GRC Report Staff

A firm expecting to earn £500,000 or more from environmental, social and governance ratings will have just over a month next summer to submit its application for authorization under the UK's new regulatory regime. Smaller providers will have a separate window. By June 2028, firms carrying out regulated ESG ratings activities in the country will generally need permission from the Financial Conduct Authority to continue.

ESMA has published Q&A 2919 asking whether MiFID II investor protection rules apply when EU-based, EU-authorized investment firms serve clients outside the EU. The entry is marked "Forwarded to EC/Public Consultation/Other," so no definitive ESMA answer has been issued. Compliance teams with cross-border client bases should treat the territorial scope of their conduct obligations as unresolved and monitor for further guidance.

ASIC's Form 361 is the mechanism by which registered agents notify ASIC that they have ceased to act for one or more companies. It is not a new rule: the document is a form and guide dated 2011 and 2015, though it is labeled as a 2026 press release. Compliance teams should treat it as a reminder to confirm that agent offboarding and corporate records processes are accurate and current.

The Dutch Data Protection Authority (AP) reviewed the Dutch Healthcare Authority's draft Mental Health Care and Forensic Care Regulations (NR/REG-2705a) and issued no comments. The clean review suggests the draft's personal data processing provisions meet the AP's GDPR and proportionality framework. It also shows compliance teams how the AP tests health-related data processing in legislative proposals.

The Austrian Financial Market Authority's Bank Sales Report 2026 shows securities custody accounts rose 14% to 2.87 million in 2025, driven by digital neobrokers and foreign branches. Investment services complaints jumped 70%, and the FMA signaled a focus on a level playing field in supervision, expanded consumer protection, and extended consumer lending powers from November 2026. Compliance teams should expect heightened scrutiny of digital sales channels, complaint handling, and fraud controls.

ASIC's Form 410 (version dated 1 July 2022) is the prescribed application for reserving a company, foreign company, registrable Australian body, or Corporate Collective Investment Vehicle (CCIV) name under the Corporations Act 2001. It is an existing form and guide, not a new rule, and the document's 2026 date appears to reflect republication rather than substantive change. Compliance teams should still confirm that entity formation, renaming, and registration workflows follow its timing, declaration, and signature requirements.

Finansinspektionen (FI) has amended Chapter 10, Section 3 of FFFS 2013:10, which sets conduct and organizational requirements for AIFMs that advise clients on units or shares in alternative investment funds. The amendment takes effect October 1, 2026, and updates the cross-references to MiFID II Delegated Regulation articles and to FFFS 2017:2 on securities transactions. Affected AIFMs should confirm that their advisory activities comply with the revised provisions before the effective date.