• SignalEBA published final Guidelines on third-country branch authorisation, tightening the EU perimeter for non-EU banking establishments (materiality 5).
• SignalESMA released new Q&As on the ESG Ratings Regulation, further clarifying supervisory expectations for rating providers operating in the EU (materiality 5).
• SignalHKICL issued a warning on FPS-themed fraudulent refund websites, flagging an active retail payments fraud vector in Hong Kong (materiality 5).
• AlertSeverity-mix anomaly remains open: Critical/High severity share has risen 17pp to 27% of signals, indicating the composition of regulatory activity is escalating even where daily volume is modest.
• AlertSignal velocity is running 2.5× the 30-day average (24/day vs 10/day), signalling sustained regulator output pressure.
• AlertFour High-severity emerging themes remain unaddressed — Conduct (15), AML (15), Sanctions (12) and Market Integrity (11) — each with no prior 30-day baseline.
• Scenario TriggerTwo open medium-severity scenario-trigger matches continue to point at the "AI Model Governance Failure in Credit Decisioning" scenario, driven by ESA statements on frontier AI ICT risks.
• GovernanceNo governance events, semantic drift changes, or lifecycle movements were recorded today.

Today's three signals are individually manageable, but the surrounding alert stack tells a more consequential story: severity mix is shifting upward, velocity is elevated, and four previously absent themes — Conduct, AML, Sanctions and Market Integrity — have appeared as High-severity emergences within a 30-day window. That combination typically precedes a step-change in supervisory expectations, and the persistent AI-governance scenario matches add a forward-looking model-risk dimension. Leaders should read the calm daily surface as a window to close scenario-pack gaps and prepare for a higher-intensity regulatory cadence rather than as steady state.

1. 1Task legal and prudential teams to assess EBA's final third-country branch authorisation Guidelines against current EU branch structures and identify any authorisation, governance or booking-model gaps.
2. 2Route ESMA's ESG Ratings Q&As to the sustainability, data and investment product teams to confirm rating-provider selection, disclosure and due-diligence processes remain aligned.
3. 3Circulate the HKICL FPS refund-fraud warning to fraud, retail payments and customer communications teams, and verify scam-detection rules and customer messaging in the Hong Kong footprint.
4. 4Convene a working session on the four High-severity emerging themes (Conduct, AML, Sanctions, Market Integrity) to determine whether existing risk taxonomies, controls and scenario packs cover them.
5. 5Direct the model risk and ICT teams to review AI credit-decisioning controls against ESA frontier-AI expectations before the open scenario-trigger matches escalate.

• Watch for further ESA output on frontier AI ICT risk that could convert the two open scenario-trigger matches into a confirmed AI model-governance scenario activation.
• Monitor whether the elevated 2.5× signal velocity persists or normalises over the coming days — sustained acceleration would compound the severity-mix anomaly.
• Track incremental signals in the newly emergent Conduct, AML, Sanctions and Market Integrity themes to see which consolidates into a durable supervisory priority.
• Close the four open scenario-pack gaps — Cyber Threat Intelligence & Incident Reporting, Climate-Related Financial Risk, Stablecoin Reserve Harmonisation, and Operational Resilience & Critical Third Parties — before a triggering signal lands.
• Watch whether the Critical/High severity share continues to climb beyond the current 27% level, which would indicate a structural rather than transient shift in regulator intensity.