GRC Report Staff

The FCA has added ExoticInvest Trading and Investment Firm to its Warning List for providing or promoting financial services in the UK without authorization. Consumers dealing with this firm have no access to the Financial Ombudsman Service or FSCS protection, increasing the risk of financial loss with no recourse. Compliance teams should treat this as a reminder to reinforce due diligence and third-party screening controls against unauthorized entities and clone firm scams.

The SEC's Investor Advisory Committee will hold a public meeting on September 10, 2026, to examine artificial intelligence's role in the public markets information ecosystem and to discuss Regulation National Market System (Reg NMS) rules. While this is a discussion and advisory forum rather than a rulemaking action, it signals the SEC's continued focus on AI oversight and market structure reform, both of which may foreshadow future regulatory proposals.

The SEC has proposed rescinding Rule 206(4)-5, the "pay-to-play" rule that bars investment advisers from receiving compensation for advisory services to government clients for two years following certain political contributions. The agency cites implementation challenges and unintended consequences, concluding that existing Advisers Act provisions are likely sufficient to address pay-to-play risks. Compliance teams at investment advisory firms serving public pension funds and government entities should closely monitor this proposal, as it could significantly ease current political contribution restrictions and related recordkeeping burdens.

The CNIL sanctioned HÔPITAL PRIVÉ DE LA LOIRE EUR 500,000 after a 2025 cyberattack exposed health data of 524,867 patients and personal data of 202,246 trusted third parties, citing failures to implement basic security measures (Article 32) and notify all affected data subjects (Article 34). This case underscores regulators' increasing scrutiny of healthcare data security architecture, particularly authentication, access controls, and breach monitoring, and reinforces that breach notification obligations extend beyond primary data subjects to any individual whose data was compromised.

The CNIL sanctioned HÔPITAL PRIVÉ DE LA LOIRE EUR 500,000 after a 2025 cyberattack exposed data on 524,867 patients and 202,246 trusted third parties, citing weak authentication, inadequate access controls, and failure to notify all affected individuals. The case underscores regulators' increasing scrutiny of healthcare data security fundamentals and the obligation to notify all categories of affected data subjects, not just primary data owners.

The FCA's Smart Data Accelerator has published findings from a June 2026 policy sprint examining how open finance could transform mortgage journeys, concluding that infrastructure, trust, and accountability—not just data access—are the critical barriers to adoption. While this report sets no binding requirements, it signals likely future FCA policy direction on data standards, mandatory participation, and accountability frameworks that mortgage lenders and open finance participants should begin monitoring closely.

The FCA's Smart Data Accelerator has published findings from a June 2026 policy sprint examining how open finance could transform mortgage journeys, concluding that infrastructure, trust, and accountability—not just data access—are the critical barriers to adoption. While this report sets no binding requirements, it signals likely future FCA policy direction on data standards, mandatory participation, and accountability frameworks that mortgage lenders and open finance participants should begin monitoring closely.