GRC Report Staff

A cyberattack that corrupts data presents a different kind of crisis from one that simply takes systems offline. Restoring servers is one challenge. Restoring confidence that the information inside them can still be trusted is another. Denmark's financial authorities chose that distinction as the foundation for a new operational resilience exercise whose conclusions reached well beyond the fictional attack itself.

For years, cybersecurity has rested on a bargain that most organizations scarcely questioned. Not every asset could receive the same level of protection, so security leaders concentrated their attention where the consequences of failure would be greatest. The systems most critical to the business became the crown jewels. Everything else received what time, people and budgets allowed. It was an imperfect arrangement, but for a long time it was a practical one.

There is a familiar rhythm to businesses that promise financial independence. The details change with technology but the promise remains durable. There is a system, the system works, and ordinary people need only follow it. The Federal Trade Commission argues that Publishing.com sold precisely that story, and on Thursday the agency formally closed the case with a final order designed to ensure the company cannot tell it the same way again.

In its 2026 Markets and Risk Outlook, the Autorité des marchés financiers said geopolitical and cyber risks remain central concerns. Financial markets, it said, have stayed broadly orderly and resilient despite a correction and heightened volatility following the outbreak of the conflict with Iran. That resilience is not presented as a clean bill of health. It is the backdrop against which the regulator now sees familiar vulnerabilities becoming more exposed.

The Federal Court of Australia has ordered ASX to pay a civil penalty of $13.5 million (AUD 20.5 million) after the exchange admitted that a market announcement misled investors by stating the Clearing House Electronic Subregister System (CHESS) replacement project was "progressing well." The court also ordered ASX to pay $2.0 million (AUD 3 million) toward the Australian Securities and Investments Commission's legal costs, bringing another chapter of the long-running project to a close, though not one likely to be forgotten quickly.

The European Commission has adopted revised European Sustainability Reporting Standards (ESRS), delivering the most substantial simplification of the European Union's sustainability reporting framework since the Corporate Sustainability Reporting Directive (CSRD) began reshaping corporate disclosure obligations.

The work of fighting money laundering has always invited a certain temptation: to mistake the existence of controls for the existence of control. Japan's Financial Services Agency is now pushing firmly against that instinct. In its latest assessment of anti-money laundering, counter-terrorist financing and financial crime efforts, the regulator makes clear that the question facing financial institutions is no longer whether they have built the necessary frameworks. It is whether those frameworks can withstand contact with the world as it actually is.