Regulatory Hub
What is changing in payments regulation, and when
We track the payments regulation that matters to our clients in the GCC, the UK and Europe, and advise on the practical and commercial response.
Last reviewed: 27 September 2026
Europe
PSD3 and the Payment Services Regulation (PSR)
Provisional agreement was reached in November 2025 and the final compromise texts went to EU member states for approval in April 2026; formal adoption and publication follow. The PSR will apply directly and PSD3 must be written into national law, with most provisions expected to apply from 2028. The package covers fraud liability, verification of payee, open banking access and payment institution licensing.
Expected to apply from 2028 · Read full analysis →
EU Instant Payments Regulation
Payment service providers in the euro area had to be able to receive instant euro credit transfers from January 2025 and to send them, with verification of payee, from October 2025. Later deadlines apply to member states outside the euro area and to payment and e-money institutions.
In force since October 2025
EU AI Act: high-risk system obligations
The AI Omnibus, in force since 27 July 2026, moved the start of high-risk obligations from August 2026 to 2 December 2027 for Annex III systems, which include creditworthiness assessment and credit scoring, and to 2 August 2028 for Annex I systems. Conformity assessment, technical documentation and human oversight still need to be planned well ahead.
Applies from 2 December 2027 · Read full analysis →
Digital Euro Regulation
The European Parliament's economic affairs committee approved its position on the digital euro regulation on 23 June 2026. Negotiations with EU member states follow, with agreement targeted by the end of 2026 and first issuance expected around 2029. The regulation will set holding limits, distribution through payment service providers and compensation rules.
Council negotiations under way · Read full analysis →
ISO 20022 on SWIFT
The SWIFT coexistence period for cross-border payment instructions ended in November 2025, and ISO 20022 (MX) is now the required format. Institutions that still depend on translation lose structured data such as addresses and purpose codes, which makes screening harder.
In effect since November 2025
EU AML Package and AMLA
The EU Anti-Money Laundering Authority (AMLA) started work in Frankfurt in July 2025. The single EU AML rulebook applies from 10 July 2027, and AMLA is due to begin direct supervision of selected high-risk institutions from 2028.
Single rulebook applies July 2027
United Kingdom
FCA CASS 15: Safeguarding for Payment and E-Money Firms
Since 7 May 2026, payment and e-money institutions must follow the FCA's new safeguarding rules: daily internal and external reconciliations, a monthly safeguarding return from June 2026, annual safeguarding audits for most firms and a resolution pack to help return customer funds on insolvency.
In force since 7 May 2026
UK APP Fraud Reimbursement
Since 7 October 2024, sending and receiving payment firms share equally the cost of reimbursing victims of authorised push payment (APP) scams on Faster Payments, up to £85,000 per claim.
In force since October 2024 · Read full analysis →
Payment Systems Regulator to Merge into the FCA
The Financial Services and Markets Bill 2026, introduced in the House of Lords on 19 May 2026, would abolish the Payment Systems Regulator and transfer its functions to the FCA. The change is not expected to take effect before 2028.
Bill before Parliament
Cross-Border Card Interchange: PSR Price Cap
In January 2026 the High Court rejected a challenge by Visa, Mastercard and Revolut to the PSR's power to cap UK–EEA card-not-present interchange fees. The PSR has dropped plans for an interim cap and is working on the method for a longer-term cap.
Methodology in development · Read full analysis →
GCC
CBUAE AlTareq Open Finance Standards v2.1: Scale-Up Phase
UAE open finance payment volumes surged from AED 19.8 million to AED 78.2 million between May and August 2026, confirming strong live adoption on the AlTareq platform. All CBUAE-licensed financial institutions must maintain a dedicated API interface for customer account and product data access, with the transition period closing 16 September 2026.
Transition period closed 16 September 2026
QCB Express Sandbox: Expansion to Insurance and Islamic Finance
Qatar Central Bank is extending its fast-track Express Sandbox beyond payments in 2026, adding insurance, wealth management, and Islamic finance products as open banking foundations stabilise. Paywise, formerly Dibsy, joined as an early payments participant in July 2025, with broader fintech cohorts expected to onboard under expanded 2026 scope.
Expansion expected Q4 2026
QCB Open Banking: Interoperability and Unified Consent Standards
Qatar Central Bank is rolling out formal interoperability standards and a unified consent model for open banking in Q3 to Q4 2026, building on live API launches by QNB. The framework governs payment initiation and data sharing between banks and licensed third-party providers under the QCB FinTech Strategy 2023 to 2028.
Standards rollout Q3-Q4 2026
CBB Bahrain Rulebook: PSP, AISP and Crypto Module Updates
The Central Bank of Bahrain updated Rulebook Volumes 1, 2, 5 and 6 in May 2026, introducing revised licensing requirements for PSP, AISP and PSIP applicants, updated client money account rules, and amendments to the Crypto-Asset Module. BPay Global, a Binance Group entity, received a PSP licence under the updated framework.
Effective May 2026
CBUAE AlTareq Open Finance: September 2026 Compliance Deadline
Under Federal Decree-Law No. 6 of 2025 and CBUAE Circular 3 of 2025, affected entities face a key compliance deadline of 16 September 2026. The framework uses a centralised API hub operated by CBUAE entity Nebras, with Lean Technologies and Wio Bank already live under the operational AlTareq infrastructure.
Compliance deadline 16 September 2026
QCB Open Banking Interoperability and Consent Standards 2026
Qatar Central Bank is scaling open banking from sandbox to production in 2026, publishing formal interoperability standards and a unified consent model governing API connections between banks and third-party providers. QNB has launched live account-information and payment-initiation APIs, with standards expected in Q3 to Q4 2026.
Standards expected Q3-Q4 2026
UAE Federal Decree-Law No. 6 of 2025: Open Finance as Licensed Activity
Federal Decree-Law No. 6 of 2025 brings open finance within the Central Bank of the UAE's licensing framework (Article 61). Firms covered by the law had until 15 September 2026 to bring their activities into line with it.
In force since 16 September 2025
QCB: Direct PSP Access to QA-RTGS
On 1 September 2026 Qatar Central Bank allowed payment service providers to open accounts in, and settle directly through, its real-time gross settlement system QA-RTGS, without an intermediary bank. SADAD Payment Solutions and Dibsy were the first two PSPs to join.
Live since September 2026
Qatar: Fawran Instant Payments
Qatar Central Bank's Fawran instant payment system has been live since early 2024, allowing account-to-account transfers around the clock using mobile numbers or aliases. Since October 2024 it has also been available for online purchases through the national QPay e-commerce gateway.
Live since 2024 · Read full analysis →
Qatar: Open Banking Roadmap
Qatar Central Bank's FinTech Strategy (2023–2028) sets out an open banking roadmap. Payment initiation and data-sharing services are being tested through the QCB regulatory sandbox, but a standalone open banking regulation has not yet been issued.
Regulation not yet issued · Read full analysis →
SAMA: Open Banking Licensing
The Saudi Central Bank has moved open banking from its sandbox to formal licensing. In March 2026 Lean Technologies became the first company licensed to provide open banking services in Saudi Arabia.
Licensing since March 2026 · Read full analysis →
SAMA: Fees Guide for Financial Institutions' Services
Announced in December 2025 to replace the Banking Tariff, the guide lowers maximum fees for services including international purchases and cash withdrawals, mada card reissuance, and transfers from bank accounts and e-wallets. It applies to banks and payment companies supervised by SAMA.
Replaces the Banking Tariff
UAE: New Central Bank Law
Federal Decree-Law No. 6 of 2025 replaced the 2018 Central Bank Law and brought banking, insurance and payments under one framework, including technology providers that facilitate financial services. The one-year transition period for existing firms ended in mid-September 2026.
Transition period ended September 2026
UAE: Open Finance and AlTareq
Under the CBUAE Open Finance Regulation, banks and insurers connect to licensed third-party providers through the central Nebras API hub, branded AlTareq for customers. Banks are going live in stages; ADIB became the first Islamic bank to implement it in January 2026. The framework covers data sharing, payment initiation and the initiation of other financial services, and has been extended to insurance.
Phased roll-out · Read full analysis →
UAE: Payment Token Services Regulation
Issued by the CBUAE in 2024, the regulation requires a licence to issue dirham-backed stablecoins and restricts the use of foreign payment tokens in the UAE to buying virtual assets.
In force since 2024 · Read full analysis →
Kuwait: National Payments System Upgrade
The Central Bank of Kuwait launched the Kuwait Automated Clearing House (KACH) on 5 January 2026 and the Kuwait Dispute Management System (KDMS) on 2 February 2026, giving payment system participants a central platform for clearing and for resolving transaction disputes.
Live since February 2026
Global
Project Aperta: Cross-Border Open Finance Interoperability Prototype
Completed in June 2026, Project Aperta was led by the BIS Innovation Hub with CBUAE, HKMA, FCA, and the Central Bank of Brazil. It demonstrated cross-border data portability for faster onboarding and trade finance lifecycle management across five economies, with policy implications for GCC cross-border open finance frameworks now pending.
Completed June 2026
Project Aperta: Cross-Border Open Finance
A BIS Innovation Hub project with the Central Bank of the UAE, Banco Central do Brasil, the Hong Kong Monetary Authority and the UK's FCA built a prototype layer linking national open finance networks without changing them. The final report was published on 29 May 2026 and the CBUAE announced completion on 17 June 2026.
Completed June 2026
FATF Travel Rule: Cross-Border Transfers and Virtual Assets
FATF Recommendation 16 requires originator and beneficiary information to travel with cross-border wire transfers, and applies the same principle to virtual asset transfers. Uneven implementation between countries still creates gaps for firms sending to jurisdictions that have not yet applied it.
Ongoing implementation
Visa Acquirer Monitoring Programme (VAMP)
Visa's VAMP, introduced in 2025, combines fraud and dispute ratios for card-not-present transactions into one measure for merchants and acquirers. Thresholds tighten during 2026, and merchants above them face fees and remediation requirements.
Thresholds tightening in 2026
Need advice on a regulatory change?
We advise payment institutions on the practical compliance and commercial response to new rules.