GRC Report Staff

The AMF's SPOT campaign across five French portfolio management companies (SGPs) found weaknesses in telephone recording policies, retention periods, and deletion procedures. Voice ordering is declining (only 19% of surveyed SGPs use it), but the AMF says the channel carries heightened operational and compliance risk and still requires robust controls. Compliance teams should use the findings to benchmark their own recording frameworks, especially where MiFID II, AIFM, UCITS, and GDPR requirements overlap.

The source text contradicts itself on the direction of the rate move. It says "cut" in one place and "raise" in another, while the stated new rates (deposit facility 2.50%, main refinancing operations 2.65%, marginal lending facility 2.90%, effective September 16, 2026) and the inflation outlook point to an increase. Compliance teams should verify the direction against the official ECB release before acting, because rate-sensitive products, models, and disclosures depend on it.

Twice in the autumn of 2020, a distributor supplying networking equipment to Extreme Networks was asked for the website of its Russian customer. Twice, the distributor provided the website of a company that manufactured missiles for Russia's air defense systems. The purchase orders named someone else.

More than 1,200 customers were allowed to gamble through high-risk channels at The Star Entertainment Group's Australian casinos, where cash deposits could be accepted from third parties without recording who had supplied the money.

Google and Apple charged South Korean app developers a 26% commission even when those developers chose to use their own payment systems. The developers also had to bear the costs of building and operating those systems, while working without some of the features available through the companies' proprietary billing services.

Moody’s Investors Service Middle East reported seven incidents of inadvertent data disclosure to Dubai’s financial regulator over a period of nearly two and a half years. Four involved confidential information reaching recipients outside the company. During that period, the credit rating agency had discontinued using a data security tool without immediately replacing it.

A multinational can deploy the same artificial intelligence system in Frankfurt, Chicago, and Singapore and face three different sets of questions about its legality, oversight, and accountability. The technology is identical, but the obligations attached to it are not. In Europe, the company must decide whether the system falls within the EU Artificial Intelligence Act, what role the company plays under it, and which requirements are already enforceable. In the United States, the inquiry moves among federal statutes, sector regulators, state laws, and enforcement powers that predate generative AI. Singapore pairs an enforceable data protection statute with voluntary AI governance frameworks meant to shape how organizations build and use the technology.