Free Regulatory Gap Analysis Tools

Free Regulatory Gap Analysis Tools from GRT Consulting: interactive self-assessments that help banks, brokers, custodians, CSDs, asset managers, payment firms, cryptoasset firms and service providers quickly identify readiness gaps against key EU and UK regulations.

Each diagnostic is structured around the core requirements of the relevant Level 1 and Level 2 texts (or equivalent UK sourcebooks), produces a prioritised view of gaps, and can be used as an early input to a fuller gap analysis or implementation programme.

Key upcoming regulatory deadlines ↓

Available and planned tools

Tool Status Key deadlines Regulatory texts & guidance Access
CSDR T+1 Readiness Diagnostic
Seven-dimension self-assessment covering allocations, settlement instructions, fails, technology, liquidity, ecosystem and governance.
Live 7 Dec 2026
1 Jul 2027
11 Oct 2027
Level 1
Regulation (EU) 2025/2075 (T+1 amendment)
Regulation (EU) No 909/2014 (CSDR)
COM(2025) 38 final
Level 2 / guidance
Settlement Discipline RTS (2018/1229)
ESMA Final Report – RTS Settlement Discipline
ESMA T+1 preparations statement (Jul 2026)
ESMA Report on shortening the settlement cycle
EU T+1 Industry High-level Roadmap
ESMA Guidelines Art 6(2) CSDR (allocations & messaging)
Launch diagnostic →
DORA Readiness Diagnostic
ICT risk management, incident reporting, resilience testing, third-party risk, governance and continuity.
Live Applied since
17 Jan 2025
(ongoing)
Level 1
Regulation (EU) 2022/2554 (DORA)
Level 2
RTS ICT risk management (2024/1774)
RTS incident classification (2024/1772)
RTS major incident reporting (2025/301)
ITS incident reporting templates (2025/302)
ITS Register of Information (2024/2956)
CTPP designation criteria (2024/1502)
RTS ICT third-party policy (2024/1773)
RTS threat-led penetration testing (2025/1190)
ECB TIBER-EU (TLPT methodology)
ESMA DORA hub (CTPP list & updates)
Launch diagnostic →
EMIR / EMIR 3 Clearing & Reporting Diagnostic
Clearing obligation, active account requirement, trade reporting quality and risk mitigation.
Live AAR from 25 Jun 2025
First AAR report Jul 2026
Phased 2025–2027
Level 1
Regulation (EU) No 648/2012 (EMIR)
EMIR Refit (2019/834)
EMIR 3 (2024/2987)
Level 2 / guidance
AAR RTS (2026/305) – operational conditions, representativeness and reporting
ESMA Final Report on Active Account Requirement
ESMA AAR reporting templates & instructions (CSV package for July 2026 first report)
EMIR reporting RTS (2022/1855)
EMIR reporting ITS (2022/1860)
ESMA EMIR Reporting hub (guidelines & Q&As)
ESMA CCP / AAR notification page
Launch diagnostic →
FCA Crypto Prudential (COREPRU / CRYPTOPRU) Diagnostic
Own funds (PMR, FOR, K-factors), liquidity (BLAR / ILAR), overall risk assessment, concentration risk, disclosure and governance under the UK cryptoasset regime.
Live Application window
30 Sep 2026 – 28 Feb 2027
Regime live
25 Oct 2027
Primary
PS26/12 – A Prudential Regime for Cryptoasset Firms (COREPRU & CRYPTOPRU)
CP25/42 & CP25/15
Related Policy Statements
PS26/9 (Admissions, Disclosures & MARC)
PS26/10 (Stablecoin Issuance)
PS26/11 (Regulated Cryptoasset Activities)
PS26/13 (Application of the FCA Handbook)
Guidance & supporting
FCA Cryptoassets Regime overview
FG26/5 (Consumer Duty for crypto firms)
BoE / FCA joint approach to systemic stablecoins
FCA Handbook COREPRU
FCA Handbook CRYPTOPRU
Launch diagnostic →
MiFID II / MiFIR Conduct & Transparency Diagnostic
Best execution, order handling, transparency, transaction reporting and record-keeping.
Live Transparency from Mar 2026
CT phased 2026–27
Derivatives transparency ~Mar 2027
Level 1
Directive 2014/65/EU (MiFID II)
Regulation (EU) No 600/2014 (MiFIR)
Regulation (EU) 2024/791 (MiFIR review)
Directive (EU) 2024/790 (MiFID II review amendments)
Level 2 – RTS / ITS
Org. requirements RTS (2017/565)
RTS 1 equity transparency (2017/587)
RTS 2 non-equity transparency (2017/583)
RTS 22 transaction reporting (2017/590)
Order execution policy RTS (2026/825) (repeals RTS 27/28)
RTS 2025/1246 – amends RTS 1 & 2 (bonds/equity transparency; CT input)
RTS 2025/1155 – CTP input/output, clock synchronisation (replaces RTS 25)
ITS 2025/1157 – APA / ARM / CTP authorisation forms
Operational / ESMA
ESMA MiFIR reporting hub (instructions, validations, FIRDS)
Transaction reporting XML schema 1.1.0 (ISO 20022)
ESMA MiFID II Interactive Single Rulebook (Q&As)
Commission MiFIR implementing & delegated acts
Launch diagnostic →
Travel Rule Compliance Diagnostic
EU TFR (2023/1113) for CASPs, exchanges, custodians and brokers — data, self-hosted wallets, messaging and AML alignment.
Live Applied from
30 Dec 2024
Level 1
Regulation (EU) 2023/1113 (TFR / Travel Rule)
Guidance
EBA Travel Rule Guidelines
Launch diagnostic →
MiCA Readiness Diagnostic
CASP authorisation, white papers, ART/EMT, custody, governance and AML for digital asset businesses under Regulation (EU) 2023/1114.
Live Applied 2024–2025
Ongoing supervision
Level 1
Regulation (EU) 2023/1114 (MiCA)
Level 2 – RTS / ITS
RTS CASP authorisation information (2025/305)
ITS CASP application forms (2025/306)
RTS records of services, orders and transactions (2025/1140)
RTS CASP conflicts of interest (2025/1142)
RTS market abuse detection & reporting (2025/885)
Guidance
ESMA MiCA hub
Commission MiCA implementing & delegated acts
Launch diagnostic →
VARA Dubai Licensing Diagnostic
Gap analysis for Dubai Virtual Assets Regulatory Authority licensing — activities, substance, capital, rulebooks and AML.
Live Ongoing
(Dubai mainland)
VARA official site
VARA Rulebook (official)
Company Rulebook (capital, substance, governance)
Compliance and Risk Management Rulebook
Market Conduct Rulebook
• Dubai Law No. 4 of 2022 (virtual assets in Dubai)
Launch diagnostic →
FCA Consumer Duty Diagnostic
PRIN 2A four outcomes, board report, outcomes monitoring and CP26/23 scope & proportionality.
Live In force 31 Jul 2023
Closed products 31 Jul 2024
CP26/23 closes 18 Sep 2026
Primary
PS22/9 – A new Consumer Duty
FCA Handbook PRIN 2A (the Duty itself)
FCA Consumer Duty hub
Guidance
FG22/5 Final non-Handbook Guidance
Outcomes monitoring: good practice
Live consultation
CP26/23 – scope and proportionality (closes 18 Sep 2026; PS expected Q1 2027)
Launch diagnostic →
Failure to Prevent Fraud Diagnostic
ECCTA 2023 s.199 for large organisations — six Home Office principles, associated persons and the reasonable-procedures defence.
Live Applied since
1 Sep 2025
(ongoing)
Primary
ECCTA 2023 s.199
In-force announcement (1 Sep 2025)
Guidance
Home Office statutory guidance
Accessible HTML guidance
Launch diagnostic →
PSR APP Scams Reimbursement Diagnostic
SD20 (FPS) and SD21 (CHAPS) — 5 business days, £85k cap, sending/receiving share and consumer standard of caution.
Live Applied since
7 Oct 2024
(ongoing)
Legal instruments
Specific Direction 20 (FPS)
Specific Direction 21 (CHAPS)
Policy
PS25/5 – APP scams reimbursement requirement (21 May 2025)
Operational / reporting
PSR APP scams hub
Deadlines for firms (RCMS / reporting)
Compliance Data Reporting Standards (CDRS)
Launch diagnostic →

Additional diagnostics will be added as the regulatory calendar evolves. All tools are illustrative self-assessments and do not constitute legal or regulatory advice.

Key upcoming regulatory deadlines

The dates below are the most material near-term milestones for post-trade, operational resilience, market infrastructure and cryptoasset participants.

July 2026 (first report)
EMIR 3 – Active Account Requirement (AAR) reporting
Who is affected: FCs and NFCs subject to the clearing obligation that exceed relevant thresholds
First half-yearly AAR compliance reports due (covering activity from 25 June 2025). Operational active account at an EU CCP and representativeness obligations already apply.
18 September 2026
FCA Consumer Duty – CP26/23 consultation closes
Who is affected: FCA-regulated firms subject to the Duty, especially wholesale, distribution-chain and non-UK retail business
Comments on scope and proportionality close 18 September 2026. Policy statement expected Q1 2027. The Duty itself has been in force since 31 July 2023 (closed products 31 July 2024).
7 December 2026
CSDR – Allocations & Confirmations (Settlement Discipline RTS)
Who is affected: Investment firms, brokers, custodians, buy-side, CSDs and their clients
New requirements on timing and machine-readable exchange of allocations and confirmations (international standards). First major operational milestone on the path to T+1.
30 September 2026 – 28 February 2027
FCA Crypto Regime – Authorisation application window
Who is affected: Firms carrying on regulated cryptoasset activities (stablecoin issuance, safeguarding, QCATP, dealing, arranging, staking, etc.)
Applications for FCA authorisation under the new UK cryptoasset regime open 30 September 2026 and close 28 February 2027. Pre-application support available. Regime becomes mandatory on 25 October 2027.
1 July 2027
CSDR – Settlement fails reporting & related RTS measures
Who is affected: CSDs and participants
Updated rules on how CSDs report and publish settlement fails data and related settlement-efficiency measures.
11 October 2027
CSDR T+1 – Full settlement cycle goes live
Who is affected: Banks, brokers, custodians, CSDs, CCPs, asset managers and service providers settling transferable securities on EU venues / EU CSDs
Intended settlement date becomes no later than the first business day after the trade (T+1). Includes early settlement instructions, hold & release, auto-partial settlement and related CSD functionalities.
25 October 2027
FCA Crypto Regime – Full authorisation mandatory (COREPRU / CRYPTOPRU live)
Who is affected: All firms performing regulated cryptoasset activities in or into the UK
New prudential sourcebooks COREPRU and CRYPTOPRU apply. Own funds (PMR / FOR / K-factors), liquidity (BLAR / ILAR), overall risk assessment, concentration risk and disclosure requirements become binding. Operating without authorisation is a criminal offence.
Ongoing (applied since 17 January 2025)
DORA – Digital Operational Resilience
Who is affected: Almost all financial entities (credit institutions, investment firms, CSDs, trading venues, fund managers, crypto-asset service providers, ICT third-party providers)
Harmonised ICT risk management, major incident reporting, resilience testing and third-party risk requirements. Supervisory focus continues through 2026–2027.
Ongoing (applied since 1 September 2025)
Failure to Prevent Fraud – ECCTA 2023 s.199
Who is affected: Large organisations meeting two or more of: >250 employees, >£36m turnover, >£18m balance sheet total (including FS groups)
Corporate criminal offence if an associated person commits a specified fraud intending to benefit the organisation and reasonable prevention procedures were not in place. Home Office six-principles guidance is the defence map.
Ongoing (applied since 7 October 2024)
PSR APP scams reimbursement – SD20 / SD21
Who is affected: PSPs participating in Faster Payments or CHAPS that provide relevant UK accounts
Mandatory reimbursement of in-scope APP scam victims within five business days, £85k cap. Legal instruments remain SD20 (FPS) and SD21 (CHAPS); PS25/5 (21 May 2025) consolidates the policy.

Need a firm-specific gap assessment?
GRT Consulting delivers full readiness reviews covering process, technology, contracts, testing and ecosystem dependencies.
T: +44 20 3695 9251 · E: info@grtconsult.com
Submit a Request for Proposal →

GRT Consulting

Speak to us about how we can help you

T: +44 20 3695 9251

E: info@grtconsult.com

Submit Request for Proposal