A rule change is not a compliance event until you can name the controls it moves.

8 changes shown

• in-force

  European Union · published 2026-02-11 · effective 2026-07-01

  DORA — Article 26/27 threat-led penetration testing cycle, year two

  European Supervisory Authorities

  Threat-led testing scope must now be justified against the register of information rather than against the institution's own criticality assertion, and third-party participation must be evidenced by contract clause, not by intent.

  Why it matters to the estate

  Scope becomes a reconciliation exercise. An institution whose register understates critical functions now fails scope before a single test is executed.

  scope-extended

  C12Operational resilience

  • C12.01
  • C12.02

  Requirement shift

  Test scope reconciles to the register of information; every critical or important function is either in scope or carries a written exclusion approved at the accountable level.

  Evidence invalidated

  Scoping memoranda that cite management judgement without a register reconciliation attached.

  Test consequence

  Re-run on the full population of critical functions. Sampling is not available: one unscoped critical function is itself the finding.

  evidence-change

  C11Third-party and outsourcing risk

  • C11.01

  Requirement shift

  Third-party participation in testing is evidenced by an executed clause with a named obligation to participate.

  Evidence invalidated

  Vendor correspondence and side letters expressing willingness to co-operate.

  Test consequence

  Contract-level inspection across all critical providers before the next cycle opens.

• adopted

  Global · published 2026-01-20 · effective 2027-01-01

  Basel III — cryptoasset exposure standard, Group 2 treatment

  Basel Committee / national implementation

  Group 1b classification requires continuous evidence that the redemption mechanism performed under stress, not a point-in-time legal opinion at issuance.

• in-force

  United States · published 2026-03-04 · effective 2026-03-04

  SEC Item 1.05 — cyber incident materiality determination practice

  US Securities and Exchange Commission

  Staff commentary makes clear that a delayed materiality determination is itself examinable. The clock is judged from the point the institution had the facts, not from the point the committee met.

• in-force

  European Union · published 2026-02-02 · effective 2026-08-02

  EU AI Act — GPAI obligations and systemic-risk model duties

  European Commission / AI Office

  Deployers of general-purpose models in regulated financial processes must hold the model documentation, not merely rely on the provider's public statement of compliance.

• stalled

  United States · published 2026-07-01 · effective —

  US market-structure legislation (CLARITY-style)

  US Congress

  The bill did not clear before recess. Nothing became operative. The operative controls remain state charters, prudential guidance from the OCC, Federal Reserve and FDIC, and — for anything touching the EU — MiCA.

• in-force

  European Union · published 2026-01-15 · effective 2026-04-01

  NIS2 — Article 23 reporting practice and near-miss expectation

  National competent authorities (EU)

  Competent authorities are asking for the near-miss population alongside reportable incidents, and for the rule that separates the two.

• in-force

  Canada · published 2026-05-01 · effective 2027-05-01

  OSFI E-23 — model risk management, enterprise scope

  Office of the Superintendent of Financial Institutions (Canada)

  Scope extends beyond capital models to any model whose output influences a material business decision, including vendor and AI-based tools.

• consultation

  United Kingdom · published 2026-04-22 · effective —

  FCA/PRA — senior managers regime, certification streamlining

  Financial Conduct Authority / Prudential Regulation Authority

  Proposals reduce certification mechanics while preserving — and in places sharpening — the reasonable-steps evidence expected of a senior manager.