Executive view
Edition: 5 October 2026. This catch-up edition was prepared and approved for publication on 15 October 2026, Cayman time. Developments and watchpoints retain their historical context as at the edition date; this is not a current-status update. The catch-up review timestamp records preparation for this release, not a claimed historical review time.
Our leadership question this week is straightforward: could the organisation demonstrate that a critical control works under pressure?
We recommend testing more than the existence of a recovery plan or reporting procedure. The useful evidence is operational: a service restored, an incident classified with a defensible rationale, a regulatory submission reconciled to its source, or an ownership record supported by reliable documentation. Each provides a more meaningful basis for challenge than a simple “complete” status.
Americas
Coverage note. Two developments are selected: US crypto-asset custody proposals and Brazilian transaction-reporting changes. No separate Cayman item is included; this is not an exhaustive jurisdictional update.
United States — The SEC proposes a tailored crypto-asset custody framework
On 1 October, the Securities and Exchange Commission proposed changes for registered investment advisers and regulated funds, including registered investment companies and business development companies. The proposals would permit certain self-custody arrangements and the use of state trust companies as custodians, subject to the proposed framework. They were not final rules at the issue date.
Our recommendation for firms assessing digital-asset services is to work through the custody arrangements before making a product decision. Who controls access? How are transactions authorised and assets reconciled? What happens if a key person, technology provider or custodian becomes unavailable? Proposed regulatory flexibility should not be confused with evidence that these controls are ready.
Brazil — New reporting categories require implemented data controls
Coaf announced that new Siscoaf reporting occurrences would be available from 1 October for institutions authorised by Banco Central do Brasil. These include virtual-asset transfers to or from self-hosted wallets at or above US$10,000 equivalent, alongside specified cash foreign-exchange transactions. The notice relates to reporting under the applicable rules, not a general prohibition on those transactions.
Coaf — New Siscoaf reporting occurrences, notice of 30 September 2026 (opens in a new tab)
For affected firms, we recommend an implementation check covering transaction identification, data completeness, reporting-system configuration and reconciliation. Testing should include eligible transactions that could be missed, not only those successfully captured.
Europe
Coverage note. Two developments are selected: UK cyber-recovery guidance and an EU DORA incident-classification clarification.
United Kingdom — NCSC guidance brings business recovery into the cyber discussion
The National Cyber Security Centre published guidance on disruptive cyber attacks on 1 October. Its preparation guidance addresses business continuity when technology is compromised, including the need to consider how essential activity can continue during recovery.
NCSC — Disruptive cyber attacks guidance, 1 October 2026 (opens in a new tab)
NCSC — Preparing business continuity for disruptive attacks (opens in a new tab)
Our recommended exercise is to assume that normal email, shared files and central identity services are unavailable together. Ask the business to demonstrate alternative communications, recovery decision-making and a controlled way to resume its most important service. Record the limits of manual workarounds and how accumulated work would be reconciled after systems return.
European Union — DORA incident assessment cannot stop at a “non-critical system” label
A Joint European Supervisory Authorities Q&A published on 2 October clarifies how successful, malicious and unauthorised access to a financial entity’s systems should be assessed. The assessment cannot be dismissed solely because those systems do not support critical or important functions, or because access was gained through an ICT provider. The applicable incident-classification and materiality criteria still determine the reporting outcome.
We recommend checking incident playbooks for premature exclusions and recording the classification rationale. A provider’s incident should not automatically be labelled a major DORA incident, but neither should the provider relationship be used to avoid assessing the consequences for the financial entity.
Africa
Coverage note. Selected coverage focuses on Kenya’s digital-credit providers and South Africa’s beneficial-ownership information. No Nigeria item is included; this does not imply that no relevant developments occurred.
Kenya — Digital-credit licensing puts customer outcomes in focus
On 30 September, the Central Bank of Kenya announced 29 additional licensed digital credit providers, bringing the total to 281. Its announcement highlighted scrutiny of business models, consumer protection and the fitness of shareholders and management, against a background of concerns including unethical debt collection and misuse of personal information.
Our recommendation for lenders and their partners is to test the complete customer journey: data permissions, decision communications, repayment support, collections and complaints. Third-party due diligence should examine how the service operates, rather than treat licensing status as the only relevant control.
South Africa — Beneficial-ownership information becomes more useful to investigators
CIPC announced the launch of its upgraded Beneficial Ownership Disclosure Module on 29 September. The functionality supports law-enforcement agencies and competent authorities in searching ownership information and identifying connections. The announcement concerns authorised investigative access, not unrestricted public access.
CIPC — Official account and 29 September 2026 launch announcement (opens in a new tab)
For companies, administrators and trust and company service providers, our recommendation is to reconcile filed ownership information with current evidence of ownership and control. Where a structure involves several entities or a trust, the records should explain the relationships and preserve the basis for the conclusion—not merely reproduce a diagram supplied at onboarding.
Leadership priorities
Run one recovery demonstration. Select an important customer service and test its fallback without assuming that the normal communications or access tools will remain available.
Challenge one incident classification. Ask the team to explain the evidence, thresholds, uncertainties and escalation decisions behind a recent assessment.
Trace one regulatory data item to source. Choose a transaction report or beneficial-ownership record and confirm how completeness, accuracy and subsequent changes are controlled.
Upcoming key dates
These are the watchpoints identified for the 5 October edition. Milestones preceding the catch-up publication date are retained for historical context.
| Date or window | Jurisdiction | Milestone and status | Source |
|---|---|---|---|
| 9 October 2026 | Kenya | The payments-policy and bill consultation closes. Organisations assessing a response had a limited window at the edition date. | National Treasury and CBK — Consultation public notice (PDF) (opens in a new tab) |
| 60 days after publication in the Federal Register | United States | SEC crypto-asset custody proposals: confirm the published deadline before scheduling a response. | SEC — Crypto-asset custody proposals (opens in a new tab) |
General information and risk commentary, not legal advice. Regulatory applicability depends on the entity, activity and jurisdiction.