Compliance Digest—May 2026

Every month, Sumsub’s Compliance Team prepares a digest with all the latest updates in the world of AML and beyond. We cover multiple industries, from AI and crypto to gambling.

If you want to get the latest news every month in one place, subscribe to our newsletter.

Crypto 

European Commission🇪🇺 Launches Review of EU Crypto Rules (MiCA) and Seeks Market Feedback

What happened?

The European Commission has opened a public consultation to assess whether the EU's Markets in Crypto-Assets Regulation (MiCA) remains effective and fit for purpose following its initial implementation. The review will examine how the framework is working in practice and whether amendments or additional rules may be needed as crypto markets continue to evolve. Areas under review include crypto-assets, stablecoins, crypto-asset service providers (CASPs), tokenized assets, decentralized finance (DeFi), and other emerging digital asset activities. The consultation may inform a future legislative proposal to amend or complement MiCA.

Suggested read: MiCA Regulation and EU Crypto Rules: What Changes in 2026

Who's affected?

• CASPs
• Crypto issuers, including stablecoin issuers
• Financial institutions and asset managers involved in tokenization or digital assets
• DeFi participants and protocol operators
• Industry associations, legal and compliance professionals
• Consumers, investors, and other stakeholders in the EU crypto ecosystem

The Commission is seeking input from both the general public and industry stakeholders through separate questionnaires. 

Deadline:

August 31, 2026: Responses must be submitted through the European Commission's consultation portal by this date. 

Read more:

• Commission seeks feedback on the functioning of EU crypto-assets rules
• Targeted consultation on the review of Regulation on the Markets in Crypto-Assets (MiCA)

Malta's🇲🇹 MFSA Launches Consultation on the Tokenization of Financial Instruments and Real-World Assets

What happened?

The Malta Financial Services Authority (MFSA) has launched a public consultation on the tokenization of financial instruments and real-world assets (RWAs) in Malta. The consultation seeks stakeholder feedback on the opportunities, challenges, and regulatory considerations associated with the development of tokenized financial markets. Key areas covered in the consultation include:

• Market appetite and strategic positioning, including which asset classes may be most suitable for tokenization in Malta
• Legal and regulatory considerations, such as ownership rights, settlement finality, and the enforceability of smart contracts
• Market infrastructure requirements, including token registries, interoperability between distributed ledger technology (DLT) systems, and custody arrangements
• Investor protection and risk management, addressing technological, operational, and financial risks associated with tokenization
• Domestic market development, including the role of investment firms, CASPs, and other market participants

The MFSA is also seeking views on whether tokenization can be accommodated within existing regulatory frameworks or whether targeted legislative and regulatory amendments may be required to support wider adoption.

Who's affected?

• Investment firms and securities market participants
• CASPs
• Issuers and promoters of tokenized financial instruments
• Custodians and market infrastructure providers
• FinTech and DLT service providers
• Institutional and retail investors
• Legal, compliance, and regulatory professionals
• Industry associations and other stakeholders involved in digital assets and tokenization

Deadline:

June 30, 2026: Stakeholders are invited to submit comments and feedback on the consultation document by this date.

Read more:

Tokenisation of Financial Instruments and Real-World Assets in Malta

US🇺🇸 CFTC Issues Advisory on 24/7 Trading, Clearing, and Settlement in Derivatives Markets

What happened?

On May 29, 2026, the Commodity Futures Trading Commission (CFTC) issued a joint staff advisory addressing the growing trend toward 24/7 trading, clearing, and settlement in derivatives markets. The advisory was published by the Division of Clearing and Risk, Division of Market Oversight, and Market Participants Division. The advisory is intended to support innovation while reminding market participants of their obligations under the Commodity Exchange Act (CEA) and CFTC regulations when operating or transitioning toward continuous market activity.

Key points include:

• Expectations for designated contract markets (DCMs), swap execution facilities (SEFs), derivatives clearing organizations (DCOs), and futures commission merchants (FCMs) operating on a 24/7 basis
• Considerations relating to market surveillance, risk management, clearing operations, governance, and operational resilience
• Recognition that certain asset classes may be better suited to continuous trading than others.
• Specific acknowledgment that crypto-asset derivatives may be particularly well-suited for 24/7 trading due to their digital infrastructure and global market activity
• Caution that other markets, such as agricultural derivatives, may face unique challenges due to their trading practices, customer bases, and regional market structures

The advisory forms part of a broader CFTC effort to modernize derivatives market oversight in response to developments in digital assets, perpetual contracts, and evolving market structures. On the same day, the CFTC also approved Kalshi’s bitcoin perpetual futures contract and issued related guidance on crypto perpetuals. 

Who’s affected?

• Designated contract markets (DCMs)
• Swap execution facilities (SEFs)
• Derivatives clearing organizations (DCOs)
• Futures commission merchants (FCMs)
• Crypto derivatives exchanges and trading venues
• Clearing, operations, risk management, and compliance teams
• Firms exploring perpetual contracts or continuous trading models
• Institutional participants trading crypto-linked or other derivatives products

Deadline:

• May 29, 2026: Advisory issued and effective immediately
• No specific compliance deadline was introduced, but the CFTC expects firms pursuing 24/7 trading models to proactively ensure compliance with existing regulatory obligations

Read more:

CFTC Staff Issues Advisory on 24/7 Trading, Clearing, and Settlement

AML 

EU🇪🇺 AMLA Publishes Reporting Package to Identify Entities Subject to Direct Supervision

What happened?

The Anti-Money Laundering Authority (AMLA) has published a reporting package to support the identification of provisionally eligible obliged entities that may fall under AMLA's direct supervision framework from 2028, following the selection process scheduled for 2027. The package provides the reporting framework that national supervisors will use to determine which entities meet the eligibility criteria for inclusion in AMLA's selection process. It includes:

• A standardized reporting template for data collection.
• An interpretative note containing detailed specifications and reporting instructions.
• Guidance to ensure consistent and accurate reporting by national supervisors and obliged entities.

National supervisors will coordinate the collection of information from obliged entities within their supervisory remit, while AMLA remains responsible for setting the reporting specifications and receiving the submitted data.

Who's affected?

• Credit institutions and financial institutions that may fall within AMLA's direct supervisory scope
• Other obliged entities that may meet the eligibility criteria under the EU AML framework
• National AML/CFT supervisors responsible for collecting and validating the required information
• Compliance, legal, regulatory reporting, and AML teams within affected entities

Deadline:

• June 10, 2026: AMLA will host a public webinar providing a practical walkthrough of the reporting template
• August 15, 2026: Deadline for national supervisors to collect and submit the required data to AMLA
• End of September 2026: Expected finalization of the provisional list of eligible obliged entities

Read more:

Interpretative Note on the identification of provisionally eligible obliged entities pursuant to the draft ITS under Article 15(3) AMLAR

Gambling 

Brazil🇧🇷 Central Bank Expands Fraud Information-Sharing Rules to Cover Virtual Assets and Illegal Betting Operators

What happened?

On May 19, 2026, the Central Bank of Brazil issued Resolution BCB 569, amending Resolution BCB 343/2023 on the sharing of data and information relating to evidence of fraud. The changes expand the scope of reportable fraud indicators to include activity by natural or legal persons as unauthorized betting operators, provision of virtual asset services, provision of financial and payment services to unauthorized betting operators, as well as related credit operations.

Who’s affected?

• BCB-supervised financial institutions
• payment institutions and payment service providers
• institutions involved in virtual asset services
• entities providing financial or payment services to betting operators
• compliance, fraud monitoring, KYC, AML, and payments teams

Deadline:

• Effective date: May 19, 2026.
• October 30, 2026: deadline to adapt systems for virtual asset service-related requirements
• December 1, 2026: deadline for measures relating to financial and payment services provided to unauthorized betting operators

Read more:

Resolução BCB n° 569 de 19/5/2026

New Zealand🇳🇿 Releases May 2026 Updates on Online Gambling Licensing Framework

What happened?

The Department of Internal Affairs (DIA) provided further updates in May 2026 regarding the implementation of New Zealand’s new regulated online casino gambling regime.

The updates form part of the ongoing rollout of the Online Casino Gambling Bill, which will establish a licensing framework for online casino operators and replace the current environment where New Zealand consumers largely access offshore gambling platforms.

The DIA confirmed that detailed regulations governing licensed operators are expected to be finalized by mid-2026. The framework will include requirements relating to:

• harm prevention and minimization
• consumer protection measures
• AML/CFT compliance and record-keeping
• advertising and marketing restrictions
• fees, levies, and licensing requirements

The government reiterated that the objective is to channel consumers from unregulated offshore operators into a regulated market with stronger safeguards and oversight. Up to 15 online casino licenses are expected to be issued through a competitive process. 

Who’s affected?

• Online casino operators seeking access to the New Zealand market
• Existing offshore gambling providers serving New Zealand customers
• Gambling compliance, AML/CFT, licensing, and regulatory affairs teams
• Technology, payments, and customer protection functions within gambling operators
• Investors and service providers supporting the online gambling sector

Deadline:

• Mid-2026: Publication/finalization of detailed online casino regulations
• July 2026: Expressions of interest expected to open for prospective operators
• September 2026: Proposed license auction process
• October 2026: Formal license application process expected to begin
• December 1, 2026: Licensed online casino regime expected to commence, with only licensed operators permitted to offer services to New Zealand consumers (subject to transitional arrangements)

Read more:

Information for online casino providers: licensing and compliance

UK🇬🇧 Gambling Commission Extends Deadline for New Deposit Limit Requirements

What happened?

The UK Gambling Commission has extended the implementation deadline for the second phase of its new deposit limit requirements under the Remote Gambling and Software Technical Standards (RTS).

The changes were originally due to take effect on June 30, 2026, but following industry feedback, the Commission has postponed implementation until September 30, 2026 to give operators additional time to make the necessary technical and compliance updates. 

Under the updated requirements, operators will be required to:

• Offer gross deposit limits to customers
• Use the term “deposit limit” exclusively for gross deposit limits
• Give gross deposit limits at least as much prominence as other financial limit tools
• Prevent further deposits once a deposit limit is reached unless the customer actively increases the limit (subject to applicable cooling-off requirements)

The Commission also clarified that only gross deposit limits must operate on a fixed time-frame basis, while other financial limit types (such as loss limits or net deposit limits) may continue to use either fixed or rolling periods. 

Who’s affected?

• Remote gambling operators licensed in Great Britain
• Online betting, casino, bingo, and gambling platform providers
• Product, engineering, compliance, and responsible gambling teams
• Customer protection and safer gambling functions
• Technology providers supporting gambling operators’ account management and financial controls

Deadline:

• October 31, 2025: First phase of customer financial limit requirements entered into force
• June 30, 2026: Original implementation date for the second phase
• September 30, 2026: New implementation deadline for the updated deposit limit requirements

Read more:

Implementation extension for new deposit limit requirements

AI

EU🇪🇺 Agrees on ‘Digital Omnibus on AI’ to Simplify Implementation of the AI Act

What happened?

On May 13, 2026, the Permanent Representatives Committee (Coreper) confirmed a compromise text on the proposed Digital Omnibus on AI, which amends the EU AI Act (Regulation (EU) 2024/1689) to address implementation challenges and reduce compliance burdens.

Suggested read: Comprehensive Guide to AI Laws and Regulations Worldwide (2026)

Key changes include:

• Delaying the application of key obligations for high-risk AI systems
• Simplifying compliance requirements for SMEs and small mid-cap companies (SMCs)
• Replacing the AI literacy obligation with a more flexible requirement to support AI literacy development
• Expanding regulatory sandboxes and real-world testing opportunities
• Streamlining conformity assessment and registration requirements
• Clarifying the interaction between the AI Act and sectoral legislation (e.g., machinery, aviation, cybersecurity)
• Introducing a prohibition on AI systems designed to generate or manipulate non-consensual intimate content and child sexual abuse material

Who's affected?

• Providers and deployers of AI systems
• High-risk AI system providers
• General-purpose AI providers
• SMEs, startups, and small mid-cap companies (SMCs)
• Conformity assessment bodies and notified bodies
• National AI regulators and market surveillance authorities
• Companies developing AI-enabled products subject to sector-specific regulation (e.g., machinery, medical devices, aviation)

Deadline:

• December 2, 2026: Providers of AI-generated content systems already on the market must comply with AI content marking requirements
• December 2, 2027: High-risk AI obligations apply to AI systems classified as high-risk under Article 6(2) and Annex III of the AI Act
• August 2, 2028: High-risk AI obligations apply to AI systems classified as high-risk under Article 6(1) and Annex I (AI embedded in regulated products)
• September 2, 2027: Commission guidance on post-market monitoring plans is to be published

Read more:

Council Document 9247/26 – Digital Omnibus on AI

Dubai🇦🇪 Launches Two-Year Initiative to Transition Private Sector to Agentic AI

What happened?

On May 4, 2026, Hamdan bin Mohammed bin Rashid Al Maktoum, Crown Prince of Dubai, launched a new initiative aimed at transitioning Dubai’s private sector toward Agentic AI: AI systems capable of autonomously executing tasks, making decisions, and managing operations with minimal human intervention.

Suggested read: From AI Agents to Know Your Agent: Why KYA Is Critical for Secure Autonomous AI

The initiative was launched under the directives of Mohammed bin Rashid Al Maktoum and forms part of Dubai’s broader strategy to position itself as a global leader in AI adoption and digital transformation. Key elements of the program include:

• A two-year transformation plan for Dubai’s private sector
• Specialized Agentic AI training programs for all business councils affiliated with the Dubai Chamber of Commerce
• Establishment of incubators for Agentic AI companies
• Creation of dedicated funding mechanisms to support AI-driven businesses and innovation
• Development of new economic opportunities and skills pathways for young professionals and entrepreneurs

The initiative aims to increase productivity, reduce operational costs, accelerate innovation, and strengthen Dubai’s competitiveness as a global technology and business hub. 

Who’s affected?

• Companies operating in Dubai across all sectors
• Members of the Dubai Chamber of Commerce and affiliated business councils
• Technology, AI, innovation, and digital transformation teams
• Startups and entrepreneurs developing Agentic AI solutions
• Financial institutions, professional services firms, and multinational companies with operations in Dubai
• Workforce development, HR, compliance, and governance functions responsible for AI adoption and oversight

Deadline:

• May 4, 2026: Initiative launched
• Within two years (by 2028) Dubai aims to transition its private sector toward widespread adoption of Agentic AI technologies

Read more:

Hamdan bin Mohammed launches new initiative to transition Dubai’s private sector toward Agentic AI within two years