Is Your Capital Model Ready for Basel III Endgame?

Today's Focus: Financial Regulation

The Fed, FDIC, and OCC's March 2026 Basel III Endgame re-proposal is now inside the final month of its comment window — June 18, 2026 is the deadline. The package would lower aggregate CET1 requirements for Category I/II banks by approximately 4.8%, for Category III/IV banks by 5.2%, and for smaller institutions by 7.8%. Combined with three parallel capital rule changes, the net effect for the largest banks is a 6% reduction in required capital — a significant pivot from the 2023 NPR that would have raised requirements substantially. June 18 is a hard cut-off: comments not received by then carry no weight with regulators. If your institution has modelled the capital impact of the revised standardized approaches, the trading book, or the operational-risk framework, this window is when that analysis shapes the final rule.

Fed re-proposal | ABA Banking Journal | PwC Capital Reform

MiCA hard deadline: 40 days for unauthorized CASPs to wind down. ESMA's April 17, 2026 supervisory statement confirmed July 1, 2026 as a non-negotiable cut-off — after that date, any crypto-asset service provider operating in the EU without a MiCA licence is in breach of EU law. ESMA has directed NCAs to scrutinize last-minute authorization applications and enforce actively against unauthorized operators. Unauthorized CASPs must have an executable wind-down plan ready now, including client offboarding and asset-transfer arrangements. Authorized CASPs must complete EU client migration before July 1. Administrative fines can reach €5 million or 3% of annual turnover, plus criminal liability for executives. ESMA MiCA page

UK BNPL: TPR window closes July 1 — criminal offense from July 15. The FCA's Deferred Payment Credit registration window opened May 15 and closes July 1, 2026. From Regulation Day (July 15, 2026), operating without authorization or TPR registration is a criminal offense. Core obligations from PS26/1: creditworthiness assessments on every DPC transaction, upfront payment schedule disclosures, and fair treatment in arrears. FCA BNPL | PS26/1

DORA: First formal enforcement actions expected in 2026. NCAs submitted Registers of Information to the ESAs by March 31, 2026. The ESAs are using that snapshot to identify systemic ICT third-party risks and queue inspections. Enforcement for DORA reporting failures is expected in late 2026. Financial entities should confirm NCA submission accuracy, verify ICT incident-reporting procedures are live, and ensure third-party risk management frameworks are audit-ready. EBA DORA

US Basel III Endgame comment deadline — June 18, 2026 (27 days). Final window to influence a capital re-proposal that reduces CET1 requirements by 4.8–7.8% across bank categories. Comments received after this date carry no regulatory weight.

Assign an owner to your Basel III Endgame comment letter today. Identify which desk is most affected — credit risk, market risk, or operational risk — and confirm that analysis reaches regulatory counsel before June 18. If you operate a BNPL product in the UK, confirm your FCA TPR registration is in progress before July 1.

Monday we're back with Cybersecurity, Data Security & Cloud Security — the week's enforcement actions, the UK Cyber Security and Resilience Bill's progress, and new CISA KEV additions with compliance deadlines.

CyberEyeQ — Actionable Regulatory Intelligence
Questions or feedback? [email protected]