GRC Report Staff

On September 16, 2026, the ESAs published 14 operational instructions to harmonize how major ICT-related incidents are reported under DORA and to fix recurring data quality issues. The instructions are non-binding "best efforts" guidance, but they were agreed with competent authorities and signal supervisory expectations. Compliance teams should align reporting templates and procedures now to avoid rejected, inconsistent, or duplicated submissions.

The Financial Industry Regulatory Authority (FINRA) has fined Webull $4.2 million for widespread failures in its anti-money laundering controls, identity theft prevention program and oversight of customer trade execution, citing deficiencies that persisted for years as the online brokerage rapidly expanded.

Nearly a quarter of senior business leaders surveyed by Deloitte say their organizations have yet to establish clear accountability when artificial intelligence produces a negative outcome. At the same time, 40% report allowing AI to execute decisions or take actions without human approval to at least a moderate degree.

The European Banking Authority has reduced the amount of detail banks will be expected to provide when documenting management responsibilities, retreating from parts of an earlier proposal as it seeks to make EU governance requirements less burdensome.

ASIC Form 5290 is the notice a CCIV's responsible person must lodge when a financial product in a Product Disclosure Statement (PDS) relating to a CCIV sub-fund is no longer available to be recommended or offered to new clients. The notice is due within 5 business days of the cessation, and late fees apply. Compliance teams should build this trigger into product lifecycle and disclosure governance to avoid breaches of s1015D(2)(c) of the Corporations Act 2001.

The Netherlands Authority for Consumers and Markets (ACM) has issued a draft policy rule clarifying how telecom providers must notify customers about expiring contracts, free termination rights, and cheaper rates. The rule targets loyalty penalties and sets specific requirements for timing, format, and content. Providers should assess their current communications now, as consultation closes 27 October 2026 and a final rule is expected before year-end.

ASIC Form 7051 (ASX Form 1001) is the certification notice that disclosing entities must lodge with their half yearly reports under the Corporations Act 2001. Lodgement is due within 75 days after the end of the accounting period, and late lodgement triggers fees. The document appears to be an existing form and guide (dated 2011 and 2014), not a new rule, so compliance teams should treat it as a reminder to confirm their lodgement processes.