FinTech Global FS Regulatory Round-up - w/e 31 July 2026

UK

FCA: Handbook Notice No 143

The FCA has published Handbook Notice 143, setting out a number of changes made by its Board to the FCA Handbook and other material. The amendments include, among others: establishment of a UK cryptoassets regulatory regime, including a new Cryptoassets sourcebook (CRYPTO), a Core Prudential sourcebook (COREPRU) and a Prudential sourcebook for Cryptoasset Firms (CRYPTOPRU).

The cryptoassets regime instruments take effect on 25 October 2027. [31 Jul 2026] #Crypto #DigitalAssets

FCA and PRA highlight firm expectations under live CTP regime

The FCA has published a blog post by Mark Francis, FCA Director of Specialists, and Simon Dixon, PRA Director of Supervisory Risk Specialists, reminding firms to continue to review how they identify, test and manage their dependencies on critical services provided by designated critical third parties (CTPs), now that the CTP regime is live.

The blog explains that the regime aims to address system-wide risk. It notes that, in 2025, third-party issues accounted for 27% of incidents reported to the FCA, of which 37% were cyber-related, highlighting the systemic risks the regime is intended to mitigate. It further notes that the CTP regime is intended to complement, not replace, individual regulated firms’ existing obligations to manage their own outsourcing and third-party arrangements. [28 Jul 2026] #CTP

HM Treasury: FCA regulatory perimeter meeting – April 2026

HM Treasury has published a record of the meeting between the Economic Secretary to the Treasury and FCA CEO Nikhil Rathi on the FCA’s March 2026 perimeter report, which sets out the financial services activities requiring FCA authorisation.

Topics discussed, among others, include:

• the extension of FCA oversight to deferred payment credit (buy now, pay later) products from 15 July 2026;
• the need for HM Treasury and the FCA to work together to understand the impact of AI on the regulatory perimeter; and
• concerns about fraudulent online ‘finfluencers’, including the limits of the FCA's current enforcement powers. [27 Jul 2026] #Payments #AI #Finfluencers

Europe

ESAs call for enhanced governance and consistent supervision of ICT risks from frontier AI models

The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) have published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigating the ICT risks stemming from frontier AI models in the EU financial sector.

The statement reflects existing regulatory requirements, the European Commission’s (EC’s) Action Plan on Cybersecurity and Artificial Intelligence, and recent publications by other competent authorities.

The ESAs outline measures to help financial entities strengthen their operational resilience against cyber risks linked to frontier AI models, with particular emphasis on prevention, detection and management of those risks.

The statement underlines that financial entities must have robust governance and risk management frameworks in place to effectively manage and mitigate these cyber risks, and provides an update on ongoing and planned Digital Operational Resilience Act (DORA) oversight activities for critical ICT third-party providers (CTPPs). The ESAs encourage both financial entities and national competent authorities to use the statement as a basis for supervisory dialogue. [31 Jul 2026] #AI #DORA

ESMA newsletter: Spotlight on Markets – June and July 2026

The European Securities and Markets Authority (ESMA) has published the latest edition of its newsletter Spotlight on Markets. This edition includes, among others:

• a statement on the end of the Markets in Cryptoassets Regulation (MiCAR) transitional period, calling on unauthorised cryptoasset service providers (CASPs) to wind down their activities in an orderly manner whilst safeguarding clients' interests;
• the ESAs’ first annual report on major ICT-related incidents under DORA; and
• the launch of common supervisory actions on risk management functions and digital operational resilience for CASPs. [31 Jul 2026] #Crypto #DORA #DigitalAssets

ECB paper: Using AI to assess financial stability risks

The ECB has published a working paper: A SPOT in the dark: using AI to assess financial stability risks. The paper introduces SPOT, an AI-based indicator measuring the severity and probability of potential trigger events for financial stability, derived from a large language model (LLM) analysis of a large dataset of financial news articles over the period 2005–2026. The results indicate that the use of AI-based signal extraction from text can be a promising avenue to improve the monitoring of financial stability risks

The views expressed are those of the authors and do not necessarily reflect those of the ECB. [29 Jul 2026] #AI

Hong Kong

Financial regulators issue joint circular to advise industry on outcomes of first production run of cross-sectoral cyber mapping exercise

The HKMA, the SFC, the Insurance Authority, and the Mandatory Provident Fund Schemes Authority have issued a joint circular to advise the industry on the outcomes of the first production run of the cross-sectoral cyber mapping exercise.

The authorities state that, while they have continually driven cyber resilience enhancements in their respective sectors, the borderless nature of cyber threats requires an ecosystem response.  They have therefore collaborated to take forward a cyber mapping exercise with the support of the Financial Services and the Treasury Bureau.  

The first production run of the cyber mapping exercise was completed in March 2026.  It delivered a Cyber Map that allowed the authorities to visualise, for the first time, how over 50 participating financial institutions (FIs) across the banking, retail payment, securities and capital markets, mandatory provident fund and insurance sectors are connected at both business and technology levels.  There are three key takeaways from the Cyber Map:

• There are no new and major ‘unknown-unknown’ sources of systemic cyber risk. Specifically, the Cyber Map reaffirmed that the largest nodes in the financial system are those FIs, financial market infrastructures, and major technology service providers and data service providers already known to support critical business and technology functions.
• That said, a deeper analysis of specific business processes and information and communication technology arrangements revealed that certain third-party service providers playing critical roles within their areas of expertise might warrant increased supervisory attention moving forward.
• Cyber mapping is a useful risk management tool for the authorities and potentially FIs in the future.  There may be potential, in the future, to extend the Cyber Map’s dashboard capabilities to FIs (for data relevant to them) to support their own risk management and incident handling.

Going forward, the authorities will adopt the Cyber Map to complement their day-to-day supervisory work, especially in the areas of third-party risk and incident management.  Where warranted, they will also leverage relevant insights distilled from the Cyber Map and take forward additional cross sectoral collaboration as needed, such as conducting drill exercises, thematic reviews, and developing additional contingency arrangements.  The technical details of the Cyber Map are set out in the Technical Note attached to the circular.

The Authorities will, where appropriate, also share insights and supervisory feedback specific to the FIs that participated in the first production run on a bilateral and confidential basis.

The authorities intend to make the Cyber Mapping exercise a recurring fixture, with the next one estimated to take place in 2027/2028.   Efforts are underway to consolidate the experience gained and feedback received throughout the first production run to enhance the exercise methodology, refine the data scope, expand the participant coverage, and develop permanent and sustainable infrastructure.  [29 Jul 2026] #Cyber #CyberResilience

SFC reprimands and fines licenced corporation HK$2.1 million for inadequate cybersecurity controls for withstanding ransomware attack and delay in recovering its systems

The SFC has reprimanded and fined Luk Fook Securities (HK) Limited (LFSHK) HK$2.1 million for failing to implement adequate and effective cybersecurity control measures, which might have contributed to its failure to withstand a ransomware attack in 2022 and led to a delay of approximately three weeks in fully recovering its systems.

During the recovery period, LFSHK’s clients were unable to trade via the firm’s mobile trading app or internet platform, and they could only place orders through their account executives.

Following LFSHK’s self-report about the incident, the SFC's investigation found multiple deficiencies in LFSHK’s cybersecurity policies and systems, including (among others):

• A lack of firewall protection and adequate network monitoring;
• Outdated operation systems and antivirus software;
• Weak controls over user access and privileged accounts;
• Poor password management practices, such as storing credentials in unencrypted files;
• Insufficient controls over remote access and external devices;
• A lack of regular cybersecurity awareness training for staff; and
• Inadequate data backup and business continuity arrangements.

Although there was no evidence that LFSHK’s clients suffered any loss, the SFC concluded that LFSHK is guilty of misconduct after determining that the firm had failed to fully comply with the applicable cybersecurity requirements under the main code of conduct and guidelines relating to hacking risks associated with internet trading. 

LFSHK’s systemic failures had significantly contributed to both its inability to withstand the incident and the severity of its impact, thereby compromising its clients’ interests and the integrity of its operations.  [28 Jul 2026] #Cybersecurity

HKMA launches quantum preparedness whitepaper and index to support transition to post-quantum cryptography

 The HKMA has launched the Whitepaper on Quantum Preparedness of Hong Kong’s Banking Sector, together with the first Quantum Preparedness Index (QPI) and relevant support measures for the industry, at the eighth edition of the FiNETech series.

The whitepaper and the QPI were developed under the HKMA’s Fintech Promotion Blueprint (see our previous update), with the aim of enhancing the banking sector’s understanding of the implications of quantum computing and supporting early preparation for quantum-related cyber risks.

The Whitepaper covers a survey conducted in early 2026, which suggests that awareness of quantum-related developments is building across the sector.  Based on the survey findings, the HKMA released the first QPI, a forward-looking benchmark assessed across four key dimensions: Awareness, Planning, Pilots and Practical Preparedness.

• The initial QPI score is 2.3 on a 10-point scale, indicating that the sector is at an early stage of preparedness.  During the transition to post-quantum cryptography, banks should continuously enhance their cyber resilience, tech maturity, and innovation capabilities.
• Around 68% of the banks surveyed demonstrate awareness or are progressing to planning or piloting stages, while 32% have not yet embarked upon their transition journey.  Preparedness for the transition to post-quantum cryptography remains uneven, with around half of the banks surveyed having no formal post-quantum planning in place. 
• Some banks have started to engage with both the opportunities and implications of quantum technologies, although practical implementation remains limited.  Around half of the banks reported that quantum computing had been discussed at board level.  In addition, about one-third of all surveyed banks indicated that they had already begun exploring or piloting quantum-related initiatives.

The HKMA will support the industry through a post-quantum cryptography toolkit and capability-building workshops, with the objective of achieving full sectoral readiness (ie, a QPI score of 10) by 2030.  [27 Jul 2026] #Quantum #Cryptography

Singapore

MAS: Annual Report 2025/2026

The Monetary Authority of Singapore (MAS) has published its Annual Report, which outlines MAS' activities and achievements in FY 2025/2026. It also includes MAS’ financial statements and a message from its Chair, Mr Gan Kim Yong.

Alongside the report, MAS has published the remarks delivered by MAS Managing Director, Mr Chia Der Jiun, at the press conference launching the report. He spoke on key areas across central banking, financial sector development and regulation, as well as MAS’ financial performance. During his address, the MAS MD outlined the continued broad-based growth across Singapore’s financial sector, and updated on MAS’ efforts to scale innovation across the financial sector and strengthen resilience of our financial system to AI-enabled scams and cyber threats. In particular, he announced that MAS will be issuing supervisory expectations for key financial institutions (FIs) to develop and submit comprehensive assessments and action plans to strengthen their defence against AI-enabled cyber threats, as well as to guide FIs’ phased migration towards quantum resilience.

MAS has also published the Financial Sector Development Fund (FSDF) Annual Report 2025/2026. The FSDF offers grants to support financial sector players in enhancing talent development, promote technology and innovation, and deepen asset class capabilities. [28 Jul 2026] #AI

MAS and ABS establish taskforce to strengthen cyber and technology resilience against AI-driven threats

MAS and the Association of Banks in Singapore (ABS) have announced the establishment of the AI-Driven Cyber and Technology Risk Taskforce (ACT), an industry-wide initiative to strengthen collective cyber and technology resilience in response to the emerging risks posed by frontier AI models. The Taskforce will focus on three areas:

• industry collaboration – facilitate financial services industry sharing of AI cybersecurity use cases and experience as well as support engagement and collaboration with industry cybersecurity and AI experts;
• capability uplift – uplift financial services industry cyber defence knowledge and conduct proof-of-concept trials to explore and validate advanced AI-enabled tools against the evolving threat landscape; and
• guidance development – strengthen financial institutions' cyber security posture by developing guidance on new measures, controls and solutions to better detect, prevent and respond to sophisticated AI-enabled threats. [28 Jul 2026] #AI #Cybersecurity

MAS and BOT sign MoU on cybersecurity cooperation and digital fraud protection

MAS and the Bank of Thailand (BoT) have signed a memorandum of understanding (MoU) on cybersecurity cooperation and digital fraud protection. The MoU formalises and expands the ongoing collaboration between MAS and BOT to strengthen cyber resilience and combat digital fraud across their respective financial sectors. The MoU provides a framework for cooperation in:

• information sharing on cybersecurity and digital fraud – exchange of regulatory and incident updates and threat intelligence affecting the financial sector;
• competency-building – joint activities such as staff training, study visits, and exchange of research and policy insights to deepen technical collaboration; and
• operational preparedness – conducting joint cross-border cybersecurity and crisis management exercises. [24 Jul 2026] #Cybersecurity

Thailand

BOT and MAS sign MoU on cybersecurity cooperation and digital fraud protection

Bank of Thailand (BoT) and the Monetary Authority of Singapore (MAS) have signed a memorandum of understanding (MoU) on cybersecurity cooperation and digital fraud protection. The MoU formalises and expands the ongoing collaboration between MAS and BOT to strengthen cyber resilience and combat digital fraud across their respective financial sectors. The MoU provides a framework for cooperation in:

• information sharing on cybersecurity and digital fraud – exchange of regulatory and incident updates and threat intelligence affecting the financial sector;
• competency-building – joint activities such as staff training, study visits, and exchange of research and policy insights to deepen technical collaboration; and
• operational preparedness – conducting joint cross-border cybersecurity and crisis management exercises. [24 Jul 2026] #Cybersecurity

India

IFSCA: AI in IFSC survey report

The International Financial Services Centres Authority (IFSCA) has published AI in IFSC - Survey 2026 Report. This report presents the findings of the IFSC AI Survey 2026, which maps the adoption, maturity and governance of AI across the regulated ecosystem. Overall, the findings indicate that the GIFT IFSC ecosystem has moved from AI exploration in 2025 to early-stage operationalisation in 2026, marking an increase in AI maturity while highlighting the need for governance, talent development, and regulatory guidance. Key findings include:

• AI adoption is broad and advancing;
• investment is gaining momentum;
• operational excellence leads the agenda;
• employee AI use is widespread;
• governance frameworks are actively developing; and
• data stewardship is the top priority. [30 Jul 2026] #AI

Philippines

BSP announces launch of new digital payment services

The Bangko Sentral ng Pilipinas (BSP) has announced the launch of three new digital payment initiatives to make payments more accessible, convenient, and responsive to the needs of Filipinos. These:

• allow customers to authorise billers to automatically collect payments from their accounts on scheduled due dates;
• allow users to fund their own account or e-wallet by sending a request for funds from their originating financial institution, using the digital platform of their receiving financial institution; and
• increase maximum transfers by registered business from PHP50,000 to PHP 500,000. [28 Jul 2026] #Payments

SECP: Blockchain-based digital signing and authentication using Veritas

The Securities and Exchange Commission Philippines (SECP) has published Memorandum Circular No. 23: Blockchain-based digital signing and authentication of SEC-related documents using the SEC Veritas.

This Memorandum Circular shall take effect immediately after publication in two newspapers of general circulation in the Philippines. [27 Jul 2026] #Blockchain

BSP issues guidance to strengthen defence against emerging AI risks

The BSP has announced that it is urging banks and other BSP-regulated entities to strengthen their cybersecurity measures in response to emerging cyber risks associated with advances in AI. Under Memorandum No. M-2026-034 issued on 6 July 2026, the BSP encourages its supervised institutions to maintain an updated inventory of digital assets and systems, strengthen security controls such as multi-factor authentication, and proactively address system vulnerabilities such as unnecessary internet exposure.

The memorandum also recommends the use of AI-powered cybersecurity tools to help detect threats, monitor systems, and respond to attacks more quickly. It further calls on financial institutions to strengthen their incident response and business continuity plans to help ensure uninterrupted delivery of financial services during cyber incidents.. [23 July 2026] #AI