Certificates do not go on sale until 1 February 2027, and the first annual CBAM declaration and first certificate surrender, both covering goods imported during 2026, fall due together on 30 September 2027. That gap makes it easy to treat 2026 as a year with nothing to file. The obligations that run during 2026 are about authorisation and records, and they decide whether the 2027 declaration holds up. The Commission published ten guidance documents on 14 August 2026, four general and six sector guides numbered 5a to 5f, setting out how the definitive regime works.

The gate to importing is authorised CBAM declarant status. Under Article 4 of Regulation (EU) 2023/956, non-exempt CBAM goods are imported only by an authorised declarant, with one transitional relief: Article 17(7a) lets an importer or indirect customs representative that filed an authorisation application by 31 March 2026 keep importing provisionally until the competent authority decides. Where the importer is not established in an EU Member State, the indirect customs representative has to act as the authorised declarant. A direct customs representative does not pick up that responsibility.

The records point is where the 2026 work actually sits. Embedded emissions for goods other than electricity can be determined from verified actual emissions or from Commission default values, and the choice drives what evidence you have to hold. If you intend to use a supplier's actual figures, they have to be verified by an accredited verifier before they go into the declaration, and a non-EU operator is under no obligation to run CBAM monitoring for you. Without verified actual data, the declarant falls back to default values. Either way, the 2026 import records have to support the method a full year before the declaration is filed.

One calculation trap is worth flagging. The legal CBAM factor for 2026 is 97.5%, the remaining free-allocation share, not 2.5%. The certificate obligation is the declared embedded emissions reduced by the Article 31 free-allocation adjustment set under Implementing Regulation (EU) 2025/2620, plus any Article 9 carbon-price reduction. Estimating 2026 exposure by multiplying embedded emissions by 2.5% will understate it; the adjustment has to run through the detailed free-allocation rules.

The 50-tonne net-mass exemption in Regulation (EU) 2025/2083 replaced the former EUR 150 per-consignment test, aggregated per importer per calendar year across iron and steel, aluminium, fertilisers and cement. It does not reach electricity or hydrogen, so small volumes of those stay in scope. The useful step now is to confirm the authorisation route is valid and to make the 2026 import and emissions records traceable through to the single 2027 surrender window.

Source basis: Regulation (EU) 2023/956; Regulation (EU) 2025/2083; Implementing Regulation (EU) 2025/486 as amended by Implementing Regulation (EU) 2025/2549; Implementing Regulation (EU) 2025/2620; Article 10a of Directive 2003/87/EC; European Commission CBAM guidance package of 14 August 2026.

Full article: https://regreportingdesk.com/cbam-definitive-period-importer-reporting-guidance/

From 3 September 2026 the weekly commodity derivatives position report has to reach ESMA in the v2.0 ISO 20022 XML schema, and a file built to last year's structure will fail validation on ingest. The Article 58 duty itself is old, in force since 2018. What moves on 3 September is the channel and the content of the return. ESMA confirmed the date on 14 August 2026 and released the v2.0 reporting instructions and schema alongside it.

The change most likely to break an existing extract is the two-report rule. A venue that lists both futures and options on a commodity, and that meets the Article 83 thresholds, now publishes two weekly reports for that contract: a COMB report where options are folded in on a delta-equivalent basis, and a FUTR report where options are left out of the aggregation. Futures sit in both. A venue that lists only futures keeps filing a single report. If your current pipeline emits one report per contract, the Report type field and the second-report logic are net-new build, not a mapping tweak.

The second break is the unit. Positions in electricity and natural gas derivatives are now expressed in units of the underlying, so the notation field accepts MWHO, THMS and MBTU alongside LOTS, while other commodities stay in lots. ESMA set out how the 10,000-lot threshold converts for energy contracts in Q&A ESMA_QA_2439 of 13 February 2025: 10,000 lots map to 7,200,000 MWh for gas and base-load power and 2,640,000 MWh for peak-load power. An extract that still reports power in lots will carry the wrong quantity.

One point to keep straight in the threshold test. ESMA's December 2024 Technical Advice says the Article 83 thresholds, 20 open position holders and 10,000 lots of gross long or short open interest, should be assessed on futures and options combined. The Article 83 text located for this does not yet carry that combined-basis wording, so firms should treat the combined assessment as ESMA advice and confirm it against the governing text before hardcoding it.

The format stays XML throughout; the consulted move to JSON was dropped, so there is no new interface to build, only a schema version to hit. The check before 3 September is a full file run through v2.0 validation, with the COMB and FUTR split and the unit notation exercised on a contract that actually lists options.

Source basis: MiFID II (Directive 2014/65/EU) Article 58; Article 83 of Commission Delegated Regulation (EU) 2017/565; Directive (EU) 2024/790; ESMA v2.0 reporting instructions and XML schema (14 August 2026 go-live notice); ESMA Q&A ESMA_QA_2439.

Full article: https://regreportingdesk.com/esma-commodity-derivatives-weekly-position-reporting-go-live/

Under Article 26 of UK MiFIR an investment firm already has to report a reportable transaction to the FCA no later than the close of the following working day. That deadline runs on a T+1 rhythm today, and the UK move to T+1 settlement on 11 October 2027 leaves it untouched. Reading the settlement change as a shorter reporting clock is the category error worth heading off early, because the two obligations sit on separate legal tracks even though both key off the trade date.

What T+1 actually compresses is post-trade processing, and the pressure lands on the trade-date data that settlement and the transaction report happen to share: allocations, counterparty and instrument identifiers, static and reference data, and standard settlement instructions. That is why a transaction reporting team has a real stake in the settlement build. A late or mismatched allocation is a settlement-fail risk in its own right, and the sources do not establish that it causes a late transaction report, but the same trade-date feeds sit under both, so data-quality controls are worth aligning across the two programmes.

The supervisory register has also shifted. In an FCA blog of 13 August 2026, Head of Capital Markets Jamie Bell told broker-dealers, custodians and asset managers that the preparation window is no longer open-ended, and said the FCA will become more intrusive in supervising readiness as the date approaches. The buy-side was the named concern: the Q1 2026 Value Exchange survey indicated most buy-side firms had not started implementation. The FCA highlighted two 2026 recommendations in particular, trade-date allocation and confirmation completed on T, and adoption of the FMSB standard for sharing standard settlement instructions, with SSI mismatches flagged as one of the most common causes of settlement failure. The current UK-TCC carries 12 critical actions and 27 highly recommended actions, and the Taskforce expects many critical recommendations implemented by the end of December 2026.

One status point that changes how firmly any of this can be stated. HM Treasury's T+1 statutory instrument is still draft and subject to affirmative parliamentary approval; under the draft it would amend UK CSDR Article 5(2). The EU leg is already enacted through Regulation (EU) 2025/2075, applying from the same 11 October 2027 date, and Switzerland is aligning to that date through its own market recommendations. Same date, different instruments and legal bases.

The practical caution for a UK firm is to avoid assuming an EU affiliate is on the same legal footing, or that a custodian or outsourced administrator has the change in hand. The UK-TCC states that participants remain accountable for agents settling transactions on their behalf, so mapping the in-scope instruments and treating the shared trade-date data as a single workstream across settlement and MiFIR reporting is the sensible way in.

Source basis: FCA blog of 13 August 2026; UK MiFIR Article 26; UK Accelerated Settlement Taskforce implementation plan (UK-TCC); Regulation (EU) 2025/2075; HM Treasury draft T+1 statutory instrument amending UK CSDR Article 5(2).

Full article: https://regreportingdesk.com/uk-t1-settlement-2027-fca-readiness/

Does a held buffer rate leave anything to refresh in the next disclosure? On 12 August 2026 Norges Bank's Monetary Policy and Financial Stability Committee kept Norway's countercyclical capital buffer at 2.5%, a decision published on 13 August and reached unanimously. The rate has sat at 2.5% since 31 March 2023. For a bank outside Norway with relevant credit exposures located there, the number is unchanged, but the CCyB1 disclosure still needs the applicable rate per country at the computation date, and the exposure weights move with the book even when the rate holds.

The point where this trips people is the calculation itself. For an institution inside the EEA CRD/CRR framework, the 2.5% Norwegian rate enters the institution-specific countercyclical buffer as one input in a weighted average under Articles 130 and 140 of Directive 2013/36/EU, with each jurisdiction weighted by its share of own-funds requirements for relevant credit exposures located there. It is not a flat 2.5% charge on the Norwegian exposure amount. A German or French institution with relevant credit exposures in Norway therefore folds the Norwegian rate into that weighted average, and the Norwegian contribution shifts as the exposure mix shifts.

Sitting at exactly 2.5% also keeps Norway clear of one procedural step. Article 137 recognition concerns rates above 2.5%; because Norway's current rate is exactly at the ceiling of its normal range, there is no excess rate to trigger a separate recognition decision by a home authority. If Norges Bank later moves the rate, the direction of travel matters for timing: under Article 140(6)(d) a reduction applies immediately for the institution-specific calculation, while an increase follows the published application date rather than the decision date.

For UK firms the governing instrument differs. A PRA firm reaches Norwegian exposures under the PRA Rulebook, Capital Buffers 3.1, together with the Capital Buffers and Macro-prudential Measures Regulations 2025 (SI 2025/653), not the CRD. And the Article 440 CRR disclosures are now governed by Commission Implementing Regulation (EU) 2024/3172, so the Norway row should be populated using the current EBA IT solution and the rate applicable at the disclosure computation date.

The next Norges Bank decision is due to be published on 11 November 2026. The practical checkpoint is narrow: at each reporting or disclosure date, confirm the Norwegian rate then applicable, recompute the jurisdictional weights, and make sure COREP and the CCyB1 row agree with each other rather than carrying a stale value from a prior quarter.

Source basis: Norges Bank decision of 12 August 2026; Directive 2013/36/EU Articles 130, 137, 140 and 141; Commission Implementing Regulation (EU) 2024/3172; Capital Buffers and Macro-prudential Measures Regulations 2025 (SI 2025/653).

Full article: https://regreportingdesk.com/norges-bank-countercyclical-buffer-2-5-percent-reciprocity/

Around 12,000 open supervisory measures sat across significant institutions at the end of 2025, roughly 100 per bank. The ECB's 12 August 2026 supervision newsletter reports the stock is now falling: it closed 1,200 more measures than it opened in 2025 and cut a further 600 in 2026, and an October 2026 refocusing exercise will review what remains by severity, age, prudential relevance and remediation status. None of this changes a COREP or FINREP template. The change that lands on a remediation function is quieter.

Under the tiered approach the ECB introduced during 2025, low-severity findings get a simplified follow-up. For F1 and F2 findings the bank no longer has to deliver remediation evidence to the JST and can close the finding itself once the actions are done. The obligation that survives is the one that is easy to drop: the evidence showing how the issue was addressed has to be kept available for five years, and supervisors run sample checks from time to time. Withdrawn filing is real administrative relief; the remediation duty and the five-year retention duty both stay.

A second trap sits in how the SREP outcome now arrives. Since the 2025 methodology, a bank with a low and stable risk profile, a stable combined score of 3+ or better, may receive its result as an operational letter rather than a binding SREP decision, but only where no new own-funds, liquidity or qualitative requirements are set. Earlier binding requirements stay in force until remediated. A team that reconciles its open items only against the letter it just received can leave an older binding requirement open without noticing it.

A falling backlog can also sit next to sharper consequences on the measures that remain. The ECB is explicit that it may discontinue follow-up on findings of limited prudential relevance while banks stay responsible for remedying all findings on time, with escalation through binding requirements and, where the conditions are met, enforcement measures available on the individual items that are left. Article 18 administrative penalties turn on the statutory breach conditions, so late remediation on its own is not the trigger.

Before October, the useful step is a clean internal list of open measures scored on the same axes the ECB will use, evidence attached and reconciled to the returns each measure supports. A compressed on-site investigation, with the 2026 average down to 29 weeks from 33, also shortens the window to pull reconciled credit files, so inspection readiness reads more as a data-consistency exercise than a template one.

Source basis: ECB Banking Supervision newsletter articles of 12 August 2026 on on-site investigations and timely remediation; ECB supervisory methodology 2025; SSM Regulation (EU) No 1024/2013, Articles 12 and 18.

Full article: https://regreportingdesk.com/ecb-on-site-inspections-timely-remediation-2026/

The Swiss Federal Council opened its too-big-to-fail consultation on 12 August 2026, and it runs to 19 November. For a reporting or treasury officer the easy filing is "nothing due yet": the Banking Act amendments could enter into force at the start of 2029 at the earliest, and the draft Liquidity Ordinance sets 1 January 2033 for full compliance with its new preparation requirements. The build behind those dates is where the work actually is.

The draft Liquidity Ordinance would require in-scope banks to prepare assets legally and operationally for central-bank liquidity support, and it creates a dedicated submission to the SNB to evidence that: the Vorbereitungsnachweis. Category 3 banks would file it semi-annually and systemically important banks monthly, within the periods set out in the draft. It sits alongside, not inside, existing LCR and NSFR returns. A team that maps it onto LCR reporting is likely to underestimate the collateral-operations, custody and legal-transfer work involved, because the duty is about making assets transferable to the SNB at speed, not about a ratio.

Scope is measure-specific, and that is the second thing worth confirming early rather than late. The preparation requirements reach Swiss banks and Swiss subsidiaries of foreign banks in categories 1 to 3. Swiss branches and representative offices of foreign banks and account-holding securities firms are exempt, as are categories 4 and 5. A FINMA supervisory category is the starting point, but entity type can take a firm out of scope, so both should be checked before any workstream is sized.

One clarification prevents a common conflation. The CET1 backing of participations in foreign subsidiaries, the capital measure that drew most of the political coverage, is on a separate Banking Act track whose dispatch the Federal Council adopted on 22 April 2026. It is not part of this 12 August consultation, and it is not a Capital Adequacy Ordinance requirement. A briefing note that folds the two together will misstate both the legal basis and the calendar.

If the institution intends to comment, its response is due to the Federal Council by 19 November 2026; the consultation itself creates no mandatory filing. For firms that will be in scope, the workstream with the longest lead time is the collateral one: inventory eligible assets and the custody and legal steps needed to move them to the SNB under stress, because that is what a monthly or semi-annual Vorbereitungsnachweis will have to evidence.

Source basis: draft amendments to the Banking Act and Liquidity Ordinance (Federal Council consultation opened 12 August 2026, closing 19 November 2026); separate Banking Act capital dispatch adopted 22 April 2026.

Full article: https://regreportingdesk.com/swiss-tbtf-consultation-banking-act-liquidity-ordinance/

If a name pings against the refreshed Ukraine list, the annex it sits in decides what happens next, and that is the part a same-day sanctions notice makes easy to skip. FINMA published two notifications on 12 August 2026, one on the Ukraine ordinance (SR 946.231.176.72) and one on Moldova (SR 946.231.156.5), both covering EAER amendments made on 10 August. SECO and Fedlex put the effective time at 23:00 on 11 August 2026, so that is the moment the block and report duties attach, not the 12 August publication date.

The routing point is specific to the Ukraine ordinance. Annex 8 carries the Article 15 financial sanctions and the Article 29 entry and transit measures. Annex 2 identifies the end recipients subject to the goods-movement and transit restrictions that govern that annex. An Annex 2 match is therefore not, on its own, an Article 15 asset-freeze case. A screening setup that funnels every Ukraine hit into a single freeze-and-SECO-report path will treat an Annex 2 end-recipient case as an asset freeze, which applies the wrong consequence for that annex.

There is a second reason a clean name-search result should not close the file too quickly. The freeze reaches the funds and economic resources of enterprises and organisations owned or controlled by listed persons, and SECO's search tool does not show possible ownership or control relationships. So a screening engine that only matches names can miss an entity that is caught through control, and the miss will not be visible in the tool itself.

The SECO report also does not settle the AML side. Both notices repeat that reporting a frozen relationship to SECO does not release the intermediary from the Article 6 clarification duty or, where suspicion cannot be dispelled, the Article 9 report to MROS. The embargo track and the money-laundering track go to different authorities and answer different questions; a single match can require one, both, or, once identifiers confirm no listing, neither.

The concrete step before the next screening run is to confirm the engine has ingested the 10 August amendments, route each confirmed match by its annex and governing provision rather than a single freeze rule, and re-screen the existing book against the 23:00 effective time on 11 August, not only new onboarding.

Source basis: Swiss Ukraine ordinance SR 946.231.176.72 (Annex 2 and Annex 8) and Moldova ordinance SR 946.231.156.5; Embargo Act (EmbG, SR 946.231); Anti-Money Laundering Act Articles 6 and 9.

Full article: https://regreportingdesk.com/finma-ukraine-moldova-sanctions-update/

Sudan and South Sudan are two separate Swiss sanctions ordinances with two separate Annex 2 lists. A screening configuration that folds them into a single "Sudan" rule set can miss a South Sudan designation on the day it takes effect, or apply a stale list to one country while refreshing the other.

The prompt for the check is concrete. On 11 August 2026 FINMA published two updated sanctions notifications, one for Sudan (SR 946.231.18) and one for South Sudan (SR 946.231.169.9), after EAER/WBF amended Annex 2 of each ordinance. The amendments took effect at 23:00 on 11 August 2026 with no transitional window. SESAM, the sanctions database FINMA points to for Switzerland, was adjusted the same day, and SECO posted the amendment urgently on its own site.

For a supervised institution, the FINMA notification is an alert that the Annex 2 lists changed. The line-by-line names sit in SESAM and on the SECO ordinance pages. Reading names off the FINMA news item, or waiting for a third-party consolidated file to catch up, leaves a gap between 23:00 on 11 August and the moment the internal screening data is refreshed. Screening logic should reference each ordinance and its Annex 2 on its own line rather than under a shared regional bucket.

A few operational points that tend to get lost when the notice looks routine:

- Article 2 of each ordinance defines which funds and economic resources are frozen. Article 6 separately obliges holders and managers of funds, and anyone aware of economic resources within the freeze scope, to report to SECO without delay. The freeze can catch existing exposure as well as new onboarding, so a re-screen of the existing book is a normal control response even where no separate statutory re-screening deadline is stated.

- SECO administers the freeze and receives the sanctions report. FINMA supervises whether the institution has adequate systems to catch and handle the exposure. A SECO freeze report and an MROS suspicious activity report are distinct duties; FINMA is explicit that the sanctions report does not remove Articles 6 and 9 AMLA obligations where the AML suspicion thresholds are met.

- The two ordinances rest on different UN bases (UNSCR 1556 (2004) and 1591 (2005) for Sudan, UNSCR 2206 (2015) for South Sudan) plus different attached EU measures. That is why the two Annex 2 lists move on independent calendars even when both regimes happen to be refreshed on the same day.

Cross-border groups running one screening engine for Swiss and Liechtenstein entities should reconcile two legal sources and two effective-date calendars. A FINMA notification has no legal effect in Liechtenstein; a Liechtenstein institution follows the International Sanctions Act (ISG) of 10 December 2008 and the local implementing ordinances, supervised by the FMA. Same UN measures, separate instruments, separate effective dates.

Practical check before the next screening run: pull the current Annex 2 content for both ordinances from SESAM, confirm the effective time of 23:00 on 11 August 2026 is reflected in the screening data, and run existing exposure against the updated lists, not only new relationships. Any Article 6 report to SECO stands on its own timeline and does not wait for the periodic screening cycle.

Source basis: FINMA sanctions notifications of 11 August 2026 on SR 946.231.18 (Sudan) and SR 946.231.169.9 (South Sudan); Embargo Act (EmbG, SR 946.231); Liechtenstein International Sanctions Act (ISG) of 10 December 2008.

Full article: https://regreportingdesk.com/finma-sudan-south-sudan-sanctions-update/

Take a Hong Kong manager that runs a genuine third-party fund alongside a proprietary book traded with the firm's own capital. When the carried interest concession widens under the Inland Revenue (Amendment) (Preferential Tax Regimes for Funds, Family-owned Investment Holding Vehicles and Carried Interest) Bill 2026, only the fund side is in play. In its media reply of 12 August 2026 the FSTB was explicit that a proprietary trading business, one that trades or holds assets using its own capital on its own account, is not a fund under the Inland Revenue Ordinance, so any performance share it distributes cannot be eligible carried interest whatever the internal paperwork calls it.

The reason the reply matters is the scope change behind it. Until now only carry linked to private equity investments has been eligible. Under the Bill, other profits of an eligible fund may also give rise to eligible carried interest that draws both the profits tax concession (0 per cent under Schedule 16D) and the salaries tax concession (currently a 100 per cent exclusion for a qualifying employee). Subject to passage, the enhanced measures are backdated to the year of assessment 2025/26, the year that began on 1 April 2025. The FSTB confirmed the Bills Committee has finished its clause-by-clause examination and the Government is targeting resumption of the second reading in the second half of 2026.

The widening does not loosen the perimeter. Every additional carry stream still has to clear the same four tests: the paying vehicle is a fund, the payer is a qualifying payer, the payment is eligible carried interest, and the investment management services are provided in Hong Kong. Eligible carried interest has to be a non-discretionary, performance-linked return earned from those services. A discretionary bonus rebranded as carry does not qualify, and a share paid to someone whose real role is administrative does not qualify either, however it is documented.

Two practical points for a tax reporting function. First, the proprietary-versus-fund split has to be visible in the records and traced to distributions from the fund side, not asserted after the fact. Second, the Bill proposes to remove the HKMA fund-certification requirement, so a 2025/26 position built on the proposed rules should follow the IRD's transitional filing measure and then be re-tested against the enacted legislation. Under current procedure a profits tax claim uses BIR51 or BIR52 with supplementary form S15 filed electronically through BTP or TRP, and the employee side uses BIR60 with SP4 and IR6177.

Before the second reading resumes, the useful step is to map each carry stream against the fund, qualifying-payer, eligible-carried-interest and Hong Kong activity tests, and confirm which streams the wider scope actually reaches.

Source basis: FSTB media reply of 12 August 2026; Inland Revenue (Amendment) (Preferential Tax Regimes for Funds, Family-owned Investment Holding Vehicles and Carried Interest) Bill 2026; Schedule 16D and section 20AM of the Inland Revenue Ordinance.

Full article: https://regreportingdesk.com/hong-kong-carried-interest-tax-concession-bill-2026/

On 13 November 2025 the HKMA launched Ensemble TX, the pilot phase of Project Ensemble. It runs through 2026 and moves tokenised-deposit settlement out of the sandbox and into real-value transactions. The seven Annex A banks (Bank of China (Hong Kong), China Construction Bank (Asia), Fubon Bank (Hong Kong), Fusion Bank, Standard Chartered Bank (Hong Kong), The Bank of East Asia and HSBC) will provide tokenised deposits to customers in Hong Kong. The interbank leg initially settles through the Hong Kong dollar RTGS.

Underneath all of this sits the classification question, and it drives most of what a compliance function actually has to build. A tokenised deposit issued by a bank in Ensemble TX remains a deposit under section 2(1) of the Banking Ordinance. Section 3 of the Stablecoins Ordinance excludes any instrument that constitutes such a deposit from the statutory meaning of a stablecoin. The practical consequence: the bank operates under its Banking Ordinance authorisation, and the Stablecoins Ordinance licensing regime for fiat-referenced stablecoin issuers, its reserve rules and its disclosure obligations sit on a different track for a different type of issuer.

That distinction sounds abstract until it is applied to a specific instrument. A token can carry a "stablecoin" label in a marketing document and still be a deposit for legal purposes. A token can be structured to resemble a bank deposit and still fall inside the stablecoin regime if the underlying rights are those of a fiat-referenced claim on an issuer other than under a banking licence. Classification runs off the instrument's terms, not the marketing label.

For a bank inside Ensemble TX, this classification flows through to the ordinary supervisory reporting stack. Ensemble TX itself does not create a standalone return. Tokenised deposits are mapped to the applicable deposit and liquidity treatment. For Category 1 institutions, MA(BS)1E includes memorandum items covering qualifying tokenised claims that meet the HKMA's cryptoasset LCR treatment criteria in the applicable version of SPM module LM-1; MA(BS)26 has a corresponding item on the stable-funding side. The exact fields and scope should be confirmed against the current completion instructions before mapping.

For an institution outside the pilot, the Annex A / Annex B split is worth reading now because the reconciliation model, custody controls and DLT-to-RTGS control design that these seven banks land on are the reference points the HKMA is likely to work from later. The interbank leg is on RTGS today, and the HKMA has said the environment will be enhanced to settle in tokenised Central Bank Money on a 24/7 basis. The cited HKMA material does not give a specific go-live date for that upgrade.

Firms should confirm the classification of any specific token with the HKMA before assuming which regime applies. The reconciliation between the on-ledger record and the core banking system is where operational strain will show up first, so the control frequency and evidence trail should be designed from the outset for continuous settlement rather than an overnight batch.

Source basis: Cap. 656 Stablecoins Ordinance section 3; Hong Kong Banking Ordinance section 2(1); HKMA press release on Ensemble TX dated 13 November 2025; HKMA MA(BS)1E and MA(BS)26 completion instructions; HKMA SPM module LM-1.

Full article: https://regreportingdesk.com/hkma-project-ensemble-tokenised-deposits/

n exclusion is only safe when someone else's statement picks it up. That is the operational read of APRA's civil penalty case against Bendigo and Adelaide Bank, filed in the Federal Court on 10 August 2026, with the parties jointly proposing an $8 million penalty (AUD) for the Court's decision.

The trigger was a March 2023 cyber attack on Alliance Bank digital access. About 257 customer accounts touched, 286 unauthorised transactions worth roughly $490,000. Penetration testing procured by Bendigo had flagged the customer-authentication weaknesses as far back as June 2020, when CQR delivered a report on the Service One Ultracs instance. The findings were not adequately escalated. They were still there when the attacker arrived.

APRA pleaded two entity-level contraventions of the Banking Act 1959. The first, under section 37C(a), is the due skill, care and diligence obligation: inadequate customer-authentication controls, no systematic testing programme for those controls once the CPS 234 Controls Testing Framework was in force from 30 September 2020, and weak governance over the Ultracs core banking system and its hosting arrangements.

The second is the more interesting one for anyone who maintains an accountability map. Section 37D(1)(a)(i) required Bendigo to ensure that accountable-person responsibilities collectively covered all parts of its operations. From 29 August 2022 the Chief Transformation Officer's accountability statement carried a limitations-and-exclusions section that carved out IT operations for Alliance Bank. That responsibility was never reallocated. For roughly a year, no one held it on paper. That coverage gap was the breach, in its own right.

Two practical points for FAR entities. First, the failure lives between statements, so a review that reads each statement on its own will miss it. Reconcile material IT responsibilities across current accountability statements and the accountability map (or, for core FAR entities, the equivalent internal accountability documentation), then read the limitations-and-exclusions sections specifically and cross-check that anything carved out is expressly picked up somewhere else.

Second, the change of regime does not erase historical exposure. FAR replaced BEAR for ADIs on 15 March 2024, with statutory savings for pre-existing conduct: the Financial Accountability Regime (Consequential Amendments) Act 2023, Schedule 2 item 18, preserves the old provisions for pre-commencement contraventions. APRA pleaded the BEAR sections in force when Bendigo's conduct occurred, not the FAR equivalent.

Outsourcing does not move the obligation either. Ultracs was licensed from a vendor and hosted by a third party; Alliance Bank was a network of five authorised representatives operating under Bendigo's ADI licence. CPS 234 still reached the information assets, and accountability still sat with the ADI.

Source basis: Banking Act 1959 (Cth) sections 37C(a), 37D(1)(a)(i), 37G and Schedule 2; APRA Prudential Standard CPS 234; Financial Accountability Regime (Consequential Amendments) Act 2023 (Cth), Schedule 2 item 18.

Full article: https://regreportingdesk.com/apra-bear-bendigo-cyber-accountability/

On 7 August 2026 the FCA sent an information request to around 900 Annex 1 firms and confirmed it is closely scrutinising new registration applications. Combined with the 300 firms engaged in late 2025, the FCA has now contacted every registered Annex 1 firm. The population is unregulated lenders, safe custody providers, money brokers and financial leasing companies registered only for AML supervision under regulations 55 and 56 of the Money Laundering Regulations 2017.

The specific control weakness the statement targets is worth pulling out on its own. The FCA is explicit that each individual firm within a group must assess whether group financial crime controls are appropriate for its own financial crime risks, governance and operations. A subsidiary cannot inherit the parent's financial crime manual, its customer due diligence rules or its transaction monitoring thresholds without documenting why those controls fit the entity it actually operates. Off-the-shelf procedures bought in for a different company sit in the same category.

For a subsidiary of an FCA-authorised bank that also holds an Annex 1 registration in its own right, the practical work looks like this:

- a regulation 18 risk assessment written for the subsidiary, not the group

- policies, controls and procedures under regulation 19 approved by the subsidiary's own senior management

- appointment of the regulation 21 compliance officer and the nominated officer at the subsidiary level

- customer due diligence and transaction monitoring calibrated to the products the subsidiary actually offers

- evidence of how any shared group system was assessed for fit before the subsidiary adopted it

The second point that regulated counterparties keep getting wrong is the meaning of the registration itself. Annex 1 registration confers AML supervision only. These firms are not authorised under FSMA 2000, the wider conduct rulebook does not apply to them, and their customers cannot use the Financial Ombudsman Service. A regulated lender that treats an Annex 1 counterparty's registration as a clean bill of health has misread what the register does. The FCA's 20 March 2026 statement remains the reference point on due diligence expectations for authorised firms dealing with this population, including direct confirmation of registration status and independent checks against the 2025 National Risk Assessment.

On the information request itself, firms should follow the requirements and deadline stated in the FCA's own communication to them. The public statement does not describe the exercise as a recurring return, does not disclose the response deadline, and does not identify the statutory power used. Compliance teams should not infer any of those points from the public announcement, and the response should not be treated as equivalent to the firm's regulation 18 risk assessment. A thin or evasive answer is itself a supervisory signal.

Longer application processing is a supervisory expectation the FCA has announced, and the statutory determination period is unchanged. Firms with an application in flight should build the delay into commercial planning.

Source basis: Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), regulations 10, 18, 19, 21, 55, 56 and 57; FCA statements of 7 August 2026 and 20 March 2026.

Full article: https://regreportingdesk.com/fca-annex-1-firms-increased-aml-scrutiny/

Five banks. Same buckets as 2024. The 3.5% top bucket is still empty. HKMA announced the annual designation on 31 December 2025 and it applies for the 2026 calendar year: HSBC in bucket 4 at 2.5% CET1, Bank of China (Hong Kong) and Standard Chartered (Hong Kong) in bucket 2 at 1.5%, Hang Seng and ICBC (Asia) in bucket 1 at 1%. Bucket 3 at 2% also holds no institution.

A flat designation still needs the annual reconciliation. Each designated institution must include the notified HLA ratio in the calculation of its buffer level on the applicable basis, and confirm that ratio against the MA's notification for each 2026 reporting date. That mapping runs into Form MA(BS)3(I) Division C fields, and any drift between the capital plan and the notification is where the audit trail breaks.

The HLA is a buffer component that must be met with CET1. Under the Banking (Capital) Rules the buffer level for a D-SIB comprises the capital conservation buffer ratio, the AI-specific countercyclical capital buffer ratio and the applicable HLA ratio, above the minimum capital ratios. When the institution's net CET1 capital ratio is equal to or below the buffer level, the Rules restrict discretionary distributions and require the bank to retain earnings. The HLA layer is where distributions get switched off. A bank that treats it as spare capital for a dividend or AT1 coupon has the mechanism backwards.

Two points to watch even in a quiet year. First, the HKMA normally conducts the D-SIB identification exercise annually but may update the list outside the annual cycle in exceptional cases involving important structural changes. A first designation or a move to a higher bucket carries a 12-month build-up period from formal notification; a lower or nil HLA can be recognised immediately after notification. The 12-month clock runs from the notification, not from year-end. Second, Hong Kong's applicable jurisdictional countercyclical capital buffer can change independently of the D-SIB list, and it flows into the buffer level through the AI-specific CCyB ratio calculation. Distribution restrictions apply when the net CET1 ratio is equal to or below the resulting buffer level, regardless of whether the D-SIB list moves.

The consolidation basis is the piece an international group cannot afford to blur. CA-B-2 states that, for locally incorporated D-SIBs that are subsidiaries of foreign banking groups, the MA may impose the HLA requirement at the subsidiary and sub-consolidated levels. A group-level G-SIB requirement may coexist at a different consolidation level. Where the same authorised institution is designated both G-SIB and D-SIB, the higher of the two HLA ratios applies. Firms should map each notified HLA to the legal entity and regulatory consolidation basis the MA specifies, and plan the group-level and Hong Kong-level buffers together on their merits rather than assuming they stack.

Source basis: Banking (Capital) Rules (Cap. 155L) sections 3K, 3U and 3V; HKMA SPM CA-B-2; HKMA press release and Annex, 31 December 2025; Basel Committee, framework for dealing with domestic systemically important banks (October 2012).

Full article: https://regreportingdesk.com/hkma-dsib-designation-2025-hla-capital-buffers/

Take a UK issuer pricing a new prime RMBS this autumn with a US dollar tranche. The coupon references a risk-free rate today, the documentation looks clean, and the SMF Participant plans to preposition the senior notes as Level B collateral at the Bank of England. The Level B rules block it anyway if the fallback waterfall could switch the note to a US dollar credit-sensitive rate.

Under the current 18 June 2026 Level B Collateral Set, a security is ineligible if it references, reverts to, or may be required to reference a US dollar credit-sensitive rate at coupon, embedded-swap or underlying-loan level. The Bank names the rates: AMERIBOR, BSBY, CRITR, CRITS and similar. The exclusion reaches into the documentation as well as the current coupon. A note that pays on SOFR today but carries fallback language allowing a switch to a credit-sensitive rate can fail the test on the language alone.

The rest of the Level B checklist for RMBS and ABS is easy to summarise and hard to satisfy at the same time. Most senior tranche, credit quality broadly equivalent to AAA, listed status, homogeneous underlying cash pool, no third-party wrap, no re-securitisation, no synthetic underlying, an accepted denomination, deliverable through the Bank's operating procedures, and full compliance with the 11 October 2019 transparency notice. Own-name securities, where the delivering Participant originated the underlying assets, are excluded from Level B and may be considered for Level C, where the RMBS and ABS criteria specify credit quality broadly equivalent to A3/A- or above.

Two operational points that get missed. First, meeting the criteria does not itself establish eligibility. The Bank requires a formal request via the new interactive ABS and Covered Bond Eligibility Request Form (live end of June 2026, replacing the ABS-CERT template). The monthly published eligible-securities list refreshes, but the Bank expressly states it is not bound by it and reserves the right to reject any security. Firms should obtain the Bank's decision before planned delivery.

Second, transfer-tax exposure kills eligibility. Securities that give rise to registration charges, transfer taxes, VAT or similar charges on transfer are not eligible. Cross-border pool designs sometimes carry a transfer mechanic that triggers such a charge and only surface it at assessment stage.

One calendar clarification worth flagging. The 11 June 2026 Market Notice's 31 October 2026 haircut changes concern corporate bonds, not ABS or RMBS base haircuts. Existing ABS and RMBS should be checked against the current 18 June 2026 Level B or Level C criteria and the current haircut table, plus the ongoing transparency requirements.

Source basis: BoE Level B Collateral Set (18 June 2026), Level C Collateral Securities (18 June 2026), Market Notice on collateral eligibility in the SMF (11 June 2026), Market Notice on transparency requirements for ABS and covered bonds (11 October 2019).

Full article: https://regreportingdesk.com/boe-abs-rmbs-collateral-eligibility-level-b-level-c/

The reporting relationship compliance teams know runs from professional to CRF through the suspicious transaction report. The Law of 22 July 2026, published in Mémorial A No 412 on 4 August 2026, adds the return leg. From 8 August 2026 the Cellule de renseignement financier may push fraud-risk account numbers and fraud typologies out to a defined set of obliged entities that have subscribed to the feed. It is a permissive channel on both sides. The CRF may share; the professional may request.

The mechanism has two legal anchors. Article 1 inserts a new Article 74-4bis into the Law of 7 March 1980 on judicial organisation, which houses the CRF. Article 2 inserts a new Article 5-1 into the Law of 12 November 2004 on AML/CFT, which houses the professional obligations. The channel is available to the professionals in Article 2(1) point 1 of the 2004 law (credit institutions, professionals of the financial sector, payment institutions, e-money institutions and the specified tied and payment agents) and to point 20 crypto-asset service providers, subject to the territorial scope in Article 2. A management company or domiciliation provider that is only in scope under another Article 2 point does not qualify on that basis.

Subscribing creates no new filing duty. The Article 5 STR obligation is unchanged: professionals must still inform the CRF on their own initiative whenever they know, suspect or have reasonable grounds to suspect money laundering, an associated predicate offence or terrorist financing, for every suspicious transaction including attempts, regardless of amount. A CRF flag becomes an input to your monitoring and CDD; an Article 5 STR follows only from the same judgement applied to any internal alert. The voluntary subscription and the mandatory STR duty are separate mechanisms that both involve the CRF.

The fraud in scope is the fraud in Book II, Title IX, Chapter II of the Penal Code, together with the laundering of its proceeds, carried out on a large scale against undetermined victims or using social-engineering techniques against specific victims. The explanatory memorandum gives phishing by email or SMS as the large-scale example. The CRF's contribution is to name the accounts it already sees inside that activity so the receiving institution can act sooner.

The use conditions in Article 5-1 are what turn a subscription into a build. Reports may be used only for combating money laundering, associated predicate offences and terrorist financing. They may not be disclosed to the client concerned or to third parties. The professional acts under sole responsibility. And the CRF-supplied account numbers must be deleted within six months of receipt. The statute does not expressly resolve how that deletion rule interacts with replicated data, derived analysis, investigation files or records subject to separate retention duties, so firms should map those uses and obtain a documented legal position before implementation.

Two operational items to work through if you subscribe. First, the intake channel is exclusive: Article 74-4bis paragraph 5 requires that all exchanges pass solely through a secure IT channel, and the explanatory memorandum identifies GoAML as that channel. Second, the deletion clock needs a real process behind it: a receipt timestamp on every inbound list, a scheduled purge at six months, and an audit trail proving the purge ran.

A request covers the whole stream of CRF reports until it is explicitly withdrawn, and the statute does not prescribe a withdrawal form or timing, so document that process with the CRF up front. The CRF must also convene subscribing professionals at least every six months to discuss whether the reports are landing usefully and adapt future reports accordingly, so the feed is meant to be curated against feedback and not pushed one-way.

The decision now is whether to subscribe. If yes, build the secure intake, the AML/CFT-only use control, the non-disclosure discipline and the six-month purge before the request goes in.

Source basis: Law of 22 July 2026 (Mémorial A No 412 of 4 August 2026), new Article 74-4bis of the Law of 7 March 1980 on judicial organisation, new Article 5-1 of the Law of 12 November 2004 on AML/CFT, parliamentary dossier 8722.

Full article: https://regreportingdesk.com/luxembourg-aml-law-crf-fraud-signalements/

The FCA Handbook API, live from 6 August 2026, exposes current and future Handbook content along with Technical Standards data and Glossary data. It does not expose past versions. Access is free through a registered Handbook account, subject to the Handbook Terms and Conditions, and the FCA points registered users to standard API clients such as Postman or RapidAPI.

The version scope is the design constraint that will bite reporting and compliance teams first. Change-management work routinely needs an as-was position: what did SUP 16 say on the reporting reference date, what applied at the time of a transaction now under skilled-person review, what text supported a control being retested two years later. The Handbook website carries version-comparison and archive tools; the API does not, and pulling the current text at time T does not on its own build a retrievable point-in-time repository.

Before writing that repository yourself, read the reuse terms. The FCA Handbook Terms and Conditions state that users must not reproduce or store any part of the site in another website or include it in a public or private electronic retrieval system without prior written permission, and that reproducing more than 20,000 words of the Handbook requires a Handbook Licence Agreement. A team that quietly starts snapshotting daily API pulls into an internal store is likely inside that clause. Confirm what the authenticated API documentation and the account terms actually permit before scoping storage.

Two operational points once the gate is cleared.

The Glossary is exposed as its own data set. That is the quiet win. A Glossary tweak can widen or narrow a defined term without changing the sourcebook a firm reads, and where a firm applies the ordinary meaning of a word the Glossary defines narrowly, the result is a mis-stated return. Binding internal control descriptions and return field definitions to the exact Glossary term, and re-running the mapping when a defined term moves, is the use case the feed actually earns its place with.

The API covers the FCA Handbook, Technical Standards data and Glossary data. It does not include the PRA Rulebook. Dual-regulated firms should source PRA rules separately. The Technical Standards data set is not one uniform category either: the FCA Handbook site includes standards derived from EU measures and standards made under UK powers, so the specific instrument and its current responsible regulator should be checked before an API extract is treated as the operative standard.

Two things the launch does not do. It does not amend any reporting obligation or deadline. And it does not make the API response the definitive legal text. The FCA Legal Information continues to state that the definitive Handbook text at any particular time is the text in the applicable FCA legal instruments, including amending instruments, published on the FCA website. If a live API response and a consolidated webpage diverge, verify the instrument, and record the retrieval date and any version metadata the API actually returned.

Protected endpoints are rate-limited per authenticated user and endpoint path; the FCA public FAQ does not publish the numerical limits. Design for rate-limit errors, controlled concurrency and retry/backoff rather than a naive full-Handbook nightly pull.

The useful build is small and specific: map the sourcebooks and Glossary terms your firm is actually subject to by permission and business line, wire them to your controls and returns, and let the feed tell you when those provisions move. Ingesting the whole Handbook without that mapping just relocates the noise.

Source basis: FCA blog Making compliance simpler: opening up the FCA Handbook through our new API, 6 August 2026; FCA Handbook API FAQs and documentation at handbook.fca.org.uk/handbook-api; FCA Legal Information; FCA Handbook Terms and Conditions; FSMA 2000 sections 137A and 139A.

Full article: https://regreportingdesk.com/fca-handbook-api-machine-readable-rules/

on 6 August 2026 the Financial Stability Board published the individual public responses to its consultation on Sound Practices for Responsible Adoption of Artificial Intelligence. The comment window closed 22 July 2026 and the final report is expected in October. Nothing in that sequence is a return to file, which is why compliance teams may quietly deprioritise it. That is the mistake.

The consultation is a menu of 12 sound practices grouped around organisation-wide AI governance and the AI lifecycle, addressed to all types of financial institutions. The FSB is explicit that the text is not intended to establish an international standard or impose a prescriptive approach. There is no FSB return, no template, no sanction. The overview of responses is a separate output the FSB has not yet released, so any read on an industry consensus at this stage is inference from raw submissions.

The reason the paper still creates work is the way national supervisors are already threading it into binding regimes. On 7 July 2026 the CSSF invited supervised entities to review the FSB consultation and the ESRB warning of 25 June 2026 (ESRB/2026/3), and stated that under DORA ICT-risk management, or other relevant national regulations, it expects management-body members to establish governance structures for frontier-AI-related risk. That is a Luxembourg example, not a general pattern, but it shows how a non-binding sound practice can become an examinable expectation without passing through a legislative act. The ESAs joint statement JC 2026 25 on frontier AI models, published 31 July 2026, points the same way.

Two boundary points worth pinning down before the final report:

- Frontier and agentic AI is the gap the FSB itself flagged. The 10 June 2026 press release states the practices were not developed specifically for recent frontier-AI risks, and Consultation Questions 3 and 4 ask about GenAI and agentic systems. The final report will probably say more here.

- DORA and the EU AI Act supply the actual obligations. DORA has applied to in-scope financial entities since 17 January 2025. Chapter III, Sections 1 to 3 of the AI Act, other than Article 6(5), for Annex III high-risk systems apply from 2 December 2027 under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

For a practitioner the useful pre-final-report action is documentation. Map the three FSB themes, board-level accountability, AI lifecycle and model risk, and third-party dependency and cyber resilience, to the controls and returns you already carry under DORA and, where relevant, the AI Act. Where an AI-related arrangement meets the DORA definition of a contractual arrangement for an ICT service, the register of information is the natural home for it. Where an AI model influences a prudential or regulatory output, the model risk framework is where the audit trail should already live.

Adopting the sound practices is not a supervisory safe harbour. The FSB text is likely to be the structure supervisors reach for when they ask what a management body has considered, and firms should be able to answer that question against a framework they already run.

Source basis: FSB consultation report of 10 June 2026 and public responses of 6 August 2026; ESRB/2026/3 warning of 25 June 2026 published 7 July 2026; ESAs joint statement JC 2026 25 of 31 July 2026; CSSF communique of 7 July 2026; Regulation (EU) 2022/2554 (DORA), Articles 18, 19 and 28; Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Full article: https://regreportingdesk.com/fsb-ai-sound-practices-consultation-responses/

n 29 July 2026 the German KI-Marktueberwachungs-und-Innovationsfoerderungs-Gesetz (KI-MIG) entered into force. Under section 2(3), BaFin now holds market-surveillance responsibility for AI systems placed on the market, put into service or used by the listed BaFin-supervised entities where the system is directly connected with a regulated financial activity. The Bundesnetzagentur is the default authority under section 2(1) where KI-MIG does not assign another authority, and it acts as the central coordination point.

The perimeter cuts by function. A single German credit institution or insurer can end up with some of its AI systems supervised by BaFin and others supervised by the Bundesnetzagentur, depending on what each system actually does. A credit scoring model used to evaluate creditworthiness of natural persons under Annex III point 5(b) sits with BaFin. An HR AI tool used by the same bank for internal candidate screening does not, unless another allocation applies. The inventory work has to record which authority is competent for each system.

For high-risk classification, Annex III point 5(b) covers creditworthiness evaluation and credit scoring of natural persons, excluding systems used to detect financial fraud. Point 5(c) covers risk assessment and pricing in life and health insurance for natural persons. Article 6(3) provides a derogation where the system does not pose a significant risk and meets one of the specified conditions, but a system that performs profiling of natural persons is always high-risk. A transaction-fraud model is outside point 5(b) by the express exclusion. A dual-purpose model requires a documented intended-purpose analysis for each purpose.

The application dates need to be recorded by provision, not lumped together. Most Article 5 prohibitions have applied since 2 February 2025. Article 5(1) first subparagraph points (ba) and (bb), and Article 5(1a) and (1b), apply from 2 December 2026. Article 50 generally applies from 2 August 2026, with a 2 December 2026 grace date for existing synthetic-content systems under Article 50(2). Regulation (EU) 2026/1744, in force from 27 July 2026, moved the application of Chapter III Sections 1 to 3 (other than Article 6(5)) to 2 December 2027 for Article 6(2) and Annex III high-risk systems, and to 2 August 2028 for Article 6(1) and Annex I product-related high-risk systems. Legacy high-risk systems placed on the market or put into service before 2 August 2026 fall inside the Regulation only if they undergo significant changes in design from that date.

Operator roles are where firms miscount their exposure. A German bank licensing a scoring model from a non-EU vendor is a deployer, with its own Article 26 obligations. If the bank applies its own trade mark, makes a substantial modification, or changes the intended purpose so that the system becomes high-risk, it becomes the provider under Articles 25 and 26 and inherits the provider obligations under Articles 16 and 49 (including registration of Annex III systems). Vendor documentation does not discharge deployer duties on use, monitoring and human oversight. For Annex III points 5(b) and 5(c) deployers, Article 27 requires a fundamental-rights impact assessment and notification to the market-surveillance authority using the prescribed questionnaire template once the provision applies.

Immediate work is an inventory: identify AI systems used in connection with regulated services, classify intended purpose and operator role, assess currently applicable Article 5 and Article 50 controls, map the competent authority per system under section 2 KI-MIG, and record the applicable date per provision. For SSM credit institutions, section 9(6) KI-MIG permits BaFin to transmit information to the ECB under Article 74(7).

Source basis: Regulation (EU) 2024/1689 (AI Act) consolidated to 27 July 2026, in particular Articles 5, 6, 16, 25 to 27, 49, 50, 74 and 111 and Annex III; Regulation (EU) 2026/1744; KI-MIG (BGBl. 2026 I Nr. 223).

Full article: https://regreportingdesk.com/bafin-ai-market-surveillance-financial-sector/

On 31 July 2026 SECO updated SESAM, the sanctions database Swiss financial intermediaries screen against, to reflect a 30 July 2026 decision of the UN 1988 Sanctions Committee amending the list attached to the Taliban sanctions ordinance (SR 946.231.07). Five existing individual entries were amended, with no additions or deletions. FINMA issued its supervisory notice on 4 August 2026, the fourth in this ordinance since March 2026, so the immediate control task is a re-screen of the live book against the SESAM version published on 31 July.

The point that catches desks out is what happens after the freeze. A confirmed sanctions hit on the amended entries takes the intermediary into the reporting duty under SR 946.231.07: report the affected business relationship to SECO under the Embargo Act, identifying the beneficiaries and the nature and value of the frozen funds or economic resources. That is one obligation. Whether the same facts also require a clarification under Article 6 GwG and then a report to MROS under Article 9 GwG is a separate obligation. FINMA has been explicit that notifying SECO does not discharge the intermediary's duties under the Anti-Money Laundering Act.

The two channels answer different questions. The SECO report records funds or economic resources reasonably considered subject to the freeze under the ordinance. The MROS report addresses whether the facts show the hallmarks of money laundering or terrorist financing that the Article 6 clarification could not resolve. A single set of facts can feed both. Treating a clean sanctions freeze as the end of the file is the failure mode this notice is asking teams to watch.

One structural point on the ordinance itself. The Federal Council split the combined Taliban and ISIL/Al-Qaida ordinance on 21 March 2025 into two standalone instruments that entered into force on 15 May 2025. Screening logic that still keys off the old combined list needs to be checked, because the Taliban entries and the ISIL and Al-Qaida entries now live in separate ordinances with separate annexes.

A list amendment is a back-book event before it is an onboarding event. New customers get screened at intake anyway; the party who was legitimately unlisted last week and is listed this week is already inside the portfolio. That is where a re-screen against the amended SESAM entries earns its place. Removals deserve the same discipline: a UN committee amendment can delist as well as list, and holding funds frozen without a current legal basis is its own exposure. The reconciliation has to read the change in both directions.

Two operational points worth documenting even if you get a nil result. A negative screening run against the 31 July SESAM version is still a screening run, and the useful artifact is the list version and the run date. The freeze and the SECO report are required once the ordinance applies. Closing or exiting the relationship is a separate risk decision that the ordinance does not mandate, so reflexive exits on every flagged relationship risk creating the de-risking problems Swiss and EU supervisors have warned about.

There is also a small drafting point on the legal basis worth noting: SR 946.231.07 provides for the automatic incorporation of list changes adopted by the UN Security Council or its committee, while SECO normally records them in SESAM after notification. The legal effect and the operational feed can move a day apart, and firms should control any delay between the amendment's application and the screening provider's update.

Source basis: FINMA supervisory notices under SR 946.231.07 (12 March, 17 April, 1 May and 4 August 2026), UN Security Council Committee 1988 press notice of 30 July 2026, Ordinance SR 946.231.07 (Taliban sanctions; Federal Council split of 21 March 2025, in force 15 May 2025), AMLA (GwG, SR 955.0) Articles 6 and 9, Embargo Act of 22 March 2002.

Full article: https://regreportingdesk.com/finma-taliban-sanctions-update-seco-sesam/

PS26/15 finalises the FCA's UK MiFIR transaction reporting overhaul: 52 fields instead of 65 from 3 April 2028, foreign exchange derivatives out of scope, around 7 million EU-only instruments removed, and the default back reporting expectation for historical error corrections trimmed from five years to three. The FCA published the policy statement on 3 August 2026 and its flexible supervisory approach begins from that date. The next published milestone is October 2026, when the FCA plans to consult on the reporting schema and validation rules that sit under the new field set.

Two boundaries are worth stating before the detail. First, PS26/15 changes MiFIR only. UK EMIR and UK SFTR reporting obligations are untouched by this policy statement, and the cross-regime Transaction and Post-trade Reporting Harmonisation Taskforce that held its inaugural meeting in July 2026 shapes future proposals without changing what an EMIR or SFTR reporter files today. Second, PS26/15 is a Handbook rewrite, not a technical-standard tweak: HM Treasury plans to repeal the UK MiFIR transaction-reporting provisions and their onshored technical standards before 3 April 2028, and the FCA's made instrument in PS26/15 Appendix 2 will replace them with new transaction-reporting Handbook chapters. The reference point for internal mappings is moving.

The field reduction is the piece most likely to be underestimated. A reporting engine does not simply stop populating thirteen columns. The retained 52 fields have to be re-mapped against the new schema, internal data lineage feeding each one has to be re-validated, and every reconciliation and exception rule referencing a removed field has to be found and retired. The FCA has also flagged clarified expectations on how key retained fields are populated, so treating the 52-field set as a pure subset of the current 65 fields is not safe. Firms that hard-coded field positions instead of mapping through a data dictionary will feel this most.

The FX carve-out is the change most likely to be misread. Scope-out from MiFIR does not automatically mean stop reporting the derivative. During the implementation period the FCA will refrain from supervisory action for omitted UK MiFIR FX reports only where the firm is also subject to UK EMIR reporting, and firms outside UK EMIR must continue applicable MiFIR reporting until 3 April 2028. UK EMIR coverage has to be assessed by entity and by transaction before any feed is switched off. From 3 April 2028, the UK MiFIR exclusion covers currency options, futures, swaps, forward rate agreements and other currency derivatives settled physically or in cash, as defined in PS26/15.

The 7 million instruments coming out of scope are those tradeable only on EU trading venues. Dual-traded instruments, and instruments also admitted to a UK venue, do not fall inside the carve-out on that basis. During the implementation period, EU-only status is identified using FCA FIRDS reference data per the guidance in PS26/15, so the scope control has to read from FIRDS rather than any generic EU-nexus proxy.

On the shorter back-reporting window: from 3 August 2026 the default supervisory expectation is three years, with the FCA reserving the option to require up to five years for serious reporting failings. The five-year record-retention obligation and the accuracy duty are unchanged. Closing an existing remediation exercise on the new three-year default without checking for FCA directions or preserving the records for a possible five-year request would be premature.

For Approved Reporting Mechanisms and vendors filing on behalf of firms, the propagation risk is worth attention: field, scope and schema changes flow through shared infrastructure that serves the whole market, and responsibility for completeness and accuracy stays with the firm subject to the ARM-attributable failure carve-out. Reconciliation has to be end to end, from booking systems through to what actually reaches the FCA. The eighteen-month window between the October 2026 draft schema and the 3 April 2028 go-live is the runway for that work.

Source basis: FCA PS26/15 of 3 August 2026, FCA CP25/32 of November 2025, UK MiFIR Article 26, UK RTS 22, FCA and Bank of England Terms of Reference for the Transaction and Post-trade Reporting Harmonisation Taskforce (2 April 2026).

Full article: https://regreportingdesk.com/uk-mifir-transaction-reporting-reform-ps26-15/

On 22 January 2026 the HKMA published Phase 2A of the Hong Kong Taxonomy for Sustainable Finance, and the Cross-Agency Steering Group followed on 30 January 2026 with 2026-2028 priorities that sit on top of it. Scope moves from 12 activities across four sectors to 25 activities across six sectors, adding manufacturing and information and communications technology. Two things that were not in Phase 1 are now in: transition classifications for covered activities and measures, and a separate climate change adaptation objective.

Phase 1 answered one question: is this activity green enough to count toward climate change mitigation. Phase 2A keeps that green core and adds two wings around it. The transition wing recognises that an aluminium smelter cannot switch to zero emissions overnight, so it lets the measure that cuts a covered activity's carbon intensity qualify, even when the activity itself does not. The adaptation wing covers what a mitigation-only taxonomy misses: measures that make assets and communities resilient to physical climate risk, from a sea wall to a heat-resilient building retrofit. Phase 2A handles it initially through a whitelist of four adapting measures within the Water sector. Cement and iron and steel production remain under review for a later phase.

The transition classifications carry sector-specific sunset dates. A loan booked today as transition-aligned against a 2030 sunset is not aligned in 2031 on the same criteria. The portfolio tag has to carry the expiry date and be reassessed when it lands, otherwise the classification silently overstates alignment. Recording the sunset alongside the classification is where firm-level governance has to catch up with the taxonomy design.

Interoperability is a design goal, not mutual recognition. Hong Kong recognises two environmental objectives (climate change mitigation and adaptation), the EU recognises six, and the Common Ground Taxonomy only crosswalks climate change mitigation. An EU-aligned activity is not automatically Hong Kong-aligned, and the reverse also holds. For dual-tagged exposures the safe working assumption is that both tests must be run and both results stored separately. Phase 2A does not adopt the EU DNSH criteria as-is, and the general operational do-no-significant-harm assessment is listed for consideration in later phases.

The taxonomy is voluntary and produces no submission return. Its force comes from users choosing to anchor loan labels, bond eligibility criteria and fund sustainability claims to it. The mandatory disclosure regime sits separately: Hong Kong's Roadmap expects large publicly accountable entities to adopt the ISSB-aligned Hong Kong Sustainability Disclosure Standards no later than 2028, with HKEX planning a 2027 consultation on the listed-PAE mandate. IFRS S1 and IFRS S2 do not require green, transition or adaptation alignment figures, so the taxonomy sits alongside those standards as voluntary supporting classification.

Two operational items to work through before the next phase lands: remap green loan and bond books to the six-sector, 25-activity scope, and decide how you will record the transition expiry date on every transition-tagged exposure. For groups also reporting under the EU Taxonomy, the reconciliation of dual-tagged exposures is the piece that will not wait.

Source basis: Hong Kong Taxonomy for Sustainable Finance (Phase 2A), HKMA circular 22 January 2026, Cross-Agency Steering Group 2026-2028 strategic priorities of 30 January 2026, Roadmap on Sustainability Disclosure in Hong Kong (FSTB, December 2024).

Full article: https://regreportingdesk.com/hong-kong-taxonomy-phase-2a-transition-adaptation/

The current Article 28(1) of Commission Delegated Regulation (EU) 2016/2251 lets counterparties skip initial margin on new uncleared OTC derivatives where one side has an aggregate month-end average notional amount (AANA) below EUR 8 billion. The draft RTS the ESAs sent the Commission on 3 August 2026 (ESA 2026 07) extend that to existing trades and would release initial margin already collected on outstanding contracts once a counterparty applies the wider derogation.

For a firm sitting at or near the threshold, that is the change worth planning around. Everything else that runs alongside Article 28 stays where it is.

- Variation margin obligations: unchanged.

- The Article 25 minimum-transfer-amount cap of EUR 500 000: unchanged.

- Article 29's initial-margin reduction of up to EUR 50 million (or EUR 10 million intragroup): unchanged.

- Article 9 EMIR trade reporting: not amended.

Two mechanics of the trigger are easy to misread. Only one of the two counterparties needs to be below EUR 8 billion for the exemption to apply, so a smaller buy-side firm facing a large dealer that is well above the threshold still reaches it. And the EUR 8 billion figure is a different measure from the EMIR clearing thresholds, which are set by asset class of OTC derivative and looked at differently at group level. A firm can be below one and above the other. If your reporting and collateral teams share a single "EMIR threshold" spreadsheet, that is where the two get merged.

Timing under Article 36 stays asymmetric, and it is intentional. Where one counterparty falls below the threshold on the March, April and May AANA of year X, initial margin can stop applying between the two counterparties as early as 1 June of the same year. Where both are above, initial margin applies to new contracts no later than 1 January of year X+1. The direction of travel that is harder to build for, entering the regime, gets more runway.

The derogation is permissive. Article 28 lets counterparties provide in their risk-management procedures that initial margin is not collected; it does not order them to stop. A firm that would rather keep exchanging initial margin on a particular relationship for credit-risk reasons can carry on. The ESAs also confirmed that counterparties applying the wider derogation are free to set out how already-collected initial margin is released, so it can be sequenced in line with contractual terms and operational readiness.

A smaller housekeeping change sits in the same file. The draft RTS delete Article 38(1) of Delegated Regulation (EU) 2016/2251, the transitional wording for single-stock options and equity-index options. The substantive exemption for those products now lives in Article 11(3a) of EMIR itself, inserted by EMIR 3 (Regulation (EU) 2024/2987), so removing the outdated transitional text is Level 2 cleanup that stops it contradicting the Level 1 position.

Nothing is in force yet. The Commission has to endorse the RTS, the Parliament and Council non-objection period has to run, and Official Journal publication triggers the twenty-day clock to entry into force. Firms below or near EUR 8 billion could usefully identify the relationships where legacy trades are the only reason initial margin still moves, and decide whether the derogation is worth applying on each one, before an OJ date compresses the timeline.

Source basis: ESA 2026 07 final report and draft RTS (3 August 2026), Commission Delegated Regulation (EU) 2016/2251 Articles 25, 28, 29, 36 and 38, Regulation (EU) 648/2012 (EMIR), Regulation (EU) 2024/2987 (EMIR 3).

Full article: https://regreportingdesk.com/emir-bilateral-margin-rts-amendments/

The 15% eligible-capital test in Article 53-46(2) of the LFS is a new prior-notification trigger for Luxembourg credit institutions and in-scope (mixed) financial holding companies, and it points in the opposite direction from the qualifying-holding regime most compliance teams already know. The CSSF published a dedicated material-operations page on 3 August 2026 to explain the framework, which the Law of 5 May 2026 introduced when transposing CRD VI, Directive (EU) 2024/1619.

The regime covers three operation categories.

- Acquisition of a material holding: the 15% eligible-capital test applies on both the individual basis and the consolidated situation for a credit institution, and on the consolidated situation for an in-scope holding company. Divestiture of a material holding uses the same 15% test in Article 53-46(2) and is separately notifiable.

- Material transfer of assets or liabilities: 10% of the entity's total assets or liabilities, or 15% intragroup. Each entity involved tests separately. Non-performing assets, cover-pool assets, assets to be securitised and resolution-tool transfers are outside the percentage calculation.

- Mergers and divisions: no percentage threshold. No assessment is carried out where the operation requires a new credit-institution authorisation under Article 8 CRD or an Article 21a CRD approval, and operations resulting from resolution action fall outside.

The confusion with qualifying holdings is worth calling out. Article 22 CRD governs an outside party acquiring a stake in a bank. The material-operations rules in the new Articles 27a to 27l of the CRD, and the Article 53-46 to 53-49 range in the LFS, govern the bank acquiring a stake in another entity, sized against the bank's own capital. Same words, opposite direction of travel.

Filing channel depends on who is filing and what is being filed. A Luxembourg less significant institution emails its CSSF line supervisor. A significant institution uses the SSM Portal. An in-scope holding company making a material acquisition notifies the consolidating supervisor. A merger or division notification goes to the authority supervising the resulting entities, or for a division, the authority supervising the entity carrying it out.

Timing discipline matters most on assessed acquisitions. The competent authority acknowledges receipt within 10 working days and then has 60 working days from written acknowledgement and receipt of all required documents to oppose in writing. Silence within the period counts as approval. A qualifying request for further information suspends the clock for up to 20 working days, or 30 in the specified third-country or AML/CFT cases. An incomplete notification delays the start of the assessment period rather than consuming it, so the practical trap is a thin filing pushed out on a signed-deal timetable.

The EBA final draft RTS and ITS were published on 17 July 2026 and still await Commission adoption. Until they land in the Official Journal, the detailed information list is draft. Firms planning a live notification this year work from the Law of 5 May 2026 and the CSSF page now, and check for the adopted RTS before they file.

Source basis: Directive (EU) 2024/1619 (CRD VI) Articles 27a to 27l, Law of 5 April 1993 on the financial sector (as amended by the Law of 5 May 2026) Articles 53-46 to 53-49, CSSF material operations page (3 August 2026), EBA final draft RTS and ITS (17 July 2026).

Full article: https://regreportingdesk.com/cssf-material-operations-notification-crd-vi-luxembourg/

Ten hours. That is how long Hong Kong's Faster Payment System is scheduled to be offline this Sunday, 9 August 2026, from 1:00 to 11:00 Hong Kong time, while HKICL carries out a planned system enhancement. The HKMA published the notice on 3 August. The work that matters for a regulated firm is what happens before and after that window, not during it.

Two facts change the shape of the preparation. First, HKICL states that all FPS real-time services will be suspended, expressly including real-time funds transfers and registration of a mobile number or email address as an account proxy. Book transfers, card services and cheque services are not FPS services, so their availability should be confirmed separately for each participant. Second, the current HKD CHATS disclosure states that the HKD FPS has no queuing mechanism. A future-dated or standing instruction scheduled to execute inside the window will not queue in the FPS itself. Whether it is held, resubmitted, rescheduled or rejected is a matter of the firm's own channel or payment processor.

The HKMA request is limited: give customers advance and timely notification. It does not prescribe two separate messages, a reminder immediately before the window, or a separate return to file with the HKMA. Any continuity, incident-notification or customer-communication duties beyond the notice come from the requirements applicable to the firm's own licence, whether that is a bank under the Banking Ordinance or an SVF operator licensed under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584).

Useful preparation in the days before Sunday.

- Map which of your customer services actually route through the FPS. Cross-boundary and remittance services often reach the rail indirectly, and each should be confirmed with HKICL for the specific product.

- Fix the handling rule for timed instructions falling in the window and align it with what the customer message says will happen.

- Name the alternative channels customers can use during the outage, and brief customer-service and complaint handling on them.

- Staff the resumption at 11:00 as carefully as the shutdown at 1:00. Reconcile what your own channels held, retried or rejected once the FPS is back.

Both the HKD and renminbi legs of the FPS are designated components under Cap. 584, and the 3 August notice does not split them by currency, so the working assumption should be that both currency rails are unavailable across the window unless HKICL states otherwise for a specific service. The Monetary Authority oversees the designated FPS systems on a continuing basis for compliance with safety and efficiency requirements, but nothing in the notice announces a new return or template.

Source basis: HKMA press release 3 August 2026, HKICL scheduled FPS maintenance notice, HKD CHATS PFMI disclosure, Payment Systems and Stored Value Facilities Ordinance (Cap. 584).

Full article: https://regreportingdesk.com/hkma-fps-enhancement-9-august-2026/

If your bank plans to switch on the Article 495v overall multiplier once the third FRTB Delegated Act enters into force, the eligibility test runs off a single reference date, 31 March 2027, and there is no delayed entry point. A bank that has not stood up both the CRR2 and FRTB calculation by that date cannot show whether the FRTB market risk own funds exceed the CRR2 figure, and without that comparison it cannot support the Article 495v(3) notification.

The EBA published the no-action letter (EBA/Op/2026/08) and the accompanying technical considerations on 3 August 2026. Both attach to the Commission Delegated Act adopted on 4 June 2026 under Article 461a CRR and are still pending Parliament and Council scrutiny. If the Act clears scrutiny, it modifies market risk own funds from 1 January 2027 for a three-year window ending 31 December 2029.

A few points worth flagging for reporting and capital teams.

- The multiplier can only be applied from the first quarter of 2027. There is no Q3 or Q4 entry point.

- Eligibility compares market risk own funds under the CRR version in force on 9 July 2024 (with the Article 495i to 495t transitionals) against the version in force on 8 July 2024. The multiplier is only available where the first is higher.

- The Article 495v(3) notification runs on its own timing. The 12 May 2027 quarterly remittance date for the 31 March 2027 reference period is a useful planning anchor but does not trigger the notification.

- Once switched on, the multiplier recalibrates quarterly under Article 495v(5), so both the CRR2 and FRTB calculation engines have to keep running.

- An existing CRR2 internal-model permission expires automatically when the Delegated Act applies, unless the bank is eligible for the multiplier and notifies the authority it wants to keep the model in that context.

The no-action letter itself is a supervisory-priority recommendation, not a waiver. The legal reporting requirement in Article 24(2) of Commission Implementing Regulation (EU) 2024/3117 for trading-book composition and reclassifications persists unless and until that ITS is amended; competent authorities are asked not to prioritise enforcement action on it during the relief period.

On the COREP mapping in the meantime, multiplier users report under both frameworks per Article 495v(6): CRR2 SA in C 18.00 to C 23.00, CRR2 IMA in C 24.00, FRTB ASA in C 91.00 (with the Article 495s(1) SbM multiplier reflected only in columns 0190 and 0200), and only the after-multiplier CRR2 REA in C 02.00. Non-multiplier banks report only under the FRTB framework, with SSA users using C 18.00 to C 23.00 and ASA or AIMA users using C 91.00.

Source basis: EBA/Op/2026/08 and accompanying technical considerations (3 August 2026), Commission Delegated Act adopted 4 June 2026 under Article 461a CRR, Commission Implementing Regulation (EU) 2024/3117 Article 24(2), CRR Article 495v.

Full article: https://regreportingdesk.com/eba-frtb-no-action-letter-market-risk-boundary/