Firms that miss the deadline could breach financial services law from Oct. 1 and face civil or criminal penalties.