GRC Report Staff

The SEC has proposed rescinding Rule 206(4)-5, the "pay-to-play" rule that bars investment advisers from receiving compensation for advisory services to government clients for two years following certain political contributions. The agency cites implementation challenges and unintended consequences, concluding that existing Advisers Act provisions are likely sufficient to address pay-to-play risks. Compliance teams at investment advisory firms serving public pension funds and government entities should closely monitor this proposal, as it could significantly ease current political contribution restrictions and related recordkeeping burdens.

The CNIL sanctioned HÔPITAL PRIVÉ DE LA LOIRE EUR 500,000 after a 2025 cyberattack exposed health data of 524,867 patients and personal data of 202,246 trusted third parties, citing failures to implement basic security measures (Article 32) and notify all affected data subjects (Article 34). This case underscores regulators' increasing scrutiny of healthcare data security architecture, particularly authentication, access controls, and breach monitoring, and reinforces that breach notification obligations extend beyond primary data subjects to any individual whose data was compromised.

The CNIL sanctioned HÔPITAL PRIVÉ DE LA LOIRE EUR 500,000 after a 2025 cyberattack exposed data on 524,867 patients and 202,246 trusted third parties, citing weak authentication, inadequate access controls, and failure to notify all affected individuals. The case underscores regulators' increasing scrutiny of healthcare data security fundamentals and the obligation to notify all categories of affected data subjects, not just primary data owners.

The FCA's Smart Data Accelerator has published findings from a June 2026 policy sprint examining how open finance could transform mortgage journeys, concluding that infrastructure, trust, and accountability—not just data access—are the critical barriers to adoption. While this report sets no binding requirements, it signals likely future FCA policy direction on data standards, mandatory participation, and accountability frameworks that mortgage lenders and open finance participants should begin monitoring closely.

The FCA's Smart Data Accelerator has published findings from a June 2026 policy sprint examining how open finance could transform mortgage journeys, concluding that infrastructure, trust, and accountability—not just data access—are the critical barriers to adoption. While this report sets no binding requirements, it signals likely future FCA policy direction on data standards, mandatory participation, and accountability frameworks that mortgage lenders and open finance participants should begin monitoring closely.

Consumer advocacy group Consumer Voice has filed a Reply in Upper Tribunal proceedings arguing the FCA's motor finance Consumer Redress Scheme (CRS) will undercompensate millions of consumers by billions of pounds, while three lenders (CA Auto Finance, Mercedes-Benz Financial Services, and Volkswagen Financial Services) simultaneously challenge the scheme seeking to limit their liability further. The outcome of these combined Tribunal challenges will determine final redress methodology, timing, and quantum for an estimated 12.1 million eligible motor finance agreements, creating material uncertainty for firms' redress provisioning and operational planning.

The SEC is proposing to rescind the "pay-to-play" rule which restricts investment advisers from providing services to government clients following political contributions. This move addresses operational complexities and unintended consequences, such as the prohibition of state-level donations and strict liability for minor "foot faults."