The Risk Horizon Brief
25 May 2026 | Weekly Institutional Intelligence
This Week's Intelligence Summary
This week's regulatory landscape was dominated by enforcement recalibration, market infrastructure reform, and persistent retail fraud pressure. The CFTC's new cooperation framework and the SEC-NFA MOU signal a more coordinated and incentive-driven US enforcement regime, while the EBA's crypto AML Q&As, ESMA's sixth CCP stress test, and the BoE's CHAPS 24x7 consultation reshape infrastructure and AML perimeters globally. Repeated HKMA scam alerts and the FCA's Competition Act probe into Mastercard, Visa and PayPal underscore that conduct and competition risk in payments remain board-level concerns.
Top 3 Signals
1. CFTC Issues New Cooperation and Self-Reporting Policy
Jurisdiction: CFTC (US) | Impact: Decreasing (conditional) | Business Line: Capital Markets
The CFTC's Division of Enforcement created a structured path to declination for firms that self-report, cooperate, and remediate timely. The advisory changes the cost-benefit calculus for voluntary disclosure and raises expectations for surveillance, escalation, and remediation infrastructure across all CFTC registrants.
2. EBA Extends AML and Travel Rule Scope to EMTs and Lightning Network
Jurisdiction: EBA (EU) | Impact: Increasing | Business Line: Payments
The EBA's final Q&As clarify AML obligations for e-money token issuers and confirm that Lightning Network transactions fall within the Travel Rule under TFR. Crypto-asset service providers must reassess onboarding, transaction monitoring, sanctions screening, and Travel Rule data-sharing controls to remain compliant under MiCA and TFR.
3. FCA Opens Competition Act Probe into Mastercard, Visa, and PayPal
Jurisdiction: FCA (UK) | Impact: Increasing | Business Line: Payments
The FCA's first major use of its concurrent Chapter I and Chapter II competition powers targets the largest card schemes and a leading digital wallet over PayPal funding and usage arrangements. The probe signals deeper structural scrutiny of payments market economics and creates precedent-setting competition exposure across the global payments ecosystem.
Strategic Insight
The combination of the CFTC cooperation framework and the SEC-NFA MOU marks a structural shift in US supervisory architecture: enforcement is becoming both more coordinated across regulators and more dependent on firms' ability to self-identify and escalate. Firms that lack mature internal investigation, surveillance, and disclosure-decision frameworks will face asymmetric outcomes — heavier penalties when issues are surfaced by regulators first, and missed mitigation when they could have self-reported. Boards should treat self-reporting infrastructure as a strategic compliance capability, not a procedural matter.
Recommended Action
This week, risk and compliance functions should:
Commission a cross-functional review (Compliance, Legal, Internal Audit, Financial Crime) to refresh the firm's global self-reporting and cooperation decision framework against the new CFTC advisory and SEC-NFA coordination posture. Outputs should include updated escalation triggers, documented decision criteria, and Audit Committee briefing materials, mapped to the firm's Operational Risk and Compliance Management control frameworks (e.g., COSO, Basel SRP) by end of Q3 2026.
The Risk Horizon Brief is published weekly by Risk Horizon. Institutional intelligence for global financial services. riskhorizon.io