GRC Report Staff

The European Securities and Markets Authority (ESMA) published its third consolidated sanctions report on October 15, recording more than 950 administrative sanctions and measures imposed by national authorities during the year. The combined value of administrative fines reached almost €82 million, while the number of sanctions and measures remained broadly unchanged from the preceding two years.

The California Air Resources Board (CARB) is contacting companies that may be subject to the state's corporate greenhouse gas reporting law, warning that their first emissions disclosures are due November 10, 2026, and that qualifying businesses must pay program fees even if they are unable to submit emissions data under a first-year reporting provision.

A countdown timer on Wayfair’s website told shoppers that a deal was about to disappear. The furniture retailer advertised products through “Daily Deals” and 24-hour “Flash Deals,” sometimes accompanied by the warning “Here Today, Gone Tomorrow.” Customers who wanted the advertised price were given reason to believe they had little time to decide.

New Zealand's financial regulators have told banks and other regulated institutions to examine whether their cybersecurity arrangements are keeping pace with advances in artificial intelligence, warning that the technology is creating new problems for corporate oversight and increasing dependence on outside technology providers.

South Korea's privacy regulator received 432 data breach reports in the first six months of 2026, nearly matching the 447 recorded throughout the whole of last year. The increase has prompted a substantial overhaul of how the country intends to investigate breaches, particularly those involving companies responsible for the personal information of millions of people.

In an Irish Independent interview, EBA Chair François-Louis Michaud argued that well-capitalized European banks should be less cautious about lending. He ruled out framing the debate as one of lower capital requirements and pointed instead to a more coherent, simplified, and predictable rulebook. Compliance teams should treat this as a directional signal rather than binding guidance, since it previews supervisory priorities on simplification, climate risk, ICT resilience, and the Savings and Investments Union.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about "gfo-xx (Clone)," a suspected clone of a UK FCA-authorized firm, based on a UK FCA warning. Compliance teams should treat this as a fraud and impersonation alert and update screening, client-protection, and monitoring controls accordingly.