GRC Report Staff

The European Banking Authority has published an updated set of validation rules (effective 12 October 2026) applicable to framework releases from version 4.0 onward, alongside a history of quarterly "small validation rules packages" that adjust rule severity and activation status. Compliance and regulatory reporting teams must ensure reporting systems and taxonomies align with the latest validation logic to avoid submission errors or rejected filings.

The Norwegian Data Protection Authority has issued its largest-ever fine—NOK 92 million (€8.6 million)—against Microsoft-owned ad-tech company Xandr for unlawfully processing and sharing sensitive personal data, including sexual orientation data derived from Grindr app usage, through real-time bidding. The decision reinforces that joint controllers cannot shift data protection responsibility to counterparties and underscores heightened regulatory scrutiny of the ad-tech ecosystem's handling of special category data.

The European Banking Authority has published a user guide explaining the conversion file that maps its legacy DPM 1.0 glossary to the new DPM 2.0 data model, as part of the ongoing DPM Quality Review project. This document is critical for institutions that rely on EBA taxonomies for supervisory reporting, as it details how domains, dimensions, and domain members will be restructured into categories, properties, items, and subcategories ahead of the v4.0 reporting framework release.

The Austrian Financial Market Authority has approved the merger of Merkur Lebensversicherung Aktiengesellschaft into Merkur Versicherung Aktiengesellschaft under section 29(1) of the VAG 2016. Compliance teams at counterparties, intermediaries, and policyholders of either entity should update internal records to reflect the consolidated legal entity and confirm continuity of regulatory obligations.

The FSMA has issued a public warning that Neura-L, operating via trade-platform.space, is falsely claiming registration with the regulator to mislead investors and solicit funds through a fraudulent trading platform. Compliance teams should note this as part of an ongoing pattern of unauthorized entities impersonating regulatory status to commit investment fraud, reinforcing the need for robust third-party verification controls and customer warnings.

The SFC will proceed with amendments to the Securities and Futures (Stock Market Listing) Rules (SMLR), introducing new tools to impose conditions on listing applicants and issuers as an alternative to trading suspension, alongside a new independent appeals mechanism. Compliance teams at listed issuers, sponsors, and advisors should prepare for these changes, expected to take effect in Q1 2027, as they will alter how the SFC addresses IPO-related and post-listing misconduct.

HKMA Chief Executive Eddie Yue delivered opening remarks at an academic conference on the Chinese economy, outlining growth, innovation, and resilience themes alongside Hong Kong's financial connectivity role. This is a speech rather than a binding regulatory action, but it signals the HKMA's strategic priorities around RMB internationalization, cross-border capital flows, and Hong Kong's positioning as a financial hub serving Mainland China's economic transformation.