Regulation

UK regulators have proposed a dedicated, proportionate framework for captive insurers, offering streamlined authorisation and lighter capital and reporting requirements to encourage companies to self-insure risks domestically.

The Financial Conduct Authority has launched a nationwide campaign telling UK consumers they do not need to pay claims firms to seek compensation under the coming motor finance redress scheme.

The Bank of England's July Financial Stability Report warned that valuations in equities, sovereign debt and private credit markets appear stretched, leaving the financial system exposed to a sharp correction, while flagging rising AI-related cyber risks.

The Monetary Authority of Singapore has issued a consultation paper proposing new requirements for financial institutions, part of a steady stream of 2026 reforms aimed at strengthening oversight of insurers, banks and the wider sector.

India's SEBI chairman said the Reserve Bank of India and insurance regulator IRDAI remain reluctant to allow banks and insurers into commodity derivatives trading, pausing a push to broaden participation in the market.

The Financial Conduct Authority says a package of measures to streamline its rulebook for asset managers will cut industry costs by about £128 million a year, part of a broader drive to reduce regulatory burden.

A senior Reserve Bank of Australia official has outlined how the central bank is working with the country's large superannuation industry to address the changing risks facing the multi-trillion-dollar retirement-savings sector.

The Bank of England's July Financial Stability Report flags intensifying cyber risk, with 82% of surveyed firms citing cyberattacks as a top-five systemic threat, while keeping the countercyclical capital buffer at 2%.

UK financial regulators have started overseeing the first designated Critical Third Parties, extending resilience supervision to major technology and cloud providers whose services underpin banks, insurers and markets.

Britain's Financial Conduct Authority announced on July 23 that it has decided to ban a father and son from working in financial services following findings of fraud and the misuse of client money.

Australia's corporate regulator secured $830 million in court-ordered civil penalties and $644 million in consumer remediation in 2025-26, roughly eight times the previous year, with insurance claims handling under scrutiny.

India's insurance regulator has revised remuneration norms so that a significant portion of variable pay for insurance CEOs and senior executives depends on claims settlement speed, grievance redressal and broader policyholder outcomes.

Australia's prudential regulator has opened consultation on a set of updates to its prudential and reporting framework covering banks, general, life and private health insurers and superannuation licensees, and granted a foreign banking licence to Taipei Fubon Commercial Bank.

The Bank of England's July Financial Stability Report flagged rising leverage in equity markets tied to AI-linked stocks and warned that rapid advances in frontier AI are increasing cyber and operational risks across the financial system.

Reserve Bank of Australia officials turned attention to the resilience of the payments system and broader financial-system risks, as the central bank weighs modernisation of payments policy ahead of its August rate decision.

The Reserve Bank of India has proposed a one-time approval mechanism that would let mutual funds, insurers and pension funds increase major shareholdings in the same bank without seeking fresh clearance each time.

The Monetary Authority of Singapore is consulting on a protected cell company framework designed to support the growth of alternative risk transfer solutions in the insurance sector.

The Bank of England's July Financial Stability Report judged the UK financial system resilient despite Middle East-driven volatility, while warning about rising equity-market leverage, private credit and AI-related operational risks.

The UK's Financial Conduct Authority has published final rules for a comprehensive cryptoasset regime covering trading platforms, custodians and stablecoin issuers, with the mandatory framework due to take effect in October 2027.

Britain's Financial Conduct Authority has published its latest Primary Market Bulletin, clarifying expectations on voting-rights disclosures and notifications for significant transactions under the UK Listing Rules.

India's insurance regulator has recommended tying insurer CEO remuneration to customer grievances and outcomes, part of a broader governance push to improve service quality and protect policyholder value.

APRA has released a wide-ranging consultation proposing amendments across 10 prudential standards and 15 reporting standards affecting banks, general, life and health insurers and superannuation funds, with feedback due in August.

Australia's prudential regulator has opened consultation on a package of updates to its rules for banks, general, life and health insurers and superannuation funds, including a securitisation capital correction.

Australia's prudential regulator has released a consultation package proposing amendments across 10 prudential standards and 15 reporting standards, with several changes carrying real operational impact for banks and insurers.

From 13 July 2026, four major global cloud and technology providers are designated Critical Third Parties, allowing the Bank of England, PRA and FCA to jointly oversee the critical services they supply to UK financial firms.

The Bank of England's July Financial Stability Report says frontier AI is heightening cyber and operational risks while stretched AI-linked equity valuations could trigger a sharp market correction with knock-on effects for UK growth.

Australia's prudential regulator released a consultation package on 10 July proposing amendments across 10 prudential standards and 15 reporting standards, with several items carrying real operational impact for banks and insurers.

The Financial Conduct Authority has released a landmark review into how artificial intelligence is reshaping retail financial services, as regulators weigh consumer protection against the drive for innovation and growth.

The Federal Reserve has requested public comment on a proposal to amend requirements for the anti-money-laundering programs that banks must maintain, part of a broader push to modernize compliance obligations.

Australia's prudential regulator has released a consultation package of technical amendments to its rules for banks, general, life and health insurers and superannuation licensees, with several changes carrying real operational impact.

The UK's Financial Conduct Authority says it led an international crackdown on illegal financial influencer promotions, resulting in three arrests and 650 social media takedown requests, alongside insider-dealing convictions.

The Federal Reserve is seeking public comment on a proposal to amend its requirements for banks to maintain anti-money-laundering programs, part of a broader effort to modernise financial-crime rules.

The Bank of England's Financial Stability Report warned that leverage in bond and equity markets, rapid growth in private credit and stretched valuations pose risks, even as it judged the UK system broadly resilient.

The Federal Reserve has asked for public comment on a proposal to amend the requirements banks must follow when maintaining anti-money-laundering programs, part of a broader effort to make compliance more risk-focused.

The Monetary Authority of Singapore has launched a consultation on a protected cell company framework and a collateralised reinsurance structure, aiming to deepen its role as a hub for insurance-linked securities.

The Upper Tribunal has suspended parts of the Financial Conduct Authority's £7.5 billion motor finance compensation scheme on terms agreed with four challengers, though firms must still comply with the rules that remain in force.

Germany's financial regulator BaFin has issued a run of penalties for market-abuse and disclosure failures, underscoring a tougher stance on corporate transparency and investor protection.

Canada's banking regulator is maintaining its loan-to-income limits on mortgage lending and flagging that a challenging trade environment is weighing on growth and borrowers, heightening credit risks for banks.

From July 15, Buy Now, Pay Later products in the UK will fall fully under Financial Conduct Authority oversight, requiring affordability checks, clearer disclosures and access to the Financial Ombudsman for disputes.

A UK tribunal has suspended parts of the Financial Conduct Authority's industry-wide motor finance compensation scheme, on terms agreed with four challengers, while firms must still comply with the rules that remain in force.

The Reserve Bank of India's revised rules governing banks' exposure to capital markets took effect on July 1 after being pushed back by three months, giving lenders and market intermediaries more time to prepare.

The Monetary Authority of Singapore is consulting on proposed changes to its technology risk management rules, aiming to strengthen financial institutions' resilience as digitalisation and cyber threats grow.

The UK Financial Conduct Authority's new 'targeted support' regime took effect on April 6, 2026, allowing banks, pension providers, and investment firms to offer ready-made recommendations to groups of consumers with similar characteristics — without a full individual advice assessment. The FCA estimates that over the next decade at least 18 million people could receive extra help with pensions and investment decisions, addressing a persistent gap where fewer than 1 in 10 UK adults take regulated financial advice.

The Australian Prudential Regulation Authority's finalized amendments to Prudential Standard CPS 230 Operational Risk Management take full effect on July 1, 2026. The changes introduce limited contractual exemptions for material arrangements with non-traditional service providers — such as central banks and clearing facilities — while preserving the core operational resilience framework that applies to insurers, banks, and superannuation funds.

The US Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) took effect in May 2026, requiring covered critical infrastructure entities to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. The mandate is accelerating demand for cyber insurance and reshaping how businesses, insurers, and regulators respond to a threat landscape where AI is intensifying both attack sophistication and underwriting complexity.

The National Association of Insurance Commissioners (NAIC) confirmed on June 25 that data taken from its IT systems has been published online by the ShinyHunters extortion group, which exploited a zero-day vulnerability in Oracle PeopleSoft. The NAIC says no personally identifiable information or payment data was accessed, while the group claims to have stolen 3.1 terabytes of regulatory filings and credit rating agency files.

North Carolina Governor Josh Stein signed House Bill 315, the 'Prohibit Litigation Investments Act,' into law on June 22, making the state the first in the nation to enact an outright ban on third-party litigation funding rather than merely regulating disclosure. Insurance industry groups have hailed the move as a major step against what they call 'legal system abuse,' while litigation finance firms warn it could restrict access to justice.

The Australian Prudential Regulation Authority's amended CPS 230 Operational Risk Management standard takes full effect on July 1, 2026, introducing limited contractual exemptions for certain non-traditional service providers such as central banks and clearing facilities. Insurers, banks, and superannuation funds must review their material service provider portfolios and update their registers before the deadline as Australia's landmark operational resilience framework reaches full implementation.

The National Association of Insurance Commissioners (NAIC) confirmed on June 25 that data stolen in a cyberattack on its Oracle PeopleSoft system has been published online by the responsible group. The extortion group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) and claims to have obtained 3.1 terabytes of data, though the NAIC maintains no personally identifiable or payment information was accessed and the group does not hold the scope of data it claims.

Australia's landmark operational resilience standard, Prudential Standard CPS 230, takes full effect on July 1, 2026, including finalised amendments providing limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities. Insurers, banks, and superannuation trustees face an immediate deadline to ensure their Material Service Provider registers and contractual arrangements comply with the framework designed to strengthen resilience against operational disruptions and cyber incidents.

North Carolina has become the first US state to pass an outright ban on third-party litigation financing, making it unlawful for outside investors to fund lawsuits in exchange for a share of any award. The move is significant for insurers, who have long argued that litigation funding fuels 'social inflation' and drives up claims costs — a trend the industry has increasingly cited as a key driver of rising premiums across casualty lines.

The National Association of Insurance Commissioners (NAIC) has confirmed that data stolen in a June ransomware attack via an Oracle PeopleSoft zero-day vulnerability has been published online by the ShinyHunters group, which claims to have taken 3.1 terabytes of data across more than 105,000 files. The NAIC says no personally identifiable information or payment data was accessed, though credit rating agencies have paused data feeds, temporarily suspending the assignment of insurer investment designations.

Australia's landmark operational risk standard, Prudential Standard CPS 230, takes full effect on July 1, 2026, following final amendments by the Australian Prudential Regulation Authority (APRA). Insurers, banks, and superannuation funds must have updated their Material Service Provider registers and compliant contractual arrangements by the deadline, with newly finalized exemptions for certain non-traditional service providers such as central banks and clearing facilities.

The US National Association of Insurance Commissioners (NAIC) confirmed on June 25 that data stolen in a cyberattack on its Oracle PeopleSoft system has been published online by the hacking group ShinyHunters. The breach, discovered on June 11, exploited a zero-day vulnerability and is part of a broader campaign affecting more than 100 organizations. The NAIC says no personally identifiable information or payment data was accessed, though credit rating agencies have paused data feeds.

The European Central Bank has warned that euro-area insurers and pension funds would be hit harder than banks in a severe private credit market shock, as the rapid, AI-fuelled expansion of the near-$2 trillion sector raises financial stability concerns. The ECB stress scenario found insurers could suffer losses of around 4% of assets, with the regulator drawing an explicit comparison between the US private credit market and the pre-crisis subprime mortgage market.

UK insurers face a June 30, 2026 deadline to have a compliant Solvent Exit Analysis in place under the Prudential Regulation Authority's new requirements, with the extensive preparatory work proving complex and time-consuming for many firms. The deadline is part of a broader 2026 UK regulatory agenda that includes the PRA's climate risk expectations and the FCA's first annual insurance Regulatory Priorities report.

Australia's landmark CPS 230 Operational Risk Management standard takes full effect on July 1, 2026, requiring banks, insurers, and superannuation funds to demonstrate resilience to operational disruptions including cyber incidents and third-party failures. The deadline arrives as APRA's finalised amendments — introducing limited exemptions for non-traditional service providers — also commence, marking the culmination of a multi-year implementation program.

Germany's financial regulator BaFin has issued a circular confirming the legal permissibility of ransom insurance under German supervisory law, consolidating prior regulatory requirements and providing clarity for insurers and policyholders. The move comes alongside an expansion of BaFin's investigative powers under new legislation effective March 31, 2026, and follows the regulator's third cyber insurance market survey flagging systemic accumulation risks.

Euro Exchange Securities UK Ltd, a British electronic-money institution, handled at least £2 billion ($2.7 billion) for a small group of high-risk customers before the Financial Conduct Authority moved to force it into administration over money-laundering concerns. Court filings reveal that almost all of more than 20,000 payments totalling £2.1 billion in a single year were made on behalf of just 14 clients the firm itself had assessed as 'high risk', highlighting the FCA's intensifying crackdown on weak anti-crime controls in the UK payments sector.

The UK Financial Conduct Authority continues to rely on its outcomes-focused Consumer Duty regime to drive fair value in insurance, with its Premium Finance Market Study confirming average APRs on monthly insurance payment plans have fallen 4.1% since 2022. The regulator declined to impose a sector-wide APR cap, opting instead for targeted supervisory engagement, while advancing a broader 2026 agenda including distribution chain reforms and investment product disclosure changes.

Australia's Prudential Regulation Authority (APRA) finalized targeted amendments to Prudential Standard CPS 230 Operational Risk Management, taking full effect July 1, 2026. The changes introduce limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities, and require insurers, banks, and superannuation funds to update their Material Service Provider registers ahead of the looming deadline.

China's National Financial Regulatory Administration (NFRA) has set out a new regulatory framework for insurance asset management, establishing requirements across four key pillars. The regulator stressed that firms must pursue high-quality development and compete in an orderly way to prevent market chaos, signalling tighter oversight of how Chinese insurers manage their substantial investment portfolios.

The Australian Prudential Regulation Authority's finalised amendments to Prudential Standard CPS 230 Operational Risk Management take effect on July 1, 2026, introducing limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities. Insurers, banks, and superannuation funds are racing to update their Material Service Provider registers and reporting processes before the deadline.

Australia's Prudential Regulation Authority (APRA) is in the final countdown to the July 1, 2026 commencement of its amended CPS 230 Operational Risk Management standard. Insurers, banks, and superannuation trustees must update their Material Service Provider registers and reporting processes to reflect new limited exemptions for non-traditional service providers such as central banks and clearing facilities before the deadline.

The Insurance Regulatory and Development Authority of India (IRDAI) proposed a new framework on June 17, 2026, mandating public consultation, periodic three-year reviews, and greater transparency in framing insurance regulations under the Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025. The draft codifies stakeholder engagement practices and requires cost-benefit assessment of proposed rules, with comments invited until July 8, 2026.

Australian insurers, banks, and superannuation funds are in the final stretch of preparations ahead of the July 1, 2026, commencement of APRA's amended CPS 230 Operational Risk Management standard. The finalized amendments, released April 30, introduce limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities, while requiring all regulated entities to update their Material Service Provider registers before the deadline.

UAE insurers, banks, and fintech firms face a September 16, 2026, deadline to align with the country's landmark consolidated Central Bank Law (Federal Decree-Law No. 6 of 2025), which came into force in September 2025. The overhaul consolidates banking and insurance regulation under the CBUAE, widens the regulatory perimeter to capture insurtech and digital platforms, and raises the maximum administrative fine fivefold to AED 1 billion.

The Insurance Regulatory and Development Authority of India (IRDAI) has proposed a broad set of amendments to regulations governing insurer registration, capital structure, share transfers, and amalgamations, aimed at improving ease of doing business. The proposals — open for stakeholder comments until July 6, 2026 — include clarified approval thresholds for shareholding increases, streamlined merger frameworks, and reduced transaction fees, following India's recent move to allow 100% foreign investment in the sector.

The UK's Financial Conduct Authority is expanding its scrutiny of the home and travel insurance markets in 2026 in response to a super-complaint lodged by consumer group Which?. While the FCA rejected calls for a joint legal review of consumer protection frameworks, it committed to reviewing claims handling, oversight of third-party claims handlers, and how products are sold across insurers, brokers, and price comparison websites.

The European Central Bank warned in its May 2026 Financial Stability Review that European insurers and pension funds would be hit harder than banks by a severe private credit market shock. In an illustrative stress exercise, the ECB found that insurers faced the largest absolute impact — around 4% of assets — because their private credit exposures are larger, less senior, and more exposed to broader market repricing. Pension funds would suffer 5-6% asset losses, while bank losses would stay contained at no more than 1.3% of equity.

India's insurance regulator IRDAI is rolling out a wave of structural reforms aimed at modernising the country's $146 billion insurance sector. The flagship initiative is Bima Sugam — a non-profit, industry-owned digital marketplace functioning as the 'UPI of insurance' where customers can compare, buy, and manage policies, with the first commercial use case targeted for 2026. IRDAI is also moving to a dynamic Risk-Based Capital framework to replace the formula-based regime, mandating Indian Accounting Standards adoption, and overhauling commissions to curb mis-selling.

The Insurance Regulatory and Development Authority of India has amended its Corporate Governance for Insurers Regulations to tie the variable pay and incentives of CEOs and other key management persons directly to customer-centric outcomes. Under a circular that takes effect immediately, performance parameters now include claim responsiveness, timely grievance redressal, product performance, financial soundness, and the removal of dark patterns from insurer and distributor websites. The move, which industry executives describe as a tightening of an already stringent framework, shifts executive accountability beyond financial growth toward measurable policyholder welfare.

The Regional Court of Munich issued a temporary injunction holding Google directly liable for false claims generated by its AI Overviews, ruling that AI-generated summaries are Google's own content rather than protected search results. The decision (Case 26 O 869/26) rejected Google's argument that users could check sources themselves and that disclaimers shield liability. Legal and insurance analysts say the principle is a direct warning to insurers that have embedded generative AI into chatbots, claims summaries, and underwriting tools: you own the output, and disclaimers will not protect you.

The National Association of Insurance Commissioners is intensifying scrutiny of the credit ratings on complex private-credit and infrastructure securities — including debt funding the AI data center buildout — held by US insurers. Since January 1, 2026, the NAIC's 'discretion amendment' has empowered regulators to challenge and override ratings that differ from their own analysis by more than three notches. With privately placed bonds now representing 23.4% of insurers' admitted bonds, up from 18.3% in 2021, the regulator is questioning whether the ratings underpinning these attractive assets are robust enough to survive closer examination.

US state insurance regulators, through the NAIC, have launched a review of the credit ratings underpinning data center and private-credit investments held by insurers — a fast-growing slice of insurer balance sheets fueled by the AI infrastructure boom. Since January 1, 2026, the NAIC has held the power to challenge and override third-party credit ratings that differ from its own analysis by more than three notches. With privately rated bonds now representing 23.4% of insurers' total admitted bonds, the scrutiny strikes at the heart of the private-assets surge.

The UK Financial Conduct Authority (FCA) published its final findings from its landmark Premium Finance Market Study in February 2026, confirming that the average annual percentage rate (APR) on insurance premium finance has fallen by 4.1% since 2022, driven by Consumer Duty supervisory pressure. The regulator stopped short of imposing a sector-wide APR cap but committed to continued targeted enforcement and monitoring, maintaining pressure on firms that are not delivering fair value.

The Australian Prudential Regulation Authority (APRA) has finalised targeted amendments to Prudential Standard CPS 230 Operational Risk Management, effective July 1, 2026. The changes introduce limited contractual exemptions for certain non-traditional service providers — such as central banks and clearing facilities — responding to industry concerns while preserving the core objectives of the landmark operational resilience framework for insurers, banks, and superannuation funds.