Outlook: From Frameworks to Feedback Loops The Rise of Programmable Compliance

Frameworks proved firms had a plan. Regulators now want proof the plan works.

Across banking, payments and digital assets, operational resilience is shifting from a documentation exercise to a live, evidenced capability - and supervisors are recalibrating accordingly. The FCA is auditing proof of scenario testing. DORA has given EU regulators an unprecedented view into ICT dependencies. The US and Brazil are building resilience requirements directly into crypto licensing. The common thread: frameworks are no longer enough on their own — firms must show they hold up under real, continuous pressure.

This Outlook report unpacks what that shift means across critical sub-verticals:

• Banks - why legacy core infrastructure is becoming a supervisory liability, and what "evidence over policy" means for resilience programmes in H2 2026
• PSPs/EMIs - how outsourcing-heavy models are colliding with regulators' insistence that accountability can't be delegated, even several layers into the supply chain
• CASPs and stablecoin issuers - how crypto-native firms, still new to formal oversight, may be better placed than legacy players to build continuous assurance in from day one