Q3 2026 Regulatory Update: key legislative and supervisory developments

Which laws and regulations have recently entered into force?

As of 1 July 2026, FIU-Nederland may request an institution to temporarily suspend one or more transactions if there are indications that they are linked to money laundering or terrorist financing (Article 17a of the Wwft). Institutions would be well advised to supplement their reporting procedures accordingly, so that it is clear who receives such a request, how the transaction is blocked operationally and how communications with the client are handled in the meantime without tipping them off.

As of 2 July 2026, the new European rules on ESG ratings apply. These primarily target ESG rating providers, but also affect financial institutions themselves. An institution that uses an internally developed ESG rating in its marketing communications must explain on its website how that rating is produced, including the methodology, data sources, weighting of ESG factors and potential conflicts of interest. This applies both to financial market participants and financial advisers (Article 13(3) of the SFDR) and to other regulated financial undertakings (Article 2(2)(c) of the ESG Rating Regulation).

The marketing communication itself must also contain a link to this explanation. In addition, a transitional regime applies: ratings from existing providers may be published or distributed until 2 November 2026 if the provider has given timely notification of its intention to apply. After that date, this is permitted only if the provider is included in the ESMA register. Institutions using ratings from external providers would be well advised to check whether their provider meets these conditions.

As of 26 September 2026, the Dutch rules have been brought into line with the revised MiFID II and MiFIR. The amendments concern, among other things, the definition of a systematic internaliser, standards for the quality of trading data supplied to the consolidated tape provider and the abolition of the periodic reporting obligation on the execution of client orders (best execution). For investment firms, this means that they no longer have to report periodically on the execution of client orders and can update their best execution procedures and reporting calendars accordingly.

European legislative framework for stock exchange listings (Listing Act)

For small and medium-sized enterprises in particular, a stock exchange listing in the EU is often complex and costly. The Listing Act therefore aims to make access to the European capital market simpler and less expensive. The package consists of three components:

• a regulation simplifying the prospectus rules, the market abuse rules (MAR) and MiFIR;
• a directive amending, among other things, the admission requirements for a stock exchange listing and the rules on research in MiFID II; and
• a directive allowing the issuance of multiple-vote shares when listing on an SME growth market.

Some of the amendments already apply. The first amendments have applied since December 2024, and the new prospectus regimes (the EU Follow-on prospectus and the EU Growth issuance prospectus) became applicable on 5 March 2026. The framework was further developed in the third quarter of 2026.

At national level, the Dutch Listings and Benchmarks Implementation Act entered into force at the end of September 2026, incorporating the Listing Act and the amended European benchmark rules into the Wft. As a result, offers of securities to the public of up to €12 million are exempt from the prospectus requirement (previously €5 million). However, an information document must be published for such an exempt offer, and the offer must be notified. In addition, a stock exchange listing is becoming more accessible as the free float requirement for admission to trading on a regulated market is reduced to 10 per cent.

For investment firms, the amendment to the rules on research is particularly important. Since 29 September 2026, investment firms have once again been able to choose whether to pay for research jointly with execution services or separately, provided that transparency towards clients is ensured. If research is paid for through a client-funded Research Payment Account (RPA), additional requirements apply. In addition, an EU code of conduct for research paid for by an issuer has applied since 7 September 2026. Only research prepared in accordance with this code may be described as issuer-sponsored research.

The prospectus rules have also been further developed:

• since 16 August 2026, a standardised format has applied to the EU IPO prospectus, and issuers of certain non-equity instruments must include additional ESG information in their prospectuses;
• since 10 July 2026, rules have applied to the submission of prospectus information and associated metadata to ESMA, so that this information becomes centrally available through the European Single Access Point (ESAP);
• on 9 September 2026, ESMA published draft rules on the key financial information in the prospectus summary, which are expected to apply in the first half of 2027; and
• on the same date, ESMA published guidelines on when issuers may add new securities to a base prospectus by means of a supplement.

The market abuse rules have also been further developed:

• since 5 July 2026, issuers have been required to maintain their insider lists in a mandatory European format;
• on 16 July 2026, the Commission published further rules on market manipulation and managers’ transactions, and on the disclosure of inside information in protracted processes, such as merger negotiations. In such processes, it is no longer necessary to disclose every intermediate step. The rules on delayed disclosure have also been amended; and

Secondary legislation implementing the revision of the AIFM and UCITS Directives

As discussed in our previous update, the revision of the AIFM and UCITS Directives was implemented in the Wft as of 29 May 2026. The revision mandates ESMA to draw up further rules in several areas, primarily to further harmonise and standardise supervisory reporting and the provision of information to supervisors.

An important aspect concerns liquidity management tools (LMTs). Since 16 April 2026, European rules have applied that specify how each LMT operates, including the calculation method and the manner of activation.

ESMA guidelines also provide further detail on the selection, calibration and application of LMTs. For existing AIFs and UCITS, a transitional period until 16 April 2027 applies to both the rules and the guidelines. This does not alter the fact that, under the Wft, managers were already required to select LMTs and document them in their policies and in the fund rules or instruments of incorporation as of 16 April 2026. Managers may also apply the new rules to existing funds earlier, but must inform the AFM in advance if they do so. In practice, further clarity is still needed on, among other things, the interaction with future reporting, supervisory expectations during the transitional period and the application of LMTs within existing fund structures.

Supervisory reporting is also changing. For AIFMs, Annex IV reporting is being revised and expanded. ESMA specifies in technical standards what managers must report, at what level of detail, how often and in which format. The new reporting is expected to provide greater insight into, among other things, liquidity profiles and risks, the use of LMTs, leverage, exposures and concentration risks, and outsourcing arrangements. Until the new standards apply, the current Annex IV reporting requirements remain applicable. However, it is advisable to start systematically recording the data needed for future reporting now.

UCITS managers will be subject to explicit periodic reporting obligations for the first time. These are expected to cover the liquidity risks of UCITS, the use of LMTs and additional fund information for macroprudential supervision. In substance, this reporting is aligned with that for AIFMs, but ESMA is developing it in separate standards.

In addition, the rules on outsourcing and delegation in both directives are being tightened, with particular attention to outsourcing to parties in third countries, preventing letter-box entities and ensuring that governance and outsourcing structures can be supervised. Supervisory reporting is expected to require more detail on delegated and sub-delegated functions, the entities and jurisdictions involved, how the manager exercises oversight and the risks of complex outsourcing structures.

For open-ended AIFs that originate loans, ESMA is developing the conditions under which these funds may retain their open-ended structure. The draft rules include requirements for the liquidity management system, the availability of liquid assets, stress tests and a redemption policy consistent with the fund’s liquidity profile. They also specify the factors that managers must take into account when assessing liquidity and designing the redemption policy.

Secondary legislation under the AMLR, AMLD6 and AMLAR

The European anti-money laundering package further harmonises the rules for preventing money laundering and terrorist financing in the EU. The Anti-Money Laundering Regulation (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6) will become applicable on 10 July 2027. From 2028, the European Anti-Money Laundering Authority (AMLA) will also directly supervise a selection of high-risk cross-border financial institutions. How the new rules will work in practice is largely determined by the secondary legislation that AMLA is currently drafting.

The main areas for which AMLA has drawn up further (draft) rules or guidelines are:

• customer due diligence: what information institutions must collect about their clients and what quality standards it must meet;
• business relationship or one-off transaction: when a business relationship exists and how linked transactions are identified;
• group policies: minimum requirements for group-wide policies and information sharing within the group, including with establishments in third countries;
• risk assessment at organisational level: minimum requirements for the content and conduct of the business-wide risk assessment (BWRA);
• ongoing monitoring: how institutions continue to monitor business relationships to detect unusual transactions in a timely manner; and
• direct AMLA supervision: the criteria AMLA uses to determine which institutions will come under its direct supervision.

Although this falls outside the reporting period of this update, we would already like to draw your attention to an important development: on 1 October 2026, AMLA published the final versions of the regulatory technical standards (RTS) for three of these areas. This provides greater clarity on how obliged entities must comply with the AMLR.

Business relationships and occasional transactions (Article 19(9) of the AMLR). The standard clarifies when there is an ongoing business relationship and when there is an occasional transaction, and provides criteria for identifying linked transactions. This ensures that customer due diligence thresholds are applied consistently throughout the EU.

Customer due diligence (Article 28(1) of the AMLR). The standard specifies which client data institutions must collect and verify. For lower-risk clients, a risk-based and proportionate approach is possible. In addition, the standard contains rules on digital identification and remote verification, and on screening politically exposed persons (PEPs), their family members and close associates.

Group policies (Articles 16(4) and 17(3) of the AMLR). The standard sets minimum requirements for governance, risk management and internal controls within groups, provides for secure information sharing between group entities and contains additional measures for subsidiaries and establishments in third countries.

The standards are now before the European Commission for approval.

Outlook

Which other upcoming laws and regulations should your organisation take into account? In our next Regulatory Update article, we will take a closer look at developments including the following:

• Regulation on a framework for financial data access (FIDA)
• Simplification of financial transaction reporting
• Guidelines on disclosure requirements under the Prospectus Regulation

Would you like to know what these developments mean for your organisation? Contact one of our experts.