M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

106

Unowned controls

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

RAGAll Red Amber Green Grey

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score
Off track	MiCA — Whitepaper Filing Regime EUESMA · 8 stale · 2d over	30 Sep 2026	-2d	14	8	—	146
Off track	APRA CPS 230 — Operational Risk Management AUAPRA · 6 stale · 8d over	1 Jul 2026	-8d	10	6	—	146
Off track	SEC Cyber Incident Disclosure Rule USSEC · 5 stale · 5d over	1 Sep 2026	-5d	7	5	—	140
At risk	DORA — ICT Third-Party Register EUESMA · 15 stale	15 Nov 2026	22d	22	15	—	85
At risk	Small Business Data Collection — Section 1071 USCFPB · 8 stale · 12d buffer	1 Oct 2026	12d	11	8	—	72
At risk	T+1 Settlement — Final Rule EUESMA · 10 stale	11 Oct 2027	40d	14	10	—	70
At risk	Consumer Duty — Annual Board Report UKFCA · 6 stale	31 Jul 2026	15d	12	6	—	63
At risk	HKMA Cyber Resilience Assessment Framework HKHKMA · 6 stale	15 Dec 2026	18d	7	6	—	60
At risk	EU AI Act — Financial Services Guidance EUEBA · 4 stale	2 Feb 2027	45d	5	4	—	52
At risk	HMT Cryptoasset Regime — Perimeter UKHMT · 4 stale	31 Jan 2027	22d	6	4	—	52
At risk	OSFI Climate Risk Guideline B-15 CAOSFI · 3 stale	31 Jan 2027	30d	4	3	—	49
At risk	ASIC DDO — Target Market Determinations AUASIC · 3 stale	30 Nov 2026	25d	4	3	—	49
At risk	MAS Technology Risk Management Guidelines Update SGMAS · 3 stale	31 Dec 2026	20d	8	3	—	49
At risk	DFSA Crypto Token Regime — Phase 2 UAEDFSA · 1 stale	1 Dec 2026	28d	5	1	—	43
On track	Operational Resilience — Impact Tolerances Refresh UKPRA · 5 stale	31 Aug 2026	30d	9	5	—	15
On track	CSRD — Sustainability Reporting EUEBA · 4 stale	31 Dec 2026	60d	8	4	—	12
On track	SFC Virtual Asset Licensing Regime HKSFC · 4 stale	28 Feb 2027	50d	5	4	—	12
On track	OCC Third-Party Risk Management Guidance USOCC · 4 stale	31 Mar 2027	80d	6	4	—	12
Not started	FSB Cross-Border Payments Roadmap GLOBALFSB · no controls	—	90d	—	—	—	10
Not started	Sustainability Disclosure — Consultation UKFCA · no controls	—	90d	—	—	—	10
On track	OSFI B-10 — Third-Party Arrangements CAOSFI · 3 stale	30 Nov 2026	55d	6	3	—	9
On track	BCBS CVA Framework — Basel Finalisation GLOBALBCBS · 2 stale	1 Jan 2027	70d	6	2	—	6
On track	MAS Enhanced Due Diligence Rules — VA SGMAS · 2 stale	31 Oct 2026	40d	5	2	—	6

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.