GRC Report Staff

On September 11, 2026, BaFin issued a warning about the website protrader-finanz(.)de and emails from info@protrader-finanz(.)de, whose operators are allegedly offering fixed-term deposit investments without the required authorization. The notice is a consumer and market protection alert, not a new rule, but it gives compliance teams actionable indicators for fraud detection, customer protection, and sanctions or blocklist screening.

A Hong Kong Monetary Authority research memorandum finds that private equity (PE) ownership of Asia-Pacific (APAC) insurers is rising and is associated with larger allocations to opaque, higher-risk private credit (PC). The paper is not a rule or a directive, but it signals supervisory attention to contagion risk between the private finance ecosystem and insurers. Compliance and risk teams should treat it as an early indicator of possible scrutiny of investment governance, capital treatment, and disclosure.

The FDIC, Federal Reserve, NCUA, and OCC have jointly requested comment on proposed non-binding third-party risk management guidance that would rescind and replace the current guidance once finalized. A companion statement on community bank engagement with core service providers outlines factors the agencies will weigh in supervisory and enforcement decisions. Compliance teams should begin gap assessments now and consider submitting comments before the 60-day window closes.

Senior officials from the SEC, FDIC, CFTC, Federal Reserve Board, and Bank of England held a tabletop exercise on Sept. 3, 2026, to discuss the hypothetical resolution of central counterparties (CCPs). The meeting focused on information sharing and communication arrangements to support financial stability. It introduces no new requirements, but it signals continued cross-border supervisory attention to CCP resilience, which matters for firms with significant clearing exposures.

EIOPA rejected Question 3463 because it sought an interpretation of French national legislation, which is outside the scope of the Q&A process. No new guidance on CIC codes for NEU CP or NEU MTN was issued. Insurers must therefore rely on existing Solvency II reporting rules and their own documented classification judgment.

In a speech delivered in his personal capacity, a PCAOB Board member urged the Board to revisit the audit firm metrics disclosure rule it adopted in 2024 and withdrew from SEC review in early 2025. He also outlined recent PCAOB initiatives, including amended QC 1000 (effective December 15, 2026), inspection modernization, and a draft 2026-2030 strategic plan. Compliance teams and audit committees should prepare for possible changes to audit oversight and firm transparency, though the remarks are not binding.

On September 11, 2026, the Hong Kong SFC issued a circular notifying licensed corporations, SFC-licensed virtual asset service providers (VASPs), and associated entities that amendments to the Haiti and Yemen UN sanctions regulations took effect immediately upon Gazette publication. The amendments renew financial sanctions and travel bans for both jurisdictions and revise Haiti's arms embargo requirements. Because there is no transition period, compliance teams must promptly confirm that screening and controls reflect the updated regimes.