Regulatory Policy Brief
Third-party risk reset: regulators trade vendor checklists for concentration oversight
US agencies propose scrapping prescriptive vendor guidance as the EBA will repeal its 2019 outsourcing guidelines once applicable; with 19 EU and four UK critical tech providers under direct oversight, supervisors now target concentration as well as contract clauses.
Materiality Over Paperwork: The Global Supervisory Reset
The OCC and FDIC have written a materiality test for MRAs into regulation, the ECB is working down around 12,000 open supervisory measures and the PRA is moving reviews to a two-year cycle: supervisors are trading paperwork for financial risk.
Rewriting the Leverage Constraint: The Bank of England's Capital Framework Reset and the Global Race to Make Buffers Usable
The Bank of England plans to cut the UK leverage minimum from 3.25% to 3%, add a releasable 25bp buffer and scrap the countercyclical leverage buffer, as the US, the euro area, the EU and Canada also rework leverage and buffer rules.
Prudential Disclosure Reset: EBA Pillar 3 ESG and Shadow-Banking Overhaul, ECB Data Discipline, and Cross-Jurisdictional Parallels — Mid-2026 State of Play
Large EU banks will disclose 37% fewer ESG data points under the EBA's final Pillar 3 package, which also adds a shadow banking template from end-2026, as the ECB presses banks on risk data and Basel climate disclosure stays voluntary.
Basel IV Year One: Implementation Progress and Early Impact Assessment — TGB Regulatory & Policy Brief March 2026
Group 1 banks' Tier 1 minimum required capital would rise 1.7% at full phase-in on June 2025 data, and the EBA puts the fully loaded EU increase at 4.7%. The UK starts on 1 January 2027 and US proposals would cut large-bank CET1 needs by 2.4%.
Stablecoins and Bank Regulation: How Jurisdictions Are Drawing the Lines — TGB Regulatory & Policy Brief November 2025
Stablecoins reached about USD 300 billion by September 2025, yet only five of 29 jurisdictions in an FSB review had finalised frameworks; the US, EU, UK and Hong Kong set or propose different rules on reserves, interest and banks' role.
Climate Risk Disclosure Requirements: Banking Sector Obligations Under TCFD and Beyond — TGB Regulatory & Policy Brief August 2025
Thirty-six jurisdictions have adopted, used or are finalising steps towards ISSB Standards, the Basel Committee has made its bank climate disclosure framework voluntary, while the EU, UK, US and Canada recalibrate their national rules for what banks must publish.
Islamic Finance Regulatory Standards: The AAOIFI and IFSB Frameworks Explained — TGB Regulatory & Policy Brief May 2025
Islamic finance assets reached USD3.38 trillion in 2023, yet the completion rate for key IFSB banking standards was 42% across 46 regulators surveyed, and AAOIFI's draft sukuk standard was still being amended in April 2025.
Open Banking Regulation: Global Progress and the Jurisdictional Patchwork — TGB Regulatory & Policy Brief February 2025
Open banking rules diverged further in 2024: the US finalised a data-access rule with compliance from 1 April 2026, Brazil widened mandatory Open Finance participation and Australia reset its Consumer Data Right after a review found its implementation costs substantial.
FATF standards in 2024: proposed revisions and new AML/CFT obligations for banks
The FSB says FATF revisions to Recommendation 16 are planned for mid-2025, the EU AML Regulation applies from 10 July 2027, and US agencies announced penalties of about $3.09bn against TD Bank: banks face changed AML/CFT obligations.
CBDC Regulatory Frameworks: How Central Banks Are Writing the Rules — TGB Regulatory & Policy Brief September 2024
The euro area's draft law would make the digital euro legal tender, bar interest and let the ECB set holding limits; the UK has promised primary legislation first; and the US House voted 216 to 192 to bar a Federal Reserve CBDC without Congress.
DORA: What EU-Supervised Banks Must Do Before January 2025 — TGB Regulatory & Policy Brief July 2024
EU banks must meet DORA from 17 January 2025: major ICT incidents notified within 4 hours of classification, a register covering every ICT third-party contract, and threat-led penetration tests at least every 3 years for identified banks.