Compliance & Ethics

The Norwegian Data Protection Authority has issued its largest-ever fine—NOK 92 million (€8.6 million)—against Microsoft-owned ad-tech company Xandr for unlawfully processing and sharing sensitive personal data, including sexual orientation data derived from Grindr app usage, through real-time bidding. The decision reinforces that joint controllers cannot shift data protection responsibility to counterparties and underscores heightened regulatory scrutiny of the ad-tech ecosystem's handling of special category data.

The European Banking Authority has published a user guide explaining the conversion file that maps its legacy DPM 1.0 glossary to the new DPM 2.0 data model, as part of the ongoing DPM Quality Review project. This document is critical for institutions that rely on EBA taxonomies for supervisory reporting, as it details how domains, dimensions, and domain members will be restructured into categories, properties, items, and subcategories ahead of the v4.0 reporting framework release.

The Austrian Financial Market Authority has approved the merger of Merkur Lebensversicherung Aktiengesellschaft into Merkur Versicherung Aktiengesellschaft under section 29(1) of the VAG 2016. Compliance teams at counterparties, intermediaries, and policyholders of either entity should update internal records to reflect the consolidated legal entity and confirm continuity of regulatory obligations.

The SFC will proceed with amendments to the Securities and Futures (Stock Market Listing) Rules (SMLR), introducing new tools to impose conditions on listing applicants and issuers as an alternative to trading suspension, alongside a new independent appeals mechanism. Compliance teams at listed issuers, sponsors, and advisors should prepare for these changes, expected to take effect in Q1 2027, as they will alter how the SFC addresses IPO-related and post-listing misconduct.

FINRA has reissued a reminder about NSCC's requirement for firms to establish separate 9A/9B trading relationships to support overnight trade clearing under the industry's 24x5 trading initiative. While FINRA itself is not mandating changes to Uniform Reporting Agreements, firms that fail to meet NSCC's requirements risk having overnight trades accepted at the TRF but rejected at NSCC, creating a trade break and operational/settlement risk.

FINRA has finalized two significant rule changes—a streamlined Outside Activities rule and a new intraday margin framework eliminating the Pattern Day Trader designation—as part of its FINRA Forward modernization initiative. Compliance teams must update policies, procedures, and training to reflect these changes while monitoring a pipeline of additional pending proposals covering senior investor protections, e-delivery defaults, remote inspections, and AI-related supervisory standards.

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) issued a statement on Germany's draft law implementing EU Regulation (EU) 2025/327 (EHDS Regulation) for healthcare data and digital innovation. The statement generally endorses the government's draft while providing detailed technical feedback on proposed amendments concerning access logging, document-level access controls in electronic patient records, research data linkability, and consent-based data processing authorization requirements. Healthcare organizations and health insurers operating in Germany should monitor this legislation closely as it will materially affect data governance obligations under both national law (SGB V, GDNG-E) and the EHDS framework.