Reporting & Disclosure

Key dates

2025-01-01

Beginning of the general period identified by the SEC during which the charged entities allegedly filed Forms ADV containing material misrepresentations; the publication does not specify an exact start date.

2026-08-27

The SEC announced the charges, disclosed the requested remedies, stated that the 38 ERA filings had been removed from its website, and referenced its related investor alert.

Suggested considerations

• Compliance teams may wish to perform a documented, line-by-line validation of Form ADV Part 1 and applicable Form ADV Part 2 disclosures, including business addresses, telephone numbers, websites, ownership, control persons, regulatory status, assets, private funds, clients, and service providers.
• Firms should consider retaining contemporaneous evidence supporting material Form ADV representations, such as lease or office records, corporate and ownership documents, fund records, audited financial statements, auditor engagement evidence, and records supporting reported assets and advisory activities.
• ERA and registered adviser compliance programs may wish to establish independent verification of counterparties' SEC registration or ERA status through the Investment Adviser Public Disclosure system and should avoid treating an SEC filing, certificate, or website badge as conclusive proof of legitimacy.
• Firms that market investment advice to individuals should consider reviewing whether their regulatory status, Form ADV disclosures, and marketing materials accurately describe whether they are registered, exempt reporting, or otherwise authorized to provide services to retail investors.
• Compliance teams may wish to investigate repeated or highly similar ownership structures, numerical disclosures, addresses, telephone numbers, websites, auditor names, or filing patterns across related advisers as potential indicators of coordinated fraudulent filings.
• Firms should consider escalating unanswered SEC requests for records and preserving relevant books, records, communications, websites, and filing-support materials, because the SEC expressly relied on alleged failures to substantiate Form ADV information.
• Private fund sponsors and allocators may wish to verify that purported fund audits were performed by identifiable independent public accounting firms with appropriate federal or state registration or licensing, rather than relying solely on statements in Form ADV.
• Financial-crime and onboarding teams may wish to incorporate the SEC's PAUSE list, investor alerts, foreign-jurisdiction indicators, website authentication checks, and independent corporate-registration checks into risk-based due diligence for purported U.S. advisers.

What changed

This publication announces enforcement complaints rather than a new rule or generally applicable filing requirement. The SEC alleges violations of Section 204(a) of the Investment Advisers Act of 1940, which governs adviser records and reports including Form ADV, and Section 207, which prohibits untrue statements or omissions in applications and reports filed under the Act. The SEC seeks permanent injunctions, conduct-based injunctions preventing the defendants from filing Forms ADV as exempt reporting advisers, and civil penalties.

Key dates

2026-08-27

The FDIC Board unanimously approved the final rule on unsafe or unsound practices and MRAs and the interim final rule on Road to Housing Act reciprocal deposits by notational vote.

Suggested considerations

• Compliance teams may wish to inventory open MRAs, supervisory recommendations, and section 8 enforcement matters and assess whether each matter satisfies the new material-harm, Deposit Insurance Fund risk, prudent-operation, or legal-violation criteria.
• Banks should consider mapping existing policies, procedures, reporting controls, documentation findings, and governance issues to the new distinction between MRAs, supervisory observations, and other violations, while retaining controls for matters that could affect capital, asset quality, earnings, liquidity, market-risk sensitivity, consumer outcomes, or receivership risk.
• Management and board committees may wish to prepare for examiner requests for the objective facts, risk analysis, and reasoning supporting any MRA or unsafe-or-unsound-practice conclusion, including evidence of how the bank assessed reasonably foreseeable conditions.
• Banks using reciprocal deposits should consider recalculating their permissible nonbrokered reciprocal-deposit capacity under the tiered liability formula and updating brokered-deposit classification, liquidity, deposit reporting, internal limits, and regulatory reporting controls.
• Potential agent institutions should verify their eligibility under the revised definition, including the applicable capital and examination-rating requirements and the broadened CAMELS-based criteria.
• Treasury, balance-sheet management, and deposit operations teams may wish to model the effect of the expanded reciprocal-deposit exclusion on funding concentration, liquidity stress assumptions, deposit pricing, and brokered-deposit monitoring.
• Legal and regulatory-affairs teams should monitor the Federal Register publication of both rules, confirm the effective dates, review any interim-final-rule comment opportunity, and determine whether implementation or comments are appropriate.
• Banks should consider reviewing examiner lookback requests and suspicious-activity review scopes against the related OCC examination guidance, which generally limits lookbacks involving failures to detect or report suspicious activity to one year or less unless heightened approval is obtained.

What changed

The final supervisory rule defines an unsafe or unsound practice as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and that, if continued, is likely to materially harm the bank's financial condition or present a material risk of loss to the Deposit Insurance Fund, or that has materially harmed the bank's financial condition.

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying ictrisksupervision@cssf.lu by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing ictrisksupervision@cssf.lu when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2026-08-26

The CFTC proposed the amendment in 91 FR 55030, RIN 3038-AF79, and opened the public-comment period.

2026-09-25 Deadline

Public comments on the proposed rule must be received by the CFTC.

Suggested considerations

• SEF compliance teams should distinguish Required Transactions from Permitted Transactions under 17 CFR 37.9 and confirm that any planned platform changes preserve Order Book and RFQ functionality for Required Transactions.
• SEFs may wish to inventory Permitted Transaction products, execution protocols, customer usage, liquidity, pre-trade transparency, surveillance dependencies, and annual Order Book operating costs before deciding whether to retain, modify, or discontinue optional Order Book functionality.
• SEFs relying on CFTC No-Action Letter No. 25-24 should assess whether their current implementation remains consistent with the proposal and should monitor the eventual final rule rather than treating the NPRM as binding law.
• SEF applicants may wish to reassess platform design and launch costs because the proposal could remove the need to build an Order Book solely for Permitted Transactions.
• Swap dealers, major swap participants, and other active SEF users should assess whether removal of an optional Order Book could affect execution practices, liquidity access, pre-trade transparency, best-execution analysis, or internal trading procedures for Permitted Transactions.
• Interested firms should consider submitting comments to CFTC docket CFTC-2026-1882, including quantified technology, staffing, infrastructure, surveillance-integration, and market-impact data, by September 25, 2026.
• Compliance teams should continue applying CEA section 2(h)(8), 17 CFR 37.9, and applicable Part 43 reporting obligations unless and until a final rule changes them.

What changed

The proposed amendment would revise 17 CFR 37.3(a)(2) so that a SEF must, at a minimum, offer an Order Book as defined in 17 CFR 37.3(a)(3) for Required Transactions as defined in 17 CFR 37.9(a)(1). It would remove the obligation to offer an Order Book for Permitted Transactions, defined in 17 CFR 37.9(c)(1) as transactions that do not involve a swap subject to the CEA section 2(h)(8) trade-execution requirement. SEFs could continue offering Order Books for Permitted Transactions voluntarily and could use any execution method permitted under 17 CFR 37.9(c)(2).

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2026-08-25

EBA launched the consultation on three draft RTS.

2026-09-25 Deadline

Deadline at 16:00 CEST to register for the EBA virtual public hearing.

2026-09-30

EBA virtual public hearing scheduled from 10:00 CEST.

2026-11-25 Deadline

Deadline for submitting comments on the consultation.

Suggested considerations

• Firms should assess whether their solo and group-level asset populations capture all entities and activities covered by the CRD amendments, including the potential effect of EU branches and consolidated group assets.
• Compliance and finance teams may wish to reconcile the proposed threshold methodology against regulatory reporting, audited financial statements and internal management information, using a rolling 12-month monitoring process where relevant.
• Investment firms above EUR 5 billion should review the draft reporting templates and instructions and identify data, governance, validation and submission gaps before the RTS become applicable.
• Firms near the EUR 30 billion threshold should model the consequences of credit institution authorisation, including CRD and CRR application, supervisory engagement, capital and liquidity requirements, governance expectations and implementation timelines.
• Groups potentially affected by the group test should consider submitting comments on the geographic scope of assets, treatment of branches, consolidation methodology and any disproportionate effects on cross-border business models.
• Potentially eligible firms may wish to prepare evidence against the proposed waiver factors and engage early with their competent authority, while recognising that a waiver is discretionary and not guaranteed.
• Stakeholders wishing to participate in the EBA public hearing should register by the stated registration deadline and firms wishing to influence the final RTS should submit consultation responses by 25 November 2026.

What changed

The EBA is revising its draft RTS following the 2024 amendments to the Capital Requirements Directive, including clarifications on which entities and assets must be included in the threshold calculation at solo and group level. The package addresses the methodology for calculating total assets against the EUR 30 billion threshold, reporting requirements for investment firms whose total assets exceed EUR 5 billion under Article 55(5) of the Investment Firms Regulation, and the factors competent authorities must consider when deciding whether to grant a waiver under Article 8a(7) of the CRD.

Key dates

2016-06-01

Approximate start of the Relevant Period during which Keptain’s liquid capital was window dressed and deficiencies arose.

2018-03-31

Approximate end of the Relevant Period identified by the SFC.

2026-08-24

SFC revoked Chan’s licence and RO approval and began his 10-year prohibition on re-entering the industry.

2036-08-23

Chan’s 10-year industry ban ends.

Suggested considerations

• Firms should consider reconciling every FRR return to bank statements, cleared funds, and post-period dishonour or reversal information rather than relying solely on month-end account balances.
• Compliance teams may wish to test whether cheques, related-party funding, temporary transfers, overdrafts, unsettled receipts, and other non-cash or conditional items meet the applicable FRR eligibility and valuation requirements before inclusion in liquid capital.
• ROs and managers-in-charge should consider documenting their review and challenge of each FRR return, including explanations for material month-end movements and evidence that reported funds were genuinely available and not temporary window dressing.
• Firms should consider implementing daily or intraday escalation triggers that identify actual or foreseeable breaches of the minimum liquid-capital requirement and the 120% notification threshold.
• Where a deficiency occurs or is reasonably identified, firms should consider assessing and documenting whether notification is required under SFO section 146(1) and FRR Rule 55(1), including the one-business-day outer limit under Rule 55(1).
• Compliance teams may wish to review historical FRR returns and supporting bank evidence for similar patterns, particularly where funds were received from connected companies or were reversed shortly after reporting dates.
• Licensed corporations should consider reminding ROs that signing regulatory returns can create personal fitness-and-properness consequences, including licence revocation and a lengthy industry ban, and should ensure that responsibility cannot be reduced to a nominal or administrative role.

What changed

This is a final enforcement action rather than a change to the underlying rules. The SFC applied Rules 4 and 6 of the Securities and Futures (Financial Resources) Rules, under which Keptain was required to maintain at least HK$3 million in liquid capital at all times. The SFC found that cheques deposited at or around month-end but dishonoured before the returns were submitted should not have been included in the liquid-capital calculations; excluding them would have produced deficiencies ranging from HK$731,000 to HK$3,473,000 over 20 months.

Key dates

2025-12-30

MAS issued the revised Notices FAA-N27, 508 and SFA 04-N24 and published its response to feedback.

2026-08-24

MAS published the circular and FAQs explaining the revised misconduct-reporting requirements and the discontinuation of the existing system.

2027-01-01 Deadline

The revised Notices FAA-N27, 508 and SFA 04-N24 take effect; the existing Notices FAA-N14, 504 and SFA 04-N11 are cancelled; and the existing misconduct reporting system is discontinued.

2027-01-22 Deadline

Default deadline for reporting qualifying pre-2027 misconduct matters that were not reported under the cancelled Notice, calculated as 21 calendar days after 1 January 2027, unless MAS permits a longer period in writing.

Suggested considerations

• Compliance teams may wish to map existing misconduct, incident, whistleblowing, investigation, HR and police-referral processes to the revised definition and categories of reportable misconduct.
• Firms should consider establishing a documented escalation test for when reasonable grounds to believe misconduct occurred arise, rather than waiting for a final investigation finding, and configuring workflow controls around the 21-calendar-day initial-reporting deadline.
• Firms may wish to obtain and operationalise the prescribed misconduct-report, investigation-report and update-report formats before the existing system is discontinued.
• Internal investigation procedures should be reviewed to ensure that the prescribed investigation information, supporting evidence, investigator assessment, corrective action and appeal information can be produced concurrently with the initial MAS report where an investigation has commenced.
• Police-report handling should be updated so that available police reports and required accompanying details are captured and submitted with the misconduct report, with subsequent police or criminal-proceeding developments tracked for update reporting.
• Firms should consider controls for providing representatives with copies of initial misconduct reports and subsequent updates within the prescribed timelines, including appropriate treatment of former representatives and confidentiality or privilege issues.
• A transitional review of open matters may be appropriate to identify cases where reasonable grounds arose before 1 January 2027 but no report was filed under the cancelled Notice; those matters may need to be reported by 22 January 2027, subject to any written extension from MAS.
• Record-retention policies, case-management systems and management information should be tested against the minimum five-year retention requirement and the requirement that electronic records remain accessible, retrievable and readable.

What changed

From 1 January 2027, Notices FAA-N27, 508 and SFA 04-N24 replace and cancel the existing Notices FAA-N14, 504 and SFA 04-N11. The initial misconduct report must generally be submitted within 21 calendar days after the firm has reasonable grounds to believe that reportable misconduct was committed or is likely to have been committed; a conclusive investigation finding is not required before reporting.

Key dates

2026-08-21

CSSF published the administrative sanction imposed on BigRep SE.

Suggested considerations

• Firms should confirm whether each Luxembourg-home-State issuer in scope has published its annual financial report no later than four months after the end of the financial year under Article 3 of the Transparency Law.
• Firms should verify that half-yearly financial reports are published no later than three months after the end of the first six months of the financial year under Article 4 of the Transparency Law.
• Compliance teams may wish to test evidence of effective dissemination, filing with the CSSF and storage with the Officially Appointed Mechanism for each periodic report.
• Issuer boards and senior management may wish to review escalation procedures for missed reporting deadlines and CSSF orders, including documented ownership, contingency arrangements and prompt remediation.
• Firms should consider maintaining an auditable reporting calendar that captures statutory deadlines, CSSF correspondence, publication timestamps, CSSF filings and Officially Appointed Mechanism confirmations.
• Issuers subject to a CSSF order should consider treating the order as a separately tracked remediation obligation rather than relying solely on completion of the underlying publication.

What changed

The CSSF imposed an administrative sanction on BigRep SE under the amended Luxembourg law of 11 January 2008 on transparency requirements for issuers. The decision concerns BigRep SE's failure to comply with the applicable requirement to publish periodic financial information and with related obligations concerning effective dissemination, filing with the CSSF and storage through the Officially Appointed Mechanism. The sanction is an enforcement action against a specific issuer rather than a new rule or general regulatory amendment.

Key dates

2026-08-21

CSSF publication of the administrative sanction against Corestate Capital Holding S.A.

Suggested considerations

• Compliance teams of Luxembourg-home-State issuers should obtain and review both PDFs linked to the CSSF publication to confirm the sanction amount, affected report, breached provision, reasoning and any required remediation.
• Issuers should consider testing their annual and half-yearly financial-reporting calendars against the applicable deadlines in Articles 3 and 4 of the Transparency Law, including controls for effective dissemination, filing with the CSSF and storage through the Officially Appointed Mechanism.
• Boards and senior management may wish to document ownership, escalation and evidence-retention arrangements for periodic-reporting deliverables, particularly where audits, restructuring, going-concern issues or delayed financial close could affect publication timing.
• Groups with repeated or historic reporting delays should consider a targeted review of prior CSSF correspondence, compliance with supervisory orders and the completeness of issuer disclosure controls.
• Legal and compliance teams should assess whether any appeal or procedural response is relevant after reviewing the decision; the publication page supplied does not state an appeal period.

What changed

The CSSF imposed an administrative sanction on Corestate Capital Holding S.A. The supplied publication page does not disclose the sanction amount, the precise reporting failure, the legal provision breached, or any remedial order; those details should be taken from the linked PDF decision before relying on them operationally. The publication does not itself introduce a new general obligation: the relevant existing framework is the Luxembourg Transparency Law of 11 January 2008, including its periodic-reporting, dissemination, storage and CSSF-filing requirements where applicable.

Key dates

2025-07-01

During July 2025, Effecta offered the relevant profit participation certificate to retail investors through a website without first publishing the KID. The source does not specify the exact day.

2026-07-30

BaFin imposed the €15,000 administrative fine on Effecta GmbH.

2026-08-21

BaFin’s English publication was current or updated on this date.

Suggested considerations

• Compliance teams may wish to inventory all products offered to retail investors and document the PRIIP classification decision for each product, including profit participation certificates and other structured or securities-like investments.
• Firms should consider implementing a hard pre-launch control that blocks retail subscriptions until the current KID is available on the relevant distribution website and the link, version and publication time have been recorded.
• Intermediaries may wish to allocate contractual responsibility between manufacturer, platform operator and distributor for preparing, approving, publishing, updating and removing KIDs, with evidence of completion retained for each offering.
• Online distributors should consider testing whether the KID is clearly accessible before the investor reaches the binding offer or subscription stage, is free of charge, can be downloaded and stored, and remains available on the required durable medium.
• Firms should consider maintaining audit trails showing the KID version displayed, publication timestamp, website location, investor notification and any periods during which an offering was paused because the KID was unavailable.
• Governance functions may wish to review supervisory oversight of product launches and assess whether escalation, sampling and post-launch monitoring would have prevented or detected a missing KID.
• Compliance teams may wish to review comparable offerings launched since July 2025 and remediate any period in which a PRIIP was presented to retail investors without a compliant KID, taking account of potential disclosure, distribution and customer-redress consequences.

What changed

This is an enforcement action rather than a new rule. BaFin applied Article 13(1) in conjunction with Article 14 of Regulation (EU) No 1286/2014, requiring persons advising on or selling a PRIIP to make the KID available to retail investors free of charge, in good time before they are bound by a contract or offer. The document may be supplied on paper, on another durable medium, or through a website meeting the Regulation’s conditions, including notifying the investor of the website address and location and keeping the KID accessible, downloadable and storable for as long as needed.

Key dates

2025-07-01

During July 2025, Companisto offered the relevant profit participation certificate to retail investors for subscription without having first published the KID. The source identifies the month but not a specific day.

2026-07-30

BaFin imposed the €9,000 administrative fine on Companisto Trust Service XXXV UG for a supervisory-duty breach connected with the Article 5(1) PRIIPs violation.

2026-08-20

BaFin published the English enforcement notice concerning the fine.

2026-08-21

The BaFin publication was updated and displayed the publication date of 21 August 2026.

Suggested considerations

• Firms should inventory products offered to retail investors and identify instruments that may constitute PRIIPs, including profit participation certificates and other structured or investment-linked products.
• Compliance teams may wish to maintain a documented PRIIP classification assessment for each product, including the rationale where an equity-like asset investment is considered outside the PRIIPs scope.
• Manufacturers should ensure that a final, approved KID is published on the relevant website before the product is offered or made available for subscription, with evidence showing the exact publication timestamp and the start of marketing.
• Firms should implement a launch gate preventing website publication, advertising, subscription opening or other retail distribution activity until the required KID has been approved and published.
• Product governance procedures should allocate responsibility among the manufacturer, platform, distributor and website operator for preparing, approving, uploading, monitoring and updating the KID.
• Compliance teams may wish to test archived web pages, subscription journeys and marketing records to confirm that retail investors could not subscribe before the KID became available.
• Senior management should receive exception reporting for any product launch where the KID is incomplete, unavailable, published late or hosted at a location that is not readily accessible to the relevant retail audience.
• Firms should assess whether existing organisational controls are sufficient to prevent or materially impede Article 5(1) breaches, because BaFin’s action shows that inadequate supervisory arrangements may be sanctioned separately from the underlying disclosure failure.

What changed

This is an enforcement action rather than a new rule or amended requirement. BaFin applied Article 5(1) of Regulation (EU) No 1286/2014, which requires a PRIIP manufacturer to draw up and publish a compliant KID before a PRIIP is made available to retail investors. The sanctioned failure was not merely a defective document: the KID was not published on the website in good time before the subscription offer.

Key dates

2026-08-21

CSSF imposed and published the €10,000 administrative fine against Gaz Capital S.A. for non-compliance concerning the annual financial report for the year ended 31 December 2025.

Suggested considerations

• Compliance teams may wish to identify every security for which the firm has Luxembourg as its home Member State and confirm whether any Article 7 exemption applies.
• Issuers with a 31 December financial year-end should consider scheduling publication of the annual financial report no later than 30 April of the following year, subject to the applicable reporting-period and instrument requirements.
• Firms should consider maintaining evidence of timely publication, effective dissemination, submission to the CSSF and storage on the Officially Appointed Mechanism, including timestamps, responsible persons and vendor confirmations.
• Reporting calendars may be reviewed to ensure that audited financial statements, the management report and responsible-person statements are complete and approved sufficiently before the four-month deadline.
• Where a delay is possible, issuers may wish to escalate promptly to senior management, legal counsel and the CSSF and document the cause, remediation and communications plan; the sanction indicates that failure across multiple disclosure channels can be treated as non-compliance even where the underlying report is subsequently produced.
• The issuer may wish to assess whether to challenge the decision before the Tribunal administratif within the statutory three-month period.

What changed

No new regulatory obligation was introduced; this is an enforcement action applying existing requirements. An issuer for which Luxembourg is the home Member State must make its annual financial report public no later than four months after the end of each financial year under Article 3 of the Transparency Law, keep it publicly available for at least 10 years, effectively disseminate it, store it on the Officially Appointed Mechanism and file it with the CSSF.

Key dates

2026-08-21

Request for Comment published in the Federal Register.

2026-10-20 Deadline

Comments are due, calculated as 60 days after Federal Register publication.

2026-10-05

Reported target date for CME Group and Silicon Data to list two compute or GPU-rental futures contracts, subject to regulatory review; this date is not established by the CFTC Request for Comment.

Suggested considerations

• Compliance teams may wish to determine whether the firm has relevant empirical data on compute prices, volumes, counterparties, supplier concentration, utilization, capacity commitments, or bilateral contract terms that could support a CFTC submission.
• Potential DCM and SEF applicants should consider mapping proposed contract specifications and settlement methodologies against CEA section 5(d), Core Principles 2, 3, 4, 5, 9, and 11, 17 CFR 38.150-38.160, 38.200-38.201, 38.250-38.258, 38.500, and 38.603, and the guidance in 17 CFR part 38 appendices B and C.
• Firms developing or contributing data to a compute index should consider documenting data provenance, publication practices, governance, auditability, contributor concentration, observation-window controls, fallback mechanisms, and safeguards against manipulation by capacity providers.
• FCMs, introducing brokers, and other intermediaries may wish to assess whether existing BSA/AML, KYC, onboarding, suitability, disclosure, and market-conduct controls address the risks identified for compute derivatives, including opaque bilateral markets and geopolitically sensitive supply.
• Market participants may wish to submit comments by the applicable deadline, clearly referencing RIN 3038-AF77 and the Request for Comment on the Listing of Compute Derivatives Contracts, while avoiding unnecessary personal or confidential business information because submissions will be publicly posted.
• Firms tracking product development should consider monitoring any subsequent DCM self-certification or Commission-approval filing, as the consultation itself does not authorize trading or postpone a proposed listing.

What changed

No final rule, approval, prohibition, or new compliance obligation was introduced. The CFTC is requesting comment on compute cash-market size, liquidity, transparency, supplier concentration, fungibility, benchmark methodology, deliverable supply, manipulation risks, surveillance feasibility, customer protection, heightened BSA/AML and KYC issues, retail protections, and the design and risks of perpetual compute futures.

Key dates

2026-08-21

Proposal published in the Federal Register for public comment.

2026-10-05 Deadline

Written comments are due 45 days after Federal Register publication.

Suggested considerations

• Firms should assess each pool’s investor eligibility against the natural-person and non-natural-person requirements in proposed Regulation 4.13(a)(4), including the distinctions between qualified eligible persons and accredited investors.
• RIAs should review offering documents, subscription procedures, investor representations, and transfer controls to support the required reasonable belief at investment or conversion that all participants satisfy the applicable eligibility criteria.
• Compliance teams may wish to confirm that each relevant pool’s interests qualify for a Securities Act exemption and that U.S. marketing practices comply with the proposed restriction, including the Rule 506(c) exception.
• Eligible advisers should map Form PF obligations and determine whether existing SEC filings would satisfy the proposed condition that Form PF be filed where required.
• Firms should prepare to file or update electronic exemption notices with the NFA and maintain the proposed Regulation 4.13 annual affirmation, recordkeeping, disclosure, and statutory-disqualification representations.
• Managers operating both registered and exempt pools should assess the proposed Regulation 4.13(e)(2) communications and redemption-right requirements and identify whether any existing participants would require notice before a pool is operated as exempt.
• Small-pool operators should model eligibility using the proposed $800,000 aggregate threshold while continuing to monitor the 15-participant-per-pool limit and unchanged contribution exclusions.
• Managers relying on Staff Letter 25-50 should preserve evidence of current compliance and evaluate transition implications because the CFTC preliminarily proposes to supersede that relief if the rule is finalized.

What changed

Proposed Regulation 4.13(a)(4) would exempt an SEC-registered investment adviser from CPO registration for qualifying pools if the pool interests are exempt from Securities Act registration and are not publicly marketed in the United States, except that the marketing restriction would not apply to pools offered under SEC Rule 506(c) of Regulation D.

Key dates

2026-05-22

Switzerland added 115 natural persons and organisations to its Russia-related sanctions list; approximately 2,790 persons, companies, and organisations are now subject to asset freezes in connection with Russia’s war against Ukraine.

2026-08-19

The Federal Council decided to adopt the further measures of the EU’s 20th Russia sanctions package according to Switzerland’s established practice.

2026-08-20 Deadline

The new measures entered into force, including the prohibition on using Russian platforms for crypto-asset transfers and exchanges and the prohibition on supporting development of specified Russian crypto-assets such as the digital rouble.

Suggested considerations

• Firms should consider updating sanctions screening rules, prohibited-platform lists, wallet and counterparty controls, and transaction-monitoring scenarios to identify Russian crypto-asset platforms and indirect use of those platforms.
• Crypto-asset firms should consider mapping all transfer, exchange, custody, brokerage, technical-support, wallet-access, and infrastructure services against the applicable provisions of the Ordinance on Measures connected with the Situation in Ukraine, including the newly prohibited Russian platforms and specified Russian crypto-assets.
• Compliance teams may wish to review exposure to the digital rouble and other Russian or rouble-linked crypto-assets, including holdings, listings, liquidity provision, development support, transfers, and third-party integrations, and document any required exit or blocking decisions.
• Firms should consider validating that assets of sanctioned natural persons, companies, and organisations are blocked and that affected business relationships are reported to SECO in accordance with the sanctions ordinance.
• Firms should consider establishing or refreshing procedures for prompt escalation of sanctions-related suspicions, including additional clarifications under Article 6 GwG and an immediate Article 9 GwG report to the Money Laundering Reporting Office where suspicions cannot be dispelled.
• Senior compliance and operations owners may wish to evidence implementation from 2026-08-20 through control attestations, blocked-transaction testing, vendor and platform due diligence, and documented review of open Russian-related relationships.

What changed

The Switzerland-Russia sanctions regime now prohibits the use of Russian platforms for crypto-asset transfers and exchanges, targeting alternative payment channels that could facilitate sanctions circumvention. It also prohibits support for the development of specified Russian crypto-assets, including the digital rouble; independent market commentary places this measure alongside restrictions concerning Russian crypto-asset service providers, sanctioned trading venues, wallet or account access, technical assistance, and certain rouble-backed assets such as RUBx and A7A5, although the FINMA...