GRC Report Staff

FinCEN issued Alert FIN-2026-Alert005 on September 3, 2026, urging financial institutions to detect and report suspicious activity tied to Southeast Asian scam centers and the laundering of their proceeds. The Alert supplements FinCEN's September 2023 "pig butchering" Alert, adds a specific SAR key term, and highlights the role of guarantee marketplaces, Chinese money laundering networks, and Huione Group. Compliance teams should update monitoring, typologies, and SAR procedures now.

FinCEN issued an alert and financial trend analysis on digital asset investment scams ("pig butchering") run by Southeast Asia-based scam centers. The analysis covers 33,904 BSA reports filed between September 8, 2023, and December 31, 2025, totaling approximately USD $12.7 Billion in suspected activity. Compliance teams should update detection scenarios with the newly published red flags and strengthen SAR reporting and information sharing.

FINTRAC imposed an administrative monetary penalty of CAD $231,826 on the Nova Scotia Gaming Corporation, a casino reporting entity, for failing to file suspicious transaction reports, maintain current compliance policies, and document its risk assessment. The penalty was assessed on July 23, 2026, announced on September 3, 2026, and has been paid in full. It adds to a record enforcement year and signals that foundational program elements remain priority examination targets.

FINRA has filed a proposed rule change (SR-FINRA-2026-018) that would extend the maximum Rule 2165 temporary hold from 55 to 145 business days. It would also create new Rule 2166, a safe harbor allowing delays of up to 10 business days on suspected fraud for customers of any age, and would make Rule 4512 trusted contact flexibility changes. Compliance teams should begin assessing procedure, training, and system impacts now, because the SEC is soliciting comments and the final text and effective date are not yet set.

The Danish Financial Supervisory Authority (DFSA) issued a public warning on September 3, 2026 against Corpholding Inc., which is suspected of running a boiler room operation and soliciting Danish consumers without authorization. Compliance teams should treat this as a fraud typology and sanctions-adjacent intelligence item, and update monitoring, screening, and customer-protection controls accordingly.

The Netherlands Data Protection Authority (Autoriteit Persoonsgegevens) has published a downloadable GDPR processing register template, plus a companion privacy notice template, for small and medium-sized enterprises in 10 industries. The templates are practical guidance rather than new law, but they signal the regulator's expectations for Article 30 recordkeeping. Compliance teams should use them as a benchmark for their own programs and for assessing SME vendors and partners.

FINRA has filed a proposed amendment to Rule 4522(b)(1) that would except uncertificated investments in unregistered investment funds from the monthly position statement and reconciliation requirement, replacing it with a quarterly cadence. The change codifies and broadens the relief in a January 2026 SEC staff no-action letter that covered only capital balance funds. Carrying and clearing firms that custody private fund interests should assess how the exception affects their reconciliation procedures, while remembering that SEA Rule 17a-13 quarterly counts and the "prudent business practice" standard still apply.