Today's Focus: Financial Regulation & Compliance — Friday, 24 July 2026

ESMA's Guidelines on the assessment of knowledge and competence under MiCA (ESMA35-24871704-2922) begin to apply on 28 July 2026 — four days away. Issued under Article 81(15)(a) of MiCA and published in multilingual form on 28 January, they require crypto-asset service providers to ensure client-facing staff meet defined standards: a qualifying professional qualification of at least 80 hours plus six months supervised experience, or at least one year of appropriate supervised experience. This is the final staff-facing milestone of the MiCA transitional wind-down, whose services transitional period ended 1 July. CASPs that cannot evidence qualifications or supervised-experience records for advising staff risk findings from national competent authorities. Source

FCA flags weak oversight of outsourced due diligence at asset managers. The FCA published good and poor practice findings on financial-crime controls at asset management and alternative firms on 22 July, drawn from engagement with 242 firms. Around 40% outsource some CDD/EDD, but only about 36% of those showed full oversight of the third party's AML onboarding, and over a quarter had no formal transaction-monitoring process. It sets supervisory expectations rather than changing any rule. Benchmark your third-party CDD/EDD oversight and transaction monitoring against the findings and document remediation. Source

OCC orders BSA/AML remediation at United Texas Bank. The OCC's July enforcement release includes a Cease-and-Desist Order (docket AA-ENF-2026-29) against United Texas Bank, N.A., Dallas, for BSA/AML program deficiencies. Entered on consent alongside the bank's conversion to a national charter, it carries forward remediation from a prior August 2024 order with the Dallas Fed and the Texas Department of Banking. A reminder that AML obligations follow an institution through a change of charter or primary regulator. Source

Still no final GENIUS Act stablecoin rules — statutory text governs. No final implementing rule appeared after the 18 July one-year rulemaking deadline. The joint permitted payment stablecoin issuer customer identification program NPRM remains at proposal stage, with its comment window running into August. The statutory effective-date backstop of 18 January 2027 is unchanged. Keep building to the statute and outstanding proposals rather than assuming imminent final rules. Source

Confirm your client-facing crypto staff meet the MiCA knowledge-and-competence criteria and that the evidence is documented before 28 July — qualification records or supervised-experience logs are exactly what national competent authorities will ask to see.

The daily rests over the weekend and returns Monday with cybersecurity, data security and cloud security — the combined week-opening security briefing.

CyberEyeQ — Actionable Regulatory Intelligence · Questions: [email protected] · Upgrade: cybereyeq.com