GRC Report Staff

The UK Information Commissioner's Office (ICO) has confirmed a live investigation into whether Police Scotland is meeting its legal obligations when handling subject access requests (SARs), including statutory response timescales. Although the matter concerns a law enforcement body, it signals continued regulatory focus on SAR compliance that financial institutions should treat as a prompt to review their own processes.

The OCC, Federal Reserve, and FDIC jointly issued a statement clarifying how they will apply risk-based supervision to certain services core providers deliver to community banking organizations. The statement outlines factors the agencies will weigh in supervisory and enforcement decisions, including where a core provider causes a bank to engage in unsafe or unsound practices or violations of law. Community banks and their compliance teams should reassess core provider oversight and contract practices.

The ACPR and AMF will host the 10th-anniversary Fintech Forum on October 2, 2026, at the Bank of France Conference Center in Paris, as part of the French FinTech Weeks. The agenda signals current supervisory priorities, including tokenization and DLT, MiCA, AML/CFT, digital operational resilience, crowdfunding, and payment services. It offers compliance teams direct access to French regulators.

The Bank of England's September 2026 Agents' summary of business conditions describes an uneven UK economy. Output and confidence have improved in select sectors, but construction, property, and consumer spending remain weak. This is not a rule change, but it gives compliance and risk teams useful context for credit risk, conduct, and operational resilience planning, particularly given rising household strain, tighter lending competition, and persistent input cost pressures.

Former PWM director and financial adviser Donald Cuthbertson has pleaded not guilty to 24 offenses under the Corporations Act and Crimes Act, including false or misleading representations to investors and attempting to pervert the course of justice. The case shows ASIC's continued use of criminal referrals against misconduct by licensees and their controllers, and it is a useful reference point for firms reviewing investor communications, governance, and conduct controls.

The September 11, 2026 NYDFS Weekly Banking Bulletin records the receipt of applications for a merger of American Community Bank into Alma Bank, along with a series of mortgage, premium finance, sales finance, and budget planner licensing actions. The bulletin is the only written notice of these submissions, and the comment period on the merger applications closes October 12, 2026. Compliance teams should check the filings for relevance to their institutions and calendar the deadlines.

Finanstilsynet (Norway FSA) has published a warning about TradeWell, referencing a warning issued by the UK Financial Conduct Authority (FCA). The notice signals that TradeWell may be offering financial services without proper authorization, so compliance teams should screen for exposure and update their watchlists.