Compliance & Ethics

The UK government and Serious Fraud Office have opened a joint consultation reviewing the whistleblowing framework under the Employment Rights Act 1996, alongside proposals for a new SFO scheme offering financial rewards to individuals reporting economic crime. Compliance teams should monitor this closely, as any resulting reforms could significantly increase whistleblower activity and reporting incentives across UK operations.

The Austrian FMA has sanctioned a natural person with a EUR 5,000 fine for providing unauthorized investment advice, including recommending clients liquidate existing investments to fund new financial instrument purchases. While the monetary penalty is modest, the case underscores the FMA's continued enforcement focus on unlicensed advisory activity and serves as a reminder that individuals acting as business partners of issuers must hold proper authorization under WAG 2018.

The Austrian Financial Market Authority has approved the proportional spin-off of the investment services provider licence held by Weilburg Family Office GmbH into a newly established entity, Weilburg Invest GmbH. Compliance teams engaging with either entity should update counterparty due diligence records and confirm the new entity's licensing status and scope of authorization.

The FCA has added Quantumtradedesk.org to its Warning List as an unauthorized entity potentially targeting UK consumers with financial services or products. Compliance teams should note this action as part of ongoing FCA efforts to combat unauthorized trading platforms and investment scams, and ensure customer-facing staff are aware of the firm's details to prevent potential customer harm.

The European Banking Authority has published an updated set of validation rules (effective 12 October 2026) applicable to framework releases from version 4.0 onward, alongside a history of quarterly "small validation rules packages" that adjust rule severity and activation status. Compliance and regulatory reporting teams must ensure reporting systems and taxonomies align with the latest validation logic to avoid submission errors or rejected filings.

The Norwegian Data Protection Authority has issued its largest-ever fine—NOK 92 million (€8.6 million)—against Microsoft-owned ad-tech company Xandr for unlawfully processing and sharing sensitive personal data, including sexual orientation data derived from Grindr app usage, through real-time bidding. The decision reinforces that joint controllers cannot shift data protection responsibility to counterparties and underscores heightened regulatory scrutiny of the ad-tech ecosystem's handling of special category data.

The European Banking Authority has published a user guide explaining the conversion file that maps its legacy DPM 1.0 glossary to the new DPM 2.0 data model, as part of the ongoing DPM Quality Review project. This document is critical for institutions that rely on EBA taxonomies for supervisory reporting, as it details how domains, dimensions, and domain members will be restructured into categories, properties, items, and subcategories ahead of the v4.0 reporting framework release.