GRC Report Staff

Apple and Amazon were fined a combined €194 million by Spain's competition regulator in July 2023 and ordered to remove restrictions on the sale and advertising of Apple products. Nearly two years passed before the companies removed two sets of the offending clauses. That delay has brought both companies back before the National Commission on Markets and Competition (CNMC), which announced on November 3 that it had initiated new sanction proceedings over their failure to comply with the original order.

The penalties against iSignthis have survived another round in court. Nearly six years after Australian regulators brought proceedings against the payments company and its former chief executive, a federal appeals court has upheld approximately $7.7 million (A$11 million) in combined penalties and a six-year ban on the former CEO managing corporations.

A firm expecting to earn £500,000 or more from environmental, social and governance ratings will have just over a month next summer to submit its application for authorization under the UK's new regulatory regime. Smaller providers will have a separate window. By June 2028, firms carrying out regulated ESG ratings activities in the country will generally need permission from the Financial Conduct Authority to continue.

ESMA has published Q&A 2919 asking whether MiFID II investor protection rules apply when EU-based, EU-authorized investment firms serve clients outside the EU. The entry is marked "Forwarded to EC/Public Consultation/Other," so no definitive ESMA answer has been issued. Compliance teams with cross-border client bases should treat the territorial scope of their conduct obligations as unresolved and monitor for further guidance.

ASIC's Form 361 is the mechanism by which registered agents notify ASIC that they have ceased to act for one or more companies. It is not a new rule: the document is a form and guide dated 2011 and 2015, though it is labeled as a 2026 press release. Compliance teams should treat it as a reminder to confirm that agent offboarding and corporate records processes are accurate and current.

The Dutch Data Protection Authority (AP) reviewed the Dutch Healthcare Authority's draft Mental Health Care and Forensic Care Regulations (NR/REG-2705a) and issued no comments. The clean review suggests the draft's personal data processing provisions meet the AP's GDPR and proportionality framework. It also shows compliance teams how the AP tests health-related data processing in legislative proposals.

The Austrian Financial Market Authority's Bank Sales Report 2026 shows securities custody accounts rose 14% to 2.87 million in 2025, driven by digital neobrokers and foreign branches. Investment services complaints jumped 70%, and the FMA signaled a focus on a level playing field in supervision, expanded consumer protection, and extended consumer lending powers from November 2026. Compliance teams should expect heightened scrutiny of digital sales channels, complaint handling, and fraud controls.