Regulation

A UK tribunal has suspended parts of the Financial Conduct Authority's industry-wide motor finance compensation scheme, on terms agreed with four challengers, while firms must still comply with the rules that remain in force.

The Reserve Bank of India's revised rules governing banks' exposure to capital markets took effect on July 1 after being pushed back by three months, giving lenders and market intermediaries more time to prepare.

The Monetary Authority of Singapore is consulting on proposed changes to its technology risk management rules, aiming to strengthen financial institutions' resilience as digitalisation and cyber threats grow.

The UK Financial Conduct Authority's new 'targeted support' regime took effect on April 6, 2026, allowing banks, pension providers, and investment firms to offer ready-made recommendations to groups of consumers with similar characteristics — without a full individual advice assessment. The FCA estimates that over the next decade at least 18 million people could receive extra help with pensions and investment decisions, addressing a persistent gap where fewer than 1 in 10 UK adults take regulated financial advice.

The Australian Prudential Regulation Authority's finalized amendments to Prudential Standard CPS 230 Operational Risk Management take full effect on July 1, 2026. The changes introduce limited contractual exemptions for material arrangements with non-traditional service providers — such as central banks and clearing facilities — while preserving the core operational resilience framework that applies to insurers, banks, and superannuation funds.

The US Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) took effect in May 2026, requiring covered critical infrastructure entities to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. The mandate is accelerating demand for cyber insurance and reshaping how businesses, insurers, and regulators respond to a threat landscape where AI is intensifying both attack sophistication and underwriting complexity.

The National Association of Insurance Commissioners (NAIC) confirmed on June 25 that data taken from its IT systems has been published online by the ShinyHunters extortion group, which exploited a zero-day vulnerability in Oracle PeopleSoft. The NAIC says no personally identifiable information or payment data was accessed, while the group claims to have stolen 3.1 terabytes of regulatory filings and credit rating agency files.

North Carolina Governor Josh Stein signed House Bill 315, the 'Prohibit Litigation Investments Act,' into law on June 22, making the state the first in the nation to enact an outright ban on third-party litigation funding rather than merely regulating disclosure. Insurance industry groups have hailed the move as a major step against what they call 'legal system abuse,' while litigation finance firms warn it could restrict access to justice.

The Australian Prudential Regulation Authority's amended CPS 230 Operational Risk Management standard takes full effect on July 1, 2026, introducing limited contractual exemptions for certain non-traditional service providers such as central banks and clearing facilities. Insurers, banks, and superannuation funds must review their material service provider portfolios and update their registers before the deadline as Australia's landmark operational resilience framework reaches full implementation.

The National Association of Insurance Commissioners (NAIC) confirmed on June 25 that data stolen in a cyberattack on its Oracle PeopleSoft system has been published online by the responsible group. The extortion group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) and claims to have obtained 3.1 terabytes of data, though the NAIC maintains no personally identifiable or payment information was accessed and the group does not hold the scope of data it claims.

Australia's landmark operational resilience standard, Prudential Standard CPS 230, takes full effect on July 1, 2026, including finalised amendments providing limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities. Insurers, banks, and superannuation trustees face an immediate deadline to ensure their Material Service Provider registers and contractual arrangements comply with the framework designed to strengthen resilience against operational disruptions and cyber incidents.

North Carolina has become the first US state to pass an outright ban on third-party litigation financing, making it unlawful for outside investors to fund lawsuits in exchange for a share of any award. The move is significant for insurers, who have long argued that litigation funding fuels 'social inflation' and drives up claims costs — a trend the industry has increasingly cited as a key driver of rising premiums across casualty lines.

The National Association of Insurance Commissioners (NAIC) has confirmed that data stolen in a June ransomware attack via an Oracle PeopleSoft zero-day vulnerability has been published online by the ShinyHunters group, which claims to have taken 3.1 terabytes of data across more than 105,000 files. The NAIC says no personally identifiable information or payment data was accessed, though credit rating agencies have paused data feeds, temporarily suspending the assignment of insurer investment designations.

Australia's landmark operational risk standard, Prudential Standard CPS 230, takes full effect on July 1, 2026, following final amendments by the Australian Prudential Regulation Authority (APRA). Insurers, banks, and superannuation funds must have updated their Material Service Provider registers and compliant contractual arrangements by the deadline, with newly finalized exemptions for certain non-traditional service providers such as central banks and clearing facilities.

The US National Association of Insurance Commissioners (NAIC) confirmed on June 25 that data stolen in a cyberattack on its Oracle PeopleSoft system has been published online by the hacking group ShinyHunters. The breach, discovered on June 11, exploited a zero-day vulnerability and is part of a broader campaign affecting more than 100 organizations. The NAIC says no personally identifiable information or payment data was accessed, though credit rating agencies have paused data feeds.

The European Central Bank has warned that euro-area insurers and pension funds would be hit harder than banks in a severe private credit market shock, as the rapid, AI-fuelled expansion of the near-$2 trillion sector raises financial stability concerns. The ECB stress scenario found insurers could suffer losses of around 4% of assets, with the regulator drawing an explicit comparison between the US private credit market and the pre-crisis subprime mortgage market.

UK insurers face a June 30, 2026 deadline to have a compliant Solvent Exit Analysis in place under the Prudential Regulation Authority's new requirements, with the extensive preparatory work proving complex and time-consuming for many firms. The deadline is part of a broader 2026 UK regulatory agenda that includes the PRA's climate risk expectations and the FCA's first annual insurance Regulatory Priorities report.

Australia's landmark CPS 230 Operational Risk Management standard takes full effect on July 1, 2026, requiring banks, insurers, and superannuation funds to demonstrate resilience to operational disruptions including cyber incidents and third-party failures. The deadline arrives as APRA's finalised amendments — introducing limited exemptions for non-traditional service providers — also commence, marking the culmination of a multi-year implementation program.

Germany's financial regulator BaFin has issued a circular confirming the legal permissibility of ransom insurance under German supervisory law, consolidating prior regulatory requirements and providing clarity for insurers and policyholders. The move comes alongside an expansion of BaFin's investigative powers under new legislation effective March 31, 2026, and follows the regulator's third cyber insurance market survey flagging systemic accumulation risks.

Euro Exchange Securities UK Ltd, a British electronic-money institution, handled at least £2 billion ($2.7 billion) for a small group of high-risk customers before the Financial Conduct Authority moved to force it into administration over money-laundering concerns. Court filings reveal that almost all of more than 20,000 payments totalling £2.1 billion in a single year were made on behalf of just 14 clients the firm itself had assessed as 'high risk', highlighting the FCA's intensifying crackdown on weak anti-crime controls in the UK payments sector.

The UK Financial Conduct Authority continues to rely on its outcomes-focused Consumer Duty regime to drive fair value in insurance, with its Premium Finance Market Study confirming average APRs on monthly insurance payment plans have fallen 4.1% since 2022. The regulator declined to impose a sector-wide APR cap, opting instead for targeted supervisory engagement, while advancing a broader 2026 agenda including distribution chain reforms and investment product disclosure changes.

Australia's Prudential Regulation Authority (APRA) finalized targeted amendments to Prudential Standard CPS 230 Operational Risk Management, taking full effect July 1, 2026. The changes introduce limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities, and require insurers, banks, and superannuation funds to update their Material Service Provider registers ahead of the looming deadline.

China's National Financial Regulatory Administration (NFRA) has set out a new regulatory framework for insurance asset management, establishing requirements across four key pillars. The regulator stressed that firms must pursue high-quality development and compete in an orderly way to prevent market chaos, signalling tighter oversight of how Chinese insurers manage their substantial investment portfolios.

The Australian Prudential Regulation Authority's finalised amendments to Prudential Standard CPS 230 Operational Risk Management take effect on July 1, 2026, introducing limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities. Insurers, banks, and superannuation funds are racing to update their Material Service Provider registers and reporting processes before the deadline.

Australia's Prudential Regulation Authority (APRA) is in the final countdown to the July 1, 2026 commencement of its amended CPS 230 Operational Risk Management standard. Insurers, banks, and superannuation trustees must update their Material Service Provider registers and reporting processes to reflect new limited exemptions for non-traditional service providers such as central banks and clearing facilities before the deadline.

The Insurance Regulatory and Development Authority of India (IRDAI) proposed a new framework on June 17, 2026, mandating public consultation, periodic three-year reviews, and greater transparency in framing insurance regulations under the Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025. The draft codifies stakeholder engagement practices and requires cost-benefit assessment of proposed rules, with comments invited until July 8, 2026.

Australian insurers, banks, and superannuation funds are in the final stretch of preparations ahead of the July 1, 2026, commencement of APRA's amended CPS 230 Operational Risk Management standard. The finalized amendments, released April 30, introduce limited contractual exemptions for non-traditional service providers such as central banks and clearing facilities, while requiring all regulated entities to update their Material Service Provider registers before the deadline.

UAE insurers, banks, and fintech firms face a September 16, 2026, deadline to align with the country's landmark consolidated Central Bank Law (Federal Decree-Law No. 6 of 2025), which came into force in September 2025. The overhaul consolidates banking and insurance regulation under the CBUAE, widens the regulatory perimeter to capture insurtech and digital platforms, and raises the maximum administrative fine fivefold to AED 1 billion.

The Insurance Regulatory and Development Authority of India (IRDAI) has proposed a broad set of amendments to regulations governing insurer registration, capital structure, share transfers, and amalgamations, aimed at improving ease of doing business. The proposals — open for stakeholder comments until July 6, 2026 — include clarified approval thresholds for shareholding increases, streamlined merger frameworks, and reduced transaction fees, following India's recent move to allow 100% foreign investment in the sector.

The UK's Financial Conduct Authority is expanding its scrutiny of the home and travel insurance markets in 2026 in response to a super-complaint lodged by consumer group Which?. While the FCA rejected calls for a joint legal review of consumer protection frameworks, it committed to reviewing claims handling, oversight of third-party claims handlers, and how products are sold across insurers, brokers, and price comparison websites.

The European Central Bank warned in its May 2026 Financial Stability Review that European insurers and pension funds would be hit harder than banks by a severe private credit market shock. In an illustrative stress exercise, the ECB found that insurers faced the largest absolute impact — around 4% of assets — because their private credit exposures are larger, less senior, and more exposed to broader market repricing. Pension funds would suffer 5-6% asset losses, while bank losses would stay contained at no more than 1.3% of equity.

India's insurance regulator IRDAI is rolling out a wave of structural reforms aimed at modernising the country's $146 billion insurance sector. The flagship initiative is Bima Sugam — a non-profit, industry-owned digital marketplace functioning as the 'UPI of insurance' where customers can compare, buy, and manage policies, with the first commercial use case targeted for 2026. IRDAI is also moving to a dynamic Risk-Based Capital framework to replace the formula-based regime, mandating Indian Accounting Standards adoption, and overhauling commissions to curb mis-selling.

The Insurance Regulatory and Development Authority of India has amended its Corporate Governance for Insurers Regulations to tie the variable pay and incentives of CEOs and other key management persons directly to customer-centric outcomes. Under a circular that takes effect immediately, performance parameters now include claim responsiveness, timely grievance redressal, product performance, financial soundness, and the removal of dark patterns from insurer and distributor websites. The move, which industry executives describe as a tightening of an already stringent framework, shifts executive accountability beyond financial growth toward measurable policyholder welfare.

The Regional Court of Munich issued a temporary injunction holding Google directly liable for false claims generated by its AI Overviews, ruling that AI-generated summaries are Google's own content rather than protected search results. The decision (Case 26 O 869/26) rejected Google's argument that users could check sources themselves and that disclaimers shield liability. Legal and insurance analysts say the principle is a direct warning to insurers that have embedded generative AI into chatbots, claims summaries, and underwriting tools: you own the output, and disclaimers will not protect you.

The National Association of Insurance Commissioners is intensifying scrutiny of the credit ratings on complex private-credit and infrastructure securities — including debt funding the AI data center buildout — held by US insurers. Since January 1, 2026, the NAIC's 'discretion amendment' has empowered regulators to challenge and override ratings that differ from their own analysis by more than three notches. With privately placed bonds now representing 23.4% of insurers' admitted bonds, up from 18.3% in 2021, the regulator is questioning whether the ratings underpinning these attractive assets are robust enough to survive closer examination.

US state insurance regulators, through the NAIC, have launched a review of the credit ratings underpinning data center and private-credit investments held by insurers — a fast-growing slice of insurer balance sheets fueled by the AI infrastructure boom. Since January 1, 2026, the NAIC has held the power to challenge and override third-party credit ratings that differ from its own analysis by more than three notches. With privately rated bonds now representing 23.4% of insurers' total admitted bonds, the scrutiny strikes at the heart of the private-assets surge.

The UK Financial Conduct Authority (FCA) published its final findings from its landmark Premium Finance Market Study in February 2026, confirming that the average annual percentage rate (APR) on insurance premium finance has fallen by 4.1% since 2022, driven by Consumer Duty supervisory pressure. The regulator stopped short of imposing a sector-wide APR cap but committed to continued targeted enforcement and monitoring, maintaining pressure on firms that are not delivering fair value.

The Australian Prudential Regulation Authority (APRA) has finalised targeted amendments to Prudential Standard CPS 230 Operational Risk Management, effective July 1, 2026. The changes introduce limited contractual exemptions for certain non-traditional service providers — such as central banks and clearing facilities — responding to industry concerns while preserving the core objectives of the landmark operational resilience framework for insurers, banks, and superannuation funds.