Upcoming Resilience Pipeline — Financial Services

← The Rulebook

For information purposes only. Forward-looking dates move — several items are proposed or scheduled and can shift or be withdrawn. Not legal advice.

What's coming but not yet binding — proposed rules, enacted-but-not-in-force rules, phase-in deadlines and open comment windows. Sorted by date.

forthcoming items

proposed

not yet in force

phase-in deadlines

international (EU/UK/CA)

2026-07-16

next deadline

Date	When	In	Regulator	Rule / milestone	Type
2026-07-16	in 7d	US	NCUA	Records Preservation Program and Appendices-Record Retention Guidelines; Catastrophic Act Preparedness Guidelines Final rule with a future compliance date.	Final — not yet in force
2026-07-16	in 7d	US	NCUA	12 CFR Part 749 — Records Preservation Program and Appendices (Vital Records; Catastrophic Act Preparedness) Vital records preservation program: identify, store and reconstruct vital member records after a catastrophic act; records preservation log; offsite storage or duplication; Appendix A record retention	Final — not yet in force
2026-09-01	in 54d	CA	CA_OSFI	OSFI Guideline E-21 — Operational Risk and Resilience OSFI operational risk management and operational resilience: define critical operations, set tolerances for disruption, map dependencies, business continuity management, disaster recovery, crisis mana	Final — not yet in force
2027-03-18	in 252d	UK	UK_FCA	PS26/2 — Operational incident and third party reporting Single, cross-authority (FCA/PRA/Bank of England) regime for reporting operational incidents and material third-party arrangements. Defines an operational incident and reporting thresholds, a standard	Final — not yet in force
2027-12-02	in 511d	EU	EU_AI	Regulation (EU) 2024/1689 — Artificial Intelligence Act EU Artificial Intelligence Act: risk-based requirements for AI systems including high-risk systems (creditworthiness/credit scoring and life/health insurance pricing are high-risk in financial service	Final — not yet in force

Read before using. Forward-looking dates move — several items are proposed or scheduled and can shift or be withdrawn (confirm against the primary source before acting). US items come from the Federal Register; EU/UK/CA items are hand-curated (no bulk API), so their forthcoming set is only as complete as the registry's review cadence. This is an operator's outlook, not legal advice.

Turning this into an operating plan?

Knowing which rules bind you is step one. WSquare Advisory builds the operating capability behind compliance — the continuity, third-party, and recovery disciplines these regimes expect. If that's your challenge, let's talk.

Start a Conversation →