Daily · Digital Innovation and Market Infrastructure · September 23, 2026

Key points

ESMA sets digital innovation supervisory priority

The European Securities and Markets Authority (ESMA) announced a new Union Strategic Supervisory Priority (USSP) on digital innovation, scheduled to launch in 2027. The initial focus of this priority will be on how supervised entities use artificial intelligence and tokenisation. ESMA stated that the goal is to embrace innovation while protecting investors and maintaining strong safeguards.

This new priority will run alongside the existing USSP on cyber and operational resilience, which has been in place since 2025. ESMA indicated it will remain flexible to address future technological developments, including those emerging from advanced models such as frontier AI. The implementation of this priority will be conducted in collaboration with National Competent Authorities.

For compliance and risk teams at EU supervised entities, this signals a dedicated supervisory focus on digital tools starting next year. Firms should begin preparing governance and documentation frameworks for AI and tokenisation activities to align with the upcoming supervisory expectations.

UK approves first live Digital Securities Depository

The Financial Conduct Authority (FCA) approved HSBC Orion as the first entrant to provide live Digital Securities Depository services in the United Kingdom. FCA chief executive Nikhil Rathi announced this development at a TheCityUK dinner sponsored by Nasdaq, held at the former headquarters of Midland Bank, which is now part of HSBC.

This approval marks a significant shift from pilot phases to production environments for tokenised securities infrastructure. It signals that the FCA is moving digital asset market infrastructure toward live operational status, which is relevant for firms planning investments in digital securities depository services.

US SEC grants immediate effectiveness to new futures rules

Coinbase Derivatives LLC filed a proposed rule change with the US Securities and Exchange Commission (SEC) relating to the adoption of rules governing cash-settled futures on individual equity securities and exchange-traded fund (ETF) shares. The filing included provisions for perpetual single-stock futures and was granted immediate effectiveness.

This introduces a US regulatory framework for perpetual single-stock futures, a product structure previously dominant in offshore crypto derivatives markets. Simultaneously, KalshiEX LLC filed a proposed rule change for listing standards for security futures products, also granted immediate effectiveness. Bitnomial Exchange LLC filed a proposed rule change relating to security futures product listing standards and customer margin, which is currently in a proposed status.

These filings indicate a rapid expansion of regulated venues for equity-linked derivatives in the US, bringing offshore-style products under formal SEC oversight.

ESAs flag external dependencies and private credit risks

The European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA), and ESMA identified external dependencies, emerging technologies, and private credit as key vulnerabilities for the EU financial system in their Autumn 2026 risk update. The authorities warned that the sector's reliance on non-EU providers and infrastructures could amplify the impact of geopolitical shocks and operational disruptions.

Dependence on information and communication technology (ICT) service providers outside the European Economic Area remains a particular concern. The ESAs also highlighted growing cyber risks linked to increasingly capable AI models. Additionally, private credit vulnerabilities were noted despite the sector remaining relatively small in the EU, citing rapid growth, limited transparency, and increasing links.

EU-regulated firms should review their third-party ICT dependencies and private credit exposures in light of these supervisory risk flags.

UK FCA reports rise in money mule account closures

A survey by the FCA found that UK financial firms closed 238,396 suspected money mule accounts in 2025, up from 184,935 in 2023 and 233,269 in 2024. The National Crime Agency (NCA) estimates that more than £100bn is laundered through the UK or UK corporate structures each year.

Account closures were highest among customers aged 26 to 39, with 91,073 closures. The sharpest increase was observed among customers aged 40 to 49, rising from 25,760 in 2024 to 37,274 in 2025. Customers aged 25 and under accounted for 85,425 closures. The FCA noted that criminals moved fraudulent funds through multiple accounts, usually cashing out between the second and fifth account.

The FCA, NCA, Home Office, Treasury, HMRC, and industry are leading on 9 system priorities as part of the UK's response to economic crime.

Routine regulatory filings and sanctions updates

Cboe EDGX, Cboe BZX, Cboe EDGA, and Cboe BYX filed rule changes with immediate effectiveness to replace the term 'registered clearing agency' with 'Qualified Clearing Agency' and clarify that non-members may act as clearing firms. NYSE Arca filed a rule change amending Rule 7.10-E on Clearly Erroneous Executions. FINRA filed a rule change to temporarily pause the assessment of the Trading Activity Fee.

The US Department of the Treasury's Office of Foreign Assets Control (OFAC) published several general licenses, including GLs Y and Z for Iran, GL 5X and 5Y for Venezuela, GL 2 for a Central African nation subject to sanctions, and GL 12 for International Criminal Court-related sanctions. OFAC also designated one or more persons on the Specially Designated Nationals (SDN) List and removed names previously blocked under East African nation sanctions authorities.

Philip R. Lane of the European Central Bank delivered a speech on the outlook for the Euro Area Economy. The ECB also published a speech on the digitalisation of money, payments, and finance, and announced that almost ten million people took part in its survey on new euro banknotes. Mark Steward, Chief Executive of the Dubai Financial Services Authority, was appointed Vice Chair of the International Organization of Securities Commissions' Growth and Emerging Markets Committee.

Our read

The convergence of ESMA's upcoming digital innovation priority and the FCA's approval of the first live Digital Securities Depository suggests that regulatory frameworks for tokenised assets are moving from pilot to production in both the EU and UK. For firms operating in these jurisdictions, the immediate focus should be on aligning AI governance and tokenisation infrastructure with the specific supervisory expectations outlined by ESMA for 2027. In the US, the SEC's grant of immediate effectiveness to Coinbase Derivatives' rules for perpetual single-stock futures indicates a willingness to bring offshore-style crypto derivatives under formal US regulation, potentially reducing the arbitrage opportunity for unregulated offshore venues. Meanwhile, the ESAs' emphasis on external dependencies and private credit risks underscores the need for firms to reassess their third-party ICT risk profiles and transparency in private credit exposures.

This digest was produced automatically by a large-language-model system from the regulator publications and official sources listed below; it is AI-generated content and may contain inaccuracies. It is not legal advice — verify wording and deadlines against the original documents.

Sources