M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

174

Unowned controls

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

RAGAll Red Amber Green Grey

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score
Off track	MiCA — Whitepaper Filing Regime EUESMA · 14 stale · 2d over	30 Sep 2026	-2d	14	14	—	164
Off track	APRA CPS 230 — Operational Risk Management AUAPRA · 10 stale · 8d over	1 Jul 2026	-8d	10	10	—	158
Off track	SEC Cyber Incident Disclosure Rule USSEC · 7 stale · 5d over	1 Sep 2026	-5d	7	7	—	146
At risk	DORA — ICT Third-Party Register EUESMA · 22 stale	15 Nov 2026	22d	22	22	—	106
At risk	T+1 Settlement — Final Rule EUESMA · 14 stale	11 Oct 2027	40d	14	14	—	82
At risk	Small Business Data Collection — Section 1071 USCFPB · 11 stale · 12d buffer	1 Oct 2026	12d	11	11	—	81
At risk	Consumer Duty — Annual Board Report UKFCA · 12 stale	31 Jul 2026	15d	12	12	—	81
At risk	MAS Technology Risk Management Guidelines Update SGMAS · 8 stale	31 Dec 2026	20d	8	8	—	64
At risk	HKMA Cyber Resilience Assessment Framework HKHKMA · 7 stale	15 Dec 2026	18d	7	7	—	63
At risk	HMT Cryptoasset Regime — Perimeter UKHMT · 6 stale	31 Jan 2027	22d	6	6	—	58
At risk	EU AI Act — Financial Services Guidance EUEBA · 5 stale	2 Feb 2027	45d	5	5	—	55
At risk	DFSA Crypto Token Regime — Phase 2 UAEDFSA · 5 stale	1 Dec 2026	28d	5	5	—	55
At risk	OSFI Climate Risk Guideline B-15 CAOSFI · 4 stale	31 Jan 2027	30d	4	4	—	52
At risk	ASIC DDO — Target Market Determinations AUASIC · 4 stale	30 Nov 2026	25d	4	4	—	52
On track	Operational Resilience — Impact Tolerances Refresh UKPRA · 9 stale	31 Aug 2026	30d	9	9	—	27
On track	CSRD — Sustainability Reporting EUEBA · 8 stale	31 Dec 2026	60d	8	8	—	24
On track	OSFI B-10 — Third-Party Arrangements CAOSFI · 6 stale	30 Nov 2026	55d	6	6	—	18
On track	BCBS CVA Framework — Basel Finalisation GLOBALBCBS · 6 stale	1 Jan 2027	70d	6	6	—	18
On track	OCC Third-Party Risk Management Guidance USOCC · 6 stale	31 Mar 2027	80d	6	6	—	18
On track	SFC Virtual Asset Licensing Regime HKSFC · 5 stale	28 Feb 2027	50d	5	5	—	15
On track	MAS Enhanced Due Diligence Rules — VA SGMAS · 5 stale	31 Oct 2026	40d	5	5	—	15
Not started	FSB Cross-Border Payments Roadmap GLOBALFSB · no controls	—	90d	—	—	—	10
Not started	Sustainability Disclosure — Consultation UKFCA · no controls	—	90d	—	—	—	10

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.