GRC Report Staff

The Portuguese Data Protection Commission (CNPD) issued an opinion raising significant concerns about Bill 697/XVII/1, which would create a new criminal offense for "digital identity usurpation" under the Cybercrime Law. CNPD finds the proposed definition of "digital identity" overly broad and indeterminate, and highlights substantial overlap with existing offenses (computer forgery, computer fraud, illegitimate access), questioning the necessity and proportionality of the new crime. Compliance teams monitoring Portuguese cybercrime and data protection legislation should track the bill's evolution, as its current drafting could create overlapping liability frameworks and interpretive uncertainty.

The UK Financial Conduct Authority has issued a public warning identifying ADM-Group (also referenced as ADM-Group Ltd and ADM-Group Limited) as an entity operating without proper authorization. Compliance teams should treat this as a standard unauthorized-firm alert and ensure the entity is screened against client and counterparty records, while also noting a discrepancy in regulator attribution in the source record.

BaFin President Mark Branson used a keynote speech to signal a strategic recalibration of German financial supervision toward greater proportionality, simplified rules, and faster, risk-focused intervention, particularly for troubled institutions. Compliance teams should note the emphasis on governance and risk culture over pure quantitative metrics, as well as expanded supervisory resources in cybersecurity, AML, conduct supervision, and forensic investigations. This signals heightened scrutiny of firms with weak governance structures, dominant management figures, or non-core business activities.

The Financial Function Enhancement Review Board of Japan's Financial Services Agency approved the organizational restructuring and merger implementation plan submitted by Niigata Prefectural Credit Union and Koei Credit Union. The minutes highlight regulatory emphasis on branch strategy sustainability, revenue synergy transparency, and compliance oversight for financial product sales to elderly customers—themes relevant to other cooperative financial institutions undergoing consolidation.

Norway's Financial Supervisory Authority (Finanstilsynet) has issued a public warning regarding the unregistered entity operating as "my.aipltfrm.com," echoing an earlier alert from Spain's CNMV. Compliance teams should treat this as a notice of an unauthorized financial services provider with potential cross-border exposure affecting European retail investors.

FinCEN, the Federal Reserve, FDIC, NCUA, and OCC jointly clarified that Suspicious Activity Report confidentiality requirements do not prevent banks from discussing potentially fraudulent transactions, suspicious activity, or account closures with affected customers. This guidance does not change existing BSA obligations or create new supervisory expectations, but it provides clarity that may help banks improve customer communication during fraud investigations while maintaining compliance.

The Norway Financial Supervisory Authority has issued a warning regarding "Yield Harbor (Clone)," a fraudulent entity impersonating a genuine FCA-authorized firm in the United Kingdom. Compliance teams should note this as a consumer protection alert rather than a rule change, and ensure appropriate client communication and fraud-prevention measures are in place.