Top 5 – What's in store for financial services in 2026?

Summary

The banking package revises Pillar 1 across credit, CVA and operational risk, introduces the output floor, and updates market risk capital under FRTB. CRD6 strengthens supervision, embeds ESG risk, and creates an EU wide regime for third country branches. Banks must re model RWAs, update Pillar 3, and redesign booking, governance and reporting. 

Indicative timeframe

CRR3 largely applies from 1 January 2025; market risk / FRTB applies from 1 January 2026. CRD6 must be transposed by 10 January 2026 and applied from 11 January 2026. The third country branch framework, including Article 21c 'core banking services', applies from 11 January 2027, with certain reporting obligations from 11 January 2026. 

Summary

A directly applicable AML Regulation creates a single rulebook, broadens obliged entities, sets a €10,000 cash cap, and harmonises CDD, PEPs, and reporting. 
AML Authority (AMLA) begins operations to coordinate supervision and FIUs. Member States implement AMLD6 for institutions and registers. Obliged entities must uplift frameworks comprehensively.

Indicative timeframe

AMLA operational from 1 July 2025. 

AMLR applies from 10 July 2027 (with limited later dates for specific sectors). AMLD6 transposition due by 10 July 2027, with some elements earlier (2025-2026) and others later (2029). 
 

Summary

The package modernises PSD2. PSR will directly harmonise conduct rules; PSD3 updates licensing and supervision. 

Key obligations include verification of payee for non euro credit transfers, stronger fraud refunds, API performance standards, prohibition of obstacles, and consumer 'permission dashboards'. PIs and EMIs gain fairer access to accounts and systems. 

Indicative timeframe

Final political agreement occurred in late 2025; formal adoption mid‑2026.

Application expected 18–24 months after entry into force, pointing to core obligations in H2 2027 (some possibly later). 

Summary

FIDA establishes regulated schemes for access to financial data across banking, investments, insurance, pensions, and beyond, on customer request and under GDPR compatible permissions. It will catalyse new distribution, embedded finance, risk analytics, and switching, while imposing governance, liability, and security obligations on data holders and users. 

Indicative timeframe

Final political agreement is awaited. Phased application culminating by 2027. 

Firms should plan for scheme participation, permission management, security controls, and product redesign by 2027. 

Summary

The AI Act imposes obligations on providers and users of 'high risk' AI, which include creditworthiness assessment and other finance critical models. Requirements span risk management, data governance, technical documentation, record keeping, transparency, human oversight, and post market monitoring. Governance, model inventories, testing, and audit readiness are essential. 

Indicative timeframe

Prohibitions and general provisions apply from 2025; core high risk obligations phase in through 2026–2027. By 2026/2027, high risk finance use cases must meet conformity and governance duties; GPAI codes and standards also mature over 2025–2026. 

Summary

Spain’s MiCA regime becomes fully operational for CASPs after the end of a transitional period. Existing providers must hold MiCA authorisation and meet conduct, prudential, governance, white paper, market abuse and safeguarding duties. CNMV leads on CASPs; Banco de España and the Treasury interface on e money tokens and AML/CTF.

Indicative timing/status

Spain’s transitional period for existing providers ends 30 December 2025. From 2026, CASPs must be authorised under MiCA to operate. Supervisory reporting and Level 2 standards continue to roll out through 2026/2027, with supervisory expectations tightening as the regime beds in.

Summary

Horizontal law setting minimum customer service standards across sectors, including financial services. It mandates maximum response times, access to human agents, clearer complaint pathways, service level reporting, and oversight of outsourced providers. Banks, insurers and investment firms must redesign contact centre operations, MI, governance and vendor management to meet the new baseline.

Indicative timing/status

Approved by Congress; pending Senate vote. Entry into force will follow publication, with phased application expected.

Financial sector compliance build will run through 2026/2027 and should be coordinated with the new Financial Customer Protection Authority to avoid duplicative standards and processes.

Summary

CCD2 expands scope to small loans and BNPL, modernises disclosures, tightens advertising, and strengthens creditworthiness assessment and withdrawal rights. Spanish lenders, BNPL providers, and intermediaries must re paper product terms, journeys, and controls; systems must support concise SECCI, affordability checks, and post contractual rights. 

Indicative timing/status

Member State measures must be applied from 20 November 2026. Spain must adopt and apply national measures consistent with this date; legacy agreements remain under old rules until expiry. 

Summary

Spain must implement AIFMD II amendments, including rules for loan originating AIFs, LMTs, delegation oversight, depositary regimes, and enhanced reporting. Spanish AIFMs and UCITS managers must update internal policies, risk, liquidity, and loan origination controls, and prepare for revised supervisory reporting templates and data. 

Indicative timing/status

National measures must apply from 16 April 2026. ESMA standards and reporting template changes land through 2026–2027, requiring staged operational updates. 

Summary

The AML single rulebook applies directly from July 2027, resetting customer due diligence, cash limits, PEP scope, beneficial ownership transparency, and reporting. Spain must also implement AMLD6 for institutional arrangements, registers, and supervisory coordination. Obliged entities must complete comprehensive framework uplifts and upgrade controls. 

Indicative timing/status

AMLA operational from 2025. AMLR applies from 10 July 2027; Spain must transpose AMLD6 by 10 July 2027 (with some elements earlier / later). Supervisory and FIU processes will align accordingly. 

Summary

The Government and the SFC consulted on proposed licensing regimes for providers of VA dealing and custodian services in 2025.  They published consultation conclusions and launched a further consultation on proposed licensing regimes for providers of VA advisory and management services in December 2025.

Indicative timeframe

The Government and the SFC aim to introduce a Bill into the Legislative Council in 2026 for all four licensing regimes. We expect the SFC to consult on and publish accompanying supervisory guidelines for the implementation of the new regimes.

Summary

The Protection of Critical infrastructures (Computer systems) Ordinance is aimed at strengthening the security of the computer systems of critical infrastructures and minimising the chance of essential services being disrupted or compromised due to cyberattacks.

The Ordinance applies to sectors that deliver essential services, including the financial services sector.  Designated operators are required to fulfil organisational, preventive, and incident reporting and response obligations. 

Indicative timeframe

The Ordinance commenced operation on 1 January 2026 with the establishment of the Office of the Commissioner of Critical Infrastructure (Computer-system Security).

The operators and critical computer systems that are designated over the coming months will be required to comply with the Ordinance. 

Summary

The HKMA commenced a consultation with retail banks in September 2025 on a proposed framework for responsibility sharing in relation to losses arising from authorised payment scams. 

Indicative timeframe

The timeframe has yet to be announced and the consultation documents have not been made publicly available.

Summary

Enhancements to the Banking Ordinance have been proposed following a review, including (among others): 

• Simplification of the three-tier banking system into two tiers; 
• Enabling the HKMA to exercise direct regulatory/supervisory powers over locally incorporated bank holding companies; 
• Allowing the HKMA to engage skilled persons; and
• Extending the HKMA’s enforcement powers.

Indicative timeframe

The proposals are at different stages of consultation and consideration.  A timeframe has yet to be announced.

Summary

The Hong Kong Exchanges and Clearing Limited (HKEX) launched a discussion in July 2025 on the potential benefits and challenges of shortening the current T+2 settlement cycle for secondary transactions in the cash equities market. The HKMA issued a circular in August 2025 encouraging banks to engage in early preparations, including allocating sufficient resources for the transition to an accelerated settlement cycle.

Indicative timeframe

The HKEX is considering the feedback on its discussion paper, and has stated that a transition to a shorter settlement cycle will be a 'multi-year journey'.  

When deciding the timeframe for a transition, the HKEX will consider the timing of existing initiatives in the Hong Kong market and the progress of transition in overseas markets.

Summary

There will be a new regulated activity of 'stablecoin issuance service' under the Payment Services Act 2019 and a new definition of 'stablecoin'. The Monetary Authority of Singapore (MAS) has finalised the features of its stablecoin regulatory regime and is preparing draft legislation.

Indicative timeframe

TBA

Summary

MAS is currently consulting on proposed Guidelines on AI Risk Management. It is expected that the finalised guidelines will be accompanied by an AI Risk Management Executive Handbook.

Indicative timeframe

Comments on the consultation paper are due by 31 January 2026

Summary

MAS will introduce a new regulatory framework for retail investors to invest in private market investment funds, providing the retail public with a wider set of investment choices.

Indicative timeframe

TBA

Summary

MAS has proposed to enhance investors' ability to seek civil compensation for losses suffered from market misconduct by facilitating self-organisation, providing access to funding and reducing legal barriers to civil action.

Indicative timeframe

MAS' response to the feedback to its consultation paper is expected in 2026

Summary

MAS has proposed reforms to the product classification regime, such as enhanced disclosures and simplified nomenclatures for complex products, streamlined distribution safeguards for complex products and extra protection for certain clients.

Indicative timeframe

MAS aims to finalise the proposals in 2026

Summary

Australia will pass new legislation as part of a first tranche of measures to reform the regulation of payment activities. This will  impact all entities (whether currently regulated or not) providing payment services in and into Australia.

Also, new legislation to regulate digital asset platforms  providers  and digital assets custodians will impact all entities (whether currently regulated or not) involved in custody, operating token platforms or intermediating digital assets.

Indicative timeframe

For the Payment Reforms, first tranche of legislation in 2026 with implementation likely in 2027 and a transitional period likely until 2028. A second tranche of legislation anticipated in 2026/2027.

For Digital Asset Reforms, legislation is already before the House with implementation likely in 2026 and a transitional period until 2027/2028.

Summary

This is expected to be the most significant change impacting Australian entities in 2026. 

Indicative timeframe

Reforms come into effect on 31 March 2026 for existing reporting entities (banks, insurers, asset managers, etc) and 1 July 2026 for those additional entities that FATF requires are subject to financial crime requirements (e.g. law firms, real estate agents, precious metal dealers, etc.)

Summary

The ‘Delivering Better Financial Outcomes’ (DBFO) legislative package is a set of advice reforms focused on improving access to quality and affordable financial advice. The DBFO package is highly anticipated by industry as the key measure that will establish a simpler and more viable financial advice regime, with a view to addressing the ‘advice gap’ in Australia.

Indicative timeframe

Tranche #1 was legislated in September 2024.

Tranche #2 was partially introduced for consultation in March 2025. More substantial reforms as part of Tranche #2 are expected in 2026. There is considerable industry lobbying taking place to seek to expedite this timing.

Summary

With a framework already in legislation, a draft package containing more detailed measures has just been published  and will be implemented in 2026. Banks, telcos and social media platforms are all in scope of the first wave of sectors subject to the requirements. Mandatory codes are being established for each sector together with an overarching framework for an external dispute resolution body.

Indicative timeframe

The Framework has already been law since 2024.

In 2026, we will see the delegated legislation (including the SPF Rules) and mandatory sector Codes put in place. It is expected that there will be short implementation period. 

Summary

ASIC has set out its roadmap to increase the attractiveness of public markets and lift conduct in private markets. ASIC proposes to modernise public markets including a new listing framework (a streamlined IPO process) and robust trading platforms. In private markets, ASIC seeks better tools from the government for effective supervision including a notification regime, data collection and independent audit requirements.  

Indicative timeframe

There are a variety of key milestones over the next 12 – 18 months.