Ongoing Developments in Financial Services Regulation in the EU and UK – Part I Investor Services A year has passed since we last compared developments in financial services regulation in both the European Union (EU) and the United Kingdom (UK). This included where the respective jurisdictions were diverging and where they were progressing towards similar policy objectives, albeit with different approaches (for example, prescription versus outcomes-based regulatory regimes). This year, as we revisit these evolving topics, and cover the latest policy developments, we have split our update into three complementary articles. In this first article we look at technological and innovation related developments. Following the approach in our previous article , looking at the concept of managed divergence and acknowledging the importance of keeping (from a regulatory perspective) clear lines of communication open, we begin by looking at the latest meeting of the Joint EU-UK Financial Regulatory Forum (the 5th Forum), held on 11 March 2026. The 5th Forum The agenda at the latest meeting focused primarily around six themes: • The policy outlook; • Macroeconomic and financial stability outlook; • Banking; • Digital finance; • Markets reform; and • Sustainable finance. At the meeting, the EU and the UK delegations exchanged views on how evolving market developments in financial sector digital innovation are shaping their respective domestic approaches and the opportunities and challenges posed by digital assets. Participants also predominantly agreed on the importance of working within international fora to further develop digital innovation analysis to inform policy work and supervisory approaches. Finally, the EU and UK delegations noted the growth and innovation potential of digital assets while continuing multilateral engagement to assess associated risks and benefits, particularly in cross-border contexts. Central Bank Digital Currencies The EU has continued to advance work on the digital euro over the past year. On 23 June 2026, the Economic and Monetary Affairs Committee (ECON) in the European Parliament adopted its position on the single currency package , consisting of three files, including the establishment of the digital euro. Interinstitutional negotiations began in July, with the aim of reaching a final agreement on the legislative text by year-end. If implemented, the digital euro would be a new, electronic form of money issued by the European Central Bank (ECB) and would work both online and offline. According to ECON, online payments would be processed through an account- based system, while offline payments would work directly via local storage devices. Therefore, offline functionality would be equivalent to using physical cash, and like physical cash, losing the device would mean losing the offline money with essentially no refund possible. Ongoing Developments in Financial Services Regulation in the EU and UK – Part I | 2 As outlined by the ECB, the final decision on whether to issue a digital euro, and on what date, lies with the EU legislature. The ECB said that, under the assumption that EU co-legislators will adopt the Regulation on the establishment of the digital euro in the course of 2026, a pilot exercise and initial transactions could take place in mid-2027. The ECB says that the whole Eurosystem should then be ready for a potential first issuance of the digital euro during 2029. In the UK, the Bank of England (BoE) published an update on the digital pound project during March 2026, detailing its progress in the design phase of the project over the previous year, as the BoE and HM Treasury continue to explore the potential of a digital pound that would be used by households and businesses for everyday payments. At the time of writing no decision has been made on whether to introduce the digital pound, with the current design phase still ongoing and not expected to end until later in 2026. However, the BoE says that, drawing on the evidence being developed through its assessment, blueprint work, technology experiments, and engagements with industry, academia and civil society, it and HM Treasury intend to set out their decision on next steps by the end of 2026. Stablecoins The development of stablecoin regulation reflects their growing importance in financial markets, enabling fully on-chain settlement of digital transactions in the absence of central bank digital currencies, as well as offering a less volatile version of digital money compared to crypto-assets such as bitcoin. In the UK, the regulators have taken a phased approach in their development of the UK’s stablecoin regime. On 22 June 2026, the BoE published a policy statement and draft rules on regulating systemic stablecoins, e.g., those that are widely used in payments and may therefore pose risks to UK stability. The BoE said that its draft rules formed a framework supporting safe innovation, enabling UK issued stablecoins to develop as trusted forms of digital money. Under the UK stablecoin regime, the Financial Conduct Authority (FCA) will regulate the issuance, custody, admission to trading, and use in payments of UK-issued stablecoins. Systemic stablecoins will be jointly regulated by the FCA and the BoE, likely with the BoE setting prudential rules, backing asset requirements and temporary issuance guardrails. And although the regime primarily applies to UK-issued stablecoins backed by sterling, non-sterling stablecoins may also be captured should their use become widespread in the UK. On 30 June 2026, the FCA published the results of its consultations on its proposed rules and guidance for the activities of issuing a qualifying stablecoin and safeguarding qualifying crypto-assets, including qualifying stablecoins. The rules aim to help ensure regulated stablecoins maintain their value, and that customers should be provided with clear information on how the backing assets are being managed. In the EU, the regulation of stablecoins falls under the Markets in Crypto-Assets Regulation (MiCA). Although not using the specific term stablecoin, MiCA’s rules cover crypto-assets designed to maintain a stable value, with specific rules for asset reference tokens – tokens backed by a basket of assets, such as currencies, commodities, or other crypto-assets – (ARTs) and e-money tokens – tokens backed by a single fiat currency such as euro – (EMTs). The issuer of ARTs must be established in the EU and must either have obtained a licence from a national competent authority or already be licensed as a credit institution. EMT issuers must be credit institutions or electronic money institutions. The European Securities and Markets Authority (ESMA) is required to maintain a register of stablecoins authorised under MiCA. As of the end of June 2026, no ARTs have been authorised compared with 40 EMTs. Crypto-Assets The ongoing rapid growth of crypto-assets has been met by law makers with a range of policy responses, some focused largely on enabling growth while others focus more on mitigating potential risks. As previously stated, the regulation of crypto-assets in the EU mostly falls under MiCA. Beyond the issue of stablecoins, MiCA regulates crypto-asset issuers and crypto-asset service providers (CASPs), such as exchanges, trading platforms, and custodian wallet providers. The core elements of MiCA cover: licencing and authorisations of issuers and CASPs, capital reserves, the production of white papers, and consumer protection. However, MiCA does not extend to financial instruments 1 , including tokenised fund units that are already regulated under the Undertakings for Collective Investment in Transferable Securities (UCITS) Directive and Alternative Investment Fund Managers Directive (AIFM D) . On 20 May 2026, the European Commission (Commission) launched a consultation on the functioning of MiCA since it came into force in 2024. The consultation period closes on 30 September 2026, and the feedback is intended to be used to consider and develop the EU’s future policy work in respect of crypto-assets. While MiCA is now fully applicable across the EU, the UK’s crypto-asset regulatory framework is still being implemented. During October 2027, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 will come into force. Extending new powers to the FCA, the regulations will require all firms conducting crypto-asset activities in the UK to be authorised to do so, with the application gateway opening at the end of September 2026. The activities captured by the regulations include operating trading platforms, safeguarding, dealing, arranging, lending, and staking, and apply to all approved UK-based firms serving any recognized market and overseas firms providing services to UK consumers. And as mentioned in the above Stablecoins section, at the end of June 2026, the FCA published a series of policy statements and final rules on its crypto-assets regime. The regime, developed following four discussion and ten consultation papers between 2023 and 2026, covers: • Admissions and disclosures and market abuse for crypto- assets (PS26/9); • Stablecoin issuance (PS26/10); • Regulated crypto-asset activities (PS26/11); Ongoing Developments in Financial Services Regulation in the EU and UK – Part I | 3 • A prudential regime for crypto-asset firms (PS26/12); and • Application of the FCA Handbook for regulated crypto-asset activities (PS26/13 ) . In addition, the FCA published two consultation papers on draft guidance relating to: • Its expectations around the purpose and scope of the overall risk assessment for firms captured by the Core Prudential sourcebook (COREPRU) ( GC26/4 ); and • Its expectations around the purpose and scope of the overall risk assessment for firms captured by the sector specific prudential requirements for firms doing regulated crypto- asset activities as set out in the Cryptoassets Regulations detailed in the Prudential sourcebook for CRYPTOPRU Firms (CRYPTOPRU) ( GC26/5 ). The consultation period for both papers ran until 20 July 2026. The FCA said, in both consultation papers, that it plans to publish the finalised guidance by the end of September 2026. Fund Tokenisation Despite the UK rules being technologically neutral, on 14 October 2025 the FCA consulted on guidance on the use of distributed ledger technologies (DLT) in the issue and registration of authorised fund (UCITS, Non-UCITS retail schemes, Qualified Investor Schemes, and Long-Term Asset Funds) units, with the aim of providing clarity to UK fund managers. Based on the interim report from the Technology Working Group to the Asset Management Taskforce – UK Fund Tokenisation: A Blueprint for Implementation – the FCA proposed detailed guidance on the maintenance of fund registers operating on DLT based systems. Of note is the guidance on unilateral updates to the register. One of the key benefits of DLT/blockchain based systems is that the records are immutable, however the firm operating a fund register must be able to alter records in certain events such as; the death of the unitholder, mandatory redemptions, errors or fraud, etc. The proposals provide firms with guidance on their ability to burn or mint tokens to amend unitholder records where necessary. 2 The consultation period closed on 21 November 2025 and the FCA published its feedback statement and final rules on 30 April 2026. In 2022 the EU established a Pilot Regime for market infrastructures based on DLT . The regulation aims to ensure that EU financial services legislation is adapted for the digital age, promoting the use of innovative technologies like DLT in the financial sector, including the issue of fund units. Originally launched as a three-year trial commencing in March 2023, ESMA recommended in 2025 that the regime be extended and made permanent. With respect to the issue of fund units, the Pilot Regime is only available to UCITS with a market value of assets under management of EUR 500m or less. This may explain why, in its 2025 report to the Commission, ESMA identified limited uptake by UCITS operators. In the Republic of Ireland, the Central Bank published a discussion paper on DLT and tokenisation in financial services. The Central Bank notes that Ireland is one of the largest global domiciles for investment funds, hosting a significant proportion of money market funds (MMFs) and exchange- traded funds (ETFs). Although not proposing any new rules, the Central Bank discusses the impact tokenisation could have on fund liquidity management, and potential use cases for MMFs and ETFs. The period for comments on the discussion paper ended on 5 June 2026 and the Central Bank says it will publish a feedback statement outlining the insights it gathers and whether existing policy and regulatory approaches are appropriate to enable the realisation of the benefits – and management of the risks – stemming from the integration of DLT in financial services. However, the Central Bank has not given a timescale for this feedback statement. Artificial Intelligence As well as cautioning firms on the risks posed by artificial intelligence (AI) at the hands of malicious actors, regulators in the UK and EU have been keen to emphasise the benefits AI may bring, so long as its use is controlled, accountable, and understood. The EU’s AI Act is a comprehensive legal framework for AI that aims to promote safe, ethical, and human-centric AI, through a risk-based classification system for all AI systems developed, deployed, or operating within the EU. The AI Act also creates specific guardrails for general -purpose AI models, requiring developers to publish detailed summaries of their training data, respect EU copyright laws, and implement robust cybersecurity. Models carrying “systemic risks” face even heavier scrutiny regarding energy consumption and incident reporting. In parallel, the EU institutions have agreed amendments through the Digital Omnibus package delaying the application of key Annex III high-risk AI obligations until December 2027. The Commission is consulting on draft guidance on high-risk use cases, including creditworthiness assessments, which will be particularly important for financial institutions. Ongoing Developments in Financial Services Regulation in the EU and UK – Part I | 4 The EU AI Act is part of a wider package of policy measures to support the development of trustworthy AI, which also includes the AI Continent Action Plan, the AI Innovation Package and the launch of AI Factories. Together, regulators say that these measures are designed to protect safety, fundamental rights and human-centric AI, and strengthen uptake, investment and innovation in AI across the EU. Recent EU initiatives also increasingly seek to balance risk management with competitiveness, innovation and technological sovereignty. For example, the Commission has also proposed the Cloud and AI Development Act (CAIDA) as part of a broader technology sovereignty agenda designed to expand European AI and cloud infrastructure capacity. In the UK, a principles-based, technology neutral approach has been adopted, evaluating AI risks through existing frameworks, while demanding strict accountability, consumer protection, and resilience. Firms using AI should consider how their use of AI aligns with, for example, the FCA’s Consumer Duty, Senior Managers and Certification Regime, and operational resilience rules. Advanced AI models may also be subject to Prudential Regulation Authority (PRA) model risk regimes. In a speech delivered on 24 June 2026, Nikhil Rathi, FCA chief executive, stated that, as AI evolves faster than traditional regulation, the FCA is re-thinking what it means to be an effective regulator, with greater emphasis on competition, collaboration and system-wide risk awareness. This was followed by the Mills Review , published by the FCA on 6 July 2026. It was commissioned by the FCA Board and led by Sheldon Mills, Executive Director at the FCA. It provides an assessment of how advances in AI, specifically generative and agentic AI 3 , will reshape retail financial services by 2030 and beyond. In June, the FCA consulted on industry examples of good and poor practice in relation to AI use in financial services via its AI Input Zone . The responses to this consultation will inform an FCA publication on good and poor practice on AI later in 2026. As AI reshapes markets and increases interconnection, understanding how competition is evolving – and where that may impact resilience – will become more important than ever. Cyber Security While the EU’s Digital Operational Resilience Act (DORA) came into effect five years after the UK left the EU, the UK has developed a comparable regime through the Operational Resilience Framework and the Critical Third Parties (CTP) regime, and the UK incident reporting rules which come into full effect in March 2027 following a 12-month transitional period. This is understandable given the extra territorial nature of DORA (where UK firms providing services to EU consumers are captured) and where regulators will try to avoid differing approaches to the same outcome. On 7 July 2026, the Commission published its EU Action Plan on Cybersecurity and Artificial Intelligence , promoting the use of AI to strengthen cybersecurity capabilities while increasing expectations around AI-related cyber risk management, secure deployment and vulnerability remediation. The Commission is also progressing revisions to the EU Cybersecurity Act as part of a wider cyber package. One of the key debates is the interaction between horizontal cybersecurity obligations and sector-specific requirements under DORA. The cyber package and Digital Omnibus proposals also seek to streamline reporting obligations across DORA, Network and Information Security Directive and related frameworks through greater harmonisation and a single reporting entry point. In January 2026, the European Supervisory Authorities (European Banking Authority, European Insurance and Occupational Pensions Authority and ESMA – the ESAs) signed a Memorandum of Understanding with the BoE, the PRA, and the FCA. This agreement aims to enhance the cooperation between the authorities to oversee critical information and communications technology (ICT) third-party service providers as required by DORA and the CTP regime. On 15 May 2026, the BoE, the FCA, and HM Treasury, published a joint statement addressing the implications of rapidly evolving frontier AI models, i.e., cutting-edge, general-purpose AI systems that operate at the current limits of capability, for cyber security and operational resilience within regulated firms. The core message emphasises that while AI capabilities offer advancements, their malicious use can profoundly amplify cyber threats, necessitating proactive and robust risk management strategies from financial institutions. The statement outlines key areas where financial institutions must enhance their governance, risk identification, protection, and response mechanisms to safeguard against AI-driven cyber risks and maintain financial stability. In the EU, on 3 June 2026, the ESAs published their first report on major incidents relating to ICT as required by article 22 of DORA. The report provides an overview of major ICT related incidents that occurred in 2025. Major ICT related incidents are defined as ICT-incidents that have a high adverse impact on the network and information systems that support critical or important functions of financial entities. The report states that, overall, 3,383 major incidents (corresponding to an average of 0.18 major ICT related incidents per financial entity subject to DORA) were reported in 2025 across all financial sectors in the EU, with most of them occurring in the credit and payments sectors. The ESAs say such a concentration reflects differences in market structure, the existence of similar reporting requirements prior to DORA, and the highly digital and customer facing nature of services provided in these sectors rather than sector-specific weaknesses. Data collection Both EU and UK regulators have increased their collection of data from fund operators as the scope of regulations broadens and their supervision responsibilities increase. The increased use of RegTech, including AI, to supervise fund operators requires standardised data. At the same time regulators are becoming increasingly aware that excessive data collection increases pressure on fund operators. Ongoing Developments in Financial Services Regulation in the EU and UK – Part I | 5 In the EU, the existence of multiple regulators, across multiple countries, wanting the same data from fund operators was addressed in the AIFMD II directive, which introduced data reporting and sharing requirements that aim to reduce the reporting burden on both AIFMs and UCITS management companies. Unlike the rest of the AIFMD II, these requirements do not come into effect until 2027. At the beginning of July 2026, ESMA published a report on the simplification of transaction reporting. Setting out a path towards, what ESMA calls, a ‘report once’ approach, the report details the development of a single integrated transaction reporting framework across the Markets in Financial Instruments Regulation (MiFIR), the Regulation on Over- the-Counter Derivatives, Central Counterparties and Trade Repositories (EMIR), and the Regulation on Transparency of Securities Financing Transactions and of Reuse (SFTR). ESMA says this integrated model would allow transaction data to be reported once through a common modular structure to reflect product specificities within one single framework. Such data can then be reused across authorities and supervisory mandates, reducing duplication while preserving the information needed for effective supervision. In the UK the FCA published a consultation paper on a new framework called Fund Reporting for Asset Management Entities (FRAME) on 14 July 2026. The FCA says it is proposing the new framework to increase the quality and consistency of data reported to it. When implemented FRAME would: • Replace the current fund reporting requirements with consolidated forms; • Reduce the need for some notification requirements; and • Give managers of smaller funds more proportionate requirements based on the risk they pose to the market. Alongside this consultation, the FCA published three example reporting templates that represent the data it proposes to collect from managers and operators of different types of fund and a version of its proposed essential reporting requirements as an online form that firms can test on a voluntary basis. With the consultation period closing on 22 September 2026, the FCA aims to publish a policy statement and final rules in the first half of 2027 with the aim of having the new reporting regime fully implemented in 2028. Then on 3 August 2026, the FCA finalised its rules to reduce transaction reporting costs. The new rules are designed to help ensure the FCA continues to receive accurate, high-quality data while eliminating duplicative or low-value reporting. Key changes include: • Reducing the number of transaction reporting fields from 65 to 52. • Removing foreign exchange derivatives from reporting requirements, according to the FCA this will reduce costs for over 400 firms. • Removing reporting requirements for 7 million financial instruments including equities, bonds and certain derivatives that are only traded on EU trading venues. According to the FCA this will save firms approximately £32m annually. • Reducing the period for correcting historical reporting errors from 5 to 3 years, lowering the number of transaction reports that need to be resubmitted by a third. The changes will take effect on 3 April 2028; however, a flexible supervisory approach will allow firms that are ready to make certain changes sooner. The FCA will continue working closely with the BoE and HM Treasury to harmonise transaction and post-trade reporting regulations. Conclusion In our next article, Part II of Ongoing Developments in Financial Services Regulation in the EU and UK, watch out for developments in retail disclosure frameworks, the progression of certain aspects of the European Commission’s Retail Investment Strategy and the FCA’s Consumer Duty, amongst other topics. This article was correct at the time of writing: 24 August 2026. Article Contributors Matthew Cherrill Amanda Hale Andrew Newson 1. See MiCA Article 2(4)(a) 2. Minting brings new tokens into existence, while burning permanently removes them. It is equivalent to the creation and cancellation/liquidation of fund units. 3. Generative AI is a class of artificial intelligence algorithms that can learn from existing data (such as text, images, audio, or code) and use that knowledge to create entirely new, original content. Agentic AI refers to a type of artificial intelligence system designed to act as an autonomous agent. https://www.citigroup.com/global/businesses/services/investor-services The market, service, or other information is provided in this communication solely for your information and “AS IS” and “AS AVAILABLE”, without any representation or warranty as to accuracy, adequacy, completeness, timeliness or fitness for particular purpose. The user bears full responsibility for all use of such information. Citi may provide updates as further information becomes publicly available but will not be responsible for doing so. The terms, conditions and descriptions that appear are subject to change; provided, however, Citi has no responsibility for updating or correcting any information provided in this communication. No member of the Citi organization shall have any liability to any person receiving this communication for the quality, accuracy, timeliness or availability of any information contained in this communication or for any person’s use of or reliance on any of the information, including any loss to such person. This communication is not intended to constitute legal, regulatory, tax, investment, accounting, financial or other advice by any member of the Citi organization. This communication should not be used or relied upon by any person for the purpose of making any legal, regulatory, tax, investment, accounting, financial or other decision or to provide advice on such matters to any other person. Recipients of this communication should obtain guidance and/or advice, based on their own particular circumstances, from their own legal, tax or other appropriate advisor. Not all products and services that may be described in this communication are available in all geographic areas or to all persons. Your eligibility for particular products and services is subject to final determination by Citigroup and/or its affiliates. The entitled recipient of this communication may make the provided information available to its employees or employees of its affiliates for internal use only but may not reproduce, modify, disclose, or distribute such information to any third parties (including any customers, prospective customers or vendors) or commercially exploit it without Citi’s express written consent in each instance. Unauthorized use of the provided information or misuse of any information is strictly prohibited. Among Citi’s affiliates, (i) Citibank, N.A., London Branch, is regulated by Office of the Comptroller of the Currency (USA), authorised by the Prudential Regulation Authority and subject to regulation by the Financial Conduct Authority and limited regulation by the Prudential Regulation Authority (together, the “UK Regulator”) and has its registered office at Citigroup Centre, Canada Square, London E14 5LB and (ii) Citibank Europe plc, is regulated by the Central Bank of Ireland, the European Central Bank and has its registered office at 1 North Wall Quay, Dublin 1, Ireland. This communication is directed at persons (i) who have been or can be classified by Citi as eligible counterparties or professional clients in line with the rules of the UK Regulator, (ii) who have professional experience in matters relating to investments falling within Article 19(1) of the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 and (iii) other persons to whom it may otherwise lawfully be communicated. No other person should act on the contents or access the products or transactions discussed in this communication. In particular, this communication is not intended for retail clients and Citi will not make such products or transactions available to retail clients. The information provided in this communication may relate to matters that are (i) not regulated by the UK Regulator and/or (ii) not subject to the protections of the United Kingdom’s Financial Services and Markets Act 2000 and/or the United Kingdom’s Financial Services Compensation Scheme. © 2026 Citibank, N.A. (organized under the laws of USA with limited liability) and/or each applicable affiliate. All rights reserved by Citibank, N.A. and/or each applicable affiliate. Citi, Citi and Arc Design and other marks used herein are service marks of Citigroup Inc., used and registered throughout the world. 26-FB62358D 08/26 Please contact for further details: David Morrison Global Head of Trustee and Fiduciary Services david.m.morrison@citi.com +44 (0) 20 7500 8021 Amanda Hale Head of Regulatory Services amanda.jayne.hale@citi.com +44 (0)20 7508 0178 Kelli O’Brien Global Head of Fund Administration Product kelli.a.obrien@citi.com +1 617 859 3468 Ramesh Selva Head of Trustee & Fiduciary Services North & South Asia ramesh.selva@citi.com +65 6657 4142 Sung-Wook Han Head of Trustee & Fiduciary Services Korea sungwook.han@citi.com +82 22004 2162 Shane Baily Head of Fiduciary Services UK and Europe shane.baily@citi.com +353 1 622 6297