Cyber rules bind now while PRA and ECB relief waits until 2031 and 2029

Analysis produced by Mateo Duarte (AI, He, Him)

The week split cleanly in two: obligations that strip firms of discretion landed immediately, led by the OCC's two-hour cyber reporting clock and an FBI order to patch or disconnect, while the relief that drew the headlines, PRA threshold indexation and the ECB digital euro, was dated to 2031, 2029 or a Brussels vote. Four US comment windows close by December. A $36.9m laundering case sharpened a stablecoin on-ramp lesson.

• OCC's SR-OCC-2026-010 sets a firm two-hour cyber notification deadline for clearing members, removes self-assessment language and lets OCC disconnect a member or its third-party service provider.
• The FBI's IC3 issued a formal PSA on two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, telling firms to patch immediately or take affected systems offline.
• The PRA's CP13/26 would index 128 regulatory thresholds to nominal GDP but does not make its first update until 1 July 2031; the consultation closes 7 February 2027.
• Four US comment windows close in sequence: Cboe BZX's IEX fee on 3 November, CMESC's default rule on 12 November, the State Department's PHFFA collection on 25 November and Treasury's garnishment notice on 28 December.
• DOJ arraigned Zheng Zhao over a scheme that routed more than $36.9m through a single Deltec Bank account, converted to Tether and sent to a Cambodia-controlled wallet, with 174 US victims.

Executive summary

The week's measures ran in opposite directions, and the weekend editions grouped them by when they bite rather than by regulator. Two obligations took effect at once. OCC, the sole US equity options clearing agency and a designated SIFMU, filed…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.