EU and UK Regulatory Update (May 2026)

1.3 Regulation of Shadow Banking

The EBA published a consultation paper on the Capital Requirements Regulation and its application to ‘shadow banking’, or, in other words, private credit, insurance firms and funds of various distinction that provide credit. It provides for revised guidelines that govern institutional exposure to Shadow Banking Entities (SBEs) under the Capital Requirements Regulation (CRR). The revisions are primarily intended to align the existing 2015 guidelines with the now fully harmonised EU framework for identifying SBEs, as set out in Delegated Regulation (EU) 2023/2779. Under the proposed approach, institutions are expected to maintain robust internal frameworks for managing SBE exposures, including setting limits on both individual and aggregate exposures. These limits are designed to address microand macro-prudential risks respectively and must be embedded
within firms’ governance, risk management and monitoring processes.

1.4 Cybersecurity Regulation Proposals

The EC published on 20 January 2026, a proposed regulation that amends and adds to the Cybersecurity Act (CSA), that first came into effect in 2019. The CSA is part of a broader regulatory framework developed by the EU that also includes the Cyber Resilience Act of 2024 (CRA) and the NIS2 directive. The former is a law that applies to business across the Union that enforces standards on software and hardware manufacturing and importation to enforce higher standards of risk management, safety and, therefore, market resilience in products with ‘digital elements’. The EC’s CSR proposal to amend the CSA aims to reduce risks in the ICT supply chain and improve legal clarity.

The CSA on the other hand established the EU Agency for Cybersecurity (ENISA) and a cybersecurity certification framework for products and services, which ensures the strength of security controls and protection for Information Communication and Technology (ICT) products and services. Part of the CSR is a revision of the NIS2 Directive, to clarify and simplify compliance rules for firms. The Network Information Security (NIS2) Directive, passed in 2022, established a unified legal framework across the Union, from which national legislation would need to adopt and uphold (as directives are vertical legal instruments that require adoption by member states). It also specified the key cybersecurity legislative requirements for 18 critical industries including finance. The CSR will further empower ENISA to regulate, support and alert companies and stakeholders in the EU about cybersecurity, including working with Computer Security Incident Response Teams (CSIRTs). Financial services firms must assess their exposure to potential risks and suppliers that are considered high risk.

1.5 Private Equity Secondary Market

Following the rollout of a private equity exit and share trading framework in the UK, along with the examples of private marketplaces in the US, the EU is consulting on private share auctions. The outline of the project mentions the UK’s PISCES programme, highlighting similarities and differences between the EC’s proposal and the current UK regime.

The EC proposal under consultation has a significant difference: the EC has not ruled out primary issuances in private market trading, whereas the PISCES platforms only allow for secondary trading at auction of already issued shares. Nevertheless, these developments may help to increase capital raising for scale-up companies but disincentivise initial public offerings from private companies if they are able to intermittently raise capital through auction platforms.

1.6 ESG Assessment Failures

The ECB has imposed its second ever fine for failures by a bank to comply with Environmental, Sustainability and Governance (ESG) risk management regulation. Credit Agricole was fined EUR 7,551,050 for failure to comply with a decision and notice from the ECB on the firm’s risk assessment, management and reporting on ESG matters.

2. UK Regulatory Developments

The UK’s regulators have laid out regulatory priorities for the year in terms of data, AI, capital requirements, ESG and liquidity for 2026. [1], [2]

2.1 FCA Wholesale Markets Regulatory Priorities

The FCA released the Wholesale Markets Regulatory Priorities Report in March 2026. For Wholesale Markets and Investment Banks, the review has five core relevant areas: strengthening market resilience (including trading controls, liquidity and operational resilience), improving market efficiency through streamlined and less prescriptive rules, supporting safe adoption of new technologies (AI and digital assets), tackling financial crime and conflicts of interest and promoting competition and innovation.

The FCA’s most relevant priorities for Funds and Investment Banks for 2026 at the time of writing are:

• Publishing final rules to support issuance and investment in securitisations in H2 2026, following on from the consultation, Rules for reforming the UK Securitisation Framework (CP26/6).
• Consulting on equity market structure and transparency in 2026, following on from CP25/20.
• Consulting on amendments to rules on unconnected research in the context of an IPO.
• Publishing final rules on an equity consolidated tape by the end of H1 2026, following consultation on a framework (CP25/31), and running a concurrent procurement process to appoint an operator.
• Publishing final rules following consultation on client categorisation and conflicts of interest (CP25/36).
• Implementing reforms to the commodity derivatives regulatory framework (PS25/1) in July 2026.
• Publishing final rules for ESG ratings in Q4 2026 following consultation on a proposed regulatory approach (CP25/34).
• Developing a joint approach with HM Treasury and the Bank of England to streamline transaction reporting.
• Engaging on operational standards for the bond consolidated tape ahead of launch in June 2026.
• Monitoring firm readiness for T+1 implementation.
• Engaging stakeholders on tokenised securities and Distributed Ledger Technology in wholesale markets, alongside related work on tokenised funds, the Digital Securities Sandbox and Project Guardian. The latter is a multinational financial regulatory cooperation between the FCA and the Monetary Authority of Singapore and others, on digital assets, AI and fund tokenisation regulations among other initiatives.

2.2 Open Finance Roadmap

On 14 April 2026, the FCA published Open Finance: Our Vision for a Smart Data Future as a schedule for its development and facilitation of open finance in the UK between now and 2030. Open finance is the concept of allowing the sharing of entity or personal financial data with fintechs or other financial institutions. The idea is to allow greater connectivity between clients and services in the finance industry. Open banking, as a conceptual framework in the UK, is limited to payments data. Open finance would extend the same principles to products such as mortgages, SME lending, investments, pensions, insurance, savings, credit and debt management.

The roadmap aims to expand secure, consent-based data sharing across more financial products, building on the UK’s success in open banking. According to the FCA, implementation of open banking in the UK now includes 145 active third-party providers and around 17 million users. An open finance regulatory drive and industry expansion would extend these principles to mortgages, SME lending, investments, pensions, insurance, savings and credit and debt management. The FCA’s roadmap to 2030 focuses on collaboration with industry, consumers, academia and technical experts, supported by its Innovation Hub and Smart Data Accelerator (launched in September 2025). Key milestones include:

• TechSprints (2026 Q1 & Q4) building on earlier work in SME lending and mortgages, including AI-driven affordability tools and reusable loan data.
• A PolicySprint (2026 Q2) to identify where open finance can improve outcomes and what industry needs.
• The PRISM Taskforce (reporting 2026 Q3) to prioritise real-world use cases.
• A discussion paper (2026 Q4) on the first open finance scheme, with FCA and HM Treasury proposals, to aid construction of an open finance regulatory framework.
• A 2027 finalisation or publication of an initial framework.
• A period thereafter of industry consultation, amendments, finalisation and then transition to live regulatory scheme by 2030.

2.3 New IPO Disclosure Rules

On 27 April 2026, the FCA published consultation paper CP26/14, which proposes changes to UK IPO information flow rules that were themselves introduced in 2018 to improve research quality and manage conflicts. The FCA proposes to remove the current seven-day delay between publication of a prospectus and connected research, aiming to improve timeliness and align more closely with international practice. It also removes the rule for syndicate banks to share information on IPO research with analysts. These rules introduced institutional friction and time-lag. In addition, the FCA proposes a technical correction to Handbook provisions on investment research, following onshoring of MiFID rules.

2.4 Short Selling Regime Policy

The UK’s new short selling regime (SSR), set out in the FCA’s PS26/5, replaces the EU-derived framework that had been in place prior to and since Brexit, with a more flexible system aimed at boosting market competitiveness while maintaining regulatory oversight and simplicity.

Previously, market makers were able to enjoy certain exemptions for disclosure requirements for net short positions due to their centrality in the market as market makers. The FCA has revised rules that allow for exceptions to disclosure requirements for market makers to allow for notifications to the regulator through a ‘single activity’ based notification system, instead of the previous instrument-based notification system. The rules will extend the deadline for firms reporting net short positions from 15:30 to 23:59 on T+1, providing a greater time cushion for short-selling organisations.

The publication requirements and thresholds for net short positions have been changed. Article 6 of the (previous but still in force until July) UK SSR currently requires entities to disclose details of the net short positions that they hold when these positions reach or exceed 0.5% of a company’s issued share capital. Under the amendments, the FCA instead will be required to publish companies in which there is an aggregate net short position (ANSP) of 0.2% of their share capital but will not name the entities which hold those positions. The regime will commence on 13 July 2026, with the beginning of its transitional period, and the end of the transitional period will be 29 January 2027.

2.5 AI Application Testing with Banks

The FCA has selected eight firms, including Barclays, UBS, Lloyds Banking Group (Scottish Widows) and Experian, to participate in its second AI Live Testing. The initiative, run with technology partner, Advai, allows firms to test AI applications in real-world conditions under simulated regulatory oversight. The goal is to support safe and responsible AI use in financial services, with a focus on risk management and live system monitoring. The first AI Live Testing included banks such as NatWest, Santander and Monzo.

The FCA’s AI Lab provides access to computing resources, synthetic data and regulatory guidance to help firms develop and validate AI systems for use in markets and customer services. The programme for the AI Lab is part of a broader innovation and fintech focus for the regulator. It envisions a partnership approach with firms as technology develops rapidly and regulatory agility has to match the challenges this brings.

2.6 Securitisation Framework Reform

The FCA conducted a consultation after publishing a paper (CP 26/6) on a new securitisation framework over the first quarter of 2026, ending in May 2026. The consultation paper is built upon the work of CP 23/17, the FCA’s subsequent policy statement, PS 24/4, which transferred firm-facing securitisation rules to the FCA Handbook and the Prudential Regulatory Authority (PRA) consultation paper on the securitisation for firms authorised by the PRA.

The proposals significantly change the due diligence obligations of investors. The FCA proposes removal of the requirements for investors to verify compliance of manufacturers with securities regulations with regard to credit granting, transparency and risk retention. This, the FCA concluded, places the investors in a ‘quasi-supervisory’ capacity. Rather than requiring investors to verify strict compliance with predefined criteria, the FCA proposes that investors form their own assessment of whether an originator’s lending practices are sufficiently robust, except where the originator is already subject to UK prudential regulation.

The consultation introduces greater flexibility in how ongoing due diligence is performed. Current rules mandate specific activities, such as regular stress testing and detailed monitoring against prescribed metrics. The FCA proposes to remove these requirements, allowing investors to calibrate their monitoring activities according to the level of risk associated with a given position. In parallel, the FCA proposes a substantial simplification of the transparency framework. This includes cutting back the number of reporting templates, simplifying those that remain and introducing updated templates for collateralised loan obligations (CLOs). It further removes the distinction between public and private securitisations, along with the elimination of mandatory reporting to securitisation repositories.

The FCA’s objective in the proposals is to reduce regulatory burden, especially for institutional investors, and simplify the securitisation process to enhance global competitiveness of UK securities markets. The consultations from both regulators should be evaluated and considered by both the buyside and sellside as they prepare for future change.

2.7 Stress Testing Programmes

The Bank of England (BoE) has added AI risk to financial institutions to its stress testing programmes. This announcement has come out of a UK Treasury Select Committee meeting, in which the BoE outlined how it will measure AI risk to financial institutions and the market as a whole. More specifically, the bank highlighted the risk that AI agents could amplify herding behaviour in financial markets. The FCA and PRA have asked investment firms and banks to come forward and be part of their reporting joint-task force that aims to streamline and harmonise transaction and post-trade reporting requirements.

2.8 PRA Liquidity Requirements Changes

The PRA recently proposed to update its liquidity policy framework in a consultation with the industry. The PRA’s liquidity framework evaluates the liquidity requirements for financial institutions. Firms are expected to strengthen stress testing, governance and operational readiness, especially in the early stages of a liquidity stress event. This includes assessing how realistic their stress assumptions are, how easily assets (like sovereign bonds) can actually be sold and whether they are operationally prepared to use central bank facilities (legal setup, collateral, procedures and escalation processes). The PRA also highlighted the need for better monitoring of collateral and liquidity by entity and currency, particularly where systems are fragmented across business functions. The main five proposals in the consultation document are:

1. To assess the composition of liquidity resources and monetisation risk.
2. To remove exemption for Level 1 Assets (including sovereign bonds) from the LCR Operational Requirement for monetisation testing.
3. To clarify the role of central bank facilities within the prudential liquidity framework.
4. To require firms to monitor and assess their prepositioned collateral with central banks, along with estimating the amount of non-prepositioned eligible assets, as additional liquidity resources.
5. Other changes relate to the internal liquidity adequacy assessment process (ILAAP) documentation and requirements and Liquidity Contingency Plans (LCP) governance.

Disclaimer: The regulatory analysis contained within this article are not legal advice. Any analysis or predictions based on current regulation are therefore subject to legal risk and regulation changes. This is not an exhaustive list of EU and UK financial regulations, but is a collection of relevant updates, material changes and interesting developments according to the team at GreySpark Partners.