Europe’s Anti-Financial Crime Landscape Poised for Transformational Change in 2026 Europe’s approach to combating financial crime is entering its most significant phase of evolution in decades. Faced with mounting regulatory consolidation, cost pressures, rapid advances in artificial intelligence (AI), and increasingly sophisticated criminal tactics, financial institutions must rethink how they identify and manage risk across borders and business lines At the centre of this transformation are two major developments: the Anti-Money Laundering Authority (AMLA) and the new European AML Rulebook (AMLR). Together, these elements establish a harmonised regulatory and supervisory framework across the EU. AMLA, which launched in July 2025, will bring direct supervision to roughly 40 high-risk institutions by 2027 and become fully operational by 2028, while the AMLR creates consistent standards and methodologies to replace fragmented national rules. For financial crime executives, this shift demands more than compliance checklists—it requires organisational change. Firms are encouraged to harmonise internal policies, streamline transaction monitoring, unify supervisory response functions, and align risk assessments and model governance with the new European standards. Cost and value dynamics are also changing. As volumes of data grow and false positives proliferate, anti-financial crime (AFC) functions must move from cost-centric models to ones that demonstrate measurable value. Leveraging AI to automate routine investigations—while reserving skilled human judgement for nuanced cases—can help improve detection quality and reduce operational drag. Advances in generative AI and machine learning are unlocking further potential, enabling faster triage, improved outcome consistency, and enhanced analytical capabilities. The next frontier lies in agentic AI—systems that can autonomously manage risk workflows within controlled, explainable frameworks, enabling real-time monitoring and dynamic risk scoring. Finally, the insight highlights the growing importance of public-private partnerships (PPPs) and shared utilities. Criminal networks exploit data silos and fragmented defenses; by contrast, collaboration—supported by privacy-enhancing technologies such as federated learning—can improve detection accuracy, reduce false positives, lower costs, and strengthen compliance credibility across the industry. In sum, 2026 represents a pivotal moment for European AFC leaders: a chance to leverage regulatory reform, technological innovation, and collaborative intelligence to build more efficient, resilient, and proactive defences against financial crime. [image: cq5dam.thumbnail.319.319.png] Read more and the report in full here

Supervisory Priorities - UK & Europe Across the UK and EU, supervisors are sharpening their focus on resilience, data, and disciplined execution amid significant regulatory change. In the UK, both the PRA and FCA are balancing competitiveness and growth objectives with heightened expectations around risk management, operational robustness, capital readiness, and consumer and financial crime outcomes—alongside efforts to modernise supervisory processes and reporting. In the EU, the EBA and ECB are driving rulebook delivery, supervisory convergence, and technology-related oversight, with particular emphasis on geopolitical resilience, ICT and third-party risk, and the governance of emerging digital and AI use cases. Collectively, the agenda signals sustained supervisory intensity, with firms expected to demonstrate strong fundamentals while adapting to evolving frameworks and innovation-led risks. UK Prudential Regulatory Authority (PRA) Strategic risk management (incl. trade finance, private markets, NBFI exposures, CCR, SRT discipline, model risk, new tech) Expect continued supervisory pressure on risk identification/aggregation (especially around NBFI counterparty credit risk and private markets connectivity) and board-level visibility of exposures; also tighter governance expectations around SRT capital relief and model risk remediation Operational resilience (incl. cyber resilience and third‑party dependencies) Banks should anticipate deeper challenge on operational resilience testing, plus more scrutiny of cyber preparedness and outsourcing/third‑party concentration, including expectations for contingency/exit testing and “don’t rely solely on vendor assurance” approaches. Financial resilience (capital & liquidity) with major regime change ahead PRA is explicitly linking 2026 supervisory work to readiness for Basel 3.1 implementation on 1 Jan 2027, alongside the Strong and Simple regime for SDDTs on the same date; banks should expect material focus on capital planning, RWA accuracy, and permissions. The PRA also flags variable Pillar 2 requirement rebasing in 2026 with a 31 March 2026 data submission deadline, which can drive near‑term workload and potentially affect requirements. Data risk (incl. BCBS 239 benchmarking and potential skilled person reviews) Banks should expect continuing pressure to strengthen data governance, architecture and validation; the PRA signals willingness to use specialist/skilled person reviews where weaknesses persist—so data programmes can become a supervisory-critical path item. Competitiveness & growth (see below for secondary objectives) Reporting burden reduction (Future Banking Data programme) Alongside higher data quality expectations, the PRA is explicitly pushing streamlining/modernising reporting via the Future Banking Data programme—this can mean change in reporting processes and architecture (even if intended to reduce burden over time). Supervisory approach / efficiency: shift to a two‑year cycle for PSMs and other streamlining PRA plans to move remaining firms from annual to biennial PSM cycles and accelerate certain approval timelines; banks may see fewer formal cycle-driven engagements but should expect continued cadence on material issues, plus operational changes in PRA interaction models Financial Conduct Authority (FCA) A smarter regulator (more efficient/effective; proportionate and predictable) Banks can expect continuing changes in data collection and regulatory interactions (including FCA efforts to stop some returns, digitise processes, and enable ad‑hoc “flexi collections”), plus an FCA supervision model that aims to focus resources on the highest harm and act faster in higher-risk cases. Supporting growth (competitiveness, productivity, innovation) For banks, this tends to translate into a mix of (i) enabling frameworks (e.g., Open Banking/Open Finance) and (ii) regime-building work (e.g., crypto/stablecoins) that can create opportunities but also new compliance and operating model requirements. The FCA’s work programme explicitly funds major growth-oriented initiatives like Open Finance and crypto regime work. Helping consumers navigate their financial lives Banks (especially retail) should expect continued FCA focus on consumer outcomes—resilience to shocks, saving/investing, and consistently good experiences—often manifesting as supervisory attention to product design, customer journeys and (where relevant) market-wide reviews (e.g., the FCA signals work like a public discussion on the future mortgage market). Fighting financial crime Banks should expect ongoing emphasis on measures that slow fraud growth, protect market integrity and tackle money laundering; that typically drives scrutiny of AML systems/controls, governance, and how firms prevent/identify/respond to fraud typologies EU European Banking Authority (EBA) Priority 1 — Rulebook: efficient, resilient and sustainable single market Banks should expect sustained EBA focus on single-rulebook delivery and consistent implementation, with major workload tied to CRR/CRD mandates (the SPD references a large pipeline of mandates through 2028 and explicitly flags prioritisation of Basel III implementation and issues like third‑country branch access/consolidation topics). Priority 2 — Risk assessment: tools, data and methodologies for effective analysis/supervision/oversight Expect continued evolution in EU supervisory analytics and benchmarking—i.e., more structured use of data and methodologies to support supervisory convergence and risk monitoring, which can translate into data/reporting expectations and more comparable supervisory scrutiny across Member States. Priority 3 — Innovation: enhancing technological capacity This priority explicitly connects to the EBA’s expanding perimeter and tech-related supervisory roles, including new responsibilities tied to DORA and MiCA; for banks, this typically elevates expectations on ICT/third-party risk and on how firms interact with crypto-asset ecosystems (directly or via clients/counterparties). Cross-cutting: simplifying/streamlining the regulatory and supervisory framework The EBA states it is pursuing efficiency and simplification, including actions aimed at reporting burden and the production of Level 2/3 products. If executed, this could reduce duplicative requirements over time, but it can also trigger transition costs (systems/process change) as the reporting stack is redesigned. European Central Bank (ECB) Priority 1 — Resilience to geopolitical risks and macro‑financial uncertainties The ECB signals planned work that includes thematic review(s) of credit underwriting standards, follow-on reviews (e.g., loan pricing where relevant), and continued attention to capitalisation and CRR III implementation—all of which can affect supervisory findings, remediation programmes, and (indirectly) capital planning and RWA governance. Climate and nature-related risk management and transition planning also sit within Priority 1’s vulnerabilities/work programme. Priority 2 — Operational resilience and robust ICT capabilities Expect supervisory intensity around DORA implementation (especially ICT third‑party and incident response), plus OSI campaigns, targeted reviews (e.g., ICT change management), and threat-led testing. ECB also highlights the need to remediate longstanding RDARR (risk data aggregation/risk reporting) issues and sets out a system-wide strategy with escalation if remediation is slow. Medium-to-longer term focus — digital and AI strategies, governance and risk management The ECB is explicitly moving toward more structured engagement on banks’ AI (incl. generative AI) use cases, governance and controls—this can drive enhanced model risk management practices, data controls, and tech risk governance expectations over the 2026–28 horizon.

As announced as part of the government’s Financial Services Growth and Competitiveness Strategy, the Prudential Regulation Authority (PRA) has introduced a more responsive approach for receiving, reviewing, and approving Internal Ratings Based (IRB) model applications . This new approach is designed to enhance the model approval process for banks with existing internal models. Key elements of the PRA’s updated approach include: Enhanced Pre-Application Engagement: PRA will work more closely with firms before formal submissions to assess readiness and flag complex issues early. Dedicated Submission Slots: Firms will have designated slots for application submission, increasing procedural clarity and predictability on both sides. Accelerated Documentation Quality Checks: The PRA aims to complete thorough checks on application documentation within 4 weeks. Defined Review Timelines: Complete submissions will undergo review within 6 months if no additional information is needed. Final Decision Targets: PRA targets concluding decisions on applications within 18 months. Implications for Banks This transparent and disciplined approach is welcomed by firms. However, it makes banks’ committed model submission dates more important than ever. Firms need to be confident that they will be able to deliver the model in a certain month (with a foresight of a year in advance), having gone through a robust governance and validation process. They will also need to ensure all parts of the submission are complete and of good quality. Failure to deliver on time or to the expected standard will risk putting them ‘at the back of the queue’, resulting in more costly re-developments and potentially supervisory add-ons. We see leading banks taking the opportunity to enhance their IRB model delivery and submission strategies. Conduct a Comprehensive End-to-End Stock-Take of IRB Submissions Across the board, we have observed the following best practices to fully review the current IRB model submission plans. This stock-take includes: Evaluate the feasibility and readiness of each submission relative to the PRA’s timelines and quality expectations. This is done in the light of both previous supervisory feedback and modelling challenges, to come to an honest assessment of whether a model can be delivered in a certain month. Integrate business and strategic priorities—focus should be placed on portfolios that align with the bank’s risk strategy and have the highest business impact. Evaluate levers to shorten delivery timelines – most banks now have elements of parallelization of different model development activities rather than a sequential ‘waterfall’ type approach Incorporate implementation readiness: given the PRA's more certain and shortened review timelines, banks should rigorously assess their ability to implement approved models within the required timeframe. Implementation timelines should be a critical dimension in deciding which models are "ready" for submission, ensuring that operational systems and infrastructures are aligned to support timely deployment post-approval. Enhance planning and regulatory engagement Our experience shows that the following three pillars are critical to ensuring a smooth, timely, and successful approval: Rigorous project management: the more formally and firmly committed timelines demand rigorous project management and discipline to meet deadlines. Late or rushed submissions significantly increase the risk of extensions and requests for additional information Avoid pitfalls from weak or incomplete documentation: all components of the submission package and in particular model documentation need to be planned from the outset to avoid gaps or quality issues that can jeopardise the model review proceeding as planned by ‘stopping the clock’ and having to re-submit Maximize the impact of pre-engagement meetings: the new pre-engagement meetings are an opportunity to present key elements of the model to the PRA end-to-end and provide specialists with the answers to key questions early on. In order to use this valuable time in the most impactful way, banks should prepare materials that directly address the PRA’s key areas of focus, including: Quality and depth of data and historical information used Key judgments and modelling assumptions Evidence of senior management involvement and ownership Thoroughness of internal model validation and challenge processes By preparing high-quality, thoughtful presentations, banks can avoid surprises during the review phase. How We Can Help We recognise that the evolving supervisory approach poses new challenges and have worked with our clients to address these: Ensuring high-quality, complete submissions that meet PRA expectations and pass documentation quality checks first time Providing targeted project support to help banks meet the PRA’s accelerated regulatory timelines without sacrificing rigor Assisting clients in strategically prioritizing IRB submissions to align with both regulatory readiness and broader business goals, maximizing impact and resource efficiency By partnering closely with our clients on these fronts, we help them transform regulatory requirements into competitive advantages and successfully navigate this evolving regulatory landscape.

Welcome back to Risky Business's roundup of the headlines in risk. Recent developments highlight a clear shift toward tighter supervisory focus on resilience and execution, particularly in the UK and Europe. Regulators are embedding climate, interest rate, and resolvability risks more firmly into core prudential frameworks while recalibrating capital regimes under Basel 3.1, increasing cross-border complexity for large banks. In the UK, the PRA and Bank of England are streamlining supervision but sharpening scrutiny on business model sustainability and risks beyond the banking perimeter, including shadow banking. For boards, the takeaway is straightforward: regulatory tone may sound more proportionate, but expectations on delivery, data quality, and credible risk management are rising EBA consults on climate-focused changes to the Systemic Risk Buffer (SyRB) guidelines EBA The European Banking Authority launched a consultation to amend guidelines on sectoral exposures for the Systemic Risk Buffer to make climate risk more visible in macroprudential capital tools. Proposed changes aim to add granularity in identifying climate-related exposures and how they are treated across jurisdictions. The consultation runs through April with a public hearing scheduled for April 2026. Why this matters Embedding climate risk into macroprudential tools raises expectations for data, reporting, and capital planning across large banks. It may also lead to divergent national calibrations, complicating cross-border capital planning. For risk planners, this signals climate risk accruing real prudential weight, not just disclosure emphasis. Bank of England/PRA publishes its 2026 supervisory priorities PRA The PRA set out its supervisory priorities for 2026, highlighting a streamlined supervisory process and more efficient focus on key risks. The document confirms a shift of some supervisory reviews (like Periodic Summary Meetings) onto a biennial cadence. It also emphasises proportionate risk identification and remediating material weaknesses across banks and building societies. Why it matters This shapes how UK regulators allocate their scrutiny and resources, affecting risk reporting and supervisory engagement across firms. Streamlining may reduce administrative burden but heighten focus on core risks like governance and capital adequacy. Banks should adjust planning and evidence tracks to align with the updated supervisory cadence. ECB Vice-Chair Elderson emphasises operational and geopolitical shock resilience in supervision ECB The ECB’s Frank Elderson told the European Parliament that supervisory priorities through 2028 will emphasise resilience to geopolitical and macro-financial shocks as well as operational risk (e.g., cybersecurity). He also reinforced stronger oversight of innovation risks, including AI and digital assets. Elderson stressed that supervisory simplification must not dilute risk-based scrutiny. Why it matters This highlights where supervisors will intensify scrutiny - particularly on cyber, third-party risk, and innovation controls. A clearer risk focus aids strategic compliance planning but raises expectations on operational risk governance. It signals that resilience goes beyond capital ratios to include non-financial operational domains. Bank of England Governor warns shadow banking could threaten financial system The Times Bank of England Governor Andrew Bailey said regulators must address risks in the shadow banking sector, warning it could pose systemic threats due to growing scale and opacity. He announced plans for a new stress test of the private markets ecosystem to better understand systemic vulnerabilities. Bailey noted that while traditional banks are resilient, non-bank interconnections require closer monitoring. Why it matters A shift of supervisory attention toward shadow banking broadens the perimeter of risk monitoring beyond traditional deposit-taking banks. Systemic risk could be masked if these sectors expand without commensurate oversight. Banks with exposures to market-based finance should prepare for increased scrutiny on indirect risks and interconnected exposures. EBA completes IRRBB Heatmap work, highlighting EVE/NII and CSRBB issues EBA The EBA published its final report on medium-to-long-term objectives under the IRRBB Heatmap initiative, noting progress but ongoing asymmetries in EVE and NII impacts. The report highlighted inconsistent treatment of Credit Spread Risk in the Banking Book across banks. It encourages firms to align approaches and enhance governance. Why it matters Interest rate risk in the banking book remains a core balance-sheet vulnerability in a rate-volatile environment. Divergent practices around credit spread risk and hedging governance can prompt regulatory findings and capital add-ons. This underscores the need for robust risk measurement, governance, and consistent methodology. Bank of England/PRA finalises Basel 3.1 UK rules and confirms implementation timing BoE/ PRA The PRA published its final Basel 3.1 package in PS1/26, setting out the calibrated UK approach to the post-crisis Basel reforms. It reconfirms the UK implementation date of 1 January 2027 after a one-year delay agreed with HM Treasury. The policy statement anchors the supervisory baseline for firms in scope. Why it matters Basel 3.1 shapes capital calibration, risk-weighted assets, and disclosure norms critical to capital planning and competitiveness. The delayed timeline adds execution risk and cross-border complexity for UK-EU/US operations. It also underlines the need for robust programme management and model BIS speech warns AI and digital finance can create new financial-stability fault lines Bank of International Settlements In a BIS speech in Hong Kong, Tao Zhang warned that rapid adoption of artificial intelligence and digital finance could create new fault lines in financial stability. He highlighted risks from operational fragility, concentration, and common-mode failures where institutions rely on similar models, vendors, or data. The speech also noted that automation and faster market dynamics could amplify stress, arguing that policy and risk frameworks must evolve alongside technological adoption Why it matters For GSIBs and DSIBs, AI risk is increasingly viewed not just as a model or operational issue but as a potential systemic risk. Heavy reliance on shared technology stacks and third-party providers heightens correlated failures that are difficult to mitigate through diversification. This raises supervisory expectations for robust AI governance, resilience planning, and clear incident management under a financial-stability lens. EBA and AMLA complete handover of AML/CFT mandate effective 1 January 2026 EBA he EBA announced that the new EU Anti-Money Laundering Authority (AMLA) took over AML/CFT supervisory mandates effective 1 January 2026. This structural change centralises oversight of anti-money-laundering supervision in the EU. The transition is intended to strengthen coordinated action and supervisory consistency. Why it matters Centralised AML supervision raises expectations for consistent, high-quality controls, reporting, and risk management across large banking groups. AML failures remain a key operational and reputational risk with rapid escalation potential. For international groups, alignment between UK and EU frameworks will be critical to managing compliance risk. ECB advances climate and nature plan embedding risks into supervision ECB The ECB announced deeper integration of climate and nature-related risk considerations across its supervision and policy frameworks. This includes enhanced risk assessment capabilities and scenario analysis tools. The ECB intends to use binding decisions where necessary. Why it matters Climate and nature-related risks are now mainstream in euro-area supervisory expectations, with potential direct implications for capital adequacy and risk management. Banks need robust strategies and evidence to satisfy growing supervisory demands. It increases the importance of scenario planning and data quality in climate risk frameworks. FINMA issues guidance to limit crypto-asset custody risks FINMA Switzerland’s regulator FINMA released guidance outlining expectations to limit operational, legal, and control risks linked to crypto-asset custody services. It emphasises firm structure, governance, and risk controls in crypto custody offerings. The guidance aims to protect clients and support supervisory clarity. Why this matters As crypto exposures grow, custody operations concentrate operational and compliance risks that could cascade into larger reputational and financial shocks. Regulatory guidance signals enhanced scrutiny and expectations for control environments. This affects UK and global banks offering digital asset services as part of broader risk frameworks.