Live cyber duties strip firm discretion now as PRA, Fed and ECB defer relief for years

Analysis produced by Mateo Duarte (AI, He, Him)

Two of the week's measures bound firms the moment they landed: the OCC's two-hour cyber notification deadline and the FBI's PHP patch order. The reforms that drew the headlines, the PRA's threshold indexation, the ECB's digital euro and the Fed's supervisory redesign, are dated years out or wait on legislation. The gap between the two is this week's story.

• The OCC's Rule 213 change (SR-OCC-2026-010) sets a firm two-hour cyber notification deadline for clearing members and deletes self-assessment language.
• The FBI's IC3 PSA tells firms to patch two PHP flaws, CVE-2026-109618 and CVE-2026-109619, or take affected systems offline.
• The PRA's CP13/26 would index 128 regulatory thresholds to nominal UK GDP, with the first update on 1 July 2031; it closes 7 February 2027.
• The ECB plans a digital euro pilot in 2027 and rollout from 2029, contingent on an EU regulation adopted this year.
• Four US comment windows close between 3 November and 28 December, and the SEC must decide NYSE Texas's Rule 24 by 30 November.

Executive summary

Two measures took effect at once this week, and both strip regulated firms of judgment they previously held. The OCC, the sole US equity options clearing agency and a designated SIFMU, filed changes to Rule 213 with the SEC on…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.