GRC Report Staff

BaFin has amended the Securities Institutions Audit Report Regulation and the Crowdfunding Service Providers Audit Regulation, effective September 11, 2026, to align audit requirements with DORA (Regulation (EU) 2022/2554). Auditors must now apply these more detailed requirements during annual audits, so compliance teams at affected firms should confirm their ICT risk documentation and evidence are audit-ready.

The FCA has issued a Call for Input, open until October 23, 2026, on whether tokenizing physical gold could improve trading, collateral mobilization, and settlement in UK wholesale markets. It also asks whether uncertainty over the collective investment scheme (CIS) and alternative investment fund (AIF) perimeter is holding back product development. Compliance teams should treat this as an early signal of policy direction and consider responding, because outcomes could include guidance, an "eligible gold token" classification, targeted exemptions, or a bespoke regime.

An ECB working paper (No 3280) finds that Federal Reserve policy changes pass through only weakly and unstably to stablecoin deposit rates in DeFi lending protocols, with short-run moves often in the opposite direction. It is research and not binding regulation, and the authors' views do not represent the ECB's. Even so, it signals supervisory attention to stablecoin and DeFi linkages with traditional finance, which matters for institutions with crypto exposure, tokenized-asset plans, or stablecoin-related partnerships.

The European Banking Authority issued its quarterly update to the validation rules in its reporting frameworks, deactivating some rules due to inaccuracies or IT issues and reactivating others. It also released a validation rules package (a micro taxonomy and DPM update scripts) required from release 4.0 onward. Compliance and regulatory reporting teams should confirm that their validation logic matches the updated rule set to avoid false errors and resubmissions.

The Austrian Financial Market Authority (FMA) announced that the banking licence of Raiffeisenbank Ehrwald-Lermoos-Biberwier eGen has lapsed following its merger into Raiffeisenbank Tirol Mitte West eGen, entered in the Commercial Register (Firmenbuch) on September 12, 2026. Compliance teams with counterparty, correspondent, or customer exposure to the transferring bank should confirm that records, contracts, and controls reflect the successor entity.

BaFin issued Circular 10/2026 (BA) on September 14, 2026, concerning the appointment of administrators of the refinancing register under Sections 22e et seq. of the German Banking Act (KWG). Only the title and metadata were available for this analysis, so the substantive requirements could not be confirmed. Compliance teams at institutions that use or plan to use refinancing registers should review the full circular promptly.

De Nederlandsche Bank published an analysis showing that interest rate changes have a weaker effect on growth and inflation when financial or geopolitical uncertainty is high. The release is research, not a rule, and it introduces no new obligations. It still matters for compliance and risk teams because it affects assumptions in stress testing, scenario analysis, and interest rate risk planning.