on 12 december 2025, the eu adopted council regulation (eu) 2025/2600 (the regulation), prohibiting the transfer of immobilised assets of the central bank of russia, or entities acting on its behalf, back to russia. this temporary measure is a direct response to the ongoing war of aggression against ukraine and aims to mitigate the severe economic and security challenges posed by russia's actions. the decision underscores the eu's commitment to limiting russia's access to financial resources that could be used to escalate the conflict. in the absence of this prohibition, such resources could directly fund russia’s military operations, exacerbate hybrid threats such as cyberattacks, misinformation campaigns, and infrastructure sabotage. key highlights of the regulation: scope of prohibition: the regulation bans any direct or indirect transfer of assets or reserves of the central bank of russia, including those managed by entities like the russian national wealth fund. temporary nature: the measures will remain in effect until russia ceases its aggression against ukraine, provides sufficient reparations to support ukraine’s reconstruction without harming the eu economy and no longer poses a serious economic threat to the eu. reporting obligation: a broad range of natural and legal entities, including the european central bank must disclose an array of information to the european commission including the identification of individuals or entities that hold or control relevant assets. such information must be updated every three months. safeguards: the regulation bars the enforcement of claims arising from contracts or transactions affected by the eu measures, where such claims are brought by the russian government, designated russian entities or persons acting on their behalf. economic rationale: allowing these transfers would risk prolonging the war, destabilising eu economies, and increasing fiscal burdens on member states. the eu has already faced significant economic disruptions, including energy price shocks, supply chain issues, and increased defence spending. broader implications: the regulation aligns with the eu’s broader strategy to strengthen resilience against hybrid threats and reduce dependency on external energy sources, as outlined in initiatives like repowereu. review: by 31 december 2026 and every 12 months after, the european commission will review this regulation and present a report on the main findings of that review to the eu council. this measure highlights eu’s commitment to supporting ukraine while prioritising the economic stability and security of the union. by curbing access to key financial resources, the eu seeks to address the broader challenges posed by the ongoing conflict. for more details, refer to the official press release here and the council regulation (eu) 2025/2600 here.

the recent enactment of the national sanctions implementation unit law 2025 (the nsiu law) and establishment of the national sanctions implementation unit (nsiu) in cyprus marks a significant milestone in the island’s sanctions enforcement regime. for obliged entities operating in regulated sectors, understanding how the nsiu law affects your business is not just a matter of compliance, it is essential for mitigating significant financial and reputational risk. this detailed overview is designed for "obliged entities" and their compliance professionals, focussing on obligations regarding risk management and reporting to the nsiu. for completeness, the nsiu law also contains provisions which are of general application (not just to obliged entities). you can find a more general overview of the nsiu law here. new obligations under the nsiu law the nsiu law introduces, among other things, a set of obligations for obliged entities specifically targeting sanctions compliance. these obligations are additional to those applicable to obliged entities under the aml law or directives issued by their supervisory authorities under powers granted by the aml law. what types of entities are “obliged entities” under the nsiu law? the nsiu law borrows the concept of an “obliged entity” from the cyprus prevention and suppression of money laundering and terrorist financing law 2007 (the aml law) and includes: credit institutions financial institutions (such as investment firms, aifs, payment institutions and emis) administrative service providers crypto-asset service providers gambling service providers auditors, external accountants and tax advisors legal professionals (in certain cases) a real estate agent or intermediary in real estate rentals (for transactions above a certain threshold) traders in precious metals, precious stones, or high-value goods like art and cultural artefacts risk management the nsiu law requires every obliged entity to establish and implement adequate and appropriate policies, controls and procedures. the goal is to effectively identify, assess, mitigate, and manage the risks of sanctions violations and possibly actions or omissions which amount to sanctions violations. such policies, controls and procedures must be proportionate to the characteristics and activities of the relevant obliged entity. supervisory authorities (such as cysec, the central bank, the cyprus bar association and icpac) are empowered to issue binding regulations and directives specifying the details and method of implementation of the risk management obligations under the nsiu law, also noting that certain authorities had already issued directives with respect to sanctions and restrictive measures prior to the nsiu law. mandatory reporting of possible breaches to the nsiu a cornerstone of the new regime is the direct line of communication between obliged entities and the nsiu. obliged entities are required to report directly to nsiu any information related to potential sanctions breaches that comes into their possession or awareness in the context of their activities, subject to data protection considerations under the general data protection regulation (gdpr). the nsiu has the authority to request, in writing, any additional information it deems necessary for its investigations. importantly, the sanctions breach reporting obligation under nsiu law is independent of suspicious activity reporting (sar) and suspicious transaction reporting (str) obligations to the financial intelligence unit (mokas) under the aml law. where obliged entities a case of potential sanctions violation, they must carefully assess whether a report to mokas must be under the aml law, in addition to their reporting obligations to the nsiu. severe penalties for non-compliance under the nsiu law, the nsiu is empowered to impose various administrative measures on obliged entity where they breach their risk management obligations set out in part 2 above: administrative fines: supervisory authorities can impose administrative fines of up to €500,000. in cases of continuing violation, an additional daily fine of €500 may be levied. other administrative measures: these include suspending or revoking an obliged entity’s operating licence, prohibiting permanently or temporarily individuals from holding management positions, requiring an obliged entity or an individual to cease and desist from any action amounting to a breach, and issuing public statements labelling the non-compliant entity. separately, the breach of reporting obligations under the nsiu law may amount to a criminal offence under the law on criminal offenses and penalties for violation of union restrictive measures 2025 which transposes the provisions of eu directive 2024/1226. overall, the establishment of the nsiu is a pivotal step in modernising the sanctions enforcement framework of cyprus and the ruleset for obliged entities aims to brings sanctions compliance mechanisms on equal footing with those under the aml law. the nsiu law can be accessed here (in greek)

the european banking authority (eba) recently provided comprehensive advice to the european commission on six key regulatory mandates under the new anti-money laundering and countering the financing of terrorism (aml/cft) framework. this guidance includes proposals for draft regulatory technical standards (rts) and preparatory work on mandates which aim to establish a robust foundation for the operations of the new anti-money laundering authority (amla), ensuring a risk-based, proportionate and harmonised approach across the eu. key highlights: risk assessment methodologies: amla must set out how supervisors will assess and clarify the residual risk profile of each obliged entity and the frequency at which such risk profile must be reviewed. the eba proposes its own methodology for the calculation of residual risk recommending single, standardised and unified data points to use as risk indicators and that quantitative and objective data must be used where possible. the eba adopted a proportionate approach by cutting data collection requirements by 15 per cent following stakeholder feedback and new transitional measures will give both institutions and supervisors time to adjust. importantly, as risks vary and evolve, specific scoring thresholds and weights are not included in the draft rts. instead, it would be the role of amla to define the specific scoring thresholds and weights for each review cycle and to monitor the effective application of these indicators by supervisors in all member states. customer due diligence (cdd): amla must harmonise customer due diligence requirements by specifying, by means of draft rts, which information obliged entities must collect to perform standard cdd, simplified due diligence (sdd) and enhanced due diligence (edd). even more amla is required to set out in the draft rts which reliable and independent sources of information obliged entities may use to verify the identities of relevant natural or legal persons. the scale of change introduced by the anti-money laundering regulation (amlr) could create vulnerabilities. to mitigate such risk, where possible the eba decides to build on and align with pre-existing eba works and standards. enforcement and sanctions: eba provides guidelines on classifying breaches by severity and setting criteria for pecuniary sanctions, administrative measures and periodic penalty payments. this ensures consistent and proportionate enforcement across member states. the draft rts contain specific provisions for natural persons, including senior management and the management body in its supervisory function. holding individuals accountable for aml/cft failures is an important deterrent and an essential part of effective enforcement. group-wide policies and procedures: amla must prepare a draft rts defining the minimum standards for information-sharing within groups, criteria for identifying parent undertakings and conditions for applying group-wide obligations to entities with shared ownership, management or compliance control. next steps: once adopted by amla and endorsed by the european commission, these instruments will aim to form the backbone of a comprehensive and resilient eu aml/cft system. for further details eba’s press release can be found here

the european banking authority (eba) and the european securities and markets authority (esma) recently issued a joint report recommending targeted revisions to the investment firms regulation (ifr) and directive (ifd). this follows a call for advice from the european commission to assess the prudential framework for investment firms. under articles 60 and 66 of the ifr and ifd, the european commission is required to deliver a comprehensive report to the eu council and european parliament. this report evaluates the prudential framework for investment firms and may propose legislative amendments to address any identified gaps or areas for improvement. key recommendations: categorisation of investment firms: proposed conditions to qualify as small and non-interconnected investment firms as well as the conditions to qualify as credit institutions. proportionality and functionality: the framework is deemed fit-for-purpose but requires refinements to enhance proportionality and operational efficiency. level playing field: proposals aim to ensure fair competition among investment firms and between investment firms and financial institutions performing similar activities. consistency: improvements in calculation methodologies and threshold monitoring are suggested to ensure consistent application across the eu. the report also addresses: adequacy of own funds requirements. implications of the banking package. specific considerations on commodity and emissions allowance dealers and on energy firms. prudential consolidation of investment firm groups. remuneration policies. interactions with other regulations, including mica, ucits and aifm directives. next steps: the eba and esma will submit their findings to the european commission for consideration. for more detailed information, please see here

the british virgin islands financial services commission (bvi fsc) has extended the moratorium on filing fees for certain statutory updates until 31 march 2026, offering continued relief to eligible entities. under the bvi business companies act (revised edition 2020), existing companies that were incorporated or continued before 2 january 2025 and are not struck off can still make the required filings under sections 41 (register of members), 43a (registration of register of members) and 96a (company to collect, keep and maintain beneficial ownership information) with a us$0 filing fee through 31 march 2026. in plain terms, these sections deal with bringing a company's core statutory records and key particulars up to date on the public register (for example, information held in statutory registers and other prescribed company details), and the moratorium lets older companies make those catch‑up filings without paying the usual fee. similarly, under the limited partnership act (revised edition 2020), existing limited partnerships that were registered or continued before 2 january 2025 and are not struck off can make the required filings under sections 53a (registration of registers of general partners and limited partners) and 53b (limited partnership to collect, keep and maintain beneficial ownership information) with a us$0 filing fee through 31 march 2026. put simply, these sections cover filing updates to prescribed limited partnership particulars and registered records, enabling existing lps to bring their filings into line at no charge while the moratorium is in place. for entities that are non-compliant with the framework they should work to ensure full compliance as quickly as possible so as not to impact any corporate good standing issues. these updates were published by the bvi fsc on 31 december 2025 through industry circular 46 of 2025. for more information, readers can consult the official notice and industry circular 46, which provide additional context on the filing framework. for further details, the official notice can be accessed here and circular 46 can be found here

on 16 december 2025, luxembourg’s commission de surveillance du secteur financier (cssf) published circular 25/900, amending circular cssf 22/811 concerning the authorisation and organisation of entities acting as uci (undertakings for collective investment) administrators. key amendment repeal of annex b: annex b of circular cssf 22/811 has been repealed. updated annual reporting instructions are available on the cssf’s website. for detailed guidance, circular 25/900 can be accessed here

the bvi financial investigation agency (returns) order, 2025, has been published, introducing a structured framework for the submission of returns by designated non-financial businesses and professions (dnfbps) and non-profit organisations (npos). this order, effective from 27 november 2025, clarifies reporting obligations and establishes a clear legal context for compliance. the order, gazetted as statutory instrument no. 99 of 2025, formalises these requirements into law. understanding its provisions is crucial for all affected entities to ensure they meet their statutory duties and avoid administrative penalties. purpose and objectives of the order the primary objective of the financial investigation agency (returns) order, 2025 (the order) is to streamline and formalise the process for submitting returns. made under the authority of section 5r of the financial investigation agency act, revised edition 2020, the order is designed to enhance the financial investigation agency's (fia) supervisory capabilities. the core purposes include: timely submission: to facilitate the prompt preparation and filing of returns by dnfbps and npos. data analysis: to enable the fia to analyse statistical data, identify compliance deficiencies, and develop informed supervisory strategies. information requests: to allow the fia to respond efficiently to statistical inquiries and other requests for information. electronic filing: to facilitate a modern, electronic system for filing returns, improving efficiency and accuracy. fulfilling obligations: to ensure the fia can meet its obligations and undertakings as a supervisory body. the order applies to all dnfbps and npos over which the fia exercises supervisory responsibility pursuant to section 5c of the act. key reporting requirements the order establishes clear and non-negotiable deadlines for the submission of returns. compliance with these timelines is mandatory for all applicable entities. who is required to file? every dnfbp and npo subject to the fia's supervision must file the relevant return. the specific requirements are detailed in schedule 1 for dnfbps and schedule 2 for npos. filing deadlines both dnfbps and npos are required to file their respective returns by 31 december each year. the return will cover the activities of the preceding calendar year. for example, the return filed by 31 december 2026, will pertain to the 2025 calendar year. this annual reporting cycle is critical for maintaining up-to-date records and facilitating ongoing risk assessment. legal context and penalties the order is not a standalone directive but is firmly rooted in the financial investigation agency act, revised edition 2020. this legislative backing gives the order its authority and defines the consequences of non-compliance. penalties for non-compliance failure to adhere to the provisions of the order constitutes a breach and exposes the dnfbp or npo to administrative penalties. these penalties are detailed in schedule 5 of the order and are designed to enforce compliance key breaches include: failure to file a return: entities that do not submit their annual return by the 31 december deadline will be liable for a fine. failure to ensure accuracy: submitting a return that contains inaccurate or incomplete information is a contravention of the order. failure to notify of inaccuracies: if an entity becomes aware of an inaccuracy in a previously filed return, it must notify the agency. failure to do so is a punishable breach. this order represents a significant step in strengthening the bvi's regulatory framework. we provide expert advice on the laws of the british virgin islands and our team is positioned to guide you through these new compliance obligations. the bvi fia (returns) order 2025 can be found here

on 16 october 2025, the european securities and markets authority (esma) released its second consolidated report on sanctions and measures imposed in member states for 2024. here are the highlights: sanctions overview: a total of 975 administrative sanctions and measures were imposed across 29 member states, with the value of fines exceeding €100 million. in 2023, the value of administrative fines where approximately €71 million. over 60 per cent of the sanctions imposed in 2024 were administrative fines. top sectors: market abuse regulation (mar) and mifid ii/mifir accounted for the highest amounts of administrative fines. france and germany imposed the highest fines, with france leading at eur 29.4 million settlements: settlement procedures accounted for 10 per cent of administrative sanctions, totalling €20m. germany issued the largest settlement fine (€12.9m) under mifid ii for algorithmic trading violations. discrepancies across member states: enforcement varied significantly, with hungary issuing the most sanctions (182), followed by greece (93) and italy (84). some member states, like slovakia, reported minimal activity, reflecting differences in market size and enforcement practices. sector-specific observations: mar: insider trading and market manipulation were the most common violations, with 259 administrative fines issued. mifid ii/mifir: organisational requirements, general principles and client information obligations were key areas of enforcement. ucits directive: 47 administrative sanctions were issued, with france imposing the highest fines (approximately €2.1 million). emerging regulations: no sanctions were reported under the markets in crypto-assets regulation (mica) or the securities financing transactions regulation (sftr), reflecting their recent implementation. trends and challenges: while the total number of administrative sanctions remained stable compared to 2023, the report highlights the need for greater convergence in enforcement practices across the eu. esma emphasises that administrative sanctions are just one tool in a broader supervisory framework. next steps: esma will continue encouraging discussions among national authorities to ensure consistent enforcement and transparency, aiming for a more integrated and effective eu financial market. esmas news release can be found here and the report here

if you are involved in the virtual assets space in the british virgin islands, you will want to pay attention to this. in november 2025 the bvi financial services commission (fsc) released circular 43, which includes a helpful faq document called "understanding virtual assets and vasp regulation". think of it as your go-to guide for navigating the regulatory requirements around virtual asset activities under the virtual assets service providers act, 2022 (vasp act), which has been in effect since 1 february 2023. what you need to know? let's break down the key points from the guidance: what counts as a virtual asset? simply put, virtual assets are digital representations of value that you can use for trading, making payments, or investing – but this doesn't include traditional fiat currencies. what activities does this cover? if you're running exchanges, handling transfers, providing safekeeping services, or offering financial services related to virtual assets, you're likely operating as a vasp. what do you need to do to stay compliant? there are three main requirements: register with the fsc – this isn't optional. follow anti-money laundering (aml) and counter financing of terrorism (cft) regulations – these are critical safeguards. appoint compliance officers and maintain robust internal controls – you need the right people and systems in place. what happens if you do not comply? operating without proper registration is potentially a criminal offence and can land you with fines of up to us$100,000 or even imprisonment. the fsc isn't messing about here. why this matters the fsc is emphasising compliance for good reason – it's all about mitigating risks like money laundering and terrorist financing and protecting the integrity of the bvi's financial system. whether you're already operating in this space or considering entering it, understanding these requirements is essential. for the full details, you can access circular 43 and the faqs directly from the fsc. need help navigating vasp regulations in the bvi? get in touch with our team for tailored guidance. for more details, access circular 43 here and the faqs here.

on 14 october 2025, the european banking authority (eba) published a comprehensive report on the growing use of white labelling in the financial services sector. this business model, where financial institutions (providers) collaborate with other entities (partners) to offer financial products under the partner's brand, is gaining traction across europe. here is a summary of the key insights: what is white labelling? white labelling is a business model which involves a financial institution creating a product or service (e.g., bank accounts, payment cards, loans) which is then branded and distributed by a partner, which could be a financial or non-financial entity. for instance, a retail chain might offer a branded credit card issued by a bank. key findings widespread adoption: over 35 per cent of surveyed banks in 2025 reported using white labelling, with applications ranging from payment services to credit products like buy now pay later (bnpl) and open banking services. diverse partnerships: non-financial entities, such as digital platforms and marketplaces, are increasingly acting as partners, leveraging their customer reach to distribute financial products. cross-border potential: white labelling is not limited to domestic markets; it is also being used to expand services across borders. opportunities cost efficiency: providers can leverage partners' infrastructure and brand visibility, reducing marketing and operational costs. expanded offerings: partners can offer a broader range of financial products without needing their own licenses. increased customer base: both providers and partners can reach new customers. financial inclusion: digital distribution can make financial services more accessible, especially regarding the geographic distribution and fee models. innovation and competition: it prompts innovation and lowers entry barriers, promoting a more dynamic financial market. risks and challenges identified by the eba transparency issues: consumers may struggle to identify the actual service provider or know whom to contact for complaints. opacity of the cost structure: consumers may receive inaccurate, incomplete, or contradictory information and the terms and conditions applicable might not be clear. fraud risks: reduced clarity in roles and responsibilities can increase vulnerability to fraud. even more, fraudulent activity may occur due to weaknesses in partner cdd or oversight practices. regulatory complexity: supervisors face challenges in monitoring these arrangements, especially when partners are non-financial entities or operate across borders. operational and reputational risks: both providers and partners may face risks due to the fragmented value chain and potential misconduct by the other party. next steps: the eba plans to: enhance supervisory convergence by integrating white labelling into the 2026 union strategic supervisory priorities. improve consumer awareness through better disclosures about the roles of providers and partners. continue monitoring the evolution of white labelling through regular assessments. eba’s press release and the reports can be found here

on 16 december 2025, luxembourg introduced draft bill no. 8669, a significant legislative proposal set to modernise the incorporation of private limited liability companies (sarls). the reform introduces greater flexibility for founders by allowing the deferred payment of the minimum share capital. this change aims to enhance luxembourg’s competitiveness by streamlining the company formation process, addressing practical hurdles such as delays in opening bank accounts due to stringent kyc/aml checks. below is a summarised overview of what this bill entails. key aspects of the proposed reform this draft bill represents one of the most practical updates to luxembourg company law in recent years. here are the essential details you need to know: deferred payment of minimum capital: the core change allows the payment of the €12,000 minimum share capital for a sarl to be deferred for up to 12 months post-incorporation. this applies exclusively to cash contributions. mandatory subscription: while payment can be delayed, the requirement to fully subscribe to the entire share capital at the time of incorporation remains unchanged. founders must still commit to the full amount from day one. scope and exclusions: the deferral is limited to the statutory minimum. any capital subscribed above €12,000 must be fully paid up at incorporation. furthermore, contributions in kind must be fully paid up at the time of formation, as is currently the case. extension to sarl-s: this new flexibility is also extended to the simplified private limited liability company (société à responsabilité limitée simplifiée - sarl-s), further lowering the barrier to entry for entrepreneurs (the minimum share capital for this type of company being €1. alignment with european practice: the reform brings luxembourg’s framework in line with several neighbouring jurisdictions, including france and germany, removing a comparative disadvantage for company formation. new safeguards and accountability with increased flexibility comes a renewed focus on accountability and creditor protection. founder liability: the liability of founders will be aligned with the stricter regime applicable to public limited companies (sas). this includes responsibility for unpaid capital contributions. suspension of voting rights: as a powerful sanction, the voting rights attached to shares for which capital calls remain unpaid may be suspended until the payment is made. enhanced transparency: companies must publish the names of shareholders with outstanding capital contributions, along with the amounts due, in their annual accounts. this ensures full transparency for third parties. next steps the legislative process is underway, with the draft bill currently under review by the luxembourg parliament and the council of state. the new rules will apply to all sarls and sarl-s incorporated after the law officially enters into force. the draft bill 8669 can be accessed here (in french).

if you manage or operate a bvi limited partnership, you should take note of an important update from the bvi financial services commission. on 19 november 2025, the fsc published circular 41, which introduces the limited partnership (financial return) order, 2025. what does this mean for you? starting from 1 september 2025, limited partnerships will need to submit annual financial returns to their registered agents. this requirement comes from section 54a of the limited partnership act (revised 2020) and is designed to enhance transparency and regulatory oversight. does this apply to your partnership? not all partnerships will need to comply with this new requirement. you may be exempt if your partnership falls into one of these categories: your partnership is already regulated under financial services legislation and submits financial statements to the commission; or your partnership files annual tax returns with financial statements to the inland revenue department when do you need to act? the first returns will be due from 1 january 2026 onwards, with the specific deadline depending on your partnership's fiscal year. where can you find more information? for complete details, you can review circular 41 and the order directly. if you have any questions about how this affects your partnership or need assistance with compliance, please don't hesitate to get in touch with us. we're here to help you navigate these changes smoothly and ensure your partnership remains compliant with the new requirements. for details, circular 41 can be found here and the order can be accessed here.

the government of bermuda, through the national anti-money laundering committee (namlc), released its 2024 national risk assessment (nra), marking the fourth such assessment. this comprehensive report evaluates bermuda's exposure to money laundering (ml) and terrorist financing (tf) risks, providing insights to strengthen national policies and private sector resilience. key findings: money laundering (ml) risks: high-risk areas: drug trafficking, foreign-sourced fraud, foreign-sourced market manipulation / insider training and foreign-sourced corruption/bribery remain the primary proceeds generated ml threats. sectoral risks: the deposit-taking, securities, trust business, corporate service provider and legal sectors are rated as having high inherent ml risks due to their international exposure and transaction volumes. emerging risks: the economic investment residential certificate (eirc) program, introduced in 2023, was assessed for the first time, receiving a medium ml high risk rating due to its potential exposure to high-value investments. terrorist financing (tf) risks: bermuda's tf threat remains low, with no evidence of domestic or cross-border tf activities. the nonprofit sector, while assessed for tf vulnerabilities, showed no significant risks. sectoral insights: digital asset businesses (dabs): rated medium-high for ml risk due to the global nature of digital assets and potential misuse for illicit activities. real estate: medium ml risk, influenced by foreign investments, including through the eirc program. nonprofit organisations (npos): low tf risk, with robust oversight and no evidence of misuse. global cooperation: bermuda continues to collaborate with international bodies to address ml/tf risks, aligning with financial action task force (fatf) standards. the findings will guide updates to bermuda's aml/atf policies, ensuring the jurisdiction remains resilient against evolving financial crimes. for more information, the report can be found here and the press release here

on 18 november 2025, the european supervisory authorities (eba, eiopa, and esma) officially designated critical information & communication technology (ict) third-party providers (ctpps) under the digital operational resilience act (dora). this milestone strengthens the eu's financial sector's operational resilience by ensuring robust oversight of key ict service providers. key highlights: role of ctpps: these providers deliver essential ict services, including infrastructure, business, and data services, to financial entities across the eu. they have a pivotal role in maintaining the financial ecosystem's stability. objective of the dora oversight framework: promote the sound management of ict risk by the critical providers through direct oversight engagement the dora framework mandates the european supervisory authorities to oversee ctpps, ensuring they implement effective risk management and governance practices. this oversight aims to mitigate ict risks and safeguard the eu financial sector's operational resilience. the european supervisory authorities will continue engaging with designated ctpps through ongoing examinations to uphold these standards. for further details, refer to esma’s news release, here and the list of designated ctpps, here

on 19 december 2025, luxembourg’s commission de surveillance du secteur financier (cssf) published circular 25/901, which became effective the same day. this circular, streamlines and modernises the regulatory framework for luxembourg's investment funds. by consolidating previous circulars and aligning provisions with practical experience, it establishes a unified and coherent set of rules for specialised investment funds (sifs), investment companies in risk capital (sicars), and part ii undertakings for collective investment (ucis). this initiative not only simplifies compliance but also ensures that the regulatory environment remains adaptable to the diverse needs of investors and market participants. key highlights include: scope: applies to sifs, sicars, and part ii ucis, excluding certain fund types such as eltifs and mmfs. investment rules: clarifies asset concepts, risk-spreading principles, and investment limits, with flexibility for well-informed or professional investors. transparency: mandates clear, accurate disclosures in sales documents, covering investment policies, risks, and redemption terms. borrowing & techniques: sets borrowing limits and provides guidelines for efficient portfolio management techniques. sicar-specific rules: defines risk capital criteria, emphasising development intent, specific risks, and exit strategies. a notable feature of the circular is its emphasis on flexibility and investor-centric provisions. for instance, it allows for tailored investment limits and derogations based on the type of investor, such as well-informed or professional investors, while maintaining robust risk-spreading principles. additionally, the circular underscores the importance of transparency, requiring detailed and accurate disclosures in sales documents to enable investors to make informed decisions. this includes clear guidelines on investment strategies, risks, redemption terms, and borrowing limits, ensuring that funds operate with a high degree of accountability and investor protection. by addressing key areas such as risk capital criteria for sicars, the use of portfolio management techniques, and the treatment of borrowing, the circular reflects the cssf's commitment to fostering a dynamic yet secure investment environment. it also provides transitional provisions to ensure a smooth implementation for existing funds, reinforcing its role as a forward-looking regulatory instrument designed to support the growth and stability of luxembourg's investment fund industry. the circular 25/901 can be found here

the european union has intensified its sanctions against russia's "shadow fleet" in response to its ongoing aggression against ukraine. two recent measures highlight the eu's commitment to curbing russia's revenue streams and addressing its violations of international law. 1. sanctioning 41 vessels of the shadow fleet on 18 december 2025, the eu imposed restrictive measures on 41 additional vessels linked to russia's shadow fleet. these vessels are accused of circumventing the oil price cap mechanism, supporting russia's energy sector, transporting military equipment, or facilitating the theft of ukrainian grain and cultural goods. the sanctions include a port access ban and restrictions on maritime services. this brings the total number of designated vessels to nearly 600. the eu has reaffirmed its readiness to adopt further measures to pressure russia and its shadow fleet operations. 2. targeting 9 shadow fleet enablers on 15 december 2025, the eu also sanctioned five individuals, and four entities involved in supporting russia's shadow fleet. these include businessmen linked to major russian oil companies, such as rosneft and lukoil, and shipping companies based in the uae, vietnam and russia. the sanctions involve asset freezes, travel bans and prohibitions on eu citizens and companies providing funds to the listed parties. these measures aim to disrupt the shadow fleet's operations, which involve concealing the origin of russian oil and engaging in high-risk shipping practices. the press releases can be found here and here

the sanctions (miscellaneous amendments) (overseas territories) order 2025 (the order) was published on 12 december 2025 and came into force on 11 december 2025. this updates the sanctions framework that applies across uk overseas territories (ukots), including the british virgin islands, cayman islands. the changes are also relevant to, by local extension, to bermuda. an understanding of these changes are important for businesses based in the ukots to ensure they remain compliant and avoiding regulatory issues. the order ensures that sanctions regimes in the ukots remain aligned with developments under uk domestic legislation. the order updates various existing sanctions orders to reflect recent changes made to uk sanctions regimes under the sanctions and anti-money laundering act 2018. specifically, it implements the modifications introduced by the sanctions (eu exit) (miscellaneous amendments) (no. 2) regulations 2024 in the ukots. the key updates are as follows: 1. multiple sanctions regimes updated the order introduces tailored updates across a wide range of uk/ukot sanctions regimes, including those targeting venezuela, north korea, russia, iran, syria, and global anti-corruption measures. these amendments are designed to close gaps and ensure consistency. 2. better information sharing one of the main themes is enhanced financial transparency. new provisions allow relevant public authorities in the ukots to share information with the governor or an authorised officer. this strengthens the information-sharing framework needed for effective sanctions enforcement. 3. paying statutory obligations whilst under sanctions the order clarifies how "required payments" work. it creates explicit exceptions to asset-freeze rules for payments that a designated person must make under ukot law. this covers payments to: government departments customs and revenue authorities company registrars financial regulators land authorities consolidated funds importantly, the amendments also allow a designated person to reimburse a non-designated person who has made such a payment on their behalf. this practical change ensures that routine legal obligations can be met without accidentally breaching asset-freeze rules. 4. keeping up with the modern economy: cryptoassets and art the order significantly expands the definition of "relevant firm" across numerous sanctions schedules to reflect modern business realities. the updated definition now includes: cryptoasset exchange providers – firms that exchange cryptoassets for money or other cryptoassets custodian wallet providers – firms that safeguard cryptoassets or private cryptographic keys for customers art market participants – firms trading in or acting as intermediaries for art sales worth €10,000 or more insolvency practitioners – persons administering insolvency proceedings letting agents – firms carrying out letting agency work reporting to the governor amendments have been made to direct reporting obligations towards the governor rather than the treasury in specific contexts. this streamlines the administrative process and clarifies who is responsible for oversight in the ukots. insolvency proceedings the order clarifies the rules around insolvency. it sets out specific conditions under which actions related to insolvency and restructuring proceedings involving a designated person can occur. the key safeguard remains: any payments made directly or indirectly to a designated person must be credited to a frozen account. this order ensures that ukots maintain consistency with the uk's evolving sanctions framework, reinforcing the global effort to address issues like terrorism, corruption, and human rights abuses. what should firms do next? given the expansion of relevant firm definitions and adjusted reporting lines, organisations with activities or structures in the ots should review their sanctions screening and reporting processes. if you need support or guidance in navigating these changes, our team is available to assist. sanctions (miscellaneous amendments) (overseas territories) order 2025 can be accessed here.

on 3 december 2025, the department for international tax cooperation (ditc) announced the activation of the country-by-country reporting (cbcr) functionality on the ditc portal. this functionality is effective as of 3 december 2025. this update is critical for multinational enterprise groups (mne groups) with cayman islands constituent entities (ces). re-registration deadline: the ditc previously advised (on 29 august 2025) that all mne groups were required to re-register with the tax information authority (tia) via the ditc portal by 30 november 2025, prior to filing cbc reports. key requirements: consider classification: every entity resident in the cayman islands must determine whether or not it is a ce of an mne group. filing obligations: ultimate parent entities (upes) resident in the cayman islands with consolidated group revenue of usd 850 million or more in the preceding fiscal year must file a cbc report. surrogate parent entities (spes) resident in the cayman islands where the upe is not required to file in its jurisdiction or where there is not automatic exchange agreement in place with that jurisdiction. reports must include jurisdictional data on revenue, taxes, employees, assets, and other financial metrics, adhering to the oecd xml schema guide. filing deadlines: standard deadline: 12 months post the fiscal year-end. extension: for filings due between 31 july 2025, and 31 december 2025, the deadline is extended to 27 february 2026. resources and support: updated guidelines are available on the ditc website. queries can be directed to portal@gov.kyby authorised contacts only. ditc’s press release can be found here. for further details, access the ditc portal at https://ditcportal.secure.ky/login. our previous blog post on this matter can be accessed here

the cayman islands monetary authority (cima) has officially implemented the virtual asset service providers (vasp) financial returns form, effective 1 december 2025. this form, accessible via the reefs system under code vfr-051-84, standardises the submission of periodic financial data for entities registered or licensed under the virtual asset (service providers) act (2024 revision). key details include first deadline: 31 december 2025, for the reporting period ending 30 september 2025. mandatory submission: timely and accurate completion is required; no extensions will be granted. for ease of reference, all reefs forms completion guides can be accessed here. vasps are reminded that the timely and accurate submission of financial returns is a condition of ongoing registration or licensing and is an integral component of cima’s risk-based supervisory framework. cima’s notices can be found here and here.

on 3 december 2025, the european commission officially added russia to its list of high-risk jurisdictions with strategic deficiencies in anti-money laundering (aml) and counter-terrorist financing (cft) frameworks. this decision follows the adoption of delegated regulation (eu) 2025/1393, which aims to amend and assess the eu aml list based on a review of third countries not listed by the financial action task force (fatf) but whose membership is suspended. the eu commission’s technical assessment conducted using established methodologies and input from public sources, member states’ competent authorities and the european external action service, concluded that russia meets the criteria for high-risk designation. consequently, under the 4th anti-money laundering directive (4amld), eu entities must now apply enhanced vigilance in transactions involving russia to safeguard the integrity of the eu financial system. the delegated regulation will take effect following a one-month scrutiny period by the european parliament and the council, extendable by an additional month. the eu commission will continue monitoring listed countries and relevant developments. for further details, refer to the eu commission’s press release here.