M4 — Path
Where to intervene first.
Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.
Off track
0
At risk
11
Controls stale
63
Unowned controls
0
| Status | Regulation | Deadline | Buffer | Controls | Stale | Unowned | Score |
|---|---|---|---|---|---|---|---|
| At risk | DORA — ICT Third-Party Register EUESMA · 15 stale | 15 Nov 2026 | 22d | 22 | 15 | — | 85 |
| At risk | Small Business Data Collection — Section 1071 USCFPB · 8 stale · 12d buffer | 1 Oct 2026 | 12d | 11 | 8 | — | 72 |
| At risk | T+1 Settlement — Final Rule EUESMA · 10 stale | 11 Oct 2027 | 40d | 14 | 10 | — | 70 |
| At risk | Consumer Duty — Annual Board Report UKFCA · 6 stale | 31 Jul 2026 | 15d | 12 | 6 | — | 63 |
| At risk | HKMA Cyber Resilience Assessment Framework HKHKMA · 6 stale | 15 Dec 2026 | 18d | 7 | 6 | — | 60 |
| At risk | EU AI Act — Financial Services Guidance EUEBA · 4 stale | 2 Feb 2027 | 45d | 5 | 4 | — | 52 |
| At risk | HMT Cryptoasset Regime — Perimeter UKHMT · 4 stale | 31 Jan 2027 | 22d | 6 | 4 | — | 52 |
| At risk | OSFI Climate Risk Guideline B-15 CAOSFI · 3 stale | 31 Jan 2027 | 30d | 4 | 3 | — | 49 |
| At risk | ASIC DDO — Target Market Determinations AUASIC · 3 stale | 30 Nov 2026 | 25d | 4 | 3 | — | 49 |
| At risk | MAS Technology Risk Management Guidelines Update SGMAS · 3 stale | 31 Dec 2026 | 20d | 8 | 3 | — | 49 |
| At risk | DFSA Crypto Token Regime — Phase 2 UAEDFSA · 1 stale | 1 Dec 2026 | 28d | 5 | 1 | — | 43 |
Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.