Balancing the Regulatory Stack Contents 08Driving Capital Formation & Growth4109Expanding Digital Assets4810Enhancing Parties & Workforce54KPMG Regulatory Insights60Regulatory Analytics61List of Acronyms62List of Executive Orders64 Introduction301Executing Mandates402Adopting Disruptive Tech & AI903Maintaining Cyber & Data Security1404Mitigating Financial Crimes2005Averting Fraud & Scams2506Protecting Fairness3007Ensuring Resiliency36 Introduction On behalf of KPMG Regulatory Insights, I am excited toissue our Ten Key Regulatory Challenges for 2026. In the following pages we project “what to watch” acrossten key challenges based on regulatory signals observedin 2025. For all organizations, the overarching challenge As we enter 2026, the regulatory landscape is beingshaped by rapid technological innovation and evolvingsupervisory priorities. Recalibration of the many layers ofpolicy, guidance and oversight that direct regulatory risk Organizations face a complex “regulatory stack” —requiring balance between innovation and control, speed 01ExecutingMandates Aligning with the Administration’s priorities to reduce complexity, encourage innovation, and promotegrowth, regulators have narrowed supervision and enforcement to core statutory authorities; RegulatorySignals •Core Mission “As the U.S. regulatory landscape evolves, regulators appear to be returning to fundamentals—core missions, statutory mandates—even as they embrace implementation of the digital financialtechnologies, like digital assets and AI applications, that are reshaping the financial system. This •“Self-Regulation” •Regulatory Divergence Laura ByerlyManaging DirectorRegulatory Insights 01ExecutingMandates Signal Examples Federal agencies have focused resources onsupervising and enforcing regulations basedon their statutory authorizations, and in amanner consistent with the Administration’s •Reviewing regulations for consistency with the law (e.g., EO14219, Presidential Memo directing repeal of regulations)•Publicly stating a return to “core mission” (e.g., agency statementsSEC (Atkins, Pierce), EPA (Zeldin); FTC Draft Strategic Plan)•Cross-agency identification of regulations that may hindercompetition, entrepreneurship, and innovation (e.g., FTC/DOJ jointletter, anti-competitive task forces; FTC RFI) RegulatorySignals •Core Mission What to Watch •A “back-to-basics” approach to supervision and enforcement•Ongoing tailoring of regulations based on size, scale, and risk profile•Increasing use of guidance (e.g., FAQs) and frameworks 01ExecutingMandates Signal Through the withdrawal/recission of regulations,narrowed enforcement priorities, and increased relianceon guidance, regulators are exercising a “lighter touch” •Promotion of self-reporting, cooperation, and remediation(e.g., DOJ Criminal Division policies (white collar crime,crediting penalties); CFTC Enforcement Advisory)•Focusing banking supervision on material risks (e.g., RegulatorySignals •“Self-Regulation” What to Watch •In the absence of regulation by enforcement, market-driven pressures will likely challenge companies to maintain theircompliance and risk programs – “compliance is good for business” 01ExecutingMandates Signal Examples The regulatory landscape continues to grow incomplexity as federal and state laws and regulationsdiverge due to differences in supervisory andenforcement priorities. In many instances, state activity(e.g., legislative, regulatory, enforcement) has increased •Recission of federal rules related to climate, DEI, fossilfuels (e.g., EO 14151, EO 14154, EPA rule withdrawals,SEC withdrawal of climate disclosure rule defense)•State laws governing climate/sustainability (e.g., CACorporate Climate Accountability Disclosure Act) andfederal opposition (e.g., EO 14260)•Identification and potential withdrawal/recission of federal RegulatorySignals •Regulatory Divergence What to Watch •Continuation and expansion of divergences between federal, state and global regulations and frameworks in certain areasincluding AI, digital assets, data privacy, and sustainability•Rapid growth in regulatory changes across jurisdictions, including new wide-ranging “comprehensive” state AI laws 01ExecutingMandates RelevantThoughtLeadership RegulatorySignals First 100 Days:Regulatory Signals Risk, Regulatoryand Compliance TopRelatedRegulatoryChallenges 09 Expanding Digital Assets10 Enhancing Parties & Workforce 02 Adopting Disruptive Tech & AI03 Maintaining Cyber & Data Security 02AdoptingDisruptiveTech&AI Federal and state regulatory adaptation of existing risk frameworks and policies respond tocomplexities in evolving AI innovation, with increasing private sector participation. RegulatorySignals •Model Risk Management “As regulations across the US continue to evolve andtake shape in 2026, we expect a key focus area fororganizations will be ensuring they have mechanismsin place to classify and validate that AI systems andguardrails are