EXECUTIVE SUMMARY
The third edition of the Uniqus “Regulatory Pulse” bulletin covers key regulatory developments and supervisory themes observed across India and the Middle East over the quarter ended September 2026. Consistent with the series, this publication focuses on banking regulators and core lending institutions. It does not seek to provide an exhaustive account of all regulatory developments, cover quasi-regulatory bodies, fintech regulators, Financial Centre specific regulations, or other sectoral authorities within each jurisdiction. Instead, it concentrates on high-impact regulatory signals and supervisory priorities from banking authorities that are most likely to influence risk management, governance, capital and balance sheet strategy.
The defining feature of the quarter was operational resilience. Supervisors across the GCC are now asking two questions: can institutions absorb losses, and can they keep critical services running through disruption?
- SAMA put quantum computing risk on the board agenda. A full inventory of encryption assets is due by end-2026, and an enterprise-wide risk assessment follows in Q1 2027.
- The CBUAE’s new Operational Risk Management Regulation took effect in September. It requires the Central Bank to be notified within four hours of any event affecting critical operations.
- QCB overhauled its business continuity instructions and expects D-SIBs to restore full operations, preferably within the day of disruption.
In each case, ownership sits with the Board, and third-party providers fall squarely within scope.
Alongside this, the direction of travel was framework completion and market modernization. The RBI advanced the remaining pieces of Basel III. It finalized the market-risk capital and Pillar 3 disclosure rules and consulted on CVA and the leverage ratio, all set to take effect from 1 April 2027. It also proposed a single principles-based framework for loan pricing and issued draft data-governance expectations. Across the GCC, payment infrastructure opened to new participants and corridors, and conduct expectations widened: Oman issued a sector-wide Code of Conduct, and the CBUAE brought SME customer protection close to retail standards.
For boards and senior management, the implication is clear. Resilience must now be evidenced, not asserted. That means mapping critical operations to their dependencies, bringing vendors inside the plan, and rehearsing reporting clocks before a real incident tests them. In India, the capital, disclosure and pricing reforms converge on April 2027 and should be run as one programme rather than as parallel projects. The early close of the RBI’s FCNR(B) swap window is also a reminder that central bank support is discretionary and time-limited. This bulletin highlights these cross-market signals so that firms can anticipate change and prioritize their risk and regulatory agendas accordingly.
Supervisory Themes at a Glance
The story of the quarter is not only how much capital banks hold, but whether they can keep operating, and prove it.
Operational resilience moved to the centre of supervision. SAMA, the CBUAE and QCB each set board-level expectations, firm deadlines and tighter reporting on technology, continuity and incident risk. Each also extended scrutiny to outsourced and vendor-dependent operations. Data location now matters too: the CBUAE requires the core system of record to be held in the UAE, and QCB requires encrypted data to be stored both inside and outside Qatar. The common expectation is that institutions identify critical operations and set board-approved tolerances. Their plans must also hold up under severe but plausible scenarios.
India’s capital framework is converging on a single date. Several reforms are due to apply from 1 April 2027: market-risk capital under the Simplified Standardized Approach, a new BA-CVA charge, a leverage ratio that must be met at all times, and Pillar 3 disclosures carrying board-level attestation. All of them sit alongside the ECL and revised credit-risk directions. Much of the underlying data is shared, and the RBI’s draft data governance guidance requires a single source of truth. Institutions are expected to treat capital, data and disclosure as one integrated agenda.
Market structure and conduct expectations are shifting together:
Payments are opening up.
QCB gave payment service providers direct access to its real-time settlement system. Qatar and Saudi Arabia switched on reciprocal card acceptance, Kuwait launched its national Wage Payment System, and Oman launched its FinTech Strategy. These moves redistribute payments revenue and require controls to operate at settlement speed.
Conduct expectations are widening.
Oman, the UAE and India all raised the bar on fair treatment and pricing.
Enforcement is getting sharper.
The CBUAE’s action against Bank Melli Iran shows it will restrict business lines for AML/CFT and proliferation-financing failures.
The message across markets is consistent: institutions must evidence control effectiveness and outcomes, not merely maintain policies.
| Theme | Jurisdictions | What Boards should do |
|---|---|---|
| Operational Resilience | UAE, Qatar, Saudi | Map critical operations and rehearse incident reporting |
| Basel III Completion | India | Run a single April 2027 capital impact programme |
| Payments Modernization | Qatar, Saudi, Kuwait, Oman | Reassess revenue model and real-time controls |
| Conduct & Customer Protection | Oman, UAE | Evidence conduct frameworks, not just policies |
IN THE NEWS
SAMA
SAMA Puts Quantum Risk on the Board Agenda, with a Full Inventory of Encryption Assets Due by End-2026
The Saudi Central Bank (SAMA) has issued Circular No. 482021280, “Enhancement of Operational Resilience to Address Quantum Computing Risks,” dated 27 August 2026. The circular aims to raise the financial sector’s preparedness for quantum computing, which is expected in future to be able to break the encryption that currently protects banking systems, payments and customer data. It applies to banks, finance companies, payment services companies, credit information companies and support entities licensed by SAMA. Financial institutions are required to take four measures:
- Enterprise-wide quantum risk assessment (by end of Q1 2027): Assess quantum computing risks across the institution in line with its enterprise risk management procedures, covering operational, legal, regulatory, strategic and human resources risks, and develop action plans to address what the assessment finds.
- Inventory of encryption assets (by end of Q4 2026): Ensure the institution has accurate and complete procedures to identify and classify all its encryption assets, together with the data, systems and services they protect. These must be ranked by sensitivity and by priority for upgrading to quantum-resistant encryption, and the protection of priority assets must be assessed, including any constraints, challenges and reliance on third parties.
- Upgrade plans for priority assets: Develop plans to bring all priority assets to the required level of protection, or put appropriate alternative solutions in place, based on the results of the inventory.
- Board-level oversight (ongoing): Make quantum risk a standing item for regular monitoring by the Board’s Information Security Supervisory Committee and Risk Committee, with challenges and recommendations reported to the Board.
Key implications
- The inventory of encryption assets is due by 31 December 2026, a full quarter before the enterprise risk assessment. The order is deliberate: an institution cannot judge its quantum risk without first knowing where and how it uses encryption. With roughly three months left, the inventory is the deliverable most likely to slip. The same technology teams will also face a global industry change in March 2027 that requires website security certificates to be renewed every 100 days, so resourcing for early 2027 should be planned now.
- Attackers can steal encrypted data today and hold it until they are able to unlock it. The data to protect first is therefore the data that must stay confidential the longest, such as customer identity records kept for ten years under anti-money laundering rules, signed account mandates and long-term contracts. Priorities should be set by how long information must remain secret, not only by how important the system is.
- Institutions can scan their own networks to find part of their encryption, but a large share sits inside vendor products: core banking systems, card and payment network connections, cloud services and the specialised hardware that stores encryption keys. Only the vendor can confirm what these products use. Institutions should ask key vendors now for details of the encryption in their products and their upgrade plans, and build upgrade commitments into new and renewing contracts.
- The requirement to plan upgrades for priority assets has no deadline of its own, but it is not open-ended. Plans depend on the December inventory and will naturally sit within the action plans due with the risk assessment in March 2027. SAMA allows “appropriate alternative solutions” where an upgrade is not possible, such as isolating, replacing or retiring a system. That flexibility only holds if each decision is recorded with a reason, an owner and a date; a system left unchanged without a documented decision is likely to be viewed as a gap.
- With quantum risk now a standing agenda item for the Information Security Supervisory Committee and the Board Risk Committee, boards should ask for regular indicators, for example how complete the inventory is, how many priority systems have an approved plan, and how many critical vendors have no upgrade plan. SAMA’s explicit reference to human resources risk also matters: specialists in this field are scarce worldwide, and institutions across the Kingdom will be competing for them on the same timeline.
SAMA Consults on Draft Rules for Supply Chain Finance
SAMA has issued draft Rules for Engaging in Supply Chain Finance for public consultation. Draft rules create a licensing and supervisory framework for supply chain finance (SCF) providers, intermediaries and the digital platforms they run. The stated aims are to set clear standards for the activity and to support the sector’s growth, especially as a source of working capital for SMEs. SAMA benchmarked the draft against Spain, the UK, France, Indonesia, Singapore, China and Australia.
The rules cover the main SCF products: open account trade finance, factoring and reverse factoring, with or without recourse. Only banks and licensed SCF companies may provide SCF, and only licensed SCF intermediation companies may match buyers and suppliers with providers. Buyer-led programmes are in scope whenever the buyer is headquartered in Saudi Arabia, even if none of the suppliers are.
Key requirements include:
- Capital and limits: minimum paid-up capital of SAR 30 million for SCF companies and SAR 2 million for intermediaries. Total financing is capped at 8 times capital and reserves. Exposure to a single-recourse party is capped at 10%, and to a group at 25%.
- Fraud controls: specific measures against invoice fraud and double financing, limits on the value of eligible assets, and due diligence to confirm that receivables are genuine and not already pledged or assigned.
- Platform standards: these apply equally to banks, SCF companies and intermediaries. They cover secure and resilient IT, verifying counterparties’ identity and address, retaining records for 10 years, and reporting cyber incidents to SAMA immediately. Fees, risks and licence details must be clearly disclosed.
- Customer protection: 60 days’ notice and consent before contract changes, and no SCF for individuals unless they’re registered to carry on a commercial activity. Intermediaries must not favour one provider over another when offers are substantially equal.
- Governance (intermediaries): quarterly risk reports to the Board and SAMA, an external auditor approved by SAMA, and publication of financial statements.
A non-binding annex sets out best practices, including notifying debtors of assignments and getting confirmation from counterparties that there’s no set-off or double financing. The rules will take effect once they are published on SAMA’s website.
Key implications
- Fintechs and non-bank SCF platforms will need a licence and maintain minimum capital to continue to operate. This will likely lead to consolidation in the market around fewer, better-capitalised players.
- Banks already running SCF platforms are not exempt from the platform requirements and should benchmark their current set-up against them.
- Fraud and double financing are clearly SAMA’s main concern. Invoice verification, assignment registration and checks against duplicate financing will be under the closest scrutiny.
- Because buyer-led programmes are in scope wherever the buyer is Saudi-headquartered, providers based outside Saudi Arabia that serve Saudi corporates should assess whether they’re caught.
Source: SAMA Seeks Public Consultation on Draft Rules for Engaging in Supply Chain Finance
UAE
CBUAE Sanctions UAE Branches of Bank Melli Iran
CBUAE imposed enforcement measures on the UAE branches of Bank Melli Iran for breaching AML/CFT and proliferation financing requirements under Article 168-1-C of Federal Decree-Law No. 6 of 2025. Sanctions were based on the findings of its examinations. The branches are now barred from any financial transactions to and from Iran, including trade finance and fund transfers.
Key implications
- The CBUAE is willing to restrict business lines, not just impose fines, when it finds AML/CFT failures.
- Banks with trade finance exposure to sanctioned or high-risk corridors should check that their proliferation financing controls are sound.
CBUAE Sets a 4-Hour Clock for Reporting Disruptions as New Operational Risk Rules Take Effect
CBUAE issued Circular No. 1/2026, the “Operational Risk Management Regulation,” in February 2026, which came into effect on 14 September 2026. This replaces the 2018 Operational Risk Regulation and Standards and shifts the supervisory focus from managing operational losses to ensuring that critical operations can continue through disruption. It applies to all licensed financial institutions that are legal entities, including banks, insurers and reinsurers, and other licensed financial institutions such as finance companies.
The regulation sets minimum requirements across six main areas:
- Board, not a committee, must approve and review at least annually the institution’s operational risk appetite, its tolerance for disruption, and its business continuity and disaster recovery plans. Senior management must report actual or expected breaches directly to the Board, an independent operational risk function must sit under the Chief Risk Officer, and systemically important institutions must have a Board-level operational risk committee.
- Institutions must identify their critical operations, which at a minimum include payments and other time-critical services, keeping accurate financial records, and managing solvency and liquidity. Each must be mapped to the people, technology, processes, data, facilities and service providers it depends on, and supported by incident response, business continuity and disaster recovery plans tested at least annually under severe but plausible scenarios.
- The control framework must follow the three lines of defence model and include a register of all processes with named owners. Banks and insurers must submit an annual report on internal control to the Board and the Central Bank, and critical functions must undergo penetration testing by an independent external party, with results presented to the Board.
- The Board must approve and oversee the technology and cyber risk framework, and institutions must have a timeline to replace or retire outdated systems. The Master System of Record, the complete set of data needed to run critical operations, must be held in the UAE; branches of foreign institutions may keep an up-to-date copy in the UAE with Central Bank approval.
- Changes that are material to critical operations or customers require thorough testing, a rollback plan, a parallel run where systems are replaced, an independent external expert report, at least 30 calendar days’ notice and the Central Bank’s written no-objection. Outsourcing any activity that could significantly affect critical operations also needs prior no-objection, contracts must give the Central Bank inspection rights, and institutions must keep workable exit plans.
- Institutions must notify the Central Bank within 4 hours of an event affecting critical operations, send a summary report within 24 hours, confirm when normal operations resume, and report any high-risk incident within 72 hours. They must also publicly disclose their approach to operational risk and resilience, including how they protect personal data.
Key implications
- Business continuity plans, incident management, change approvals and vendor oversight must all refer back to the mapping of each critical operation and what it depends on. If a vendor or data feed is missing from the map, the gap carries into every other plan. Supervisors are likely to start their reviews here, and the mapping should be treated as a living record updated with every significant change, not a one-off exercise.
- The clock starts when an event affects or may affect critical operations, which can happen overnight, on a weekend or inside a vendor’s systems. Meeting it requires agreed criteria for what is reportable, a named decision-maker available around the clock, and contracts that oblige vendors to alert the institution quickly. Institutions should rehearse the full sequence, from detection to the 4-hour notice and the 24-hour summary, before a real incident tests it.
- The external expert report, 30 days’ notice and written no-objection add several months to any change affecting critical operations or customers. Core banking replacements, cloud migrations and new digital launches should build these steps, and the cost of independent assurance, into their plans now. Institutions are also liable for customer losses caused by errors arising from such changes, which raises the stakes of every go-live.
- Contracts must give the Central Bank inspection rights that reach subcontractors handling customer data, and exit plans must show the institution can keep running if a provider fails. The requirement to keep the core record in the UAE will test arrangements where data or processing sits offshore or in a group shared service center. Contract renegotiation may take time, and the Central Bank can require an arrangement to be ended if it judges the reliance excessive, so reviews should start now.
- The full Board must approve key policies, including the institution’s tolerance for disruption, and receive breach reports directly rather than through a committee. Sanctions under the regulation can include fines, restricting or replacing directors and senior managers, and barring individuals from the UAE financial sector. Directors should expect to show how they challenged management on resilience, not only that they approved the framework.
CBUAE Issues New SME Customer Protection Regulation
CBUAE issued a new Customer Protection Regulation for small and medium-sized enterprises (SMEs) in February 2026, effective 13 September 2026. It applies to all banks and finance companies it licenses, including Islamic institutions. It replaces the 2021 SME Market Conduct Regulation.
SMEs are defined using the federal thresholds for headcount and turnover, and sole proprietors are included. Medium enterprises can have up to AED 250 million in annual revenue. Institutions must also tailor their products, policies and staff training to each SME category: micro, small and medium.
The main requirements are:
- Disclosure: a Key Facts Statement before every product, all information in English and Arabic, 60 days’ notice of changes to terms or fees, and written reasons when an application is rejected.
- Conduct: no tied selling or bundling, suitability assessments, no abusive contract terms, and pay structures that reward mis-selling.
- Fees: fees must be proportionate to the SME’s size and stay within CBUAE caps. Paper statements, legally required updates and account switching must be free, and no closure fee once an account is open since six months or more.
- Account opening: low-risk accounts must be opened within 3 business days, and any delay is capped at two weeks. A register of applications is reported to the Board every quarter.
- Financial difficulty and credit: institutions must offer early support, restructuring options and impartial credit counselling, and must not put excessive pressure on SMEs in collections. Credit can only be granted on a written request and after an affordability check.
- Complaints and data: complaints are acknowledged within 2 business days and answered within 30, with escalation to Sanadak. Institutions must report data breaches and reimburse customers’ direct, verifiable costs.
Breaches can lead to financial sanctions, restrictions on senior management or the Board, and individuals being barred from the UAE financial sector.
Key implications
- SMEs now get protections close to retail customers. Product governance, disclosures and fee schedules for SME books will need to be redone, not just tweaked.
- The 3-day account opening target means AML risk assessment and onboarding have to work together, with every delay documented and reported to the Board.
- Banks will likely need to review their fee income, since several SME charges are now banned and the rest must be justified against cost and the SME’s size.
- Accountability sits with the Board and senior management, who can be personally sanctioned.
Source: CBUAE Circular No. 2/2026, 17 February 2026.
QATAR, BAHRAIN, KUWAIT AND OMAN (QKBO)
CBK Launches Kuwait Wage Payment System
Central Bank of Kuwait (CBK) has launched the Kuwait Wage Payment System (KWPS), a national platform for processing and monitoring wage transfers to private-sector employees through local banks. The CBK runs the system technically and operationally, while the Public Authority for Manpower checks whether employers are complying with it.
KWPS is built on the ISO 20022 messaging standard and aims to:
- Make wage payments faster, more transparent and electronic, with less manual processing
- Let supervisors monitor wage payments in real time and spot non-compliance early
- Improve data quality and data sharing between authorities, to support labour-market policy
- Promote financial inclusion and the use of electronic payments
KWPS is the third system launched under Phase II of the Kuwait National Payment System this year. It follows the Kuwait Automated Clearing House (January 2026) and the Kuwait Dispute Management System (February 2026).
Key implications
- Banks will need to make sure their payroll processing, ISO 20022 messaging and data reporting work with KWPS, since wage payments now pass through a monitored national platform.
- Better visibility of wage flows strengthens oversight of employer compliance. It may also give banks richer data for onboarding and transaction monitoring.
Source: 28.09.26 | Press Release | CBK Launches “Kuwait Wage Payment System” (KWPS)
CBO Issues a Sector-Wide Code of Conduct and Business Ethics, with Compliance Due by June 2027
Central Bank of Oman (CBO) has issued Circular BM 1232 – Code of Conduct and Business Ethics for Banks and Financial Institutions, dated 6 July 2026. The Code establishes the minimum principles and standards for professional conduct, integrity, accountability and responsible business behaviour, and was developed to strengthen governance and align the sector with international best practices. It applies to all licensed banks, finance and leasing companies, payment service providers and money exchange establishments operating in the Sultanate, covering areas such as integrity and honesty, conflicts of interest, confidentiality of customer information and data, fair treatment of customers, market conduct and whistleblowing.
Under the circular, every licensed institution must develop, adopt and implement internal conduct and business-ethics policies that are consistent with the Code and commensurate with its size, nature, complexity and scale of operations, no later than 30 June 2027, giving institutions a year to close gaps against the new standards.
Key implications
- The Code makes conduct and ethics a board and management-level obligation. Institutions will need a documented, embedded framework with clear ownership and monitoring rather than a standalone policy.
- The proportionality clause offers no exemption. Smaller finance, leasing, payment and exchange businesses must still produce tailored, evidenced policies sized to their operations.
- Conduct expectations now extend well beyond banks to PSPs, finance and leasing companies and exchange houses, many with less mature governance, widening the compliance uplift across the sector.
- Supervisory attention on culture and conduct is likely to rise; demonstrable implementation, not merely the existence of a policy, will be the test.
CBO Sets a 2030 Deadline to Convert Islamic Banking Windows into Standalone Islamic Banks
CBO has issued the Islamic Banking Windows Conversion and Transformation Framework via Circular IB 13, dated 2 July 2026. The Framework sets the regulatory roadmap for phased discontinuation of Islamic Banking Window model operated within conventional banks towards fully independent, fully-fledged Islamic banks, with transformation to be completed by 31 December 2030.
It seeks to establish standalone Islamic institutions under robust governance and Shari’a-compliance arrangements, ensure complete separation between conventional and Islamic banking, protect depositors and maintain service continuity, and enhance transparency and market discipline through Muscat Stock Exchange listing requirements. Licensed banks must review the Framework, assess the most suitable transformation approach and submit a Board-approved transformation plan to the CBO.
Key implications
- This is a strategic, capital-intensive restructuring. Window operators must plan the carve-out and capitalization of a standalone entity, the migration of assets and liabilities, and full operational and technological separation.
- A Board-approved transformation plan is due to the CBO in the near term, so the governance and project-mobilisation clock starts now rather than closer to 2030.
- Depositor protection and continuity of service are explicit CBO priorities, meaning transition planning must safeguard customers throughout the carve-out.
- The Muscat Stock Exchange listing requirement adds a capital-markets, disclosure and investor-readiness workstream on top of the operational build.
CBO Launches the National FinTech Strategy and ‘Oman FinTech Gate’ to Build a Regional Hub
CBO in partnership with the Financial Services Authority (FSA) and the National Programme for Fiscal Sustainability and Financial Sector Development (Estidama), launched the National FinTech Strategy and the Oman FinTech Gate on 22 September 2026. The initiatives represent a major step in Oman’s financial-sector transformation, aiming to position the Sultanate as a leading regional and globally connected FinTech hub in support of Oman Vision 2040.
The Oman FinTech Gate is intended to act as a central access point for the ecosystem, signaling a more structured pathway for licensing, sandboxing and market entry as the regulated fintech perimeter expands.
Key implications
- An expanding regulated-fintech perimeter points to open-finance and API access, new licensing categories and more bank–fintech partnerships that institutions should factor into product and technology roadmaps.
- Deeper fintech integration raises third-party, cyber and operational-resilience risk; onboarding, data-sharing and vendor-oversight controls will need to scale accordingly.
- Competitive pressure on payments and retail-banking revenue will intensify; incumbents that partner early are better placed than those that treat fintech as peripheral.
- A single ‘Gate’ as the ecosystem’s front door suggests a more visible sandbox and licensing pipeline that banks should monitor for emerging competitors and partners.
QCB Overhauls Business Continuity Rules: Board Ownership, D-SIB Same-Day Recovery and a Six-Month Fix Window
Qatar Central Bank (QCB) on 2 August 2026 issued new Business Continuity Management (BCM) Instructions for all banks operating in Qatar. These instructions replace the previous business-continuity requirements and take effect immediately, with banks granted a six-month grace period to rectify their status. Non-compliance carries financial penalties under the QCB Law and the Regulation of Financial Institutions Law No. 13 of 2012.
The framework requires a comprehensive BCM programme with Board and Executive Management ownership, a dedicated BCM unit and committee, business-impact analysis, recovery strategies and plans, and crisis-management, testing and communication arrangements. It mandates semi-annual Board reporting, external audit by an independent firm annually, oversight of outsourced and critical functions, a geographically distant alternative site on separate power and communications networks, and encrypted data stored both inside and outside Qatar. Banks classified as Domestic Systemically Important Banks (D-SIBs) must aim to recover full operations preferably within the day of disruption and obtain prior QCB approval of their business-continuity plans, while all banks must test at least annually, file test results with the Banking Supervision Department within one month and notify QCB at least one month before any disaster-recovery exercise.
Key implications
- BCM is elevated to a board-level, independently audited discipline, with a dedicated committee and at least half-yearly board reporting now explicit requirements.
- The six-month grace period is tight for banks that must establish a new alternative site, arrange cross-border encrypted data storage.
- D-SIBs need near same-day recovery plus prior QCB approval of the plan, which is a materially higher bar that recovery-time objectives and test evidence must be able to support.
- A mandatory annual external audit alongside internal-audit review formalises independent assurance over the continuity plan and its testing.
- A heavier supervisory reporting cadence (test results within a month, DR pre-notification, annual submissions to Banking Supervision) calls for automated tracking and evidence management.
- The explicit duty to manage continuity risk in outsourced functions pulls critical third parties into scope; vendor contracts, testing and exit plans should be reviewed now.
QCB Grants Payment Service Providers Direct Access to QA-RTGS, Bypassing Intermediary Banks
QCB has enabled licensed Payment Service Providers (PSPs) to directly access the Qatar Real-Time Gross Settlement system (QA-RTGS), on 1 September 2026. PSPs can now settle transactions without routing through intermediary banks, expected to reduce costs, accelerate payment processing, enhance regulatory oversight and support modernization of Qatar’s financial infrastructure.
Bringing non-bank participants directly into the country’s core settlement system marks a structural shift in Qatar’s payments landscape and in the role banks play within it.
Key implications
- Direct PSP settlement blocks revenue stream of settlement and correspondent fees from routing PSP flows.
- New direct participants in the RTGS introduce settlement, liquidity and operational-risk considerations for the system that QCB will expect participants to manage and monitor.
- Banks should reassess PSP relationships, which shift from pure intermediary arrangements towards a mix of competition and partnership.
- Faster, direct settlement compresses the window for controls, so real-time sanctions screening, fraud detection and AML monitoring must operate at settlement speed.
QCB and SAMA Switch On Reciprocal ‘Himyan’ and ‘mada’ Card Acceptance Across Qatar and Saudi Arabia
QCB and SAMA have launched reciprocal acceptance of Qatar’s Himyan cards and Saudi Arabia’s mada cards on 15 September 2026. The initiative allows cardholders in each country to transact across the other’s merchant and ATM networks, strengthening payment-system integration between the two countries and supporting the modernization of regional payment infrastructure.
The move extends the cross-border reach of national card schemes and deepens GCC payment interlinkage, building on Himyan’s earlier expansion into other regional markets.
Key implications
- Cross-border AML/CFT monitoring, fraud detection and dispute-and-settlement processes must scale to cover a second national scheme and jurisdiction.
- Interoperability or settlement failures between the schemes could become operational incidents that reflect on QCB and Qatari banks, even where the fault lies elsewhere.
- The initiative signals QCB’s intent to reduce reliance on international card networks; domestic operators and global schemes should reassess their competitive position in Qatar.
- As GCC card interlinkage widens, institutions with regional operations should build a repeatable onboarding and compliance playbook for further market pairings.
INDIA
RBI Finalizes Basel III Market-Risk Capital Rules, Locking In the Simplified Standardized Approach From April 2027
On 21 September 2026, the RBI issued the Reserve Bank of India (Commercial Banks – Minimum Capital Requirements for Market Risk) Directions, 2026, effective 1 April 2027. The directions build on an established framework rather than introducing a new one. The Simplified Standardized Approach (SSA) was set out in the draft guidelines of 17 February 2023, and its scalars have been applied since 1 April 2024 under transition arrangements. The trading book is defined by reference to the Held for Trading (HFT) sub-category under the Investment Portfolio Directions, 2025. The revised Net Open Position (NOP) and forex charge from the Tenth Amendment Directions, 2026 are incorporated. Specific-risk tables for interest-rate risk are realigned with BCBS standards. Debt mutual fund and ETF holdings move to a look-through charge subject to eligibility conditions and positions hedged through total return swaps receive offset treatment.
The directions apply to commercial banks other than Small Finance Banks, Payments Banks, and Local Area Banks, at both consolidated and standalone levels. Requirements must be met on a continuous basis, at the close of each business day. The SSA charge continues to aggregate interest-rate, equity, and FX requirements, scaled by 1.30, 3.50, and 1.20 respectively, with risk-weighted assets derived by multiplying the charge by 12.5. Any reclassification between the banking and trading books that reduces total capital must be held as a disclosed Pillar 1 surcharge. New Pillar 3 templates require annual qualitative and semi-annual quantitative market-risk disclosures. The timing is significant: the effective date coincides with that of the ECL and revised standardized credit-risk capital charge directions applicable effective April 2027, so the CRAR impact of all three reforms will crystallize in the same quarter.
Key implications
- Trading-book capital will need to be re-baselined. The scalars are already embedded, but the revised trading-book boundary, fund look-through tests, and specific-risk tables will shift the charge position by position. Treasury and Risk should rerun the full SSA calculation under the final rules well ahead of April 2027 and reflect the results in ICAAP and the FY2027-28 capital plan.
- Accounting classification now determines capital, and arbitrage carries a cost. With the trading book anchored to HFT, classification decisions under the Investment Directions become capital decisions. Any reclassification that lowers capital attracts a disclosed Pillar 1 surcharge. Banks should subject book transfers to a documented capital-impact review and sign-off.
- Fund holdings require look-through data. Debt fund and ETF positions keep debt treatment only if the fund is open-ended, holds at least 90% in debt, and reports constituents and duration monthly with a daily NAV. Failing any test means 9% plus 9% at the 3.50 equity scalar. Treasury should screen holdings now and reflect the outcome in investment limits.
- Internal hedging needs evidence, not intent. Credit-risk transfers from the banking book count only with an exactly matching external hedge. Interest-rate transfers need a dedicated desk approved by the Department of Supervision. Banks relying on internal hedges should document them and seek desk approval early rather than lose recognition on day one.
- FX and NOP limits should be reconciled with the capital charge. With the Tenth Amendment NOP instructions embedded in the final directions, ALCO should align NOP limits, intraday monitoring, and the market-risk charge, particularly for banks carrying large FX positions after the 2026 swap window.
Source:
RBI issues Directions on Minimum Capital Requirements for Market Risk under Basel III for Commercial Banks; Sep 21, 2026
Reserve Bank of India (Commercial Banks – Minimum Capital Requirements for Market Risk) Directions, 2026; Sep 21, 2026
Basel III Adoption: CVA, Leverage Ratio, and Pillar 3 Disclosures
The RBI advanced three further components of the Basel III framework during the quarter, covering derivative capital, balance-sheet leverage, and market disclosure:
- Credit Valuation Adjustment framework (draft): Released on 7 August 2026, the draft replaces the 2011 framework with the Basic Approach (BA-CVA). Banks with an insignificant volume of non-centrally cleared derivatives may instead hold CVA capital equal to 100% of their counterparty credit risk charge. The draft recognizes eligible CVA hedges, introduces sector- and rating-based risk weights, and is proposed to take effect from 1 April 2027.
- Leverage ratio (draft): The Eleventh Amendment Directions implement the Basel Leverage Ratio 2017 Standard. They set a minimum of 4% for D-SIBs and 3.5% for other banks, to be met at all times, with G-SIB branches holding the applicable G-SIB buffer in addition. Derivatives enter the exposure measure at 1.4 times the sum of replacement cost and potential future exposure, and new quarterly templates LR1 and LR2 apply. The changes are proposed to be effective from 1 April 2027.
- Pillar 3 disclosures (final): The revised regime takes effect on 1 April 2027, with first quarterly disclosures for the quarter ending 30 June 2027. It requires a board-approved disclosure policy and written attestation by a board-level senior officer. This defers the start date proposed in the May 2026 draft, which had targeted the quarter ending 30 September 2026. Market-risk templates have since been issued in Annex I of the market-risk Directions of 21 September 2026. Templates for operational risk, counterparty credit risk, and CVA are to follow, and the leverage templates are proposed in the Eleventh Amendment draft.
Key implications
- CVA becomes a standalone capital line for derivative books. Under BA-CVA, counterparty spread volatility, sector, and rating drive capital. Treasury and trading desks should embed CVA capital in derivative pricing, client profitability, and limit frameworks well ahead of April 2027.
- The CVA shortcut and hedge recognition both require evidence. Banks relying on the 100% counterparty credit risk alternative should document the materiality assessment supporting it, as an undocumented threshold invites supervisory challenge. Eligible CVA hedges are also excluded from market-risk capital under the market-risk Directions, so hedge designation and documentation now carry consequences in two frameworks.
- The leverage ratio becomes an “at all times” constraint. Quarter-end compliance will no longer suffice. The RBI has also flagged structures that reduce the exposure measure, including collateral swaps and agency models, as candidates for a Pillar 2 charge. Banks with large repo, derivative, or off-balance-sheet books should monitor leverage intra-quarter.
- Leverage headroom should be tested alongside risk-based capital. With D-SIBs held to a 4% minimum and derivatives measured at 1.4 times replacement cost plus potential future exposure, the leverage ratio may bind before CRAR for low-risk-weight, high-volume businesses. ALCO should model both constraints together when setting balance-sheet and business-line limits.
- The Pillar 3 deferral is a bridge rather than a reprieve. Board-level attestation means disclosures must carry the same assurance as financial reporting. Finance and Risk should use the additional time to reconcile Pillar 3 templates to a single data source and test controls through a dry run during FY2026-27.
- One derivative data set now feeds three frameworks. SA-CCR, BA-CVA, and the leverage exposure measure all draw on the same trade, netting-set, and margin data, and all converge on 1 April 2027. Banks that build a common derivative data layer now will avoid three parallel remediation efforts.
Source:
RBI invites public comments on the draft Directions on ‘Credit Valuation Adjustment (CVA) Framework’; Aug 07, 2026
Draft Reserve Bank of India (Commercial Banks – Credit Valuation Adjustment Framework) Directions, 2026; Aug 07, 2026
RBI invites comments on the draft “Reserve Bank of India (Commercial Banks – Prudential Norms on Capital Adequacy) Eleventh Amendment Directions, 2026”; Aug 07, 2026
Reserve Bank of India (Commercial Banks – Prudential Norms on Capital Adequacy) Eleventh Amendment Directions, 2026 – Draft; Aug 07, 2026
RBI issues Basel Pillar 3 Disclosures for Banks; Jul 30, 2026
Reserve Bank of India (Commercial Banks – Prudential Norms on Capital Adequacy) Seventh Amendment Directions, 2026; Jul 30, 2026
Reserve Bank of India (Commercial Banks – Minimum Capital Requirements for Market Risk) Directions, 2026; Sep 21, 2026
RBI Closes the FCNR(B) Swap Window a Month Early After Mobilizing USD 132.98 Billion
On 14 August 2026, citing an encouraging response, the RBI announced that its swap facility would cover only FCNR(B) deposits mobilized till 31 August 2026, with swaps to be availed by 11 September 2026. The window had originally been scheduled to run until 30 September 2026. The ECB and OFCB windows remain open until 31 December 2026. On 25 August 2026, the RBI aligned the interest-rate relaxation with the revised swap window. It amended the end date for the withdrawal of ceilings on 3-to-5-year FCNR(B) deposits and 3-year-plus NRE deposits from 30 September 2026 to 31 August 2026. On 21 September 2026, the RBI reported that banks had mobilized USD 132.98 billion of FCNR(B) deposits till 31 August 2026. Total inflows under the facility reached USD 143.596 billion post considering USD 5.32 billion of OFCBs and USD 5.296 billion of ECBs reported till 18 September 2026.
Key implications
- A new block of long-dated foreign-currency funding is on the books. USD 132.98 billion of FCNR(B) deposits with 3-to-5-year tenors was raised between 8 June and 31 August 2026. ALM should map these deposits by contractual maturity into structural liquidity and IRRBB gaps, rather than treat them as part of the existing NRI deposit base.
- Late-window inflows warrant behavioral caution. FCNR(B) mobilization rose from USD 65.397 billion on 21 August to USD 132.98 billion by the 31 August cut-off. Deposits raised in a short, incentive-driven window should not be assumed to behave like a typical NRI franchise, and concentration limits by depositor, corridor, and channel should reflect this.
- Central bank support is a contingency, not a funding plan. The RBI withdrew both the swap window and the rate relaxation a month ahead of schedule once mobilization was sufficient. Contingency funding plans should treat such facilities as discretionary and time-limited, and growth plans should not assume their repetition.
Source:
Forex inflows via FCNR(B) Deposits, External Commercial Borrowings (ECBs) and Overseas Foreign Currency Borrowings (OFCBs) under Reserve Bank’s Swap facility; Aug 14, 2026
Reserve Bank of India (Commercial Banks – Interest Rate on Deposits) Third Amendment Directions, 2026; Aug 25, 2026
Data on Forex inflows via FCNR(B) Deposits, External Commercial Borrowings (ECBs) and Overseas Foreign Currency Borrowings (OFCBs) under Reserve Bank’s Swap facility; Sep 21, 2026
Reporting of FCNR(B) Deposits, External Commercial Borrowings (ECBs) and Overseas Foreign Currency Borrowings (OFCBs) mobilized under Reserve Bank’s Swap Facility; Jul 20, 2026
Data on Forex inflows via FCNR(B) Deposits, External Commercial Borrowings (ECBs) and Overseas Foreign Currency Borrowings (OFCBs) under Reserve Bank’s Swap facility; Aug 22, 2026
Data on Forex inflows via FCNR(B) Deposits, ECBs and OFCBs under Reserve Bank’s Swap facility (provisional); Sep 02, 2026
RBI Rewires Bank Pricing: Bulk-Deposit Flexibility Now, a Single Loan-Rate Rulebook Next
The RBI moved on both sides of bank pricing during the quarter:
- Interest Rate on Deposits (final): On 30 July 2026, following the June draft, the RBI permitted differentiation of rates on bulk deposits by the LCR run-off rate applicable to the deposit or unsecured wholesale funding, for both domestic and non-resident rupee deposits.
- Interest Rates on Loans and Advances (draft): Issued on 12 August 2026, following the Statement on Developmental and Regulatory Policies of 5 August, the draft sets a single principles-based framework for the domestic operations of commercial banks (including Small Finance Banks and Local Area Banks), RRBs, co-operative banks, AIFIs, and NBFCs including housing finance companies. Comments closed on 11 September 2026, and the framework is proposed to take effect on 1 April 2027.
- Pricing: Fixed and floating loans are priced off an internal or external benchmark plus a risk-based spread, and no loan may be priced below its benchmark.
- Resets: Floating-rate benchmarks must reset at a periodicity not exceeding three months, fixed for the life of the loan. Agricultural loans reset in line with the crop season, subject to a 12-month maximum.
- Spreads: Spread components other than the credit risk premium cannot be revised for three years. The credit risk premium may change only when the borrower’s credit profile changes.
- Benchmarks: Commercial banks must link all floating-rate personal and MSME loans to an external benchmark.
- Migration: Existing benchmark-linked loans must migrate by 1 April 2029 through a one-time mapping exercise, with borrower consent, at no charge, and at a rate no higher than before migration.
The changes come as bank credit grew 16.5% year on year at end-June 2026 and the weighted average lending rate on outstanding credit fell 45 bps to 9.26%.
Key implications
- Liquidity cost is now visible in the deposit price. Linking bulk-deposit rates to LCR run-off categories ties funding cost directly to liquidity treatment. ALM teams should map bulk depositors to run-off categories and ensure the FTP liquidity premium is consistent with the rate offered.
- Pricing discretion moves from the desk to the published schedule. Rates must follow a schedule published by 10:00 am and be applied uniformly, so any differentiation must sit within published run-off categories rather than individual negotiation. Treasury should automate rate publication and maintain complete audit trails to withstand supervisory review.
- Benchmark design feeds directly into IRRBB. A reset periodicity of no more than three months, fixed for the life of each loan, defines the repricing profile of the floating book. Benchmark choice also determines basis risk against deposit costs. Risk should recalibrate NII and EVE sensitivity once the final directions are issued.
- Spread decisions become three-year commitments. With non-CRP components frozen for three years and the CRP revisable only on a change in the borrower’s credit profile, pricing errors cannot be corrected quickly. Banks should document spread methodologies and strengthen the governance and rating evidence behind CRP revisions.
- Migration carries one-way margin risk. Legacy loans must move to the new framework by 1 April 2029 at a rate no higher than before, with borrower consent and no charges. Any mapping shortfall therefore falls on the bank’s margin. Banks should model the book-wide impact early and plan contracts, systems, and borrower communication as a multi-year programme.
Source:
RBI Issues Amendment Directions on Interest Rate on Deposits; Jul 30, 2026
Reserve Bank of India (Commercial Banks – Interest Rate on Deposits) Second Amendment Directions, 2026; Jul 30, 2026
RBI invites comments on the Draft “Reserve Bank of India (Interest Rates on Loans and Advances) Directions, 2026”; Aug 12, 2026
Reserve Bank of India (Interest Rates on Loans and Advances) Directions, 2026 – Draft; Aug 12, 2026
Quarterly Basic Statistical Return (BSR)-1 on Credit by Scheduled Commercial Banks – June 2026; Aug 31, 2026
RBI Issues Draft Data Governance Guidance, Putting Data Quality on the Board Agenda
On 15 July 2026, the RBI released a draft Guidance on Regulatory Expectations for Data Governance, open for comments until 17 August 2026. It sets expectations on governance, roles, architecture, metadata and lineage, data quality, and third-party arrangements involving data sharing, recognizing that weak data governance can create financial, operational, compliance, and reputational risk. Drawing on the BCBS principles for effective risk data aggregation and risk reporting (BCBS 239), the draft calls for a Data Governance Framework, aligned with the risk management framework, and reviewed at least annually. Oversight sits with a board-level Data Governance Committee, or an existing board committee assigned the role, supported by an executive-level Data Governance Executive Committee.
Its scope runs from commercial banks (including foreign banks), Small Finance Banks, Payments Banks, Local Area Banks, RRBs, and co-operative banks to NBFCs in all layers, AIFIs, ARCs, and credit information companies. Foundational metadata must be created at capture and flow with the data to downstream systems.
Key implications
- Data quality becomes a board-reported metric. Quarterly reporting of quality metrics and persistent issues to a board-level committee turns data defects into a governance matter. Banks should define measurable thresholds for dimensions such as accuracy, completeness, and timeliness on critical data elements before the guidance is finalized.
- A single source of truth will test existing architectures. The draft prohibits parallel or competing sources for the same data element and requires all downstream systems, models, and processes to derive from the designated source. Where ECL, capital, and regulatory reporting draw on separate extracts, banks should map the gaps and build reconciliation now rather than under examination.
- Model risk and data risk are converging. Models must draw on the designated source of truth, derived data must remain traceable to its origin, and externally sourced data must meet internal standards. Banks should extend lineage documentation to model inputs, including vendor data, and apply equivalent due diligence to data shared with third parties and group entities.
- Ownership must be named, not implied. A head of data at Chief General Manager rank or equivalent, an executive committee, and designated owners, stewards, and custodians require organizational decisions, not only IT investment.
- Data governance will face independent assurance. The framework must be audited internally and externally, including by CERT-In empanelled auditors where applicable, with reports going to the Audit Committee of the Board. Internal audit should build data governance coverage into its plan, and data functions should keep evidence of control effectiveness, not only policies.
Source:
RBI issues draft ‘Guidance on Regulatory Expectations for Data Governance’; Jul 15, 2026
Draft Guidance on Regulatory Expectations for Data Governance; Jul 15, 2026
RBI issues Basel Pillar 3 Disclosures for Banks; Jul 30, 2026
Board and Supervisory Rulebook Reset: 64 Master Directions Replace 628 Circulars
Two final measures reset how banks are supervised and how their boards spend their time:
- Matters to be placed before Boards: On 14 July 2026, following the April draft, the RBI issued Governance Amendment Directions for commercial banks, Small Finance Banks, Payments Banks, and Local Area Banks, effective 1 October 2026. They aim to help boards use their time effectively and focus on strategy and risk governance. The directions replace scattered requirements in existing circulars with a single schedule in three appendices. Appendix I lists the policies requiring Board approval and those that may be delegated, Appendix II A lists the other matters that must go to the Board and Appendix II B lists matters the Board may delegate at its discretion. Periodic review of Board-approved policies may be delegated to Board committees, with the Board approving only material amendments, and items identified for discontinuation have been omitted. The Board must ensure sufficient time for strategy and risk governance. It must also periodically review both the matters placed before it and those delegated to committees, including the timeliness and adequacy of agenda papers.
- Consolidated supervisory directions (final): On 31 July 2026, the RBI issued 64 Master Directions consolidating all instructions administered by the Department of Supervision on an “as is” basis. These now serve as the sole library of supervisory instructions. A parallel circular repealed 628 circulars with immediate effect, while actions already taken or initiated under them remain governed by the repealed instructions.
Key implications
- Delegation is not abdication. Boards remain accountable for matters delegated to committees and management, and the directions require them to review those delegations periodically. Banks should approve a documented delegation matrix and retain evidence of each periodic review.
- Every policy citation needs re-mapping. With 628 circulars repealed, policies, control libraries, and audit checklists that cite them are out of date even where the substance is unchanged. Compliance should re-map its obligations register to the 64 Master Directions to avoid findings on stale references.
- The new board framework is already in force. The governance changes took effect on 1 October 2026. Banks should confirm that board calendars, committee terms of reference, and internal policies reflect the revised appendices, and stop routing discontinued items to the Board unless internal policy requires otherwise.
- Freed board time should go to the 2027 transition. Removing routine items creates room for the strategy and risk governance the RBI intends. Boards should direct that capacity to the capital, data, and model-risk changes landing in 2027 rather than absorb it into existing agendas.
Source:
RBI Issues Amendment Directions on ‘Matters to be placed before the Boards of the Banks’; Jul 14, 2026
Reserve Bank of India (Commercial Banks – Governance) Amendment Directions, 2026; Jul 14, 2026
Reserve Bank of India issues Consolidated Supervisory Directions; Jul 31, 2026
Consolidation of Supervisory Instructions – Repeal of Circulars; Jul 31, 2026
