M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

Unowned controls

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score
At risk	DORA — ICT Third-Party Register EUESMA · 22 stale	15 Nov 2026	22d	22	22	—	106
At risk	T+1 Settlement — Final Rule EUESMA · 14 stale	11 Oct 2027	40d	14	14	—	82
At risk	Small Business Data Collection — Section 1071 USCFPB · 11 stale · 12d buffer	1 Oct 2026	12d	11	11	—	81
At risk	Consumer Duty — Annual Board Report UKFCA · 12 stale	31 Jul 2026	15d	12	12	—	81
At risk	MAS Technology Risk Management Guidelines Update SGMAS · 8 stale	31 Dec 2026	20d	8	8	—	64
At risk	HKMA Cyber Resilience Assessment Framework HKHKMA · 7 stale	15 Dec 2026	18d	7	7	—	63
At risk	HMT Cryptoasset Regime — Perimeter UKHMT · 6 stale	31 Jan 2027	22d	6	6	—	58
At risk	EU AI Act — Financial Services Guidance EUEBA · 5 stale	2 Feb 2027	45d	5	5	—	55
At risk	DFSA Crypto Token Regime — Phase 2 UAEDFSA · 5 stale	1 Dec 2026	28d	5	5	—	55
At risk	OSFI Climate Risk Guideline B-15 CAOSFI · 4 stale	31 Jan 2027	30d	4	4	—	52
At risk	ASIC DDO — Target Market Determinations AUASIC · 4 stale	30 Nov 2026	25d	4	4	—	52

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.