GRC Report Staff

On September 15, 2026, the SEC approved FINRA Rule 3290, as modified by Partial Amendment No. 1. The rule replaces Rules 3270 (Outside Business Activities) and 3280 (Private Securities Transactions) with a single framework that narrows reportable activity to investment-related activities. Compliance teams at member firms will need to revise policies, procedures, and surveillance to reflect the new scope, categories, and assessment factors.

The Hong Kong Monetary Authority (HKMA) allotted HKD $64.979 Billion of 91-day and HKD $14 Billion of 182-day Exchange Fund Bills on September 15, 2026, with accepted average yields of 2.83% and 3.02%. This is a routine market operation and not a new compliance requirement. It does show strong demand and the current short-term HKD rate environment, which matters for treasury, liquidity, and market risk monitoring.

BaFin has warned the public about festgeldlotse(.)de, whose unknown operators are suspected of offering financial and securities services without authorization while falsely claiming a link to Munich-based TFD KVG GmbH. BaFin confirms this is identity theft and that the named firm has no connection to the site. Compliance teams should treat the warning as a fraud-typology and brand-impersonation alert and update their controls accordingly.

The Austrian Financial Market Authority (FMA) fined a management board member of an issuer EUR 18,000 under the Market Abuse Regulation (MAR) for failing to notify a personal transaction within three business days. The decision is final and was resolved through an accelerated procedure. It shows that regulators enforce managers' transaction (PDMR) reporting deadlines strictly, even for single late filings by individuals.

The HKMA has alerted the public to fraudulent websites and internet banking login screens impersonating four Hong Kong banks: The Bank of East Asia, Shanghai Commercial Bank, Chong Hing Bank, and Fubon Bank (Hong Kong). The alert restates that banks do not send SMS or emails with embedded hyperlinks for transactions and do not request sensitive credentials. Compliance teams should treat it as a prompt to review fraud controls, customer communications, and incident response procedures.

The Eurosystem has opened a call for expression of interest for euro area e-commerce and m-commerce merchants to take part in the 12-month digital euro pilot, with applications due by 17:00 CET on October 27, 2026. Participation is voluntary and unpaid, but selected merchants must sign a merchant participation agreement with the ECB and arrange a contract with an acquiring pilot PSP. Compliance teams at merchants, PSPs, and acquirers should assess the contractual, operational, and regulatory implications now.

The ACPR released a three-part video series marking the 10th anniversary of its Fintech-Innovation hub. It reinforces the regulator's view that innovation, regulation, and supervision must advance together, and it highlights the FinTech Charter, which commits the ACPR to initial feedback within two weeks. The release creates no new obligations, but it signals supervisory priorities, especially around AI, and shows how firms can engage early with the regulator.