GRC Report Staff

On September 16, 2026, BaFin issued a public warning that the unknown operators of xlla(.)tech are offering banking, financial, and cryptocurrency services in Germany without authorization. They pose as a fictitious Swiss company called "XLLA." Compliance teams should treat this as a fraud and sanctions-screening indicator and update their monitoring and customer-protection controls accordingly.

EIOPA's Eurofi article argues that insurance should become an active tool for climate prevention, risk reduction, and adaptation within the forthcoming European Integrated Framework for Climate Resilience. It is a policy-positioning piece rather than binding regulation, but it signals where supervisory expectations, data requests, and consumer-protection monitoring on natural catastrophe risk are heading. Compliance teams should treat it as an early indicator of future scrutiny.

ASIC has extended its Consultation Agreement with the Financial Markets Standards Board (FMSB) by three years, to 25 September 2029. The extension deepens ASIC's engagement in shaping global wholesale market standards, but ASIC states that its participation is not an endorsement and that industry standards do not replace obligations under Australian law. Compliance teams should treat FMSB materials as informative good practice, not as a safe harbor.

The FCA's annual report for the year ended March 31, 2026 (the first year of its 2025 to 2030 strategy) describes a shift from risk elimination to risk rebalancing, with earlier intervention and clearer expectations. Compliance teams should note the Buy Now Pay Later (BNPL) regime effective July 2026, the motor finance redress scheme, the Payment Systems Regulator (PSR) consolidation, and the FCA's expanded AML supervision of professional services firms.

EIOPA's Eurofi article explains that the revised Solvency II framework, applicable from January 30, 2027, is expected to release significant capital through a revised risk margin calculation. That release comes with an explicit political expectation that the capital will support productive European investment. Compliance teams should prepare for new capital treatments, closer supervisory monitoring of capital use, and EIOPA's first report by the end of 2028.

A Board of Appeal member of the European Supervisory Authorities (ESAs), David Ramos Muñoz, has filed a signed declaration of commitment and interests under Article 59(6) of the ESA founding regulations. The document is a routine governance filing with no new obligations for supervised firms. It does, however, reinforce the independence safeguards that underpin the appeals process available to financial institutions.

Norway's Financial Supervisory Authority (Finanstilsynet) published a warning about "Luminex STO," a security token offering whose issuer is listed as based in the Netherlands. The notice points to a Dutch Authority for the Financial Markets (AFM) boiler room warning, which suggests a suspected investment fraud. Compliance teams should treat the entity as high risk and update screening and client-protection controls.