GRC Report Staff

ASIC has released Consultation Paper 391 proposing tiered access settings for companies register data, expanding free access to core officeholder information while restricting sensitive personal details to verified users with a clear need. Compliance teams that rely on registry data for due diligence, KYC, and onboarding should assess the impact now and respond by 5:00 pm on 12 October 2026, because the proposed changes begin on 1 July 2027. ANALYSIC:

The Norway Financial Supervisory Authority has published a warning about smart market GmbH, an entity associated with Switzerland. The linked source is the Swiss regulator FINMA's warning list, which suggests the entity may be offering financial services without authorization. Compliance teams should screen for exposure and strengthen controls against unauthorized-entity risk.

On September 11, 2026, BaFin warned that the unknown operators of sogmbh(.)com are suspected of offering financial, securities, and cryptocurrency services without authorization. The operators falsely claim an affiliation with Strategic Opportunities GmbH of Offenburg, which is a victim of identity theft. Compliance teams should treat this as a fraud typology and sanctions/screening input, and should update their monitoring, onboarding, and customer-awareness controls.

The Norway Financial Supervisory Authority (Finanstilsynet) has republished a warning about fr-totalenergiesinvest.com, a website the French AMF blacklisted for impersonating a legitimate entity. The notice shows regulators sharing fraud intelligence across borders. Compliance teams should block the domain, update fraud monitoring, and warn customers and staff.

The OCC issued proposed third-party risk management guidance that would let banks scale oversight to the magnitude and likelihood of harm from each relationship, rather than following broad, process-driven approaches. It also clarified its risk-based supervision and enforcement of core service providers to help community banks facing due diligence, monitoring, and contract challenges. Compliance teams should assess how their current frameworks would change and consider submitting comments.

The Administrative Review Tribunal affirmed ASIC's five-year bans on former advisers Andrew Hanley and Shane Monte Silva, finding that advisers cannot outsource fact-finding or Statement of Advice content to unlicensed telemarketers or paraplanners. The decisions confirm that these obligations fall personally on the adviser and signal continued enforcement focus on high-volume, templated superannuation switching advice and lead-generation arrangements. Compliance teams at advice licensees should treat this as a clear benchmark for adviser involvement and supervision.

BaFin has issued a public warning about schelhammer-systems(.)com, whose unknown operators are suspected of offering banking, financial, and cryptocurrency services in Germany without the required authorization. The warning is a consumer-protection and fraud-prevention signal. Compliance teams should treat it as a trigger to update screening lists, monitor for related payment flows, and reinforce fraud awareness.