In brief: Supervisors spent this fortnight fitting requirements to the size and shape of the firm, and publishing clearer routes from proposal to practice. This edition covers how proportionate rules make relevance the thing that matters most, how joined-up supervision rewards a joined-up view across jurisdictions, and why following a rule from consultation through to guidance gives teams time and choices. This edition covers 3 – 16 October 2026.
The CUBE Read is CUBE’s fortnightly take on regulatory change in financial services and what it means for compliance and risk teams.
Proportionality is arriving. Relevance keeps compliance and risk teams ahead.
Supervisors spent the fortnight fitting requirements to the size and shape of the firm. The EBA has proposed cutting the data points in EU bank reporting by around 50%, while keeping a single regime for all banks with simpler rules for small and non-complex institutions. The ECB proposed a higher threshold for small banks and less frequent supervisory reviews. AMLA, the EU’s anti-money laundering authority, submitted final draft standards for the private sector to the European Commission, with proportionate due diligence for lower-risk situations alongside conditions on remote verification.
The same direction runs through the 2027 plans. The European Supervisory Authorities are planning DORA oversight and PRIIPs KID simplification under the EU’s simplification agenda, alongside a special focus on AI and digital-asset tokens. EIOPA consulted on outcomes-focused supervision of insurance investment product sales without adding new requirements.
For compliance and risk teams, the starting question is relevance: which developments apply to their firm, their category and their business lines. Firms in focused lending and insurance categories, and across financial services more widely, should look to move from spreadsheet tracking toward structured, profile-based coverage.
What it means for compliance and risk professionals: When requirements are scaled to the firm, the value sits in knowing where your firm lands. A new threshold, a reduced reporting scope or a proportionate due diligence standard matters most to the firms it reaches, and teams who see that early can plan with confidence. Intelligence matched to your profile, with expert interpretation, frees your teams to act on the changes that reach them.
Supervision is joining up. A joined-up view keeps your teams in step.
Cross-border coordination moved from principle to mechanism. AMLA proposed information sharing without prior consent in EU cross-border supervision, and a central database in which supervisors report AML/CFT measures and entity-level data. EIOPA told supervisors to examine the entire financing structure of private equity-backed insurers, widening the view beyond a single entity.
Crypto-asset work follows the same pattern. ESMA told supervisors that crypto firms should stop servicing stablecoins that do not meet MiCA, the EU’s crypto-asset regulation, with a three-month remediation deadline. AMLA recommended that the European Commission consider closing MiCA gaps on staking, DeFi arrangements, stablecoins that do not meet MiCA and asset-referenced token issuers. The FSB flagged uncertain cross-border treatment of global stablecoins and outlined monitoring and failure-planning work. ESMA also told national supervisors not to make action on third-country central securities depositories a priority after the January 17, 2027 deadline, and UK Finance urged the government to use the UK’s 2027 G20 presidency to update international standards.
The picture is being mirrored firm-side; for those who answer to several supervisors at once, and those expanding into new countries, there is a need to map local obligations country by country.
What it means for compliance and risk professionals: As supervisors share more with one another, the same development reads consistently across regions, and teams can gain from the same: one view of what changed, where, and how it fits with requirements elsewhere. Regulatory intelligence that covers Europe, the United States, Canada, Asia and Australia, with expert interpretation, will help compliance and risk teams read each development once, with the cross-border context alongside it.
Every rule has a lifecycle. Following it gives teams time and choices.
The fortnight showed the full arc, starting at proposal stage. The FCA proposed transition arrangements and reporting guidance for the new transaction reporting regime due on April 3, 2028. ESMA opened a call for evidence on digital-token collateral at EYU central counterparties (clearing houses) with existing safeguards to stay unchanged. ASIC proposed three net tangible asset models for digital asset platforms ahead of the April 2027 regime, and an extension of its CFD intervention order to 2037 that would cover digital-asset settlement.
Final texts followed. MAS issued final AI guidelines, effective October 2027, with agentic AI consultations to follow. The FSB published 12 sound practices on AI adoption, expanded its treatment of agentic AI and asked the G20 to champion them. ESMA published final guidelines on electronic allocations and confirmations, reflecting the amendments it proposed to its settlement standards.
Guidance and practice come next. ESMA listed poor practices in impact and climate transition claims, citing standard engagement presented as impact. The EBA expects around 18 PSD3 and PSR (payment services) mandates and says payment fraud needs a new approach. The HKMA issued AI supervisory guidance and plans a discussion paper on agentic AI governance. The FCA told motor finance lenders to plan for the scheme being quashed ahead of the February 2027 hearing.
At every stage, the useful view is a clear line from consultation and feedback to final text and guidance, with consolidated versions that show amendments, tied to a firm’s obligations registers and internal policies.
What it means for compliance and risk professionals: Following a rule through its lifecycle enables teams to plan better for each stage in turn. A proposal gives time to test scenarios, a final text sets the date, and guidance and examples show how supervisors read it. Intelligence that carries expert interpretation at each stage, and connects to policies and obligations, means compliance and risk teams reach each date prepared, with the evidence of how they got there.
The through line
Across all three themes, regulation is being tuned rather than added to. Scope is being fitted to the firm, so relevance sets the workload. Supervision is joining up, so a connected view across jurisdictions keeps pace. Rules arrive in stages, so following the lifecycle from proposal to practice turns each stage into time to plan. For your teams, that is a more workable picture.
That is the work CUBE does with compliance and risk teams: regulatory intelligence matched to your firm, connected across the jurisdictions you operate in, and traceable from proposal to practice.
FAQs
What does proportionality mean in supervision?
Proportionality means scaling requirements and supervisory attention to a firm’s size, complexity and activities. Applying a lighter, more focused set of requirements to small and non-complex institutions within the existing framework is one way to do it.
What would information sharing “without prior consent” change in cross-border supervision?
As proposed by AMLA, supervisors in different EU countries could exchange supervisory information without first obtaining the originating supervisor’s consent, provided that supervisor is notified. The proposal also covers a central database for supervisors to report AML/CFT measures and entity-level data. It remains a proposal.
What is the difference between final draft standards and rules that apply?
Final draft standards, such as AMLA’s customer due diligence standards sent to the European Commission on October 1, 2026, are the regulator’s finished proposal. They bind firms only once the Commission adopts them and they are published in the EU’s Official Journal. Guidance such as the FSB’s sound practices is not binding, and shows how supervisors expect firms to apply the rules.
How often is The CUBE Read published?
Fortnightly. Each edition covers the regulatory developments most relevant to compliance and risk teams in financial services.