GRC Report Staff

Finanstilsynet Names Rune Fuglsang Smet Head of Credit Risk Office

The Danish Financial Supervisory Authority (Finanstilsynet) has appointed Rune Fuglsang Smet as Head of the Credit Risk Office, effective September 1, 2026. This is a routine leadership appointment with limited direct regulatory impact, though it signals continuity in the regulator's supervisory approach to credit risk at banks and mortgage credit institutions.

ECB Publishes Consolidated Financial Statement of Eurosystem as at 28 August 2026

The European Central Bank has released its routine consolidated financial statement of the Eurosystem for the reporting period ending 28 August 2026. This is a standard disclosure reflecting the weekly financial position of the Eurosystem and does not introduce new regulatory requirements for financial institutions.

UODO's 2025 Annual Report Shows Sharp Rise in Fines, Complaints, and Data Breach Notifications

Poland's data protection authority (UODO) reported a 363% increase in total administrative fines and a 61% jump in complaints in 2025, signaling intensified enforcement activity. Compliance teams operating in Poland should note the sharp rise in breach notifications (51% increase) and inspections (52% increase), reflecting heightened regulatory scrutiny and public awareness of data protection rights.

APRA and ASIC Host Superannuation CEO Roundtables on AI, Cyber and Operational Resilience

APRA and ASIC jointly convened superannuation CEOs in June 2026 to discuss frontier AI, cyber risk, operational resilience, and crisis preparedness. While no new formal requirements were introduced, the roundtable signals heightened regulatory focus on these themes, which compliance teams should factor into ongoing risk and governance reviews.

BaFin Warns Against Unauthorized Crypto Services Offered via trade-lend(.)com

BaFin has issued a public warning against trade-lend(.)com, operated by Tradeshow Limited, for providing unlicensed cryptocurrency exchange services disguised as loan offerings. This action underscores ongoing regulatory scrutiny of unauthorized crypto activity in Germany and serves as a reminder for compliance teams to monitor third-party and counterparty due diligence processes.

Dutch DPA Submits Multi-Year Funding Estimate for AI Act Supervision to Parliament

The Dutch Data Protection Authority (DPA) has shared an implementation and enforceability test on the AI Regulation Implementation Act with Parliament, outlining a multi-year funding estimate (2027–2031) needed to adequately supervise AI under the EU AI Act. Compliance teams operating in the Netherlands should note the DPA's expanded role as a market surveillance authority for AI, with supervisory capacity expected to scale alongside rapid AI adoption and increasing system complexity.

BaFin Warns Against Unauthorized Financial Services Website zentrumpro.com

BaFin has issued a public warning against zentrumpro(.)com for suspected unauthorized provision of financial and cryptocurrency services in Germany. This action underscores ongoing regulatory scrutiny of unlicensed online financial operators and serves as a reminder for compliance teams to monitor regulatory warning lists as part of third-party and fraud risk management.