FinTech Global FS Regulatory Round-up - w/e 11 September 2026

Global

FSI paper: Frontier AI cyber threats and policy responses in financial sector

The Financial Stability Institute (FSI) at the Bank for International Settlements (BIS) has published a paper which assesses frontier AI models’ cyber capabilities and their prudential implications for financial sector supervisors. Risks identified include compressed remediation windows, increased likelihood of breach, and third-party concentration risk, where reliance on common cloud and AI providers can cascade disruption across firms and jurisdictions. Authorities are responding by reinforcing existing cyber and operational resilience frameworks, with supervisory expectations adapting to the new cyber threat environment.

The views expressed in the publication are those of the authors and do not necessarily reflect the views of the BIS, its member central banks or the Basel-based standard-setting bodies. [9 Sep 2026] #AI #Cyber

CPMI-IOSCO publish cyber resilience toolkit for FMIs and consultation on third-party service provider risks

The Committee on Payments and Market Infrastructures (CPMI) and the International Organisation of Securities Commissions (IOSCO) have jointly published two documents on operational resilience at financial market infrastructures (FMIs):

• a cyber resilience toolkit providing practical considerations to support FMIs in strengthening their cyber resilience frameworks and implementing operational resilience-related components of the CPMI-IOSCO Principles for Financial Market Infrastructures; and
• a discussion paper examining challenges and risks arising from FMIs' reliance on third-party service providers.

The toolkit is voluntary and non-binding, covering several broad topics relevant to cyber resilience, and is designed to complement the 2016 CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures. The discussion paper identifies key challenges related to third-party service provision to FMIs, particularly for critical services, and sets out questions for stakeholder feedback on the identified risks and on potential further engagement.

Comments on both the toolkit and the discussion paper are requested by 1 December 2026. [8 Sep 2026] #Cyber

UK

HM Treasury: Economic Secretary outlines support for UK private capital sector and AI adoption

HM Treasury has published a speech by the Economic Secretary to the Treasury, Lucy Rigby KC MP, at the UK Private Capital summit. Ms Rigby highlighted progress under the Financial Services Growth and Competitiveness Strategy, including the introduction of the Financial Services and Markets Bill to Parliament, a draft statutory instrument (SI) laid in July 2026 on proposed reforms to the Alternative Investment Fund Management Regulations, and a package of reforms for venture capital (VC) fund managers.  

The Economic Secretary also set out the Government's ambition for the UK to be the fastest adopter of AI in the G7, referencing the AI Adoption Plan for financial services published in July 2026, which focuses on supporting innovation whilst maintaining consumer protection, operational resilience and trust in the financial system. [11 Sep 2026]  #AI

FCA, BoE and HM Treasury respond to FSRC on stablecoin regulation

The Financial Services Regulation Committee (FSRC) has published responses from the FCA, the Bank of England (BoE) and HM Treasury to the recommendations in its June 2026 report on UK stablecoin regulation.

For the FCA, David Geale, Executive Director for Consumers, Payments and Competition, explained that the regulator had taken the FSRC's report into account when finalising its rules, including (among other refinements) reducing the K-factor and permitting intragroup custody up to 20% of backing assets subject to safeguards.

BoE Deputy Governor for Financial Stability, Sarah Breedon, highlighted that the BoE’s rules will be finalised by the end of 2026, meaning that systemic stablecoins will be able to operate under the regime from 2027.

The response from HM Treasury addressed, among other matters, the Government’s broader agenda for digital assets and perspective on comparisons with other jurisdictions also developing stablecoin regimes. [10 Sep 2026]  #Stablecoin #DigitalAsset

HM Treasury speech: Digitalisation of wholesale financial markets

HM Treasury has published a speech delivered by the Economic Secretary to the Treasury, Lucy Rigby KC MP, at UK Finance. Ms Rigby described the digitalisation of wholesale financial markets as a ‘national endeavour’ requiring coordinated action by Government, regulators and industry.

She also discussed the Digital Securities Sandbox (DSS), noting that it currently has 16 participating firms, and confirmed that the Digital Gilt Instrument (DIGIT) will be issued in Q1 2027. Ms Rigby also noted the Government’s intention to engage with the sector on legal framework changes needed to support digital markets beyond the sandbox. [8 Sep 2026]  #Digitalisation

Europe

EPC consults on FRIDA scheme rulebook

The European Payments Council (EPC) has published a consultation on its proposed FRaud Information Distribution Arrangement (FRIDA) scheme rulebook. The rulebook will govern fraud data exchange for account-to-account payment transactions within the Single Euro Payments Area (SEPA), implementing obligations on payment service providers (PSPs) under the EU Payment Services Regulation (PSR). The FRIDA scheme provides a standardised framework for automated fraud data sharing between PSPs, using a central platform for fraud alert distribution.

Comments on the proposed version 0.1 of the rulebook are requested by 10 December 2026. Version 1.0 of the rulebook and technical specifications are expected to be published by May 2027, with the scheme taking effect alongside the PSR in Q4 2028. [11 Sep 2026]  #Payments

Hong Kong

SFC CEO discusses AI and RMB internationalisation as twin engines for further market growth, while SFC Executive Director details plans for advancement of RMB internationalisation

The CEO of the SFC, Ms Julia Leung, gave panel remarks at Hong Kong Association of Banks’ Annual Distinguished Speaker Luncheon.  She highlighted that Hong Kong is uniquely positioned to harness the opportunities from artificial intelligence (AI) and RMB internationalisation, the twin engines for China’s economic rise as well as the driving forces for the next stage of market development for Hong Kong.

On AI:

• The SFC’s regulatory approach focuses on the safe and responsible use of AI, underpinned by existing regulatory principles – senior management accountability, sound governance, adequate systems and controls, transparency and protection of client interests. 
• Human accountability should move upstream to the design – what data AI may access, what decisions AI may support, what actions require human approval, what thresholds trigger escalation, and how records are kept.
• The SFC is considering whether further guidance is needed to help firms apply the existing principles to agentic use cases.  The aim is not to prescribe every technology design, but to clarify the outcomes the SFC expects – clear ownership and effective human oversight, controlled access and defined scope, robust testing before deployment and monitoring thereafter, operational resilience, and prompt escalation and remediation when things go wrong.
• The SFC itself is on a digital transformation journey, which will also benefit regulated firms and individuals through shorter licence processing time and earlier detection of misconduct and scams. [4 Sep 2026] #AI #Cyber

Ex-bank manager admits acceptance of bribes worth US$470,000 in cryptocurrency in exchange for illegal authentication of false instruments

A former relationship manager of a bank, Mr Lam Chun-yin, has admitted to conspiring with an employee of a fintech company and associates to accept bribes worth totalling over US$470,000 in cryptocurrency Tether for illegally authenticating multiple false instruments as guarantees for various insurance-related investment transactions, without the bank’s authorisation.

The incident was uncovered in an internal investigation by the bank, after which the bank lodged a corruption complaint with the ICAC and rendered full assistance.

Mr Lam pleaded guilty to one count of conspiracy for an agent to accept advantages, contrary to section 9(1)(a) of the Prevention of Bribery Ordinance and section 159A of the Crimes Ordinance.  Another charge of conspiracy to use false instruments was left on the court file.

The District Court adjourned the case to 18 September 2026 for sentencing, and remanded Mr Lam in the custody of the Correctional Services Department.  [9 Sep 2026]  #Crypto #DigitalAsset

Singapore

MAS responds to Parliamentary question on bank safeguards against scams involving use of AI

The Monetary Authority of Singapore (MAS) has published its response to a Parliamentary question on bank safeguards against scams involving AI-generated deepfake impersonation. [9 Sep 2026]  #AI #Deepfake

India

SEBI announces successful launch of Demat 2.0

The Securities and Exchange Board of India (SEBI) has announced the successful launch of Demat 2.0, a pilot project on tokenisation of corporate bonds. The pilot is being taken forward in phases. Issuances under the first phase are ongoing. Later phases will extend to buying and selling these bonds through the existing request for quote (RFQ) platforms, and to access for retail investors. The experience gained will guide any wider rollout. [10 Sep 2026] #Tokenisation

SEBI keynote: Regulating in a technology-intensive securities market

SEBI Chair, Tuhin Kanta Pandey, delivered a keynote address on ‘Growing Fast, Growing Safe: Regulating a Large and Technology-Intensive Securities Market’ during the Global Fintech Fest 2026 in Mumbai. He highlighted predictive supervision through SupTech and AI, the Demat 2.0 corporate bond tokenisation pilot, and cyber and quantum resilience, emphasising that innovation must scale without risk scaling at the same pace.

The Chair also participated in a high level panel discussion. The panel discussed how regulation can enable innovation while protecting investors and market integrity. The discussion covered AI accountability and safeguards, predictive supervision through SupTech, critical technology dependencies, tokenisation and changing market structures, investor education, and cyber and quantum resilience. [10 Sep 2026] #AI #Cyber #Tokenisation #Cyber #Quantum

US

NY DFS issues new cybersecurity risk assessment guidance

The New York State Department of Financial Services (NY DFS) has issued new cybersecurity guidance outlining its expectations for NY DFS-regulated entities around conducting risk assessments which are sufficient to inform their cybersecurity programs.

The guidance does not impose new obligations or requirements on regulated entities, but provides clarification on regulatory requirements under the NY DFS’ cybersecurity regulation and shares best practices that entities should consider implementing. The outline of key elements of effective risk assessment includes expectations related to governance and oversight, methodology, scope, documentation, and the need to integrate assessments into cybersecurity programs.  Factors to be considered when performing a risk assessment include:

• Material Technology Change: Reassessing risk before or after major system migration, acquisition, or implementation of a new critical system.
• Third-Party Risk: Evaluating whether multiple critical functions depend on the same cloud provider, managed service provider, software platform, or other common dependency.
• Emerging Risk: Considering how adoption of AI or other emerging technologies changes the entity’s threat exposure, data risks, access controls, or third-party dependencies.
• Risk-Informed Controls: Assessing identified risks to determine whether existing controls, policies, monitoring, or risk acceptance decisions need to be strengthened or updated.  [Sep 10, 2026]  #Cybersecurity #AI

CISA releases updated Insider Threat Mitigation Guide covering AI and hybrid working risks

The Cybersecurity and Infrastructure Security Agency (CISA) has released an updated Insider Threat Mitigation Guide, providing organisations with a current assessment of insider threats and practical steps to develop or enhance an insider threat programme. The updated guide addresses evolving considerations including the rise in hybrid and remote working and the increasing use of AI to manipulate or deceive. Key updates include new case studies and statistics, expanded guidance on access control and visitor screening, content on mitigating the risk of adverse employee separations, and access to newly released CISA resources supporting preparedness and early risk detection. [Sep 9, 2026]  #Cybersecurity #AI

FinCEN: Nearly $13 billion linked to suspected digital asset scams operated by overseas scam centers

FinCEN has published a Financial Trend Analysis and an alert to financial institutions to be vigilant to digital asset investment scams perpetrated by overseas scam centers.  FinCEN explains that it analyzed 33,904 BSA reports involving suspected digital asset investment scam-related activity filed between September 8, 2023, and December 31, 2025, totaling approximately $12.7 billion in financial activity tied to suspected digital asset investment scams. Individuals of all ages were the target of suspected scams across all 50 states and several U.S. territories.

Fraudsters deployed a variety of well-known fraud tactics, often using assumed names or identities to pose as potential romantic partners, new friends, or new business partners to target scam victims. Frequently, they created websites and mobile applications which imitated legitimate investment services to carry out their criminal activity. FinCEN also notes the use of guarantee marketplaces, which are online markets where scam center operators purchase illicit services, such as online account creation, phishing, and money laundering services. [Sep 3, 2026]  #DigitalAsset