GRC Report Staff

The BfDI has issued recommendations, based on a survey of 1,500 insured persons, urging the German Federal Government to strengthen transparency and granular user controls in the electronic patient file (ePA). From the end of October 2026, pseudonymized medication list data can be extracted for research unless insured persons object. Compliance teams at organizations handling German health data should treat this as a signal of regulatory expectations on consent, control, and transparency.

In his opening remarks at the 2026 Green Fintech Symposium, HKMA Chief Executive Eddie Yue presented a strategy that combines digital data infrastructure (the Commercial Data Interchange and Project CargoX), the next phase of the Hong Kong Taxonomy for Sustainable Finance, and market-led green fintech innovation. The speech sets no new binding requirements, but it signals supervisory priorities on greenwashing, transition-washing, and data-driven climate risk assessment. Compliance teams should treat the Taxonomy as the expected reference standard for sustainability claims and classifications.

HKMA Deputy Chief Executive Darryl Chan said Hong Kong is expanding sustainable finance access for SMEs through a Phase 2B Hong Kong Taxonomy consultation, a broader green debt grant scheme, and a free greenhouse gas emissions calculator. The speech is not binding, but it signals supervisory priorities. Compliance teams should watch the taxonomy consultation, which will shape how transition and adaptation activities are classified and disclosed.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about the website autorite-des-marches-financiers.com, which appears to impersonate France's financial markets regulator, the AMF. The notice relays the AMF's own blacklist entry for the domain. Compliance teams should treat this as a regulator-impersonation fraud indicator and update their screening and customer protection controls.

Japan's Financial Services Agency will not pursue administrative or criminal liability for reports and notifications with legal deadlines that are filed by November 27, 2026, if the earthquake prevented timely submission. The relief also covers reports with no statutory deadline and allows case-by-case extensions for affected institutions headquartered in Kumamoto Prefecture. Compliance teams should confirm eligibility and document the earthquake's impact on filing capacity.

The UK Financial Reporting Council has opened three investigations tied to State Oil Limited (part of the Prax Group): one into an individual accountant's conduct on financing arrangements, and two into statutory audits by KPMG LLP and PKF Littlejohn LLP. The opening of an investigation does not imply any finding of breach or misconduct, but it signals continued FRC scrutiny of audit quality and of professional conduct around financing arrangements. Compliance teams should note the read-across for audit oversight, lender and borrower reporting, and finance function governance.

The CMA has issued an open letter reminding domestic heating oil suppliers that consumer contract terms must be fair and transparent, with particular focus on terms that remove or reduce supplier liability. The letter follows a CMA intervention over order cancellations during a price and demand surge tied to the Middle East conflict, which resulted in voluntary compensation for hundreds of customers. Compliance teams in any consumer-facing sector should treat it as a signal of enforcement priorities for contract terms during market volatility.