1. FSB finalises AI sound practices as G20 considers stablecoin cross-border risks

Two FSB publications frame today’s meeting of G20 Finance Ministers and Central Bank Governors. The first, published today (15 October), is the FSB’s final report on sound practices for the responsible adoption of artificial intelligence in finance. The second, published on 12 October, is the FSB’s note on global stablecoin arrangements and cross-border vulnerabilities. Chair Andrew Bailey’s letter to G20 ministers, also dated 12 October, drew on both streams of work.

AI sound practices: final report published today

The FSB published its finalised report “Sound Practices for Responsible Adoption of Artificial Intelligence (AI)” today, along with an overview of responses to the June 2026 consultation. The report is a deliverable for the US G20.

The 12 sound practices are organised into two broad groups. The first covers organisation-wide AI governance, including board and senior-management oversight, governance roles and responsibilities, integrating AI risk into existing risk-management frameworks, and documentation and continuous learning. The second covers risk management throughout the AI lifecycle from development to deployment and encompasses materiality and risk assessment, technology selection, data governance, explainability and compensating controls, performance evaluation, human oversight, cyber and ICT risk, and third-party AI dependency risk. Practices 11 and 12, on cyber and ICT risk and third-party AI dependencies respectively, are of particular relevance to firms deploying AI through external model providers or critical third-party infrastructure.

The FSB strongly encourages boards and senior management of financial institutions to reference the practices when developing or refining AI governance, risk-management and control frameworks. The sound practices are not binding legal obligations; they sit alongside, rather than within, regulatory frameworks such as the EU AI Act, which will apply binding obligations on high-risk AI systems from 2 December 2027 (Article 6(2)/Annex III).

The cyber dimension was already visible in Bailey’s G20 communication of 31 August 2026, in which he warned that frontier AI could materially alter the speed, scale and economics of cyber risk. Today’s final report translates that broader concern into practical governance and risk-management expectations for financial institutions.

Global stablecoin arrangements: cross-border vulnerabilities (12 October)

The FSB’s note on global stablecoin arrangements, published on 12 October, addresses the structural vulnerabilities that arise when stablecoin arrangements operate continuously across multiple entities, reserve holders and jurisdictions. The note highlights several recurring vulnerabilities.

Multi-issuer arrangements create conditions for concentrated run risk: where holders may redeem with any affiliated issuer, demand can accumulate on a single entity while reserves sit dispersed across jurisdictions, and moving reserves under stress may not be operationally feasible.

Monitoring capacity is constrained by data quality. Authorities rely principally on private data providers with inconsistent methodologies, and the pseudonymous nature of blockchains makes it difficult to track where holders are located, what stablecoins are used for, or what redemption demands may look like in a stress scenario.

Cross-border crisis management remains, in Bailey’s assessment in the 12 October letter, “immature or not yet developed.” Where multiple entities and jurisdictions are involved, the applicable insolvency regime and the mechanism for coordinating an orderly resolution are not clearly established. Round-the-clock secondary market trading adds the further complication of continuous market pressure in any distress scenario.

The FSB’s 2025 review found that 11 of 28 surveyed jurisdictions had finalised stablecoin frameworks. The note identifies three areas for continued work: enhanced cross-border monitoring; stronger information-sharing under the FSB’s 2023 recommendations; and fact-finding on emerging approaches to distress planning and failure resolution. The note is not a rulemaking instrument and creates no new legal obligations.

FinReg Daily analysis

The two FSB publications address different problems with a shared underlying characteristic: governance frameworks designed for entities operating within single jurisdictions are under strain when the relevant activities, data or risk concentrations span multiple legal systems simultaneously.

On AI, the finalised sound practices give financial institutions a clear reference point for internal governance review. The emphasis in practices 11 and 12 on cyber and third-party dependencies is particularly timely: as AI deployment moves increasingly through external providers, counterparty and operational risk frameworks need to extend to the AI supply chain. The FSB’s positioning of board and senior-management ownership as central to the framework reinforces that AI governance is a matter of institutional culture, not simply a compliance function.

On stablecoins, the 12 October note warrants reading alongside the ESRB’s response to the European Commission’s MiCA-review consultation, dated 30 September 2026 and re-highlighted on the ESRB’s website on 14 October. The ESRB continues to raise financial-stability concerns regarding third-country multi-issuer stablecoin schemes, drawing on Recommendation ESRB/2025/9, which took the position that such schemes should not be treated as permissible under the current MiCA framework unless a dedicated safeguards framework is created. That is the ESRB’s institutional position, not current MiCA law. Taken together, the FSB and ESRB material shows that cross-border multi-issuer stablecoin structures are receiving sustained attention from both global and European financial-stability authorities.

2. MiCAR implementation: BingX EU receives Austrian authorisation

Austria’s Financial Market Authority (FMA) authorised MEGE zweite GmbH, the Vienna-based entity operating as BingX EU, as a crypto-asset service provider under Article 63 of MiCA by decision dated 13 October 2026. The FMA published the authorisation on 14 October. The company made a public announcement on 15 October.

The authorisation covers four services: custody and administration of cryptoassets on behalf of clients; exchange of cryptoassets for funds; exchange of cryptoassets for other cryptoassets; and transfer services for cryptoassets on behalf of clients. The authorisation can support cross-border provision of those services elsewhere in the EU through MiCA’s passporting notification framework. Chief Executive Daniel Lai described the authorisation as enabling the company to develop its services within a clearer regulatory framework.

FinReg Daily analysis

The BingX EU authorisation is worth noting alongside a development from earlier this week. The global BingX exchange was among the 27 platforms whose websites South Korea’s communications regulator approved for domestic access blocking (Issue 147), on the basis that those platforms had not registered under the Act on Reporting and Using Specified Financial Transaction Information. The Austrian MiCA authorisation applies to MEGE zweite GmbH, a distinct legal entity operating in the European context; it does not extend to or legitimise the global platform’s activities in other jurisdictions. The juxtaposition is a useful reminder that regulatory status attaches to legal entities, activities and jurisdictions, not merely to global brand names. For compliance counsel and counterparties, entity-level verification remains essential.

Digital Assets Regulatory Compass

The FSB’s findings on stablecoin cross-border risk apply across every jurisdiction in which stablecoin issuers and service providers operate. How monitoring obligations, reserve requirements and passporting or equivalence frameworks interact in practice varies materially by market. WH Partners maintains a jurisdiction-by-jurisdiction digital-assets regulatory resource for practitioners tracking those local variations: https://whpartners.eu/digital-assets-regulatory-compass/

Rolling Action Calendar

• 20 October 2026: SEC Regulation Crypto Assets comment deadline (proposed offering exemptions and conditional safe harbour)
• 23 October 2026, 23:59: EBA first-batch DGSD3 consultations close, including Guidelines on the investment of available financial means by Deposit Guarantee Schemes under the revised DGSD framework
• 28 October 2026: ESMA tokenisation workshop
• 30 October 2026: RBA consultation closes on RITS access policy and tokenised ecosystem
• 2 November 2026: EBA consultation closes on draft RTS under EMIR on margin models including ISDA SIMM framework
• 3 November 2026: SEC comment deadline on Transfer Agent Modernisation (optional DLT for securities ownership tracking)
• 5 November 2026: Bank of England MPC decision and Monetary Policy Report
• 25 November 2026: EBA consultation closes on draft RTS on reclassification of investment firms as credit institutions
• 6 December 2026: Malta PAD Parts V and VI (L.N. 258/2026) take effect (switching and cross-border account access provisions deferred from 6 October 2026)
• 7 December 2026: SEC comment period closes on Adviser and Regulated Fund Custody Rules; Crypto Custody Rules
• 14 December 2026: CFTC comment deadline on Regulation CTX/CAM ANPR
• 31 December 2026: EBA consultation closes on draft RTS on operational risk management under CRR3
• 8 January 2027: ESMA outer supervisory timeframe for NCAs to address remaining non-MiCA-compliant ART/EMT exposure
• 15 January 2027: ESMA call for evidence closes on tokenised assets as CCP collateral
• 7 February 2027: PRA CP13/26 closes (Updating Regulatory Thresholds: An Autopilot Approach)
• 28 February 2027: FCA cryptoasset authorisation application window closes (opened 30 September 2026)
• Q1 2027: UK DIGIT pilot issuance
• 25 October 2027: FCA new UK cryptoasset regime in force
• 2 December 2027: EU AI Act Chapter III Sections 1, 2 and 3 (Article 6(2)/Annex III) apply
• 2 August 2028: EU AI Act Article 6(1)/Annex I apply

Note: CFTC event-contract proposal and casino-style gambling interim final rule comment deadlines to be confirmed on Federal Register publication.

Source: Joseph F. Borg