Every fintech compliance deadline between now and 2028, on one page

The trade press covers each of these separately, as it should, because each one is a story on the day it moves. Nobody has put them on a single timeline, which is what you need if the question is not "what happened this week" but "what is coming, and which of it is actually mine".

So: every dated obligation we could verify, landing on a European payment institution, e-money institution, crypto-asset service provider or their bank between today and the end of 2028. Every date below was read from the instrument that sets it — or, where a date is derived from an offset or set by a UK regulator rather than by an instrument, from that regulator's own published statement, and we say which. Where a date does not exist, we say so instead of estimating one.

Four dates most calendars get wrong

Start here, because these are the ones most likely to be sitting in your planning documents in the wrong form.

The AI Act's high-risk obligations are no longer 2 August 2026. The delay is adopted law, not a proposal. A regulation of 8 July 2026, in force since 27 July 2026, moved the high-risk obligations for systems listed in Annex III to 2 December 2027, and those for systems embedded in regulated products under Annex I to 2 August 2028. For a financial firm, Annex III is the one that matters, because it captures systems used to evaluate creditworthiness or establish a credit score — with an express exception for systems used to detect financial fraud. The application dates for prohibited practices, AI literacy and general-purpose models were not postponed and have applied since 2025. Their substance did change: the same regulation added two new prohibited practices, applying from 2 December 2026, and rewrote the AI literacy duty from ensuring literacy to taking measures that support its development.

Hybrid addresses have no end date. The widely repeated line that hybrid is a temporary bridge is wrong. The EPC's guidance says the hybrid format has no expiration date, and its operative table records "no end date set for the time being" — so it is not a scheduled sunset, though nor is it guaranteed permanent. What was scheduled to end in November 2026 is the fully unstructured format only.

The payment services package has no application date. PSD3 and the Payment Services Regulation reached provisional political agreement on 27 November 2025 and were approved in committee on 5 May 2026, but neither has been adopted or published in the Official Journal. Every date in the agreed text is an offset from an entry into force that has not happened. The commonly quoted 24-month re-authorisation window is also not what the agreed text says: it uses a pair, 21 months to transposition and re-authorisation assessment complete by 27 months, with a possible three-month extension by the competent authority.

AMLA does not start direct supervision on 1 January 2028. That date is not in the regulation. What the regulation sets is a chain: the first selection process must commence by 1 July 2027, conclude within six months, and direct supervision begins six months after the list is published. Only 1 July 2027 is a hard date, and it is a backstop rather than a target — every step in the chain is a maximum, so the whole sequence can run earlier.

What is left in 2026

• 11 September 2026 — the Cyber Resilience Act's reporting duty starts. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and to ENISA. If you ship an app, an SDK, a terminal or embedded firmware into the EU, this is yours before the rest of the Act is.
• 30 September 2026 — the FCA expects its cryptoasset authorisation gateway to open in the UK, with applications expected to close 28 February 2027.
• 15 November 2026 — the EPC's end date for fully unstructured addresses, across all four SEPA scheme rulebooks — credit transfer, instant credit transfer, direct debit core and direct debit business to business — and the instant one-leg-out credit transfer scheme. For the two instant schemes the cut-over is 03h30 CET. Contested: see the section below.
• 28 November 2026 — the Eurosystem deploys its November releases for T2, T2S, TIPS and ECMS, moved from 14 November. A temporary measure will allow fully unstructured postal addresses in T2 RTGS messages to continue for a limited period, with no published end date. User testing is scheduled to start 9 October 2026.
• 2 December 2026 — two AI Act items. The two new prohibited practices inserted by the July 2026 amendment start to apply, and providers of systems generating synthetic audio, image, video or text placed on the market before 2 August 2026 must comply with the transparency obligation.
• 24 December 2026 — each member state must make at least one European Digital Identity Wallet available. This binds member states, not you. It matters because it started the clock you are on. Derived: the regulation sets 24 months from the entry into force of two implementing acts, which was 24 December 2024.
• 31 December 2026 — transposition deadline for the first stage of the VAT in the Digital Age directive. Binds member states; the measures apply to firms from 1 January 2027.

What changes in 2027

• 1 January 2027 — the first VAT in the Digital Age measures apply. Separately, the EU market risk own funds requirements apply to banks, and the UK's Basel 3.1 rules take effect.
• 9 January 2027 — payment service providers in non-euro member states must offer receipt of instant euro credit transfers, and must charge no more for an instant euro credit transfer than for a standard one.
• 12 January 2027 — providers of data processing services may no longer impose switching charges under the Data Act. Relevant to every cloud and platform contract underneath a payments stack.
• 28 February 2027 — the FCA cryptoasset application window is expected to close.
• 9 April 2027 — e-money institutions and payment institutions in the euro area must offer both sending and receiving of instant euro credit transfers. The same date is the receiving deadline for e-money and payment institutions outside the euro area.
• 1 July 2027 — AMLA must commence the first selection of directly supervised entities. It is resourced to supervise up to forty groups and entities, and the first selection is capped at that number.
• 9 July 2027 — three things land together for non-euro-area firms: sending of instant euro credit transfers for payment service providers generally, sending for e-money and payment institutions, and verification of payee.
• 10 July 2027 — the Anti-Money Laundering Regulation applies to obliged entities other than professional football clubs and football agents, who get until 2029. The sixth Anti-Money Laundering Directive's general transposition deadline falls the same day.
• 12 September 2027 — the Data Act's chapter on unfair contractual terms between enterprises reaches legacy contracts concluded on or before 12 September 2025 that are of indefinite duration or run at least ten years from 11 January 2024. This is the unfair terms chapter, not the switching chapter.
• 30 September 2027 — the first exchange between tax authorities of crypto-asset data collected under DAC8 for calendar year 2026. Derived: the directive sets nine months from the end of the calendar year.
• 11 October 2027 — T+1 settlement in the EU by regulation and, on the same day, in the UK, where the statutory instrument was still in draft when this was written.
• 25 October 2027 — the UK cryptoasset and stablecoin regime goes live.
• 2 December 2027 — AI Act high-risk obligations reach Annex III systems, including credit scoring.
• 11 December 2027 — the Cyber Resilience Act applies in full.
• 24 December 2027 — private relying parties in banking and financial services that are required, by law or by contract, to use strong user authentication for online identification, other than micro and small enterprises, must accept the European Digital Identity Wallet where a user asks to use it. Note that this is strong user authentication for online identification, a broader concept than the strong customer authentication defined in the payment services directive. Derived from a 36-month offset from the same December 2024 base. This is the item most often missing from a payments compliance calendar.
• 31 December 2027 — operators of trading platforms must ensure a crypto-asset white paper is drawn up, notified, published and kept updated, in the cases the regulation requires, for crypto-assets other than asset-referenced tokens and e-money tokens that were admitted to trading before 30 December 2024.

What changes in 2028

• 1 January 2028 — the UK transitional allowing existing market risk models ends. Separately, the DAC8 derogation measures on tax identification numbers apply.
• 9 June 2028 — the derogation ends that lets payment service providers outside the euro area decline to send instant euro credit transfers from accounts denominated in national currency. It is narrower than it looks: it applies only while those providers neither send nor receive non-instant euro credit transfers on those accounts. This is the last instant payments date that binds a payment service provider.
• 1 July 2028 — the second stage of VAT in the Digital Age applies, including single VAT registration and the extended one-stop shop. One measure carries a member state option to defer as late as 1 January 2030.
• 2 August 2028 — AI Act high-risk obligations reach systems embedded in regulated products under Annex I.
• Mid-2028, no fixed date — the latest AMLA direct supervision can begin if every step of the selection chain runs to its deadline. It could be earlier. The regulation sets no start date.

Why is the structured address date contested?

Because four organisations that were moving together are no longer moving together, and only one of them has held its date.

Swift accepted a community request on 27 August 2026 to defer the structured address migration in its 2026 standards release, and has not published a replacement date; it committed to an update by December at the latest. The Bank of England deferred its November 2026 RTGS standards release in its entirety on the same day, with a current expectation of folding the changes into the November 2027 release — an expectation the Bank itself says remains subject to confirmation. The Eurosystem decided on 4 September 2026 to proceed with its November releases, deployment moved to 28 November, but with a temporary measure permitting fully unstructured postal addresses in T2 RTGS messages for a limited period.

The EPC, as at 8 September 2026, had not moved. Its published position was that the timelines remain unchanged and 15 November 2026 stands, with its Payment Scheme Management Board due to determine the question on 9 September 2026. No outcome had been published at the time of writing.

What that means practically: if you originate SEPA credit transfers or direct debits, the November 2026 date may still be yours even though the correspondent banking equivalent has moved. And the fix is the same either way, because structured and hybrid addresses are both already permitted and hybrid has no end date set.

What has no date at all

• PSD3 and the Payment Services Regulation. Agreed, not adopted. The agreed text repeals the E-Money Directive and treats existing e-money institutions as authorised payment institutions, narrows the limited network exclusion to a single limited network, and extends payee-matching duties beyond the euro credit transfer perimeter. None of it is law.
• The Financial Data Access Regulation. Council agreed its negotiating mandate on 4 December 2024. Trilogues opened and stalled after the second meeting in June 2025; the Commission circulated a non-paper on options for finalising negotiations on 6 April 2026. Parliament has still not adopted a first-reading position. It has not been withdrawn, and it has no application date.
• The FCA's end-state safeguarding regime for payment and e-money firms. The interim regime has been in force since 7 May 2026. The end-state rules depend on the repeal of the payment services and e-money regulations and carry no published timeline.
• The digital euro. Proposal only.
• The Digital Omnibus on data and privacy. Tabled 19 November 2025, still in committee in Parliament and without an agreed Council position. It has changed nothing. Note that this is a different instrument from the AI omnibus, which was adopted — conflating the two is how the AI Act delay ends up recorded as a proposal.

What we could not verify

Stated plainly, because a reference page that hides its gaps is worth less than one that shows them.

• The outcome of the EPC board meeting of 9 September 2026, and Swift's replacement date, neither of which existed when this was written.
• The end date of the Eurosystem's temporary measure permitting unstructured addresses in T2. None is published.
• Whether the UK statutory instrument for T+1 has been made. The date is confirmed by the FCA; a search of the statute book found no made instrument.
• The annual submission window for the DORA register of information for 2027. It is set by supervisors each year rather than by the regulation, and had not been announced.
• The DAC8 filing date for crypto-asset service providers. There is no EU-wide date — the first report covers calendar year 2026 and is filed during 2027, but the day is set in national law. Anyone publishing a single European date for this has invented it.

One reading worth passing on

The instant payments regulation gives e-money and payment institutions until 9 April 2027 for the instant credit transfer obligation. That concession sits in the article on instant transfers and not in the article on verification of payee, which contains no equivalent derogation. On the literal text, a euro-area e-money institution offering euro credit transfers has been bound by verification of payee since 9 October 2025, whatever its instant payments timetable.

The Commission's published questions and answers on implementation confirm it. They record that the articles setting the charges, verification of payee and sanctions screening deadlines "do not distinguish between bank and non-bank PSPs", and that the obligation to provide a verification of payee service "applies also to non-bank PSPs such as PIs and EMIs when the payer is their customer". The document carries the Commission's usual disclaimer that it does not express a formal legal position, and its framing is slightly narrower than the article itself — it addresses non-bank providers that already offer instant euro credit transfers. But the direction is not ambiguous, and a number of firms appear to have read the April 2027 date as covering both obligations.

If we have a date wrong, or you hold one we have missed, tell us and we will correct the page and say what changed.