GRC Report Staff

The FDIC, Federal Reserve, NCUA, and OCC have jointly requested comment on proposed non-binding third-party risk management guidance that would rescind and replace the current guidance once finalized. A companion statement on community bank engagement with core service providers outlines factors the agencies will weigh in supervisory and enforcement decisions. Compliance teams should begin gap assessments now and consider submitting comments before the 60-day window closes.

Senior officials from the SEC, FDIC, CFTC, Federal Reserve Board, and Bank of England held a tabletop exercise on Sept. 3, 2026, to discuss the hypothetical resolution of central counterparties (CCPs). The meeting focused on information sharing and communication arrangements to support financial stability. It introduces no new requirements, but it signals continued cross-border supervisory attention to CCP resilience, which matters for firms with significant clearing exposures.

EIOPA rejected Question 3463 because it sought an interpretation of French national legislation, which is outside the scope of the Q&A process. No new guidance on CIC codes for NEU CP or NEU MTN was issued. Insurers must therefore rely on existing Solvency II reporting rules and their own documented classification judgment.

In a speech delivered in his personal capacity, a PCAOB Board member urged the Board to revisit the audit firm metrics disclosure rule it adopted in 2024 and withdrew from SEC review in early 2025. He also outlined recent PCAOB initiatives, including amended QC 1000 (effective December 15, 2026), inspection modernization, and a draft 2026-2030 strategic plan. Compliance teams and audit committees should prepare for possible changes to audit oversight and firm transparency, though the remarks are not binding.

On September 11, 2026, the Hong Kong SFC issued a circular notifying licensed corporations, SFC-licensed virtual asset service providers (VASPs), and associated entities that amendments to the Haiti and Yemen UN sanctions regulations took effect immediately upon Gazette publication. The amendments renew financial sanctions and travel bans for both jurisdictions and revise Haiti's arms embargo requirements. Because there is no transition period, compliance teams must promptly confirm that screening and controls reflect the updated regimes.

On September 11, 2026, the Austrian Financial Market Authority (FMA) issued a public warning that Clear Markets Europe, apparently based in London, is not authorized to conduct licensable securities transactions in Austria. The firm may not execute client orders under the Securities Supervision Act 2018 (WAG 2018). Compliance teams should treat the entity as a high-risk, unlicensed counterparty and update screening and fraud controls accordingly.

Japan's Financial Services Agency (FSA) reported 15,418 inquiries to its Financial Services User Consultation Office for April 1 to June 30, 2026, down 347 from the prior quarter. Investment products drew the most inquiries (5,603), and the FSA identified 1,961 fraudulent investment solicitation cases, 1,616 involving some form of damage. Because the FSA feeds this data into supervisory monitoring, compliance teams should treat it as an indicator of likely examination and hearing priorities.