Regulatory Watch
What's coming, how mature it is,
and what it means for you
Regulatory change rarely arrives all at once. It is proposed, adopted, phased in, and only then fully felt — and its relevance shifts as each date approaches. This is a living view of the instruments that matter most for cross-border financial-crime and digital-asset work, arranged so you can see at a glance how far along each one is, who it touches, and where to go for the detail.
One rule, three readings
Many of these instruments are European in their make-up. But for a firm with clients across the EU, Switzerland and the UK, the same measure can mean three slightly different things — and sometimes the same thing. Each entry notes where that distinction bites, and points to the primary source — the EU institutions, FINMA, or the relevant authority — for the detail.
Swiss AMLA revision + Transparency Register
Revised Anti-Money Laundering Act & Transparency Act (TJPG/LETA)
In force: 1 Oct 2026
In force since 1 October 2026. The revised Anti-Money Laundering Act (AS 2026 322) brings "advisers" within the Act: those who professionally assist with real-estate purchases and sales, with forming, managing and administering non-operating legal entities, and who provide a domicile or seat for legal entities. Some provisions, including those for notaries in public employment, start later. The Transparency Act (TJPG, AS 2026 323) and its ordinance (AS 2026 364) launched a central, non-public register of beneficial owners run by the Federal Office of Justice, with filing through EasyGov. From the same date, reports to MROS must use goAML CH 2.0.2 (fedpol ordinance, AS 2026 440).
For the in-house compliance officer
Existing entities must file within one month of their first commercial-register change, and at the latest within three to six months depending on legal form and audit status — two years where every beneficial owner already appears in the commercial register; foreign legal entities have six months. Financial intermediaries' duty to report register discrepancies starts six months after commencement. Advisers newly in scope need due-diligence and organisational arrangements in place now, and suspicious-activity reporting must already run on goAML CH 2.0.2.
A Swiss measure, but groups with EU/UK arms must reconcile it with EU beneficial-ownership registers and the UK PSC regime — similar intent, different mechanics, and a sharper access contrast: the Swiss register is open to authorities and obliged entities only, not the public.
Source: Fedlex — AS 2026 322 (revised AMLA) →EU AMLA — the new supervisor
EU Authority for Anti-Money Laundering (AMLA)
Direct supervision begins: 1 Jan 2028
The EU's new central AML supervisor, operational in Frankfurt since 1 July 2025, with direct supervision beginning in 2028 under Regulation (EU) 2024/1620. Eligibility is gated: AMLA periodically assesses credit and financial institutions and groups only where they operate "in at least six Member States, including the home Member State" — and expressly "regardless of whether the activities are carried out through infrastructure on the territory concerned or remotely", so passporting in without local establishment counts. From those, it selects on risk profile up to 40 groups and entities "at least during the first selection process"; where more than 40 qualify, the tie-break is breadth — those operating in the highest number of Member States. The cohort is reviewed on a three-year cycle. Crypto-asset service providers are named in the supervised population, and AMLA also coordinates supervisors of the non-financial sector, including self-regulatory bodies.
For the in-house compliance officer
Two questions, and they are different. Will AMLA supervise you? Start with the gate, not the risk: fewer than six Member States and you are outside direct supervision altogether, however high your risk profile — and remote, passported activity counts toward the six. Above the gate, selection runs on risk, with breadth as the tie-break where more than 40 qualify. The live timetable: national supervisors collected data to 15 August 2026; a provisional list of eligible entities was expected by end-September 2026 but had not been published as at 2 October 2026; the first selection must start by 1 July 2027. And what happens if you are selected? AMLA may impose pecuniary sanctions capped at 10% of total annual turnover for the most serious breaches (or €10m for others), adjusted by the coefficients in Annex I, with any benefit derived or third-party loss added on top of that cap — plus periodic penalty payments of up to 3% of average daily turnover to compel compliance. Model both now: eligibility is being assessed this quarter, not in 2027.
The design differs sharply from the other two regimes, before any question of how it is used. The FCA fines without a statutory ceiling (FSMA s.206); AMLA fines against a turnover-proportionate cap with a published coefficient methodology; FINMA cannot fine at all and reaches the money by confiscating profit instead, with criminal fines sitting elsewhere entirely. A group operating across all three cannot carry one mental model of "supervisory penalty". Note also that AMLA’s remit reaches self-regulatory bodies — the model Switzerland runs at its core.
Source: AMLA (europa.eu) →AMLA Guidelines — ongoing monitoring
AMLA draft Guidelines on ongoing monitoring of a business relationship
Consultation closed; final guidelines awaited: 3 Sep 2026
Draft Guidelines under Article 26(5) of Regulation (EU) 2024/1624, in three parts: cross-sectoral general principles, keeping customer information up to date, and monitoring transactions and activity to detect the unusual or suspicious. Consultation opened 3 June 2026 and the public hearing was held on 2 July 2026; the consultation closed on 3 September 2026 at 23:59 CEST and AMLA's page now records it as closed, with results to follow and no date announced for the final guidelines.
For the in-house compliance officer
This will set the EU baseline for trigger events, refresh cycles and the calibration of monitoring scenarios. Compare your periodic-review and event-driven refresh policy against the draft and respond where a trigger is unworkable in practice. The window has now shut, as have the other two consultations in this set (20 and 27 September 2026); AMLA has published no final text or date for any of them as at 2 October 2026.
EU obliged entities are the addressees. UK firms run the JMLSG expectation and Swiss firms the AMLO-FINMA duty over the same relationships — the substance converges, the evidence each supervisor expects to see does not.
Source: AMLA — consultation page →AMLA ITS — the EU-wide SAR template
AMLA draft implementing technical standards on the format for reporting suspicions and providing transaction records
Consultation closed; final ITS awaited: 20 Sep 2026
Draft ITS under Article 69(3) of Regulation (EU) 2024/1624 setting a single EU-wide template for reporting suspicions, differentiated by category of obliged entity, together with a standard format for credit and financial institutions to provide transaction records to FIUs. Consultation opened 2 July 2026, held its public hearing on 9 September 2026 and closed on 20 September 2026; no final text or date announced as at 2 October 2026.
For the in-house compliance officer
Model the field-level requirements against your current SAR workflow now. The templates are drafted so a firm can automate submission from its own case-management system rather than rekeying into an FIU portal — but only where the data already sits in the right fields. Retrofitting reporting data after the standards are final is materially harder than shaping it now.
Bites on EU obliged entities when the AML Regulation applies from 10 July 2027. A group with UK and Swiss arms will hold one suspicion and file it three ways — this format, the NCA's SAR regime, and MROS reporting.
Source: AMLA — consultation page →AMLA RTS — risk scoring outside the financial sector
AMLA draft regulatory technical standards on the inherent and residual risk profile of obliged entities in the non-financial sector
Consultation closed; final RTS awaited: 27 Sep 2026
Draft RTS under Article 40(2) of Directive (EU) 2024/1640 setting the harmonised methodology supervisors will use to assess and classify the ML/TF risk profile of non-financial obliged entities, with the data points those entities must report to feed the assessment. Consultation opened 13 July 2026, held its public hearing on 10 September 2026 and closed on 27 September 2026; no final text or date announced as at 2 October 2026.
For the in-house compliance officer
Lawyers, accountants, trust and company service providers, estate agents and high-value dealers are the direct addressees: the resulting score will drive supervisory intensity and inspection frequency. Read the data-point annexes first — they decide what you will be reporting every year — and answer the proportionality questions if the burden does not scale to your size.
The EU is standardising risk scoring for precisely the professions the UK is moving under FCA supervision and Switzerland supervises through SRO affiliation. Same population, three supervisory designs, diverging further.
Source: AMLA — consultation page →AMLA final draft RTS — CDD and group-wide rules
AMLA final draft RTS on customer due diligence, business relationships and thresholds, and group-wide requirements
Final drafts sent to the Commission: 1 Oct 2026
On 1 October 2026 AMLA sent the Commission three sets of final draft regulatory technical standards under the AML Regulation: customer due diligence (Art 28(1) — what to collect and verify, simplified measures, non-face-to-face and electronic-identification verification, screening of politically exposed persons and their family and close associates); business relationships, occasional and linked transactions and lower thresholds (Art 19(9)); and group-wide minimum requirements, including third-country branches and subsidiaries (Arts 16(4) and 17(3)). These are final drafts, not law: they bind no one until the Commission adopts them and they are published in the Official Journal.
For the in-house compliance officer
This is the operational core of the EU single rulebook. AMLA proposes that the standards apply six months after entry into force (from 10 July 2029 for football agents and clubs) and gives no adoption date. Map your CDD procedures, PEP screening and group policies against the final drafts now; the Commission may still amend them.
EU obliged entities are the addressees. Swiss and UK groups with EU subsidiaries will apply these through the group-wide standards — which reach their third-country branches and subsidiaries too.
Source: AMLA — press release, 1 Oct 2026 →EU AMLR — the single rulebook
EU Anti-Money Laundering Regulation (single rulebook)
Most provisions apply: 10 Jul 2027
A directly-applicable single rulebook harmonising customer due diligence, beneficial ownership and reporting across member states, replacing much of the patchwork left by successive directives.
For the in-house compliance officer
Plan for a single, directly-applicable standard from July 2027 — uniform CDD methods, verification and ongoing monitoring set out in binding technical standards, reducing (but not removing) national variation.
EU-wide by design; CH/UK firms serving EU clients will need to meet it for that book of business even where home rules differ.
Source: EUR-Lex — Regulation (EU) 2024/1624 →MiCA — crypto-asset framework
Markets in Crypto-Assets Regulation (MiCA)
Transition window closed: 1 Jul 2026
The EU's comprehensive regime for crypto-asset service providers and token issuers. The last national transitional regimes closed on 1 July 2026: a provider without MiCA authorisation may no longer serve EU clients, and reverse solicitation is the only — narrow, closely-scrutinised — residual route.
For the in-house compliance officer
The cliff has passed. Verify your own and your counterparties' authorisation against the ESMA register; wind down any EU book still running on a lapsed national regime; document why any remaining EU-client contact is genuine reverse solicitation. Expect early enforcement to target exactly these two gaps.
An EU passport regime: CH-based providers reach EU clients only via an EU-authorised entity; UK firms face a separate domestic perimeter.
Source: ESMA →DORA — operational resilience
Digital Operational Resilience Act (DORA)
Applies: 17 Jan 2025
EU framework for ICT risk management, incident reporting and oversight of critical third-party providers across the financial sector — applicable since January 2025.
For the in-house compliance officer
Treat as live: ICT risk registers, incident-reporting pathways and third-party (including cloud) oversight must be operational. Relevant to any platform handling regulated data, including evidence and case material.
EU-anchored, but its third-party oversight reaches CH/UK vendors serving EU financial entities.
Source: EU / ESAs →EU AI Act — high-risk regime
EU AI Act — high-risk obligations
High-risk (Annex III) obligations apply: 2 Dec 2027
Obligations for high-risk AI systems — capturing AI used in credit scoring, KYC and agentic tools in finance. The deferral is now settled law, not a proposal: Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI) was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, moving the application of Chapter III, Sections 1-3 from 2 August 2026 to 2 December 2027 for stand-alone Annex III systems and to 2 August 2028 for AI embedded in products already covered by EU product-safety law (Annex I).
For the in-house compliance officer
Inventory AI used in compliance and onboarding and have conformity-assessment and transparency workstreams running to the confirmed dates: 2 December 2027 for stand-alone Annex III systems, 2 August 2028 for product-embedded ones. The deferral buys time, it does not narrow scope — and the general-purpose AI obligations already in application are unaffected by it. Reconcile with GDPR/FADP throughout.
EU product-safety logic: CH/UK developers placing AI on the EU market are caught; purely domestic use may not be.
Source: Regulation (EU) 2026/1744 — Digital Omnibus on AI (EUR-Lex) →FINMA Guidance 01/2026 — crypto custody
FINMA Guidance 01/2026 — custody of crypto-based assets
Published: 12 Jan 2026
FINMA's guidance resetting supervisory expectations on the custody of crypto-based assets — segregation, bankruptcy remoteness and client-asset protection.
For the in-house compliance officer
Custodians should translate the guidance into concrete segregation policies, custody agreements and bankruptcy-remoteness analysis, and be ready to defend them to the regulator and banking counterparties.
Swiss-specific, but informs how CH custodians service EU/UK institutional clients with their own custody expectations.
Source: FINMA — Guidance 01/2026 →UK crypto regime — FSMA authorisation
UK cryptoasset regime — full FSMA authorisation
Crypto activities fully within FSMA: 25 Oct 2027
The FCA's final cryptoasset regime (published 30 June 2026) brings crypto activities fully within FSMA. AML-only registration ends: every UK-facing crypto firm needs full authorisation. A joint FCA–Bank of England approach covers systemic stablecoin issuers.
For the in-house compliance officer
The application window opened on 30 September 2026 and closes on 28 February 2027; the final perimeter guidance (PS26/18) was published on 16 September 2026. MLR registrations do not convert: firms that apply within the window may keep operating while their application is decided. The application is a full authorisation — governance, prudential and conduct standards, not just AML controls.
A separate perimeter from MiCA: authorisation in one bloc gives no rights in the other. Firms serving both markets run two applications and two rulebooks.
Source: FCA — gateway opens, 30 Sep 2026 →UK MLRs — 2026 amendment (SI 2026/621)
Money Laundering and Terrorist Financing (Amendment) Regulations 2026
In force: 30 Jun 2026
Recasts the UK MLRs: enhanced due diligence narrowed from all 'complex' to 'unusually complex' transactions, automatic EDD confined to FATF Call-for-Action countries, euro thresholds converted to sterling, and trust registration extended to certain non-UK trusts holding UK land. Most provisions applied from 30 June 2026; enhanced due diligence on cryptoasset correspondent relationships (new reg. 34A) commences on 1 February 2027, and the change-in-control regime for registered cryptoasset businesses on 25 October 2027 (reg. 1(4)).
For the in-house compliance officer
Re-paper risk assessments and CDD policies against the new EDD triggers and thresholds; trustees of non-UK trusts holding UK land acquired before October 2020 face new registration duties.
Loosens the UK's EDD triggers just as the EU's AMLR tightens toward a single rulebook — cross-border groups now manage a wider EU/UK delta, and Swiss firms serving both face three sets of triggers.
Source: legislation.gov.uk — SI 2026/621 →ECCTA — failure to prevent fraud
ECCTA — failure to prevent fraud offence
Offence in force: 1 Sep 2025
The Economic Crime and Corporate Transparency Act 2023's corporate offence: a large organisation is criminally liable where an associated person commits fraud for its benefit and it lacked reasonable fraud-prevention procedures. No knowledge by management is required.
For the in-house compliance officer
Large organisations (two of: 250+ employees, £36m+ turnover, £18m+ assets) need documented fraud-prevention procedures mapped to the government guidance — risk assessment, proportionate controls, training, monitoring. The reasonable-procedures defence is only as good as its paper trail.
Reaches non-UK organisations where the fraud has a UK nexus; EU and Swiss groups with UK business should treat it as in scope.
Source: GOV.UK guidance →UK SPSS reform — FCA takes over AML supervision
UK AML supervision reform — FCA as single professional-services supervisor
First firms move to the FCA (government timetable): End 2028
HM Treasury decided in October 2025 that the FCA will become the single AML/CTF supervisor for legal and accountancy service providers and trust and company service providers — around 60,000 firms, moving from 22 professional body supervisors to one. Individual practitioners are expressly in scope, barristers included. The June 2026 response settled the powers: the FCA will rely on the existing Part 9 MLR toolkit rather than bespoke ones — financial penalties, public censure, prohibitions on senior managers or removal of authorisation, and criminal proceedings in serious cases. OPBAS ceases to exist once the transfer completes; until then OPBAS continues and the professional bodies keep their responsibilities. Treasury states implementation "will inevitably take several years". In the House of Lords on 7 September 2026, during the Financial Services and Markets Bill's Report stage, the government gave a timetable: the first FCA-supervised firms before the end of 2028, and all in-scope firms by mid-2030.
For the in-house compliance officer
The change is the supervisor's enforcement scale and publication habit, not the underlying obligations — the MLRs stay the MLRs. A professional body fines in the hundreds and thousands; the FCA publishes a Final Notice setting out findings of fact, and fines on a different order. Firms carrying AML weaknesses today are carrying them toward a regulator that documents them in public. Note what the SRA's own current enforcement already shows about the population being handed over: 935 proactive engagements in the latest period against 545 before, 833 firms inspected or desk-reviewed, and a third of firms non-compliant with 54% only partially compliant.
Moves the UK toward a concentrated supervision model as the EU centralises under AMLA — while Switzerland keeps SRO delegation. Three models, drifting further apart. The UK's is the only one of the three that moves an entire profession from self-regulation to a financial-services regulator.
Source: HM Treasury — decision (Oct 2025) and powers response (Jun 2026) →Berne Agreement — UK–Swiss mutual recognition
Berne Financial Services Agreement (UK–Switzerland)
In force: 1 Jan 2026
A UK–Swiss treaty recognising each other's regulation as delivering equivalent outcomes across five wholesale sectors, including banking and investment services. Firms serve the other market under their home rules and home supervisor — regulator deference by treaty.
For the in-house compliance officer
Check eligibility first: the corridor covers wholesale and sophisticated clients only, sector by sector. Map which services ride on the Agreement, follow the notification routes, and hold a contingency plan — the treaty has its own suspension and termination machinery.
The direct London–Zurich rail. FINMA and the FCA/Bank of England operate it through cooperation arrangements; it is treaty-based and mutual, unlike unilateral EU equivalence decisions.
Source: GOV.UK — treaty text →Looking for the long-form analysis? The worked pieces live with the dossiers, alongside the reports available on request.
Working on a cross-border matter where one of these applies?
Start a conversation