GRC Report Staff

The Dutch Data Protection Authority (DPA) has shared an implementation and enforceability test on the AI Regulation Implementation Act with Parliament, outlining a multi-year funding estimate (2027–2031) needed to adequately supervise AI under the EU AI Act. Compliance teams operating in the Netherlands should note the DPA's expanded role as a market surveillance authority for AI, with supervisory capacity expected to scale alongside rapid AI adoption and increasing system complexity.

BaFin has issued a public warning against zentrumpro(.)com for suspected unauthorized provision of financial and cryptocurrency services in Germany. This action underscores ongoing regulatory scrutiny of unlicensed online financial operators and serves as a reminder for compliance teams to monitor regulatory warning lists as part of third-party and fraud risk management.

The CFTC has recorded certification of a new Designated Contract Market (DCM) product from FEX, a binary option-style event contract tied to copper futures price forecasts. This filing is relevant to compliance teams at firms trading, clearing, or offering access to CFTC-regulated derivatives, as it expands the universe of certified products subject to CFTC oversight.

MAS has published a consultation paper proposing amendments to the Payment Services Act 2019 to formalize its Single-Currency Stablecoin (MAS-SCS) framework, covering licensing, value stability, capital, redemption, and disclosure requirements. Compliance teams at financial institutions engaging with stablecoins, digital payment tokens, or tokenized asset markets in Singapore should review the proposals closely, as they will determine who can market stablecoins as "MAS-regulated" and set new safeguards for issuers and intermediaries. Comments are due by October 16, 2026.

EIOPA has published its technical advice to the European Commission on harmonizing minimum standards for insurance guarantee schemes (IGS) across the EU. The advice aims to strike a balance between targeted harmonization of policyholder protection mechanisms and preserving national flexibility, which will shape future EU legislative proposals affecting insurers' contingency planning and cross-border risk management.

APRA has confirmed that OnePath Custodians Pty Limited (OPC), part of the Insignia Financial Group, has fully satisfied its obligations under a Court Enforceable Undertaking (CEU) originally accepted in July 2024 for default contribution failures. The conclusion of the CEU, including the lifting of a AUD $40 Million capital overlay, demonstrates APRA's supervisory approach of enforcing accountability while recognizing genuine remediation efforts.

The Netherlands Data Protection Authority (AP) has reviewed the draft Regulation on the Experiment in Rehabilitation and Recovery Care (NR/REG-2701) under Article 36(4) GDPR and raised no objections. While this is a sector-specific healthcare regulation, it illustrates the AP's assessment framework for evaluating proportionality and data protection safeguards in draft legislation, which is instructive for compliance teams managing GDPR-related legislative consultations.