On September 8, 2026, Colombia's SIC opened a public consultation on identity verification mechanisms, implementing Law 2573 of 2026 to curb identity theft in credit and telecom onboarding.
Rwanda's data authority continues to enforce mandatory registration for controllers and processors, with fines up to RWF 5 million or 1 percent of turnover for operating without a DPP certificate.
On 7 July 2026 the Gambling Commission confirmed it will introduce financial risk assessments in stages after its pilot found around 97 percent of checks could run frictionlessly on public data.
The 19 critical ICT third-party providers designated under DORA now face direct ESA oversight, with joint examination teams assessing resilience against a December 2025 reference date.
A FinCEN final rule effective August 14, 2026 permanently removes Corporate Transparency Act beneficial-ownership reporting for US companies and US persons, and deletes previously filed US-person data.
From October 30, 2026, Brazil's central bank prohibits supervised institutions from dealing with unauthorised VASPs. Resolutions 519, 520, and 521 turn Lei 14.478 into a live licensing regime.
A 2026 Bank of Ghana Supervisory Guidance Note mandates the Ghana Card as the only identification document for onboarding, with biometric verification against the national register.
The Transfer of Funds Regulation applies to every crypto transfer with no minimum threshold, and supervisors have named Travel Rule implementation an examination priority for 2026.
Ofcom's first statutory age assurance report found checks working at scale but the job unfinished, citing 23 open investigations into 88 adult services and gaps that let children reach non-compliant sites.
Connecticut's SB 1295 amendments to the CTDPA take effect July 1, 2026, banning targeted advertising and data sales for under-18s, lowering the applicability threshold, and expanding sensitive-data protections.
On August 1, 2026, Chapter VIII of SBS Resolution 02648-2024 takes effect, binding Peruvian VASPs to the FATF Travel Rule and full AML/CFT registration with the UIF-Perú.
Kenya's Virtual Asset Service Providers Regulations, 2026 were gazetted on 22 July 2026, operationalising the 2025 Act. Existing providers have until 4 November 2026 to obtain a licence.
On 14 July 2026 OfDIA published its first annual report under the Data (Use and Access) Act 2025, with the DVS register listing 46 providers offering 64 certified digital verification services.
As of April 1, 2026, factoring, financing and leasing, and cheque-cashing businesses in Canada are past their transition period and fully bound by PCMLTFA AML obligations.
The Commission's white-label age-verification app is technically ready, with front-runner member states piloting it. Together with the DSA Article 28 minors guidelines, the reasonable bar for age assurance is now defined.
Registered virtual-asset providers in Argentina must file their first audited or accountant-certified annual reports in 2026 under CNV RG 1058, converting the PSAV registry from a formality into a supervised regime.
By 31 March 2026 the FSCA had received 533 crypto-asset licence applications, approving 310 and declining 17. The regulator is now shifting from onboarding to enforcement.
On 30 June 2026 the FCA published five policy statements setting final rules for stablecoin issuance, custody, market conduct, and prudential requirements ahead of the regime's 25 October 2027 start.
The European Parliament has endorsed the Digital Omnibus, pushing high-risk AI Act obligations back by more than a year. Final Council approval follows within days.
The Fifth Circuit stayed the injunction blocking Texas SB 2420, and the App Store Accountability Act took effect June 4, 2026. App stores must now verify age and secure parental consent.
The CMF amended its Open Finance rule on June 1, 2026, adding Annex 3 and a developer portal. The specs harden how banks and fintechs will share data under the Fintech Act.
Nigeria's data regulator extended its 2025 audit-return filing deadline to 30 May 2026. With the window now closed, late filers face penalties under the GAID and the Data Protection Act 2023.
Companies House identity verification under ECCTA is now compulsory for new appointments, with an estimated 6 to 7 million existing directors and PSCs facing an 18 November 2026 deadline.
AMLA's consultation on the harmonised customer due diligence standards for the EU's single AML rulebook has closed. Final drafts go to the Commission by July, with the AMLR applying from July 2027.
FinCEN has finalized a two-year delay of the investment adviser AML rule, moving the compliance date from January 1, 2026 to January 1, 2028 while it retailors the requirements.
FATF's March 3, 2026 report finds stablecoins account for 84% of illicit virtual asset volume. Secondary market monitoring is now in scope for issuers.
ESMA confirmed April 17 the MiCA transitional period ends July 1, 2026. Operating in EU markets without authorization after that date is a breach of EU law.
Meta announced bone-structure-based AI age inference May 5. Live in Brazil, the EU, and the US. Expansion to UK and EU Facebook in June.
EU Member States must offer at least one EU Digital Identity Wallet by December 2026 under eIDAS 2.0. Private-sector acceptance follows in December 2027.
Senators Tillis and Alsobrooks released the CLARITY Act stablecoin yield text on May 1. Passive yield is banned. Activity-based rewards survive. Markup is next.
August 2, 2026 is the EU AI Act compliance date for high-risk financial AI systems. Conformity assessment, CE marking, and EU database registration must be done.
The UK's failure to prevent fraud corporate offence under the ECCTA has been in force for six months. The SFO has opened its first investigations under the offence.
Brazil's Digital Statute for Children and Adolescents enters Phase 2 enforcement this week. Platforms serving Brazilian minors must implement age assurance.
The SEC's April 13 no-action statement on broker-dealer registration for cryptoasset wallet interface providers is now operational at the two-week mark. Custodial interfaces remain excluded.
April 24 marks the midpoint of the 60-day FinCEN and OFAC NPRM comment window for stablecoin issuers under the GENIUS Act. Forty-five days remain.
Coinbase, Ripple, Circle, and 100+ more just told the Senate: mark up the CLARITY Act or lose the industry.
Congress is finally writing federal data privacy rules for financial services — two bills, two committees, one push.
Four bills moved out of committee today — including one aimed directly at China's currency manipulation.
The FCA showed up in person. Multiple locations. Illegal crypto trading busted across London.
The FCA wants firms to clean up their Appointed Representative registers — inactive ARs are a compliance risk.
MiCA isn't even fully enforced yet and the EU is already drafting the sequel.
The next Fed Chair goes before the Senate. Jerome Powell's term expires May 15.
The honor system for crypto tax reporting is over. The IRS can now see your cost basis.
FinCEN wants to know if your AML program works — not just if it exists.
If you build a crypto wallet or trading interface, the SEC just told you when you don't need a broker-dealer license.
The CFTC's top regulator told Congress he has zero tolerance for fraud in crypto — and he needs more people to enforce it.
California's crypto licensing law is final. The compliance deadline is 77 days away.
The stablecoin yield deadlock that stalled crypto legislation for a year is resolved.
Stablecoin issuers will face the same AML/sanctions rules as banks. No lighter-touch alternative.
The OCC removed the last textual ambiguity about what crypto trust banks can do.
Japan just put crypto in the same legal category as stocks and bonds.
The FDIC is building the rulebook for how banks can issue stablecoins.
The SEC's dedicated crypto regulation is one step from publication.
A new class of financial advice goes live in the UK — lighter than full advice, heavier than guidance.
The biggest US banks just got more room to trade Treasuries.
South Korea's largest crypto exchange failed to verify millions of users. The penalty matched the scale.
The FATF wants regulators to stop playing whack-a-mole with offshore crypto operators.
The EU's new AML super-regulator is picking its first 40 targets. You might be one of them.
Bitcoin, Ethereum, Solana, XRP, and 12 others are now commodities — not securities.
Brazil now requires biometric age verification for platforms serving children. Self-declaration is dead.
The US will not be issuing a digital dollar. The Senate made it official.
The UK government is spending a quarter billion pounds to fight fraud. Identity verification is at the center.
Small and mid-sized EU banks get better access to resolution safety nets.
The SEC and CFTC formally agreed to stop fighting over who regulates crypto.
A crypto company now has direct access to the Federal Reserve's payment system.