Payments & E-Money

What Changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the themes “European culture” and “Rivers and birds.”
• The ECB has opened an online public survey to gather feedback on the proposed designs.
• The survey is open until 21 September 2026.
• The ECB Governing Council is expected to make the final design decision around the end of 2026.
• The current publication does not impose any immediate compliance obligation on firms; it is a consultation and design-selection step, not an enacted regulatory rule.

Suggested Considerations

• Review the ECB consultation materials and assess whether your firm has any direct operational exposure to future euro banknote changes.
• Monitor ECB and Central Bank of Ireland updates for the final design decision expected around the end of 2026.
• Prepare internal stakeholder briefings for cash operations, branch operations, payments, customer service, and communications teams on the expected euro banknote redesign timeline.
• If your firm accepts or processes cash, begin a preliminary review of any systems, controls, or vendor dependencies that could be affected by future note specifications, authentication features, or rollout timing.
• Update external messaging and FAQs only after the ECB publishes the final banknote design and implementation details.

Key Dates

References

• [1] lemonde.fr/economie/article/2026/07/23/la-banque-centrale...
• [2] centralbanking.com/central-banks/currency/banknotes/79592...
• [3] ecb.europa.eu/press/pr/date/2025/html/ecb.pr250131~611055...
• [4] linkedin.com/posts/european-central-bank_we-have-taken-th...
• [5] bundesbank.de/en/tasks/topics/new-design-for-euro-banknot...
• [6] ecb.europa.eu/euro/banknotes/future_banknotes/html/ecb.fa...
• [7] euronews.com/2026/07/23/leonardo-callas-and-curie-or-euro...
• [8] en.ara.cat/economy/beethoven-cervantes-or-callas-the-fina...

What Changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the two themes “European culture” and “Rivers and birds”.
• An EU‑wide online public survey has been launched to collect feedback on the shortlisted designs, forming part of the ECB’s inclusive approach to banknote design.
• The ECB’s Governing Council will select a single design proposal around the end of 2026, informed by the Design Contest Jury conclusions, technical assessments and survey results.
• The chosen design will undergo further development and testing before production, including integration of new and improved security features.
• The new series of euro banknotes will be introduced into circulation in subsequent years, alongside existing series, which will retain their legal value and continue to circulate.

Suggested Considerations

• Establish an internal project workstream to monitor ECB communications on the banknote redesign and plan for operational impacts on cash handling, ATM networks and merchant devices.
• Conduct a preliminary impact assessment of how new banknote security and design features may affect existing banknote sorting, authentication and recycling equipment, and identify likely upgrade or replacement needs.
• Engage with ATM and cash‑handling hardware vendors to understand expected firmware, sensor and software changes required to support the new banknote series and to secure upgrade slots ahead of issuance.
• Review and update internal cash‑handling and banknote authentication procedures, including staff training materials, to incorporate new design and security features once technical specifications are published.
• Plan customer communications strategies to explain the coexistence of old and new series banknotes, reaffirm the continued validity of previous series, and address any fraud or counterfeiting concerns.

Key Dates

References

• [1] ecb.europa.eu/home/html/index.en.html
• [2] banque-france.fr/en/press-release/ecb-selects-motifs-futu...
• [3] ecb.europa.eu/press/pr/date/2023/html/ecb.pr230710~77cf71...
• [4] ecb.europa.eu/euro/banknotes/future_banknotes/html/index....
• [5] bundesbank.de/en/tasks/topics/ecb-selects-motifs-for-futu...
• [6] politico.eu/article/ecb-euro-christine-lagarde-to-choose-...
• [7] ecb.europa.eu/euro/banknotes/future_banknotes/html/ecb.fa...
• [8] rte.ie/news/business/2023/1130/1419310-new-ecb-banknote-t...

What Changed

• - The CSSF demonstrates that it is prepared to impose administrative sanctions directly on members of the board of directors of electronic money institutions, not just on the institution as a legal...
• Board members of Luxembourg‑authorised electronic money institutions are now clearly exposed to personal regulatory liability for governance, risk management and safeguarding failures under the CSSF...
• This enforcement confirms that CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions is not only a formal...
• The sanction underscores CSSF expectations that the supervisory body (board of directors) must ensure sound and prudent management, continuity of the institution and protection of its reputation, and...
• The case signals a stricter enforcement posture by the CSSF towards the payments and e‑money sector, aligning its expectations and enforcement intensity more closely with bank‑equivalent governance...

Suggested Considerations

• Review and map the institution’s current governance framework, board charter and committee mandates against the detailed requirements of CSSF Circular 26/906, including central administration, board composition, responsibilities and functioning.
• Ensure that the board of directors collectively has the required expertise, independence, diversity and time commitment, and that this is documented and periodically reassessed in line with CSSF expectations.
• Update board policies to explicitly assign responsibility for strategy, risk appetite, safeguarding of client funds, information security, outsourcing, conflicts of interest and AML/CFT, and ensure these responsibilities are effectively discharged and evidenced.
• Confirm that the institution’s central administration, decision‑making centre and administrative centre are physically located in Luxembourg and that members of the management body are sufficiently present on site, as required under the governance framework.
• Establish or reinforce the “three lines of defence” model by clearly separating business units, control functions (compliance and risk) and internal audit, and ensure reporting lines to the board are independent and robust.

Key Dates

References

• [1] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [2] finconduit.com/resources/cssf-circular-26-906-emi-pi-gove...
• [3] loyensloeff.com/insights/news--events/news/circular-cssf-...
• [4] elvingerhoss.lu/insights/publications/circular-cssf-26906...
• [5] cssf.lu/en/2026/03/communication-to-the-investment-fund-i...
• [6] financialcrime.lu/2026/01/20/CSSF-Circular-26-906/

What Changed

• - The decision clarifies that EBA’s decision whether or not to initiate an investigation into a possible breach or non‑application of Union law under Article 17 of Regulation (EU) No 1093/2010 is a...
• The Board of Appeal confirms that a decision not to open a Union law breach investigation does not constitute a reviewable “decision” for the purposes of Article 60(1)–(2) of the ESA Regulations and...
• The Board of Appeal confirms that individual complaints about account closures and associated supervisory handling remain primarily within the remit of national competent authorities and national...
• The decision reiterates that only certain categories of ESA acts that produce binding legal effects (for example, decisions adopted under Articles 17, 18 or 19 of the ESA Regulations, and acts within...
• The outcome aligns with prior Board of Appeal and EU court case law confirming that persons outside the specific categories listed in Article 17(2) of the ESA Regulations have no right of appeal to...

Suggested Considerations

• Review internal complaints‑handling and escalation procedures to ensure that disputes over account closures and related supervisory decisions are managed through national complaint bodies and courts, rather than assuming EBA or Board of Appeal review will be available.
• Update legal and compliance guidance notes to reflect that EBA’s decision whether to initiate a breach‑of‑Union‑law investigation is discretionary and generally not subject to appeal before the Board of Appeal, limiting external escalation avenues.
• Train front‑office, customer‑service and complaints staff to provide accurate information to customers about available redress routes, emphasising national ombudsman, national competent authority and judicial mechanisms rather than ESMA/EBA appeals.
• For groups operating across the EU, map national complaint and judicial mechanisms for account closures in each jurisdiction and integrate them into group‑wide conduct risk frameworks and customer communication templates.
• Monitor further ESA and EU court case law on which ESA acts are susceptible to appeal before the Board of Appeal, and adjust litigation and escalation strategies accordingly.

Key Dates

References

• [1] eba.europa.eu/sites/default/files/document_library/103736...
• [2] eulawlive.com/european-banking-authoritys-decision-not-to...
• [3] cms.law/en/int/regulatory-news/eba-eiopa-esma-decision4
• [4] eufimar.jeanmonnet.unige.it/boa
• [5] esma.europa.eu/press-news/esma-news/esas-joint-board-appe...
• [6] inview.nl/document/idfc65faa7e3b34ffab5a421db4ee486d3/esa...
• [7] art.torvergata.it/retrieve/5202f4a5-3ac8-4386-b202-68b342...
• [8] inview.nl/document/idf6f86cf964ed45c8930028872e35ba78/jud...

What Changed

• - A new CTP oversight regime becomes operational on 13 July 2026, under which the Bank of England, PRA and FCA will jointly supervise certain technology and service providers whose failure could...
• HM Treasury has made the first formal CTP designations: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited.
• Designated CTPs must identify and manage risks to their critical services effectively, including governance, risk management and operational resilience arrangements specifically focused on services...
• CTPs are required to maintain open, timely communication with regulators and with firms that rely on them, particularly during major incidents, implying strengthened incident reporting,...
• The three regulators will jointly oversee CTPs under a proportionate regime focused on resilience of “critical services”, including assessing and mitigating system‑level risks and reducing the risk...

Suggested Considerations

• Review and update the firm’s operational resilience framework, including impact tolerances and scenario testing, to explicitly incorporate systemic risk arising from reliance on the designated CTPs and potential correlated failures affecting multiple services or regions.
• Re‑assess outsourcing and third‑party risk management policies to ensure they clearly distinguish between obligations placed on regulated firms and those placed directly on CTPs, while maintaining robust due diligence, ongoing monitoring and exit strategies for all CTP‑hosted services.
• Engage with designated CTPs (through account management, risk and security channels) to understand their approach to compliance with the CTP regime, including incident reporting arrangements, resilience testing, communication protocols and any new assurance artifacts they plan to provide.
• Update board and senior management reporting so that reliance on designated CTPs, associated systemic risk and regulatory developments under the CTP regime are regularly monitored and discussed at appropriate governance forums (e.g. risk committee, operational resilience committee).
• Review major incident management and crisis communication playbooks to ensure they include specific escalation paths, contact points and joint incident handling procedures with designated CTPs and relevant regulators.

Key Dates

References

• [1] riskledger.com/resources/critical-third-parties-regime-tprm
• [2] kempitlaw.com/insights/uk-critical-third-parties-regime-r...
• [3] fca.org.uk/news/statements/uk-and-eu-regulators-sign-memo...
• [4] escode.com/resources/the-uk-critical-third-party-ctp-regi...
• [5] bankofengland.co.uk/financial-stability/financial-market-...
• [6] fusionrm.com/blogs/critical-third-party-resilience-regula...
• [7] aws.amazon.com/blogs/industries/what-customers-need-to-kn...
• [8] fca.org.uk/publications/policy-statements/ps24-16-operati...

What Changed

• (From the enforcement notice itself, there are no new rules; the impact is interpretative and enforcement‑related.)
• CSSF confirms that authorised electronic money institutions are subject to active supervisory and enforcement scrutiny, including public administrative sanctions for regulatory breaches.
• The sanction demonstrates that failures which may appear operational or procedural can nonetheless result in monetary fines and public naming, reinforcing the need for robust compliance frameworks in...
• The case is likely to be assessed by CSSF in light of the new governance, risk management and safeguarding expectations introduced under CSSF Circular 26/906 for payment and e‑money institutions,...
• The public nature of the sanction underscores CSSF’s use of transparency as a deterrent tool, increasing reputational risk for firms that do not comply with licensing, governance, reporting or...

Suggested Considerations

• Review the CSSF sanction against PingPong Europe S.A. and identify which categories of requirements (e.g. governance, safeguarding of client funds, reporting, outsourcing, internal controls) were implicated, then map these to your own control framework.
• Conduct a gap analysis against CSSF Circular 26/906, focusing on central administration, internal governance, risk management, and safeguarding of client funds for payment and e‑money institutions.
• Update policies, procedures and internal control documentation governing payment services, e‑money issuance, safeguarding (segregation, reconciliations), outsourcing and IT connectivity to ensure alignment with CSSF Circular 26/906.
• Ensure that a clearly designated member of the management body holds documented responsibility for oversight of safeguarding arrangements and compliance with CSSF requirements for payment and e‑money institutions.
• Implement or enhance daily reconciliations and robust segregation of client funds accounts, supported by periodic internal reviews and testing of safeguarding controls.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/S_3_EME_PingPong_Europe_S.A._0...
• [2] linkedin.com/pulse/enforcement-actions-against-private-fu...
• [3] opensanctions.org/datasets/lu_administrative_sanctions/
• [4] caceis.com/regwatch-2026/february-2026
• [5] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [6] cssf.lu/en/Document/administrative-sanction-of-2-march-2026/
• [7] cssf.lu/en/Document
• [8] international.pingpongx.com/trust-center

What Changed

• - Japan has finalized a partial amendment to the list of designated countries/regions under Articles 17-2 and 17-3 of the Order for Enforcement of the Act on Prevention of Transfer of Criminal...
• The amendment expands the set of foreign jurisdictions for which Japanese firms must apply travel rule obligations when transferring cryptoassets and electronic payment instruments to foreign VASPs,...
• For transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs, travel rule obligations apply only when the counterparty VASP is located in a jurisdiction...
• Transfers to foreign VASPs in non-designated jurisdictions remain outside the Japanese travel rule transmission obligation, reflecting JFSA’s concern about regulatory ineffectiveness where equivalent...
• The amendment confirms that the travel rule applies to both cryptoassets (virtual assets, VAs) and electronic payment instruments, including stablecoins (SCs) handled by Cryptoasset Exchange Service...

Suggested Considerations

• Review and obtain the official Attachment to identify the five newly added jurisdictions and verify their exact legal names and any specific conditions attached to their designation.
• Update internal jurisdiction lists and travel rule mapping to reflect all currently designated countries and regions under Articles 17-2 and 17-3, including the newly added five jurisdictions, ensuring that this mapping is embedded in transaction routing and screening engines.
• Revise travel rule implementation procedures so that originator and beneficiary information is consistently transmitted for all transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs located in designated jurisdictions, including the new additions.
• Confirm that no de minimis threshold is applied in practice to covered transactions and that systems are configured to send travel rule data regardless of transaction size when the counterparty is in a designated jurisdiction.
• Update customer and counterparty onboarding documentation and contractual terms for foreign VASPs in newly designated jurisdictions to reflect their status as travel rule counterparties and any data-sharing, security, and retention requirements.

Key Dates

References

• [1] notabene.id/world/japan
• [2] sygna.io/blog/japan-travel-rule-starts-1-june-an-in-depth...
• [3] innreg.com/blog/crypto-travel-rule-guide
• [4] fsa.go.jp/en/newsletter/weekly2024/573_1.pdf
• [5] elliptic.co/blockchain-basics/what-is-the-travel-rule
• [6] sumsub.com/blog/what-is-the-fatf-travel-rule/
• [7] bitflyer.com/en-jp/faq/5-20

What Changed

• - A new governance and delivery model for UK retail payments infrastructure is being operationalised, with strategy set by the PVDC, design work led by the RPIB, and implementation by a new...
• The RPIB has launched a formal consultation on the design of the future retail payments infrastructure, seeking views on payment journeys, key design choices and priorities.
• The PVDC has published additional context to support stakeholders’ reading of the consultation, including expectations for the commercial model, consumer protection outcomes and financial crime...
• Responsibilities across the ecosystem are being reset, with clearer roles for public authorities (HM Treasury, Bank of England, FCA, PSR), Pay.UK, and industry participants in designing and...
• Next‑generation infrastructure is expected to support account‑to‑account payments at point of sale, enhanced cross‑border payments, and interoperability with new forms of digital money (including...

Suggested Considerations

• Assess and document your firm’s current and projected use of UK retail interbank payments (including Faster Payments, account‑to‑account, and cross‑border flows) to inform your response to the RPIB consultation.
• Prepare and submit a coordinated consultation response to the RPIB by 11 September 2026, covering your views on payment journeys, design choices, consumer protection needs and financial crime controls.
• Review your firm’s commercial and pricing models for interbank payments to understand how potential changes to the future infrastructure’s commercial model could affect revenue, costs and access.
• Map dependencies between your operational resilience framework and the existing UK retail payments infrastructure, and identify key risks and mitigants under a transition to the next‑generation infrastructure.
• Engage with industry bodies, Pay.UK and relevant trade associations to align positions on access, interoperability, fraud management, and technical standards for next‑generation retail payments.

Key Dates

References

• [1] gov.uk/government/publications/national-payments-vision/p...
• [2] finreg.aoshearman.com/uk-pvdc-strategy-for-future-retail-...
• [3] lewissilkin.com/en/insights/2026/03/05/payments-vision-de...
• [4] bankofengland.co.uk/news/2026/june/rpib-launches-consulta...
• [5] assets.publishing.service.gov.uk/media/690de7a247ad122f85...
• [6] fca.org.uk/news/statements/payments-vision-delivery-commi...
• [7] wiki.treasurers.org/wiki/Payments_Vision_Delivery_Committee
• [8] linkedin.com/posts/bank-of-england_the-retail-payments-in...

What Changed

• - MAS reaffirmed its willingness to hold senior management personally accountable where they fail to ensure their institution complies with MAS regulations, as illustrated by reprimands against...
• MAS demonstrated continued zero tolerance for trading-related offences under the Securities and Futures Act (SFA), supporting criminal prosecutions that resulted in imprisonment and substantial fines...
• MAS confirmed that Major Payment Institution (MPI) licences can and will be revoked where inspections reveal significant weaknesses in risk management, conflict-of-interest policies, and...
• MAS signalled continued priority on AML/CFT supervision and enforcement by imposing a $300,000 composition penalty on a licensed trust company (Padang Trust Singapore Pte.
• MAS underscored its ongoing focus on insider trading and market abuse by imposing a civil penalty on an individual for insider trading in shares of a Singapore-listed (now delisted) company.

Suggested Considerations

• Review and, where necessary, enhance senior management and board-level oversight frameworks to ensure that responsibilities for MAS regulatory compliance are clearly allocated, documented, and evidenced (e.g. through committee charters, management information, and challenge records).
• Conduct a targeted compliance review at fund managers and other CMS licence holders to assess adherence to MAS regulations, focusing on areas previously cited in MAS enforcement actions (e.g. internal controls, client asset safeguards, and recordkeeping).
• For Major Payment Institutions and other payment providers, perform a comprehensive gap analysis of risk management frameworks, conflict-of-interest policies, and compliance with MAS Guidelines on Outsourcing, including due diligence, ongoing monitoring, and intra-group/related-party arrangements.
• Implement or strengthen formal governance around the accuracy and completeness of all information submitted to MAS (licence applications, regulatory returns, inspection responses), including sign-off controls, documentation standards, and verification procedures.
• For licensed trust companies and other AML/CFT-obliged entities, review and update AML/CFT policies, customer due diligence (CDD) and enhanced due diligence (EDD) procedures, ongoing monitoring, and suspicious transaction reporting processes in line with MAS Notices and Guidelines.

Key Dates

References

• [1] mas.gov.sg/news/media-releases/2026/key-enforcement-actio...
• [2] linkedin.com/pulse/mas-imposes-over-20m-penalties-aml-mar...
• [3] mas.gov.sg/regulation/enforcement/enforcement-actions
• [4] ncontracts.com/nsight-blog/enforcement-actions-roundup-ap...
• [5] sec.gov/newsroom/press-releases/2026-34
• [6] opensanctions.org/datasets/sg_mas_enforcement_actions/
• [7] reedsmith.com/articles/investigations-and-enforcement-tre...
• [8] fincen.gov/news/enforcement-actions

What Changed

• - UK stablecoin issuance will be subject to a dual regulatory regime: non‑systemic stablecoins will be supervised solely by the FCA, while systemic stablecoins used for payments will be jointly...
• Issuing a qualifying sterling‑denominated stablecoin in the UK will become a regulated activity, requiring FCA authorisation for non‑bank issuers and bringing them within the FCA’s prudential,...
• HM Treasury will apply statutory systemic tests under the Banking Act (e.g. scale, interconnectedness, substitutability, impact on confidence in sterling) to decide whether a stablecoin payment...
• Once recognised as systemic, stablecoin issuers and systemic payment system providers will fall under the Bank of England’s remit under the Banking Act 2009, including powers to obtain information,...
• Systemic sterling‑denominated stablecoin issuers will be required to maintain backing reserves equal to all outstanding coins, with backing assets held on statutory trust in the UK and ring‑fenced...

Suggested Considerations

• Map all existing and planned sterling‑denominated stablecoin products against the UK’s systemic and non‑systemic regimes and assess whether their intended use in UK payments could trigger HM Treasury systemic recognition.
• Initiate or update FCA authorisation applications for stablecoin issuance and cryptoasset custody activities, ensuring business models, governance and safeguarding arrangements align with CP25/14 and the forthcoming stablecoin regime.
• Design and implement reserve‑management frameworks capable of maintaining backing assets equal to outstanding coins, in the proposed 70/30 mix between short‑term UK government debt and Bank of England deposits, with appropriate stress testing and liquidity risk oversight.
• Establish statutory trust and segregation structures for backing assets and liquid‑asset reserves, including appointing UK‑authorised third‑party custodians and aligning documentation with FCA client‑asset‑style protections and coinholder proprietary claims.
• Develop capital planning processes and ICAAP‑style assessments to meet the Bank of England’s requirements for capital against general business risk and dedicated reserves for financial risk and wind‑down costs.

Key Dates

References

• [1] fmlc.org/wp-content/uploads/2026/02/FMLC_Reponse-to-Syste...
• [2] paulhastings.com/insights/client-alerts/bank-of-england-c...
• [3] mayerbrown.com/en/insights/publications/2025/12/proposed-...
• [4] whitecase.com/insight-alert/bank-england-consults-regulat...
• [5] skadden.com/insights/publications/2025/11/bank-of-england...
• [6] bankofengland.co.uk/news/2026/june/boe-launches-policy-st...
• [7] theglobalcity.uk/PositiveWebsite/media/IRSG/240208_RESPON...
• [8] fca.org.uk/publications/consultation-papers/cp25-14-stabl...

What Changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Suggested Considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

Key Dates

References

• [1] mayerbrown.com/en/insights/publications/2025/08/fatf-revi...
• [2] moodys.com/web/en/us/kyc/resources/insights/fatf-recommen...
• [3] innreg.com/blog/fatf-travel-rule-crypto-fintech-complianc...
• [4] vaspnet.com/articles/how-the-eus-travel-rule-goes-above-a...
• [5] sumsub.com/blog/what-is-the-fatf-travel-rule/

What Changed

• - The EDMC completed its annual reporting cycle for the period 1 March 2025 to 28 February 2026, confirming the continued operation of the PRA’s contested-case decision framework.
• The report confirms that the EDMC continues to provide functional separation between investigation/enforcement staff and decision-makers in PRA contested enforcement cases.
• The report confirms that the EDMC’s role covers enforcement cases under the Bank’s statutory regimes for prudential regulation, financial market infrastructure, resolution, securitisation, wholesale...
• The EDMC confirms that contested enforcement decisions are made independently, with disclosure of relevant material and the opportunity for both written and oral representations.
• The EDMC confirms that its decision is the final stage of administrative decision-making in contested PRA enforcement cases, after which the subject may refer the matter to the Upper Tribunal.

Suggested Considerations

• Review your firm’s PRA enforcement response plan to ensure it supports rapid collection, review, and production of material that may be disclosed in a contested case.
• Ensure legal and compliance teams are prepared to make both written and oral representations to the EDMC if the firm becomes subject to a contested enforcement matter.
• Confirm that internal governance provides for independent escalation and board-level oversight when a PRA investigation enters the decision stage.
• Maintain an updated settlement strategy for PRA matters, including documented positions on fairness, scope of admissions, and mitigation, because the EDMC may review settlement processes retrospectively.
• Map exposure across all PRA enforcement regimes relevant to the business, including prudential regulation, FMI, resolution, securitisation, wholesale cash distribution, critical third parties, and S&NI banknote matters.

Key Dates

References

• [1] bankofengland.co.uk/prudential-regulation/publication/202...
• [2] bankofengland.co.uk/prudential-regulation/publication/202...
• [3] jonesday.com/en/insights/2018/12/bank-of-england-establis...
• [4] assets.publishing.service.gov.uk/media/5a7ecd2c40f0b62305...
• [5] pallasllp.com/journal/regulatory-round-up-what-to-expect-...
• [6] fca.org.uk/publication/corporate/regulatory-initiatives-g...
• [7] ey.com/content/dam/ey-unified-site/ey-com/en-uk/insights/...
• [8] iif.com/LinkClick.aspx?fileticket=mK5vs8kmCK4%3D&portalid

What Changed

• - The RPIB has opened a consultation to develop a high‑level “blueprint” for the future UK retail payments infrastructure, which will underpin the National Payments Vision and inform the design to be...
• The consultation scope explicitly covers payment journeys, key design choices and priorities for the next‑generation infrastructure, rather than setting immediate prescriptive rules for firms.
• The next‑generation infrastructure is intended to support new payment methods, including account‑to‑account payments at the point of sale (in‑store and online) as a complement to card payments, and...
• Existing retail interbank payment systems (Faster Payments, Bacs, Image Clearing System) operated by Pay.UK will continue to run safely and resiliently during the transition, implying a multi‑year...
• The new infrastructure is being designed to support a multi‑money ecosystem, including existing commercial bank money and emerging forms of digital money (e‑money, tokenised deposits, systemic...

Suggested Considerations

• Identify internal stakeholders (payments product, technology, operations, legal, compliance, risk) and establish a formal project to coordinate your firm’s response to the RPIB consultation.
• Perform a gap analysis of your firm’s current use of Faster Payments, Bacs and cheque imaging, focusing on account‑to‑account capabilities, cross‑border flows, fraud and financial crime controls, customer authentication and operational resilience.
• Map and document key payment journeys relevant to your firm (e.g. point‑of‑sale account‑to‑account payments, bill payments, peer‑to‑peer transfers, ecommerce, cross‑border transactions) to enable substantive feedback on user needs and design priorities.
• Assess your firm’s strategic interest in account‑to‑account payments at the point of sale and enhanced cross‑border services, and identify functional requirements (APIs, messaging, reconciliation, chargeback‑like protections) that should be reflected in the consultation response.
• Review emerging regulatory publications under the National Payments Vision and Payments Forward Plan to ensure your consultation input aligns with expected regulatory outcomes on access, competition, resilience and innovation.

Key Dates

References

• [1] bankofengland.co.uk/payment-and-settlement/the-national-p...
• [2] gov.uk/government/publications/national-payments-vision/n...
• [3] bankofengland.co.uk/payment-and-settlement/the-national-p...
• [4] twobirds.com/en/insights/2025/uk/a-new-strategy-announced...
• [5] assets.publishing.service.gov.uk/media/699f2bc6c497bac082...
• [6] linkedin.com/posts/nuala-jackson_payments-vision-delivery...
• [7] ukfinance.org.uk/system/files/2026-03/Future%20Retail%20P...
• [8] globalgovernmentfinance.com/bank-of-england-external-enga...

What Changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Suggested Considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

Key Dates

References

• [1] pwc.lu/en/newsletter/2026/cssf-circular-26-906-in-focus.html
• [2] linkedin.com/posts/khadija-bartali-ghazzale-74925793_cssf...
• [3] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [4] loyensloeff.com/insights/news--events/news/circular-cssf-...
• [5] cssf.lu/en/Document/circular-cssf-26-904/
• [6] luther-lawfirm.com/fileadmin/user_upload/NF_CSSF_Circular...
• [7] cssf.lu/en/Document/circular-cssf-26-906/
• [8] cssf.lu/en/Document/circular-cssf-26-912/

What Changed

• - CSSF republished the annex to Circular CSSF 22/822 in a Version of 19 June 2026, meaning firms should treat this as the current Luxembourg reference point for FATF jurisdiction screening and...
• The annex distinguishes between high-risk jurisdictions subject to enhanced due diligence and, where appropriate, counter-measures, and jurisdictions under increased monitoring that require...
• The publication incorporates the FATF’s current statements on jurisdictions with strategic AML/CFT/CPF deficiencies, which is the basis for operational country-risk controls used by...
• The related Circular CSSF 22/822 remains the framework document that instructs professionals to use FATF statements when assessing jurisdictional ML/TF/PF risk.

Suggested Considerations

• Review your AML/CFT country-risk methodology and update it to reflect the 19 June 2026 FATF/CSSF jurisdiction list.
• Re-screen customers, beneficial owners, counterparties, and transactions against the updated high-risk and monitored jurisdiction lists.
• Apply enhanced due diligence for relationships and transactions involving high-risk jurisdictions, and escalate where counter-measures may be required.
• Reassess risk ratings for customers linked to jurisdictions under increased monitoring and document the rationale for any continued onboarding, retention, or exit decisions.
• Update automated screening rules, transaction-monitoring scenarios, and onboarding checklists so they use the current CSSF annex version.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/cssf22_822_eng.pdf
• [2] cssf.lu/wp-content/uploads/cssf22_822_annexe_eng_271025.pdf
• [3] cssf.lu/wp-content/uploads/cssf22_822_annexe_eng_260623.pdf
• [4] cssf.lu/en/Document/annex-of-circular-cssf-22-822-11/
• [5] linkedin.com/posts/bastien-collette-17686229_annex-of-cir...
• [6] regulplus.com/post/0/en/cssf-circular-22-822
• [7] cssf.lu/en/Document/annex-of-circular-cssf-22-822-10/
• [8] cssf.lu/en/Document/annex-of-circular-cssf-22-822-9/

What Changed

• - The Bank of England has published a policy statement “Sterling‑denominated systemic stablecoins” (22 June 2026) and a draft Code of Practice that will constitute the primary rulebook for systemic...
• The regime applies only to systemic sterling‑denominated stablecoins used for UK payments, i.e. stablecoins recognised as systemic under Banking Act 2009 tests where disruption could threaten UK...
• The previous proposal that at least 40% of backing assets be unremunerated central bank deposits and up to 60% in short‑term UK government debt has been revised so that up to 70% of backing assets...
• Backing assets must remain highly liquid and low‑risk, with central bank deposits used explicitly to support prompt redemption in stress, while the expanded gilt component is intended to improve the...
• The BoE has dropped the earlier concept of temporary per‑holder limits (for example, £20,000 per individual and £10 million per business that were consulted on in 2025) and replaced them with a...

Suggested Considerations

• Conduct a regulatory perimeter and recognition analysis to determine whether any issued or planned sterling‑denominated stablecoin could meet the Banking Act 2009 systemic tests and therefore fall under the BoE systemic stablecoin regime.
• Review and update treasury and investment policies for stablecoin backing assets to ensure the portfolio structure can comply with the revised requirement of up to 70% short‑term UK government debt and the remainder in BoE deposits.
• Perform detailed liquidity and redemption stress‑testing to evidence that central bank deposits and gilt portfolios can support prompt redemption under extreme but plausible scenarios while remaining within the £40 billion issuance guardrail.
• Re‑calibrate business plans and revenue models for systemic stablecoin issuance to reflect the increased allowable share of interest‑bearing gilts, the absence of per‑holder limits, and continued constraints on paying interest to coinholders.
• Design and implement governance and risk‑management frameworks that meet BoE expectations for systemic payment systems, including Board‑level oversight, risk appetite for digital money, and clear accountability for prudential and operational risks.

Key Dates

References

• [1] skadden.com/insights/publications/2025/11/bank-of-england...
• [2] uk.finance.yahoo.com/news/bank-of-england-uk-stablecoin-t...
• [3] whitecase.com/insight-alert/bank-england-consults-regulat...
• [4] bankofengland.co.uk/paper/2025/cp/proposed-regulatory-reg...
• [5] mayerbrown.com/en/insights/publications/2025/12/proposed-...
• [6] reuters.com/business/finance/bank-england-faces-calls-uk-...
• [7] linkedin.com/posts/bank-of-england_today-we-have-publishe...
• [8] mofo.com/resources/insights/251203-uk-proposes-regulating...

What Changed

• - Der Anhang 2 der Verordnung vom 25. Mai 2005 über Massnahmen gegenüber Sudan (SR 946.231.18) wurde durch Entscheid des WBF aktualisiert, was Änderungen an der Sanktionsliste (gelistete natürliche...
• Die aktualisierte Sanktionsliste zu Sudan ist für alle von der Verordnung erfassten Finanzintermediäre unmittelbar verbindlich und ist bei der Prüfung von Kunden, wirtschaftlich Berechtigten,...
• Vermögenswerte von neu gelisteten Personen oder Einrichtungen müssen gemäss Verordnung unverzüglich eingefroren und dürfen weder direkt noch indirekt zur Verfügung gestellt werden.
• Bereits bestehende Geschäftsbeziehungen zu neu gelisteten Personen oder Einrichtungen sind zu suspendieren bzw. abzuwickeln, soweit dies mit den gesetzlichen Vermögenssperren vereinbar ist.
• Institute sind verpflichtet, gefundene Treffer (Treffer bei Konten, Depots, Zahlungs- oder Handelsgeschäften) zu gelisteten Personen oder Einrichtungen den zuständigen Bundesstellen nach den...

Suggested Considerations

• Führen Sie umgehend einen Abgleich aller Kunden-, Konten- und wirtschaftlich Berechtigten-Stammdaten sowie relevanter Transaktionen gegen die aktualisierte Sudan-Sanktionsliste gemäss Anhang 2 der Verordnung SR 946.231.18 durch.
• Identifizieren und dokumentieren Sie alle Treffer (Hits) zu gelisteten Personen, Organisationen oder Einrichtungen und prüfen Sie diese formal (True Hit vs. False Positive) unter Anwendung eines dokumentierten, vier-Augen-prüfenden Verfahrens.
• Frieren Sie Vermögenswerte von bestätigten gelisteten Personen oder Einrichtungen unverzüglich ein, blockieren Sie Transaktionen und verhindern Sie jede direkte oder indirekte Bereitstellung von wirtschaftlichen Ressourcen, in Übereinstimmung mit der Sudan-Verordnung.
• Erstatten Sie umgehend die erforderlichen Meldungen an die zuständigen Bundesstellen (insbesondere SECO bzw. die im Sanktionsrecht vorgesehenen Behörden) sowie – soweit einschlägig – Verdachtsmeldungen an die Meldestelle für Geldwäscherei (MROS).
• Aktualisieren Sie Ihre Sanktions- und AML-Richtlinien, Arbeitsanweisungen und Kontrollpläne, um die neuen Sudan-spezifischen Listungen und Prozesse zur Vermögenssperre und Meldung explizit zu berücksichtigen.

Key Dates

References

• [1] finma.ch/de/news/2026/06/20260605-sr-946-231-18/

What Changed

• - The modernised Consumer Protection Code entered into effect in 2025, updating the existing Irish conduct framework to reflect digital delivery of financial services and strengthen protections in...
• Requirements on informing consumers effectively were tightened, implying higher expectations on clear, fair, not misleading disclosures across digital and traditional channels, and more robust...
• New or enhanced obligations concerning consumers in vulnerable circumstances now apply, requiring firms to identify, record and respond to vulnerability and to embed vulnerability considerations into...
• Mortgage switching processes are subject to strengthened conduct standards, increasing expectations on how options are presented, how customers are supported to switch, and how potential conflicts or...
• Insurance auto‑renewal practices are now more tightly controlled, requiring clearer pre‑renewal information, active consent and controls to mitigate consumer detriment from inertia or unsuitable...

Suggested Considerations

• Map the modernised Consumer Protection Code requirements against existing policies, procedures and customer journeys to identify and remediate gaps, particularly in digital channels, disclosure, sales practices and complaints handling.
• Update vulnerable customer policies, customer‑facing procedures, training materials and systems flags to ensure systematic identification, recording and tailored treatment of consumers in vulnerable circumstances.
• Review mortgage switching processes and documentation to ensure customers receive clear, comparative information on switching options, are not subject to unreasonable barriers or retention tactics, and that conflicts of interest are controlled and documented.
• Conduct a comprehensive review of insurance auto‑renewal practices (including communications, timing, consent mechanisms and pricing) and implement changes to align with the strengthened consumer protection expectations.
• Strengthen fraud and scam prevention frameworks by enhancing customer education, warnings, authentication, monitoring, incident response and redress processes, with particular focus on online and mobile channels.

Key Dates

References

• [1] centralbank.ie/news/article/press-release-enforcement-act...
• [2] centralbank.ie/news/article/cryptocom-(clone)---central-b...
• [3] centralbank.ie/contact-us
• [4] centralbank.ie/regulation/industry-market-sectors/electro...
• [5] centralbank.ie
• [6] centralbank.ie/news/article/coinhive---central-bank-of-ir...
• [7] centralbank.ie/regulation/how-we-regulate/authorisation/r...
• [8] centralbank.ie/statistics/statistical-publications/behind...

What Changed

• - The FCA publicly endorses the launch of the UK Payments Initiative (UKPI) as an industry‑led open banking payments scheme focused on commercial variable recurring payments (cVRP), signalling...
• The statement confirms the FCA wants competition between commercial open banking schemes, indicating a shift from a single mandated model (under PSD2/open banking implementation) towards multiple...
• The FCA signals support for the creation of an independent standards‑setting body for open banking payments, moving standard‑setting away from transitional arrangements towards a more permanent,...
• The FCA announces its intention, subject to future legislation granting new powers, to consult on a long‑term regulatory framework for open banking (and, by extension, commercial open banking schemes...
• The FCA links this announcement to its regulatory roadmap for open finance, confirming that open banking data‑sharing will be extended to broader financial data, providing a strategic direction of...

Suggested Considerations

• Conduct an internal assessment of how your firm currently uses or plans to use open banking and cVRP (e.g., recurring payments, subscription billing, merchant acquiring) and document potential exposure to UKPI or similar schemes.
• Establish or update a regulatory horizon‑scanning process to track: (i) UKPI scheme documentation and rulebooks, (ii) FCA’s forthcoming open finance regulatory roadmap outputs, and (iii) the enabling legislation that will grant the FCA new powers.
• Engage product, legal and compliance teams to map existing recurring payment processes and consumer consent flows against anticipated expectations for open banking cVRP, including clarity of consent, cancellation rights, transparency of variable amounts, and dispute handling.
• Review and, where necessary, update data protection, API security, and customer authentication controls to ensure they can support commercial open banking schemes and more granular data‑sharing under an open finance regime.
• For firms intending to participate in UKPI, proactively review and align internal policies with emerging industry standards and scheme rules, including technical standards, liability allocation, service‑level requirements, and complaints/chargeback processes.

Key Dates

References

• [1] fca.org.uk/news
• [2] gov.uk/government/organisations/financial-conduct-authority
• [3] fca.org.uk/news/news-stories/2025-fines
• [4] fca.org.uk/news/press-releases/fca-warns-younger-investor...
• [5] fca.org.uk/consumers/warning-list-unauthorised-firms
• [6] en.wikipedia.org/wiki/Financial_Conduct_Authority
• [7] fca.org.uk
• [8] fca.org.uk/consumers/fca-firm-checker

What Changed

• - CBI has formally identified Fire Financial Services Limited (CLONE) as an unauthorised entity that is not authorised to provide banking business or payment services in Ireland and is misusing the...
• CBI has published specific fraud indicators associated with this clone, including website domains (e.g.
• The warning explicitly states that the clone firm appears to be running an inheritance scam, including the use of fake documentation allegedly from third parties, which should be treated as a red...
• CBI reiterates that there is no connection between the legitimate authorised Fire Financial Services Limited (C58301) and this fraudulent entity, thereby clarifying the status of the genuine firm and...
• The firm’s name is formally published on CBI’s list of unauthorised firms under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, increasing regulatory expectation that firms...

Suggested Considerations

• Review and update internal fraud‑risk and financial crime risk assessments to explicitly cover clone‑firm risks, including inheritance scams and impersonation of authorised entities.
• Integrate the specific domains, email addresses, and phone numbers listed in the CBI notice into fraud‑monitoring tools, allow‑/block‑lists, and case‑management systems, and ensure they are treated as high‑risk indicators.
• Ensure front‑line, call‑centre, and relationship‑management staff receive targeted training and briefing on this specific clone case and on common clone‑firm red flags, including requests related to inheritance payments and use of unofficial domains.
• Enhance onboarding and counterparty due diligence procedures to include systematic checks against the CBI “unauthorised firms” list and the CBI public registers, especially where firms claim Irish regulation or use names similar to existing authorised firms.
• Update third‑party and introducer due diligence controls to verify that any firm referring business or presenting as an intermediary is properly authorised and not listed as unauthorised under section 53 of the Central Bank (Supervision and Enforcement) Act 2013.

Key Dates

References

• [1] centralbank.ie/news/article/warning-notice-fire-financial...
• [2] fi.ee/sites/default/files/2022-07/Central%20Bank%20of%20I...
• [3] centralbank.ie/news-media/warning-notices/51
• [4] centralbank.ie/news/article/bw-financial-services-(clone)...
• [5] finanstilsynet.no/contentassets/c38e2cee9df943c98cef1cbc2...
• [6] cnmv.es/webservices/verdocumento/ver?e=laIyj4IDQM1QvWy2W3...
• [7] youtube.com/watch?v=zBmrVRzNFaE
• [8] youtube.com/watch?v=hCMfc5-iyUU