GRC Report Staff

The AEPD announced it will run a dedicated data protection room on November 24, 2026, on the first day of the XX STIC Conference in Madrid. The announcement is not a new rule, but it signals that the regulator wants privacy integrated into cybersecurity, AI, and quantum risk management from the earliest design stages. Compliance teams should treat it as a supervisory-priority indicator and an opportunity to engage.

CFTC Division of Market Oversight Letter 26-24 allows Electron Exchange DCM, LLC (ElectronX) to keep applying the "exclusively self-cleared contracts" reporting framework to its direct participants, even though FCM intermediation is now permitted. ElectronX will report on behalf of direct participants, while FCM clearing members must still meet standard reporting obligations for intermediated accounts. Compliance teams at exchanges, FCMs, and direct traders should review how reporting responsibilities are now allocated.

The Norway Financial Supervisory Authority has published a warning about Robus Umbrella, referencing a Luxembourg CSSF notice concerning the website www.robusumbrella.com. It signals a suspected unauthorized or fraudulent entity operating under a Luxembourg connection. Compliance teams should screen for exposure and update fraud and onboarding controls.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning on "RBC Funds (Lux)," referencing a Luxembourg CSSF notice about the website www.visionfundlu.com. The source content is sparse, but it appears to be a cross-border warning about a suspected fraudulent or unauthorized entity using a Luxembourg fund identity. Compliance teams should treat it as a fraud and impersonation alert and update screening and client-protection controls.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about UrbanMint Digital Assets S.A., an entity presented as Luxembourg-based, and it references a CSSF warning about the website www.urbanmint-io. Compliance teams should treat the entity and its website as potentially unauthorized or fraudulent and screen for any exposure.

A warning concerning Novexis Suisse (novexissuisse.com) has been published, with the source link pointing to the Swiss Financial Market Supervisory Authority (FINMA) warning list. Compliance teams should treat the entity as a high-risk counterparty, screen for exposure, and note a discrepancy in the source metadata regarding which regulator issued the notice.

Finanstilsynet (Norway FSA) has issued a warning about "hanfcl (Clone)," a clone firm that appears to impersonate an FCA-authorized United Kingdom entity. The notice relays a UK Financial Conduct Authority warning, so compliance teams should treat it as a fraud and impersonation alert and update screening and customer-protection controls.