Regulatory alerts for the quarter
We have an ongoing regulatory watch systemManagement Solutions compiles new regulations published by regulators of the financial services industry on a global level (BCBS, FSB), a supranational one (with a focus on Europe), and on some local geographies (USA, UK and Spain).
Relevant publications
ESMA · Annual Work Programme for 2027
09/28 · Emerging Regulation
The European Securities and Markets Authority (ESMA) has published its Annual Work Programme for 2027, in which it sets out its key regulatory and supervisory priorities for the coming year, focusing on capital market integration, regulatory simplification, strengthened supervision, and the use of data and technology. Among its priorities, ESMA will make progress in the supervision of consolidated tape providers, external auditors of European green bonds and providers of environmental, social and governance (ESG) ratings, as well as adapting its activities to its new powers regarding benchmark index administrators. It will also continue, alongside the other ESAs, to supervise critical ICT service providers under the Digital Operational Resilience Act (DORA) and will strengthen supervisory convergence regarding crypto-asset service providers under the Markets in Crypto-Assets Regulation (MiCA). In 2027, it will also review the impact of the European Market Infrastructure Regulation (EMIR) 3, support the implementation of the European Single Access Point (ESAP) and the transition to T+1, and make progress on its four simplification initiatives concerning trade reporting, fund reporting, the retail investor experience and risk-based supervision. In terms of technology, ESMA will continue to develop its data platform, incorporate artificial intelligence tools into supervision, and maintain crypto-assets, AI and tokenisation as priorities. (more detail)
EBA · Final technical package of its Pillar 3 reporting and disclosure framework
10/12 · Sustainability
The European Banking Authority (EBA) has published Phase 1 of the final Technical Package 4.4 of its Pillar 3 reporting and disclosure framework. The aim is to enable institutions to prepare in advance for the new requirements under International Financial Reporting Standard (IFRS) 18, Pillar 3 environmental, social and governance (ESG) disclosures and other technical adjustments, thereby reducing implementation costs and facilitating compliance. The package includes the Data Point Model (DPM), validation rules and XBRL taxonomies. Key changes include new financial reporting templates (FINREP) aligned with IFRS 18; updated disclosures on ESG risks, equity exposures and shadow banking; adjustments linked to the Fundamental Review of the Trading Book (FRTB); corrections to resolution reporting and the minimum requirements for own funds and eligible liabilities (MREL); liquidity reporting for third-country branches; and templates for future supervision by the European Anti-Money Laundering Authority (AMLA). As regards implementation dates, the first reference dates will be 31 December 2026 for various Pillar 3 disclosures, resolution, MREL and AMLA reporting; 31 March 2027 for FINREP aligned with IFRS 18 and certain FRTB disclosures; and 31 December 2027 for certain disclosures by small, non-complex entities.Furthermore, Phase 2 of Package 4.4 is scheduled for early 2027 and will incorporate the most extensive simplification of supervisory reporting. (more detail)
ESAs · Joint Work Programme for 2027
10/13 · Emerging regulation
The Joint Committee of the European Supervisory Authorities (ESAs) has published its Work Programme for 2027, which sets out common supervisory priorities to address cross-cutting risks in the European financial sector. The aim is to strengthen supervisory coordination, financial stability and consumer protection. Key priorities include digital operational resilience, including the supervision of critical third-party information and communication technology (ICT) providers under the Digital Operational Resilience Act (DORA); monitoring artificial intelligence (AI) and other digital innovations; the consistent application of the sustainable finance framework; securitisation; the monitoring of cross-sectoral risks; and the protection of retail consumers. The programme will also support the regulatory simplification agenda and the objectives of the Savings and Investment Union. (more detail)
Other publications of interest (financial sector)
Spain - Ministry of Finance · Order on the technical requirements of the public electronic invoicing solution
10/05 · Regulatory compliance
The Ministry of Finance has published Order HAC/1028/2026, which regulates the technical and functional elements of the public electronic invoicing solution managed by the Spanish Tax Agency (AEAT) and completes the implementation framework for mandatory electronic invoicing between businesses and professionals established by Royal Decree 238/2026. The Order sets out the semantic model and invoice syntax, which must comply with the EN 16931 standard using UBL, as well as the procedures for issuing, interconnecting, validating, consulting and retrieving electronic invoices. It also specifies the obligation for private invoicing platforms to simultaneously submit a faithful electronic copy of invoices to the public solution, establishes a unique invoice identification code based on the issuer's tax identification number, series, invoice number and issue date, and regulates the electronic communication of invoice statuses, including rejection, payment, collection and non-payment. In addition, it develops the mechanisms for interoperability between the public solution and private platforms, consultation and download services, authentication and representation arrangements, and applicable data protection and security requirements. The entry into force of the Order triggers the calculation of the deadlines for the effective application of mandatory B2B electronic invoicing. The Royal Decree takes effect on October 28, 2026, although it establishes specific transition periods for certain obligations. (more detail)
Brazil - BCB · Resolution establishing a Consolidated Debt Dashboard and strengthening responsible lending requirements
10/23 · Credit
The Central Bank of Brazil (BCB) has published BCB Resolution No. 601/2026, requiring the implementation of a Consolidated Debt Dashboard for individual customers and strengthening requirements for assessing credit suitability and borrowers' repayment capacity. The objective of the Resolution is to prevent over-indebtedness, promote responsible lending practices and improve the transparency of information provided to customers. The Resolution establishes: i) the obligation to provide customers with a dashboard consolidating their financial obligations, including outstanding balances, payment due dates and debt trends; ii) mandatory simulations before new credit agreements are concluded and automated warnings when credit is unsuitable or monthly repayment capacity utilisation reaches 40%; iii) the progressive integration of information from the Credit Information System (SCR) and Open Finance, together with record-keeping, internal control and accountability requirements. Institutions will have 180 days from official publication to adapt their systems and procedures, while the main provisions will enter into force on 1 July 2027, followed by a subsequent phase incorporating external credit information. (more detail)
Chile - CMF · Public consultation on a regulatory proposal introducing new methodologies for calculating risk-weighted assets for savings and credit cooperatives
10/16 · Risk and capital
The Chilean Financial Market Commission (CMF) has launched a public consultation on a regulatory proposal introducing new methodologies for calculating risk-weighted assets (RWAs) for savings and credit cooperatives and updating the provisions governing their effective equity. The objective of the proposal is to strengthen the solvency and resilience of the cooperative sector by establishing more risk-sensitive capital requirements tailored to the characteristics of these institutions. The proposal establishes: i) the introduction of a new Chapter CAC-20 setting out standardised methodologies for calculating credit, market and operational RWAs; ii) amendments to Chapter CAC-3 updating the recognition criteria, eligibility requirements, limits and deductions applicable to effective equity components in accordance with the existing prudential framework; iii) the repeal of the remaining provisions of Circular No. 108 and transitional arrangements for adapting RWA calculations to the new methodologies. The public consultation will remain open for four weeks from 16 October 2026, and the proposed provisions are scheduled to enter into force on 1 January 2028. (more detail)
Peru - SBS · Draft legislation amending the capital requirement for counterparty credit risk
09/29 · Credit · Risk and Capital
The Superintendency of Banking, Insurance, and Private Pension Fund Administrators (SBS) has pre-published a draft resolution amending the Regulations on Capital Requirements for Credit Risk, in order to incorporate a new methodology for calculating counterparty credit risk. The draft introduces the standard approach for counterparty credit risk (SA-CCR), applicable to exposures arising from derivative financial instruments, long-term settlement transactions, and other transactions subject to counterparty credit risk. This method would replace the current treatment with a more risk-sensitive measurement that takes into account the replacement value of the transaction, potential future exposure, the existence of margins, collateral, netting agreements, and the type of underlying asset of the contract. In addition, the draft incorporates specific treatment for exposures to central counterparties, including netted transactions, margins posted, collateral, and contributions to default funds. It also defines when a central counterparty may be considered eligible and how the effective capital requirements associated with those exposures should be calculated. The proposal is part of the alignment of the Peruvian framework with Basel III standards and will primarily affect institutions engaged in derivatives, repos, deferred settlements, or exposures to clearing houses. The comment period is open through December 28, 2026, and the draft is scheduled to take effect on January 1, 2027. (more detail)
Perú - SBS · Draft General Regulations for the Open Finance System
10/05 · Architecture, infrastructure and solutions
The Superintendency of Banking, Insurance and Private Pension Fund Administrators (SBS) has published the draft General Regulations for the Open Finance System (SFA) for public consultation, , which includes only Titles I through IV, with the aim of laying the foundations for the standardised and secure exchange of financial data, under the user’s control and with their consent. The proposal defines the scope of the system, the participants and their roles, the registration and authorisation mechanisms, the rules governing data access and consent management, and the governance of the SFA. In the first phase, priority will be given to the exchange of information on savings and current accounts from 1 January 2028 and on credit cards from 1 July 2028, with a gradual extension to other products. The project also provides for a phased roll-out: certain processes relating to registration, authorisation and access to the test environment will begin on 1 August 2027, whilst the General Regulation will, in general, come into force on 1 January 2028. Rules on digital infrastructure, the trust framework, security and quality, cost recovery, incidents, supervision and sanctions are still to be developed. The public consultation is open until 23 October 2026. (more detail)
Singapur - MAS · Guidelines on Artificial Intelligence Risk Management for Financial Institutions
10/07 · Artificial Intelligence
The Monetary Authority of Singapore (MAS) has published its Guidelines on Artificial Intelligence (AI) Risk Management for Financial Institutions, which apply to all financial institutions and all forms of AI, including generative AI and AI agents. The aim is to set out supervisory expectations for identifying, assessing and managing risks arising from the use of AI in a proportionate manner, complementing existing requirements and the FEAT principles of fairness, ethics, accountability and transparency. Key changes include the requirement for institutions to define responsibilities and risk appetite, maintain an inventory of use cases, assess their materiality, and implement controls throughout the entire lifecycle covering data, models, testing, explainability, human oversight, cybersecurity, incidents, changes and decommissioning. The guidelines also reinforce accountability for AI solutions provided by third parties and the need for adequate staff, resources and capabilities. The guidelines will come into force on 7 October 2027 for supervisory expectations, systems, policies and procedures, and on 7 October 2028 for lifecycle controls, capabilities and resources. As a next step, the MAS plans to consult the sector in 2027 on possible additional guidance for AI agents. (more detail)
Other publications of interest (insurance sector)
Portugal - ASF · Regulatory standard on reporting obligations concerning digital operational resilience
10/20 · Regulatory Compliance
The Portuguese Insurance and Pension Funds Supervisory Authority (ASF) has published Regulatory Standard No. 6/2026-R, amending reporting obligations for insurance and reinsurance undertakings, pension fund management companies and certain insurance intermediaries concerning digital operational resilience. The objective of the regulation is to develop reporting requirements to the ASF arising from the application of the EU Digital Operational Resilience Act (DORA), strengthening the supervision of technology-related risks while simplifying certain existing reporting obligations. The regulation establishes: i) new reporting requirements concerning contractual arrangements with third-party information and communication technology (ICT) service providers, major ICT-related incidents, significant cyber threats and ICT risk management; ii) an obligation to report participation in cyberattack information-sharing arrangements; iii) a reduction in the frequency of cyber incident reporting from monthly to quarterly, the removal of certain variables concerning their economic impact and the repeal of previous provisions to avoid regulatory duplication. This periodic reporting does not replace the reporting of major incidents required under DORA. The regulation entered into force on 29 October 2026, except for reporting obligations concerning planned ICT service arrangements supporting critical or important functions and changes in the classification of such functions, which will apply from 27 November 2026. (more detail)
Colombia - SFC · External Circular updating the Single Financial Information Catalogue for supervisory purposes
10/23 · Financial reporting
The Financial Superintendence of Colombia (SFC) has published External Circular No. 010/2026, amending the Single Financial Information Catalogue for Supervisory Purposes (CUIF) to expand its structure and align it with International Financial Reporting Standards (IFRS) and prudential requirements applicable to supervised entities. The objective of the Circular is to improve the recognition, classification, presentation and reporting of financial information, facilitating the incorporation of changes arising from IFRS 17 on insurance contracts and the technical provisions framework. The Circular establishes: i) the expansion of the CUIF structure from 6 to 10 digits and the introduction, deletion and modification of accounting codes; ii) the obligation to submit implementation plans including schedules, responsible persons and assessments of technological and operational impacts, together with quarterly progress reports; iii) differentiated transitional arrangements for insurers and other supervised entities, including testing periods and the possibility of early implementation. The Circular entered into force upon publication and sets deadlines of 16 December 2026 for insurers and 1 June 2027 for other supervised entities to submit implementation plans, while the new codes will become mandatory from 1 January 2028 for insurers and no later than 1 January 2031 for other supervised entities. (more detail)
Regulatory news from previous periods or FYs can be found in the Quarterly Regulatory Reports, section for current year reports, or the Annual Regulatory Reports section for previous year reports.
