Regulatory calendar 2027: deadlines for crypto, payment, gambling and investment firms.
69 dated changes from December 2026 to July 2028 in 27 jurisdictions: new licensing regimes, AML rules, CARF tax reporting, capital and fees. Every date links to the law or the regulator's notice it comes from, checked on 29 October 2026.
Updated · Reviewed by Nikolai Timofejev, Head of Licensing & Regulatory Affairs
Regulatory deadlines by month
69 dated changes in date order. Filter by area to see one business line. Each entry links to the official text it comes from and to our page on that licence.
- Law
- The date is set in a statute or regulation.
- Regulator
- The date comes from a regulator's rule, notice or published timeline.
- calc.
- The law sets a period, such as nine months after publication, and we counted the day.
- Target date
- The authority calls the date a target.
December 2026
New ZealandRegulatorOnline casino operators that have not applied for a New Zealand licence must stop serving New Zealand. Applicants can keep operating, without advertising, until their application is decided. The DIA timeline also marks 1 June 2027 as the end of an exemption from the prohibition.
Applies to: Online casino operators
BrazilRegulator, calc.First monthly report to the central bank on virtual-asset services in the FX market, covering operations from 3 November 2026. Later reports are due by the 5th of each month.
Applies to: FX-authorised institutions that provide virtual-asset services
SpainRegulator, calc.New set warnings in gambling ads. One of three harm messages replaces "play responsibly", with a reference to juegoseguro.es where the medium allows. The minors warning reads "Solo para mayores de 18 años". Radio ads for contests are exempt from the harm message. Ads under contracts signed before 6 October 2026 may run unchanged until 6 January 2027.
Applies to: DGOJ-licensed operators and their affiliates
MexicoRegulatorMobile apps of SPEI participants must follow Banxico's transfer guides: no more than four stages to send a transfer, the beneficiary identified by CLABE, card digits or mobile number, and a tracking key and payment receipt for transfers to other institutions.
Applies to: SPEI participants, including e-money institutions
- BrazilRegulator
Deadline for former fixed-odds betting operators to settle the financial and regulatory obligations tied to their authorisations after the betting ban.
Applies to: Former licensed betting operators
South KoreaLawNew rules for payment gateways take effect: sellers' settlement funds must be protected outside the firm, through a trust, a deposit or guarantee insurance. The protected share is 60% in the first year, 80% in the second and 100% from the third.
Applies to: Payment gateway (PG) operators
CuraçaoLawThe LOK transition period ends. Suppliers of critical goods or services to CGA licensees need a CGA supplier licence if based in Curaçao, or a CGA registration if based abroad. In October 2026 the CGA postponed portal filing deadlines until its portal is back; that notice does not mention the 24 December date.
Applies to: B2B suppliers to CGA licensees
JapanLawCARF: last day for existing customers of crypto exchanges, those on the books on 31 December 2025, to give their exchange a self-certification of tax residence.
Applies to: Crypto-asset exchange service providers and their users
NigeriaRegulatorCentral bank market-share caps: a firm with more than 25% of consumer issuing may hold no more than 15% of merchant acquiring, and the reverse. Full compliance is due by this date.
Applies to: Banks, mobile money operators, switches and other licensed payment operators
SwitzerlandLaw, calc.Existing companies report their beneficial owners to the new federal transparency register. AGs with an ordinary audit have 3 months from 1 October 2026, other legal entities up to 6 months; entities whose owners are all already in the commercial register have two years. From 1 April 2027 financial intermediaries must report differences between their KYC data and the register.
Applies to: Swiss legal entities; banks, crypto and fintech firms as financial intermediaries
Trinidad and TobagoLawThe temporary ban on virtual-asset business under the Virtual Assets and VASP Act 2025 ends. Firms in the regulatory sandbox were exempt. The TTSEC has not yet said what applies from 1 January 2027.
Applies to: VASPs serving Trinidad and Tobago
January 2027
- BrazilRegulator
A 24-hour wait for large outgoing crypto transfers. Transfers above US$10,000 per operation or per client per day to foreign virtual-asset firms or self-custody wallets, stablecoins included, can go out only 24 hours after the funds reach the client's wallet.
Applies to: Crypto service providers (SPSAVs), banks and payment institutions offering crypto
- BrazilRegulator
Crypto service providers, and the groups they lead, must start applying the 31 central bank prudential rules listed in Resolution 580, in line with their prudential segment.
Applies to: Crypto service providers (SPSAVs)
- BrazilRegulator
New reports to the central bank: client balances, crypto held in custody, verifiable proof of reserves and staking assets.
Applies to: SPSAVs; banks and payment institutions offering crypto
- BrazilRegulator, calc.
The new minimum capital is phased in: existing institutions hold their old minimum plus 50% of the gap to the new one from 1 January 2027, 75% from 1 July 2027 and the full amount from 1 January 2028.
Applies to: Central bank-authorised institutions, including payment institutions, that were operating on 4 November 2025 or had applied by then
- KahnawakeRegulator
Fees rise. A Client Provider Authorization costs US$40,000 to apply (was US$35,000) and US$40,000 to renew for five years, annual fee included (was US$5,000 plus the annual fee). A Key Person Permit costs US$6,000 to apply or renew (was US$5,000). Complete applications filed before 1 January 2027 keep the old fees.
Applies to: CPA holders and applicants
- NigeriaRegulator
Payment transaction data generated in Nigeria must be stored and managed in Nigeria.
Applies to: Banks, mobile money operators, switches and other licensed payment operators
SingaporeLawCARF due diligence and data collection start for crypto-asset service providers. First returns, for 2027, are due by 31 May 2028.
Applies to: Crypto-asset service providers with a Singapore nexus
- SingaporeLaw
The amended CRS applies. Firms that hold e-money or central bank digital currency for customers now count as depository institutions, so e-money issuers can become CRS reporting institutions.
Applies to: E-money issuers, banks, custodians and investment entities
- SpainLaw, calc.
Higher licence guarantees: €2.6m for each general licence in its initial period, and €1.3m in total for all of an operator's general licences in later years. Operators below the new amounts must top up.
Applies to: Licensed online operators in Spain
TürkiyeRegulatorMinimum capital for 2027: TRY 500m for full-licence portfolio management companies and TRY 250m for limited-licence ones. The bulletin sets no deadline for existing companies.
Applies to: Portfolio management companies
UAETarget dateTarget date for CARF due diligence and data collection. Reviews of existing users are due by 31 December 2027 and first reports by 30 June 2028; the first exchange is on 1 September 2028.
Applies to: Crypto-asset service providers in the UAE
US (Illinois)Law; rules in draftIllinois digital asset tax: 0.2% of the value of the digital asset exchanged, transferred or stored, paid by customers in Illinois. Brokers with an office in Illinois, and remote brokers with US$100,000 or more of sales to Illinois customers, collect it. The tax department's rules are still in draft.
Applies to: Crypto brokers and exchanges serving Illinois customers
- BrazilRegulator, calc.
One-off report to COAF, the financial intelligence unit, of crypto transfers of US$10,000 or more to or from self-custody wallets made in October-December 2026, due on the first business day of January 2027.
Applies to: Central bank-authorised institutions, including SPSAVs
EURegulator, calc.ESMA's deadline for stablecoins that are not MiCA-compliant. National regulators should require CASPs to remediate remaining pre-existing exposures as soon as possible and no later than three months after ESMA's opinion of 8 October 2026.
Applies to: MiCA-authorised CASPs
- EU (non-euro states)Law
Payment service providers in non-euro member states, other than payment and e-money institutions, must be able to receive instant euro transfers. They may not charge more for them than for standard euro transfers.
Applies to: Banks and other PSPs in non-euro member states (payment and e-money institutions follow on 9 April 2027)
- USLaw
The GENIUS Act and the OCC's implementing rule take effect for payment-stablecoin issuers. Treasury's AML and sanctions rule for issuers is still a proposal.
Applies to: Payment-stablecoin issuers
UKLawCARF: crypto service providers must tell reportable users that their 2026 data will be reported to HMRC.
Applies to: UK reporting cryptoasset service providers
February 2027
- South KoreaLaw
Tokenized securities can be issued and traded under the amended FSCMA and Electronic Registration Act. Under the FSC's draft rules, open for comment until 11 November 2026, distributed ledgers must be shared by at least two account management entities together with the Korea Securities Depository.
Applies to: Securities firms, issuers and OTC trading venues
NorwayRegulatorFirst CARF report to the Tax Administration, covering 2026. After that the deadline is 10 February every year.
Applies to: Crypto exchange and custody providers
- South KoreaLaw, calc.
The travel rule extends to transfers of any amount between registered VASPs; today it starts at KRW 1m. The change applies from 19 February 2027, six months after the amended decree was promulgated on 18 August 2026.
Applies to: VASPs
- UKRegulator
The FCA application window closes; it opened on 30 September 2026. A firm that applied in time but has no decision when the regime starts on 25 October 2027 can keep providing cryptoasset services until the FCA decides. The FCA calls this the saving provision.
Applies to: Crypto firms serving UK customers
March 2027
MalaysiaRegulatorBank Negara's technology requirements for payment services firms take effect: system resilience, cyber security, data protection and fraud detection.
Applies to: Payment services firms, including e-money issuers
- SpainLaw
Joint deposit limits across all operators, run by the DGOJ: €700 a day, €1,750 a week and €3,300 per four weeks by default. Operators must check the central system before each deposit.
Applies to: Online operators in Spain
CanadaRegulatorRegistered payment service providers file their annual report for 2026 with the Bank of Canada.
Applies to: PSPs registered under the RPAA
ItalyRegulatorRemote gaming concessionaires must file a certified report on each payment instrument used to top up gaming accounts. Until then, the instruments already in use stay valid on a transitional basis.
Applies to: Remote gaming concessionaires
- UAE (ADGM)Regulator
End of the transition period for venture capital fund managers and foreign fund managers under ADGM's new funds framework.
Applies to: Venture capital and foreign fund managers in ADGM
April 2027
AustraliaRegulatorInterchange on foreign-issued cards used in Australia is capped at 1% of the transaction value.
Applies to: Acquirers and card networks
- CuraçaoRegulator
Licensees must meet the local substance (local presence) requirement of the LOK.
Applies to: CGA online gaming licensees
- JapanLaw
Online identity checks with a high spoofing risk are abolished, mainly those based on images of ID documents, such as an ID photo plus a selfie sent through an app.
Applies to: Banks, funds-transfer firms, crypto exchanges and other firms under the Act on Prevention of Transfer of Criminal Proceeds
- UKLaw
Remote betting moves to a 25% rate of General Betting Duty. Bets placed wholly on UK horse racing are excluded.
Applies to: Online betting operators serving UK customers
- AustraliaLaw
Digital asset platforms and tokenised custody platforms come under AFS licensing. A 6-month transition starts: firms that apply to ASIC within it may keep operating until ASIC decides. The date is from the Act's commencement table; ASIC's roadmap gives 9 April 2027.
Applies to: Crypto exchanges, brokers and custody platforms serving Australians
- EULaw
Payment and e-money institutions in the euro area must be able to send and receive instant euro transfers; those in other member states must be able to receive them.
Applies to: Payment institutions and e-money institutions
- JapanLaw
First CARF reports from crypto exchanges on 2026 transactions. After that, reports are due by 30 April every year.
Applies to: Crypto-asset exchange service providers
May 2027
- AustraliaRegulator; extension proposed
ASIC's product intervention order for retail CFDs expires unless it is extended. ASIC proposes to extend it to 2037 and widen it to CFDs settled in digital assets; the Minister must approve.
Applies to: CFD and FX brokers with retail clients
- BrazilRegulator
eFX providers (international payments and transfers) without BCB authorisation must apply for a payment institution licence to keep offering eFX. Without an application they must stop within 30 days.
Applies to: eFX providers in Brazil without BCB authorisation
South AfricaRegulatorFirst CARF report to SARS, for 1 March 2026 - 28 February 2027.
Applies to: Crypto-asset service providers
- UKLaw
First CARF reports to HMRC, for 2026. Providers in scope in 2026 must also register with HMRC by this date.
Applies to: UK reporting cryptoasset service providers
June 2027
ChileRegulatorAnnual sworn return DJ 1964 to the tax service on users resident in Chile, covering 2026.
Applies to: Crypto-asset service providers
- EULaw
The European Commission reports on how MiCA is working, with a legislative proposal where appropriate.
Applies to: CASPs and token issuers
Isle of ManLawFirst CARF return, for 2026.
Applies to: Reporting crypto-asset service providers
JerseyLawFirst CARF reports, for 2026. After that they are due by 30 June every year.
Applies to: Reporting crypto-asset service providers
- New ZealandLaw, calc.
First CARF reports, for the tax year 1 April 2026 - 31 March 2027.
Applies to: Crypto-asset service providers in New Zealand
- NigeriaRegulator
New minimum capital levels for capital market operators, including digital asset firms and VASPs, must be met.
Applies to: VASPs, brokers, dealers, fund managers and custodians
July 2027
- EULaw
Deadline for AMLA to start its first selection of firms for direct supervision; it must finish within six months of starting. Credit and financial institutions active in at least six member states are assessed.
Applies to: CASPs, payment and e-money institutions active in six or more member states
FinlandLawThe licensed market for online betting and online casino opens, ending the Veikkaus monopoly for these games.
Applies to: Betting and online casino operators; game suppliers
- EU (non-euro states)Law
Payment service providers in non-euro member states must be able to send instant euro transfers and offer verification of payee.
Applies to: Banks, PSPs, payment and e-money institutions in non-euro member states
- EULaw
The AML Regulation (AMLR) starts to apply directly in every member state, and the deadline to transpose the sixth AML directive passes.
Applies to: All obliged entities, including CASPs, payment and e-money institutions
- JapanLaw, calc.
Crypto regulation moves from the Payment Services Act into the Financial Instruments and Exchange Act, with disclosure duties and insider-trading rules for crypto. A Cabinet Order will set the day, no later than one year after the law was promulgated.
Applies to: Crypto exchanges and issuers
September 2027
- EULaw, calc.
DAC8: deadline for the first exchange between EU tax authorities of the crypto data that providers report for 2026.
Applies to: CASPs, through national reporting
October 2027
- AustraliaLaw, calc.
Last day of the 6-month transition. Platforms that have not applied to ASIC fall under the full rules from 8 October 2027.
Applies to: Digital asset and tokenised custody platform operators
- EULaw
The EU moves to T+1: securities traded on trading venues must settle no later than the first business day after the trade.
Applies to: Investment firms, trading venues, CSDs and custodians
- UKLaw
The UK cryptoasset regime starts: FCA authorisation is needed for activities such as running a trading platform, dealing and custody.
Applies to: Crypto firms serving UK customers; UK stablecoin issuers
December 2027
- South KoreaLaw, calc.
Second year of the payment gateway regime: the protected share of sellers' settlement funds rises from 60% to 80%.
Applies to: Payment gateway (PG) operators
2028
- EULaw (year only)
AMLA begins direct supervision of the firms it selected.
Applies to: Selected CASPs, payment and e-money institutions and other financial institutions
- USLaw
FinCEN's AML/CFT program rule for investment advisers takes effect after a two-year delay.
Applies to: Registered investment advisers and exempt reporting advisers
- USLaw, calc.
Deadline for state regulators to submit their first certification that their stablecoin regime is substantially similar to the federal one.
Applies to: State stablecoin regulators and state-qualified issuers
- BrazilRegulator
Last day of the rule that places crypto service providers, and the groups they lead, in prudential segment S4 whatever their size. The central bank can change the segment.
Applies to: Crypto service providers (SPSAVs)
- USLaw, calc.
Digital-asset service providers may no longer offer or sell payment stablecoins to people in the US unless a permitted issuer issued them, subject to the Act's exceptions.
Applies to: Exchanges, brokers, wallets and other digital-asset service providers
Dates as of 29 October 2026. Regulators can still move a date, so check the linked source before you rely on it. Write to us if you see a change we have missed.
Expected, no fixed date yet
Announced or proposed changes without a confirmed date. They move into the calendar once a law or a regulator sets the day.
- EU
PSD3 and the Payment Services Regulation are not adopted yet. The Parliament's indicative plenary date is 14 December 2026; application dates follow publication in the Official Journal.
- EU
Retail Investment Strategy: political agreement on 18 December 2025. The new rules apply 18 to 30 months after publication in the Official Journal, so not in 2027.
- UK
Systemic sterling stablecoins: the Bank of England plans to finalise its rules by the end of 2026. Each coin starts with a temporary issuance limit of £40bn.
- UK
Financial Services and Markets Bill: abolishes the Payment Systems Regulator, moving its functions to the FCA, and reforms AML supervision. No start dates are set yet.
- UK
T+1 settlement from 11 October 2027, the same day as the EU. The statutory instrument is still in draft.
- US
Comments on the CFTC's advance notice on crypto market rules close on 14 December 2026, and on the SEC's proposed crypto custody rules on 7 December 2026.
- Canada
Federal stablecoin regime under the Bank of Canada: the government intends the regulations to take effect in fall 2027. Issuers already issuing could continue if they apply within 30 days of the Act coming into force. Comments on the draft are due within 60 days of its publication on 24 October 2026.
Hong KongLicensing for virtual-asset trading, custody, advisory and management services: the government plans to put the bill to the Legislative Council within 2026. The CARF bill is still before the Council.
- Switzerland
CARF applies from 1 January 2027 at the earliest; Parliament has not yet approved the partner states.
SwedenProposals: the Gambling Act would cover any online game people in Sweden can play (proposed from 1 January 2027), and new AML laws would follow the EU package (proposed from 10 July 2027).
- Brazil
Provisional Measure 1.394/2026, which bans fixed-odds betting, can stay in force until 4 March 2027 at the latest unless Congress converts it into law (our count of the constitutional period, which pauses during the congressional recess).
- New Zealand
The DIA timeline marks 1 June 2027 as "End of exemption from prohibition" without further detail.
- Australia
CARF and domestic crypto reporting: the ATO says the measure is not yet law.
DenmarkBill L 127 on tighter gambling marketing rules, mostly planned from 1 January 2027, has lapsed.
GibraltarThe Gambling Act 2025 has been in force since 1 April 2026 except sections 55-77; no date is set for those yet.
The licences behind these dates
Regulator, licence type, capital, timelines and tax in each jurisdiction.
CASP authorisation under MiCA: services, capital classes, the passport and the AML rules that come with it.
Payment institution, e-money and money transmitter licences by country.
Online gaming and betting licences, from Curaçao and Malta to the newly regulated markets.
Investment firm, fund manager and broker licences by country.
Forex and CFD broker licences, with capital and client protection rules.
Offices from Hong Kong to Miami.
A law firm, not a reseller.
Prifinance has many years of experience in supporting licensing projects for crypto, payment, gambling and investment firms. We know the typical problems clients face and deal with risks early.
60+ lawyers, auditors and consultants work on applications directly - no outsourcing chains.
The quote you approve is the price you pay; government and regulator fees are stated separately upfront.
Company structure, license application, bank account and compliance framework - from a single provider.
Business plans, AML/KYC and IT security policies drafted to the standards regulators actually check.
Reporting, audits, renewals and license extensions once you are live. We stay on your side.
The people who will handle your file
Expert with 15 years of experience in FinTech, payments, and business strategy.
Expert in company registration, financial licenses, AML and tax consulting.
International business consultant with experience in company setup, remote work, and multilingual communication.
Active across our channels.
Founders who wanted it done right.
“As a software development crew at FewMoreTaps OÜ, we've had the pleasure of working with Prifinance on some key financial moves.First of all, navigating the world of corporate banking and finance can be a maze, but Prifinance made it feel like a walk in the park. They helped us set up a corporate bank account without the hassle of jumping on a plane or drowning in paperwork. Everything was done remotely, smoothly…”
“I had their assistance in company registration and I would recommend them. They were answering all my clarification during the process and offering all their supportThank you Daniel and Irinia”
“We found PRIFINANCE COMPANYvia the Internet and asked for help in organizing the opening of their company in Estonia. PRIFINANCE COMPANY specialists helped us a lot with this. Their professional, competent approach and knowledge of their business left us with only the best impressions.”
“I'm thrilled with my experience with PriFinance! They helped me obtain a crypto license in Estonia without any hassle. The team was super understanding and always available to answer my questions and assist. It was great to see how they put effort into preparing the documents to ensure everything went smoothly. I'm delighted with the outcome and highly recommend PriFinance to anyone looking to get a license…”
“Opening an account with Prifinance in a Swiss bank was such an easy and quick process that I was shocked. It all started with the first call, where I received detailed guidance on the required documents and the entire procedure.One of the key highlights was their attention to detail. As someone who usually gets tangled up in paperwork, I was pleasantly surprised when they sent me all the documents and…”
“I recently had the pleasure of working with Boris.. and I must say, it was a fantastic experience. Boris went above and beyond to assist me with my residency needs. His professionalism, knowledge, and dedication truly stood out. I highly recommend working with Boris and the team!”
Regulatory deadlines in 2027: common questions.
What are the main regulatory deadlines for crypto firms in 2027?+
In the US, the GENIUS Act takes effect on 18 January 2027. In the UK, the FCA application window closes on 28 February 2027 and the new cryptoasset regime starts on 25 October 2027. Australia brings digital asset platforms under licensing on 8 April 2027, with a 6-month transition. In the EU, AMLA must start selecting firms for direct supervision by 1 July 2027 and the AML Regulation applies from 10 July 2027. CARF tax reporting starts in many countries, with the first reports due from February 2027.
When does the EU AML Regulation (AMLR) apply?+
From 10 July 2027, under Article 90 of Regulation (EU) 2024/1624. It applies directly in every member state, so there is no national version to wait for. Member states must also transpose the sixth AML directive by the same date.
When does the UK cryptoasset regime start?+
On 25 October 2027, under regulation 1(2) of SI 2026/102. A firm that applies to the FCA between 30 September 2026 and 28 February 2027 and is still waiting for a decision on that date can keep operating under a saving provision until its application is finally determined.
When does the GENIUS Act take effect?+
On 18 January 2027, the date the OCC gives for the Act and its own implementing rule. State regulators must submit their first certification by 18 January 2028. From 18 July 2028, digital-asset service providers may not offer or sell to people in the US payment stablecoins that a permitted issuer did not issue, subject to the Act's exceptions.
When are the first CARF reports due?+
It depends on the country: Norway by 10 February 2027, Japan by 30 April 2027, the UK and South Africa by 31 May 2027, and the Isle of Man, Jersey and New Zealand by 30 June 2027. In the EU, providers report under DAC8 through national rules, and the first exchange between tax authorities is due by 30 September 2027. Singapore starts collecting data on 1 January 2027 and the first returns are due in 2028.
When does the EU move to T+1 settlement?+
On 11 October 2027, under Regulation (EU) 2025/2075. Trades on trading venues must settle no later than the first business day after the trade. The UK plans the same date, but its statutory instrument is still in draft.
How are the dates checked?+
Each date comes from the law or the regulator's own notice, linked next to it, and was checked on 29 October 2026. Where the law sets a period rather than a day, such as nine months after publication, we count the day and mark it "calc.". Proposals without a fixed date are listed separately under "Expected".
Which of these deadlines apply to my company?+
That depends on your licences, where your clients are and what you offer. Send us a short description of your business and our lawyers will reply in writing with the dates that apply and what to prepare for each.
Find out which 2027 deadlines apply to your business
Tell us your licences, the countries you serve and your services. Our lawyers reply in writing with the dates that apply to you and what to prepare for each one.