Editor’s note: This monthly update covers regulatory developments across Australia, New Zealand, the UK, and Canada. Our aim: help regulators – who increasingly work with and learn from their peers across these global jurisdictions despite their distance – understand what is now live, why it matters, and what is coming. If you haven’t already, consider signing up for our monthly newsletter to stay abreast of the latest regulatory developments.
This March, regulatory design meets daily use. Frameworks that have lived in the abstract – in consultation papers and legislative timetables – now begin to operate as systems.
In Australia, mandatory cybersecurity standards for smart devices take effect on 4 March, and the Australian Transaction Reports and Analysis Centre (AUSTRAC) begins the most substantial anti-money laundering transition in decades. Competition authorities are recalibrating merger control and digital conduct rules. New Zealand is easing low-risk foreign investment while tightening its environmental planning architecture. And while Canada advances a child exploitation bill, it leaves broader digital reform in preparation, or stasis.
What binds these developments is judgment about pace and priority. AUSTRAC has deferred certain customer due diligence obligations for legacy clients by three years, while widening the regime and pressing ahead with new governance expectations.
What binds these developments is judgment about pace and priority.
The choice is neither indulgence nor retreat. Instead, it is an acknowledgement of capacity and sequencing. In the UK, the Competition and Markets Authority (CMA) is drafting binding conduct requirements for Google at the same time as the government consults on reshaping the authority itself. Institutional structure and regulatory intervention are moving together. In New Zealand, liberalisation and constraint are unfolding in parallel, leaving agencies to resolve the trade-offs in day-to-day decisions.
The Financial Conduct Authority’s (FCA) new sector-specific Regulatory Priorities reports reflect a similar shift in emphasis. Regular, structured expectation-setting replaces occasional portfolio letters. No statute changes, yet boards receive a clearer map of supervisory focus, and coordination across agencies adjusts accordingly.
Across jurisdictions, March is less about fresh announcements than about whether institutions can convert design into durable practice.
Regulatory orientation: what is now live or unavoidable
Australia
- Smart device cybersecurity rules commence 4 March. The Cyber Security (Security Standards for Smart Devices) Rules 2025 switch on mandatory minimum security requirements for consumer IoT products including smart TVs, cameras, routers, and wearables. This is Australia’s first test of making “secure-by-design” an enforceable market access condition rather than an aspiration, and it should quickly reveal how much technical and legal capacity product regulators actually have.
- AML/CTF reform begins for existing reporting entities on 31 March. Updated programme and governance expectations commence, but the Australian Transaction Reports and Analysis Centre’s (AUSTRAC) transitional rules defer initial customer due diligence for legacy customers until March 2029, while insisting on credible implementation plans and ongoing monitoring. The regulator is using time and expectations as supervisory tools, concentrating early enforcement on engagement and egregious non-compliance rather than technical slip-ups – which matters for how boards prioritise scarce change resources.
- Tranche 2 professions move toward AML/CTF supervision. From 31 March, AUSTRAC opens enrolment to lawyers, accountants, real estate agents, and dealers in precious metals and stones ahead of obligations commencing 1 July. This will rapidly widen the number and diversity of supervised entities, forcing regulators to design proportionate oversight models for sectors with little prior experience of financial crime regulation.
- ACCC merger thresholds start to bite. Australia’s mandatory merger control regime, in force since January, lowers notification thresholds from 1 April, with cumulative tests based on party size and transaction value. This is when in-house teams and the Australian Competition and Consumer Commission (ACCC) itself will see whether filing volumes and review timelines match the “fewer but better” ambition of the reforms.
- ACCC confirms 2026–27 enforcement priorities. Eleven priorities include supermarket pricing, domestic aviation, digital platforms, cartels, and product safety, with explicit emphasis on executive accountability. For regulators, this reweights where competition scrutiny and political attention are likely to fall, influencing how other agencies coordinate their own investigations and public messaging.
- The Australian Securities and Investments Commission (ASIC) sustains a more muscular enforcement stance. Priorities announced in late 2025 confirm continued focus on poor product design, misleading pricing, greenwashing, private credit, and insurance claims handling failures, with investigations and court actions already at significantly higher levels than in prior years. The new normal is a securities regulator more willing to litigate, which changes the risk calculus for supervised entities and for other regulators considering joint or parallel action.
New Zealand
- Overseas Investment Act reforms take effect 6 March. A new risk-based framework for overseas investments comes into force, with streamlined pathways and an aspirational 15-day (or faster) processing target for low-risk applications, and new rights for certain high-value investor visa holders. Regulators will be judged on whether they can maintain genuine national interest scrutiny while materially speeding up benign deals.
- The Commerce Commission’s Gull–NPD fuel merger decision looms. By 16 March, the commission must decide whether to allow consolidation into New Zealand’s third-largest fuel retailer, with roughly 240 stations. Whatever the outcome, this will become a reference case for how the regulator balances low-cost competition, regional resilience, and the risks of consolidation in concentrated markets.
- Resource Management Act replacement moves through select committee. The twin Planning and Natural Environment Bills are now before the Environment Select Committee with submissions closed and a report expected later in 2026. This is the final design window before a multi-year transition that will redefine planning obligations, environmental limits, and appeal pathways.
- Crypto-Asset Reporting Framework begins 1 April. Inland Revenue is preparing to implement the OECD framework, requiring domestic service providers to track and report detailed transaction data. This will increase the data available to tax and financial intelligence units but also raises coordination questions about how that information is shared and acted on across agencies.
- Online casino licensing edges closer. The government’s Online Casino Gambling Bill is advancing toward an expressions-of-interest phase for a capped number of licences under a new national regime. Gambling and financial regulators will need to work out how harm minimisation, AML, and consumer protections are coordinated in what is currently a regulatory gap.
United Kingdom
- The CMA’s first conduct requirements for Google move from concept to design. Following Google’s designation as a strategic market status firm, the CMA has consulted on binding conduct requirements for its search and search advertising services, covering self-preferencing, data use, and publisher protections. March is when the authority begins turning high-level duties into practical expectations, shaping how publishers, advertisers, and sector regulators adjust their own strategies.
- The Department for Business and Trade’s (DBT) consultation on overhauling the CMA runs to 31 March. Proposals include replacing independent Phase 2 panels with Board sub-committees, introducing a single-phase market review tool, adding algorithm investigation powers, and imposing sunset clauses on remedies. These changes would alter how quickly and how visibly the CMA can act, which matters for regulators that rely on its findings in digital, utilities, and consumer markets.
- CMA draft guidance on unfair contract terms closes 19 March. Refreshed guidance aligned with new Digital Markets, Competition and Consumers Act (DMCC Act) powers will influence how both the CMA and sector regulators assess subscription models and dark-pattern-adjacent practices.
- Online Safety Act implementation continues in the background. Priority offences including serious self-harm and cyberflashing are now designated, with the Office of Communications (Ofcom) issuing further guidance and moving the categorised services register to July 2026. For platforms and complaints bodies, these steps are incremental but important in clarifying where enforcement attention and compliance investment will concentrate.
- ETA enforcement is now the default. Since 25 February, the UK’s Electronic Travel Authorisation scheme has moved from soft launch to full enforcement, with carriers responsible for checking approvals. Early error rates and redress patterns will offer a practical test of how well digital border systems balance security, convenience, and due process.
Canada
- Bill C-16 advances but remains a legislative, not operational, development. The Protecting Victims Act, which would expand child sexual abuse and exploitation material (CSAEM) reporting duties and create new offences including coercive control, has been reintroduced in the 45th Parliament and referred to the Justice Committee. March is still a period of watching hearings and potential amendments rather than changing day-to-day practice, but the eventual framework will carry significant compliance and Charter-risk implications.
- AI capability gaps persist amid fragmented frameworks. Provincial and sectoral initiatives continue to move ahead without a coherent federal AI regime, leaving regulators expected to oversee AI use and adopt it internally without a common scaffold. This “mini-EU without the capacity” problem means many agencies will need to build governance and technical capability bottom-up if they are to enforce emerging expectations credibly.
- Other March changes cluster at the margins. Deadlines under firearms compensation and other public safety programmes fall at the end of the month, alongside securities and investment fund rule changes. These measures are operationally non-trivial for the regulators immediately involved but do not yet represent a system-wide shift.
- On pause: broader economic and privacy reforms. Beyond Bill C-16, the Carney government’s wider digital regulation and privacy initiatives have not yet crystallised into implementation steps. For most regulators, this means another month in which big structural changes are telegraphed but not yet specified, complicating planning and capability-building.
Five stories to watch
AUSTRAC’s AML/CTF transition: managing scale through time
Australia’s AML/CTF reforms are ambitious in scope but cautious in tempo. Existing reporting entities face a 31 March commencement date for updated programmes and governance, yet AUSTRAC’s transitional rules explicitly defer certain initial customer due diligence obligations for legacy customers until March 2029, while insisting on ongoing monitoring and credible implementation plans. At the same time, the regime’s perimeter begins to widen: from 31 March, enrolment opens to lawyers, accountants, real estate agents, and others ahead of obligations from 1 July.
AUSTRAC appears to have concluded that insisting on immediate full compliance would generate more noise than risk reduction, and that it is better to lock in direction of travel while focusing scarce capacity on bringing new, high-risk sectors into the net.
This is a live demonstration of using phasing, guidance, and supervisory posture as tools of risk-based regulation. AUSTRAC appears to have concluded that insisting on immediate full compliance would generate more noise than risk reduction, and that it is better to lock in direction of travel while focusing scarce capacity on bringing new, high-risk sectors into the net. Other agencies contemplating major framework changes under fiscal constraint may find this model – clear end-state, targeted deferrals, emphasis on plans – more durable than either blanket extensions or inflexible hard deadlines.
Competition regulators retool across three jurisdictions
In March, competition enforcement becomes a shared preoccupation.
In the UK, the CMA is moving from statutory text to practice by designing the first conduct requirements for Google under the digital markets regime, while the government’s consultation on restructuring the CMA would compress some decision-making into Board sub-committees and introduce algorithmic investigation powers.
In Australia, the ACCC’s mandatory merger control regime and 2026–27 priorities will determine how scrutiny of supermarket pricing, aviation, and digital platforms plays out. And in Wellington, the Commerce Commission is about to rule on whether two low-cost fuel retailers can merge into a third major player.
The connecting theme is experimentation with institutional tools. The UK is testing firm-specific conduct rules and considering faster procedures; Australia is embedding more ex ante merger control; New Zealand is weighing regional resilience against consolidation. How each authority uses – or declines to use – these new tools will shape not just markets but expectations of what modern competition agencies can deliver.
Cybersecurity mandates arrive in the product safety aisle
Australia’s smart device cybersecurity rules are narrow in one sense – they apply to a defined class of connected consumer products – but broad in what they imply. From 4 March, manufacturers and importers must meet specific requirements: unique default passwords, clear vulnerability disclosure channels, and transparent support periods, with non-compliance enforceable under the Cyber Security Act 2024. The rules borrow heavily from international best practice and European thinking, treating basic cybersecurity as part of product safety rather than a purely IT concern.
This blurs lines between technical, consumer, and privacy oversight. Product safety agencies will need enough technical depth to assess compliance; cybersecurity authorities will need to coordinate with market surveillance teams; and privacy regulators will see new levers for reducing data-breach risk built into devices themselves. The early cases – especially any enforcement action against mainstream brands – will set expectations about how far “secure-by-design” can be operationalised with the capacity agencies actually have.
New Zealand’s two-track reform: faster capital, tighter environments
New Zealand’s reforms embody a deliberate two-track strategy. On one track, Overseas Investment Act changes streamline low-risk screening, set ambitious timelines, and give certain high-value investors more scope to purchase residential property. On the other, the Planning and Natural Environment Bills, now before select committee, aim to replace the Resource Management Act (RMA) with a framework that strengthens environmental limits and standardises planning rules.
This combination means regulators will be expected to move faster and be stricter at the same time, depending on the domain. Agencies involved in investment screening, environmental permitting, and local planning will have to resolve tensions between growth objectives and environmental stewardship in their day-to-day decisions rather than through tidy legislative slogans. How well they can do that under capacity constraints will determine whether the reforms are experienced as coherent system change or as another layer of complexity.
Canada’s AI capability gap meets a slow-burn legislative agenda
Canada enters March with two parallel stories: legislative ambition and regulatory capacity. Federally, Bill C-16 continues through committee, while new privacy and digital regulation frameworks are trailed for 2026 but not yet introduced, and the AI-specific provisions of the former Bill C-27 have effectively been shelved.
At the same time, provincial initiatives and sectoral regulators push ahead with their own AI and technology expectations, producing a fragmented patchwork without the central capability-building that makes such systems navigable.
The risk is not simply confusion but erosion of authority: agencies are being asked to oversee AI use and adopt AI internally without systematic investment in the skills, tools, and governance needed to do either credibly.
The risk is not simply confusion but erosion of authority: agencies are being asked to oversee AI use and adopt AI internally without systematic investment in the skills, tools, and governance needed to do either credibly. The contrast with jurisdictions that have treated AI capability as infrastructure – such as Australia’s APS AI plan or the FCA’s internal tooling – is becoming starker, and March does little to close that gap.
March – May 2026 watch list
Immediate (March 2026)
Australia
- 4 March – Smart device cybersecurity rules commence. Early enforcement choices will show whether regulators treat this as a posture exercise or as a serious new front in product oversight.
- 31 March – AML/CTF reforms start for existing entities. How supervisory teams respond to early shortcomings will set the tone for the next three years of implementation.
- 31 March – Enrolment opens for Tranche 2 AML/CTF entities. Uptake in this first window will give an early read on where outreach and guidance gaps are largest.
New Zealand
- 6 March – Overseas Investment Act reforms commence. The first tranche of decisions under the new rules will heavily influence whether investors perceive New Zealand as genuinely easier to enter.
- 16 March – Commerce Commission Gull–NPD decision due. Its reasoning will be mined by practitioners and other regulators as a marker of how aggressively New Zealand will police consolidation in concentrated sectors.
- 31 March – NZX Code and listing rule amendments relating to clearing arrangements and climate reporting thresholds take effect. Boards and regulators will be watching whether the changes meaningfully shift disclosure quality or mainly codify existing norms.
United Kingdom
- 19 March – CMA unfair terms guidance consultation closes. The final guidance will influence how both the CMA and sector regulators assess subscription models and dark-pattern-adjacent practices.
- 31 March – DBT consultation on CMA reforms closes. The response profile will indicate how comfortable business, consumer groups, and other regulators are with the trade-offs between speed, independence, and accountability.
- March – FCA publishes further Regulatory Priorities reports. These documents will quickly become reference points in board packs and supervisory conversations, shaping how firms prioritise remediation and change.
Canada
- 31 March – Key firearms and safety programme deadlines. Performance against these deadlines will quietly test whether stretched enforcement teams can deliver on politically salient commitments.
- March – Justice Committee hearings on Bill C-16. The hearing record will matter for how future Charter challenges frame the proportionality and necessity of the new regime.
Near term (April – June 2026)
Australia
- 1 July – AML/CTF obligations commence for Tranche 2 entities. Supervisors will need to balance initial forbearance with enough visible enforcement to avoid perceptions that the new perimeter is purely symbolic.
- From July – Second wave of climate disclosure obligations for Group 2 entities. This will stretch both reporting entities and regulators as climate risk moves from specialist teams into the core of financial supervision.
New Zealand
- 1 April – Crypto-Asset Reporting Framework goes live. How effectively transaction data is integrated into financial crime and tax analytics will determine whether the regime improves risk targeting or just adds paperwork.
- 19 April – 1 May – Commerce Act amendment consultation window. The consultation will shape where the line is drawn between legitimate competitive behaviour and unlawful exploitation in New Zealand’s concentrated markets.
- Mid-2026 – Select committee report on RMA replacement expected. Its recommendations will heavily influence how radical – or conservative – the eventual replacement proves to be in practice.
United Kingdom
- By 30 June – Digital asset and stablecoin regime expected fully in force. This will mark the point at which crypto moves from registration-style oversight to a more traditional prudential and conduct toolkit.
- From July – Ofcom’s Online Safety Act categorisation register goes live. The list will crystallise expectations and likely prompt a new wave of compliance investment from services on the cusp of higher tiers.
Canada
- 31 May – First forced labour and modern slavery reporting deadline. The quantity and quality of reports will reveal how far modern slavery risks have been integrated into mainstream compliance, rather than confined to CSR teams.
- Spring–summer – Continued movement on criminal and digital bills. The near term remains a period of scenario-planning and capability-building rather than firm rulebook updates for most regulators.
Longer view (H2 2026 and beyond)
Australia
- Late 2026 – APS-wide AI capability assessment milestone. Regulators that treat this as a compliance tick-box rather than a genuine capability exercise risk being left behind by both regulated entities and peer agencies.
New Zealand
- Mid-to-late 2026 – Enactment and early implementation of the RMA replacement. The transition period will test whether regulators can manage overlapping obligations without paralysing development or weakening environmental protection.
- July – Medicines Advisory Committee shortage tools review. This is a fork in the road: it will decide whether New Zealand’s emergency-era medicine shortage tools are wound back as a temporary fix or locked in as a permanent feature of the health regulatory system.
United Kingdom
- 1 September – FCA non-financial misconduct regime starts. This will require regulators and firms to grapple with the boundaries between personal behaviour, culture, and regulatory risk in a more structured way than ever before.
- Late 2026 – Visa vignettes phased out in favour of digital status. Employers, landlords, and regulators overseeing right-to-work and right-to-rent checks will need to update processes and assurance models accordingly.
Canada
- Late 2026 – Likely Charter litigation over Bill C-16. The resulting jurisprudence will shape not only this statute but the room future governments and regulators have to expand digital reporting obligations.
Final word
“12 months on, it seems we are operating in an ever more uncertain, volatile and fragmented world. The historic economic paradigm – both globally and within nations – can no longer be taken for granted.”
– Sarah Cardell, Chief Executive of the Competition and Markets Authority,
at The Economist’s Antitrust Summit, 26 February 2026.
Cardell was not talking about competition alone. She was describing the conditions under which every regulator in this update is now operating: geopolitical fragmentation, fiscal pressure, and the expectation that agencies will simultaneously accelerate growth and tighten oversight. AUSTRAC is staging a generational AML transition with finite capacity. New Zealand is loosening investment screening with one hand while tightening environmental law with the other. The UK government is consulting on restructuring its own competition authority mid-stride. And Canadian regulators are being asked to govern AI systems they did not build and cannot yet assess.
The common test is not whether new frameworks exist – March proves they do, in abundance – but whether institutions can hold a credible posture when the ground beneath them keeps shifting. Agencies that treat this moment as an invitation to sharpen judgment, invest in capability, and redesign how they work will earn the authority that statute alone cannot guarantee. Those that default to compliance theatre will find the gap between ambition and delivery harder to explain with every passing quarter.
The Modern Regulator delivers independent regulatory news, insight, and analysis for regulators and the professionals who work alongside them. Sign up for our monthly newsletter.
