AI Accountability, CFTC Rulemaking, and FCA: Crypto Regulatory Roundup

In a two-week window straddling late September and early October 2026, the world's most influential financial regulators issued a coordinated, if not formally coordinated, set of signals about artificial intelligence governance in financial services. The Bank of England, the European Central Bank, the Bank for International Settlements, and the Monetary Authority of Singapore all drew the same basic line: AI can run, but humans must be able to grab the wheel. Simultaneously, the US Commodity Futures Trading Commission opened a landmark rulemaking process that would create a dedicated oversight regime for retail crypto commodity transactions for the first time. For accounting firms, CFOs, and compliance officers building crypto practices, these developments are not background noise. They shape what your AI-assisted tools must do, how you document their use, and which regulatory registers your clients may soon need to appear on.

What Global Regulators Said About AI and Financial Services

The cluster of statements was striking in its geographic breadth. Within roughly ten days, senior figures at four major institutions made public statements on AI governance, each adding a different dimension to the same core concern.

Bank of England: Human Oversight as a Non-Negotiable Principle

In an article published on 30 September, Bank of England Governor Andrew Bailey focused on what he called recursive, self-reinforcing AI systems, models that learn and act in loops without discrete human checkpoints. His concern was that systems with those characteristics "risk reducing society's ability to exercise meaningful oversight and intervention," and that the more capable the system, the more acute that risk becomes.

Bailey was careful not to call for prohibition. He specifically warned against premature regulation of fast-moving technology and acknowledged that AI can drive meaningful efficiency gains, economic growth, and prosperity across industries. His argument was about governance architecture: policymakers should concentrate on ensuring that humans retain the practical ability to intervene and set boundaries, rather than trying to constrain the technology itself. The most pressing near-term mechanism the Bank of England identified is rigorous pre- and post-deployment testing of frontier AI models, which the UK already facilitates through a dedicated testing regime. Cybersecurity risk, particularly the threat that frontier models could undermine the operational sustainability of financial infrastructure, was flagged as the area of greatest concern.

ECB Supervisory Board: Clarity of Responsibility Across the AI Lifecycle

ECB Supervisory Board member Patrick Montagner echoed many of Bailey's themes in a speech delivered on 1 October. He agreed that frontier AI models introduce significant new cybersecurity risks to the banking sector, but added a more nuanced point: banks can also leverage those same frontier capabilities defensively. Threat detection powered by the same class of models that criminals may exploit is already a practical use case.

Montagner's conditions for responsible AI adoption in banking centred on three requirements: responsibilities must be clearly assigned, data quality must be sufficient to support the decisions the model is making, and monitoring must be maintained throughout the entire operational life of the system. That last point, lifecycle-spanning oversight, is one that many firms currently treat as a deployment-phase activity, not an ongoing one.

BIS Financial Stability Institute: Systemic Resilience, Not Just Firm-Level Governance

Fernando Restoy, Chair of the BIS Financial Stability Institute, speaking in September, offered the broadest lens. His argument was that AI changes not only how banks operate internally, but also the environment those banks operate within. That distinction matters for regulators, who need to think about systemic risk at the network level, not just about whether each individual firm has an AI policy document.

Restoy noted a specific tension in the cybersecurity context: AI enables banks to detect threats faster and with greater accuracy, but that enhanced detection also demands faster real-time remediation. Operational resilience frameworks built for human-speed incident response may not be equipped to handle AI-speed threat landscapes. Supervisors, in his view, need to update their own frameworks to account for this lag.

MAS Finalises AI Governance Guidelines for Financial Institutions

The most concrete near-term regulatory output came from Singapore. On 7 October, the Monetary Authority of Singapore published its finalised supervisory expectations for responsible AI adoption by regulated financial institutions. The guidelines were developed following a consultation that opened in November 2025.

The MAS framework sets out four core expectations for regulated firms. First, firms must maintain clear oversight and accountability for AI-related risks. Second, they must assess and manage risks across the complete AI lifecycle, from model selection through deployment and eventual retirement. Third, they must account for third-party risks when AI systems are sourced from or rely on external providers. Fourth, controls must be proportionate to the risks the AI system presents.

The guidelines take effect from October 2027, with certain provisions applying from October 2028. Singapore-regulated firms operating crypto businesses, and international firms with MAS-licensed entities, now have a defined runway to build compliance programmes. Firms without MAS exposure should nonetheless treat this as a leading indicator: the Bank of England and ECB statements suggest similar expectations are moving toward formalisation in the UK and EU.

CFTC Opens the Door to a Dedicated Crypto Market Framework

Separately, on 5 October, the US Commodity Futures Trading Commission published an Advanced Notice of Proposed Rulemaking outlining its intention to build a comprehensive regulatory framework for retail commodity transactions involving cryptoassets. For firms and their clients active in US crypto markets, this is a significant procedural step, even if it remains a proposal at this stage.

What the ANPRM Actually Proposes

The ANPRM contains two linked proposals. The first, labelled "Regulation Crypto Asset Transactions," identifies categories of cryptoasset transactions that the CFTC considers to fall within the scope of the Commodity Exchange Act. The key concept is the "covered offer": any agreement through which a retail customer transacts in cryptoassets on a leveraged, margined, or financed basis. Entities offering such products would be required to monitor those transactions for indicators of market abuse.

The second proposal, "Regulation Crypto Asset Markets," would require exchanges and other market participants offering covered products to register with the CFTC as designated Crypto Asset Markets (CAMs). The proposal describes how corporate structure and service integration would affect a firm's designation, sets out draft listing standards for covered cryptoasset transactions, and invites public comment on a range of additional factors affecting CAM oversight.

Why This Matters for Firms: Filling a Long-Standing Gap

To date, cryptoasset exchanges offering futures or other products within the CFTC's existing perimeter have been able to register with the Commission, but there has been no framework purpose-built for the wider set of crypto market activities. That gap has created persistent uncertainty, particularly where CFTC and SEC jurisdictions potentially overlap. The ANPRM would, if finalised through formal rulemaking, close that gap for the first time.

The timing is deliberate. Congress has not yet passed market structure legislation that would resolve the CFTC/SEC tension through statute. With roughly two years remaining in the current administration, both regulators appear to be advancing rulemaking on their own initiative rather than waiting for legislative clarity. Accounting firms and CFOs advising clients in the US crypto market need to track this process closely. Registration as a CAM, if it becomes mandatory, carries record-keeping, reporting, and surveillance obligations that will directly affect how client transactions are captured and classified in digital asset accounting software.

For background on the broader CFTC rulemaking trajectory and political timeline, see our earlier analysis of the CFTC crypto framework and the 2028 deadline risk. The interaction between this ANPRM and the FinCEN CVC mixing rule withdrawal is also relevant context; details are in our piece on the FinCEN CVC mixing rule withdrawal and the CFTC retail framework review.

Accounting and Compliance Implications Across Jurisdictions

These developments do not land in isolation. They affect how firms structure their AI-assisted workflows, how they document those workflows for audit purposes, and what regulatory registrations their clients may need to plan for.

AI Tools in Crypto Accounting and Compliance: Governance Gaps to Close Now

Many accounting firms and compliance teams already use AI-assisted tools for transaction categorisation, on-chain monitoring, and report generation. The MAS guidelines, and the directional language from the Bank of England and ECB, suggest that regulators will increasingly expect firms to demonstrate that those tools meet defined governance standards, not just produce accurate outputs.

Practically, that means several things. Responsibility for AI-generated outputs must be allocated to a named individual or function, not left as a shared assumption. Data quality controls feeding the AI system must be documented and periodically reviewed. The system must be monitored on an ongoing basis, not just validated at the point of deployment. Where the AI tool is supplied by a third party, firms need contractual and operational mechanisms to assess and manage the risks that vendor introduces.

For firms using crypto accounting software or digital asset accounting software with embedded AI features, this is a prompt to review vendor documentation now. Can your vendor demonstrate that their model meets the kind of governance standards the MAS has formalised? Do your own internal procedures assign clear ownership for AI-assisted outputs before they reach a client deliverable or a regulatory filing? These are the questions auditors and regulators will begin to ask with greater frequency.

CFTC ANPRM: Record-Keeping and Reporting Obligations on the Horizon

If the CFTC's proposals move toward final rules, exchanges and other entities offering leveraged or margined crypto products to retail customers in the US will face new registration, surveillance, and reporting obligations. For accounting firms with US-based crypto exchange clients, the operational change is material. CAM registration would likely require systematic transaction monitoring, structured record-keeping aligned with CFTC reporting standards, and potentially new internal control frameworks that the audit team will need to understand and test.

CFOs at crypto businesses should be mapping their product offerings against the "covered offer" definition now. Even at ANPRM stage, the proposed framework signals where the CFTC's compliance perimeter is heading. Firms that build their operational and accounting infrastructure around that perimeter early will face less disruption when final rules arrive.

Cross-Border Dimension: Where These Frameworks Interact

A firm with entities in Singapore, the UK, and the US faces a three-layer landscape. MAS AI governance rules apply from October 2027. Bank of England expectations, while not yet formalised as binding rules, are clearly heading toward similar requirements, and the existing UK AI testing regime is already active. In the US, the CFTC's ANPRM is open for public comment, and the direction of travel is toward formal registration requirements for crypto commodity market participants.

For international groups, the practical advice is to build AI governance and crypto market compliance programmes to the most demanding standard across the jurisdictions in which they operate, then assess where local requirements diverge. The MAS framework, being the most detailed and time-bound, is a reasonable starting template for that exercise.

Frequently Asked Questions

What does the MAS AI governance framework require, and when does it apply?

The Monetary Authority of Singapore's finalised guidelines require regulated financial institutions to maintain clear accountability for AI risks, manage those risks across the full AI lifecycle, assess third-party AI risks, and implement proportionate controls. The framework takes effect from October 2027, with certain provisions delayed to October 2028. Firms with MAS-regulated entities should begin gap assessments now.

Does the Bank of England's AI guidance create binding obligations for UK crypto firms?

Governor Bailey's article was a policy statement, not a binding rule. However, it signals the direction of the Prudential Regulation Authority and Financial Conduct Authority's supervisory expectations. UK firms should treat the principles Bailey outlined, human oversight, rigorous testing, defined accountability, as the basis for their own AI governance frameworks, ahead of any formal rulemaking.

What is a "covered offer" under the CFTC's proposed Regulation Crypto Asset Transactions?

Under the ANPRM, a covered offer is any agreement through which a retail customer can transact in cryptoassets on a leveraged, margined, or financed basis. Entities making covered offers would be required to monitor those transactions for market abuse indicators and, under the companion proposal, register with the CFTC as designated Crypto Asset Markets.

How does the CFTC ANPRM affect firms that use crypto accounting software to manage client reporting?

If the proposals become final rules, exchanges and market participants subject to CAM registration will face structured record-keeping and reporting obligations aligned with CFTC standards. Accounting firms serving those clients will need to ensure that their digital asset accounting software can capture and classify transactions in a format compatible with the new reporting requirements. Assessing that compatibility now, before final rules are published, reduces implementation risk.

Are EU crypto firms affected by these AI governance developments?

The EU's AI Act already establishes a risk-based framework for AI systems, including those used in financial services. The ECB supervisory board's October 2026 remarks suggest that prudential supervisors are developing expectations that go beyond the AI Act's minimum requirements, particularly around lifecycle monitoring and data quality. EU crypto firms and their auditors should monitor ECB and EBA guidance on AI governance in banking for developments that may extend to crypto asset service providers.

Source: Elliptic