GRC Report Staff

The OCC, with the Federal Reserve, FDIC, and NCUA, has issued proposed guidance that would revise and replace existing third-party risk management guidance and ask banks to tailor their practices to the assessed risk of each relationship. The guidance is non-enforceable, but it will likely shape examiner expectations and would apply to community banks once final. Compliance teams should review current programs and consider submitting comments within 60 days of Federal Register publication.

On September 11, 2026, the Austrian Financial Market Authority (FMA) issued a public warning about BCLS Assets, an entity apparently based in Switzerland, for offering securities services in Austria without the required license. Compliance teams should treat the entity as a high-risk, unauthorized counterparty and update screening and monitoring controls accordingly.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning that relays a French Autorité des marchés financiers (AMF) blacklist entry for the website amf.eigen.eng.br. The AMF lists the site under its "usurpation" category, meaning it appears to impersonate the AMF itself. Compliance teams should treat the domain as a fraud indicator and update their screening and customer-protection controls.

The Norway Financial Supervisory Authority has issued a warning about "GM Trade / GM TradeAI," referencing a FINMA (Switzerland) warning-list entry. Compliance teams should treat the entities as unauthorized or high-risk and screen for any exposure, since the source content is minimal and details must be verified directly with FINMA.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about cryptobullbear.com, which the French Autorité des Marchés Financiers (AMF) added to its blacklist of crypto-currency websites. Compliance teams should treat the domain as a high-risk, likely unauthorized actor and update screening and customer-protection controls accordingly.

The CFTC approved a final rule establishing a 30 percent presumptive award for whistleblower awards of USD $5 Million or less, subject to Commission discretion and its analysis of relevant regulatory factors. Modeled on SEC Rule 21F-6(c), the rule aligns the two agencies' whistleblower frameworks. Compliance teams should reassess internal reporting programs, because the clearer and more predictable award structure may increase incentives for employees to report externally.

The Bundesbank's September 11, 2026 press release shows domestic bond issuance surged in July 2026, driven by federal government and credit institution issuance and heavy foreign investor demand. This is a statistical release, not a rule change, so it creates no new obligations. It does provide useful market context for compliance, treasury, and risk teams assessing liquidity, concentration, and funding conditions.