GRC Report Staff

The HKMA has released detailed guidance drawn from the second cohort of its GenA.I. Sandbox, covering 27 use cases across 20 banks and 14 technology partners. The report provides practical reference points on data strategy, solution design, and risk mitigation for generative AI and AI agent deployments, directly supporting application of the HKMA's updated Supervisory Guidance for Responsible Adoption of Artificial Intelligence (the "ART" framework: Accountability, Resilience, Trust).

The Spanish Data Protection Agency (AEPD) issued an opinion limiting a medical college's transfer of members' national ID numbers (DNI) and dates of birth to a regional health service for temporary disability control purposes. The ruling confirms that only data on doctors actually competent to issue disability reports within the requesting authority's territory may be shared, and that DNI (not date of birth) is the only additional identifier proportionate to the stated purpose. This decision offers a useful precedent on data minimization and purpose limitation for any organization sharing professional registry data with public administrations.

Norway's Finanstilsynet has issued a public warning against Fondavex, operating under the Shinenwt trading platform, for soliciting Norwegian investors without authorization. The case highlights continuing risks from unlicensed cross-border crypto and investment platforms using aggressive sales tactics and fabricated performance data to defraud retail investors.

The CFTC has recorded a self-certification filing from ROTHDCM for a new event-based swap contract tied to the outcome of the NBA Cup Championship. This filing reflects the continued expansion of designated contract markets into sports-outcome event contracts, requiring compliance teams to monitor product listings for market integrity and suitability concerns.

The Ontario Securities Commission has issued a public warning identifying Risance Ltd. and Smjer Fundark as unregistered entities not authorized to deal or advise in securities in Ontario. Compliance teams at registered firms should be aware of this warning to help identify potential fraud patterns, support client inquiries, and reinforce anti-fraud monitoring protocols.

EIOPA's annual factsheet shows EEA insurers held EUR 7.9 trillion in government bonds, corporate bonds, and equities at year-end 2025, with notable home bias persisting in fixed income and growing unit-linked cross-border exposure. While not a binding regulatory requirement, the data provides compliance and risk teams with benchmarking insight into investment concentration, sovereign exposure, and diversification trends relevant to Solvency II prudent person principle assessments.

The Bundesbank's October 14, 2026 auction increased two outstanding federal bonds (maturing 2047 and 2056), raising a combined EUR 1,888.79 Million in allocations against total bids of EUR 3,860.00 Million. This is a routine sovereign debt issuance update with limited direct compliance impact but is relevant for institutions tracking German sovereign debt supply, market maintenance obligations, and fixed-income portfolio exposures.