GRC Report Staff

FINRA has filed a proposed rule change (SR-FINRA-2026-018) that would extend the maximum Rule 2165 temporary hold from 55 to 145 business days. It would also create new Rule 2166, a safe harbor allowing delays of up to 10 business days on suspected fraud for customers of any age, and would make Rule 4512 trusted contact flexibility changes. Compliance teams should begin assessing procedure, training, and system impacts now, because the SEC is soliciting comments and the final text and effective date are not yet set.

The Danish Financial Supervisory Authority (DFSA) issued a public warning on September 3, 2026 against Corpholding Inc., which is suspected of running a boiler room operation and soliciting Danish consumers without authorization. Compliance teams should treat this as a fraud typology and sanctions-adjacent intelligence item, and update monitoring, screening, and customer-protection controls accordingly.

The Netherlands Data Protection Authority (Autoriteit Persoonsgegevens) has published a downloadable GDPR processing register template, plus a companion privacy notice template, for small and medium-sized enterprises in 10 industries. The templates are practical guidance rather than new law, but they signal the regulator's expectations for Article 30 recordkeeping. Compliance teams should use them as a benchmark for their own programs and for assessing SME vendors and partners.

FINRA has filed a proposed amendment to Rule 4522(b)(1) that would except uncertificated investments in unregistered investment funds from the monthly position statement and reconciliation requirement, replacing it with a quarterly cadence. The change codifies and broadens the relief in a January 2026 SEC staff no-action letter that covered only capital balance funds. Carrying and clearing firms that custody private fund interests should assess how the exception affects their reconciliation procedures, while remembering that SEA Rule 17a-13 quarterly counts and the "prudent business practice" standard still apply.

The Norway Financial Supervisory Authority has posted a warning that originates from Luxembourg's CSSF. It concerns fraudulent actors misusing the name of Luxempart S.A., a Luxembourg-based issuer. Compliance teams should treat it as an impersonation-fraud alert and check their onboarding, payment, and client-communication controls for exposure.

The Norway Financial Supervisory Authority has published a warning about MelzaPlay S.A., an entity identified as a Luxembourg issuer, and it references a CSSF warning about the website www.melzapay.com. The notice indicates that the entity or its website may be offering financial services without proper authorization. Compliance teams should screen for exposure and strengthen controls against potential fraud and unauthorized activity.

The Norway Financial Supervisory Authority (Finanstilsynet) has relayed a warning, originally issued by the UK Financial Conduct Authority (FCA), about a clone of the FCA-authorized firm Quanta North. Clone firms use a legitimate firm's name and credentials to defraud consumers, so compliance teams should update screening and fraud controls and brief customer-facing staff.