Regulatory Updates Newsletter: October 2026
Welcome to the October 2026 edition of our Regulatory Updates Newsletter. There have been quite a few changes across the financial sector this month, with regulators focusing on everything from stablecoin rules and AI risk management to banking requirements and operational resilience. We're also seeing efforts to make existing regulations simpler and more practical for financial institutions.
Here are the key updates you should know about.
OCC Finalises GENIUS Act Regulations for Payment Stablecoins
The U.S. Office of the Comptroller of the Currency (OCC) has issued a final rule implementing the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act. The rule establishes requirements for payment of stablecoin issuance and related activities by entities under the OCC’s jurisdiction, including certain custody activities conducted by OCC-supervised entities.
The final rule covers activities, reserve assets, redemption, risk management, audits, reporting and supervision. It also sets out requirements for applications and registrations, the transition of certain state-qualified issuers to the federal regulatory framework, and the examination of foreign issuers. The OCC has incorporated or addressed feedback received on its proposed rule.
The rule takes effect on 18 January 2027. Requirements relating to the Bank Secrecy Act, anti-money laundering and Office of Foreign Assets Control (OFAC) sanctions will be addressed through separate rulemaking in coordination with the U.S. Department of the Treasury.
Implications
Entities within the OCC’s jurisdiction that issue payment stablecoins or conduct related activities should review the final requirements and assess their readiness ahead of the effective date. Areas to consider include reserve assets, redemption arrangements, risk management, audits, reporting, supervision and applicable licensing or registration requirements.
Firms should also monitor the separate rulemaking on Bank Secrecy Act, anti-money laundering and OFAC sanctions requirements, which is not covered by this final rule.
Source- OCC
MAS Sets Out AI Risk Management Guidelines for Financial Institutions
The Monetary Authority of Singapore (MAS) has issued new Guidelines on Artificial Intelligence (AI) Risk Management, setting out supervisory expectations for financial institutions (FIs) adopting AI. The guidelines apply across the financial sector and cover all forms of AI, with institutions expected to manage risks at both enterprise and individual use-case levels.
The framework focuses on four key areas: strengthening board and senior-management oversight, identifying and managing AI risks throughout the AI lifecycle, addressing risks associated with third-party AI services, and applying controls proportionate to the scale and materiality of AI use. Existing governance structures may be used where they provide adequate oversight, and a dedicated AI committee is not mandatory.
The guidelines take effect on 7 October 2027, with expectations under Sections 3 and 4 to be met by that date and those under Sections 5 and 6 by 7 October 2028. MAS also intends to consult the financial sector further in 2027 on additional guidance for agentic AI.
Implications
Financial institutions operating in Singapore should assess their existing AI governance arrangements against MAS’ expectations and identify any gaps before the implementation deadlines. Priorities include maintaining appropriate inventories of AI use cases, assessing their risk materiality, strengthening lifecycle controls, and ensuring clear accountability at board and senior-management levels.
Institutions should also review third-party AI arrangements, obtain appropriate assurance from providers, and establish safeguards to address identified risks. The risk-proportionate approach allows controls to reflect the potential impact of AI use, but institutions remain accountable for managing risks associated with the AI services they deliver. Early preparation can help firms demonstrate regulatory readiness while supporting responsible AI adoption.
Link - MAS
UK Regulators Propose Further SM&CR Reforms
The UK Financial Conduct Authority (FCA) has launched a consultation on the second phase of reforms to the Senior Managers and Certification Regime (SM&CR). The proposals aim to reduce unnecessary regulatory burdens while maintaining high standards of individual accountability and conduct across financial services.
The proposed changes include reducing the number of Senior Management Function applications, allowing certain roles to be notified instead, streamlining application processes, and raising thresholds for firms subject to the Enhanced regime. The FCA also proposes removing the Certification Regime, retiring the Directory of certified and assessed persons, simplifying Conduct Rule training, and raising breach-reporting thresholds.
The consultation is open to firms currently covered by the SM&CR, including third-country branches, as well as firms expected to enter its scope, such as cryptoasset firms. The deadline for responses is 22 January 2027, with final regulatory requirements expected in the first half of 2027.
Implications
Firms should review the proposed changes and consider how they could affect their existing SM&CR processes, including senior management approvals, certification, conduct training and breach reporting. Firms regulated by both the FCA and the Prudential Regulation Authority (PRA) should also review the PRA’s corresponding consultation.
As the changes remain proposals, firms should continue to follow existing requirements while monitoring the consultation outcome and preparing for any finalised changes.
Source - FCA UK
EBA Releases Final Technical Package for Reporting Framework 4.4
The European Banking Authority (EBA), released the final technical package for version 4.4 of its reporting and disclosure framework. The first phase covers IFRS 18-aligned financial reporting, updated Pillar 3 disclosure requirements on ESG risks, equity and shadow banking exposures, selected FRTB-related templates, and other technical amendments.
The package includes the Data Point Model (DPM), validation rules for reporting requirements and XBRL taxonomies. It also introduces a new FINREP module reflecting IFRS 18 requirements and includes technical updates relating to resolution planning, MREL decisions, third-country branch liquidity reporting and AMLA reporting.
The release incorporates stakeholder feedback on the draft published on 24 July 2026. A second phase, expected in early 2027, will cover the remaining elements of the EBA's supervisory reporting simplification package.
Implications
Banks and other reporting institutions should assess how the updated requirements affect their existing reporting processes, including data mappings, reporting templates, taxonomies and disclosure systems. Institutions will also need to consider the new IFRS 18-aligned FINREP templates and updated Pillar 3 disclosure requirements.
The second phase is expected to introduce further simplifications to supervisory reporting, making it important for institutions to monitor the upcoming technical updates.
Source - EBA
FSB Finalises Sound Practices for Responsible AI Adoption
On 15 October 2026, the Financial Stability Board (FSB) published its final report on Sound Practices for the Responsible Adoption of AI, following a public consultation in June. The report sets out 12 sound practices covering two areas: organisation-wide AI governance and AI lifecycle risk management.
The practices address board and senior management oversight, governance and accountability, AI risk frameworks, documentation, materiality assessments, data governance, explainability, performance monitoring, human oversight, cybersecurity and third-party AI risks.
The FSB describes them as a non-binding, flexible toolkit that financial institutions can adapt to their size, complexity, business model and risk profile. The Board will continue monitoring developments and update the practices as necessary.
Implications
Financial institutions can use the 12 practices to review and refine their existing AI governance and risk management frameworks. The review should consider oversight and accountability, documentation, risk assessments throughout the AI lifecycle, human oversight and third-party dependencies.
Institutions should apply the practices proportionately and continue meeting applicable local legal and regulatory requirements, as the FSB guidance does not replace them.
Source - FSB
RBI Issues Final Basel Leverage Ratio Guidelines
The Reserve Bank of India (RBI) has issued the final Reserve Bank of India (Commercial Banks – Prudential Norms on Capital Adequacy) Eleventh Amendment Directions, 2026, implementing the Basel Committee’s Leverage Ratio 2017 Standard. The final directions follow a draft issued on 7 August 2026, which invited stakeholder feedback until 28 August 2026.
The RBI reviewed the feedback received and incorporated modifications into the final directions. The instructions will come into effect on 1 April 2027.
Implications
Banks should review the final directions and assess their implications for existing capital adequacy practices ahead of the implementation date. They should also examine the RBI’s accompanying statement on stakeholder feedback to understand the modifications made between the draft and final directions and prepare for the new requirements.
Source - RBI
UK Simulates Sector‑Wide Cloud Outage (SIMEX26)
The Bank of England, HM Treasury, FCA, UK Finance and other authorities on 8 October completed SIMEX26, a multi‑firm cyber‑resilience exercise.
The scenario simulated a severe global disruption of cloud services, involving 38 major banks and market infrastructure participants. Senior industry and public-sector leaders participated, including a live meeting of the Cross-Market Business Continuity Group. The exercise exposed how firms coordinate during tech outages, tested contingency plans, and highlighted concentration risk from shared cloud providers.
BoE Deputy Governor Katharine Braddick noted the sector’s strong collaboration and said the Bank will expect firms to strengthen their resilience following SIMEX26.
Implications
Firms should review lessons from the exercise and enhance operational resilience. In practice, banks and markets participants likely need to stress‑test dependencies on key cloud vendors and refine disaster‑recovery plans.
Regulators will examine how third‑party (especially cloud) outages are managed. The exercise reinforces the need for robust incident response, redundant systems and cross‑firm coordination.
Financial institutions can expect ongoing regulatory emphasis on cyber/tech risk management, including potential future inquiries into common vulnerabilities revealed by SIMEX26.
Source - BOE
FSB Consults on Regulatory and Supervisory Modernisation Principles
The Financial Stability Board (FSB) published a consultation report proposing eight high-level principles to help financial authorities improve the effectiveness, efficiency, risk focus, coherence and forward-looking nature of regulatory and supervisory frameworks. The principles aim to help authorities respond to emerging vulnerabilities, new technologies, financial offerings and changing economic conditions while preserving or enhancing financial system resilience.
The proposed principles recognise the relationship between financial stability and sustainable economic growth, build on commitments to implement internationally agreed standards, and account for the legal frameworks and circumstances of individual jurisdictions. The FSB is inviting feedback on the consultation until 8 January 2027, with the final report expected in the first half of 2027.
Alongside the consultation, the FSB published its 2026 G20 Implementation Monitoring Review (IMR). The report examines whether the FSB’s policy development process influences implementation of agreed policies. It identifies national circumstances, including legal frameworks, market structures and political capacity, as the main reasons for uneven implementation, while also noting that challenges can arise from the policy development process itself.
Implications
Financial authorities can use the proposed principles as a reference when reviewing regulatory and supervisory frameworks, while accounting for their jurisdictions’ legal requirements and circumstances. For financial institutions, the consultation provides insight into the FSB’s approach to modernising financial regulation.
The accompanying IMR also highlights the importance of considering implementation challenges when developing and applying international financial standards.
Source - FSB
Summary of Other Notable Updates
To Wrap Things Up
That's a wrap for October. This month’s updates show how regulators are working to keep up with changes in the financial sector while making sure institutions continue to manage risks effectively. From new rules for stablecoins and AI governance to changes in banking regulations and cloud resilience, there's plenty for financial institutions to keep an eye on.
Some of these changes will take effect in the coming months, while others are still open for consultation. Either way, firms should start reviewing what these updates could mean for their existing processes and prepare for the changes ahead.
Stay informed with our regulatory updates and join us next month for the latest developments in risk management and compliance!
For any feedback or requests for coverage in future issues (e.g., additional countries or topics), please contact us at info@riskinfo.ai. We hope you found this newsletter insightful.
Best regards,
The RiskInfo.AI Team
Comments