GRC Report Staff

EIOPA's article, published in connection with Eurofi, argues that the Insurance Distribution Directive (IDD) is broadly technology-neutral but must be applied consistently as AI chatbots, digital platforms, and agentic AI blur the lines between insurance, investment, and crypto-asset distribution. Supervisory focus is expected to move from individual products and firms to the governance of the entire digital customer journey. Compliance teams should assess now whether their AI-enabled tools could be treated as insurance distribution.

The SEC approved FINRA's new Rule 3290 on September 15, 2026. It replaces Rules 3270 (Outside Business Activities) and 3280 (Private Securities Transactions) with a single consolidated rule and eliminates reporting of non-investment-related activities. The effective date has not been announced, so compliance teams should begin planning policy and procedure updates now.

The European Parliament has confirmed Thomas Gstädtner as Executive Director of the European Banking Authority (EBA) for a renewable five-year term. The appointment introduces no new regulatory requirements, but it marks a leadership transition that compliance teams should monitor for possible shifts in the EBA's operational priorities and supervisory engagement.

The Deutsche Bundesbank Executive Board held its hearing on September 16, 2026, on the nomination of Dr. Philipp Nimmermann and raised no objections. The outcome has been communicated to the Federal Council. This is a governance and personnel update with no direct regulatory obligations, but it is relevant for compliance teams that track German and Eurosystem supervisory leadership.

ASIC's Form COI4 requires unlicensed carried over instrument (COI) lenders to lodge an annual compliance certificate by 15 August each year. The certificate covers business activity data, oversight personnel, risk status, general conduct obligations, and dispute resolution outcomes. Compliance teams should note that the form is dated 31 October 2018 (guide dated 21 November 2014), even though the update is listed as 2026-09-16, so they should confirm whether the content has changed.

ASIC Form 2205 is the prescribed form for notifying ASIC of company resolutions affecting shares, including share rights alterations, consolidations and subdivisions, capital reductions, and financial assistance approvals. Lodgement deadlines are short (14 days for most categories, one month for consolidations and subdivisions), so compliance teams need clear internal processes to avoid late lodgement and the associated public register and penalty exposure.

On September 16, 2026, BaFin issued a public warning that the unknown operators of xlla(.)tech are offering banking, financial, and cryptocurrency services in Germany without authorization. They pose as a fictitious Swiss company called "XLLA." Compliance teams should treat this as a fraud and sanctions-screening indicator and update their monitoring and customer-protection controls accordingly.