The Regulatory Digest is the companion to Five to Follow. It covers the full sweep of developments across Australia, New Zealand, the United Kingdom, Canada, and beyond, including smaller and sector-specific regulators that don’t always make the headline round.
September brings two distinct clusters of regulatory activity. The UK’s non-financial misconduct regime takes effect in the first days of the month, the same week Australia gets a new APRA deputy chair and opens its accountability streamlining consultation. Three weeks later, a second cluster lands: Australia’s digital asset grace period lapses and the UK’s crypto authorisation gateway opens, testing implementation capacity just as the first cluster settles.
Australia
eSafety’s enforceable undertaking gives Roblox a hard deadline
The eSafety Commissioner secured a court-enforceable undertaking from Roblox on 19–20 August 2026, following testing that found adults could still contact children under 16 without parental consent and that children’s profiles remained visible platform-wide despite earlier commitments. The undertaking requires Roblox to restrict adult-to-child contact, set children’s accounts to private by default, improve complaint reporting, and submit to an independent third-party audit of its safety controls, including age-estimation technology, within three months. Breach would allow eSafety to apply to the Federal Court for compliance orders.
APRA and ASIC test what accountability streamlining can remove
The Australian Prudential Regulation Authority (APRA) and the Australian Securities and Investments Commission (ASIC) opened joint consultation on streamlining the Financial Accountability Regime (FAR) in the first days of September, proposing to remove key-functions requirements from the FAR regulator rules and drop the requirement to report accountable persons’ direct reports in accountability maps. APRA estimates the changes will cut reporting obligations for roughly 4,500 accountable people, with implementation targeted for early 2027. David Bradbury commenced as APRA deputy chair the same week, adding a leadership dimension to a consultation that is fundamentally about what “reducing burden” is permitted to remove.
ING’s liquidity breach lands as AUSTRAC’s Tranche 2 enforcement widens
APRA imposed licence conditions and additional capital and liquidity requirements on ING Bank Australia Limited following material breaches of minimum liquidity requirements – a concrete, named enforcement action that sits alongside the Australian Transaction Reports and Analysis Centre’s (AUSTRAC) continuing work through its expanded Tranche 2 register. AUSTRAC opened an investigation into Western Union on 1 September and issued notices to non-enrolled businesses in late August, extending a pattern of graduated enforcement tools – investigation, notices, undertakings – since Tranche 2 obligations took effect on 1 July.
ASIC’s digital asset grace period runs out
ASIC’s sector-wide no-action position for digital asset businesses lapses on 30 September 2026, having already been extended once from its original 30 June deadline and expanded in scope to cover authorised representative and intermediary arrangements. With the deadline falling inside this publication window, providers that have not lodged an Australian financial services licence application face civil and criminal penalty exposure once the grace period ends.
In brief
- APRA published its 2026–27 Corporate Plan, committing to sharpened focus on risk management practices amid a rapidly moving threat environment.
- APRA confirmed OnePath Custodians has completed all obligations under its Court Enforceable Undertaking on member protections.
- ASIC’s Regulatory Portal window for 2025–26 financial year industry funding business activity metrics runs from 23 July to 24 September, with sustainability report lodgements now received separately from standard business activity forms.
- ASIC launched a Small Business Director Essentials hub and a refreshed Small Business Strategy, emphasising education alongside targeted enforcement.
- AUSTRAC ran two RegTech Insights virtual events, on 3 and 9 September, as part of its structured engagement with vendors supporting the newly regulated Tranche 2 population.
New Zealand
The FMA’s merged mandate reaches its second month
The Financial Markets Authority (FMA) is now two months into its expanded mandate as New Zealand’s single conduct regulator, having absorbed consumer credit regulation from the Commerce Commission on 1 July under the Credit Contracts and Consumer Finance Act. The consolidation brought conduct oversight of banks, insurers, and lenders under one roof for the first time, and September offers the first meaningful window to assess how the merged mandate is functioning in practice.
A grid regulator grades Transpower’s delivery in public
The Electricity Authority Te Mana Hiko published a finding on 1 September that Transpower’s process for connecting new generation projects to the national grid has improved significantly since an earlier period of public criticism. The authority is simultaneously consulting on amendments to the Electricity Industry Participation Code, with submissions open until 14 September – a live regulatory-practice story about a sector regulator publicly grading a regulated monopoly’s operational performance on a politically salient issue.
The Regulatory Standards Board approaches its first real test
New Zealand’s Regulatory Standards Board (RSB), like the FMA, is now two months into full operation, having become operational on 1 July with every government bill now requiring a formal Consistency Accountability Statement. The board can scrutinise and report but cannot compel amendment, and legislation found inconsistent with its principles remains legally valid regardless – making September a natural point to check for its first substantive findings or complaints.
A sector review doubles as a lesson in regulatory stewardship
The Ministry for Regulation published a review of the agricultural and horticultural products system on 1 September, offering what the ministry frames as lessons in stewardship, reform, and adaptive regulation applicable well beyond the sector itself.
In brief
- The Ministry for Regulation confirmed removal of the “offensive trades” list from the Health Act 1956 on 14 August, continuing its ongoing programme of removing rules that no longer serve a purpose.
- The Reserve Bank of New Zealand raised the Official Cash Rate to 2.75% on 2 September, with forecasters expecting a hold in October and a further increase in December.
United Kingdom
New conduct rules reach 37,000 firms with no experience of them
The Financial Conduct Authority’s (FCA) non-financial misconduct rules took effect on 1 September 2026, extending conduct-rule coverage under the Code of Conduct sourcebook (COCON) to cover bullying, harassment, or violence with a work-related link to an individual’s regulatory role. The rules now apply to roughly 37,000 additional firms with no prior experience operating under formal conduct-rule obligations, giving September a genuine implementation story distinct from the earlier rulemaking already covered.
The FCA’s crypto gateway opens for business
The FCA’s crypto-asset authorisation gateway opens on 30 September 2026, following final rules and guidance published on 30 June, with the full regime commencing from 25 October 2027. The gateway opening is a distinct operational milestone from the rulemaking itself: firms can now formally apply, and how the FCA manages an initial wave of applications will be an early test of its stated ambition to reduce authorisation timelines more broadly.
The Charity Commission’s enforcement and technology cluster
The Charity Commission’s Annual Report 2025/26 recorded a 23% rise in compliance cases and 69 new statutory inquiries opened, alongside a Charity Sector Risk Assessment 2026 warning that charities face increasingly complex attacks. Sitting alongside these compliance figures, the commission’s income threshold for statutory audit rises from £1 million to £1.5 million from 30 September, and a separate £9.5 million digital transformation programme covering all casework and digital services on Microsoft Azure and Dynamics 365 has a supplier interest deadline of 10 September – together giving the commission a genuine enforcement-and-technology cluster this month.
In brief
- The FCA published a new webpage on 2 September setting out its expectations for how firms should approach frontier artificial intelligence, extending its existing supervisory technology commentary.
- The FCA banned and fined an adviser over unauthorised pension transfer advice on 3 September.
- The Cyber Security and Resilience Bill remains at committee stage, with Royal Assent still expected by late 2026.
Canada
OSFI keeps its pipeline public while building the plumbing behind it
The Office of the Superintendent of Financial Institutions (OSFI) held its third Quarterly Release Day of 2026 on 10 September, followed by a virtual Industry Day on 24 September, continuing the transparency programme already established through its licensing dashboard and consultation pipeline. A working group convened on 23 September to progress OSFI’s Data Collection Modernization programme, ahead of a Regulatory Data Hub go-live now expected in late autumn 2026. Read about the regulator that opened its books.
Bill C-29 awaits its clause-by-clause reckoning
Bill C-29, which would establish Canada’s Financial Crimes Agency, remains before the Standing Committee on Justice and Human Rights, with clause-by-clause consideration ongoing. The Financial Action Task Force’s mutual evaluation report, due this autumn, is expected to provide the first authoritative external verdict on Canada’s broader financial crime reform trajectory, which centres on the new agency the bill would establish.
The Competition Bureau’s cartel guidelines consultation closes
The Competition Bureau’s consultation on its Cartel Enforcement Guidelines closes on 13 September 2026, having opened on 15 July – a live consultation on how cartel conduct is investigated and prosecuted, with implications for enforcement practice once submissions are assessed.
In brief
- The Canadian Investment Regulatory Organization issued a sanctions decision against Haimeng Wang following an August hearing, and has scheduled a settlement hearing for Arthur Silber alongside a motion decision in the Abid Hossain matter.
- The Canadian Radio-television and Telecommunications Commission is running a show-cause proceeding on device-unlocking practices, with interventions due 14 September and replies due 24 September.
- Bill C-22, the Lawful Access Act 2026, passed third reading in the House of Commons on 18 June and awaits Senate consideration when Parliament returns on 21 September.
The final word
“Roblox cannot mark their own homework.”
– Julie Inman Grant, Australia’s eSafety Commissioner, on the decision to require an independent third-party audit of Roblox’s safety controls.
For deeper analysis of five stories worth following this month, see Five to Follow: September 2026, our companion piece, covering the eSafety–Roblox undertaking, the APRA–ASIC accountability streamlining, the Electricity Authority’s grid-connection finding, the FCA’s non-financial misconduct commencement, and OSFI’s transparency and modernisation programme.
