Operational Resilience / Outsourcing

What Changed

• - Licensed corporations must ensure that firewall protection and network monitoring are implemented and effective across critical infrastructure, including file servers, domain controllers, email...
• Licensed corporations must maintain up‑to‑date operating systems and antivirus software, avoiding end‑of‑life or unpatched environments that materially increase vulnerability to ransomware and other...
• Firms must enforce strong user access and privileged account controls, including robust administration of system admin accounts, least‑privilege access models, periodic reviews of access rights, and...
• Firms must implement secure password management practices, prohibiting the storage of credentials in unencrypted files and enforcing strong password policies and technical controls for credential...
• Remote access must be subject to strict controls, including secure configuration of VPN or other remote access solutions, need‑to‑have access principles, and monitoring for unusual or unauthorized...

Suggested Considerations

• Conduct a comprehensive cybersecurity risk assessment and control gap analysis across all critical systems, including trading platforms, email servers, domain controllers, file servers, and accounting systems.
• Implement and regularly review firewall configurations and network monitoring tools to ensure effective protection and detection capabilities for internal and external network traffic.
• Upgrade all operating systems and antivirus software to supported, fully patched versions and establish formal patch and vulnerability management procedures with defined timelines and testing steps.
• Establish and enforce robust user access management policies, including least‑privilege access, periodic recertification of user and privileged accounts, and logging and monitoring of admin activities.
• Implement secure password management solutions and technical controls, eliminating unencrypted storage of credentials and enforcing strong password complexity, rotation, and multi‑factor authentication where applicable.

Key Dates

References

• [1] apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announce...
• [2] fxnewsgroup.com/tag/luk-fook/
• [3] apps.sfc.hk/edistributionWeb/api/circular/list-content/ci...
• [4] charltonslaw.com/legal/newsletters/574/sfc-enforcement-ac...
• [5] davispolk.com/insights/client-update/hong-kong-sfc-calls-...
• [6] apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermed...
• [7] sfc.hk/-/media/EN/files/IS/publications/Cybersecurity-the...
• [8] reuters.com/legal/litigation/hong-kong-securities-regulat...

What Changed

• - The FCA expects firms to regularly assess, test, understand, and evidence the outcomes retail customers are receiving under the Consumer Duty.
• Firms should use monitoring to identify whether any group of retail customers is experiencing different outcomes from another group for the same product and understand why those differences exist.
• Monitoring frameworks should define what good outcomes look like in practice and translate those outcomes into measurable indicators tied to the customer journey.
• Firms should not rely on broad or high-level MI alone; they must use information to challenge performance, identify risks, and drive improvements.
• Firms should be able to explain why metrics and tolerances were chosen and whether any actions taken have been tested and shown to reduce harm or friction.

Suggested Considerations

• Firms must establish and maintain a documented outcomes monitoring framework that defines good and poor customer outcomes for each relevant product or service.
• Firms must map metrics to the full customer journey, including product design, communications, customer support, and distribution arrangements.
• Firms must collect MI that can identify poor or potentially poor outcomes, root causes, and emerging risks before harm crystallises.
• Firms must document the rationale for each metric, threshold, and tolerance, including why those measures are appropriate for the customer population and product.
• Firms must maintain a clear audit trail linking MI, governance review, decisions, remediation, and outcome improvement testing.

Key Dates

References

• [1] fca.org.uk/publications/multi-firm-reviews/insurance-mult...
• [2] fca.org.uk/publications/corporate-documents/our-rule-revi...
• [3] tlt.com/insights-and-events/insight/the-fcas-expectations...
• [4] handbook.fca.org.uk/handbook/prin2a/prin2as9
• [5] youtube.com/watch?v=qEc9w7_EBsc
• [6] fca.org.uk/publication/finalised-guidance/fg22-5.pdf
• [7] square4.com/outcomes-monitoring-in-a-consumer-duty-world/
• [8] adoreboard.com/fca-consumer-duty-outcomes/

What Changed

• - The CFTC has extended the comment deadline on the RFC regarding 24/7 trading of standard futures contracts and perpetual contracts in energy markets by 30 days, moving the due date to 26 August...
• The RFC focuses on the extension of standard futures contracts, including energy futures, to a 24/7 trading schedule while keeping fixed expirations but allowing potentially material economic changes...
• The RFC separately focuses on the listing and regulation of perpetual contracts that reference physically delivered or storable energy commodities, such as crude oil, and that have no fixed...
• The Commission has added additional questions to the original RFC to probe market integrity, price formation, operational resilience, customer protections, and risk management implications of 24/7...
• The RFC builds on and is informed by the CFTC’s May 29, 2026 coordinated actions on perpetual contracts and 24/7 trading in digital commodities, including the Policy Statement on perpetual contracts,...

Suggested Considerations

• Identify and convene an internal cross‑functional working group (trading, risk, operations, compliance, legal, and IT) to assess potential impacts of 24/7 trading and energy perpetual contracts on your firm’s business model and control environment.
• Perform a gap analysis of current trading, clearing, surveillance, margin, and risk management frameworks against the operational and risk expectations articulated in recent CFTC staff advisories and policy statements on 24/7 markets and perpetual contracts.
• Draft and submit a data‑driven comment to the CFTC by 26 August 2026 addressing the RFC questions most relevant to your activities, including empirical analysis of liquidity, price formation, manipulation risk, funding rate behavior, and customer protection in energy derivatives.
• Review and update internal policies and procedures for trade surveillance, market abuse monitoring, and manipulation detection to address continuous 24/7 trading windows and any contemplated use of energy perpetual contracts.
• Assess whether current staffing models, systems support, and incident‑response processes can support 24/7 trading or clearing operations, and document enhancements or mitigations that would be needed to maintain operational resilience.

Key Dates

References

• [1] cftc.gov/PressRoom/PressReleases/9271-26
• [2] dentonscrypto.com/cftc-issues-staff-advisory-setting-expe...
• [3] bloomberg.com/news/articles/2025-04-21/cftc-seeks-input-o...
• [4] bloomberg.com/news/articles/2026-06-23/cftc-seeks-input-o...
• [5] wilmerhale.com/-/media/files/shared_content/editorial/pub...
• [6] sidley.com/en/insights/newsupdates/2025/04/the-us-cftc-lo...
• [7] complianceconcourse.willkie.com/articles/cftc-releases-pr...
• [8] jdsupra.com/legalnews/cftc-advances-framework-for-perpetu...

What Changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the two themes “European culture” and “Rivers and birds”.
• An EU‑wide online public survey has been launched to collect feedback on the shortlisted designs, forming part of the ECB’s inclusive approach to banknote design.
• The ECB’s Governing Council will select a single design proposal around the end of 2026, informed by the Design Contest Jury conclusions, technical assessments and survey results.
• The chosen design will undergo further development and testing before production, including integration of new and improved security features.
• The new series of euro banknotes will be introduced into circulation in subsequent years, alongside existing series, which will retain their legal value and continue to circulate.

Suggested Considerations

• Establish an internal project workstream to monitor ECB communications on the banknote redesign and plan for operational impacts on cash handling, ATM networks and merchant devices.
• Conduct a preliminary impact assessment of how new banknote security and design features may affect existing banknote sorting, authentication and recycling equipment, and identify likely upgrade or replacement needs.
• Engage with ATM and cash‑handling hardware vendors to understand expected firmware, sensor and software changes required to support the new banknote series and to secure upgrade slots ahead of issuance.
• Review and update internal cash‑handling and banknote authentication procedures, including staff training materials, to incorporate new design and security features once technical specifications are published.
• Plan customer communications strategies to explain the coexistence of old and new series banknotes, reaffirm the continued validity of previous series, and address any fraud or counterfeiting concerns.

Key Dates

References

• [1] ecb.europa.eu/home/html/index.en.html
• [2] banque-france.fr/en/press-release/ecb-selects-motifs-futu...
• [3] ecb.europa.eu/press/pr/date/2023/html/ecb.pr230710~77cf71...
• [4] ecb.europa.eu/euro/banknotes/future_banknotes/html/index....
• [5] bundesbank.de/en/tasks/topics/ecb-selects-motifs-for-futu...
• [6] politico.eu/article/ecb-euro-christine-lagarde-to-choose-...
• [7] ecb.europa.eu/euro/banknotes/future_banknotes/html/ecb.fa...
• [8] rte.ie/news/business/2023/1130/1419310-new-ecb-banknote-t...

What Changed

• - The CSSF demonstrates that it is prepared to impose administrative sanctions directly on members of the board of directors of electronic money institutions, not just on the institution as a legal...
• Board members of Luxembourg‑authorised electronic money institutions are now clearly exposed to personal regulatory liability for governance, risk management and safeguarding failures under the CSSF...
• This enforcement confirms that CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions is not only a formal...
• The sanction underscores CSSF expectations that the supervisory body (board of directors) must ensure sound and prudent management, continuity of the institution and protection of its reputation, and...
• The case signals a stricter enforcement posture by the CSSF towards the payments and e‑money sector, aligning its expectations and enforcement intensity more closely with bank‑equivalent governance...

Suggested Considerations

• Review and map the institution’s current governance framework, board charter and committee mandates against the detailed requirements of CSSF Circular 26/906, including central administration, board composition, responsibilities and functioning.
• Ensure that the board of directors collectively has the required expertise, independence, diversity and time commitment, and that this is documented and periodically reassessed in line with CSSF expectations.
• Update board policies to explicitly assign responsibility for strategy, risk appetite, safeguarding of client funds, information security, outsourcing, conflicts of interest and AML/CFT, and ensure these responsibilities are effectively discharged and evidenced.
• Confirm that the institution’s central administration, decision‑making centre and administrative centre are physically located in Luxembourg and that members of the management body are sufficiently present on site, as required under the governance framework.
• Establish or reinforce the “three lines of defence” model by clearly separating business units, control functions (compliance and risk) and internal audit, and ensure reporting lines to the board are independent and robust.

Key Dates

References

• [1] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [2] finconduit.com/resources/cssf-circular-26-906-emi-pi-gove...
• [3] loyensloeff.com/insights/news--events/news/circular-cssf-...
• [4] elvingerhoss.lu/insights/publications/circular-cssf-26906...
• [5] cssf.lu/en/2026/03/communication-to-the-investment-fund-i...
• [6] financialcrime.lu/2026/01/20/CSSF-Circular-26-906/

What Changed

• - The PRA proposes to delete in full the Continuity of Provision of Services Chapter in the Ring‑fenced Bodies Part of the PRA Rulebook, removing the specific ring‑fencing continuity‑of‑services...
• The PRA will make consequential amendments to the Ring‑fenced Bodies Part to remove or adjust cross‑references, defined terms and obligations that are linked to the deleted Continuity of Provision of...
• The proposal effectively retires the bespoke continuity‑of‑services construct that was introduced when ring‑fencing was implemented (including detailed constraints on termination, suspension or...
• The consultation paper explains how the PRA intends to align ring‑fenced bodies’ continuity‑of‑services expectations with existing supervisory statements on operational continuity in resolution (for...
• The PRA invites stakeholders to comment on whether deleting the Continuity of Provision of Services Chapter, and relying on the broader operational continuity regime, still adequately protects the...

Suggested Considerations

• Assess the current use of the Continuity of Provision of Services Chapter in the Ring‑fenced Bodies Part within your firm’s ring‑fencing policies, procedures, contracts and governance, and identify all controls that explicitly rely on those rules.
• Prepare and submit a considered response to CP10/26 by 14 October 2026, addressing the practical impact of deleting the Continuity of Provision of Services Chapter, any residual areas of concern, and suggestions for guidance or transitional arrangements.
• Coordinate with group entities acting as permitted suppliers or critical service providers to ensure their OCIR documentation, service catalogues, TSAs and liquidity arrangements remain aligned with the ring‑fenced body’s continuity requirements in the absence of the deleted chapter.
• Monitor for the subsequent PRA policy statement that will follow CP10/26, and be prepared to implement any final rule changes, transitional provisions or clarifications on how ring‑fencing continuity expectations intersect with OCIR and operational resilience regimes.

Key Dates

References

• [1] bankofengland.co.uk/prudential-regulation/publication/201...
• [2] bankofengland.co.uk/-/media/boe/files/prudential-regulati...
• [3] legislation.gov.uk/ukpga/2013/33/notes/division/4/data.xh...
• [4] freshfields.com/en/our-thinking/blogs/risk-and-compliance...
• [5] bankofengland.co.uk/-/media/boe/files/prudential-regulati...
• [6] regulationtomorrow.com/2015/05/the-implementation-of-ring...
• [7] bankofengland.co.uk/-/media/boe/files/prudential-regulati...

What Changed

• - A new CTP oversight regime becomes operational on 13 July 2026, under which the Bank of England, PRA and FCA will jointly supervise certain technology and service providers whose failure could...
• HM Treasury has made the first formal CTP designations: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited.
• Designated CTPs must identify and manage risks to their critical services effectively, including governance, risk management and operational resilience arrangements specifically focused on services...
• CTPs are required to maintain open, timely communication with regulators and with firms that rely on them, particularly during major incidents, implying strengthened incident reporting,...
• The three regulators will jointly oversee CTPs under a proportionate regime focused on resilience of “critical services”, including assessing and mitigating system‑level risks and reducing the risk...

Suggested Considerations

• Review and update the firm’s operational resilience framework, including impact tolerances and scenario testing, to explicitly incorporate systemic risk arising from reliance on the designated CTPs and potential correlated failures affecting multiple services or regions.
• Re‑assess outsourcing and third‑party risk management policies to ensure they clearly distinguish between obligations placed on regulated firms and those placed directly on CTPs, while maintaining robust due diligence, ongoing monitoring and exit strategies for all CTP‑hosted services.
• Engage with designated CTPs (through account management, risk and security channels) to understand their approach to compliance with the CTP regime, including incident reporting arrangements, resilience testing, communication protocols and any new assurance artifacts they plan to provide.
• Update board and senior management reporting so that reliance on designated CTPs, associated systemic risk and regulatory developments under the CTP regime are regularly monitored and discussed at appropriate governance forums (e.g. risk committee, operational resilience committee).
• Review major incident management and crisis communication playbooks to ensure they include specific escalation paths, contact points and joint incident handling procedures with designated CTPs and relevant regulators.

Key Dates

References

• [1] riskledger.com/resources/critical-third-parties-regime-tprm
• [2] kempitlaw.com/insights/uk-critical-third-parties-regime-r...
• [3] fca.org.uk/news/statements/uk-and-eu-regulators-sign-memo...
• [4] escode.com/resources/the-uk-critical-third-party-ctp-regi...
• [5] bankofengland.co.uk/financial-stability/financial-market-...
• [6] fusionrm.com/blogs/critical-third-party-resilience-regula...
• [7] aws.amazon.com/blogs/industries/what-customers-need-to-kn...
• [8] fca.org.uk/publications/policy-statements/ps24-16-operati...

What Changed

• (From the enforcement notice itself, there are no new rules; the impact is interpretative and enforcement‑related.)
• CSSF confirms that authorised electronic money institutions are subject to active supervisory and enforcement scrutiny, including public administrative sanctions for regulatory breaches.
• The sanction demonstrates that failures which may appear operational or procedural can nonetheless result in monetary fines and public naming, reinforcing the need for robust compliance frameworks in...
• The case is likely to be assessed by CSSF in light of the new governance, risk management and safeguarding expectations introduced under CSSF Circular 26/906 for payment and e‑money institutions,...
• The public nature of the sanction underscores CSSF’s use of transparency as a deterrent tool, increasing reputational risk for firms that do not comply with licensing, governance, reporting or...

Suggested Considerations

• Review the CSSF sanction against PingPong Europe S.A. and identify which categories of requirements (e.g. governance, safeguarding of client funds, reporting, outsourcing, internal controls) were implicated, then map these to your own control framework.
• Conduct a gap analysis against CSSF Circular 26/906, focusing on central administration, internal governance, risk management, and safeguarding of client funds for payment and e‑money institutions.
• Update policies, procedures and internal control documentation governing payment services, e‑money issuance, safeguarding (segregation, reconciliations), outsourcing and IT connectivity to ensure alignment with CSSF Circular 26/906.
• Ensure that a clearly designated member of the management body holds documented responsibility for oversight of safeguarding arrangements and compliance with CSSF requirements for payment and e‑money institutions.
• Implement or enhance daily reconciliations and robust segregation of client funds accounts, supported by periodic internal reviews and testing of safeguarding controls.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/S_3_EME_PingPong_Europe_S.A._0...
• [2] linkedin.com/pulse/enforcement-actions-against-private-fu...
• [3] opensanctions.org/datasets/lu_administrative_sanctions/
• [4] caceis.com/regwatch-2026/february-2026
• [5] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [6] cssf.lu/en/Document/administrative-sanction-of-2-march-2026/
• [7] cssf.lu/en/Document
• [8] international.pingpongx.com/trust-center

What Changed

• - ESMA has published an Interim Report on the effectiveness of the Active Account Requirement, covering implementation and market impact during 2025 and early 2026, and explicitly framing this as the...
• ESMA confirms that roughly 500 entities have formally notified ESMA and national competent authorities that they are subject to the AAR, indicating that competent authorities now have a defined...
• Notified entities represent more than 90% of notional outstanding held by EU entities in relevant AAR‑scope derivatives, signalling supervisory focus on a concentrated set of high‑exposure...
• ESMA identifies early signs of increased clearing activity at EU CCPs, particularly among smaller entities, including some full relocation of positions from Tier 2 CCPs to EU CCPs for AAR‑relevant...
• ESMA notes a gradual but limited shift in market shares from systemically important Tier 2 CCPs to EU CCPs in certain AAR‑related products, indicating that supervisors will monitor market‑share...

Suggested Considerations

• Confirm whether your entity (and any funds or branches) is subject to the Active Account Requirement by assessing EMIR clearing obligation status and relevant notional clearing volumes against EMIR 3 thresholds for AAR‑scope derivatives.
• Implement and document annual stress‑testing of the active account arrangements, including at least one test per year, to evidence that positions and new trades can be shifted from Tier 2 CCPs to EU CCPs under stress scenarios.
• Map and quantify exposures to Tier 2 CCPs across AAR‑relevant derivatives, and establish an internal monitoring framework to track shifts in clearing volumes between Tier 2 CCPs and EU CCPs in line with AAR objectives.
• Align trade booking, clearing workflows, and client documentation so that the required minimum number of trades per relevant subcategory and contract class can be cleared through the EU active account on an annual average basis, taking into account representativeness requirements where applicable.
• Prepare to submit the first AAR report by 31 July 2026, ensuring that systems and controls can capture and report activity from 25 June 2025 to 30 June 2026 in accordance with ESMA’s reporting templates and instructions.

Key Dates

References

• [1] linkedin.com/pulse/emir-3-esma-moves-from-principle-imple...
• [2] ashurst.com/en/insights/eu-emir-esma-publishes-guidance-o...
• [3] esma.europa.eu/press-news/esma-news/esma-releases-reporti...
• [4] esma.europa.eu/press-news/esma-news/esma-publishes-final-...
• [5] simmons-simmons.com/en/publications/cm5wo3yoj06j8tr0ksgax...
• [6] linkedin.com/posts/eurex_emir-30-active-account-requireme...
• [7] esma.europa.eu/sites/default/files/2025-12/ESMA91-1505572...
• [8] eurex.com/ec-en/rules-regs/emir3-0

What Changed

• - ESMA has clarified, through enforcement, that CRAs must ensure complete, accurate and up‑to‑date data is reported to ESMA across all relevant CRA reporting channels (including the European Rating...
• ESMA has reinforced that errors limited to regulatory reporting data (and not directly affecting published ratings) can still constitute material breaches of the CRA Regulation, demonstrating that...
• ESMA has indicated that group reporting arrangements (where one CRA entity reports on behalf of others in the group) must have clear documentation of responsibilities, validation processes, and...
• ESMA has emphasized that regulatory reporting frameworks must include robust policies, procedures and internal control mechanisms, and that deficiencies in these frameworks constitute distinct...
• ESMA has signalled that negligence, rather than intentional misconduct, is sufficient to trigger significant fines under the CRA Regulation, and that both aggravating and mitigating factors will be...

Suggested Considerations

• Conduct a comprehensive review of all ESMA‑related reporting processes to ensure that data submitted to ESMA (including rating information, historical performance data, rating changes, and other CRA regulatory reports) is complete, accurate, and kept up‑to‑date at all times.
• Map and document all responsibilities for ESMA reporting within the CRA group, ensuring that where one entity reports on behalf of others, the allocation of roles, ownership of data, and validation steps is explicitly defined, approved, and regularly reviewed.
• Perform a gap analysis of existing regulatory reporting policies, procedures, and internal control mechanisms against CRA Regulation requirements and ESMA supervisory expectations, and update documentation to remove ambiguities and outdated provisions.
• Implement or strengthen data validation and reconciliation controls over submissions to the European Rating Platform and ESMA’s central repositories, including automated checks for missing ratings, non‑withdrawn ratings, incorrect rating actions, and inconsistencies in historical performance data.
• Establish a formal governance process for changes to regulatory reporting frameworks, ensuring regular review, independent challenge by compliance or risk functions, and clear escalation routes for identified data quality issues or control failures.

Key Dates

References

• [1] fxnewsgroup.com/forex-news/regulatory/esma-imposes-e2-1m-...
• [2] esma.europa.eu/sites/default/files/2026-07/ESMA43-8572387...
• [3] mnb.hu/en/pressroom/press-releases/press-releases-2017/es...
• [4] pinsentmasons.com/out-law/news/esma-fines-moodys-in-germa...
• [5] fintech.global/2021/03/30/esma-fines-moodys-e3-7m-for-fai...
• [6] reuters.com/article/business/eu-fines-moodys-for-failing-...
• [7] finextra.com/pressarticle/86859/esma-fines-moodys-37-mill...
• [8] moodys.com/uploadpage/Mco%20Documents/SCL0042_Policy%20Re...

What Changed

• - CCIL is formally recognised as a Tier 1 third‑country central counterparty (TC‑CCP) under Regulation (EU) No 648/2012 (EMIR), allowing it to offer clearing services to EU clearing members and EU...
• The recognition is contingent on an equivalence decision adopted by the European Commission for the Indian regulatory framework applicable to CCPs under EMIR Article 25.
• ESMA has assessed and confirmed effective supervision and enforcement by the Reserve Bank of India (RBI) over CCIL as a prerequisite for recognition.
• ESMA and RBI have put in place cooperation arrangements, formalised through a Memorandum of Understanding, to support ongoing supervisory coordination over CCIL’s activities that affect EU...
• CCIL is now included in ESMA’s updated list of recognised third‑country CCPs, clarifying that EU firms may use CCIL’s clearing services while complying with EMIR’s clearing and risk‑management...

Suggested Considerations

• Confirm and document that CCIL now appears on ESMA’s official list of recognised third‑country CCPs and that its status is Tier 1 under EMIR, updating internal CCP eligibility lists and counterparty approval registers accordingly.
• Review and update internal clearing policies, procedures and governance documents to reflect that EU entities may again clear eligible products through CCIL, subject to EMIR and firm‑specific risk appetite.
• Reassess and formally approve CCIL within the firm’s CCP due‑diligence framework, including credit risk, operational risk, legal risk and jurisdictional risk assessments, taking account of the RMU with RBI and the Tier 1 classification.
• Update EMIR compliance mappings to ensure that trades cleared via CCIL are correctly treated for clearing obligation, risk‑management, reporting and collateral requirements, and that no activity is undertaken through non‑recognised CCPs in India.
• Coordinate with front‑office, clearing operations and collateral management teams to re‑open or adjust clearing access to CCIL (e.g. membership arrangements, client clearing channels, account structures, margin and collateral workflows).

Key Dates

References

• [1] ndtvprofit.com/markets/ccil-receives-esma-recognition-to-...
• [2] x.com/lakshmishaks/status/2072157632589418928
• [3] business-standard.com/amp/industry/news/ccil-secures-esma...
• [4] securitiesfinancetimes.com/securitieslendingnews/regulati...
• [5] esma.europa.eu/press-news/esma-news/esma-withdraw-recogni...
• [6] esma.europa.eu/sites/default/files/library/third-country_...
• [7] esma.europa.eu/central-counterparties/third-country-ccps
• [8] dirittobancario.it/wp-content/uploads/2022/03/Third-count...

What Changed

• - UK stablecoin issuance will be subject to a dual regulatory regime: non‑systemic stablecoins will be supervised solely by the FCA, while systemic stablecoins used for payments will be jointly...
• Issuing a qualifying sterling‑denominated stablecoin in the UK will become a regulated activity, requiring FCA authorisation for non‑bank issuers and bringing them within the FCA’s prudential,...
• HM Treasury will apply statutory systemic tests under the Banking Act (e.g. scale, interconnectedness, substitutability, impact on confidence in sterling) to decide whether a stablecoin payment...
• Once recognised as systemic, stablecoin issuers and systemic payment system providers will fall under the Bank of England’s remit under the Banking Act 2009, including powers to obtain information,...
• Systemic sterling‑denominated stablecoin issuers will be required to maintain backing reserves equal to all outstanding coins, with backing assets held on statutory trust in the UK and ring‑fenced...

Suggested Considerations

• Map all existing and planned sterling‑denominated stablecoin products against the UK’s systemic and non‑systemic regimes and assess whether their intended use in UK payments could trigger HM Treasury systemic recognition.
• Initiate or update FCA authorisation applications for stablecoin issuance and cryptoasset custody activities, ensuring business models, governance and safeguarding arrangements align with CP25/14 and the forthcoming stablecoin regime.
• Design and implement reserve‑management frameworks capable of maintaining backing assets equal to outstanding coins, in the proposed 70/30 mix between short‑term UK government debt and Bank of England deposits, with appropriate stress testing and liquidity risk oversight.
• Establish statutory trust and segregation structures for backing assets and liquid‑asset reserves, including appointing UK‑authorised third‑party custodians and aligning documentation with FCA client‑asset‑style protections and coinholder proprietary claims.
• Develop capital planning processes and ICAAP‑style assessments to meet the Bank of England’s requirements for capital against general business risk and dedicated reserves for financial risk and wind‑down costs.

Key Dates

References

• [1] fmlc.org/wp-content/uploads/2026/02/FMLC_Reponse-to-Syste...
• [2] paulhastings.com/insights/client-alerts/bank-of-england-c...
• [3] mayerbrown.com/en/insights/publications/2025/12/proposed-...
• [4] whitecase.com/insight-alert/bank-england-consults-regulat...
• [5] skadden.com/insights/publications/2025/11/bank-of-england...
• [6] bankofengland.co.uk/news/2026/june/boe-launches-policy-st...
• [7] theglobalcity.uk/PositiveWebsite/media/IRSG/240208_RESPON...
• [8] fca.org.uk/publications/consultation-papers/cp25-14-stabl...

What Changed

• - The RPIB has opened a consultation to develop a high‑level “blueprint” for the future UK retail payments infrastructure, which will underpin the National Payments Vision and inform the design to be...
• The consultation scope explicitly covers payment journeys, key design choices and priorities for the next‑generation infrastructure, rather than setting immediate prescriptive rules for firms.
• The next‑generation infrastructure is intended to support new payment methods, including account‑to‑account payments at the point of sale (in‑store and online) as a complement to card payments, and...
• Existing retail interbank payment systems (Faster Payments, Bacs, Image Clearing System) operated by Pay.UK will continue to run safely and resiliently during the transition, implying a multi‑year...
• The new infrastructure is being designed to support a multi‑money ecosystem, including existing commercial bank money and emerging forms of digital money (e‑money, tokenised deposits, systemic...

Suggested Considerations

• Identify internal stakeholders (payments product, technology, operations, legal, compliance, risk) and establish a formal project to coordinate your firm’s response to the RPIB consultation.
• Perform a gap analysis of your firm’s current use of Faster Payments, Bacs and cheque imaging, focusing on account‑to‑account capabilities, cross‑border flows, fraud and financial crime controls, customer authentication and operational resilience.
• Map and document key payment journeys relevant to your firm (e.g. point‑of‑sale account‑to‑account payments, bill payments, peer‑to‑peer transfers, ecommerce, cross‑border transactions) to enable substantive feedback on user needs and design priorities.
• Assess your firm’s strategic interest in account‑to‑account payments at the point of sale and enhanced cross‑border services, and identify functional requirements (APIs, messaging, reconciliation, chargeback‑like protections) that should be reflected in the consultation response.
• Review emerging regulatory publications under the National Payments Vision and Payments Forward Plan to ensure your consultation input aligns with expected regulatory outcomes on access, competition, resilience and innovation.

Key Dates

References

• [1] bankofengland.co.uk/payment-and-settlement/the-national-p...
• [2] gov.uk/government/publications/national-payments-vision/n...
• [3] bankofengland.co.uk/payment-and-settlement/the-national-p...
• [4] twobirds.com/en/insights/2025/uk/a-new-strategy-announced...
• [5] assets.publishing.service.gov.uk/media/699f2bc6c497bac082...
• [6] linkedin.com/posts/nuala-jackson_payments-vision-delivery...
• [7] ukfinance.org.uk/system/files/2026-03/Future%20Retail%20P...
• [8] globalgovernmentfinance.com/bank-of-england-external-enga...

What Changed

• - The Bank of England has published a policy statement “Sterling‑denominated systemic stablecoins” (22 June 2026) and a draft Code of Practice that will constitute the primary rulebook for systemic...
• The regime applies only to systemic sterling‑denominated stablecoins used for UK payments, i.e. stablecoins recognised as systemic under Banking Act 2009 tests where disruption could threaten UK...
• The previous proposal that at least 40% of backing assets be unremunerated central bank deposits and up to 60% in short‑term UK government debt has been revised so that up to 70% of backing assets...
• Backing assets must remain highly liquid and low‑risk, with central bank deposits used explicitly to support prompt redemption in stress, while the expanded gilt component is intended to improve the...
• The BoE has dropped the earlier concept of temporary per‑holder limits (for example, £20,000 per individual and £10 million per business that were consulted on in 2025) and replaced them with a...

Suggested Considerations

• Conduct a regulatory perimeter and recognition analysis to determine whether any issued or planned sterling‑denominated stablecoin could meet the Banking Act 2009 systemic tests and therefore fall under the BoE systemic stablecoin regime.
• Review and update treasury and investment policies for stablecoin backing assets to ensure the portfolio structure can comply with the revised requirement of up to 70% short‑term UK government debt and the remainder in BoE deposits.
• Perform detailed liquidity and redemption stress‑testing to evidence that central bank deposits and gilt portfolios can support prompt redemption under extreme but plausible scenarios while remaining within the £40 billion issuance guardrail.
• Re‑calibrate business plans and revenue models for systemic stablecoin issuance to reflect the increased allowable share of interest‑bearing gilts, the absence of per‑holder limits, and continued constraints on paying interest to coinholders.
• Design and implement governance and risk‑management frameworks that meet BoE expectations for systemic payment systems, including Board‑level oversight, risk appetite for digital money, and clear accountability for prudential and operational risks.

Key Dates

References

• [1] skadden.com/insights/publications/2025/11/bank-of-england...
• [2] uk.finance.yahoo.com/news/bank-of-england-uk-stablecoin-t...
• [3] whitecase.com/insight-alert/bank-england-consults-regulat...
• [4] bankofengland.co.uk/paper/2025/cp/proposed-regulatory-reg...
• [5] mayerbrown.com/en/insights/publications/2025/12/proposed-...
• [6] reuters.com/business/finance/bank-england-faces-calls-uk-...
• [7] linkedin.com/posts/bank-of-england_today-we-have-publishe...
• [8] mofo.com/resources/insights/251203-uk-proposes-regulating...

What Changed

• - Supervisory expectations are raised for standardisation and reduction of fragmentation in CCP default-management procedures and communication conventions, with a strong push toward harmonised...
• Lead authorities explicitly promote greater use of portal-based solutions (rather than ad hoc email or bespoke channels) for communication, information sharing, and auction-related workflows between...
• Authorities call for more realistic testing of porting arrangements, including end-to-end operational tests that reflect real-life constraints (documentation, client consent, timing of transfers, and...
• The lead authorities propose considering a voluntary “market stress overlay” module in future CIDS exercises, creating a coherent cross-CCP macro stress scenario to test whether operational capacity...
• ESMA confirms that global CCP fire drills are now a core component of system-wide resilience expectations, effectively embedding regular multi-CCP default simulations into ongoing supervisory...

Suggested Considerations

• CCPs should review and update their default management procedures to align with emerging cross-CCP standards, including harmonised communication conventions, standardised information templates, and coordinated auction timelines.
• Clearing members should conduct a cross-CCP gap analysis of their default-management playbooks to ensure they can support simultaneous auctions and calls from multiple CCPs without creating operational bottlenecks.
• CCPs and clearing members should implement or upgrade portal-based communication and workflow tools for default events, replacing fragmented email- or spreadsheet-based processes where feasible.
• Clearing brokers and client-clearing firms should test and, where necessary, redesign their porting arrangements (including client consent, documentation, booking models, and operational capacity) to ensure they can port positions and collateral under stressed but realistic timelines.
• Risk and operations teams at CCPs and clearing members should incorporate findings from the 2023 and 2025 CIDS exercises into their internal default-management training, drills, and board reporting on operational resilience.

Key Dates

References

• [1] posttrade360.com/news/infrastructure/follow-up-report-esm...
• [2] bankofengland.co.uk/paper/2026/2025-ccp-global-internatio...
• [3] esma.europa.eu/sites/default/files/2024-04/ESMA91-1505572...
• [4] ccp-global.org/defaultsimulation
• [5] esma.europa.eu/press-news/esma-news/esma-and-eu-ccps-part...
• [6] securitiesfinancetimes.com/securitieslendingnews/industry...
• [7] eurex.com/ec-en/find/circulars/clearing-circular-4426338
• [8] linkedin.com/posts/post-trade-360_esma-and-eu-ccps-comple...

What Changed

• - The FCA will introduce a new overarching rule requiring that all UK‑domiciled MMFs must hold sufficient liquidity for “adequate resilience”, explicitly linking fund liquidity to financial stability...
• The FCA will retain the current minimum WLA requirements from the existing UK Money Market Fund Regulation (UK MMFR) in its rules, instead of the previously consulted increases to 50% WLA for all...
• The FCA will issue guidance setting out strong supervisory expectations that stable NAV MMFs should hold 40% WLA and variable NAV MMFs should hold 20% WLA to meet the new resilience requirement,...
• The FCA makes clear that falling below the 40%/20% WLA supervisory expectations should only occur to meet redemption requests or due to factors beyond the manager’s control, and should be rare, with...
• The FCA will retain existing minimum daily liquid asset (DLA) requirements from UK MMFR in rules and does not plan to issue new guidance on DLA levels, but expects DLA and WLA together to be...

Suggested Considerations

• Conduct a comprehensive gap analysis comparing current MMF liquidity management frameworks (DLA, WLA, and stress‑testing assumptions) against the forthcoming FCA “adequate resilience” rule and the 40% (stable NAV) / 20% (variable NAV) WLA supervisory expectations.
• Update MMF liquidity policies, board‑approved risk appetites, and internal limits to reflect the new WLA expectations, including documentation of when and how funds may temporarily operate below 40%/20% WLA and the governance required to approve such deviations.
• Implement enhancements to liquidity monitoring and MI reporting so that portfolio managers, risk, and compliance have near‑real‑time visibility of DLA and WLA levels, breaches of internal and supervisory thresholds, and redemption‑driven use of liquidity buffers.
• Review and update fund prospectuses, KIIDs/KIDs, and investor disclosures to ensure that descriptions of MMF liquidity management, the availability of liquidity management tools, and the operation of stable NAV structures are accurate under the new FCA regime.
• Revise and strengthen investor KYC procedures for MMFs to capture concentration risks and potential correlated outflows, including segmentation of investor types, monitoring of large holders, and scenario analysis around key client redemption behaviour.

Key Dates

References

• [1] jdsupra.com/legalnews/uk-to-reform-money-market-fund-7624...
• [2] assets.publishing.service.gov.uk/media/6a059b2622977ebc82...
• [3] fca.org.uk/publication/consultation/cp23-28.pdf
• [4] theia.org/sites/default/files/2024-03/FCA_CP23_28_MMF_IAR...
• [5] gov.uk/government/publications/reforms-to-money-market-fu...
• [6] immfa.org/publications/consultations-and-responses.html

What Changed

• - The Bank of England and FCA confirm, following consultation with FMIs over the last 12 months, that the existing MoU framework for supervisory cooperation on financial market infrastructures...
• The authorities explicitly reaffirm their commitment to efficient coordination to enhance the effectiveness of supervision, signalling continued emphasis on timely, accurate and proactive information...
• The statement maintains, rather than revises, the current allocation of responsibilities between the Bank of England (as primary prudential and systemic supervisor for FMIs) and the FCA (as conduct,...
• The authorities confirm the continuation of an annual review process of the MoU, including consultation with supervised FMIs to obtain feedback on how coordination is working in practice, embedding...
• The publication sits alongside the underlying 2025 MoU text (and the broader multi‑regulator MoU framework with FCA, PRA and PSR), reinforcing that FMIs should align their governance, reporting and...

Suggested Considerations

• Confirm internally that your firm’s regulatory engagement framework recognises the Bank of England–FCA MoU and clearly allocates responsibilities for managing relationships with both authorities in line with their respective roles.
• Review and, where necessary, update internal regulatory communications and escalation procedures to ensure that information relevant to both the Bank of England and FCA can be shared consistently, accurately and on a timely basis, in anticipation of coordinated supervisory expectations.
• Prepare to continue providing structured, constructive feedback during the annual MoU review process by maintaining records of supervisory interactions with each authority, including instances of overlap, gaps, or divergent expectations.
• Align incident management, operational resilience and major change approval processes with the expectation that both authorities may need to be informed and coordinated, and verify that notification playbooks and contact trees reflect this dual‑regulator structure.
• For groups operating multiple FMIs or cross‑border infrastructures, map where other regulators rely on the Bank of England/FCA supervisory cooperation (for example, via substituted compliance or recognition regimes) and integrate this into your global regulatory engagement strategy.

Key Dates

References

• [1] securitiesfinancetimes.com/securitieslendingnews/industry...
• [2] fca.org.uk/news/statements/bank-england-fca-mou-supervisi...
• [3] ey.com/content/dam/ey-unified-site/ey-com/en-uk/insights/...
• [4] mondovisione.com/media-and-resources/news/bank-of-england...
• [5] cms.law/en/gbr/regulatory-news/boe-fca-mou-on-the-supervi...
• [6] bankofengland.co.uk/-/media/boe/files/memoranda-of-unders...
• [7] psr.org.uk/media/mdfep01b/mou-the-bank-fca-psr-pra-june-2...
• [8] cliffordchance.com/content/dam/cliffordchance/briefings/2...

What Changed

• - Bank of England Statistics Taxonomy v1.3.1 replaces v1.3.0 for statistical reporting under the BoE Statistics Taxonomy framework.
• The new taxonomy applies to LIVE submissions of end‑May data due from mid‑June 2026, meaning firms must generate those returns using v1.3.1.
• Reporting requirements and published definition documents remain unchanged, with the update limited to technical implementation changes (validation fixes, data point model changes and related...
• Taxonomy v1.3.1 is not backwards compatible with v1.3.0, so XBRL instance documents created under v1.3.0 will not be valid for submission once v1.3.1 is in force.
• Filing indicators are standardised across statistics reporting and now follow the format XX.XX.XX (for example, FI.01.01), requiring alignment of internal mapping and validation rules.

Suggested Considerations

• Update internal reporting systems, data integration layers and XBRL engines so that all relevant BoE statistical returns are generated using Statistics Taxonomy v1.3.1 for end‑May 2026 reporting onwards.
• Review and update all XBRL instance document templates and configuration to ensure they reference the correct v1.3.1 entry points and filing indicators (XX.XX.XX format, e.g. FI.01.01).
• Decommission or phase out any dependency on the BoE Statistical Utility tool, and implement an alternative XBRL generation solution (recognised software provider or internal tooling) capable of producing valid v1.3.1 files.
• Conduct a detailed review of the BoE‑published change log, taxonomy package, sample files and XBRL filing manual to understand validation changes, DPM updates and implementation nuances that could cause submission failures.
• Schedule and complete end‑to‑end testing in the BEEDS UAT environment (where available) and in internal test environments to validate that v1.3.1 submissions pass all technical and business validations.

Key Dates

References

• [1] bankofengland.co.uk/statistics/notice/2026/statistical-no...
• [2] bankofengland.co.uk/statistics/notice/2025/statistical-no...
• [3] bankofengland.co.uk/statistics/data-collection/statistica...
• [4] whistlebrook.co.uk/april-2025-regulation-update/
• [5] bankofengland.co.uk/statistics/notice/2026/statistical-no...
• [6] bankofengland.co.uk/statistics/notice/2026/statistical-no...
• [7] xbrl.org/news/bank-of-england-publishes-final-statistical...
• [8] einpresswire.com/article/915224460/statistical-notice-202...

What Changed

• - The ESAs have operationalised Article 22(2) DORA by issuing the first annual overview of major ICT‑related incidents, confirming that yearly ESA‑level aggregation and analysis of incident data is...
• Incident reporting under DORA is now demonstrably harmonised and centralised, with major ICT‑related incidents being notified to all competent authorities involved and then aggregated by the ESAs for...
• The report confirms that cross‑border incidents are prevalent (around one third of major incidents), reinforcing that the “borderless and interconnected” nature of ICT risk is a key supervisory...
• System failures and external events, rather than pure cyber‑attacks, are identified as the main drivers of major incidents, placing regulatory emphasis on ICT change management, resilience of core...
• The ESAs highlight third‑party and outsourcing risk as a core theme, stressing the need for robust oversight of ICT service providers and close coordination with them during incident response and...

Suggested Considerations

• Review and, where necessary, recalibrate internal incident classification criteria against the DORA definition of “ICT‑related incident” and “major ICT‑related incident”, ensuring consistency with applicable RTS on classification and materiality thresholds.
• Validate that your firm’s incident management and escalation processes can identify, assess and classify incidents “without undue delay” and trigger major‑incident reporting within the prescribed timelines (initial, intermediate and final reports).
• Conduct a gap analysis of cross‑border incident handling, ensuring that governance, communication and coordination arrangements adequately address incidents affecting multiple Member States or shared cross‑border infrastructures.
• Strengthen third‑party and outsourcing risk management by mapping critical and important functions to their supporting ICT service providers, and ensuring contracts, SLAs and incident‑response clauses support DORA reporting and cooperation obligations.
• Test and, if needed, enhance incident response runbooks to ensure close coordination with ICT service providers during incident containment, remediation and recovery, including clear roles for data provision required for regulatory reporting.

Key Dates

References

• [1] regulation-dora.eu/dora-incident-reporting
• [2] centralbank.ie/regulation/digital-operational-resilience-...
• [3] fma.gv.at/en/cross-sectoral-topics/dora/dora-ict-related-...
• [4] dilitrust.com/prepare-dora-compliance/
• [5] bdo.com.mt/en-gb/insights/dora-rts-its-reporting-template...
• [6] digital-operational-resilience-act.com
• [7] esma.europa.eu/press-news/esma-news/esas-publish-study-fe...
• [8] ispartnersllc.com/blog/dora-compliance/

What Changed

• - The Bank has opened a consultation on selecting four distinct native wildlife images for the central design of the next series of banknotes, one for each denomination from £5 to £50.
• The eligible imagery is limited to a published shortlist; the Bank is not seeking alternative nominations and will only consider animals on that list.
• The shortlist spans mammals, birds, and amphibians/insects/fish, reflecting the Bank’s intent to represent different UK environments across the banknote set.
• The Bank will select up to two examples from each category in the consultation, but the final selection may not match the highest-voted options.
• The Bank will retain a portrait of the monarch on the next series, alongside additional wildlife and nature elements.

Suggested Considerations

• Review internal cash and branch readiness plans to account for a future change to the visual appearance of UK banknotes.
• Monitor the Bank of England’s consultation outcomes so denomination-specific handling, ATM, sorting, and authentication procedures can be updated in time.
• Update customer communications and frontline scripts to reflect that the next series will feature wildlife imagery, while retaining the monarch’s portrait.
• Validate that note-recognition, counterfeit-detection, and cash-acceptance systems can accommodate new denomination designs once specifications are released.
• Track the Bank’s second consultation in summer 2026 if your organisation relies on cash logistics, cash processing, or public education materials.

Key Dates

References

• [1] bankofengland.co.uk/banknotes/help-us-design-our-next-ser...
• [2] bankofengland.co.uk/news/2026/march/wildlife-feature-on-n...
• [3] zsl.org/news-and-events/feature/why-bank-englands-future-...

What Changed

• - CSSF is requiring market participants to complete the national competent authorities’ T+1 readiness survey by 9 June 2026, with responses visible only to CSSF and ESMA.
• CSSF is strongly encouraging participation in the EU T+1 Industry Committee second readiness survey to support a Union-wide assessment of market preparedness.
• CSSF is flagging that the transition to T+1 settlement on 11 October 2027 under CSDR will require coordinated changes across the trading and post-trading chain.
• CSSF is warning that forthcoming amendments to the RTS on Settlement Discipline are expected to be endorsed by the European Commission and will further define operational requirements for the T+1...
• ESMA’s revised guidelines on standardised procedures and messaging protocols are intended to make post-trade communication faster, clearer, and more consistent across the EU.

Suggested Considerations

• Complete the CSSF T+1 readiness survey before 9 June 2026 and ensure the submission accurately reflects the firm’s current operational readiness.
• Participate in the EU T+1 Industry Committee second readiness survey to demonstrate engagement with the EU-wide readiness process.
• Review the firm’s allocation and confirmation workflows to ensure they can operate within T+1 timeframes.
• Replace any reliance on oral, manual, or non-machine-readable communications with electronic, standardised messaging channels unless a temporary technical disruption justifies an exception.
• Align internal messaging standards with international messaging protocols used for post-trade communication.

Key Dates

References

• [1] fisglobal.com
• [2] nuvei.com
• [3] bankingcircle.com
• [4] fintechweekly.com/fintech-companies/
• [5] ripple.com
• [6] thefopro.com/deal-round-up-family-offices-fund-fintech-pl...
• [7] bis.org/fsi/publ/insights33.pdf
• [8] mercury.com

What Changed

• - The EU settlement cycle for in‑scope financial instruments under CSDR will shorten from T+2 to T+1 with effect from 11 October 2027, materially reducing the time to complete front‑to‑back trade,...
• CSSF has launched a national competent authorities’ T+1 readiness survey and sets a firm completion deadline of 9 June 2026 for Luxembourg market participants, treating it as a critical supervisory...
• In parallel, CSSF strongly encourages Luxembourg firms to complete the EU T+1 Industry Committee (EUIC) second readiness survey to support an EU‑wide view of T+1 readiness and potential systemic...
• ESMA’s final draft amendments to the CSDR RTS on Settlement Discipline will introduce additional operational requirements specifically designed to support T+1 (e.g.
• ESMA has launched a consultation on updated guidelines on standardised procedures and messaging protocols for allocations, confirmations and affirmations, explicitly aimed at facilitating the T+1...

Suggested Considerations

• Identify all group entities and business lines in Luxembourg that are in scope of CSDR T+1 (trading, clearing, settlement, custody, collateral, fund dealing) and formally designate a T+1 programme owner at senior management level.
• Complete the CSSF T+1 national competent authorities’ survey in full and by 9 June 2026, ensuring that responses accurately reflect current readiness, key risks, dependencies on third parties, and planned remediation milestones.
• Arrange for appropriate internal review and sign‑off (e.g. by Compliance and relevant senior management) of the responses to both the CSSF survey and the EUIC second readiness survey before submission.
• Participate in the EU T+1 Industry Committee second readiness survey and ensure the firm’s answers are consistent with the information provided to CSSF and with internal T+1 project documentation.
• Perform a comprehensive T+1 impact assessment of front‑to‑back trade flows, covering trade execution, allocation, confirmation, affirmation, clearing, settlement, collateral movements, cash and liquidity management, and corporate actions.

Key Dates

References

• [1] ey.com/en_lu/insights/wealth-asset-management/luxembourg-...
• [2] cssf.lu/en/2026/06/reminder-of-the-importance-of-particip...
• [3] fca.org.uk/markets/about-t1-settlement
• [4] cssf.lu/en/t1-settlement-preparing-for-the-future-of-euro...
• [5] esma.europa.eu/esmas-activities/markets-and-infrastructur...
• [6] cssf.lu/en/reporting-to-be-submitted-by-ucis/
• [7] kroll.com/en/publications/financial-compliance-regulation...
• [8] icmagroup.org/market-practice-and-regulatory-policy/repo-...

What Changed

• - ESMA is advancing the simplification of EU reporting frameworks for funds and transaction reporting, indicating upcoming changes to reporting templates, data fields and/or reporting channels under...
• ESMA has launched its sixth EU‑wide stress test exercise for Central Counterparties (CCPs), expanding supervisory scrutiny of CCP risk management, default management processes and resilience to...
• ESMA has published guidance on the effective use of resolution tools in CCP crisis planning, clarifying expectations for CCP resolution planning, coordination with resolution authorities and use of...
• ESMA has issued reporting templates and instructions for the Active Account Requirement under EMIR 3, operationalising new obligations for counterparties and CCPs to maintain and report active...
• ESMA has published a call for evidence on the structure of European equity markets, opening a policy workstream that may lead to changes in market structure, transparency, and best execution...

Suggested Considerations

• Map your firm’s current EMIR, MiFIR and fund reporting obligations against ESMA’s stated objective of simplifying EU reporting frameworks and begin scenario‑planning for changes to templates, data models and validation rules.
• For CCPs and clearing members, review participation in the sixth ESMA CCP stress test, ensure timely and accurate data delivery, and assess internal implications of potential stress test findings for risk management frameworks.
• CCPs should compare existing recovery and resolution plans and playbooks against ESMA’s new guidance on effective use of resolution tools, updating governance, triggers, communications and coordination arrangements with resolution authorities.
• Counterparties and CCPs in scope of EMIR 3 should identify products and business lines affected by the Active Account Requirement and begin implementing systems, processes and controls to populate ESMA’s reporting templates and instructions.
• Investment firms active in equity markets should respond to ESMA’s call for evidence on European equity market structure where appropriate, and internally assess potential impacts on best execution, order routing, internalisation and transparency obligations.

Key Dates

References

• [1] esma.europa.eu/press-news/esma-news/esma-publishes-latest...
• [2] esma.europa.eu/press-news/esma-news/esma-outlines-enforce...
• [3] esma.europa.eu/press-news/esma-news/esma-identifies-areas...
• [4] youtube.com/watch?v=NY5CU84kj78
• [5] complianceweek.com/europe/esma-statement-supports-smooth-...
• [6] esma.europa.eu/news-publications/newsletter
• [7] esma.europa.eu/form/newsletter
• [8] esma.europa.eu/press-news/esma-news

What Changed

• - The SFC reiterates that licensed corporations must maintain required liquid capital at all times under the Securities and Futures (Financial Resources) Rules (FRR), and any deficit (even if later...
• The enforcement confirms that firms are strictly accountable for the accuracy of financial returns submitted under the FRR, including where preparation and compilation are outsourced to external...
• The SFC clarifies that external service providers involved in financial returns and FRR compliance must be demonstrably competent and possess relevant FRR knowledge and experience, and that licensed...
• The case reinforces that internal staff responsible for FRR reporting must be adequately trained and familiar with FRR requirements, with effective review and challenge processes before submissions...
• The SFC confirms that transferring client money from segregated client accounts to overseas brokers’ accounts requires a valid written direction or standing authority from the client in accordance...

Suggested Considerations

• Review and, where necessary, update internal policies and procedures to ensure continuous compliance with the Securities and Futures (Financial Resources) Rules, including robust controls over capital monitoring and financial return preparation.
• Implement or enhance daily (or more frequent, as appropriate) capital monitoring processes that detect and escalate any actual or potential liquid capital deficits before they arise and ensure timely remedial action.
• Conduct a comprehensive review of all external service providers involved in financial reporting, prudential calculations, and FRR returns to verify and document their competence, relevant experience, and FRR knowledge, and update outsourcing due diligence criteria accordingly.
• Establish or strengthen formal governance and oversight frameworks for outsourced finance functions, including clear accountability, documented review of work performed, periodic quality assessments, and rights of audit.
• Provide targeted FRR training to finance, compliance, and relevant front‑office staff so they understand FRR calculations, common error types, and their responsibilities in reviewing and approving FRR returns before submission.

Key Dates

References

• [1] fxnewsgroup.com/forex-news/regulatory/hk-regulator-impose...
• [2] scmp.com/business/banking-finance/article/2019361/sfc-fin...
• [3] charltonslaw.com/sfc-reprimands-and-fines-hsbc-hk2-5-mill...
• [4] apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announce...
• [5] wealthbriefingasia.com/article.php/Hong-Kong's-SFC-Raps-D...
• [6] fxnewsgroup.com/forex-news/regulatory/hk-watchdog-fines-i...
• [7] sfc.hk/edistributionWeb/gateway/EN/news-and-announcements...
• [8] hkma.gov.hk/eng/news-and-media/press-releases/2025/08/202...

What Changed

• - ESMA confirms measurable data quality improvements across EMIR, SFTR, MiFIR, AIFMD and MMFR regulatory datasets, indicating that regulators now consider these data sufficiently reliable for...
• ESMA highlights extensive and growing supervisory use of regulatory data by ESMA and NCAs for investor protection, financial stability, orderly markets and market integrity, increasing the...
• The scope of the annual data quality and use report is expanded to include Prospectus reporting obligations, bringing prospectus‑related data formally into ESMA’s cross‑regime data quality scrutiny.
• The report scope is also expanded to include ICT‑related incident reporting under the Digital Operational Resilience Act (DORA), signaling that operational resilience incident data will be monitored...
• ESMA has launched a 2025 Call for Evidence on streamlining reporting across EMIR, MiFIR and SFTR, including options to remove duplications and apply a “report once” approach, which will likely lead...

Suggested Considerations

• Map all existing regulatory reporting obligations across EMIR, SFTR, MiFIR, AIFMD, MMFR, Prospectus and DORA ICT‑incident reporting, and document the underlying data sources, systems and ownership for each regime.
• Review and enhance data quality controls for EMIR, SFTR and MiFIR reporting, including validation rules, completeness checks, reconciliations, pairing and matching processes, and governance around Unique Transaction Identifiers and counterparty data.
• Perform a gap analysis of Prospectus reporting and DORA ICT‑incident reporting processes against ESMA’s emerging cross‑regime data quality expectations and ensure they are covered in the firm’s enterprise data governance framework.
• Establish or update a centralised regulatory data governance framework that explicitly covers cross‑regime consistency (for example, trade and position data alignment between EMIR, SFTR and MiFIR) and defines clear accountability at senior management level.
• Engage with internal IT and reporting teams to identify where a future “report once” model could be supported technically, including harmonised reference data, common identifiers and golden‑source transaction and position records.

Key Dates

References

• [1] kaizenreporting.com/esma-data-quality-progress-2024-annua...
• [2] esma.europa.eu/press-news/esma-news/esma-report-shows-inc...
• [3] spglobal.com/market-intelligence/en/news-insights/researc...
• [4] esma.europa.eu/sites/default/files/2025-04/ESMA12-1209242...
• [5] cms.law/en/int/regulatory-news/esma-annual-assessment-of-...
• [6] youtube.com/watch?v=NY5CU84kj78
• [7] esma.europa.eu/esmas-activities/data
• [8] esma.europa.eu/sites/default/files/2026-05/ESMA32-2064178...

What Changed

• - ESMA proposes revised Guidelines on standardised procedures and messaging protocols for allocations and confirmations under CSDR Settlement Discipline, specifically to support the transition to a...
• The guidelines will mandate the use of electronic, standardised communication channels for post‑trade allocations and confirmations, moving away from mixed paper / manual practice to fully electronic...
• Firms will be required to use international messaging standards (e.g. ISO‑based protocols) for post‑trade communication, to ensure interoperability and faster straight‑through processing across EU...
• The guidelines remove references to non‑electronic and non‑machine‑readable methods, including oral allocations and confirmations, except where there is a temporary technical disruption that prevents...
• The revisions are explicitly aligned with ESMA’s Final Report on Amendments to the CSDR RTS on Settlement Discipline, which introduce same‑day timing for allocations and machine‑readable formats for...

Suggested Considerations

• Map all current allocation and confirmation workflows and identify any use of non‑electronic, non‑standardised or non‑machine‑readable communication (including email attachments, faxes, PDFs, and oral instructions).
• Develop and execute a remediation plan to replace manual or oral allocation and confirmation processes with fully electronic, machine‑readable workflows using recognised international messaging standards.
• Review and update front‑to‑back trade processing systems (OMS, EMS, middle‑office, back‑office, matching engines) to ensure they can generate, receive and process standardised electronic allocation and confirmation messages within same‑day T+1‑compatible timelines.
• Engage with CSDs, custodians, brokers, counterparties and third‑party vendors to confirm their roadmap and readiness for the mandated electronic standards and to align implementation timelines to the 7 December 2026 application date.
• Update contractual documentation with clients and counterparties (including terms of business and service level agreements) to incorporate obligations for electronic, standardised, machine‑readable allocations and confirmations and to remove reliance on manual methods except as contingency.

Key Dates

References

• [1] esma.europa.eu/press-news/esma-news/esma-proposes-key-ref...
• [2] gfma.org/wp-content/uploads/2023/12/esma_cp1_sett_gfmas-g...
• [3] icmagroup.org/News/news-in-brief/icma-responds-to-esmas-c...
• [4] esma.europa.eu/esmas-activities/markets-and-infrastructur...
• [5] marketsmedia.com/esma-proposes-settlement-reforms-for-t1/
• [6] cssf.lu/en/t1-settlement-preparing-for-the-future-of-euro...
• [7] esma.europa.eu/sites/default/files/2025-06/High-level_Roa...
• [8] esma.europa.eu/sites/default/files/2025-10/ESMA74-2119945...