Editor’s note: This monthly update covers regulatory developments across Australia, New Zealand, the UK, and Canada. Our aim: help regulators who increasingly work with and learn from their global peers understand what is now live, why it matters, and what is coming. If you haven’t already, consider signing up for our monthly newsletter to stay abreast of the latest regulatory developments.
For regulators, 1 July is rarely an ordinary date. This year, however, it is genuinely exceptional.
On this day, three major frameworks will arrive simultaneously: Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) Tranche 2 obligations commence for roughly 90,000 newly regulated professionals, the second wave of Australia’s mandatory climate disclosure regime begins for Group 2 entities, and New Zealand’s Regulatory Standards Act 2025 Part 2 (and the Regulatory Standards Board it creates) comes into full operation. Less than a planned convergence, this flurry of activity is the compound effect of years of deferred reform arriving all at once.
Elsewhere, the Financial Conduct Authority’s (FCA’s) £9.1 billion motor finance redress scheme – by total cost the largest consumer compensation programme in British history – is suspended in legal limbo, with a tribunal hearing no earlier than October and a ruling expected in mid-November. And in Canada, a bill that law professor Michael Geist has described as a “two-headed surveillance monster” is being amended on the floor of Parliament in real time.
What is now live or unavoidable
Australia
AUSTRAC Tranche 2 obligations commence 1 July 2026. From that date, lawyers, accountants, conveyancers, real estate professionals, and dealers in precious metals, stones, and products must comply with AML/CTF obligations for the first time. The Australian Transaction Reports and Analysis Centre (AUSTRAC) has opened enrolment; the deadline is 29 July 2026 – after which daily penalties apply: up to A$18,780 per day for corporations, A$3,756 for individuals.
Each new reporting entity must verify client identities, build a written AML/CTF programme, and report suspicious matters to AUSTRAC. The list of obligations is longer than it looks – record-keeping requirements run for at least seven years, and a formal compliance officer must be appointed. For professional services firms with no prior experience of financial crime regulation, the capability demand is substantial. AUSTRAC has signalled it will concentrate early enforcement on engagement and egregious non-compliance rather than technical slip-ups, but the clock is now running.
Group 2 climate disclosures commence 1 July 2026. The second cohort of mandatory climate reporting under Australia’s Corporations Act sustainability reporting regime begins for financial years starting on or after 1 July 2026. Group 2 entities are mid-sized businesses with at least A$200 million in consolidated revenue, A$500 million in assets, or 250 employees. They must report under the Australian Sustainability Reporting Standards (ASRSs) on governance, strategy, risk management, and Scope 1 and 2 greenhouse gas emissions from year one. Directors must personally declare the sustainability report’s compliance.
The Australian Securities and Investments Commission (ASIC) has indicated a pragmatic approach to early enforcement – but entities are expected to take their obligations seriously from the first report. For more background, see our coverage of Australia’s regulatory implementation wave.
ASIC’s digital assets no-action position expires 30 June 2026. Providers of digital asset financial product services that have not applied for an Australian Financial Services (AFS) licence – or notified ASIC of their intention to apply – by 30 June 2026 will be in breach of financial services laws from that date. ASIC has emphasised that unlicensed conduct carries serious civil and criminal penalties, including fines of up to 10% of annual turnover. The Digital Assets Framework Act 2026 (DAF Act), which establishes the longer-term licensing regime for digital asset platforms, received Royal Assent on 8 April 2026 and commences 8 April 2027; the 30 June deadline operates under the existing AFS regime, not the new one.
New Zealand
Regulatory Standards Act Part 2 comes into force no later than 1 July 2026. The Regulatory Standards Act 2025 received Royal Assent on 17 November 2025 despite a Waitangi Tribunal finding of Treaty breach and opposition from 98.7% of more than 159,000 public submitters. Part 2, which establishes the Regulatory Standards Board, comes into force no later than 1 July 2026. The board was appointed in April 2026; its chair is Paul Ridley-Smith. From commencement, all government-initiated legislation and new regulation must be assessed for consistency with the Act’s principles of responsible regulation, and a “consistency accountability statement” must accompany any bills or regulations that depart from those principles. TMR has covered the Act’s contested passage in our earlier analysis.
Online casino licensing moves forward. The Online Casino Gambling Bill commenced on 1 May 2026, permitting up to 15 licensed operators to offer online casino games to New Zealanders from December 2026. Expressions of interest for licences are expected to open in July 2026, with an auction in September and applications in October. Advertising by unlicensed offshore platforms has been illegal since May 2026. Fines of up to NZ$5 million apply for violations.
United Kingdom
FCA motor finance redress scheme – legal challenge hearing approaches. The FCA confirmed on 1 May 2026 that its industry-wide motor finance compensation scheme had been legally challenged by four parties: Mercedes-Benz Financial Services, Volkswagen Financial Services, CA Auto Finance, and a consumer body called Consumer Voice. A tribunal hearing is not expected before October 2026, with a ruling anticipated in mid-November. The FCA has told lenders to prepare on a precautionary basis for the possibility of the scheme being annulled. The scheme covers approximately 12.1 million motor finance agreements made between 6 April 2007 and 1 November 2024, with total costs – including administration – estimated at £9.1 billion, and redress to consumers alone estimated at approximately £7.5 billion. For context on the scheme’s design history, see our motor finance split analysis.
Ofcom’s Online Safety Act categorised services register expected in July 2026. The register, which determines which online services are subject to the most demanding child protection obligations, has been pushed back twice and is now targeted for July 2026. Services on or near the threshold for higher-tier categorisation should anticipate a new wave of compliance scrutiny once the list is published.
Canada
Bill C-22 under amendment. The Lawful Access Act, 2026, introduced on 12 March 2026 as the government’s second attempt at lawful access legislation, is being amended. Public Safety Minister Gary Anandasangaree announced on 27 May 2026 that he would propose modifications to better protect encryption and clarify the bill’s metadata retention requirements. Law professor Michael Geist has described the bill’s architecture as a “two-headed surveillance monster” – one head being mandatory metadata retention that would affect tens of millions of Canadians with no requirement for individualised suspicion, and the other a technical capability mandate compelling service providers to build intercept infrastructure under secret ministerial orders. The proposed amendments were expected to be tabled on 27 May 2026, but the substantive privacy tensions are likely to persist.
Four stories to watch
When 90,000 businesses enter the AML/CTF net at once
From 1 July 2026, around 90,000 businesses – lawyers, accountants, real estate agents, precious metals dealers – must comply with Australia’s AML/CTF laws for the first time. There is no comparable modern precedent for that speed of supervised-population expansion.
AUSTRAC’s approach to managing this transition has been deliberate: widen the perimeter, set clear expectations, phase the harder obligations, and concentrate supervisory energy on the sectors most exposed to criminal exploitation. The enrolment deadline of 29 July 2026 means entities that miss 1 July are not immediately in breach, but the daily penalty clock starts the day after that window closes.
What this means for the supervised population is relatively clear. What it means for AUSTRAC is less so. Bringing 90,000 new entities into supervision simultaneously – across sectors with different professional cultures, different peak bodies, and very different ideas about what compliance looks like – is not a challenge that guidance documents alone can resolve. The agency will need to triage, communicate through intermediaries, and make early enforcement choices that signal expectations without generating panic. How AUSTRAC handles the first six months will matter far more than how the legislation reads.
For context on the broader trajectory of Australia’s regulatory implementation wave, see our April feature.
The FCA scheme in the dock
The motor finance redress scheme was designed to be the definitive resolution of a scandal that has hung over the UK car finance industry since January 2024 – and, in the FCA’s telling, since 2007. By some measures it already represents the most sophisticated mass redress mechanism a UK financial regulator has attempted: a standardised methodology, automated eligibility criteria, a hybrid remedy structure, and a deliberate decision to route claims through the scheme rather than the courts.
The legal challenge changes the picture entirely. Four parties – including two of Europe’s largest vehicle-financing arms – are now contesting the scheme’s lawfulness before the Upper Tribunal (Tax and Chancery Chamber). A hearing is not expected before October 2026, and the FCA has told lenders to prepare on a precautionary basis for a ruling that could annul the scheme entirely. Implementation deadlines of 30 June 2026 (for post-April 2014 agreements) and 31 August 2026 (for pre-2014 agreements) remain formally in place, but no lender is likely to invest heavily in systems it may not be required to operate.
The deeper question is structural. Can a regulator impose mass industry-wide remediation by policy statement alone, without primary legislation, and have that withstand judicial review? The FCA’s position is that it can. The tribunal’s answer – expected in mid-November – will set the terms of that debate for years. If the scheme is upheld, the FCA has demonstrated that soft-law redress at scale can survive challenge. If it is struck down, Parliament will face pressure to legislate, and regulators in other jurisdictions watching this model will need to recalibrate.
Climate disclosure meets its second wave
Group 2 mandatory climate reporting is a significant expansion in scope, not just in numbers. The first cohort – large listed companies and financial institutions – had existing disclosure infrastructure, investor pressure, and dedicated sustainability teams. The second cohort, commencing 1 July 2026, is different: mid-sized entities with at least A$200 million in revenue, A$500 million in assets, or 250 employees are being asked to meet broadly the same standard with considerably less capacity.
The standard is demanding. Governance disclosures, climate-related risk and opportunity analysis, scenario analysis for climate resilience, transition plan information, and Scope 1 and 2 emissions data must all appear in the first report. Directors must personally declare compliance. ASIC has said early enforcement will be pragmatic. What it hasn’t said is what happens when a director signs a compliance declaration over a report that turns out to be materially wrong.
Surveillance, encryption, and the Canadian bill that won’t stay still
Bill C-22 is among the most contested pieces of legislation in the Canadian Parliament’s current session, and it’s still moving. The Lawful Access Act, 2026 is the Carney government’s successor to Bill C-2, and it has arrived at committee carrying the same structural tensions that defeated its predecessor.
The amendment proposed on 27 May 2026 – to clarify encryption protections and narrow the metadata retention definition – represents a meaningful response to the sharpest technical objections. But the underlying architecture remains: Part 2 of the bill would require “core providers” (large telecoms and, potentially, any digital service provider, by ministerial order) to build and maintain intercept-infrastructure capabilities, subject to secret orders they cannot publicly acknowledge. The metadata retention regime would require those providers to retain location and communications data for up to one year, without individualised suspicion.
For regulators outside the privacy and telecommunications sectors, the implications are indirect but real. Any framework that creates large-scale metadata repositories increases the attack surface for data breaches, raises the bar for what “adequate” data security looks like, and expands the obligations on regulated entities that also operate digital services.
What is coming: July to September
- 1 July – AML/CTF Tranche 2 obligations commence for ~90,000 new entities (Australia)
- 1 July – Group 2 mandatory climate disclosure commences (Australia)
- 1 July (no later) – Regulatory Standards Act Part 2 in force; Regulatory Standards Board operational (New Zealand)
- July – Online casino licence expressions of interest expected to open (New Zealand)
- July – Ofcom Online Safety Act categorised services register expected (UK)
- 29 July – AUSTRAC Tranche 2 enrolment deadline; penalties apply after this date (Australia)
- 31 August – FCA motor finance redress implementation deadline for pre-2014 agreements, subject to tribunal outcome (UK)
- September – Online casino licence auction expected (New Zealand)
- October – FCA motor finance tribunal hearing, earliest expected date (UK)
- October – Online casino licence applications expected to open (New Zealand)
- Mid-November – FCA motor finance tribunal ruling expected (UK)
The Final Word
The FCA’s motor finance scheme may be the largest consumer redress programme a British financial regulator has ever attempted. It is now in front of a tribunal before it has paid out a single claim.
FCA Chief Executive Nikhil Rathi’s message to lenders was direct, delivered in an interview with the Financial Times on 3 August 2025:
“Now is not the time to haggle with us, but to help put things right for consumers. You can’t say the law has been broken but you don’t want to put it right.”
Whatever the tribunal decides, that sentence will be quoted for years – in favour of regulators when schemes are upheld, and against them when the line between policy ambition and legal authority blurs. The motor finance case is not really about car loans. It’s about whether a regulator can compel mass industry-wide remediation by design alone, without Parliament. The answer, arriving in November, matters well beyond the UK.
For more on the stories behind this update, check out these other TMR articles: AUSTRAC Tranche 2 guide · the ICO’s AI rulebook · NZ regulatory standards · Canada’s AI governance gap
