GRC Report Staff

The FCA has added "The FBA Investor" (@thefbainvestor), operating via stan.store, to its Warning List for providing or promoting financial services without authorization. This action reinforces the importance of due diligence on social-media-driven financial promotions and the risks UK consumers face when dealing with unauthorized entities, including loss of FSCS and Financial Ombudsman Service protections.

SEC Chairman Paul Atkins announced a proposal to fully rescind Rule 206(4)-5, the "pay-to-play" rule under the Investment Advisers Act of 1940, along with related recordkeeping requirements. Compliance teams at registered investment advisers should prepare for the potential elimination of political contribution monitoring and the two-year compensation ban, pending the formal rulemaking process and public comment period.

The FCA has added ExoticInvest Trading and Investment Firm to its Warning List for providing or promoting financial services in the UK without authorization. Consumers dealing with this firm have no access to the Financial Ombudsman Service or FSCS protection, increasing the risk of financial loss with no recourse. Compliance teams should treat this as a reminder to reinforce due diligence and third-party screening controls against unauthorized entities and clone firm scams.

The SEC's Investor Advisory Committee will hold a public meeting on September 10, 2026, to examine artificial intelligence's role in the public markets information ecosystem and to discuss Regulation National Market System (Reg NMS) rules. While this is a discussion and advisory forum rather than a rulemaking action, it signals the SEC's continued focus on AI oversight and market structure reform, both of which may foreshadow future regulatory proposals.

The SEC has proposed rescinding Rule 206(4)-5, the "pay-to-play" rule that bars investment advisers from receiving compensation for advisory services to government clients for two years following certain political contributions. The agency cites implementation challenges and unintended consequences, concluding that existing Advisers Act provisions are likely sufficient to address pay-to-play risks. Compliance teams at investment advisory firms serving public pension funds and government entities should closely monitor this proposal, as it could significantly ease current political contribution restrictions and related recordkeeping burdens.

The CNIL sanctioned HÔPITAL PRIVÉ DE LA LOIRE EUR 500,000 after a 2025 cyberattack exposed health data of 524,867 patients and personal data of 202,246 trusted third parties, citing failures to implement basic security measures (Article 32) and notify all affected data subjects (Article 34). This case underscores regulators' increasing scrutiny of healthcare data security architecture, particularly authentication, access controls, and breach monitoring, and reinforces that breach notification obligations extend beyond primary data subjects to any individual whose data was compromised.

The CNIL sanctioned HÔPITAL PRIVÉ DE LA LOIRE EUR 500,000 after a 2025 cyberattack exposed data on 524,867 patients and 202,246 trusted third parties, citing weak authentication, inadequate access controls, and failure to notify all affected individuals. The case underscores regulators' increasing scrutiny of healthcare data security fundamentals and the obligation to notify all categories of affected data subjects, not just primary data owners.