What the date actually means
Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025, consolidating the regulation of banks, insurers, payment providers and technology enablers under one framework. Article 184 granted in-scope entities a one-year transitional period, which ended on 16 September 2026, to regularise their status: licensing, governance and compliance arrangements aligned with the new law. The Central Bank could extend it for individual entities at its discretion; nothing obliged it to.
For resilience and continuity, the question is the same as under the Rulebook's Article 7: can you demonstrate, with dated evidence, that critical functions survive a severe disruption within stated recovery objectives? What changed is the cost of a weak answer.
The calendar below was the transitional-year plan. It stays here because its order still holds: an institution that has not finished starts from the first window it has not closed and keeps the sequence, with the test before the evidence pack.
The transitional-year calendar, window by window
| Window | What had to be finished | Why then |
|---|---|---|
| Q4 2025 + Q1 2026 | Gap assessment against Article 7 and the new law's scope; BIA refresh; remediation plan approved by the board | Consultant and internal calendars were still open in that window, and findings need months to fix |
| Q2 2026 | Plans rewritten and short; technology recovery arrangements verified; first full test executed with timings | A first test failed in Q2 was a finding to close; failed later, it became a risk carried into the examination |
| Jul-Aug 2026 | Second test if the first produced material findings; evidence pack assembled: policy, BIA, BCP, test reports, board minutes | The August 2026 queue was real — external reviewers and internal sign-offs jam before regulatory dates |
| 1-16 Sep 2026 | Buffer. Nothing new starts here | Late fixes fail interviews; a quiet fortnight signals control |
The rule of thumb from every regulatory deadline we have worked through holds after it as well: institutions that finished testing early answer examiners' questions calmly; those still testing write explanations. If you are in the second group, test first and document as you go.
Three mistakes that slow down regularisation
- Treating it as a legal-only project. Licensing paperwork regularises status; it does not create a tested continuity capability. Examiners interview operations, not lawyers.
- Scheduling the test last. The test is where gaps surface. Put it in the middle of the plan, leave time to fix what it finds and test again.
- Building the evidence pack last. Dated evidence cannot be backfilled. A test report written the week before an examination reads exactly like what it is.
Frequently asked questions
Was the deadline extended?
Article 184 allowed the Central Bank to extend at its discretion for individual entities. Without an individual extension, an entity that has not regularised is now late and should expect closer attention.
We are a payment company newly in scope. Where do we start?
With a scope-and-gap exercise: which licensing category you fall under, which Rulebook requirements attach, and where your continuity arrangements stand against Article 7 logic. That is 2-3 weeks of work and it sets the order of everything that follows.
Is one annual test enough?
One test is the regulatory minimum. If your first test produces material findings — most first tests do — plan a second one to show the loop closed.