Payments & E-Money

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying ictrisksupervision@cssf.lu by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing ictrisksupervision@cssf.lu when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

2026-05-22

Switzerland added 115 natural persons and organisations to its Russia-related sanctions list; approximately 2,790 persons, companies, and organisations are now subject to asset freezes in connection with Russia’s war against Ukraine.

2026-08-19

The Federal Council decided to adopt the further measures of the EU’s 20th Russia sanctions package according to Switzerland’s established practice.

2026-08-20 Deadline

The new measures entered into force, including the prohibition on using Russian platforms for crypto-asset transfers and exchanges and the prohibition on supporting development of specified Russian crypto-assets such as the digital rouble.

Suggested considerations

• Firms should consider updating sanctions screening rules, prohibited-platform lists, wallet and counterparty controls, and transaction-monitoring scenarios to identify Russian crypto-asset platforms and indirect use of those platforms.
• Crypto-asset firms should consider mapping all transfer, exchange, custody, brokerage, technical-support, wallet-access, and infrastructure services against the applicable provisions of the Ordinance on Measures connected with the Situation in Ukraine, including the newly prohibited Russian platforms and specified Russian crypto-assets.
• Compliance teams may wish to review exposure to the digital rouble and other Russian or rouble-linked crypto-assets, including holdings, listings, liquidity provision, development support, transfers, and third-party integrations, and document any required exit or blocking decisions.
• Firms should consider validating that assets of sanctioned natural persons, companies, and organisations are blocked and that affected business relationships are reported to SECO in accordance with the sanctions ordinance.
• Firms should consider establishing or refreshing procedures for prompt escalation of sanctions-related suspicions, including additional clarifications under Article 6 GwG and an immediate Article 9 GwG report to the Money Laundering Reporting Office where suspicions cannot be dispelled.
• Senior compliance and operations owners may wish to evidence implementation from 2026-08-20 through control attestations, blocked-transaction testing, vendor and platform due diligence, and documented review of open Russian-related relationships.

What changed

The Switzerland-Russia sanctions regime now prohibits the use of Russian platforms for crypto-asset transfers and exchanges, targeting alternative payment channels that could facilitate sanctions circumvention. It also prohibits support for the development of specified Russian crypto-assets, including the digital rouble; independent market commentary places this measure alongside restrictions concerning Russian crypto-asset service providers, sanctioned trading venues, wallet or account access, technical assistance, and certain rouble-backed assets such as RUBx and A7A5, although the FINMA...

Key dates

2021-01-01

The FCA’s permanent restriction on marketing speculative illiquid securities, including relevant mini-bonds and loan notes, to retail investors took effect under COBS 4.14.

2026-01-01

The UK regime regulating offers of securities to the public came into force under the Public Offers and Admissions to Trading Regulations 2024.

2026-07-16

Robert Goodhew and Andrew Stoneman of Kroll Advisory were appointed joint administrators of Woodville Consultants Ltd.

2026-08-20

The FCA publication was updated and warned consumers and market participants about risky mini-bonds, loan notes and related financial promotions.

Suggested considerations

• Compliance teams should inventory current and proposed promotions, introducer arrangements and distribution channels involving loan notes, mini-bonds, litigation funding, private credit or other potentially speculative illiquid securities.
• Firms should document the classification analysis under FCA COBS 4.14, including whether the security is speculative and illiquid, whether it is excluded from the restriction, and the precise exemption relied upon for any retail communication.
• Authorised firms should verify that every financial promotion is made or approved within the firm’s permission and competence, is fair, clear and not misleading under FCA Principle 7 and COBS 4, and contains sufficiently prominent explanations of capital-loss, liquidity, issuer-default and compensation-scheme risks.
• Firms should not rely solely on an investor’s self-certification as a high-net-worth or sophisticated investor; compliance teams may wish to test the basis, timing, wording and evidence for each investor-status declaration against the applicable Financial Promotion Order exemptions.
• Banks, payment firms and professional intermediaries should consider enhanced onboarding and transaction-monitoring controls for unusual high-yield investment flows, unexplained introducer commissions, overseas exchange references, trust structures and claims of FCA-regulated involvement that may create a misleading halo effect.
• Distribution agreements should clearly identify fees, commissions, conflicts and the party responsible for the promotion, with controls to prevent unauthorised introducers from soliciting UK retail investors or passing them to unauthorised issuers.
• Firms should assess whether a proposed public offer engages the Public Offers and Admissions to Trading Regulations 2024 and related FCA requirements, while treating that assessment as separate from financial-promotion, authorisation, conduct and investor-protection analysis.
• Relevant firms and professional intermediaries should retain evidence of due diligence, approvals, investor categorisation, risk disclosures, payment flows and complaints handling, and consider reporting suspicious activity or unlawful promotions to the FCA.

What changed

The FCA has reiterated that speculative illiquid securities, including most mini-bonds and loan notes, have been subject to a permanent restriction on their marketing to retail investors since 1 January 2021 under FCA COBS 4.14. The restriction does not make every loan note unlawful or bring every issuer within FCA authorisation; firms must separately assess whether the instrument falls within the restricted category, whether an exemption applies, and whether the promotion is made or approved by an authorised person in accordance with the Financial Services and Markets Act 2000 and the...

Key dates

2026-08-18

The competent UN Sanctions Committee amended the ISIL (Da’esh) and Al-Qaida sanctions list; the amendment became directly applicable in Switzerland.

2026-08-19

SECO updated the SESAM database and published the Swiss sanctions-list adjustment.

2026-08-20

FINMA published the updated sanctions notice describing the amendment and related financial-intermediary obligations.

Suggested considerations

• Compliance teams may wish to obtain the 2026-08-19 SESAM update and identify precisely which persons, companies or organisations were added, amended or removed.
• Firms should consider refreshing sanctions-screening data and screening customers, beneficial owners, counterparties, payment parties, securities positions and existing business relationships against the amended entries without delay.
• Where a potential match is identified, firms should consider applying the relevant prohibitions, preventing disposal or transfer of assets, documenting the match analysis and escalating the case under their sanctions procedures.
• Firms should consider reporting affected business relationships and frozen assets to SECO in accordance with SR 946.231.08 and retaining evidence of the report and asset-freeze decision.
• A SECO sanctions report should not be treated as a substitute for AML controls; where indicators give rise to suspicion, compliance teams may wish to conduct the additional clarifications required by Article 6 GwG and file an immediate MROS report under Article 9 GwG if the suspicion cannot be dispelled.
• Firms with delegated or outsourced screening may wish to verify that vendors refreshed their Swiss sanctions data after 2026-08-19 and that payment and transaction-monitoring controls cover the amended list.

What changed

The sanctions list under the Swiss Ordinance of 2025-03-21 on measures against persons and organisations associated with ISIL (Da’esh) and Al-Qaida (SR 946.231.08) was amended following the UN committee decision of 2026-08-18. The publication does not identify the amended entries or specify whether they are new designations, amendments or delistings; firms should therefore reconcile the current SESAM data against their prior screening population. The amendment applies in Switzerland directly and without a separate Swiss legislative adoption step.

Key dates

2026-08-14

The competent UN sanctions committee amended the ISIL (Da’esh) and Al-Qaida sanctions list; the amendment became directly applicable in Switzerland under the applicable automatic-implementation framework.

2026-08-17

SECO updated the Swiss-authoritative SESAM sanctions database and published the corresponding list adjustment.

2026-08-19

FINMA published its notice reporting the SECO sanctions-list update.

Suggested considerations

• Compliance teams may wish to retrieve the 17 August 2026 SESAM update and reconcile it against the prior list, recording all additions, removals and amendments and preserving the source version used.
• Firms should consider rerunning customer, beneficial-owner, counterparty, payment, trade and custody screening against the amended list, including historical transactions and open orders where their risk-based controls require retrospective review.
• Firms should consider reviewing transliterations, aliases, dates of birth, nationality, incorporation data and other identifiers for any newly listed individual or entity to reduce false negatives and false positives.
• Where a potential match is identified, firms should consider applying the prohibitions and asset-freeze requirements under SR 946.231.08, escalating the case under their sanctions procedures and assessing whether notification to SECO is required.
• Compliance teams may wish to verify that vendor feeds, transaction-screening systems, watchlists, case-management workflows and manual escalation procedures reflect the direct-applicability model and the 17 August SESAM update date.
• Firms should consider documenting the timing of list ingestion, screening completion, disposition of alerts, any blocked or frozen assets, and any reports or licence requests submitted to SECO for audit and supervisory purposes.

What changed

The UN sanctions committee changed the list of sanctioned individuals, companies and organisations covered by SR 946.231.08. Switzerland applies the change directly, without a separate Swiss legislative or regulatory adoption step. SECO updated SESAM, the SECO Sanctions Management database described as authoritative for Switzerland, on 17 August 2026 and published the amendment on its website.

Key dates

2026-08-17

EAER amended Annexes 12, 13 and 14 and SECO updated the SESAM sanctions database.

2026-08-18 Deadline

The amendment became legally effective at 23:00 Swiss time; affected prohibitions, asset freezes and SECO reporting obligations applied from that time.

Suggested considerations

• Compliance teams may wish to obtain the effective 2026-08-18 23:00 SESAM dataset and run an immediate rescreening of customers, beneficial owners, authorised signatories, counterparties, payment beneficiaries, securities positions and relevant transaction history.
• Firms should consider applying the Article 16 asset-freeze and availability prohibitions to positive matches, including assets or economic resources controlled indirectly, and escalating potential matches for ownership-and-control analysis rather than relying only on exact-name screening.
• Financial intermediaries should consider reporting affected business relationships and frozen assets to SECO without delay in accordance with the ordinance, while documenting the screening timestamp, match disposition, freeze decision and notification trail.
• Teams may wish to review pending and recurring Iran-related payments against Article 21, including the CHF 10,000 SECO reporting threshold, the five-working-day reporting period, and the CHF 50,000 prior-authorisation threshold.
• A SECO sanctions report should not be treated as a substitute for AMLA analysis: where circumstances create suspicion, firms should consider additional clarifications under Article 6 AMLA/GwG and an immediate MROS report under Article 9 AMLA/GwG if the suspicion cannot be dispelled.
• Firms should consider reviewing delisted and amended entries separately, because removal from an Iran annex does not necessarily resolve exposure under other Swiss, UN or foreign sanctions regimes or eliminate unrelated AML, proliferation-financing or reputational-risk concerns.
• Compliance and operations teams may wish to confirm that screening vendors, payment filters, case-management workflows, correspondent-bank controls and sanctions procedures recognise the 23:00 Swiss-time effective moment and preserve an auditable change-management record.

What changed

The amendment updates the Swiss SESAM sanctions database and the designation annexes of the Ordinance of 12 December 2025 on measures against the Islamic Republic of Iran. Six individuals were delisted, one entity record was amended, and two individuals and one entity were newly listed; the publication does not identify the parties in the FINMA notice itself, so firms should rely on the current SECO SESAM data rather than the notice's entry counts alone.

Key dates

2026-08-13

The competent UN Sanctions Committee amended the ISIL (Da’esh) and Al-Qaida list; independent notices describe amendments to four entries.

2026-08-14

SECO updated the Swiss SESAM database and published the corresponding Swiss sanctions-list update.

2026-08-17

FINMA published its updated sanctions notice drawing attention to the directly applicable Swiss list change.

Suggested considerations

• Compliance teams may wish to obtain the amended UN list and the updated SESAM data, identify the three amended individuals and one amended entity, and map all aliases, dates of birth, nationalities, addresses, registration details and other identifiers into screening systems.
• Firms should consider immediate rescreening of customers, beneficial owners, authorised signatories, counterparties, vendors, payment beneficiaries and relevant historical transactions against the amended data.
• Where a potential match is identified, firms should consider suspending the relevant transaction or relationship pending a documented false-positive assessment and escalating a confirmed or unresolved match to sanctions, legal and MLRO governance channels.
• For a confirmed match, firms should consider applying the asset-freeze restrictions under SR 946.231.08, preventing funds or economic resources from being made available directly or indirectly to or for the benefit of the designated person or entity, and assessing applicable Swiss notification and reporting requirements.
• Firms should retain evidence of the SESAM and screening-data update, screening timestamps, alert dispositions, approvals, transaction holds and any regulatory or law-enforcement communications.
• Control owners may wish to test whether outsourced screening providers, payment filters, correspondent-bank interfaces and crypto blockchain analytics received the update without delay.
• Compliance teams may wish to note the market reading reflected in parallel official-industry notices: the practical expectation is operational list maintenance and prompt rescreening, not merely awareness of the FINMA publication.

What changed

The list entries covered by the Ordinance of 2025-03-21 on Measures Against Persons and Organisations Connected with ISIL (Da’esh) and Al-Qaida (SR 946.231.08) were amended; the available public notices indicate amendments to three individuals and one entity, rather than a new standalone FINMA rule. The amendments became directly applicable in Switzerland through the UN sanctions-list mechanism, and SECO incorporated them into SESAM on 2026-08-14.

Key dates

10 August 2026

- The WBF amended the list of sanctioned persons, companies, and organizations under the South Sudan measures

11 August 2026

- FINMA published the updated sanctions notice and stated that the urgent amendment would be published on the WBF website the same day

11 August 2026, 23:00

- The updated sanctions entry takes effect and becomes enforceable in Switzerland

Suggested considerations

• Re-screen customers, counterparties, beneficial owners, and payment flows against the updated SESAM sanctions data immediately.
• Freeze any assets or economic resources that match the updated South Sudan sanctions list as soon as the entry becomes effective.
• Block prohibited dealings and ensure no funds or economic resources are made available, directly or indirectly, to listed persons or entities.
• Report any affected business relationships to SECO without delay where a match is identified.
• Perform additional clarifications under Art. 6 GwG when sanctions hits or related suspicion indicators arise.

What changed

• - The WBF amended Annex 2 of the Swiss ordinance on measures against the Republic of South Sudan (SR 946.231.169.9), and FINMA relayed that the authoritative Swiss sanctions database SESAM has been...
• The urgent amendment takes effect today at 23:00, meaning firms must treat the revised list as enforceable from that time onward.
• Financial intermediaries must implement the prohibitions contained in the ordinance for the sanctioned parties.
• Financial intermediaries must freeze assets of sanctioned persons, companies, and organizations.
• Financial intermediaries must report affected business relationships to SECO.

Key dates

2026-08-11

Effective date of the Geographic Targeting Order

2027-02-06 Deadline

Order period ends after 180 days unless renewed

Suggested considerations

• Compliance teams may wish to identify all branches, subsidiaries, and offices in Hennepin and Ramsey Counties and map which payment flows meet the Order’s definition of a Covered Transaction.
• Firms may wish to update transaction-monitoring and customer due diligence workflows to capture the additional data elements required for bank or money transmitter reports, including beneficiary or recipient contact details and government-benefits-related funding questions.
• Operational teams may wish to confirm readiness to submit reports through the FI Portal and to generate the required CSV files using the Minnesota Fraud GTO template and naming convention.
• Records-management teams may wish to set a retention control ensuring all reports and related compliance records are preserved for five years from the last day the Order is effective.
• Banks and money transmitters may wish to review whether any existing BSA or sanctions screening processes can be leveraged to identify covered international transfers meeting the $3,000 threshold.
• Compliance teams may wish to test month-end reporting processes so filings occur by the end of the month following the month in which each Covered Transaction took place.

What changed

The Order creates a temporary, geographically targeted recordkeeping and reporting regime under 31 CFR Part 1010 for covered institutions in Hennepin and Ramsey Counties. A “Covered Business” is any bank under 31 CFR 1010.100(d) or money transmitter under 31 CFR 1010.100(ff)(5) with a branch, subsidiary, or office in the covered area.

Key dates

TBD

- The Handbook API is launched and made available for use by registered Handbook website users

TBD

- Firms may choose to adopt the API directly, through third-party providers, or continue using the Handbook website and its refreshed search and tracking features

Suggested considerations

• Review whether current regulatory-change monitoring processes would benefit from ingesting FCA Handbook data through the new API.
• Confirm that your firm has a free Handbook website account and that internal users or vendors accessing the API are covered by the FCA’s terms and conditions.
• Assess whether the firm should connect the API directly to internal compliance systems or route access through a RegTech provider.
• Update internal governance for change management so that teams can use the API’s current-version content as the authoritative source for Handbook analysis.
• Rework rule-mapping, obligations registers, and control libraries to take advantage of structured Handbook content where this improves efficiency and accuracy.

What changed

• - The FCA has introduced the Handbook API to provide Handbook content in a structured, machine-readable format that systems can consume directly.
• The API is free to use for registered users with a free account on the FCA Handbook website, but use is subject to the FCA’s terms and conditions.
• The API is designed to support compliance monitoring, regulatory and policy change management, and other RegTech use cases.
• The API returns the latest version of Handbook content and does not provide historic Handbook versions.
• The API can be accessed only through compatible external applications such as Postman or RapidAPI, rather than directly through the website interface.

Key dates

2026-06-24

Venezuela experienced a pair of strong earthquakes off the northern coast west of Caracas, triggering the humanitarian crisis referenced by the agencies.

2026-07-27

FinCEN issued a substantively similar statement of enforcement policy regarding Venezuela-related financial services.

2026-07-31

The OCC, Federal Reserve, FDIC, and NCUA issued the joint enforcement policy.

2026-07-31

Start of the period during which authorized financial services to persons or entities in Venezuela are covered by the enforcement commitment.

2027-01-29 Deadline

End of the covered period for the joint enforcement commitment.

Suggested considerations

• Compliance teams may wish to confirm whether current Venezuela-related activity falls within the scope of authorized financial services covered by the joint statement.
• Institutions may wish to verify that their BSA compliance program remains current and that ongoing controls reflect reasonable efforts to comply during the relief period.
• Firms may wish to check whether they have had any final FinCEN or OCC enforcement action involving BSA violations in the prior 24 months before relying on the policy.
• Sanctions teams may wish to confirm continued compliance with all applicable OFAC-administered sanctions regulations and authorizations.
• Institutions with Venezuela exposure may wish to document how they will evidence reliance on the policy and monitor the January 29, 2027 end date.

What changed

The agencies stated that eligible U.S. financial institutions that choose to provide authorized financial services to persons or entities in Venezuela will not be subject to supervisory action, including a citation for a violation of law, or enforcement action related to a Bank Secrecy Act requirement, for those services. The commitment is limited to authorized financial services provided from 2026-07-31 through 2027-01-29 and applies only to statutes or regulations specifically addressed in the joint statement.

Key dates

2026-06-25

FinCEN published the underlying NPRM to amend the Huione Group definition

2026-06-25

Electronic comment filing became unavailable due to a portal issue

2026-06-30

Portal issue period ended after six days of blocked electronic filing

2026-07-22

FinCEN dated the comment-period extension notice

2026-07-24

Federal Register publication of the extension notice at 91 FR 46761

2026-08-02 Deadline

Extended deadline for written comments on the NPRM

Suggested considerations

• Consider whether to submit comments on the NPRM by the extended deadline of 2026-08-02.
• Review customer, correspondent, and payment relationships for any exposure to Huione Group, H-Pay Service PLC, or entities that may be treated as successor entities if the proposal is finalized.
• Assess whether internal screening, escalation, and due diligence procedures would need updates if FinCEN finalizes the expanded definition.
• Monitor FinCEN’s final action on the NPRM and any resulting special-measures scope changes under 31 CFR 1010.

What changed

This publication does not impose a new final obligation; it extends the public comment deadline for an existing NPRM. The underlying proposal would amend FinCEN’s definition of Huione Group, a financial institution operating outside the United States of primary money laundering concern, to include H-Pay Service PLC and to add a defined term for “successor entity.” The extension was granted because a technological issue with the comment portal prevented electronic filing from June 25 through June 30, 2026.

Key dates

End of 2026

- The ECB Governing Council is expected to make the final decision on the new banknote design

23 July 2026

- The Central Bank of Ireland publishes the press release encouraging public participation in the ECB consultation

21 September 2026

- The public survey on the shortlisted euro banknote designs closes

Suggested considerations

• Review the ECB consultation materials and assess whether your firm has any direct operational exposure to future euro banknote changes.
• Monitor ECB and Central Bank of Ireland updates for the final design decision expected around the end of 2026.
• Prepare internal stakeholder briefings for cash operations, branch operations, payments, customer service, and communications teams on the expected euro banknote redesign timeline.
• If your firm accepts or processes cash, begin a preliminary review of any systems, controls, or vendor dependencies that could be affected by future note specifications, authentication features, or rollout timing.
• Update external messaging and FAQs only after the ECB publishes the final banknote design and implementation details.

What changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the themes “European culture” and “Rivers and birds.”
• The ECB has opened an online public survey to gather feedback on the proposed designs.
• The survey is open until 21 September 2026.
• The ECB Governing Council is expected to make the final design decision around the end of 2026.
• The current publication does not impose any immediate compliance obligation on firms; it is a consultation and design-selection step, not an enacted regulatory rule.

Key dates

Late 2026

- Expected Governing Council decision on the final design proposal for the new euro banknote series

Subsequent years (post‑2026)

- Progressive introduction of new‑series euro banknotes into circulation, co‑circulating with existing series which retain value

21 September 2026

- Closure of the ECB public online survey on the ten shortlisted euro banknote design proposals

Suggested considerations

• Establish an internal project workstream to monitor ECB communications on the banknote redesign and plan for operational impacts on cash handling, ATM networks and merchant devices.
• Conduct a preliminary impact assessment of how new banknote security and design features may affect existing banknote sorting, authentication and recycling equipment, and identify likely upgrade or replacement needs.
• Engage with ATM and cash‑handling hardware vendors to understand expected firmware, sensor and software changes required to support the new banknote series and to secure upgrade slots ahead of issuance.
• Review and update internal cash‑handling and banknote authentication procedures, including staff training materials, to incorporate new design and security features once technical specifications are published.
• Plan customer communications strategies to explain the coexistence of old and new series banknotes, reaffirm the continued validity of previous series, and address any fraud or counterfeiting concerns.

What changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the two themes “European culture” and “Rivers and birds”.
• An EU‑wide online public survey has been launched to collect feedback on the shortlisted designs, forming part of the ECB’s inclusive approach to banknote design.
• The ECB’s Governing Council will select a single design proposal around the end of 2026, informed by the Design Contest Jury conclusions, technical assessments and survey results.
• The chosen design will undergo further development and testing before production, including integration of new and improved security features.
• The new series of euro banknotes will be introduced into circulation in subsequent years, alongside existing series, which will retain their legal value and continue to circulate.