GRC Report Staff

In December 2020, Latch shipped $147,000 worth of hardware to one of its channel partners, but there was a catch. The partner could send all of it back, without consequence, if the building developer behind the order decided not to proceed. That condition was written down, but it simply never made its way to the people doing the accounting. Latch booked the $147,000 as revenue anyway. About six months later, the hardware came back.

Austria’s Supreme Cartel Court has increased the fine against German construction machinery company Kiesel from €240,000 to €2.4 million for implementing two mergers before the law permitted it to do so, turning what had been a relatively modest penalty into one intended, quite deliberately, to be felt.

The Norwegian Financial Supervisory Authority (Finanstilsynet) has issued a warning regarding kibachag.com, an entity also flagged by the Swiss Financial Market Supervisory Authority (FINMA) for operating without proper authorization. This cross-border warning signals potential unlicensed financial services activity that compliance teams should monitor to prevent inadvertent exposure or referral relationships with the flagged entity.

The Portuguese Data Protection Commission (CNPD) issued an opinion raising significant concerns about Bill 697/XVII/1, which would create a new criminal offense for "digital identity usurpation" under the Cybercrime Law. CNPD finds the proposed definition of "digital identity" overly broad and indeterminate, and highlights substantial overlap with existing offenses (computer forgery, computer fraud, illegitimate access), questioning the necessity and proportionality of the new crime. Compliance teams monitoring Portuguese cybercrime and data protection legislation should track the bill's evolution, as its current drafting could create overlapping liability frameworks and interpretive uncertainty.

The UK Financial Conduct Authority has issued a public warning identifying ADM-Group (also referenced as ADM-Group Ltd and ADM-Group Limited) as an entity operating without proper authorization. Compliance teams should treat this as a standard unauthorized-firm alert and ensure the entity is screened against client and counterparty records, while also noting a discrepancy in regulator attribution in the source record.

BaFin President Mark Branson used a keynote speech to signal a strategic recalibration of German financial supervision toward greater proportionality, simplified rules, and faster, risk-focused intervention, particularly for troubled institutions. Compliance teams should note the emphasis on governance and risk culture over pure quantitative metrics, as well as expanded supervisory resources in cybersecurity, AML, conduct supervision, and forensic investigations. This signals heightened scrutiny of firms with weak governance structures, dominant management figures, or non-core business activities.

The Financial Function Enhancement Review Board of Japan's Financial Services Agency approved the organizational restructuring and merger implementation plan submitted by Niigata Prefectural Credit Union and Koei Credit Union. The minutes highlight regulatory emphasis on branch strategy sustainability, revenue synergy transparency, and compliance oversight for financial product sales to elderly customers—themes relevant to other cooperative financial institutions undergoing consolidation.