Insights

What changed, when it took effect, and which instrument says so.

Rule packs are versioned because rules move. These are the changes that moved ours, each with the date it applies from and a link to the primary source. Two entries are corrections to claims repeated widely across this industry.

India — DPDP substantive duties commence

Rules were notified on 13 November 2025, but notice, consent, security safeguards, breach notification, erasure, data-principal rights and the penalty regime commence on 13 May 2027, with Consent Manager registration from 13 November 2026. Maximum penalty ₹250 crore. Dated ahead: this has not happened yet.

Primary source · Read the rules →

UK — FCA PS26/16 removes the seven-day wait

The seven-day gap between the approved registration document or prospectus and connected research is gone, as is the mandatory unconnected-analyst equal-information requirement. Research still cannot precede publication of the relevant document (COBS 11A.1.4F). Any day count a desk applies now is firm policy, not law.

Primary source · Read the rules →

EU — research payment optionality begins to apply

Directive (EU) 2024/2811 begins to apply in member states, reversing rigid unbundling.

Read the rules →

UK — a new prospectus regime changes the trigger

POATR replaced the UK Prospectus Regulation and the PRM sourcebook replaced PRR. The amended COBS 11A.1 cross-refers to PRM 1.4 and PRM 9.5, so any "document published" trigger has to point at the PRM definition.

Primary source · Read the rules →

India — retention rose from five to eight financial years and localisation became explicit

SEBI (Merchant Bankers) Regulation 16 was substituted with effect from 3 January 2026 (amendment notified 5 December 2025). Records now run eight financial years instead of five, and new Reg. 16(2) requires a merchant banker to hold all data and information within India. SEBI has not yet specified the detailed localisation norms, so the plain-language duty is what binds today. For an India-first desk this is the most consequential change on this page.

Primary source · Read the rules →

India — the UPSI definition widened

A "fund raising proposed to be undertaken" is now expressly UPSI. A contemplated IPO is price-sensitive from an early stage, which is the strongest justification for SDD-grade logging on pre-deal material.

Primary source · Read the rules →

US — the 17a-4(f) audit-trail alternative

Release 34-96034 (broker-dealer compliance 3 May 2023) is what lets a platform build append-only logging instead of buying WORM media. It is also why we describe the record the way we do, and still decline to claim conformance.

Primary source · Read the rules →

Correction — the FINRA lock-up quiet period ended in 2015, not 2016

Rule 2241 replaced NASD 2711, effective 25 September and 24 December 2015. The 15-day period around lock-up expiry no longer exists. The widely repeated 2016 date is wrong.

Primary source · Read the rules →

Nothing on this page is legal advice: it records what changed and when, not what your firm must do about it. Dates are the date the change takes or took effect, not the date it was announced. Entries dated in the future have not happened yet and are written in the future tense. Last reviewed 5 October 2026.

A rule moved. Does your platform know?

A deal that went live in July 2026 and one that went live in September 2026 are judged by different UK rules. We will show you how a pinned pack handles that.

Built to host data in IndiaAppend-only, hash-chained access recordIndividually numbered copiesRule packs pinned per deal
Talk through your next dealBook a demo