Regulatory Horizon Tracker

CP26/38: Financial Crime Guide updates

The FCA is consulting on updates to its Financial Crime Guide, including the use and oversight of AI-enabled and third-party financial crime systems and controls. These are proposals, not final requirements. Firms should consider whether they can evidence the effectiveness of automated detection and screening, understand limitations and false negatives, challenge providers, and maintain appropriate human oversight, management information and accountability.

AI and TPRM connections: Model validation and ongoing effectiveness testing; third-party due diligence and oversight; data and model dependencies; explainability, provider challenge and operational resilience. The AI tool may support a control without constituting the entire control framework.

CP170: proposed operational resilience framework

DFSA proposals address identification of critical business services, impact tolerances, resource and third-party dependency mapping, severe-but-plausible scenario testing and disruption notifications. Track final rules and implementation dates; consultation proposals are not yet final obligations.

Operational Risk Management Regulation C 1/2026

Effective requirements for licensed financial institutions covering operational risk and resilience, critical operations, dependency mapping including intragroup and external third parties, incident response, continuity and recovery. Firms should assess compliance and ongoing assurance.

Operational Risk Management and Cyber Security (Rulebook OM)

Monitor changes to the CBB Operational Risk Management module, including cybersecurity governance, risk tolerance, incident management, third-party security and cyber resilience. No new 2026 implementation deadline is asserted.

Operational Risk Management RTS under CRR3

Draft standards on the operational risk management framework, including governance, assessment and control. Review consultation proposals and potential implications for ORM methodology.

Operational incident reporting and material third-party reporting

Implement incident materiality assessment, escalation and regulatory reporting; material third-party notifications, register data and governance. Confirm entity-specific applicability and first reporting obligations.

Final Guidelines on Third-Party Risk Management

Guidance addressing non-ICT third-party arrangements alongside the DORA framework. Review lifecycle controls, materiality, registers and governance; verify formal application and transition dates.

Operational risk and third-party risk guidance

Track MAS proposals and subsequent final guidance on operational risk and third-party arrangements; do not treat consultation material as final requirements.

Technology risk management requirements

Monitor changes concerning IT asset management, technology risk assessment, change management, backups and recovery.

Digital Operational Resilience Act (DORA)

Monitor ICT incident reporting, digital operational resilience testing, ICT third-party oversight and supervisory clarification. DORA is already applicable, not a future go-live.

Internal governance and risk culture guidance

Monitor EBA publications for relevant changes to governance, culture, accountability and control expectations. No unverified deadline is asserted.

Selected international operational risk, cyber, AI and TPRM developments

Curated monitoring of material supervisory publications only; future dated entries will be added after primary-source verification.