FinTech Global FS Regulatory Round-up - w/e 16 October 2026

Global

FSB finalises sound practices for the responsible adoption of AI

The Financial Stability Board (FSB) has published its final report on sound practices for the responsible adoption of AI by financial institutions. The report sets out 12 practices organised into two groups that:

• emphasise the importance of organisation-wide AI governance as financial institutions adopt AI; and
• set out a comprehensive framework for managing risks throughout the AI lifecycle, from development to deployment.

The FSB states that the sound practices serve as a practical toolkit that financial institutions can tailor to their specific context and risk profile and integrate into existing frameworks, including those for cyber and third-party risk. The report includes case studies illustrating the benefits reported by firms and how some sound practices have been applied proportionately.

The FSB will monitor developments and update the sound practices as necessary to support safe and responsible AI adoption by financial institutions. [15 Oct 2026]  #AI

BIS Innovation Hub: Project Aurum Phase 2 report

The Bank for International Settlements (BIS) Innovation Hub has published its Project Aurum Phase 2 report on the application of privacy-enhancing technologies (PETs) to digital cash systems. The report finds that privacy and compliance need not be mutually exclusive, though stronger privacy protections may involve trade-offs in programmability, performance, and operational complexity.

The project was carried out by the BIS Innovation Hub Hong Kong Centre in collaboration with the Hong Kong Monetary Authority (HKMA), the Hong Kong Polytechnic University and the Hong Kong Applied Science and Technology Research Institute (ASTRI). [13 Oct 2026]  #Payments #DigitalAsset

UK

PSR consults on simplified regulatory framework for access to payment systems

The Payment Systems Regulator (PSR) has published Consultation Paper 26/3 – Regulatory framework for access to payment systems (CP26/3), which sets out simplification proposals while broadly maintaining existing access requirements.

The introduction of a proposed single access regime aims to simplify the existing regulatory framework as part of the abolition of the PSR, by removing overlap and fragmentation across various regulatory requirements that govern access to payment systems.

The consultation is framed around the planned abolition of the PSR and the substantive transfer of its functions to the FCA, alongside HM Treasury's plans to repeal the payment system access regime under the Payment Services Regulations 2017. The consultation package includes a proposed revised General Direction 2 and a draft consolidated piece of access guidance.

Responses are requested by 10 December 2026. [15 Oct 2026] #Payments

DRCF launches call for input on 2027/28 workplan

The Digital Regulation Cooperation Forum (DRCF) has published a call for input to inform the development of its 2027/28 workplan. The 2027/28 call for input invites views from industry, academia, civil society, and others on the DRCF's priority areas for the year ahead.

The DRCF brings together four UK regulators (the Competition and Markets Authority (CMA), the Office of Communications (Ofcom), the Information Commission’s Office (ICO), and the FCA) to coordinate their approach to digital regulation.

Comments are requested by 20 November 2026. [15 Oct 2026] #DigitalRegulation

Commons Library: AI regulation in the UK

The House of Commons Library has published a research briefing which provides an overview of how AI is regulated in the UK. The paper highlights that the UK does not have any AI-specific legislation covering AI as a technology; instead, AI is regulated in the context in which it is used through existing legal frameworks and sector-specific regulators. The briefing outlines key policy initiatives and provides an extensive further-reading list of UK Government documents, third-party analyses and parliamentary select committee reports on AI regulation. [14 Oct 2026]  #AI

Commons Library briefing: AI safety

The House of Commons Library has published a research briefing on AI safety, covering risks and harms arising throughout the AI lifecycle and current UK governance measures. [13 Oct 2026]  #AI

Europe

ESMA publishes new Q&A – CASPs

ESMA has published its answer to a question relating to cryptoasset service providers (CASPs): Use by CASPs of payment accounts provided by non-bank payment service providers for holding clients’ funds. [16 Oct 2026]  #Crypto #DigitalAsset 

ESAs set supervisory priorities for 2027

The Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) has published its annual work programme for 2027, setting out priorities for addressing cross-sectoral risks and strengthening coordination across the EU financial sector.

Key priorities include digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring. Under the Digital Operational Resilience Act (DORA), the ESAs will continue oversight activities relating to critical ICT third-party service providers and will work to strengthen the financial sector's preparedness against cyber threats. The Joint Committee will also assess the implications of growing AI use and other digital innovations. Consumer protection will remain a central priority, with continued joint work on issues affecting retail consumers. [13 Oct 2026] #DORA #Cyber #AI

ESMA TRV risk analysis: Social media sentiment and retail trading behaviour

ESMA has published a trends, risks and vulnerabilities (TRV) risk analysis examining the effect of social media interactions on retail investors' realised returns as well as on the behaviour underlying retail investors’ return realisation.

The analysis finds a significant relationship between social media sentiment and retail investor outcomes. ESMA found that positive sentiment is associated with realised gains and net selling, while divergent opinions are associated with realised losses and net buying. ESMA concludes that, beyond the established risks of misinformation and manipulation, social media's influence on retail investor behaviour operates through a sentiment-driven channel that warrants attention. ESMA states it will continue to monitor these developments and will further explore the mechanisms at work. [13 Oct 2026]  #SocialMedia

Australia

ASIC consultation: Implementing new digital asset laws

ASIC has launched consultation on guidance and standards that will support new laws for digital asset platforms (DAPs) and tokenised custody platforms (TCPs). The consultation paper sets out ASIC's proposed standards and regulatory guidance to comply with the new digital asset framework introduced by the Corporations Amendment (Digital Assets Framework) Act 2026, which commences 8 April 2027.

The draft guidance covers proposals regarding the standards on asset-holding and trading activities, financial requirements for licensees and how to comply with the new laws. It focuses on how these changes impact:

• operators of DAPs and TCPs, and others providing financial services for these new products; and
• existing Australian financial services (AFS) licensees, market participants, payments providers and other businesses that use or deal with digital assets.

The new framework is designed to align Australia's approach with overseas jurisdictions and bring DAPs and TCPs into the financial services regulatory framework to build customer confidence in digital asset trading.

Under the proposed guidance, firms will need to:

• apply for (or vary) an Australian financial services licence,
• provide customer disclosure documents and platform rules, and
• comply with asset-holding standards, transactional and settlement standards, and net tangible asset requirements, where relevant.

ASIC intends to continue liaising with stakeholders during the consultation period. Submissions are requested by 27 November 2026.  [15 Oct 2026]  #DigitalAsset

ASIC: Financial consultancy penalised $1.35 million for cybersecurity failures

The Supreme Court of NSW has ordered a financial consultancy to pay a $1.35 million penalty after admitting it failed to properly manage cybersecurity risks across its financial advice network.

Over a period of about two years, the consultancy admitted it:

• failed to implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks across its business and authorised representative network;
• failed to implement adequate processes, systems and frameworks to oversee and monitor the cyber resilience of its authorised representatives;
• failed to maintain adequate human resources with specialised cybersecurity expertise; and
• failed to maintain adequate cybersecurity risk management systems.

These failures were found to expose its representatives and clients to cyber-related attacks, risking serious harm and loss.

In determining the penalty, the Court considered the size of the business, which had between 81 and 94 financial advice practices, around 200 authorised advisers, and 55,000 retail clients. It was also relevant that the conduct was found not to be deliberate, and that the consultancy cooperated with ASIC throughout the investigation and court proceedings.

ASIC's chair, Sarah Court, said that the outcome "reinforces ASIC’s continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short”.  [14 Oct 2026]  #Cybersecurity

Hong Kong

HKMA announces 'ART' Framework to promote responsible AI adoption

The HKMA has announced the 'ART' Framework – representing Accountability, Resilience, and Trust – to support the responsible adoption of artificial intelligence (AI) in the banking sector, marking an important step under the Fintech 2030 strategy and the Fintech Promotion Blueprint (see our previous update).

With the objective of supporting banks in seizing the opportunities presented by AI while maintaining robust governance and operational resilience, key initiatives under the 'ART' Framework include:

• The issue of Supervisory Guidance for Responsible Adoption of Artificial Intelligence, drawing on insights from the second cohort of the Generative AI (GenAI) Sandbox (see our previous update);
• An AI training data sharing platform in collaboration with Hong Kong Cyberport Management Company Limited and the University of Hong Kong, with data quality assurance as a core design principle; and
• Further testing of agentic AI applications through the GenAI Sandbox++ (see our previous update) and an upcoming discussion paper to seek industry views on a proposed supervisory framework for agentic AI governance, exploring intent-anchored accountability, a registry of material AI agents, and effective intervention mechanisms.

The HKMA also co-hosted the Finance + AI Forum with Cyberport on 15 and 16 October 2026, marking the successful completion of the technical trials under the second cohort of the GenAI Sandbox.  In particular, more than 60% of the use cases explored agentic AI, demonstrating the industry’s active pursuit of advanced AI applications, such as automated planning and execution of multi-step tasks within defined boundaries and controls.  The HKMA has published a report, 'Practical Insights from the Second Cohort of the GenAI Sandbox', to share observations and good practices from the sandbox pilots, with cross-references to the above supervisory guidance.

In addition, the HKMA has issued a Concept Note on the Governance of Agentic AI, which sets out preliminary considerations for governance arrangements as agentic AI develops further in the banking sector.  It will inform future formulation of supervisory requirements, drawing on experience from the GenAI Sandbox++ and engagement with the industry.  [15 Oct 2026]  #AI

Thailand

BOT: Blueprint to combat digital financial fraud

The Bank of Thailand (BOT), the International Monetary Fund (IMF) and the World Bank Group have announced the ‘Bangkok Blueprint for Fraud-Resilient Financial Services’. The Blueprint’s 12 recommendations span five pillars: strategic planning; comprehensive corruption management; use of existing risk management and law enforcement frameworks; stronger domestic and international cooperation; and consumer protection, awareness and digital resilience. [14 Oct 2026]  #AI

SECT consults on amendments to the Disciplinary Committee framework for Digital Asset Businesses

The Securities and Exchange Commission Thailand (SECT) has published a consultation on proposed principles for amending the regulations governing the Disciplinary Committee for Digital Asset Businesses. The proposed amendments aim to improve clarity and align the regulations with those governing other panels of qualified experts that provide opinions to SECT, while promoting credibility, transparency and operational efficiency. Feedback is requested by 16 October 2026. [9 Oct 2026]  #DigitalAsset

US

FINRA information on social media and investing

The Financial Industry Regulatory Authority (FINRA) has published information for retail investors on evaluating investment information obtained through social media and avoiding related investment risks and fraud.  [Oct 14, 2026]  #SocialMedia

SEC’s Selway outlines upcoming market developments

The Securities and Exchange Commission (SEC) has published remarks delivered by Jamie Selway, Director, Division of Trading and Markets, in which he outlined current and planned developments in market structure, tokenised securities and novel financial products. In particular, Mr Selway highlighted:

• The SEC is reviewing its proposal to rescind Rule 611, the trade-through rule, and amend Rule 610(e) to permit locked and crossed markets. It expects complete the review by the end of 2026. Any Rule 611 changes are expected to be coordinated with modernised best execution requirements. The consolidated transaction reporting plan is scheduled to become operational in April 2027.
• In September, the SEC approved a five-year conditional Innovation Exemption for tokenised securities venues. Eligible venues must be U.S. persons, operate on public permissionless blockchains, use automated market makers for permissioned participants, observe volume limits, and trade tokenised NMS stocks carrying the same rights and privileges as the underlying stocks. Issuers must have an opportunity to object to the trading.
• The SEC has approved Cboe’s proposal to list binary security options linked to key performance indicators for NMS securities. Five designated contract markets (DCMs) registered with the Commodity Futures Trading Commission (CFTC) submitted notices in September 2026 to register as security futures exchanges, and at least four are expected to begin trading perpetual securities futures during the fourth quarter of 2026.

Mr Selway was speaking at the Security Traders Association’s 93rd Annual Market Structure Conference.  [Oct 14, 2026]  #Tokenisation