The MFSA issued three notable updates in August 2026, signalling a continued focus on strengthening operational resilience while streamlining regulatory requirements and modernising supervisory reporting. The updates cover AI-driven cyber threats, investment services requirements, and the transition to digital regulatory reporting.
The MFSA issued three notable updates in August 2026, signalling a continued focus on strengthening operational resilience while streamlining regulatory requirements and modernising supervisory reporting. The updates cover AI-driven cyber threats, investment services requirements, and the transition to digital regulatory reporting.
- AI & Cybersecurity: The MFSA has highlighted the emerging threat posed by Frontier Artificial Intelligence Models (FAIMs), urging Licence Holders to assess whether existing ICT risk management, cybersecurity, incident response and third-party risk frameworks remain effective as AI enables faster and more sophisticated cyberattacks. While no new regulatory requirements are introduced, firms are expected to consider these developments within their existing frameworks.
- Investment Services: Amendments to the Investment Services Rules significantly streamline requirements for CFD and rolling spot forex firms, including the removal of the €750,000 capital requirement, the 10% regulated shareholder requirement, certain proprietary IT requirements and the “Trading Organisation” definition. At the same time, the MFSA is strengthening expectations around competence, independent risk management, and due diligence over liquidity providers and counterparties.
- HRRF & Regulatory Reporting: The MFSA and FIAU have released draft technical documentation for the Home Grown Returns Framework (HRRF), marking the transition towards JSON-based regulatory reporting for Financial Institutions and CASPs. A converter tool and early release of the specifications are intended to give firms and their technology providers time to prepare for the new reporting architecture.
Taken together, the updates demonstrate a clear supervisory direction: greater technological resilience and accountability, alongside more proportionate regulatory requirements and increasingly digitalised reporting processes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
