GRC Report Staff

In its Annual Enforcement Review 2026, the UK's Financial Reporting Council does more than catalog another year's worth of enforcement activity. It draws a line from the mistakes uncovered in investigations to the weaknesses the regulator continues to see in financial reporting, audit quality, and firms' internal systems of control. Just as importantly, it explains how those cases are shaping the FRC's supervisory work and the standards it expects the profession to meet.

Poland's Data Management Act took effect Thursday, completing a piece of legal architecture that has been waiting for its final support. The European Union's Data Governance Act has applied across the bloc since 2023. What entered into force now is the national legislation that gives the regulation a fully functioning home inside Poland's legal system.

In two decisions under the European Union's Digital Markets Act (DMA), the Commission fined Google a combined €890 million, finding that the company unlawfully favored its own services in Google Search while also preventing app developers from freely steering customers toward alternative purchasing channels outside Google Play. The penalties amount to €460 million for Google's search practices and €430 million for its Play Store policies.

A Chick-fil-A One account contains more than reward points. It can also hold payment methods, gift card balances, and enough personal information to make it worth trying a password that worked somewhere else. That, according to breach notification letters first reported by BleepingComputer, is what happened in June, when attackers used credentials stolen from an unrelated source to gain access to a limited number of customer loyalty accounts. The campaign did not depend on breaking into Chick-fil-A's systems. It depended on customers reusing passwords.

The Australian Communications and Media Authority found that Tabcorp Holdings' wagering business repeatedly breached Australia's telemarketing rules while marketing to VIP customers. The regulator identified 351 calls made to numbers listed on the Do Not Call Register without consent, 82 calls placed outside legally permitted hours, and nearly 4,000 calls in which TAB failed to properly identify itself, the purpose of the call, or both.

Poland recorded roughly 270,000 cybersecurity incidents last year, according to the country's Personal Data Protection Office. That was a 150% increase over 2024. The agency says it is seeing the same trajectory in reports of personal data breaches.

On Wednesday, the Australian Securities and Investments Commission wrote to every registered company auditor in the country with a reminder that reads less like routine regulatory housekeeping than a response to a profession under unusual scrutiny. Trust, ASIC told auditors, has become part of the story. That alone explains why the regulator felt compelled to restate obligations that already exist in law.