Regulatory Hub
Keeping pace with a fast-moving regulatory environment
Payments regulation is changing faster than at any point in the last decade. We track material changes and advise clients on practical compliance and commercial response.
Europe
PSD3 and the Payment Services Regulation (PSR)
Political agreement reached late 2025. National transposition underway across EU member states; full application expected mid-to-late 2027. Covers stronger fraud protections, enhanced open banking rights and new payment institution provisions.
Updated June 2026 · Read full analysis →
EU Instant Payments Regulation
All eurozone banks required to receive instant payments from January 2025 and send from October 2025. SEPA Instant Credit Transfer now mandatory infrastructure across the euro area.
Active from October 2025
EU AI Act: high-risk system obligations
High-risk AI system requirements, covering fraud detection, credit scoring and customer risk assessment, apply from August 2026. Conformity assessments, technical documentation and human oversight mechanisms required.
August 2026 · Read full analysis →
Digital Euro Enabling Regulation
ECB completed preparatory phase late 2025. Enabling regulation expected to define the legal framework for issuance, distribution via intermediaries, holding limits and relationship to commercial bank deposits.
Expected 2026 · Read full analysis →
ISO 20022 Migration
ISO 20022 becomes the default standard for high-value and cross-border payment messages globally. As SWIFT tightens tolerance for MT message translation, participants face escalating pressure to upgrade infrastructure.
Ongoing through 2025–2026
EU AML Package: AMLA Authority
The EU AML package establishes AMLA with direct supervisory powers over high-risk financial institutions. Unified AML/CFT requirements across member states through a single European rulebook.
AMLA operational 2026–2027
United Kingdom
FCA CASS 15: Payment Institution Safeguarding
In effect from 7 May 2026. Payment institutions and EMIs required to safeguard client funds under stricter rules including dedicated trust accounts, monthly reconciliation proof reports and updated disclosure requirements.
In force May 2026
UK APP Fraud Reimbursement Rules
PSR rules require sending and receiving payment service providers to share liability for reimbursing APP fraud victims. Rules created significant commercial exposure for smaller institutions and triggered industry-wide reviews of fraud controls.
Active from October 2024
PSR CP26/1: Visa and Mastercard Financial Reporting
PSR consulted in May 2026 on requiring Visa and Mastercard to submit annual P&L accounts for UK card payment operations. Responses due 3 July 2026. Flows from card scheme fees and processing charges review.
Consultation closes July 2026
FCA Protection Reforms for Payment Institutions
Updated FCA safeguarding framework strengthens requirements for payment institutions and EMIs on how client funds are protected, intra-group settlements and reporting. Stronger focus on auditability and insolvency readiness.
Updated 2025–2026
GCC
QCB NAPS and QPay Direct Fintech Integration Rules
Qatar Central Bank is enabling licensed fintechs to integrate directly with the national NAPS infrastructure and QPay platform, establishing technical and compliance requirements for direct participation. Applicants must satisfy QCB authorisation criteria and meet defined API security standards before accessing live payment rails.
Framework rollout ongoing 2026
CBB Rulebook Volume 6: Capital Markets PSP Update
The Central Bank of Bahrain amended Rulebook Volume 6 in May 2026, introducing revised capital adequacy thresholds and updated fit-and-proper criteria for payment service providers operating in capital markets. Firms must demonstrate compliance with new governance and operational resilience standards as a condition of CBB authorisation.
In force May 2026
GCC Unified Remittance Corridor API Standardisation
GCC central banks are collaborating to standardise API specifications for cross-border remittance corridors, targeting interoperability between national payment schemes. The initiative aims to reduce settlement friction and compliance overhead for licensed PSPs routing transfers between member states, with pilot specifications under review in 2026.
Pilot review ongoing H2 2026
CBUAE Open Insurance Live: TPP Broker Obligations
The CBUAE has extended its open finance framework to insurance, placing transitional obligations on licensed third-party providers accessing broker and insurer data via regulated APIs. Firms must complete TPP certification through Nebras before initiating live insurance data or service calls under the expanded scope.
Transitional period active 2026
CBUAE Nebras Open Finance: Centralised API Hub Certification
Nebras, a CBUAE-established entity, operates the centralised API hub underpinning the UAE Open Finance framework under Circular 3 of 2025. Third-party providers must obtain digital certificates and register in the compliance registry to access bank and insurance data, with TPP expansion milestones progressing through 2026.
Effective 10 July 2025, Ongoing 2026
CBB Rulebook Volume 3 and 4: PSP Ancillary Services May 2026
The Central Bank of Bahrain amended Rulebook Volumes 3 and 4 in May 2026, updating authorisation requirements for ancillary services providers including PSPs, AISPs, and PSIPs. Applicants must now meet revised capital, governance, and operational resilience standards before seeking CBB authorisation.
Effective May 2026
CBUAE CB Law 2025: Payments and VASP Scope Expansion
Federal Decree-Law No. 6 of 2025 consolidates UAE banking, insurance, and payments regulation under a single framework, repealing the 2018 Central Bank Law. Technology providers facilitating financial services and virtual asset payment operators are newly in scope. Full compliance is required by 16 September 2026.
Compliance Deadline 16 September 2026
QCB Open Banking: Interoperability and Consent Standards 2026
Qatar Central Bank is expected to publish formal interoperability standards and a unified consent model during 2026, building on its five-year FinTech Strategy and Express Sandbox programme. The framework will govern API connections between banks and third-party providers for payment initiation and data sharing.
Standards Expected Q3 to Q4 2026
CBUAE Open Finance: Service Initiation and Embedded Finance Rules
Circular 3 of 2025, in force from 10 July 2025, introduced service initiation rights under the UAE open finance framework, allowing accredited third-party providers to trigger financial services directly within non-bank environments. All licensed financial institutions must adhere to the standard via the Nebras centralised API hub, with phased expansion continuing through 2026.
Effective 10 July 2025, phased expansion 2026
CBB Rulebook Volume 3: PSP and Ancillary Services Licensing
The Central Bank of Bahrain amended Volume 3 of its Rulebook in May 2026, updating authorisation requirements for payment service providers and ancillary service licensees under Articles 37 to 48 and 180 of the CBB and Financial Institutions Law 2006. Firms providing payment initiation and related regulated services must meet revised licensing conditions.
Effective May 2026
Project Aperta: Cross-Border Open Finance Interoperability Network
The CBUAE announced the successful completion of Project Aperta in June 2026, a BIS-led initiative establishing a trusted interoperability network for secure cross-border open finance. The project links multiple jurisdictions' open finance networks and sets a replicable blueprint for regulated data sharing across borders.
Completed June 2026
QCB Open Banking: Interoperability Standards and Consent Model
Qatar Central Bank is advancing its open banking framework in 2026 by developing interoperability standards and a unified consent model as API adoption scales across the sandbox ecosystem. The iterative approach builds on the QCB FinTech Strategy 2023 to 2028 and is expected to extend into insurance, wealth, and Islamic finance verticals.
Rollout in progress 2026
CBB BPay Global PSP License: Binance Fiat Services Authorised
The Central Bank of Bahrain granted BPay Global, a Binance Group entity, a Payment Service Provider licence on 9 April 2025, authorising fiat payment services to Binance users globally. Crypto.com received a concurrent PSP licence, expanding Bahrain's regulated crypto-payments ecosystem under CBB Rulebook Volume 5.
Effective April 2025
CBUAE Nebras Open Finance: Centralised API Hub and TPP Certification
Open Finance Circular 3 of 2025, in force from 10 July 2025, mandates all licensed financial institutions connect via Nebras, a CBUAE-governed centralised API hub. The framework includes a testing and certification programme, a commercial pricing model, and a trust framework governing TPP authentication and digital certificates.
Effective 10 July 2025
QCB Express Regulatory Sandbox: Open Banking Payment Initiation Testing
Qatar Central Bank's fast-track Express Sandbox admits fintechs to test payment initiation and data-sharing under live market conditions. Paywise, formerly Dibsy, joined in July 2025 as an early entrant. In 2026, QCB expects to extend sandbox scope to insurance, wealth, and Islamic finance products as open banking foundations stabilise.
Ongoing: 2025 to 2026
QCB Open Banking: Live Production API Access for Fintechs
Qatar Central Bank is scaling open banking from sandbox to production in 2026, following QNB's launch of live account-information and payment-initiation APIs. QCB is introducing unified consent models and interoperability standards as fintech API adoption expands under the QCB Payment Services Regulation Circular No. 23/2021.
Scaling Phase: 2026
CBB Rulebook Volume 4 and 6 Amendments: May 2026
The Central Bank of Bahrain amended Rulebook Volumes 4 and 6 in May 2026, updating authorisation and capital requirements for payment service providers. The changes introduce revised capital adequacy thresholds and updated fit-and-proper criteria for PSP licence applicants operating in Bahrain.
Effective May 2026
CBUAE CB Law 2025: September 2026 Compliance Deadline
Entities regulated under the UAE Federal Central Bank Law 2025, published in the Official Gazette on 15 September 2025, must achieve full operational compliance by 16 September 2026. The one-year transitional period covers licensing, governance, and prudential obligations for banks, PSPs, and financial institutions.
Deadline 16 September 2026
GCC Unified Remittance Corridor API Standardisation Initiative
Spearheaded by the CBB, GCC regulators are developing unified API standards for cross-border remittance corridors, targeting implementation by end of 2026. The initiative is projected to save the region approximately 410 million USD annually in transaction fees through interoperability across member states.
Target completion Q4 2026
CBUAE Open Finance Circular 3 of 2025: Service Initiation Rules
Circular 3 of 2025, in force from 10 July 2025, introduces service initiation as a regulated activity, permitting non-bank players to directly trigger financial services within third-party environments. This enables embedded finance models and expands open finance beyond data access and payment initiation.
In force 10 July 2025
CBB Rulebook Volume 5: PSP Authorisation Module Amendment
The Central Bank of Bahrain amended its Rulebook Volume 5 Authorisation Module in May 2026, updating licensing requirements for payment service providers and electronic money issuers. Firms must review capital, governance, and operational resilience thresholds to confirm continued compliance under the revised framework.
Effective May 2026
QCB FinTech Strategy 2023 to 2028: Open Banking Formal Framework
Qatar Central Bank is developing formal open banking regulation under its five-year FinTech Strategy, with interoperability standards and unified consent models under active development. A standalone mandatory framework has not yet been gazetted as of mid-2026, with the Express Sandbox accelerating production-ready fintech participants ahead of formal rules.
Formal regulation date TBC
CBUAE CB Law 2025: One-Year Transitional Compliance Deadline
Federal Decree-Law No. 6 of 2025 consolidates UAE banking, payments, and insurance regulation under a unified framework. All affected entities, including payment institutions and technology providers facilitating financial services, must achieve full operational compliance by 16 September 2026.
Deadline 16 September 2026
CBUAE Open Insurance Live: TPP-Broker Transitional Obligations
Open Insurance launched in the UAE in March 2026 under the AlTareq initiative. TPP-Brokers holding existing bilateral agreements with insurers at the time of the November 2025 Commercial and Pricing Model announcement must maintain those agreements on identical terms for two years post-launch, creating defined transitional compliance obligations.
Effective March 2026
QCB Open Banking Interoperability Standards and Unified Consent Model
Qatar Central Bank is developing interoperability standards and a unified consent model for its open banking ecosystem, building on the five-year National Fintech Strategy launched in October 2023. The framework will govern API architecture and data-sharing across licensed PSPs, with formal consultation expected to advance through 2026.
Consultation Phase 2026
CBUAE Nebras Open Finance Phase 2: TPP Expansion Milestones
Nebras Open Finance LLC is advancing Phase 2 of the UAE Open Finance rollout under CBUAE Circular No. 03/2025, effective 10 July 2025. Commercial Bank of Dubai became the first bank to activate live Open Finance operations with licensed TPPs including Pay10 and Lean Technologies, setting compliance benchmarks for remaining institutions.
Effective July 2025, Phase 2 ongoing 2026
CBB Stablecoin Issuance and Offering Framework: First License
The Central Bank of Bahrain granted its first license under the Stablecoin Issuance and Offering Framework in June 2026, codified in CBB Rulebook Volume 6. The framework establishes licensing, reserve, and operational requirements for stablecoin issuers seeking to integrate into Bahrain's regulated financial system.
First License Granted June 2026
CBUAE Open Finance: Service Initiation & Embedded Finance Rules
Circular 3 of 2025, in force from 10 July 2025, introduces 'service initiation' enabling non-bank fintechs to directly trigger financial services, including lending, wealth management, and pension setup, from within their own platforms. This moves the UAE framework beyond conventional payment initiation into full embedded finance orchestration.
In Force July 2025
QCB NAPS & QPay Direct Integration for Fintechs
The Qatar Central Bank now offers fintechs direct integration access to NAPS and the QPay e-commerce payment gateway, reducing intermediary costs and broadening digital payment access for SMEs and migrant workers. The initiative forms part of Qatar's Third Financial Sector Strategy under Vision 2030.
Active 2026
QCB Open Banking Architecture: Fintech API Strategy
Qatar Central Bank is developing a formal open banking framework under its five-year National FinTech Strategy, with API platform infrastructure and unified consent models under design. Unlike Bahrain or the UAE, Qatar has no standalone open banking regulation yet; a formal consultation is the anticipated next milestone.
Consultation Expected H2 2026
Project Aperta: Cross-Border Open Finance Interoperability
The BIS Innovation Hub completed Project Aperta on 17 June 2026, establishing a tested prototype for cross-border open finance via a neutral API interoperability layer connecting the UAE, UK, Brazil, Hong Kong, and India. All architectural blueprints, trust frameworks, and reference code are released as open public goods for global adoption.
Completed June 2026
QCB Digital Bank Regulatory Framework: Qatar
Qatar Central Bank published its Regulatory Framework for Digital Banks in Q4 2024 under the Third Financial Sector Strategy. PSPs gain direct NAPS and QPay integration access, removing intermediaries. A formal open banking circular remains anticipated but unpublished; Qatar operates under a sandbox-led pre-regulation model as of mid-2026.
Framework issued Q4 2024; NAPS integration announced October 2025
CBUAE Open Finance Regulation: AlTareq Live Rollout
Following Circular 3/2025 (effective 10 July 2025), UAE banks including CBD and ADIB are now live on the Nebras centralised API hub. Licensed TPPs Pay10 and Lean Technologies are operational, enabling regulated consent-based data sharing and payment initiation for retail customers nationwide.
Live from Q4 2025 / ADIB January 2026
QCB Express Regulatory Sandbox: Fast-Track PSP Admissions
Qatar Central Bank's multi-tiered sandbox now includes an Express Sandbox track for payment initiation and data-sharing fintechs, accelerating time-to-approval. The scheme is the primary licensing pathway ahead of a formal open banking regulation, with new cohorts approved through 2025–2026 under QCB's FinTech Strategy.
Ongoing admissions; formal open banking regulation anticipated 2026
CBUAE Federal Central Bank Law 2025: Compliance Transition
Federal Decree-Law No. 6 of 2025 introduced a comprehensive overhaul of the UAE Central Bank Law, with a one-year transitional compliance period expiring 16 September 2026. Licensed payment institutions, digital banks, and open finance participants must confirm full alignment with updated licensing, governance, and prudential requirements before the deadline.
Transition deadline: 16 September 2026
SAMA: Open Banking Full Licensing
SAMA announced transition from sandbox to full licensing programme on 26 March 2026. First fintechs licensed 8 April 2026. Strict governance, cybersecurity, API performance and consent management requirements apply.
Active April 2026
SAMA: Payment System Oversight Framework, Circular 472047719
Issued March 2026, replacing the 2021 Payment and Settlement System Oversight Framework. SIPS operators required to conduct annual self-assessments per CPMI-IOSCO standards and publish public disclosure summaries.
Issued March 2026
CBUAE: Updated AML/CFT/CPF Guidance
Comprehensive update issued April 2026 covering proliferation financing risk, enhanced correspondent banking due diligence, trade finance monitoring expectations and dynamic ongoing risk monitoring replacing static screening.
Issued April 2026
UAE Federal VASP Law: New Licensing Framework
Decision 4/R.M/2026 issued February 2026. Replaces 2023 VASP framework with comprehensive three-module regulatory guide covering eight licensed virtual asset activities. Existing licensees must comply by February 2027.
Issued February 2026
Global
Project Aperta: Open Finance Blueprint Released as Public Good
Completed in June 2026 under BIS leadership, Project Aperta released all architectural blueprints, trust framework designs, and reference code as open public goods. The interoperability layer connects domestic open finance networks across the UAE, UK, Brazil, and Hong Kong without requiring changes to national frameworks.
Completed June 2026
FATF Travel Rule: Cross-Border Transfers and Virtual Assets
Recommendation 16 requires originator and beneficiary information to accompany cross-border wire transfers above thresholds. Extended to virtual asset transfers under updated FATF guidance, with inconsistent VASP implementation creating sunrise problem compliance gaps.
Ongoing implementation
Visa VAMP: New Acquirer Monitoring Thresholds 2026
New CNP fraud and dispute thresholds from 1 January 2026. Acquirers required to maintain fraud and dispute ratios below 0.5% on card-not-present transactions. Excessive merchant threshold reduced to 1.5% from April 2026.
Active January 2026
Mastercard: 72-Hour Suspicious Merchant Investigation
From July 2026, acquirers and payment facilitators must actively monitor merchant behaviour and initiate investigation within 72 hours when indicators reach Mastercard's risk threshold. Confirmed fraudulent activity requires merchant suspension from Mastercard acceptance.
Active July 2026
Need regulatory compliance advice?
Our team advises payment institutions on practical compliance and commercial response to regulatory change.