Regulatory Updates Newsletter: January 2026
- Staff Correspondent
- 2 days ago
- 7 min read
Welcome to the January 2026 edition of our Regulatory Newsletter. The year has opened with regulators moving quickly on familiar pressure points, particularly financial crime, operational resilience, and technology governance.
This month’s updates include the UK Prudential Regulation Authority setting out its 2026 supervisory priorities for international banks, alongside U.S. action to strengthen AML tools to prevent large-scale fraud in public benefit programs and the FCA’s continued efforts to recover assets in a major peer-to-peer lending fraud case. In Europe, regulators advanced long-planned cybersecurity reforms and completed the transfer of AML oversight to the EU’s new Anti-Money Laundering Authority. There were also developments in cross-border coordination under DORA and new guidance from Singapore on managing risks posed by autonomous AI systems.
Dive in for official updates and actionable insights from leading jurisdictions.
UK PRA Sets 2026 Supervisory Priorities for International Banks
The UK’s Prudential Regulation Authority issued a Dear CEO letter outlining its 2026 supervisory priorities for international banks and designated investment firms operating in the UK. The PRA highlighted heightened geopolitical risk, fragmented global trade, and pressure on sovereign debt markets, and stressed the need for firms to maintain strong governance, risk management, and resilience.
Key focus areas include counterparty credit risk, particularly growing exposures to non-bank financial institutions and private markets, as well as weaknesses in risk data aggregation and intraday exposure monitoring. The PRA also flagged risks linked to increased use of artificial intelligence, reliance on third-party providers, and cyber threats. Firms were reminded to prepare for the implementation of Basel 3.1 and the 2026 rebasing of Pillar 2 capital requirements.
Implications
Signals continued PRA scrutiny of NBFI exposures, private markets, and data quality in risk management frameworks.
Pressures firms to strengthen cyber resilience and oversight of critical third-party providers as technology use expands.
Reinforces expectations for early preparation for Basel 3.1 and Pillar 2 capital changes.
Indicates a more streamlined supervisory approach, including reduced frequency of Periodic Summary Meetings.
FinCEN launches AML measures to Tackle Fraud in Minnesota
Treasury Secretary Scott Bessent announced a suite of AML initiatives targeting fraud in Minnesota’s government nutrition programs. FinCEN issued a Geographic Targeting Order requiring banks in Hennepin and Ramsey Counties (Minneapolis) to report detailed information on U.S. dollar transfers, and a FinCEN Alert urging institutions to detect and report fraud in child nutrition benefits.
FinCEN also issued four information subpoenas to Minnesota money services businesses and provided law enforcement training on using financial data (e.g., SARs) in fraud cases. These actions build on prior enforcement against a major fraud ring that stole billions from school lunch programs, shifting the emphasis from prosecution to prevention and data-driven detection.
Implications
Signals U.S. focus on using financial data (BSA filings, GTOs) to prevent welfare fraud.
Pressures banks/MSBs to bolster AML controls (e.g., enhanced monitoring of benefit payments).
Demonstrates FinCEN’s role in cross‐sector coordination (GTOs, alerts, law enforcement training).
May lead to broader AML guidance for pandemic‐related or public-benefit programs nationwide.
FCA obtains a confiscation order in a major P2P Lending Fraud Case
The FCA secured a £265,523.96 confiscation order against Andrew Currie, who defrauded investors via the now-collapsed Collateral peer-to-peer lending platform. Currie was previously jailed (2023) for fraud and money-laundering; the confiscation order (imposed Jan 9, 2026) represents the value of assets still recoverable for victims.
FCA enforcement director Steve Smart said the action “is a clear warning to fraudsters” that ill-gotten gains will be seized. The order requires repayment or up to 3 years’ imprisonment for non-payment, with proceeds earmarked for victim compensation.
Implications
Reinforces FCA’s commitment to pursuing financial crime and returning funds to victims.
Highlights risks of high‐return P2P schemes and the FCA’s enhanced powers under the new public offers regime.
Signals that FCA will leverage criminal and civil tools (CofF authorities) to dismantle fraud networks.
May prompt other regulators to pursue similar confiscations in crypto or fintech fraud cases.
EU-Commission Proposes Strengthened Cybersecurity package (Digital Rulebook)
On 20 January 2026, the European Commission launched a “digital cybersecurity package” to bolster EU resilience. The proposal amends the NIS2 Directive and revises the EU Cybersecurity Act. Key elements include stricter ICT supply-chain security requirements and streamlined certification for digital products (making cybersecurity “secure by design”).
It also simplifies compliance (e.g., harmonised reporting of ransomware attacks) and strengthens ENISA’s coordination role. The goal is to reduce compliance burden for ~28,700 firms (including ~6,200 SMEs) while tightening controls on critical infrastructure operators
Implications
Accelerates digital operational resilience in finance, aligning with broader DORA objectives.
May lead to new EU cybersecurity standards that financial firms and third-party ICT providers must follow.
Highlights EU's emphasis on reducing fragmentation and easing cross-border supervision under ENISA.
Sets the stage for future directives affecting financial services (e.g. tighter software certification, mandatory breach reporting).
EBA and New AML Authority complete handover of AML/CFT Oversight
As of 1 January 2026, the EBA has formally transferred all its AML/CFT mandates and functions to the new Authority for Anti-Money Laundering (AMLA). AMLA now sits at the center of the EU’s AML/CFT system, supervising 40 of the largest cross-border firms. The handover “marks a milestone in the EU’s fight against financial crime”, concluding the EBA’s standalone AML remit.
EBA’s AML guidelines, databases (e.g., EuReCa), and risk assessments have been ported to AMLA to ensure continuity. Under the new regime, AMLA will finalize the EU “single rulebook” on AML, drive supervisory convergence, and coordinate FIU information exchange.
Implications
Centralizes EU anti-money laundering oversight to achieve more consistent enforcement across member states.
Industry should prepare for direct AMLA supervision (40 large institutions) and revised standards when issued.
Continues EBA’s prudential role in AML (capital/regulatory requirements) but shifts compliance supervision to AMLA.
Likely to accelerate EU adoption of the 6th AML Directive and related technical standards via AMLA.
(Source- AMLA)
RBI fines Co-Operative Banks for Prudential Violations
The RBI imposed penalties on two cooperative banks in January 2026 for breaches of lending norms. On 22 Jan, Shri Kanyaka Nagari Sahakari Bank (Pune) was fined ₹8 lakh for violating RBI directions on advances to housing developers.
A week earlier, Nandura Urban Co-op Bank (Maharashtra) was fined ₹1 lakh for exceeding prescribed loan exposure limits to certain members. The penalties under the Banking Regulation Act stemmed from supervisory inspections. The RBI noted that these actions are for “deficiencies in regulatory compliance” and do not invalidate the underlying transactions.
Implications
Emphasizes RBI’s scrutiny of risk management and lending practices in the cooperative sector.
Warns other banks to comply strictly with exposure ceilings and priority sector norms.
Underlines the RBI’s intent to use penalties as a deterrent for governance lapses.
May prompt further AML/KYC inspections of small banks and NBFCs as well.
ESAs and UK regulators sign DORA MoU on third-party ICT oversight
On 14 January 2026, the European Supervisory Authorities (EBA, EIOPA, ESMA) and the UK’s BoE, PRA, and FCA signed a Memorandum of Understanding under DORA. The MoU establishes a cooperation framework for supervising “critical ICT third-party providers” (CTPPs) across the EU and UK.
It sets out principles for joint oversight, information-sharing, and coordinated examinations of ICT vendors serving financial institutions. This cross-border MoU reflects the equivalence assessment of confidentiality laws and aims to strengthen operational resilience by ensuring consistent treatment of cloud/SaaS providers used by banks and insurers in both jurisdictions.
Implications
Formalizes EU–UK post-Brexit regulatory cooperation on ICT risk to ease oversight of major tech vendors (e.g., cloud providers).
Firms using third-party ICT must expect aligned EU/UK supervision under DORA, reducing dual-regulator conflicts.
Enhances systemic resilience by coordinating on cyber incidents and vendor management across borders.
Signals priority on operational resilience and may lead to joint supervisory exercises under DORA Articles 36/44.
Singapore Launches Model AI Governance Framework for Agentic AI
Singapore’s IMDA released a new Model AI Governance Framework for Agentic AI, providing guidance for the safe deployment of autonomous AI “agents” capable of initiating actions, accessing systems, and interacting with other agents without continuous human input. The framework builds on Singapore’s earlier AI governance principles but addresses novel risk vectors associated with agentic systems, including unauthorized actions, unintended privilege escalation, opaque decision-making, and expanded data-access risks.
The framework sets out both technical and organisational measures, emphasising clear accountability, pre-deployment risk assessments, ongoing monitoring, and the preservation of meaningful human oversight for high-impact or sensitive use cases. IMDA positions the framework as voluntary but expects it to inform enterprise governance practices and future regulatory approaches, particularly as the adoption of agentic AI accelerates across financial services and other regulated sectors.
Implications
Firms deploying agentic AI systems should reassess governance structures to ensure clear accountability, human-in-the-loop controls, and defined escalation pathways for autonomous actions.
Risk and compliance teams will need to expand AI risk frameworks beyond model accuracy and bias to include agent autonomy, system access rights, and interaction risks across multiple AI agents.
Technology teams should implement stronger monitoring, logging, and kill-switch mechanisms to detect and intervene in unintended or unauthorized agent behaviour.
The framework signals Singapore’s intent to shape global norms for advanced AI governance; multinational firms should anticipate similar expectations emerging in other jurisdictions.
Summary of Other Notable Updates
Jurisdiction | Regulator | Update | Source | |
UK | FCA | On 19 January 2026, the UK’s Public Offers and Admissions to Trading regime came into force, imposing stricter rules on public securities offerings. This new regime covers both transferable securities and high-risk debt instruments (e.g., mini-bonds). The FCA warns retail investors to be cautious of unregulated high-risk schemes. | ||
U.S. | U.S. Treasury | On 16 Jan 2026, Treasury’s Office of Foreign Assets Control (OFAC) designated 21 entities and individuals (plus one vessel) involved in transferring oil and other resources to Iran-backed Houthis. The sanctions target financial facilitators and front companies (primarily UAE- and Yemen-based) that fund Houthi terrorism via illicit oil sales. The move is part of a broader U.S. effort to disrupt Iran-Houthi revenue streams. | ||
EBA | European Banking Authority | On 26 Jan 2026, the EBA released a report on its “Interest Rate Risk in the Banking Book” (IRRBB) heatmap for the medium-to-long term. The analysis finds banks gradually adjusting to the higher-rate environment (fewer outliers in shock tests) and recommends adherence to the ECB’s 5-year interest-rate cap benchmark. It also highlights best practices in modelling deposit behavior and hedging interest-risk. The report offers observations for supervisors but introduces no new regulations | ||
UK | Bank of England/PRA | On 14 Jan 2026, the PRA published its final rules implementing Basel 3.1 (Basel IV) capital standards. The PRA confirmed that the effective date of these rules will be 1 January 2027, one year later than initially planned. The delay was chosen to align UK implementation with international counterparts and account for cross-border firms. The new standards include increased risk sensitivity and an output floor, aiming to strengthen UK banks’ capital adequacy. |
Stay informed with our regulatory updates and join us next month for the latest developments in risk management and compliance!
For any feedback or requests for coverage in future issues (e.g., additional countries or topics), please contact us at info@riskinfo.ai. We hope you found this newsletter insightful.
Best regards,
The RiskInfo.ai Team
Comments