Regulatory digest: July 2026

This digest is the companion to our new monthly rundown of five regulatory stories to follow. The digest covers the full sweep of regulatory developments, including smaller and sector-specific regulators that don’t always make the headline round. Five to follow provides a deeper look at five stories worth following. Together, these two pieces replace and expand upon the monthly updates our readers are used to.

July’s defining pattern was simultaneity. An unusual compression of commencement dates, concentrated almost entirely around 1 July, meant that regulated entities and regulators alike absorbed multiple new obligations at once, with no natural gap between them. The pressure was most acute in Australia, but the pattern ran across multiple geographies.

Australia

AUSTRAC’s register expands fivefold

On 1 July 2026, Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) regime extended to lawyers, accountants, real estate agents, conveyancers, and dealers in precious metals and stones. The Australian Transaction Reports and Analysis Centre (AUSTRAC) grew from approximately 19,000 regulated entities to close to 100,000. Designated non-financial businesses and professions (DNFBPs) must enrol by 29 July, appoint a compliance officer, conduct customer due diligence, and file suspicious matter reports. New threshold transaction report and suspicious matter report forms took effect simultaneously for all entities. Existing registrants have until 30 March 2029 to transition, but new entrants began on the new forms immediately. AUSTRAC has taken a pragmatic early posture, acknowledging it does not expect full compliance on day one.

APRA’s CPS 230 transition completes

1 July also closed the final transition phase of the Australian Prudential Regulation Authority’s (APRA) operational risk standard, Prudential Standard CPS 230. Pre-existing service provider contracts and business continuity requirements for non-systemically important financial institutions had until this date to comply. APRA released targeted amendments in April 2026, introducing limited exemptions from contractual requirements where compliance is not practicable. Its three-year supervision programme now moves into its second phase: broader assessments, with enhanced scrutiny for entities that have fallen short.

Group 2 climate disclosure begins

Group 2 entities – companies meeting at least two of four size thresholds – must now produce audited sustainability reports alongside annual financial disclosures. Directors may issue qualified assurance declarations for the first three years. Scope 3 emissions reporting carries a one-year deferral, with litigation protections applying for three years from each group’s start date. For the lead-up to this deadline, see our story on the second wave of climate disclosure compliance.

In brief

• The National Environmental Protection Agency (NEPA) commenced operations on 1 July 2026, becoming Australia’s first federal environmental regulator with direct compliance and enforcement functions under the Environment Protection and Biodiversity Conservation Act 1999 (Cth).

• The NDIS Quality and Safeguards Commission (NDIS Commission) made registration mandatory for supported independent living (SIL) providers from 1 July, extending its oversight to a sector that had operated outside the formal registration system.

• The Therapeutic Goods Administration (TGA) applied mandatory Unique Device Identification (UDI) requirements to high-risk medical devices from 1 July 2026, requiring manufacturers and sponsors to assign and maintain identifiers for Class III and certain Class IIb devices.

• Safe Work Australia confirmed changes to workplace exposure limits (WELs) for a range of chemical and biological hazards, with new model codes of practice taking effect across New South Wales, South Australia, and other jurisdictions.

• APRA released draft Prudential Standard CPS 510 Governance on 16 June 2026 – proposing a 12-year tenure limit for non-executive directors and other board reforms – while ASIC and APRA jointly announced streamlining of the Financial Accountability Regime (FAR), removing certain key functions requirements and raising materiality thresholds; both consultations are open.

• The Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026 passed the House of Representatives on 30 June, granting the eSafety Commissioner power to compel documents from age-assurance providers, app store operators, and anyone reasonably believed to hold relevant information. The Senate has referred it to an eight-week parliamentary inquiry, which delays it further.

New Zealand

The Regulatory Standards Board opens for business

The Regulatory Standards Act 2025 took effect on 1 July 2026, establishing the Regulatory Standards Board (RSB) and opening a public portal for complaints about poorly designed legislation. Every government-initiated bill or new regulation must now carry a Consistency Accountability Statement. The board’s findings are advisory – it cannot strike down legislation – but the mechanism itself is new: any member of the public can now formally challenge the quality of existing laws. The Act passed against near-universal opposition in submissions. For the constitutional questions it raises, see our backgrounder.

Taumata Arowai files its first prosecution

The Water Services Authority – Taumata Arowai filed charges in the Greymouth District Court against Grey District Council and Westroads Ltd in June 2026 for failing to comply with the duty to supply safe drinking water. It is the first prosecution the authority has brought since its establishment in 2021. A boil water notice for the Greater Greymouth area had been in place since April 2025. The prosecution of a public entity – a council – is a test of whether the regulator will hold public bodies to the same standard as private operators. For the broader reform context, see our story on water reform.

FMA absorbs consumer credit regulation

On 1 July 2026, responsibility for consumer credit regulation transferred from the Commerce Commission to the Financial Markets Authority (FMA), following the Credit Contracts and Consumer Finance Act (CCCFA) Amendment Bill’s third reading on 30 May. The FMA is now the single conduct regulator for financial markets; the Reserve Bank of New Zealand (RBNZ) is the sole prudential regulator. The FMA has stated it intends to use its new powers actively. New Zealand’s twin peaks model is, as of this month, operational. The FMA also published its 2026/27 statement of priorities, centring on conduct risk, climate-related disclosure, and the transition of its expanded mandate.

In brief

• The Health and Safety at Work Amendment Bill passed its third reading on 30 June 2026, introducing new duties for persons conducting a business or undertaking (PCBUs) on worker engagement and expanding the definition of workplace.

• Expressions of interest opened in July for New Zealand’s new online casino licensing regime under the Online Casino Gambling Act 2026. Up to 15 licences are available, with an auction scheduled for September, applications in October, and licences from December. The Department of Internal Affairs (DIA) administers the regime.

• The Ministry for Regulation’s May 2026 mapping exercise identified 260 regulators in New Zealand, including 95 in central government, 79 in local government, and 57 statutory bodies, committees, or tribunals.

• The Planning Bill and Natural Environment Bill – the proposed replacements for the Resource Management Act 1991 – are before Parliament’s Environment Committee. The government aims to pass both into law in 2026, with a fully operational planning system targeted by 2029.

• The Commerce Commission’s 2025/26 enforcement and compliance priorities – covering cartel conduct in public procurement, online sales practices, grocery sector breaches, and telecommunications compliance – remain the governing framework for the balance of the year.

United Kingdom

Motor finance: a £7.5 billion scheme suspended

The Financial Conduct Authority (FCA) confirmed its industry-wide motor finance redress scheme in March 2026, covering 12.1 million agreements made between 2007 and 2024. The scheme sets average compensation at around £830 per agreement, with firms expected to pay around £7.5 billion in redress and the total bill – including non-redress costs – estimated at £9.1 billion. On 2 July, the Upper Tribunal suspended the operative parts of the scheme following a challenge by Consumer Voice and three lenders. The substantive hearing is scheduled for December 2026 or February 2027. If the scheme survives, payments could begin in 2027. The challenge turns on whether the FCA can impose mass redress without individual proofs of loss. For the background, see our story on how the FCA is segmenting the motor finance scandal to keep the redress machinery moving.

Ofcom’s categorisation register imminent

Ofcom has confirmed it will publish the register of categorised services – the document determining which platforms face the Online Safety Act 2023’s most extensive duties – in July 2026. Services had until 31 July to submit risk assessment records. The register will cover a small number of large platforms and trigger a consultation on the additional duties that apply. Ofcom will also publish a statutory report assessing how platforms have used age assurance in the first year of the child safety duties. For the cross-jurisdiction picture on age assurance, see our story on age assurance.

In brief

• The FCA’s non-financial misconduct rules extend from 1 September 2026 to approximately 37,000 additional financial services firms; conduct rule COCON 1.1.7FR will apply to serious bullying, harassment, discrimination, and sexual misconduct where there is a sufficient work-related link to the individual’s regulatory role.

• The Charity Commission for England and Wales received a new Chair and updated statutory guidance on serious incident reporting in June 2026, alongside an expanded compliance casework programme.

• Tim Miller, the Gambling Commission’s Executive Director of Research and Policy since 2016, announced his departure on 30 June 2026 after a decade of service – a significant loss of institutional expertise as the commission works through the post-White Paper implementation period under acting chief executive Sarah Gardner, who stepped up following CEO Andrew Rhodes’s departure on 30 April 2026.

• Ofqual confirmed that AI cannot be used as the sole or primary marker in qualifications assessments – a ruling that applies to all regulated qualifications in England and sets a floor for human involvement in high-stakes assessment.

• The Health and Safety Executive (HSE) closed its consultation on proposed changes to the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) on 30 June 2026.

• The Pension Schemes Act 2026 is being brought into force in stages; the Pensions Regulator (TPR) opened consultation on guidance for the new defined benefit (DB) surplus release framework, which allows employers to extract surplus from well-funded schemes under defined conditions, with a new regime expected from April 2027. Pensions Regulator DB surplus

• The Information Commissioner’s Office (ICO) continued implementing enhanced powers under the Data Use and Access Act 2025, including new compulsion powers to require attendance at interviews and production of technical reports; the ICO’s transition to the Information Commission is expected by end of 2026.

• The Cyber Security and Resilience Bill is completing its committee stage; it will bring between 900 and 1,100 managed service providers, data centres, and critical supply chains within statutory oversight for the first time.

Canada

OSFI’s streamlined approvals framework launches

The Office of the Superintendent of Financial Institutions (OSFI) launched its Streamlined Approvals Framework on 25 June 2026, covering provincial credit unions and fintechs seeking to become federally regulated financial institutions. The framework introduces three phases with defined timelines – four weeks for an initial readiness assessment, 12 months for a formal application review, and three months for operational readiness – and a public-facing dashboard showing the status of all active applications in real time. See our story on how it turns a historically opaque licensing process into a live, measurable test of whether transparency can hold a prudential regulator to account.

Ottawa signals direction to the CRTC

In June 2026, Culture Minister Marc Miller directed the Canadian Radio-television and Telecommunications Commission (CRTC) to review and reconsider its decision that would have tripled streamers’ financial contributions to Canadian content. The government offered a C$600 million fund as an alternative. The CRTC has not yet formally reversed its decision, and no Order in Council has issued; the direction is nonetheless a rare, direct government intervention in a published regulatory outcome – and a signal that Canadian content obligations remain politically fluid regardless of formal regulatory processes.

Lawful Access Bill reaches the Senate

Bill C-22, the Lawful Access Act 2026, passed third reading in the House of Commons on 18 June and received first reading in the Senate. The bill requires electronic service providers to facilitate lawful interception, mandates retention of metadata for up to one year, and grants the Minister of Public Safety authority to issue directives to providers. The government tabled amendments in May to clarify the definition of encryption following public backlash. The bill has not yet proceeded to second reading in the Senate.

In brief

• The Financial Consumer Agency of Canada (FCAC) published a revised complaint-handling guideline and a new 2026–29 strategic plan in June, emphasising financial literacy, open banking, and enhanced supervision of large banks’ consumer-facing obligations.

• The Autorité des marchés financiers (AMF) recognised the Chambre de l’assurance as a self-regulatory organisation on 4 July 2026 under Law 16, simultaneously completing consequential amendments to the Canadian Investment Regulatory Organization (CIRO) recognition order to transfer oversight of mutual fund dealer representatives to CIRO.

• The Competition Bureau opened a formal examination of food supply chain dynamics on 16 June 2026, focused on whether pricing practices by grocery retailers and their suppliers have harmed competition and consumers.

• OSFI’s proposed senior leadership accountability regime for federally regulated financial institutions – modelled on Australia’s Financial Accountability Regime and the UK’s Senior Managers and Certification Regime (SMCR) – remains open for consultation following its launch in January 2026.

• Bill C-29, proposing to establish a Financial Crimes Agency with police powers and civilian leadership alongside the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), is before Parliament.

Don’t forget to read our companion piece on five regulatory stories to follow this month.