What's live now — FCA, FINMA and the EU

A maintained board of the themes currently occupying the FCA, FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. and the EU authorities — each with what is happening, why it matters, and what a well-advised firm does about it. Drawn from the primary documents, not commentary.

Three supervisors, one direction of travel.

How this board is kept honest#

Reviewed quarterly against the primary sources: FCA consultation papersAn authority's draft rules, published for public comment with a deadline. The one stage where anyone — firm, association, individual — can formally shape the text. and priorities, FINMA GuidanceA short notice to supervised firms (German: Aufsichtsmitteilung). FINMA says it is not a regulatory instrument and is aimed at practical effect, not legal effect. and the annual Risk Monitor, and the AMLA / ESMAThe European Securities and Markets Authority — the EU-level supervisor that drafts most of MiCA's detailed rules and keeps its registers. It drafts; the Commission adopts. / EBAThe European Banking Authority — ESMA's banking-side sibling, responsible for MiCA's stablecoin rulebook. It drafts; the Commission adopts. workplans. Every card carries its source and the date it was last verified — currently October 2026.

Each card below carries a heat tag — Live now, Deadline set, or Direction — indicating how immediate the item is.

FCA — United Kingdom#

The final crypto rulebook lands#

Heat: Live now · Published 30 Jun 2026

The FCA published its final policy statements and guidance, completing the crypto roadmap. Highlights: a bespoke prudential sourcebook (CRYPTOPRU) with capital and stress-testing requirements; stablecoinA token designed to track a currency, run by an issuer who can typically freeze balances — e.g. USDT or USDC. standards eased after consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. — the K-SII capital coefficient cut from 2% to 1% with a £350k permanent minimum, plus backing-asset and redemption rules; a new Market Abuse Regime for Cryptoassets (MARC); the Consumer Duty for retail business; DeFi in scope where there is an identifiable controlling entity.

• Trigger — Final policy statements under the FSMA (Cryptoassets) Regulations 2026. The perimeter guidance followed as PS26/18 on 16 Sep 2026. On 30 Jun the FCA said it would consult later in 2026 on DeFi guidance, operational resilience for firms using DLT and the Financial Crime Guide.
• Who — Trading platforms (QCATPs), intermediaries, custodians, staking arrangers and stablecoinA token designed to track a currency, run by an issuer who can typically freeze balances — e.g. USDT or USDC. issuers serving UK clients; systemic stablecoins supervised jointly with the Bank of England.
• When — Pre-application support meetings from Jul 2026; gateway 30 Sep 2026 – 28 Feb 2027; mandatory regime 25 Oct 2027.

So what — Gap analysis can now run against final text, not drafts — and existing AML registration does not convert, so the authorisation case must be built from scratch.

Source: FCA — final rules press release

Cryptoasset authorisation gateway#

Heat: Deadline set · Gateway opened 30 Sep 2026

The application window for the new FSMA cryptoasset regime runs 30 September 2026 – 28 February 2027, ahead of commencement on 25 October 2027. CP26/13 consulted on the perimeter; the final perimeter guidance, PS26/18, was published on 16 September 2026, and the gateway opened on 30 September. Authorisation is not automatic, and PS26/18 records that existing MLR registrations do not convert.

• Trigger — FSMA 2000 (Cryptoassets) Regulations 2026 — a statutory instrument widening the regulated perimeter; PS26/18 is the FCA's final guidance interpreting it. The FCA says it will consult in October 2026 on targeted updates, following the Government's amendments to the Regulations.
• Who — UK crypto exchanges, custodians, staking/lending providers, stablecoinA token designed to track a currency, run by an issuer who can typically freeze balances — e.g. USDT or USDC. issuers — including firms holding only MLR registration today.
• When — Apply 30 Sep 2026 – 28 Feb 2027; regime live 25 Oct 2027.

So what — Application quality is existential. Pre-application file-building — BWRA, monitoring evidence, governance — is exactly a rapid-review engagement.

Source: FCA — PS26/18, cryptoasset perimeter guidance

Market abuse comes to crypto#

Heat: Deadline set · PS26/9 · Final rules Jun 2026

The final Market Abuse Regime for Cryptoassets (MARC) prohibits insider dealing, unlawful disclosure of inside informationPrecise, unpublished information that would move a crypto-asset's price if known. It must be disclosed properly, and nobody holding it may trade on it. and market manipulation on cryptoasset markets, with systems-and-controls duties for trading platforms and intermediaries — and, for the largest platforms, on-chain monitoring and cross-platform information sharing.

• Trigger — The same Cryptoassets Regulations; the FCA consulted in CP25/41 and published final rules, with the admissions and disclosures regime, in PS26/9 (June 2026).
• Who — Trading platforms, brokers and market-makers in cryptoassets serving UK clients.
• When — With the new regime — 25 Oct 2027; surveillance build must start earlier.

So what — Trading venues need surveillance capability they have never had to evidence before; expect early test cases.

Source: FCA — PS26/9, admissions & disclosures and market abuse

Change-in-control & sanctions tightening#

Heat: Live now · SI 2026/621 · In force 30 Jun 2026

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 widen the test of who controls a registered crypto business (a substituted Schedule 6B), add enhanced due diligence for cryptoasset correspondent relationships (new regulation 34A) and convert euro thresholds to sterling; some measures bite from February 2027.

• Trigger — Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621, made 9 Jun 2026) — an SI amending the MLRs 2017.
• Who — FCA-registered cryptoasset businesses, their owners, and anyone acquiring control of one.
• When — Most provisions from 30 Jun 2026; the rest staged to 1 Feb 2027 and 25 Oct 2027.

So what — Ownership changes now attract supervisory scrutiny earlier — map your cap table before the regulator does.

Source: SI 2026/621 — as made

FINMA — Switzerland#

FINIG amendment — the two new licences#

Heat: Direction · ConsultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. closed 6 Feb 2026

The Federal CouncilThe seven-member Swiss executive. It makes ordinances and decides when laws come into force.'s proposal creates a payment-instrument-institution licence (replacing the FinTech licence, without its CHF 100m deposit cap, and covering stablecoinA token designed to track a currency, run by an issuer who can typically freeze balances — e.g. USDT or USDC. issuance) and a crypto-institution licence (custody incl. staking, trading, exchange) — moving crypto intermediaries from SROA self-regulatory organisation. A private body, recognised by FINMA, that supervises money-laundering compliance at firms FINMA does not supervise itself. Eleven exist.-only oversight to direct FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. supervision.

• Trigger — Federal CouncilThe seven-member Swiss executive. It makes ordinances and decides when laws come into force. consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. to amend the Financial Institutions Act (FinIA/FINIG) and Art. 1b Banking Act — primary legislation, so Parliament decides.
• Who — Swiss crypto custodians, exchanges, staking providers and stablecoinA token designed to track a currency, run by an issuer who can typically freeze balances — e.g. USDT or USDC. issuers currently under SROA self-regulatory organisation. A private body, recognised by FINMA, that supervises money-laundering compliance at firms FINMA does not supervise itself. Eleven exist.-only AML supervision.
• When — ConsultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. closed 6 Feb 2026; no dispatch to Parliament published as at 10 Oct 2026. Parliament decides after the dispatch.

So what — The end of the SROA self-regulatory organisation. A private body, recognised by FINMA, that supervises money-laundering compliance at firms FINMA does not supervise itself. Eleven exist. era for crypto. Positioning work — gap analysis against the draft licence conditions — should start before the dispatch is published.

Source: Federal Council — consultation launched, 22 Oct 2025

AML risk analysis judged on substance#

Heat: Live now · Guidance 04/2026 · 4 Jun 2026

FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone.'s re-review of banks' Art. 25(2) AMLO-FINMAFINMA's own Anti-Money Laundering Ordinance (SR 955.033.0) — the detailed rules under the GwG. In German, GwV-FINMA. risk analyses: risk tolerance must be documented and translated into limits; KRIs are not limits; systematic exceptions-to-policy read as an undeclared change of risk appetite. FINMA says the findings may be applied by analogy to FinIA institutions, scaled to their risk.

• Trigger — FINMA GuidanceA short notice to supervised firms (German: Aufsichtsmitteilung). FINMA says it is not a regulatory instrument and is aimed at practical effect, not legal effect. 04/2026, a supplement to Guidance 05/2023 on the existing duty in Art. 25(2) of the FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. AML OrdinanceA rule made by the government or a regulator under a power given by an Act. Binding law, but below the Act. — no new law, sharpened expectations.
• Who — Banks first; by analogy, FinIA institutions — securities firms, fund management companies, managers of collective assets, portfolio managers and trustees.
• When — Now — the benchmark for current audits and supervisory reviews.

So what — The risk analysis is now a supervisory benchmark for enforcement exposure. An independent substance-check of it is cheap insurance.

Source: FINMA — Guidance 04/2026 (risk analysis)

Crypto custody & digital fraud#

Heat: Live now · Guidance 01/2026 + 02/2026

Custody delegations to foreign sub-custodians only where equivalent supervision and insolvency protection exist; separately, new guidance on digital fraud risks targets online onboarding fraud and account takeover — with the laundering of fraud proceeds through bank accounts squarely in frame.

• Trigger — FINMA GuidanceA short notice to supervised firms (German: Aufsichtsmitteilung). FINMA says it is not a regulatory instrument and is aimed at practical effect, not legal effect. 01/2026 (custody) and Guidance 02/2026 on digital fraud risks (9 Apr 2026) — supervisory interpretations of existing banking and AML law.
• Who — Crypto service providers using foreign sub-custodians; banks and Art. 1b fintechs with online onboarding.
• When — Now — both apply immediately as supervisory expectations.

So what — Custody-chain mapping and onboarding-fraud controls are now inspectable expectations, not best practice.

Source: FINMA — digital fraud guidance

Operational resilience — the uneven middle#

Heat: Live now · Fully applicable since 1 Jan 2026

Guidance 05/2025 surveyed 267 institutions against CircularA FINMA document explaining how it will apply the law. It binds FINMA itself. FINMA says a circular needs no express statutory hook but must trace back to a higher rule. 2023/1. In supervisory categories 1–3, only 12–15% had coordinated resilience with operational risk, business continuity, third-party management and emergency planning, and 85% had not yet carried out any testing. Nearly half of the cyberattacks reported to FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. in 2025 targeted service providers and outsourcing partners.

• Trigger — FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. CircularA FINMA document explaining how it will apply the law. It binds FINMA itself. FINMA says a circular needs no express statutory hook but must trace back to a higher rule. 2023/1 (in force 1 Jan 2024, with a two-year transition for operational resilience) read through Guidance 05/2025 (10 Nov 2025, the market-wide gap report).
• Who — Banks, securities firms and financial-market infrastructures — pressure highest on supervisory categories 1–3.
• When — Fully applicable since 1 Jan 2026, when the transition ended; the 2026 supervisory cycle tests them.

So what — FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. has told the market where the gaps are, with numbers. Institutions should assume the 2026 cycle inspects exactly those gaps.

Source: FINMA — Guidance 05/2025 · FINMA — annual media conference 2026

EU — AMLA · ESMA · EBA#

AMLA is operational#

Heat: Live now · Operational since 1 Jul 2025

The new authority has assumed EU-level AML/CFT responsibilities and is building toward direct supervision of the highest-risk cross-border entities. The single rulebook (AMLR) applies from 10 July 2027 — the technical standards defining it are being written now.

• Trigger — The AMLA Regulation (EU) 2024/1620 — directly applicable EU law creating the authority.
• Who — National FIUsFinancial intelligence unit — the national office that receives and analyses suspicious activity reports. The UK's sits in the NCA; Switzerland's is MROS. and supervisors immediately; 40 of the most complex cross-border financial institutions or groups (CASPsCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. among the candidates) are to be selected for direct supervision in 2027.
• When — Took up operations 1 Jul 2025 (the EBAThe European Banking Authority — ESMA's banking-side sibling, responsible for MiCA's stablecoin rulebook. It drafts; the Commission adopts.→AMLA handover of AML/CFT mandates completed 1 Jan 2026); direct supervision of selected entities from 2028.

So what — The selection criteria for direct supervision are the new strategic risk: know whether you could be on the list, and what the file would show if you were.

Source: AMLA — EBA/AMLA mandate handover (Jan 2026)

MiCA: the enforcement phase#

Heat: Live now · Since 1 Jul 2026

The last transitional regimes closed on 1 July. National authorities moved from registration to enforcement. ESMAThe European Securities and Markets Authority — the EU-level supervisor that drafts most of MiCA's detailed rules and keeps its registers. It drafts; the Commission adopts.'s register stamp of 30 September 2026 holds 364 authorised-CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. records across 27 home states, and 173 entries in its register of non-compliant entities; national authorities also publish their own lists, such as the AMF's blacklist of unauthorised crypto-asset sites.

• Trigger — MiCA — Regulation (EU) 2023/1114; Art. 143(3) set the grandfatheringA transitional permission to keep operating under old national rules while a new regime phases in. Under MiCA it ran at most to 1 July 2026, and many states chose shorter. clock that has now run out.
• Who — Every crypto-asset service provider serving EU clients, wherever incorporated — and the banks and funds exposed to them.
• When — Transition closed 1 Jul 2026; enforcement is the current phase.

So what — Counterparty checks against the ESMAThe European Securities and Markets Authority — the EU-level supervisor that drafts most of MiCA's detailed rules and keeps its registers. It drafts; the Commission adopts. register are now table stakes; unauthorised-CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. exposure in your client base is a live regulatory liability.

Source: ESMA — Markets in Crypto-Assets Regulation (MiCA)

Travel rule with teeth#

Heat: Live now · TFR in application

The Transfer of Funds Regulation applies FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists.'s travel ruleThe requirement that sender and recipient identity data accompany crypto transfers between providers (FATF Recommendation 16). to all CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. transfers — with EDD on third-country counterparties and verification of unhosted-wallet ownership. It implements FATF Recommendation 16 as applied to virtual assets.

• Trigger — Recast Transfer of Funds Regulation (EU) 2023/1113, implementing FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists. Recommendation 16 for crypto transfers.
• Who — All EU CASPsCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. on every transfer — including identification duties around unhosted (self-custodied) wallets.
• When — Applicable since 30 Dec 2024.

So what — Counterparty-discovery and wallet-attributionA claim about who is behind an address. Never a ledger fact — always cite who made the claim and when. capability is the differentiator — precisely a blockchain-analytics service line.

Source: EUR-Lex — Regulation (EU) 2023/1113 (TFR)

AMLR — the single rulebook countdown#

Heat: Deadline set · Applies 10 Jul 2027

One directly-applicable AML regulation replacing national transpositions: harmonised CDD, beneficial-ownership at 25%, EU-wide cash cap, expanded obliged entities. Nine months of gap-analysis time remain.

• Trigger — The AML Regulation (EU) 2024/1624 — a regulation, not a directive: it applies directly, with no national transposition to wait for.
• Who — All obliged entities EU-wide — banks, CASPsCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union., payment firms, plus newly-scoped sectors.
• When — Applies 10 Jul 2027; AMLA sent four final draft technical standards to the Commission on 1 Oct 2026; more follow through 2026–27.

So what — Gap analyses against AMLR should run in 2026, not 2027 — remediation queues at the deadline will be long and expensive.

Source: EUR-Lex — Regulation (EU) 2024/1624 (AMLR)

The language, decoded#

If you have been away for five years, start here. The cards above use the regulators' own vocabulary. Each term below is a different kind of instrument, with a different legal weight — knowing which is which tells you how seriously, and how quickly, to react.

Statute vs statutory instrument#

A statute (Act of Parliament / federal act) is primary law. A statutory instrument or ordinanceA rule made by the government or a regulator under a power given by an Act. Binding law, but below the Act. is secondary law made under it — faster to change, equally binding. The UK MLRs and the Swiss AMLO are secondary law.

CP — consultation paper (e.g. CP26/13)#

A formal FCA proposal, numbered by year (CP26/13 = 2026, paper 13). It is not the rulebook and not law: it publishes draft rules and invites comment. The final rules arrive months later in a Policy Statement (PS) and only then enter the FCA Handbook. Its value is direction of travel — in practice final rules change little from the CP, so reading one buys 12–18 months of preparation time.

• FCA — consultation papers

FCA Handbook · PERG#

The FCA's rulebook. PERG is its perimeter guidance — the chapter that answers "is my activity regulated at all?", which is where every crypto firm's analysis starts.

MLR registration vs FSMA authorisation#

MLR registration is an AML-only check. FSMA authorisation is the full regime — governance, capital, conduct, Consumer Duty. The UK is moving crypto from the first to the second.

• MLRs 2017 — the SI
• FCA — crypto AML regime
• FCA — authorisation

FINMA Guidance vs Circular vs Ordinance#

Three instruments, descending legal weight. An ordinanceA rule made by the government or a regulator under a power given by an Act. Binding law, but below the Act. (Verordnung) is binding secondary law. A circularA FINMA document explaining how it will apply the law. It binds FINMA itself. FINMA says a circular needs no express statutory hook but must trace back to a higher rule. (Rundschreiben) is FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone.'s published interpretation of law, applied in supervision. Guidance (AufsichtsmitteilungGerman for FINMA guidance — a short notice to supervised firms. FINMA states it is not a regulatory instrument. / Communication / Comunicazione) creates no new rules: it reports findings and states expectations, which FINMA applies from publication. Originals are authoritative in DE, FR and IT; English versions are translations.

• FINMA — documentation (DE/FR/IT/EN)

EU Regulation vs Directive#

The refresher: a regulation applies directly in every member state, word for word, from its application date; a directive must first be transposed into national law, which takes years and varies by country. MiCA, the TFR, the AMLR and the AMLA founding text all take the direct form — the EU chose speed and uniformity. Why it matters at both desks: the practitioner gets one text to comply with and no national gloss to hide behind; the strategist gets hard, simultaneous dates across 27 markets — the compliance calendar is the market-entry calendar.

• EUR-Lex — legal acts explained

RTS / ITS#

Regulatory / implementing technical standards: the detailed rules an EU regulation delegates to agencies (AMLA, EBAThe European Banking Authority — ESMA's banking-side sibling, responsible for MiCA's stablecoin rulebook. It drafts; the Commission adopts., ESMAThe European Securities and Markets Authority — the EU-level supervisor that drafts most of MiCA's detailed rules and keeps its registers. It drafts; the Commission adopts.) to draft, adopted by the Commission. The AMLR's real content is arriving this way through 2026–27.

CASP vs VASP#

Same actors, two vocabularies: VASPVirtual-asset service provider — an exchange, custodian or similar business handling crypto for customers. is FATFThe Financial Action Task Force — the inter-governmental body, created by the G7 in 1989, whose Recommendations set the global anti-money-laundering standard. Not a law-maker: its power runs through peer review and its lists.'s global term; CASPCrypto-asset service provider — a firm authorised under MiCA to provide one or more of the ten listed crypto-asset services in the EU. One home-state authorisation covers the whole Union. is MiCA's licensed category. ESMAThe European Securities and Markets Authority — the EU-level supervisor that drafts most of MiCA's detailed rules and keeps its registers. It drafts; the Commission adopts. has maintained the EU-wide public register of authorised CASPs since national authorisations began in 2025 — the first pan-EU list of who may lawfully serve EU clients, and since the 1 July 2026 transition cut-off, the definitive one. If a counterparty is not on it, it cannot lawfully serve EU clients.

• ESMA — MiCA registers

AMLA — mind the collision#

In EU usage, AMLA is the new Anti-Money Laundering Authority in Frankfurt. In Swiss usage, AMLA is the Anti-Money Laundering Act of 1997. This board uses the EU sense in the EU column and the Swiss sense on the Swiss AML page.

Where probative.io comes in#

Each topic on this board maps to a skill we already field. Not commentary — working capability: secure intake, independent analysts, and analytics that produce the evidence these regimes now demand. How a review runs →

1. Authorisation file-building — BWRA, governance and monitoring evidence assembled to gateway standard — for the FCA window and, in time, the Swiss crypto-institute licence.
2. Independent AML risk-analysis review — a substance-check of the Art. 25(2) analysis against the Guidance 04/2026 benchmark, before the auditor or supervisor does the same.
3. Monitoring & typology stress-testing — would your systems catch the known typologies? Tested with real scenarios, documented as evidence.
4. Counterparty & wallet analytics — ESMAThe European Securities and Markets Authority — the EU-level supervisor that drafts most of MiCA's detailed rules and keeps its registers. It drafts; the Commission adopts.-register screening, travel-rule counterparty discovery and wallet attributionA claim about who is behind an address. Never a ledger fact — always cite who made the claim and when. — the TFR's operational demands, run as a service.
5. AMLR gap analysis — current controls mapped against the single rulebook and the incoming technical standards, with an evidenced remediation plan — in 2026, ahead of the queue.

Orientation, not advice · verify against the primary texts