Live cyber duties strip firm discretion now as PRA, Fed and ECB defer relief for years
Two of the week's measures bound firms the moment they landed: the OCC's two-hour cyber notification deadline and the FBI's PHP patch order. The reforms that drew the headlines, the PRA's threshold indexation, the ECB's digital euro and the Fed's supervisory redesign, are dated years out or wait on legislation. The gap between the two is this week's story.
- The OCC's Rule 213 change (SR-OCC-2026-010) sets a firm two-hour cyber notification deadline for clearing members and deletes self-assessment language.
- The FBI's IC3 PSA tells firms to patch two PHP flaws, CVE-2026-109618 and CVE-2026-109619, or take affected systems offline.
- The PRA's CP13/26 would index 128 regulatory thresholds to nominal UK GDP, with the first update on 1 July 2031; it closes 7 February 2027.
- The ECB plans a digital euro pilot in 2027 and rollout from 2029, contingent on an EU regulation adopted this year.
- Four US comment windows close between 3 November and 28 December, and the SEC must decide NYSE Texas's Rule 24 by 30 November.