On 11 June 2026, the European Parliament’s Committee on Economic and Monetary Affairs (ECON) published the following draft reports on the European Commission’s legislative proposals relating to the market integration and supervision package (MISP): Draft report on the proposal for a regulation of the European Parliament and of the Council amending Regulations (EU) No 1095/2010, No 648/2012, No 600/2014, No 909/2014, 2015/2365, 2019/1156, 2021/23, 2022/858, 2023/1114, No 1060/2009, 2016/1011, 2017/2402, 2023/2631 and 2024/3005 as regards the further development of capital market integration and supervision within the Union. Draft report on the proposal for a directive of the European Parliament and of the Council amending Directives 2009/65/EC, 2011/61/EU and 2014/65/EU as regards the further development of capital market integration and supervision within the Union. Draft report on the proposal for a regulation of the European Parliament and of the Council on settlement finality and repealing Directive 98/26/EC and amending Directive 2002/47/EC on financial collateral arrangements. Each draft report contains draft European Parliament legislative resolutions setting out suggested amendments to the legislative proposals, with the justifications for those amendments set out in explanatory statements.Our earlier podcast on the MISP can be found here.

On 11 June 2026, the European Banking Authority (EBA) published the draft methodology, templates and template guidance for the 2027 EU-wide stress test.As in previous EU-wide EBA stress test exercises, the 2027 one provides a common analytical framework to assess the resilience of EU banks and the wider banking system under a common adverse macro-financial scenario, testing their capital adequacy under stress. The results will feed into the Supervisory Review and Evaluation Process.A total of 63 banks from the EU and Norway, including 47 from the euro area, will participate, covering 75% of the EU banking sector.The draft methodological note describes the common methodology that defines how banks should calculate the stress impact of the common scenarios and, at the same time, sets constraints for their bottom-up calculations. It also provides banks with guidance and support for performing the EU-wide stress test. However, it does not cover the quality assurance process or possible supervisory measures that should be put in place following the outcome of the stress test. Annex I of the methodological note contains a preliminary list of institutions included in the sample. The draft template guidance provides technical guidance to participating banks for populating the set of templates for the 2027 EU-wide stress test.Notably, the draft methodology cuts required data points by 55% compared with the previous EBA EU-wide stress test, mainly by drawing on regular supervisory reporting. This includes a simplification of stress test definitions and the elimination of previous stress test datapoints or templates which would overlap with supervisory reporting. Another key change is the introduction of climate risk into the EU-wide stress test. For the first time, transition and physical risks are incorporated alongside macro-financial shocks. At this stage, climate risks will be assessed through a dedicated module and will not affect the core stress test results.The EBA plans to hold a series of workshops with the industry to help them in their preparations.

On 11 June 2026, a letter was published from Nikhil Rathi, Chief Executive of the Financial Conduct Authority (FCA), to Baroness Noakes DBE of the House of Lords Financial Services Regulation Committee, in which Mr Rathi: (i) sets out the conclusions from the FCA’s lessons learned exercise in relation to its consultation on publicising more enforcement investigations (CP24/2); and (ii) provides an update on enforcement operations and publicity since the introduction of Policy Statement 25/5 in June 2025, in which the FCA finalised revisions to its Enforcement Guide, including its amended investigation publicity policy (PS25/5).Conclusions from the FCA’s lessons learned exerciseIn the letter, the FCA acknowledges that: its consultation proposals came as a surprise to much of industry and explains that the spread of the strong negative reaction had not been anticipated; it could have flushed out some of the concerns regarding the proposals in advance if it had engaged more before the consultation, which would have both helped the FCA shape its approach, and helped it identify sooner the information which stakeholders felt would have helped to inform their feedback on the proposals; and how the FCA framed the proposals in the original consultation gave the impression of a fundamental change in approach, whereas the number of additional proactive announcements under the proposals would have been relatively modest. The FCA accepts that it would have been helpful to have provided that analysis in the original consultation. The FCA states that the reaction to CP24/2 has reinforced its commitment to be as predictable as it can be when consulting on policy changes and that this is an explicit commitment in its current five year strategy.Developments since the publication of PS25/5In terms of developments since the publication of PS25/5, in the letter the FCA notes that: Between 3 June 2025 and 30 April 2026, it opened 33 enforcement operations. Five have been announced on a named basis and two on an anonymised basis. Of the five named announcements, two were based on exceptional circumstances, and three the FCA confirmed reactively. This includes the FCA’s investigation into The Claims Protection Agency Limited, which it determined met the ‘exceptional circumstances’ test. For further information on this case please see our briefing here. The two operations that the FCA has announced anonymously under its revised policy are into firms in the home and travel insurance markets and stemmed from earlier supervisory multi-firm work. Had the public interest test been in place, these may have been candidates for a named announcement given the impact on consumers and market integrity. In one operation, the FCA’s recent decision to announce on a named basis is the subject of an ongoing legal challenge. The FCA also highlights that in January 2026, it published the first edition of Enforcement Watch, which provided a thematic overview of the suspected misconduct it is investigating in operations opened between 3 June and 31 December 2025. See our briefing on this publication here. The FCA’s next edition will be published in July.In the FCA’s view, the operations that it has confirmed reactively, and the information that it has disseminated about ongoing enforcement operations on an anonymised basis, are examples of how the changes that it implemented to its publicity policy in June 2025 have increased transparency.

On 10 June 2026, the Financial Stability Board (FSB) published a consultation report on sound practices for responsible adoption of artificial intelligence (AI).In the consultation report the FSB identifies certain sound practices to help all types of financial institutions navigate the benefits and risks as they adopt AI. The 12 sound practices cover organisation-wide governance as well as management of different stages of AI development and deployment (or AI lifecycle).Sound practices 1 to 4 emphasise the importance of organisation-wide AI governance, in informing the financial institution in its decision on whether and how to adopt an AI technology and at what scale. These sound practices highlight: The pivotal role the board and senior management play in setting the overall approach and providing oversight so that AI adoption is aligned with the financial institution’s business model, risk appetite, and strategy. The importance of establishing clear governance frameworks, policies, procedures, and processes to identify, assess, monitor, and manage AI-related risks. The importance of defining clear responsibilities and accountabilities throughout the organisation. How financial institutions benefit from continuous learning and adaptation, enabling them to develop the resources, skills, knowledge, and capabilities required to sustain value creation and effective risk management over time. Sound practices 5 to 10 focus on managing specific AI use cases at or throughout different stages of an AI lifecycle so that use case deployments are supported by proportionate guardrails. This involves: Effectively and systematically assessing the materiality and risks of AI use cases at inception and thereafter. Selecting appropriate AI models or systems by considering objectives, operational, and technical needs, as well as materiality and risk of AI use cases. Maintaining appropriate data governance so that the data for training, testing, and using AI is accurate, complete, reliable, and secure. Understanding differences in the explainability of various types of AI and, if appropriate and feasible, adopt more explainable AI or consider compensating controls. Evaluating the performance of AI use cases proportionately to their materiality and risk, including through performance assessment, testing, and ongoing monitoring. Implementing appropriate and effective human oversight that is relevant to the materiality, risk, autonomy, complexity, and explainability of different AI use cases. Sound practices 11 and 12 highlight the importance of managing: AI-related cyber and information and communication technology (ICT) risks including by incorporating AI cyber and ICT risk scenarios into tests and exercises, sharing relevant information with key stakeholders, and where appropriate, using AI tools in cyber and ICT risk management. Risks from AI third-party use with a focus on performance, transparency, data quality, supply chain and concentration risks, and business continuity. Next stepsThe deadline for comments on the consultation report is 22 July 2026.

On 9 June 2026, The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were made. An explanatory memorandum has also been published.These Regulations make targeted amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. In particular it: Refines customer due diligence, enhanced due diligence and additional due diligence requirements, including for unusually complex or unusually large transactions, high risk jurisdictions and pooled client accounts and cryptoasset correspondent relationships. Updates currency thresholds from euros to sterling. Strengthens the regime for cryptoasset businesses in aligning it with the new financial services regulatory regime for cryptoassets established under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Reforms the Trust Registration Service requirements to close identified gaps, while introducing a de minimis exemption for low-value, low-risk trusts. Brings the sale of “off-the-shelf” firms within the scope of regulated trust or company service provider activity. Clarifies that a firm is excluded from the definition of an “insurance undertaking” to the extent it is carrying out or effecting a contract of reinsurance. Enhances information-sharing and cooperation between AML/CTF supervisors and other public bodies.

On 10 June 2026, the Financial Conduct Authority (FCA) issued its first Emerging Technology Horizon Scan 2026.The document sets out three plausible ways emerging technologies could combine to create new outcomes for consumers, firms and markets. It also highlights early signals of new risks these technologies may enable.Key trendsAccording to the document key trends include: Technological convergence is accelerating. As emerging technologies combine, they are changing the way financial systems operate and serve consumers, creating new opportunities and risks Personalised intelligence could help consumers navigate their financial lives. If AI becomes the main interface between consumers and firms, AI agents, digital twins and edge computing could change how people budget, save and make financial choices. This may empower consumers, but also raises questions about autonomy, digital exclusion and consumer protection Synthetic crime is evolving fast and will affect how financial crime is tackled. Advances in AI are simultaneously improving firms’ ability to detect vulnerabilities while expanding attack surfaces. In parallel, synthetic media is becoming harder to tell apart from real content. AI may manipulate not only what we see and hear (for example, audio and video deepfakes) but also how we judge what is true. This could expose consumers and firms to new forms of fraud and deception Programmable finance could support growth by reshaping financial infrastructure and enabling new markets. Distributed ledger technologies, tokenisation, Central Bank Digital Currencies, stablecoins and smart contracts are moving from pilots to national strategies. This is creating connected financial systems that could make services faster and more efficient, while changing the underlying ‘plumbing’ of the global financial system.  Case studiesThe report also includes case studies covering: Machine learning for credit risk management. Scaling relationship management with AI. Operational efficiency with AI adoption. Aligning skills and capabilities to AI strategy. Documentation of AI use cases. Learning from the AI ecosystem through public-private sector collaboration. How an adaptive AI strategy delivered industry leadership. Project Noor. Developmental testing. Financial institutions’ management of third-party AI risks.

In this latest edition of Regulation Around the World, we focus on the global transformation of the settlement of securities transactions, as many jurisdictions begin to shift from a standard settlement timeline of two business days after trade to just one. In this issue, we examine these developments, exploring the regulatory frameworks, cross-border challenges and technological innovations that are reshaping the post-trade landscape. In a number of jurisdictions we cover the following questions: What is the current regulatory and market settlement cycle, and what changes are planned? In respect of asset classes other than crypto assets or tokenized securities, what challenges or risks have been identified with transitioning to T+1 or instantaneous settlement? How does the jurisdiction address (or propose to address) cross-border settlement mismatches when counterparties operate on different settlement cycles (such as T+1 vs T+2)? What regulatory or operational measures exist to mitigate cross-border liquidity and FX timing pressures created by shorter settlement cycles? To what extent does the jurisdiction permit or envisage 24/7 trading in securities or other financial instruments, and what regulatory or operational challenges have been identified in connection with continuous trading cycles? What is the regulatory treatment of blockchain-based or tokenized asset settlement? How do regulators approach cross-border legal recognition of blockchain-based settlement finality across multiple jurisdictions? Read the full update here.  

On 9 June 2026, Lord Stockwood moved that the Financial Services and Markets Bill be read a second time in the House of Lords. After debate, the motion was agreed to. Lord Stockwood also moved that the bill be committed to a Grand Committee, and that the Grand Committee consider the bill in the following order: Clause 1 Schedule 1, Clauses 2 to 13 Schedule 2, Clauses 14 to 31 Schedule 3, Clauses 32 to 53, and this motion was also agreed to. Hansard published consideration of these matters.

On 9 June 2026, the Financial Conduct Authority (FCA) published a consultation paper (CP26/18) in relation to proposed changes to the mortgage rules aimed at helping more people to access mortgages.BackgroundIn June 2025, the FCA published a Discussion Paper (DP25/2) on the future of the mortgage market. In December 2025, the FCA also set out its response (FS25/6) to the feedback it received and action it proposed to take as part of our longer-term plan to modernise mortgage rules, which has informed the proposals in this consultation.SummaryCP26/18 proposes a range of changes that would impact the mortgage market, including: Interest-only mortgages – The FCA is proposing three key changes to its existing interest-only framework, in particular: (i) adapting requirements for where a credible repayment strategy is needed; (ii) adding further examples of credible repayment strategy options, and (iii) clarifying expectations of the review requirement and providing examples of trigger points for when to carry out a review. Retirement interest-only mortgages – The FCA is proposing to remove current sections of its existing guidance, which would mean affordability for joint retirement interest-only mortgage applications are assessed in the same way as for standard joint mortgages i.e. firms would not be obliged to always consider a sole borrower’s ability to afford the mortgage if the joint borrower passes away. Variable and irregular income – The FCA is proposing to expand its guidance to include examples of evidence for assessing affordability for customers with variable or irregular income. In particular, to clarify that lenders may agree payment schedules at a frequency other than monthly, including quarterly or other regular frequencies. Credit-impaired or recently recovered – The FCA proposes to be explicit that the definition of ‘credit-impaired customer’ applies only in: (a) the Mortgage Conduct of Business Sourcebook (MCOB) 11.6.16R (additional steps where a credit-impaired borrower uses a mortgage for debt consolidation), MCOB 4.7A.22 G (for the example given when advising in relation to credit-impaired) and (b) SUP 16.12 reporting. As a result, the intention is that firms would be free to set credit risk appetite and target markets but should not treat the glossary definition as a factual indicator of unaffordability. Foreign currency loans – The FCA are proposing to differentiate standards and protections for loans denominated in a foreign currency from those where all or part of the income is in a currency other than sterling. The FCA sets out that the intention of this change is to move away from prescriptive, Mortgage Credit Directive derived rules and towards a more proportionate, outcomes-focused framework consistent with the Consumer Duty. Bridging loans – The FCA are proposing to amend its Handbook definition of bridging loans which are regulated mortgage contracts to include terms of up to 24 months and also set out that they don’t consider that these proposals in relation to regulated bridging loans overlap or conflict with the statutory exemptions for some types of bridging loans in FSMA 2000 (Regulated Activities) Order 2001. In addition, the FCA are proposing to amend its rules regarding bridging loan extensions, with the total combined term, including the original term and any extensions, capped at 24 months. Next stepsThe FCA sets out that welcomes feedback on the proposals in CP26/18 by 28 July 2026 and will aim to publish a policy statement in the second half of 2026.The FCA also sets out that it is continuing with policy development across the remaining three themes of the Mortgage Rule Review: enhancing later life lending, enabling innovation and protecting consumers in vulnerable circumstances.

On 9 June 2026, the European Parliament issued a press release stating that its negotiators had reached a provisional agreement with Council of the EU negotiators on proposals introducing the concept of small mid-cap enterprises (SMCs) and extending to them various exemptions that so far have been available to small and medium enterprises (SMEs).The press release adds that SMCs are defined in principle as companies with fewer than 1,000 employees; and either up to €200 million in turnover or up to €172 million in total assets (the European Commission proposed 750 employees, €150 million in turnover and €129 million in total assets). The new category will be added to certain EU directives and regulations including the Markets in Financial Instruments Directive II and the Prospectus Regulation.Next stepsThe provisional agreement needs to be formally adopted by both the European Parliament and Council of the EU. The draft legislation then needs to be published in the EU Official Journal.  

On 29 May 2026, HM Treasury (HMT) wrote to the Co-Chairs of the Crypto & Digital Assets APPG.SummaryHMT set out that it recognises the potential for digital assets and blockchain technologies to drive economic growth in the UK and that this is why the Government introduced the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, which establishes a new financial services regulatory regime for cryptoassets.HMT further explain that the legislation’s implementation period is intended to help manage implementation costs for the sector and give firms time to come into compliance before the new requirements come into force and also that the Financial Conduct Authority (FCA) expects to finalise its rules by mid-2026, and for the application period to be open from 30 September 2026, in order to give firms sufficient time to secure authorisation before the regime goes live on 25 October 2027.HMT therefore argues that the current timetable strikes the right balance between implementing the regime at pace and allowing firms sufficient time to adjust their processes as required and secure authorisation and, further, that the FCA is putting in place a range of provisions to encourage high quality applications and efficient processing, including offering firms a free pre- application meeting, providing key information ahead of the gateway opening, and prioritising its resource as needed.

On 29 May 2026, the Financial Conduct Authority (FCA) published Policy Statement 26/8: Retail banking business models data (PS26/8).BackgroundIn January 2026, the FCA consulted on transforming a previously ad hoc series of retail banking business models (R2B2) data collections into an annual regulatory return. Under the proposals firms would supply core financial data comprising of product and sub-product level financial and volumetric information on residential mortgages, personal banking, personal lending, small business banking and lending, other business banking and lending and wholesale funding. The FCA would also include an ‘off-the-shelf’ request for firms to provide various readily available business documents.SummaryIn PS26/8, the FCA sets out its final rules and guidance for the R2B2 return. It explains that most respondents agreed with the consultation proposals in relation to frequency of collection, alignment with firms’ internal accounting periods and annual publication of relevant statistics. However, the FCA also set out that it has made some changes following feedback aimed at making the rules clearer and more proportionate, including: Reconciliation: The FCA have removed from the template a formula driven reconciliation between product level data and whole business profit and loss and renamed this section ‘whole business’ to better reflect its nature and how it will be used. Streamlining off the shelf document request: This request has been amended to focus more on the business as a whole rather than individual products. Rule amendments on group reporting requirements: The FCA have sought to better align these rules with how firms report financial information, for example to enable parent firms to include data in respect of all entities they prepare group accounts for. Clarifications: The rules have bene clarified to make clear that product level data and off the shelf data required only relates to products firms provide to UK customers. Next stepsThe new rules come into force on 1 June 2026.  The FCA will engage with industry in the run up to the deadline for the first submission at the end of November 2026.

On 29 May 2026, the European Securities and Markets Authority (ESMA) published its sixth annual report on the quality and use of regulatory data.Compared to previous annual reports, this annual report has further expanded the scope of the datasets covered to include prospectus reporting, credit rating agency reporting, central counterparty supervisory reporting, crowdfunding reporting, Digital Operational Resilience Act major ICT-related incident reporting, reference data under the Markets in Financial Instruments Regulation and the ESMA registers. The report generally shows that improvements in data quality and data use reinforce each other in a virtuous cycle, supporting more effective supervision and market monitoring across the EU.The ESMA will host on 18 June 2026 a webinar to present the main findings of the report.

On 28 May 2026, the European Commission adopted a Delegated Regulation supplementing the Capital Requirements Regulation (CRR) with regard to regulatory technical standards (RTS) specifying operational risk requirements.The CRR 3 includes amendments to the operational risk area, where a revised framework is introduced and all previously existing approaches for the calculation of regulatory capital are replaced by the business indicator component (BIC). The BIC is based on a business indicator, which measures an institution’s volume of business. The business indicator is a financial statement-based proxy for operational risk. Only the items representing recurrent banking business operations in an institution’s profit and loss statement, or balance sheet statement should be included within this indicator.The RTS: Specify the components of the business indicator by detailing a list of items and the elements to be excluded from the business indicator. Specify how institutions are to determine the adjustments to the business indicator following mergers, acquisitions and disposals, the conditions according to which Member State competent authorities may grant the permission to adjust the business indicator following disposals and the timing of the adjustments post-disposals. Establish a risk taxonomy on operational risk and a methodology to classify the loss events included in the loss data set by developing a list of operational risk loss events and providing guidance on the classification of rapidly recovered losses and losses from legal proceedings. Specify the conditions under which the calculation of the annual operational risk loss should be deemed unduly burdensome for institutions the business indicator of which is equal to or exceeding EUR 750 million and not exceeding EUR 1 billion Specify how institutions are to determine the adjustments to their loss data set following the inclusion of losses from merged or acquired entities or activities. Next stepsThe Delegated Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.

On 29 May 2026, the Financial Conduct Authority (FCA) published Handbook Notice 141.This Handbook Notice describes the changes to the FCA Handbook and other material made by the FCA Board under their legislative and statutory powers on 23 April 2026 and 28 May 2026.On 23 April and 28 May 2026, the Board of the FCA made the relevant changes to the Handbook as set out in the instruments: Collective Investment Schemes (Use of Distributed Ledger Technology in Authorised Funds) Instrument 2026 Collective Investment Schemes (Direct Dealing) Instrument 2026 Consumer Credit (Regulatory Reporting) (Amendment) Instrument 2026 Supervision Manual (Amendment) Instrument 2026 Technical Standards (European Markets Infrastructure Regulation) (Clearing Thresholds) (Amendment) Instrument 2026 Short Selling Rules Sourcebook (Administration) Instrument 2026

The Serious Fraud Office (SFO) has entered into its first Deferred Prosecution Agreement (DPA) in five years. The agreement with Ultra Electronics Holdings Limited (Ultra), a British defence, security and aerospace manufacturer, covers historic alleged conduct relating to failure to prevent bribery under the UK Bribery Act 2010 (UKBA).The SFO commenced an investigation in 2018, following Ultra self-reporting suspected corruption in Algeria relating to Ultra’s overseas third-party agents. The scope was later widened by the SFO in 2022 to cover Oman, and again in 2024 to encompass all jurisdictions in which Ultra operated.Under the DPA, Ultra agreed to: pay a £10 million financial penalty, plus £4.8 million in SFO costs; and meet strict conditions, including annual reporting to the SFO on the operation of its ABC programme, and demonstrating genuine and sustained reform over a forward-looking three-year period. This DPA provides important insights into the evolving UK criminal enforcement landscape. We explore five key takeaways below.1. Reminder of the broad scope of failure to prevent offencesThe Ultra DPA is a good reminder of the breadth of failure to prevent offences following the recent coming into force of the failure to prevent fraud offence in September 2025.The DPA serves as a reminder to organisations to ensure that risk assessments, controls and policies are regularly reviewed and updated. Notably, during the investigation, Ultra undertook extensive steps to enhance its compliance programme, including commissioning an independent external risk assessment focusing on the failure to prevent fraud offence.2. Third‑party risk remains a critical exposureThe SFO’s investigation centred on the alleged activity of Ultra’s third-party sales and commercial agents in relation to securing high-value contracts. The Ultra DPA underpins the importance of ensuring compliance programmes deal head on with bribery and corruption risks arising from third party agents and intermediaries.Practical steps include: mapping and risk-rating all third-party channels and relationships; clearly explaining to third parties compliance expectations and understanding what policies and procedures they have in place (to ensure that ABC reps and warranties have meaning); conducting thorough due diligence (including considering business intelligence review for higher risk third parties); testing the commerciality of arrangements and the rationale for the engagement of particular third parties; applying enhanced due diligence and ongoing monitoring to higher-risk third parties; and undertaking an audit on financial controls on payments, including for expenses, third parties, gifts and hospitality and charitable and political donations (as Ultra did as part of its remediation steps). It is critical that companies can provide detailed documentation and data on how third-party risks are managed.3. The benefits of early and fulsome self-reportingUltra submitted a self-report to the SFO in 2018, following concerns raised about payments to an Algerian agent. This was followed by a detailed internal investigation report submitted to the SFO in 2019.In 2022, Ultra made a further disclosure to the SFO relating to conduct in Oman. However, the SFO rejected Ultra’s analysis that a prior internal investigation into the conduct in 2015 had not identified evidence of bribery and corruption, leading to a temporary breakdown in DPA negotiations that were on foot.The case illustrates two important points: Self-reporting can significantly improve the prospects of securing a DPA, rather than facing prosecution. However, the timing, completeness, and accuracy of self-disclosures are critical. In April last year, the SFO published its Cooperation Guidance that made clear prompt self-reports to the SFO, accompanied by full cooperation, would result in an invitation to negotiate a DPA, rather than prosecution.While the Ultra DPA indicates that progressive disclosures made over the course of the investigation are not prohibitive to securing a DPA, early and fulsome reporting helps to ensure the best outcome if you are intending the get the benefit of self-reporting. When assessing the Ultra DPA, the court noted that it had not overlooked the late reporting of the Oman conduct, and that it could properly be reflected in assessing the penalty.The message for corporates is clear: early, comprehensive and transparent engagement with authorities can have significant benefits down the track.4. Cooperation and remediation are determinativeA pivotal factor in securing the DPA was Ultra’s extensive cooperation and remediation efforts, particularly following its acquisition by new owners who were unconnected to the misconduct.Under new ownership and leadership, Ultra executed a “post-acquisition compliance reset” and provided substantial cooperation to the SFO, including: identifying relevant individuals and producing key documents; facilitating access to overseas records and legacy entities; offering limited waivers of privilege; supporting witnesses interviews; and delivering detailed investigative findings, reports and presentations. The company also strengthened its compliance culture, demonstrating active steps to remediate, including: engaging external lawyers to assess its compliance programme and implementing recommendations, and an external accounting firm to undertake a risk assessment; enhancing policy frameworks across business units; undertaking a wholesale review on the approach to selecting and managing third-party agents and intermediaries and a subsequent reduction on the reliance on third-parties; overhauling the Board of Directors and providing the Board with data on Ultra’s ABC programme, as well as introducing a group-level Chief Compliance Officer to report directly to the Board; establishing an independent compliance function and introducing “compliance champions” to sit within business units; and implementing a mandatory training programme. These efforts ultimately led to the SFO resuming DPA negotiations. The outcome demonstrates that meaningful cooperation and remediation can materially influence enforcement outcomes in the right case.5. Increasing emphasis on group-level accountabilityThe DPA also reflects a growing focus on accountability at the group level. Ultra’s parent company, Cobham Ultra Limited, provided formal undertakings to ensure that Ultra would: comply with the terms of the DPA; and remain operational and under its control for the duration of the agreement. This was similarly the case in a previous DPA entered into in 2019 between the SFO and Serco Geografix Ltd, where the parent company (Serco Limited) was required to provide undertakings. In approving the DPA, the Court noted that without undertakings given by the parent company, it was very unlikely that the goals of the DPA could have been achieved, and that it is the parent company which necessarily must engage in any compliance programme and cooperate with law enforcement agencies.This requirement highlights the SFO’s expectation that parent entities play an active role in ensuring compliance and remediation across group structures.The Ultra DPA also serves as a reminder to acquiring entities to undertake thorough due diligence during an acquisition, as they may effectively assume successor liability for the target’s historic misconduct. ConclusionThe Ultra DPA is a significant development in the UK corporate criminal enforcement. It reinforces several themes: the centrality of prevention-focused compliance, the critical importance of third-party risk management, and the tangible potential benefits of early cooperation and genuine remediation.For organisations operating in high-risk sectors or jurisdictions, the case serves as both a warning and a roadmap, demonstrating not only how failures can arise, but also how companies can navigate enforcement processes and, ultimately, mitigate outcomes through proactive and sustained compliance efforts.

On 28 May 2026, the Financial Conduct Authority (FCA) updated its webpage which sets out its findings from a review of how benchmark administrators manage data risks.The FCA completed a multi-firm project looking at the quality of calculation controls in the benchmarks sector and this is reported on in chapter 5 of the webpage. The FCA looked at error handling arrangements, including error identification, classification, prioritisation and notification. The FCA noted that there were two distinct approaches being taken by firms in how they captured and handled errors: Quantitative (data-led) and Qualitative (judgement-led). Both models have strengths and weaknesses.The FCA has also updated the next steps section of the webpage. It will be carrying out further work later this year on other risks set out in its December 2024 portfolio letter, including corporate governance. It adds that addressing any weaknesses in data quality and calculation controls should help firms gain confidence in, and better demonstrate, the effectiveness of their governance and oversight arrangements, as well as strengthening their overall operational resilience.

On 28 May 2026, the Financial Conduct Authority (FCA) published its findings in relation to financial firms’ controls, highlighting good and poor practices and areas for improvement to support better compliance with sanctions rules.BackgroundThe FCA highlights that over the past four years, the UK’s sanctions regimes have grown in scope and complexity and that, therefore, it recently assessed financial services firms’ systems and controls for financial and trade sanctions. As a result, the FCA now sets out examples of good and poor practice, and areas for development, to help firms comply with sanctions legislation.SummaryOverall, the FCA sets out that although there were fewer reports of suspected sanctions breaches from FCA-supervised firms between 2023-2025, the figure remains substantial compared to pre-2022 levels, and most reported breaches relate to financial sanctions, with only a comparatively small proportion of breach reports submitted by firms relating to trade sanctions. As a result, it sets out certain key observations in relation to the following areas, including: Key themes in breaches: The most common root causes of reported sanctions breaches were weaknesses in due diligence, alert management, transaction and name screening, as well as the management of frozen assets and compliance with specific and general licences. Firms should focus on strengthening their control frameworks in these areas as they underpin many of the issues the FCA observe.  Governance and oversight: Sanctions frameworks only work well if firms have strong governance and oversight. Firms should have clear ownership and accountability for compliance, and their senior management should oversee and provide informed decision-making, acting quickly to address weaknesses. Firms should also have robust contingency plans to deal with sudden events or system outages. Management Information (MI): Meaningful MI should allow senior management to understand sanctions exposure, emerging risks, control effectiveness and issues that need escalating or remediating. Firms generally reported some sanctions-related MI to senior management. Tracking and reporting true matches and false positives arising from customer and transaction screening against the UK Sanctions List is also common practice. However, the quality and depth of sanctions MI varied. Stronger MI included data and commentary on the nature and extent of inherent sanctions exposures, the operation of the firms’ controls structures and the crystallisation of any sanction’s risks. Risk assessments: Good sanctions risk assessments should guide how firms design and operate their systems and controls. Firms should assess their exposure to sanctions risks present among their customers, products and the jurisdictions they operate in, as well as the strength of the systems and controls they have in place to address them, which can help identify control gaps and support remediation. Due diligence and ongoing monitoring: Robust customer due diligence (CDD) at onboarding and ongoing reviews can help firms identify sanctions risks and take actions throughout the customer lifecycle.  Some firms understood and assessed the sanctions risks posed by their customers. In others, initial screening and CDD at onboarding did not show that they’d properly considered how they would get a clear view of their sanctions exposure. Among those that had found higher sanctions risks, the use of enhanced due diligence (EDD) tools such as sanctions exposure questionnaires was inconsistent. In some cases, questions were outdated, did not consistently cover UK sanctions regimes, or were used only as a form of customer self-attestation.  Screening: Good sanctions screening can find potential sanctions risks across customer and counterparty relationships and transactions. Firms’ screening and alert management systems and processes should be proportionate to risk exposure, appropriately calibrated, and regularly tested and reviewed. Screening policies: Firms with stronger screening frameworks often supported their screening activity with well‑documented policies and procedures with details of who or what to screen, how often, and how to escalate and resolve potential matches.  More mature frameworks had clear escalation routes, with defined roles and responsibilities across the first and second lines of defence. However, the FCA also found screening policies that were unclear, incomplete, or not applied consistently.  List management and data feeds: Firms varied in their approaches to sanctions list management and the underlying data feeds. Around two-thirds of those in the FCA’s proactive work said that they implemented sanctions list updates within one day of notification and had processes and controls in place so that updates were accurate and prompt. However, the FCA also found errors or omissions in sanctions lists provided by third-party vendors, because of poor quality data and the transfer of data between systems, as well as delays or failures in updating the UK Sanctions List in a timely manner. Calibration, configuration, and assurance testing: The sophistication of firms’ screening configuration and testing varied considerably. Effective practices included periodic calibration and quality assurance testing, engaging with vendors to retest systems following list updates or changes to matching logic, and using root cause analyses following screening mismatches to improve performance. In contrast, the FCA also observed limited testing and oversight of sanctions screening systems, meaning that some firms could not easily detect obfuscated or variant names, including those with non-Latin characters. This meant that firms couldn’t find exact matches between names on their systems and the UK Sanctions List, nor easily identify name variations. Alert management and resourcing: Alert handling was a common cause of reports of suspected breaches by firms. This includes failures to respond to alerts and to freeze accounts before assets were moved, and handling errors leading to alerts being incorrectly resolved, sometimes due to unclear procedures, training, or oversight controls. Evasion detection and investigation: Screening names and payments may not always be sufficient to identify activities breaching sanctions, particularly as connections to sanctioned activity can’t always be identified from transaction messaging.  This is particularly the case for sanctions outside asset freeze measures, such as sectoral financial sanctions and trade sanctions. Firms may need to undertake transaction monitoring, data analysis, thematic reviews and intelligence-led investigations, and have a good understanding of evasion typologies and how these may manifest across a firm’s business. Asset freezing and licence compliance: To effectively comply with asset freezing and the requirements set out in sanctions licences, firms must have clear processes to quickly identify, implement and maintain the requirements. Policies, procedures and systems, along with staff training and appropriate governance, can help ensure assets are frozen and remain frozen, and that licence permissions are managed. Reporting and assessing breaches: UK sanctions legislation defines obligations for reporting suspected breaches of financial and trade sanctions. This requires firms to have clear processes for identifying, escalating and reporting potential breaches to relevant authorities in a timely manner. Discovering what caused the breaches can inform remediation, control enhancements, and risk assessments. Firms are identifying and reporting breaches more quickly and the reporting data shows the average time between identification and reporting has shrunk slightly from 2024. Next stepsFirms should consider the findings and examples in this report and continue to review their systems and controls to ensure they comply with both financial and trade sanctions.The FCA are working with the firms that had weaknesses we found during our review, to make sure they’re taking the right remedial action and will continue to monitor firms to help drive improvements and reduce financial and trade sanctions risk across the industry.The FCA will also continue to liaise and work with relevant partners across HM Government such as the Office of Financial Sanctions Implementation and the Office of Trade Sanctions Implementation to share insights to enhance the FCA’s work. 

On 28 May 2026, the Prudential Regulation Authority (PRA) published Policy Statement 15/26 (PS15/26) setting out updates to Pillar 2A methodologies and related guidance, as the first phase of a two-stage review.BackgroundIn Consultation Paper 12/25 (Pillar 2A review) Phase 1 (CP12/25), the PRA proposed updates to Pillar 2A methodologies and guidance as the first phase of a two-stage review. Pillar 2A capital requirements are set for firms to address risks not already, or not sufficiently, captured by Pillar 1.CP12/25 marked the beginning of a programme of work to modernise the PRA’s approach to Pillar 2A capital by improving the information, guidance and transparency around the setting of Pillar 2A capital over time. It also outlined the PRA’s proposals to address the consequential impacts of the PRA rules that would implement the Basel 3.1 standards.SummaryThe PRA explained in PS15/26 that respondents generally welcomed the PRA’s intention to address the consequential impacts of the implementation of the Basel 3.1 standards, as well as increase the transparency and proportionality of the PRA’s policy.The PRA also set out that it received the most responses on the credit risk proposals. In this area, respondents expressed a range of views, with comments focused on the: Case to retain the benchmarking methodology. Calibration and scope of the two proposed systematic methodologies for certain exposures. Level of prescription and the proportionality of the proposed approach to assessing idiosyncratic credit risk. Having considered the responses to CP12/25, the PRA has made certain changes to the draft policy materials for the purpose of providing greater detail and increasing clarity where it considers appropriate, material changes include: Credit risk: Excluding exposures to small and medium sized enterprises from the systematic methodology for unconditionally cancellable commitments in the retail exposure class (retail UCCs); and, providing greater flexibility in how firms are expected to assess their idiosyncratic credit risks, compared to the CP proposal to introduce expectations for firms to use credit scenarios. Operational risk: Clarificatory updates to improve transparency and guidance for all firms, and changes to the small domestic deposit takers (SDDT) policy materials to align the operational risk Pillar 2A methodology for SDDTs and non-SDDTs. Next stepsFollowing the completion of this first phase of Pillar 2A review, the PRA will conduct a more in-depth review of certain individual methodologies within Pillar 2A. The PRA will publish a further consultation on these proposals next year.The amended Reporting Pillar 2 Part of the PRA Rulebook, reporting templates, reporting instructions and schedule, Supervisory Statements and Statements of Policy will come into force on 1 January 2027.

3 April – 3 May 2026IntroductionESG is changing the landscape for financial institutions as stakeholders, including investors, increasingly expect them to make their operations more sustainable.Financial services regulators also view ESG as a priority, embedding the principles of climate-related financial risks into their supervisory frameworks and dealing with greenwashing issues.There is limited uniformity in regulation as financial services regulators are at different stages in developing their ESG regulatory framework, particularly in relation to disclosures and taxonomy, which is a challenge for many institutions operating across borders. It is therefore critical to monitor the latest regulator updates.To help you, we have tracked ESG regulatory developments from 3 April 2026 – 3 May 2026, from the UK, France, EU, the Netherlands, the US, Australia as well as other key international regulators.This month’s highlightsNavigating the ESG Regulatory Patchwork: A Growing Challenge for ComplianceInternational firms operating across multiple jurisdictions face an increasingly complex web of ESG regulations that are difficult — and at times impossible — to reconcile. As the United Kingdom, the European Union, and the United States each pursue distinct regulatory philosophies, compliance departments find themselves caught in the crossfire of overlapping, and occasionally contradictory, obligations.In the UK, the Financial Conduct Authority has introduced stringent anti-greenwashing rules alongside broader conduct requirements designed to ensure that sustainability claims are fair, clear, and not misleading. Firms marketing financial products or services must substantiate their green credentials with rigorous evidence, and the regulatory tone is firmly interventionist. Across the Channel, the EU’s Corporate Sustainability Reporting Directive (CSRD) imposes a sweeping double-materiality framework, requiring companies to disclose not only how sustainability risks affect their business, but also how their operations impact the environment and society at large. The volume and granularity of data demanded under the CSRD represent a significant step beyond most existing reporting regimes. Meanwhile, in the United States, ESG regulation remains politically fractured. Federal initiatives, such as the Securities and Exchange Commission’s climate disclosure proposals, have met fierce resistance, and a patchwork of state-level rules — some supportive, others openly hostile to ESG considerations — adds further uncertainty.For compliance departments, the practical difficulties are acute. Teams must interpret and operationalise frameworks that differ not merely in detail but in underlying philosophy. A disclosure strategy designed to satisfy CSRD requirements may generate content that is scrutinised differently under UK anti-greenwashing standards or that attracts political risk in certain US states. Data collection and assurance processes must be flexible enough to serve multiple reporting lines simultaneously, yet robust enough to withstand regulatory challenge in each jurisdiction. Resource constraints compound the problem: recruiting and retaining staff with the cross-jurisdictional expertise needed to manage these obligations is an ongoing struggle.Ultimately, the absence of meaningful international harmonisation means that compliance is not simply a matter of meeting the highest standard and assuming coverage elsewhere. Firms must instead maintain parallel workstreams, each tailored to the specific expectations of its respective regulator — a burden that shows little sign of easing.United KingdomThere have been no reported updates this month.European Union21 April 2026 – European Commission adopts Delegated Regulation on RTS specifying the measures and safeguards to be implemented by ESG rating providersThe European Commission (Commission) adopted a draft Commission Delegated Regulation supplementing Regulation 2024/3005 (ESG Rating Regulation) with regard to regulatory technical standards (RTS) specifying the measures and safeguards to be implemented by ESG rating providers to separate their ESG rating activities from their other activities.The structure of the draft Commission Delegated Regulation is as follows: Article 1 sets out that all ESG rating providers should put in place separate organisational structures and working environments for employees and other persons involved in the rating process from any of the activities listed in Article 16(1) of the ESG Rating Regulation, and subject them to regular self-declarations attesting employees’ non-involvement in such activities. Article 2 proposes that ESG rating providers intending to provide investment services and/or insurance and reinsurance activities implement additional technical and internal control measures. Article 3 provides that, ESG rating providers that intend to provide benchmarks, or do provide such benchmarks, are to adopt additional specific safeguards ensuring that employee compensation remains unaffected by conflicts of interest related to benchmark activities, that ESG ratings are produced and offered independently of the provision of benchmarks, and that any actual or potential conflicts of interest are assessed and documented before entering into a contract for the provision of ESG rating activities. The draft Commission Delegated Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union (OJ). It applies from 2 July 2026.21 April 2026 – European Commission adopts Delegated Regulation on RTS specifying the elements of ESG rating products to be disclosed to the public and to users of ESG ratingsThe Commission adopted a draft Commission Delegated Regulation supplementing the ESG Rating Regulation with regard to RTS specifying the elements of ESG rating products to be disclosed to the public and to users of ESG ratings, rated items and issuers of rated items.The structure of the draft Commission Delegated Regulation is as follows: Article 1 specifies that the RTS address disclosures to be made under Annex III.1 and Annex III.2 of the ESG Rating Regulation. Article 2 specifies that disclosures made in accordance with Annex III.1 of the ESG Rating Regulation should be presented in accordance with the sequence and structure of the table in Annex I of the RTS. Article 3 requires a range of rating level disclosures around what is rated and what risks and impacts are measured. Article 4 addresses general methodological disclosures. Article 5 deals with disclosures on the limitations of data sources. Article 6 deals with disclosures on ESG rating providers’ organisational information. Article 7 establishes a higher level of methodological disclosures for rated items and users of ESG ratings. Article 8 deals with disclosures on the revision of methodologies. The draft Commission Delegated Regulation enters into force on the twentieth day following its publication in the OJ. It applies from 2 July 2026.24 April 2026 – ESG Rating Regulation – Commission adopts Delegated acts on fees and penaltiesThe Commission adopted: Commission Delegated Regulation supplementing the ESG Rating Regulation with regard to fees charged by the European Securities and Markets Authority (ESMA) to ESG rating providers. This Delegated Regulation supplements the ESG Rating Regulation by specifying the type of fees, the matters for which fees are due, the amount of the fees and the respective justification, the manner in which they are to be paid and, where applicable, the way in which ESMA is to reimburse competent authorities in respect of any costs that they might incur when carrying out tasks pursuant to that Regulation, in particular as a result of any delegation of tasks pursuant to the ESG Rating Regulation. Commission Delegated Regulation supplementing the ESG Rating Regulation with regard to rules of procedure on fines and periodic penalty payments imposed to ESG rating providers by ESMA.  This Delegated Regulation sets out further rules of procedure for the exercise of ESMA’s power to impose fines or periodic penalty payments, including provisions on rights of defence, temporal provisions and the collection of fines or periodic penalty payments, and on detailed rules on the limitation periods for the imposition and enforcement of fines and periodic penalty payments. Next stepsThe Council of the EU and the European Parliament will now scrutinise the Delegated Regulations. If neither object, the Delegated Regulation on fees enters into force on the day following that of its publication in the OJ and the Delegated Regulation on fines and periodic penalty payments enters into force on the twentieth day following its publication in the OJ.FranceThere have been no reported updates this month.The NetherlandsThere have been no reported updates this month.AustraliaClimate Integrity report co-authored by Ruth Higgins SC suggests recent ICJ decision will catalyse more climate litigationA report from Climate Integrity co-authored by the incoming solicitor general, Ruth Higgins SC, found a recent Advisory Opinion from the International Court of Justice on states’ climate change obligations would catalyse increased litigation over companies’ and directors’ climate obligations. The report warns of three primary litigation fronts: greenwashing claims (including those concerning ‘Paris-aligned’ targets), disputes over the regulatory approval of emissions-intensive projects, and legal challenges concerning director liability for climate-related harm.In the ICJ opinion, their Honours found states must act with due diligence and cooperate internationally to prevent environmental harm from greenhouse gas emissions, aligning with commitments under the Paris Agreement. The report observed this decision “has already precipitated legal and regulatory developments that create or amplify climate-related transition risks” (indeed, the opinion already been relied upon in at least three Australian cases challenging decisions to approve fossil fuel projects) and “we expect it to continue to do so. As the magnitude of those risks or the probability of their occurrence rises, so too may the standard of care expected of directors of those corporations.”The report stated that directors of fossil fuel companies will be affected most by the opinion, and that “in our view, directors of such corporations would be required in their decision-making processes to a least consider such risks” that their companies’ assets associated with fossil fuels may be limited, prohibited or rendered financially unviable in the near future.The report highlighted the situations most likely to give rise to a breach of a director’s duty: Where a director approves misleading statements about a corporation’s climate-related risks (including statements that are misleading by omission); Where a director fails to consider climate-related risks at all; or Where a director approves a course of action so unreasonable that no reasonable director would have approved it. The takeaway from the Climate Integrity report is that directors must exercise greater ‘diligence and intelligence’ regarding climate-related risks. Specifically, they should stay informed on evolving climate developments, seek expert advice when necessary, and ensure timely risk disclosure to the market.United States- SEC and CFTCThere have been no reported updates this month.International regulators – FSB, IOSCO, Basel Committee, NGFS, SASB, IFRS, ISSBThere have been no reported updates this month.