Global payment matters - October 2026

We are delighted to share our knowledge team’s insights into the most important legal changes affecting payment matters around the globe. In our latest update, we highlight key areas of change that have happened over the last quarter. These include:

• Global: Smart Contract Harmonization for DLT Bond Markets; Professional Money Laundering and Digital Hawala

• Asia: China: PBOC 15th Five-Year Plan; Hong Kong: Remote Customer Onboarding Guidance; Hong Kong: PEP AML/CFT Guidance; Hong Kong: GenAI Sandbox++ First Cohort; Hong Kong: eDDA Risk Controls; India: Cybersecurity and Technology Framework Directions; India: Digital Payment Security Controls Directions; Japan: SESC Monitoring Priorities; Singapore: Payment Services Act Stablecoin Consultation; Singapore: Financial Services and Markets (Amendment) Bill 2026; Singapore: FSTI 4.0 Scheme Renewed; Singapore: Misconduct Reporting Circular; Singapore: Payment Provider Audit Guidelines; Singapore: AML/CFT Expectations for DPT Service Providers; South Korea: Tokenized Securities Roadmap; South Korea: AI Cybersecurity Testing Rules Eased; South Korea: 7th Financial Hub Policy Plan; South Korea: Stricter VASP Registration Requirements

• Europe: DLT for Corporate Treasury; Digital Euro Trilogue Negotiations; ESRB Frontier AI Cyber Risk Warning; Third-Country Branch Authorization Guidelines

• Middle East: Saudi Arabia: Tap to Pay on iPhone; Saudi Arabia: Open Banking Forum; Saudi Arabia: Cross-Border National Payment Card Acceptance; UAE (Dubai): VARA and Securitize Tokenization MoU; UAE (Abu Dhabi): Coinbase Tokenization Hub Permission

• UK: PSR removes Confirmation of Payee expiry date; Payment Systems Fee Consultation; Cryptoasset Regime Guidance; RTGS Standards Release Deferral; UK-US Financial Regulatory Working Group Update; Card Scheme Fees Remedies; Recognized Payment Systems Fee Regime Consultation; Financial Services AI Adoption Plan; Modernizing Payment Services Consultation; Cryptoasset Authorization Applications; The Mills Review on AI; Future Retail Payments Ecosystem Roles; APP Scam Reimbursement Evaluation

• United States: OCC finalizes GENIUS Act stablecoin rule; Federal Reserve Stablecoin Framework; Treasury procedures for certifying state stablecoin regimes; FinCEN Digital Asset Scam Alert; SEC Regulation Crypto Assets; FDIC GENIUS Act Stablecoin Reporting; Tokenized Money Market Fund Collateral Framework; Federal Reserve Triennial Payments Study

Global

Paper examines smart contract harmonization for DLT bond markets

On September 28, 2026, the International Capital Market Association (ICMA) published a discussion paper. ‘Smart contracts and DLT-based fixed income markets: What’s next?’ assesses the growing use of smart contracts to automate processes across the bond lifecycle. This includes issuance, settlement, servicing, repo, and collateral management.

The paper:

• draws on input from the ICMA’s DLT Bonds Working Group and Bond Data Taxonomy Working Group

• maps existing industry initiatives, institutional DLT networks and live market applications

• identifies market fragmentation as a central risk

• considers whether greater standardization of smart contract standards, data frameworks and settlement infrastructure could support scalable, interoperable markets

Impact: Businesses are encouraged to monitor three pathways the paper highlights:

• converging on common platform-level standards

• resolving the digital settlement asset bottleneck

• building cross-network interoperability

The availability of digital cash remains a critical dependency for scaling DLT-based bond settlement. This could include tokenized deposits, regulated stablecoins or wholesale central bank digital currency.

The ICMA is inviting feedback from members and the wider industry on key questions posed throughout the paper, which will shape future guidance. It is also hosting a related event on November 10, 2026, in Milan focused on digital settlement assets, tokenized securities, and DLT interoperability.

Asset management, banking, and fintech businesses should assess how emerging harmonization efforts may affect their DLT strategies, custody arrangements, and compliance frameworks.

Financial Action Task Force investigates professional money laundering

On September 3, 2026, the Financial Action Task Force (FATF) published a report. It focused on professional money laundering through underground banking, hawala and other similar service providers (HOSSPs). Nearly 70% of jurisdictions reported growing use of digital technologies and “digital hawala”. Networks increasingly use bank accounts, fintech platforms, payment service providers (PSPs), virtual international bank account numbers (vIBANs), prepaid cards, and virtual asset wallets. Stablecoins are increasingly used to settle balances between operators. The report highlights deeper integration with regulated financial services and cites some EU payment and e-money agents operating under passporting arrangements, as facilitators within professional money laundering schemes.

Impact: PSPs and e-money institutions should strengthen oversight of agents, relationships and vIBAN programmes. Supervisors are likely to draw on the report’s good practices during inspections. Businesses should add digital hawala typologies to transaction monitoring frameworks. Stablecoin settlements between operators should be treated as a specific risk indicator and companies should review controls for instant payments and complex layering activity. Banks providing correspondent or vIBAN services to non-bank PSPs should revisit due diligence and ongoing monitoring. Businesses should update risk assessments and assess exposure to payment intermediaries, virtual assets, and high-risk settlement channels.

Asia

China: People’s Bank publishes 15th Five-Year Plan

On August 10, 2026, the People’s Bank of China (PBOC) published its ‘15th Five-Year Plan for Reform and Development’. The plan is accompanied by nine sector-specific action plans. Key priorities include:

• modernizing the monetary policy framework

• advancing macro-prudential management

• accelerating digital finance and digital RMB development

• deepening RMB internationalization in global trade and investment

• enhancing the cross-border payment system (CIPS)

• promoting development of e-CNY

• strengthening anti-money laundering regulations

• building financial market infrastructure

The plan also targets Shanghai’s further development and Hong Kong’s elevation as international financial centers.

Impact: The plan sets China’s central banking agenda through 2030. It signals the trajectory for monetary policy, cross-border payments, digital RMB, and financial opening-up. The plan’s emphasis on Shanghai as an international financial center may also create new market access opportunities. International businesses and financial institutions should review the nine action plans and plan around the priorities. Digital payment providers should track e-RMB policy developments and financial institutions should anticipate strengthened anti-money laundering requirements.

Hong Kong: Monetary Authority updates remote individual customer onboarding guidance

On September 3, 2026, the Hong Kong Monetary Authority published a circular on remote onboarding of individual customers. It supersedes earlier remote onboarding circulars issued in 2019 and 2021. The circular updates regulatory expectations for Authorized Institutions and Stored Value Facility (SVF) licensees. It emphasizes duties of Authorized Institutions and SVF licensees to (i) ensure reliability of documents and information obtained from customers and (ii) incontrovertibly link customers to the identity provided using appropriate technology. It also highlights risks from AI-enabled fraud, deepfakes and mule account activity.

Impact: Authorized institutions and SVF licensees should review the circular. They should also comprehensively review their remote onboarding solutions, systems and oversight. This review should consider how fraud and scam tactics have evolved. The aim is to ensure these controls remain effective. These institutions should also adopt a risk-based approach to be adopted in product and service design.

Hong Kong: Updated anti-money laundering guidance for politically exposed persons

On August 28, 2026, the Hong Kong Monetary Authority (HKMA) issued a circular on politically exposed persons (PEPs). It provides guidance on risk-based anti-money laundering and counter-financing of terrorism (AML/CFT) controls. The circular addresses expectations for authorized institutions and stored value facility licensees when identifying and managing risks associated with PEP relationships. The circular includes an enclosure with updated Smart Tips on the Treatment of Politically Exposed Persons, which emphasizes the proportionality of treatment required to ensure fair treatment of PEPs.

Impact: Authorized institutions should consider adopting the up-to-date practices as part of ongoing improvements to their PEP-related AML/CFT controls. This guidance is particularly relevant given the HKMA will conduct thematic examinations later in 2026 to assess implementation. Banks should ensure their screening and customer due diligence procedures effectively identify PEPs using a risk-based approach, distinguishing between non-Hong Kong PEPs, and Hong Kong or international organization PEPs, for whom such measures are triggered by a high-risk assessment. . Compliance teams should document how risk-based measures are applied and calibrated.

Hong Kong: GenAI Sandbox++ first cohort update

On August 27, 2026, the Hong Kong Monetary Authority, Securities and Futures Commission, Insurance Authority, and Mandatory Provident Fund Schemes Authority announced, in a press release, the first GenAI Sandbox++ cohort. Of nearly 100 proposals, 36 use cases were selected involving 30 financial institutions and 27 technology partners. The sandbox facilitates testing of GenAI applications, including agentic AI, in a controlled regulatory environment. The first cohort focuses on agentic AI applications, including end-to-end processes such as customer onboarding, payments and insurance claims, as well as AI-enabled oversight of other AI applications. Technical trials on Cyberport’s AI Supercomputing Centre platform will commence later in 2026.

Impact: This initiative signals regulators’ willingness to support AI adoption under governance frameworks. Financial institutions operating in Hong Kong should track the 36 use cases and any resulting regulatory guidance. The cross-sectoral nature of the sandbox, spanning banking, securities, insurance and pensions, signals a coordinated regulatory approach to AI governance. Businesses should engage early with regulators on AI use cases and align governance with the expectations indicated by this initiative. Technology partners should monitor interoperability requirements emerging from the trials. Agentic AI applications will require sound governance and accountability frameworks.

Hong Kong: Risk controls for electronic Direct Debit Authorization arrangements

On August 20, 2026, the Securities and Futures Commission (SFC) issued a circular on mitigating risks in receiving deposits through simplified electronic Direct Debit Authorization (eDDA) arrangements. The circular applies to licensed corporations, SFC-licensed virtual asset service providers (VASPs), and associated entities. It addresses operational and fraud risks arising from simplified eDDA arrangements used by trading platforms and intermediaries , particularly where eDDA setup requests do not require confirmation from the bank account owner.

Impact: Licensed corporations and VASPs accepting client deposits through simplified eDDA arrangements should assess existing controls against the SFC's expectations. This includes reviewing indemnities provided to their banks and payer-bank authentication requirements. They should also assess their capacity to meet potential claims. Businesses should strengthen verification, monitoring and fraud-prevention controls. They should focus on account ownership, suspicious activity detection and enhanced customer authentication. The SFC also recommends supplementary safeguards, including:

• transaction value or frequency limits

• holding periods following deposits

• enhanced or step-up authentication based on client risk factors

Businesses should review their eDDA frameworks and remediate any control gaps identified through this assessment. Where risks cannot be adequately mitigated, firms should use alternative deposit arrangements. Firms should also disclose eDDA settings to clients, obtain their consent and remind them to monitor their registered bank accounts and transactions for suspicious activity.

India: Reserve Bank issues unified cybersecurity and technology framework directions

On July 31, 2026, the Reserve Bank of India (RBI) issued cybersecurity, technology risk, resilience, and assurance framework directions for different categories of regulated entities. The directions establish a framework for technology governance, cybersecurity, operational resilience, and information systems assurance. The directions apply to commercial banks, non-banking financial companies, credit information companies, and all Indian financial institutions, with requirements varying by category of regulated entity and, for non-banking financial companies, regulatory layer and asset size. Key focus areas include:

• board-approved technology and cybersecurity policies

• information technology governance and risk management

• information security and cybersecurity controls

• cyber incident reporting and response

• business continuity and disaster recovery

• information systems audits and third-party technology risk management

The RBI issued separate directions alongside these, establishing security requirements for digital payment products and services offered by regulated entities.

Impact: Businesses within scope should complete an immediate gap assessment against the directions and map existing controls to requirements. Key changes introduced by this consolidated framework include:

• creation of a single supervisory model

• new standalone cyber security operations center chapter

• dedicated information systems audit structure

• cyber incidents must be reported within six hours of detection

Businesses should also assess the application of the new digital payments’ security directions issued at the same time. Both directions took effect immediately.

India: Reserve Bank issues new digital payment security controls directions

On July 31, 2026, the Reserve Bank of India (RBI) issued digital payment security controls directions. The directions establish security requirements for digital payment products and services offered by Payment Banks, including financial and non-financial transaction services and the associated applications, systems and technology infrastructure supporting those services. Key focus areas include:

• board-approved policies on digital payments

• governance of security risks

• application security and authentication

• internet and mobile banking security

• card payment security

• customer protection

• transaction reconciliation

• fraud management

The RBI issued separate directions alongside these, establishing requirements for technology governance, cybersecurity, resilience, and assurance for payments banks.

Impact: Payments banks within scope should complete an immediate gap assessment against the new directions and map existing controls to requirements. The directions replace a previous digital payment security instructions. Key requirements cover mandatory board-approved digital payment policies and strengthened customer authentication frameworks. Payments banks should review internet banking, mobile banking, card payment, fraud management, and reconciliation controls. Payments banks should also assess the application of the cybersecurity and technology framework directions issued at the same time. Both directions took effect immediately.

Japan: Securities and Exchange Surveillance Commission monitoring priorities 2026-2028

On July 31, 2026, the Securities and Exchange Surveillance Commission (SESC) published its summary of monitoring priorities for securities businesses. Covering the period, July 2026 to June 2027, the SESC’s monitoring priorities include industry-wide attention to Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) internal controls, and the effectiveness of internal control frameworks.

Depending on the size and nature of the business conducted, the SESC will scrutinize:

• governance and internal control frameworks
• cybersecurity and system risks
• new financial products
• risk management practices

The SESC will address cases involving new types of business associated with digital technologies and new financial products, and will conduct risk-based inspections. The SESC will also focus on cross-border cases involving unregistered business operators in cooperation with foreign authorities..

Impact: Securities companies and financial instruments business operators in Japan may be subject to risk-based SESC inspections. In line with SESC priorities businesses are encouraged to:

• review AML/CFT internal control framework
• assess digital technology risks
• verify customer asset segregation arrangements
• prepare for potential SESC on-site inspections

The priorities signal a risk-based approach with emphasis on emerging financial products.

Singapore: Monetary Authority opens Payment Services Act stablecoin consultation

On September 1, 2026, the Monetary Authority of Singapore (MAS) launched a consultation on proposed amendments to the Payment Services Act for stablecoin regulation. The proposals would introduce Singapore’s stablecoin regulatory framework into legislation. A new license class would be created for issuers of MAS-regulated stablecoins. Licensed issuers would be required to maintain reserve assets, meet redemption obligations, and comply with safeguarding, risk management, and consumer protection requirements. The consultation also seeks feedback on additional measures for systemic stablecoins, multi-jurisdictional issuance arrangements and recognition of foreign issued stablecoins.

Impact: Stablecoin issuers seeking MAS-regulated status may face new licensing, governance, and operational requirements. Businesses seeking MAS-regulated status would need to maintain fully backed reserves and support timely redemption. Businesses may also be subject to restrictions on interest payments and limits on permitted activities. Stablecoin issuers should assess potential safeguarding, stress testing, and liquidity obligations. International issuers and digital asset businesses should monitor proposals affecting offshore and systemic stablecoins. The consultation period closed on October 16, 2026.

Singapore: Financial Services and Markets (Amendment) Bill 2026

On September 8, 2026, the Monetary Authority of Singapore (MAS) introduced the Financial Services and Markets (Amendment) Bill 2026 for its First Reading in Parliament. The Bill was published alongside an explanatory brief. The Bill would empower MAS to require systemically important financial institutions to maintain minimum total loss-absorbing capacity levels. It would also align Singapore’s financial crime framework with updated Financial Action Task Force (FATF) standards on proliferation financing. The Bill includes consequential amendments to several financial sector statutes.

Impact: Systemically important financial institutions may face new capital and funding requirements to support orderly resolution during financial distress. Affected businesses should assess the potential impact of total loss-absorbing capacity requirements on their balance sheets and issuance programs. Financial institutions may also need to review their financial crime frameworks. These should align with updated legislative standards. The amendments could influence capital planning, compliance programs, and public disclosure obligations. The Bill was passed by Parliament on October 6, 2026.

Singapore: Financial Sector Technology and Innovation Scheme renewed

On August 31, 2026, the Monetary Authority of Singapore (MAS) announced a S$220 million commitment. The investment will support an innovative, resilient and globally competitive financial sector. The funding will be deployed over three years under the renewed Financial Sector Technology and Innovation Scheme (FSTI 4.0). The scheme aims to strengthen Singapore’s fintech ecosystem across six tracks: manpower, institution projects, AI Pathfinder, infrastructure and platforms, center of excellence and MAS FinTech Awards. FSTI 4.0 focuses on frontier technologies including AI, DLT, and quantum technology.

Impact: FinTech companies and financial institutions in Singapore explore funding support under the relevant FSTI 4.0 tracks, subject to eligibility requirements. International businesses establishing fintech operations in Singapore may wish to assess eligibility for institution project, AI pathfinder, and center of excellence support. Businesses are encouraged to assess available support for AI, quantum, and DLT projects. Financial institutions might evaluate market-ready AI FinTech solutions listed on PathFin.ai solutions to accelerate AI adoption. International businesses could consider Singapore as a hub for innovation and specialized talent.

Singapore: Monetary Authority issues misconduct reporting circular

On August 24, 2026, the Monetary Authority of Singapore (MAS) issued a circular on FAQs regarding misconduct reporting requirements under the following Acts:

• Financial Advisers Act 2001

• Insurance Act 1966

• Securities and Futures Act 2001

The new FAQs include relevant misconduct for representatives and broking staff, timeline for reporting, and replacement of the existing misconduct reporting system. Examples of reportable misconduct include providing inappropriate advice, making misleading statements, or failing to disclose material information. Reportable misconduct also includes insider trading, fraud, forgery, bribery, money laundering, or misappropriation of client funds.

Impact: The FAQs highlight the MAS misconduct reporting expectations, which include:

• evaluating misconduct using client impact, intent, diligence, and reputational risk factors

• continuously assessing and certifying representatives and broking staff as fit and proper

• reporting only substantiated misconduct, but disclosing all investigated allegations

• completing investigations before submitting misconduct reports within 21 calendar days of first having reasonable grounds to believe misconduct has been committed

• no more requirement to declare annual nil-return misconduct

Financial institutions regulated under the relevant Acts must prepare for the transition to the new misconduct reporting framework before January 1, 2027. Businesses should review the FAQs for clarification on reporting obligations. Compliance teams should update internal systems and procedures. The discontinuation of the existing system creates a hard deadline for transition so companies should evaluate new reporting procedures before the switchover.

Singapore: Payment provider audit guidelines released

On July 16, 2026, the Monetary Authority of Singapore (MAS) issued guidelines on the audit of payment service providers (PS-G04).

The guidelines set mandatory annual audit coverage areas. These include safeguarding relevant monies and customer assets, anti-money laundering and countering the financing of terrorism (AML/CFT) controls, base capital compliance, and technology risk. Newly licensed payment service providers must complete an end-to-end review during their first year of operations.

Impact: All payment service providers licensed under Singapore’s Payment Services Act should prepare for enhanced mandatory audit coverage. Businesses should engage external auditors in line with the new guidelines without delay. Newly licensed providers should additionally plan for an end-to-end review one year after commencing the relevant operations or services. The guidelines apply to annual audits for fiscal years ending on or after December 31, 2026.

Singapore: MAS outlines AML/CFT expectations for digital payment token service providers

On July 13, 2026, the Monetary Authority of Singapore (MAS) published an information paper on anti-money laundering and countering the financing of terrorism (AML/CFT) supervisory expectations for digital payment token (DPT) service providers.

The paper provides guidance on implementing AML/CFT and countering proliferation financing controls across key risk areas. It supplements the existing requirements under the MAS notice (PSN02) and its accompanying guidelines.

The paper covers areas including risk assessment, customer due diligence, correspondent accounts, value transfers, suspicious transaction reporting, and internal compliance frameworks.

Impact: DPT service providers operating in or from Singapore should review the paper alongside Notice PSN02 and its guidelines to identify any control gaps. Particular attention should be given to enhanced due diligence for higher-risk customers and cross-border value transfer requirements. Fund managers and financial institutions with digital asset exposure should also assess their counterparty risk frameworks.

The paper signals MAS’s continued scrutiny of the sector. It should be read alongside the proposed licensing regime under the Financial Services and Markets Act 2022.

South Korea: Financial Services Commission issues digital transformation roadmap

On September 4, 2026, the Financial Services Commission introduced a policy roadmap on the digital transformation and tokenization of securities issuance and circulation. The roadmap outlines a three-phase approach for tokenized securities infrastructure development. The proposals would expand tokenization beyond fractional investments to stocks, bonds, and funds. The roadmap also includes standards for fractional investments, over the counter trading arrangements, issuer account management entities, and distributed ledger infrastructure.

Impact: Securities businesses, issuers, and market infrastructure providers should assess readiness for the phased introduction of tokenized securities. International securities companies and infrastructure providers may evaluate potential market entry opportunities under the roadmap’s three-phase model. Businesses may need to develop distributed ledger capabilities and comply with new operational and cybersecurity expectations. The Korea Securities Depository (KSD) and securities companies will develop supporting infrastructure ahead of the planned February 2027 launch. Businesses should review the roadmap, assess technology readiness, and engage with the KSD where relevant.

South Korea: Financial Services Commission eases AI cybersecurity testing rules

On September 3, 2026, the Financial Services Commission announced the second phase of its temporary easing of network separation rules for financial companies. The initiative aims to support the use of frontier AI models and software-as-a-service solutions (SaaS) for cybersecurity purposes. Eligibility will be expanded to include non-bank financial companies and electronic financial service providers. Selected participants will receive a one-year no-action letter and must implement internal controls and report testing outcomes.

Impact: Financial institutions, non-bank financial companies, and electronic financial service providers may gain greater flexibility to assess AI cybersecurity tools. Expanded eligibility allows more businesses to participate. Businesses should assess eligibility and prepare internal controls. Selected participants are expected to receive one-year no-action letters in October 2026, and these letters will permit the use of frontier AI models and SaaS solutions for cybersecurity purposes. Program findings may inform future AI guidance and broader reforms to network separation rules.

South Korea: Financial Services Commission updates policy plan

On August 19, 2026, the Financial Services Commission (FSC) announced the 7th Financial Hub Policy Plan. The Plan was announced at the 53rd Financial Hub Development Committee meeting. It aims to strengthen South Korea’s position as a regional financial center. It covers measures to attract foreign investment, upgrade financial infrastructure and promote innovation in fintech and capital markets.

Impact: International financial institutions may wish to review the Plan for potential market entry incentives and infrastructure commitments. Businesses seeking to establish or expand regional operations through South Korea are encouraged to assess new strategic priorities. The plan covers 2026–2028. Companies might consider monitoring the FSC’s implementation measures.

South Korea: Virtual asset providers face stricter registration requirements

On August 11, 2026, the South Korean government approved a revision to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information. Virtual asset service providers (VASPs) face stricter registration requirements and enhanced anti-money laundering (AML) obligations. The travel rule for virtual asset transfers between registered VASPs is expanded from transactions of KRW1 million or more to all transaction sizes. Beneficiaries must now secure originator information. Virtual asset transfers to overseas VASPs and/or digital wallet service providers of KRW10 million or more must be reported to the Korea Financial Intelligence Unit (KoFIU). Customer due diligence (CDD) requirements are strengthened, including more rigorous due diligence where there are money laundering concerns or where high-risk individuals, products or services are involved.

Impact: All registered VASPs in South Korea face expanded AML/CFT obligations for virtual asset transfers of all sizes. International crypto-asset businesses should update monitoring and reporting frameworks for South Korean counterparties. Businesses must now report overseas transfers of KRW10 million or more to KoFIU where the transfers are to overseas VASPs and/or digital wallet service providers.

A more rigorous form of CDD where there are money laundering concerns or where high-risk individuals, products or services are involved. The new registration requirements and approach to sanctioned retired employees took effect from August 20, 2026. All other rules become effective six months after promulgation.

Europe

EU: Report explores DLT benefits for corporate treasury operations

On September 23, 2026, the Association for Financial Markets in Europe (AFME) and the European Association of Corporate Treasurers (EACT) published a summary and joint report. The report examines how DLT and tokenization could reshape corporate treasury and financing.

The report identifies four key benefit areas: faster cross-border payments, improved collateral mobility, reduced trapped liquidity, and more flexible capital market access. It notes that DLT is progressing from experimentation to production-grade applications. Near-term opportunities include tokenized fixed income and intraday liquidity management.

The report urges corporates to treat DLT as a strategic treasury capability.

Impact: Businesses should evaluate how DLT-enabled processes could address existing operational frictions. Priority areas for assessment include cross-border payment delays, collateral inefficiency, and idle cash balances.

Businesses should also track progress on DLT platform interoperability and tokenized cash settlement standards.

Businesses operating across jurisdictions should consider how programmable settlement could lower working-capital buffers.

Early engagement with regulated infrastructure providers may confer a competitive edge as adoption accelerates.

EU: Digital Euro - Parliament backs trilogue negotiations

On July 9, 2026, the European Parliament voted to start formal negotiations with the Council on the digital euro, as announced in a press release.

Parliament approved three related measures as part of the same package:

• a framework establishing the digital euro itself, issued by the European Central Bank

• a measure allowing banks and payment providers in non-euro countries to offer the digital euro

• a measure guaranteeing that physical euro cash remains legal tender

It is possible that most businesses will be required to accept the digital euro as payment. Banks and payment providers, including those outside the eurozone, could also offer the digital euro.

Negotiations with EU governments are expected to begin shortly.

Impact: Parliament and the Council aim to reach political agreement by the end of 2026, during Ireland’s EU Council Presidency. Even with an agreement this year, the digital euro is not expected to launch until around 2029, based on the Eurosystem’s own project timeline.

That still leaves time to prepare, but not to wait. Most businesses may be required to accept the digital euro once the rules take effect.

Banks and payment providers, including those outside the eurozone, will be able to offer it, creating new compliance obligations alongside new opportunities.

To get ahead of these changes, businesses may wish to:

• review payment systems now to assess readiness to accept the digital euro

• monitor the Parliament–Council negotiations as rules develop

• review cash-acceptance policies, since guaranteed access to physical cash remains a legal requirement

EU: European Systemic Risk Board frontier AI cyber risk warning

On July 7, 2026, the European Systemic Risk Board (ESRB) published a press release and warning on systemic cyber risks from frontier artificial intelligence models. The warning, dated June 25, 2026, states these models could increase the speed, scale, and sophistication of cyberattacks on financial infrastructure. The European Supervisory Authorities (ESAs) issued a supporting statement the same day, and the European Central Bank (ECB) wrote to significant banks setting supervisory expectations.

Impact: The warning raises the bar for cyber resilience across EU/EEA financial services. Businesses should assess whether existing controls address AI-driven threat vectors at the speed regulators now expect. Significant EU banks face a hard deadline to submit an action plan to the ECB by the end of October 2026. Payment providers and financial market infrastructures should review incident response and vulnerability management processes. Companies relying on third-party AI tools should evaluate associated supply-chain cyber risks.

EU: Third-country branch authorization guidelines update

On July 7, 2026, the European Banking Authority (EBA) published final guidelines on authorizing third-country branches (TCBs). The guidelines implement the Capital Requirements Directive (CRD6) regime for TCBs, specifying required information, assessment criteria, and application templates. They apply to competent authorities and third-country head entities seeking to establish a TCB in an EU member state.

Impact: These guidelines will apply from January 11, 2027. Non-EU banking groups, including those based in the UK, US and Asia, should review the guidelines before submitting branch applications after this date. Businesses should prepare non-opposition statements from home-country regulators well in advance of filing. Applicants should assess whether their information and risk assessment documentation meets the CRD6 assessment criteria. Groups with existing EU branch plans should reassess timelines against the new application templates and process requirements. Further guidance on the internal governance requirements applicable to TCBs is set to be finalized by the end of 2026.

Middle East

Saudi Arabia: Central Bank announces Tap to Pay on iPhone

On September 17, 2026, the Central Bank of Saudi Arabia (SAMA) announced that Tap to Pay on iPhone will soon be available in the country. The announcement was made during the Money20/20 Middle East conference in Riyadh (September 14–16, 2026). The service enables merchants to accept contactless payments using iPhones without additional hardware.

Impact: Payment service providers and merchants should prepare for the Tap to Pay on iPhone launch. The measure reduces hardware requirements for contactless acceptance. Businesses operating retail networks in Saudi Arabia should assess point-of-sale infrastructure compatibility. The announcement signals SAMA’s continued push towards digital payment adoption under Vision 2030.

Saudi Arabia: Open Banking Forum discusses progress

On September 16, 2026, the Saudi Central Bank (SAMA) held an Open Banking Forum on the sidelines of Money20/20 Middle East, as set out in a press release. The forum reviewed the progress of Open Banking in Saudi Arabia and discussed banks’ readiness for Payment Initiation Services (PIS). Discussions focused on improving coordination between banks and fintech companies and providing a consistent customer experience.

Impact: Banks should assess readiness for Payment Initiation Services and fintech companies may wish to explore Open Banking partnerships. The forum signals SAMA’s expectation that banks expand beyond Account Information Services to PIS. Companies should monitor SAMA for updated Open Banking technical standards with the 33 licensed payment service providers creating an active ecosystem for collaboration.

Saudi Arabia: Cross-border acceptance of national payments cards announced

On September 15, 2026, the Saudi Central Bank (SAMA) and the Qatar Central Bank announced the gradual roll-out of cross-border acceptance of ‘mada’ national payment cards in Qatar and ‘HIMYAN’ cards in Saudi Arabia. The initiative leverages the Gulf Payment Network (GCC-NET) to enable citizens and residents to withdraw cash and make point of sale payments across borders using national debit cards.

Impact: Payment processors and merchants in Saudi Arabia and Qatar should prepare for the cross-border mada and HIMYAN acceptance roll-out. The GCC-NET infrastructure enables regional debit card interoperability. Businesses should coordinate with acquiring banks on connectivity requirements. The initiative supports broader GCC economic and financial integration objectives. Companies offering payment acceptance services should assess readiness for cross-border card transactions.

UAE: VARA and Securitize sign tokenization framework agreement

On September 3, 2026, Dubai’s Virtual Assets Regulatory Authority (VARA) and Securitize Corp. signed a Memorandum of Understanding (MoU).

The agreement creates a collaborative framework to advance regulated tokenization and digital asset infrastructure in Dubai. Cooperation will span regulatory engagement, knowledge sharing, ecosystem development, talent attraction, and market education.

Securitize is a NYSE-listed tokenization platform managing roughly $5 billion in assets, with backing from BlackRock and other major institutions.

No specific projects or binding regulatory changes were announced at this stage.

VARA described the MoU as a broad basis for collaboration rather than a commitment to particular initiatives.

Impact: The MoU does not introduce new compliance obligations for market participants. However, asset managers and financial institutions exploring real-world asset tokenization should watch for concrete initiatives under this partnership.

VARA may in time develop specific tokenization rules or licensing requirements as the collaboration matures.

The agreement underscores Dubai’s drive to position itself as a leading jurisdiction for institutional-grade tokenized financial markets.

UAE: Coinbase receives permission for international tokenization hub

On August 11, 2026, the Abu Dhabi General Market (ADGM) announced that Coinbase received a Financial Services Permission (FSP) from the Financial Services Regulatory Authority (FSRA). The FSP enables Coinbase to establish its international tokenization hub in Abu Dhabi. The license permits Coinbase to arrange deals in investments and provide custody to facilitate tokenized securities. Tokenized securities registered in ADGM are fully backed by underlying shares under FSRA supervision. Token holders receive full shareholder rights including dividends and voting. Coinbase described the permission as enabling DeFi-composable assets within a regulated framework.

Impact: The license sets a precedent for regulated tokenized securities issuance in ADGM. International businesses planning tokenized securities offerings should assess ADGM’s regulatory framework. The Coinbase permission demonstrates the FSRA’s willingness to license tokenized equities that combine securities rights with blockchain composability. Companies should evaluate whether ADGM’s model aligns with their tokenization strategies. The license includes ongoing sanctions screening and freeze capabilities at the wallet level. Businesses should monitor ADGM for further institutional participants and evolving regulatory expectations.

UK

UK: Payment Systems Regulator removes Confirmation of Payee expiry date

On October 22, 2026, the Payment Systems Regulator (PSR) published PS26/2 and Specific Direction 17a. The PSR confirmed removal of the 1 November 2026 expiry date from Specific Direction 17. The direction requires certain payment service providers to offer Confirmation of Payee (CoP) services. The PSR concluded that CoP remains important for preventing authorized push payment fraud and misdirected payments. The requirement will now continue indefinitely unless amended or revoked.

Impact: Payment service providers (PSPs) subject to Specific Direction 17 will remain required to provide CoP services after November 1, 2026. Businesses may wish to review compliance, governance and operational arrangements considering the ongoing requirement. PSPs may also consider maintaining investment in CoP capabilities and customer protections. Businesses outside the current scope may wish to monitor future PSR developments concerning possible expansion. Businesses relying on payment providers may wish to confirm continued access to CoP services. Stakeholders are encouraged to monitor future PSR reviews of the regime. The PSR will review the requirement within five years, or sooner if appropriate.

UK: Bank of England consults on payment systems fees

On September 22, 2026, the Bank of England (BoE) opened consultation on its 2026/27 supervision fees. The proposals cover recognized payment systems and specified service providers (SSPs), and include:

• proposed annual fees under the current £760,000 cap are £0.76m, £0.44m and £0.15m for 'category 1', 'category 2' and 'category 3' systems

• HM Treasury (HMT) has proposed raising the cap to £1.7m. Any increase would apply pro rata for the rest of the fee year

• hourly rates for special project fees rise slightly

• payment systems based overseas may get fee reductions decided case by case

Impact: Operators of recognized payment systems and SSPs should expect higher supervision costs. If HMT raises the cap, full-year fees could increase by around one-third. For example, category 1 fees could rise from £0.76 million to £1.03 million. Overseas payment systems may receive reductions where the BoE relies on their home supervisor, and they should confirm eligibility directly with the BoE. Prospective Digital Settlement Asset service providers, including stablecoin-related firms, are also signposted for future fees. Businesses are encouraged to budget for invoices due between December 2026 and February 2027, including any pro rata uplift. Businesses should also monitor HMT’s response and the BoE’s consultation expected in June or July 2027. The consultation period closed on October 22, 2026.

UK: Financial Conduct Authority publishes cryptoasset regime guidance

On September 18, 2026, the Financial Conduct Authority (FCA) published guidance on the scope of the incoming regulatory regime applicable to cryptoassets. The guidance covers the regulated activities of issuing qualifying stablecoins and operating cryptoasset trading platforms. It also covers dealing in cryptoassets, arranging deals in cryptoassets, safeguarding cryptoassets and arranging cryptoasset staking. The FCA describes the guidance as providing businesses with the clarity needed to prepare for the new regime.

Impact: Cryptoasset businesses should assess whether their businesses fall within the scope of the regime, as further clarified in the FCA guidance. Companies already authorized under the Financial Services and Markets Act 2000 may need to vary their permissions. Payment providers and electronic money issuers may also need to do so. These variations would add cryptoasset-specific activities. Businesses registered under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 may need to become authorized for the first time. Overseas businesses serving, or with a nexus to, UK customers will need to take particular care. They should consider whether their activities trigger FCA authorization requirements. This is because the jurisdictional perimeter is broader for cryptoasset activities. If a firm does fall within the perimeter, it will need to assess whether they will apply for authorization or remove themselves from the UK. The new regime takes effect on October 25, 2027, but applications need to be submitted to the FCA by the end of February 2027.

UK: Payment standards release delay update

On August 27, 2026, the Bank of England (BoE) announced, a deferral of the November 2026 Real-time Gross Settlement (RTGS) standards release. This includes Clearing House Automated Payment System (CHAPS) messaging standards. Swift had announced, on the same date, its decision to delay the November 2026 Swift Standards Release. Industry requested additional time to prepare for the removal of the unstructured postal address format, citing global readiness concerns. The BoE deferred the entire release to maintain global interoperability and avoid implementation risks. The BoE will engage with Swift, market infrastructures, and participants on revised timelines.

Impact: Affects banks, building societies and payment service providers that use CHAPS and RTGS for sterling high-value payments. Businesses with CHAPS direct or indirect participation should reassess their ISO 20022 migration project plans. System and testing timelines tied to the November 2026 release should be paused pending revised dates. Businesses should monitor updates from the BoE and Swift for a new implementation schedule. Cross-border payment operations relying on structured address fields may need to maintain dual-format capability for longer. The deferral reduces immediate compliance pressure but may extend parallel-running costs.

UK: UK-US Financial Regulatory Working Group update

On August 4, 2026, the UK-US Financial Regulatory Working Group (FRWG) issued a joint statement. This followed the FRWG’s 13th meeting held in London on July 8, 2026. Participants included HM Treasury, Bank of England, Financial Conduct Authority, US Treasury and US regulators. Key topics included digital finance, stablecoins, the GENIUS Act, tokenization, AI in financial services, cybersecurity, operational resilience, the G20 Cross-border Payments Roadmap and Basel III implementation. The Transatlantic Taskforce for Markets of the Future (TTMF) announced initial recommendations on 14 July, including a joint US-UK statement on stablecoins.

Impact: Businesses active in digital assets and cross-border payments should assess the converging UK and US regulatory positions on stablecoins. The TTMF recommendations may inform mutual recognition of stablecoin frameworks and business are encouraged to review the joint US-UK statement. Digital asset businesses operating across both jurisdictions should prepare for aligned supervisory expectations. The statement also signals continued regulatory focus on operational resilience and AI governance. Businesses should monitor developments in the GENIUS Act and UK cryptoasset regime for cross-border impacts.

UK: Payment Systems Regulator card scheme fees remedies update

On July 30, 2026, the Payment Systems Regulator (PSR) issued a policy statement and final directions (Specific Direction 22 and Specific Direction 23) on card scheme and processing fees following its market review. Specific Direction 22 requires Mastercard and Visa to provide acquirers with clearer information about every fee charged, including what it is, how it is triggered and how it is calculated. Specific Direction 23 (Pricing Governance) requires Mastercard and Visa to consider the interests of businesses when making pricing decisions and keep clear records of reasoning. The PSR confirmed it is progressing a further Regulatory Financial Reporting measure.

Impact: The PSR expects to finalize the Regulatory Financial Reporting remedy later in 2026 with the Direction to apply from the end of July 2027. Businesses accepting card payments should prepare to review fee information once Mastercard and Visa implement transparency changes. Acquirers should use enhanced fee data to reconcile charges and challenge unnecessary costs. The Pricing Governance remedy, effective from the end of November 2026, requires Mastercard and Visa to document pricing decision rationale. Companies with UK card issuing, acquiring, or processing operations should assess indirect exposure. Compliance costs, including gap analysis, system changes and audit, were flagged during consultation. Businesses should additionally review the final Specific Directions 22 and 23 published alongside this decision.

UK: Recognized payment systems fee regime consultation opens

On July 15, 2026, HM Treasury (HMT) launched a consultation on the Bank of England’s (BoE) payment systems fee regime. The Financial Services and Markets Act 2023 brought digital settlement asset service providers within the BoE’s remit. HMT proposes extending the 2018 fee regulations to these providers and their service providers. It also proposes raising the annual supervision fee cap from £760,000 to £1.7 million. The Special Project Fee cap would rise from £500,000 to £650,000. Supervision costs now exceed the 2018 cap, partly because of increased focus on operational resilience.

Impact: Recognized payment system operators and specified service providers should prepare for potentially higher fees. The caps are maximums, while actual fees remain subject to the BoE’s annual consultation and cannot exceed the BoE’s supervisory costs. Less systemic systems may benefit from a planned third, lower fee category and, if new caps apply mid-year, the BoE expects fees to be pro-rated. Digital Settlement Asset service providers, including stablecoin firms, would pay fees only after formal recognition by HMT. According to the BoE, none are currently recognized. The consultation closed on August 31, 2026 and the Government will publish its response and final policy in due course. Any resulting regulations will require Parliamentary approval.

UK: Financial Services AI Adoption Plan issued

On July 14, 2026, HM Treasury published a policy paper setting out the Financial Services AI Adoption Plan (Plan). The Plan was authored by the Financial Services AI Champions, Harriet Rees, and Dr Rohit Dhawan. It sets out ten recommendations to accelerate safe AI adoption across the sector. Key themes include regulatory clarity, the regulatory perimeter for AI-enabled advice, and AI sovereignty and resilience. Other themes cover skills and talent, and agentic payments readiness. The Plan recommends that regulators maintain their existing technology-neutral, outcomes-focused approach, and proposes a voluntary AI incident-sharing scheme. It was welcomed as part of the Chancellor’s Mansion House 2026 announcements.

Impact: Financial institutions and technology providers in the UK should track implementation of the Plan’s ten recommendations. These cover regulatory clarity, AI third-party assurance, and agentic payments standards. Businesses should monitor HM Treasury and the Financial Conduct Authority for updates on the voluntary AI incident-sharing scheme. Businesses should also watch for the forthcoming consultation on an agentic payments trust framework. Early engagement will help shape final regulatory expectations across the sector.

UK: Modernizing payment services consultation launches

On July 14, 2026, HM Treasury published a consultation on modernizing payment services regulation. The consultation proposes updates to the UK’s regulatory framework for payment service providers and e-money businesses. It covers authorization requirements, safeguarding of customer funds, supervisory powers, and consumer protection. The proposals build on the government’s National Payments Vision policy paper and aim to strengthen the UK’s position as a global payments hub.

Impact: Detailed safeguarding, prudential, authentication and conduct requirements will move into Financial Conduct Authority (FCA) rules. These requirements currently sit within the Payment Services Regulations and Electronic Money Regulations. The FCA could amend its rules more quickly than legislation. Already authorized businesses will need a variation of permission before offering tokenized payment services. Stablecoin payment businesses may need cryptoasset safeguarding permissions until the reforms take effect.

Businesses should prioritize:

• mapping safeguarding arrangements, including segregation or insurance, against likely FCA rules

• planning variation of permission applications for stablecoin or tokenized-deposit products

• reviewing authentication and fraud controls before FCA rules replace Strong Customer Authentication requirements

• updating senior manager responsibility maps and financial crime frameworks if accountability increases

• tracking secondary legislation and FCA consultations that will establish detailed requirements

The consultation period ended on October 6, 2026. Any regulatory changes will be introduced via secondary legislation, and the Government will provide details of these reforms in due course.

UK: Applying for cryptoasset business authorization

On July 8, 2026, the Financial Conduct Authority (FCA) published an information note about the authorization application form for cryptoasset businesses. The update provides guidance for companies seeking authorization under the UK’s cryptoasset regulatory regime. It supports the FCA’s ongoing rollout of cryptoasset authorization requirements.

Impact: Cryptoasset businesses planning to operate in the UK should review the authorization form guidance before submitting applications. The application window opened on September 30, 2026. Companies should assess whether their governance, systems and controls documentation meets the FCA’s expectations. Incomplete or non-compliant applications risk delays in the authorization process. Businesses already holding temporary registration should use the guidance to prepare for the transition to full authorization. Early engagement with the application requirements is advisable given the pace of the UK’s crypto regulatory rollout.

UK: Regulator publishes landmark AI review for financial services

On July 6, 2026, the Financial Conduct Authority (FCA) published The Mills Review report. This report examines how AI could reshape retail financial services by 2030 and is the first regulator-initiated review of its kind globally. Executive director Sheldon Mills led the review, which was commissioned by the FCA Board.

The review identifies four major AI-driven shifts: the transformation of business operations, the evolution of consumer journeys, the reshaping of competition, and the amplification of fraud and cyber risks. The report finds that around 11 million UK adults would likely use autonomous AI for personal finance decisions.

It sets out seven recommendations, including securing the regulatory perimeter, strengthening coordination, and enabling agentic finance.

Impact: The FCA intends to launch a review of AI models operating outside the current regulatory perimeter within three to six months. Businesses should expect increased regulatory scrutiny of autonomous AI deployment and related accountability frameworks. The Consumer Duty and Senior Managers Regime will remain the primary regulatory tools for AI oversight.

The FCA also plans to publish guidance on good and poor AI practices later in 2026, offering practical compliance benchmarks. Businesses relying on third-party AI model providers should also evaluate supply-chain concentration risks highlighted in the report.

Fraud and cybersecurity controls will need continuous strengthening as AI-enabled threats grow in speed and scale. Businesses should also prepare for potential new frameworks governing agentic AI, including delegation, identity, and liability standards.

UK: Future roles and responsibilities in the retail payments ecosystem

On July 2, 2026, HM Treasury (HMT) published a Payments Vision Delivery Committee update on roles and responsibilities in the future retail payments ecosystem. The update sets out how industry participants, regulators and infrastructure providers should coordinate to deliver the National Payments Vision. It addresses the future architecture for retail payments, including account-to-account payments and the role of open banking.

Impact: The policy paper will shape the competitive landscape and infrastructure requirements for UK retail payments. It provides a broader framework for engagement on related issues and supports continued dialogue between HMT, regulatory authorities and other stakeholders. The paper also informs responses to the Retail Payments Infrastructure Board consultation on infrastructure design. This consultation closed on September 11, 2026. Payment service providers and banks should review their roles under the updated structure. Businesses in open banking and account-to-account payments should assess alignment with the government’s direction. Companies should engage with evolving standards to ensure scalable integration into the new architecture.

UK: Payment scam reimbursement evaluation update

On July 1, 2026, the Payment Systems Regulator (PSR) published a press release on findings from Frontier Economics’ independent evaluation of its scams reimbursement policy. The evaluation found Authorized Push Payment (APP) fraud losses fell by an estimated £73 million per year. The number of APP scams fell by nearly 35,000. Reimbursement rates for in-scope claims rose from 54% to 65% overall, with businesses reimbursing 97% of in-scope claims. The policy is delivering a net benefit estimated at £17 million to £29 million. The PSR also published a policy roadmap. A formal consultation is planned for December 2026, covering policy parameters, data-driven requirements, and consistent consumer outcomes. Stakeholder engagement commenced in August 2026.

Impact: Payment businesses should prepare for the PSR’s December 2026 consultation on APP scams reimbursement policy. The consultation will address the treatment of claims unresolved within 35 business days and investment scam returns. Businesses with high APP fraud levels should prioritize prevention investment. The PSR will publish data on platforms most used by fraudsters. Technology companies and telecoms businesses should expect increased regulatory focus on their role in enabling fraud. Businesses should review the policy roadmap and engage during the August-December stakeholder engagement window. Decisions and revised legal directions are expected by May 2027.

United States

US: Office of the Comptroller of the Currency finalizes GENIUS Act stablecoin rule

On October 21, 2026, the Office of the Comptroller of the Currency (OCC) issued a final rule implementing the GENIUS Act for payment stablecoin activities. It takes effect January 18, 2027, the Act's effective date. Most requirements sit in a new 12 CFR Part 15. Bank Secrecy Act/Anti-Money Laundering (BSA/AML) and sanctions rules will follow separately, coordinated with Treasury. The rule covers national banks, federal savings associations, federal branches, their subsidiaries and certain non-bank and foreign issuers. The ban on issuers paying yield directly to holders remains. However, the OCC dropped a proposed presumption against third-party rewards. It will instead assess arrangements on their "facts and circumstances," creating some enforcement risk.

Impact: This completes most of the OCC's GENIUS Act rulemaking. Issuers and applicants under OCC jurisdiction have until January 18, 2027 to comply. They must align reserve, redemption, risk management, custody and capital practices with the final rule. State qualified issuers nearing $10 billion should prepare for OCC oversight once state qualification is no longer available. Third-party and transaction-based rewards programs may still be possible under the facts-and-circumstances approach. However, the line between permissible and prohibited arrangements remains unclear. Finally, businesses should monitor the separate BSA/AML and sanctions rulemaking, which remains outstanding.

US: Federal Reserve proposes GENIUS Act stablecoin framework

On September 24, 2026, the Federal Reserve Board requested public comment on two GENIUS Act proposals. The first proposal requires Board-supervised payment stablecoin issuers to fully back stablecoins with permissible reserve assets. Eligible assets include short-term Treasury bills and other high-quality, liquid assets. It also sets standardized capital requirements, risk management standards and rules for firms safekeeping reserve assets. The second proposal sets an application process tailored for state member banks’ subsidiaries seeking authorization to become payment stablecoin issuers.

Impact: This is a key step in building the Federal Reserve's GENIUS Act framework for Federal Reserve-supervised issuers. State member banks considering stablecoin issuance through subsidiaries should become familiar with the proposals, including the reserve asset composition, capital adequacy and risk management frameworks. Businesses safekeeping stablecoin reserve assets should evaluate the proposed safekeeping rules. Prospective applicants should begin preparing business plans and financial information ahead of finalization of the Federal Reserve’s regulations. The comment period for the proposed regulations closes on November 30, 2026. State member banks should also continue to monitor for the final regulations from the Federal Reserve, which will be published after the end of the comment period.

US: Treasury sets procedures for certifying state stablecoin regimes

On September 30, 2026, Treasury issued an interim final rule for the Stablecoin Certification Review Committee (SCRC). It sets SCRC review procedures for state regimes and took effect immediately. Under the GENIUS Act, issuers with $10 billion or less may opt into "substantially similar" state regimes. States must certify regimes initially and annually, and SCRC certification must precede any issuer approval. Recertification may be denied only for defined "material changes" or "significant changes in circumstances." Initial certifications, even conditional or incomplete ones, are due by January 18, 2028, and must later be completed. Comments on 39 questions are due by November 30, 2026.

Impact: The rule puts in place the process behind the state option for payment stablecoin issuer authorization under the GENIUS Act's dual federal and state framework. Issuers under the $10 billion threshold considering a state pathway should track whether and when their state regulator submits a certification. The flexible deadline may give states without a regime more time to decide whether to adopt one. State regulators have separately asked Treasury for safe harbors so issuers can operate under qualifying state regimes from the effective date. The interim final rule does not address the SCRC's other GENIUS Act functions, such as the ownership limits on certain public and foreign companies.

US: Regulator flags $13 billion in suspected digital asset scams

On September 3, 2026, the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) published an alert and financial trend analysis on digital asset investment scams linked to overseas scam centers.

FinCEN analyzed over 33,900 Bank Secrecy Act reports filed between September 2023 and December 2025. These reports identified roughly $12.7 billion in suspicious activity tied to ‘pig butchering’ – a long-term relationship based fraud where scammers build friendly or romantic trust with their victim before convincing them to invest in fraudulent cryptocurrency or trading platforms - and similar cryptocurrency confidence schemes.

The schemes are largely run by transnational criminal organizations operating industrial-scale fraud compounds in Southeast Asia.

FinCEN issued red flags to help financial institutions detect and report such activity.

Impact: Financial institutions should review FinCEN’s red-flag indicators and strengthen transaction monitoring for digital asset flows linked to overseas scam operations. Compliance teams should assess whether existing suspicious activity reporting procedures adequately capture the fraud patterns described in the alert.

Companies in the financial services and digital asset markets should treat this as a signal of heightened regulatory scrutiny on crypto-related fraud controls.

The alert supports the objectives of Executive Order 14390, targeting cybercrime and predatory schemes against Americans.

US: SEC proposes Regulation Crypto Assets

On August 18, 2026, the SEC issued a proposed rule for ‘Regulation Crypto Assets’. The regulation would deliver a tailored securities offering regime for certain investment contracts involving crypto assets. The proposal includes a startup exemption (up to $5 million over four years) and a fundraising exemption (up to $75 million per year). It also includes an ‘investment contract safe harbor’ under which a crypto asset would cease to be subject to an investment contract. The proposal would preempt state securities law registration requirements for qualifying offers and sales. The comment period is 60 days after Federal Register publication.

Impact: This landmark regulatory development establishes the first fit-for-purpose SEC offering framework for crypto assets. Crypto asset issuers and intermediaries are encouraged to review the proposal to assess eligibility under the startup or fundraising exemptions. The investment contract safe harbor creates a clear pathway for projects to exit SEC jurisdiction once essential managerial efforts cease. International issuers considering US capital formation should evaluate the framework’s preemption of state securities law. Businesses with existing token offerings should assess disclosure obligations under the proposed rules. The feedback period closed October 20, 2026.

US: Proposal for GENIUS Act stablecoin reporting

On July 17, 2026, the Federal Deposit Insurance Corporation (FDIC) issued a Financial Institution Letter. It proposed weekly and quarterly reporting forms for permitted payment stablecoin issuers. The forms apply to FDIC-supervised issuers under the GENIUS Act. The forms implement an information collection proposed on April 10, 2026. This is part of the FDIC’s GENIUS Act rulemaking.

Impact: FDIC-supervised entities seeking to issue permitted payment stablecoins under the GENIUS Act face new regulatory reporting obligations. Weekly and quarterly reporting forms are proposed for these issuers. Businesses should review the forms and instructions now, ahead of finalization. Data systems should be prepared for recurring submissions to avoid compliance delays once the reporting requirement takes effect.

US: Tokenized money market fund collateral framework published

On July 7, 2026, Global Digital Finance and the International Swaps and Derivatives Association jointly published a press release and report on using tokenized money market funds as collateral in US derivatives markets.

The report draws on contributions from over 300 participants across more than 120 businesses in the financial industry. It assesses the legal, regulatory, and operational requirements for deploying tokenized fund shares as margin in cleared and uncleared transactions.

The analysis evaluates three tokenization models against ten legal and regulatory dimensions, finding favorable outcomes across nearly all of them. However, cleared variation margin remains explicitly ineligible for money market funds, representing a notable limitation.

The report also addresses Uniform Commercial Code characterization, insolvency access, settlement finality, and related structural considerations. It provides a practical framework for businesses evaluating whether and how to adopt tokenized collateral.

Impact: Businesses should assess where tokenized fund shares can enhance collateral workflows across derivatives, repo, and securities lending. Internal collateral eligibility schedules, haircut frameworks, and credit policies will likely need updating to accommodate these instruments.

Businesses should identify internal governance owners and establish repeatable, documented workflows for tokenized collateral. Passage of the GENIUS Act may further shape the stablecoin and digital asset infrastructure supporting these markets.

US: Federal Reserve publishes initial triennial payments study findings

On July 1, 2026, the Federal Reserve issued initial findings from its 2025 triennial payments study. The study tracks trends in US non-cash payments. These include cheques, cards, and automated clearing house transactions. The findings help the Federal Reserve understand changes in the payments landscape.

Impact: Payment service providers and financial institutions should review the findings on shifting noncash payment trends. The data informs product development and compliance strategies across cards, automated clearing house, and other channels. Businesses should use the findings for benchmarking against industry trends. Companies should incorporate the data into strategic planning for evolving payment method use. Additional information will be released as further analysis is completed.

Co-authored by Uendi Barreti, Jonathan Botham and Rachel Campion

Further reading:

• FS+ Country Updates – September 2026

• Navigator: Trends driving change in the financial services industry

• FS+ Country Updates – August 2026

• UK: FCA finalizes the UK Crypto Regime

• Flash Update: EU: Digital Euro - Parliament backs trilogue negotiations