GRC Report Staff

The FCA has published guidance explaining how the UK's new cryptoasset regime applies to firms and which activities may require authorization. With the authorization gateway opening on September 30, 2026 and the regime taking effect on October 25, 2027, compliance teams should use the guidance now to assess perimeter exposure and prepare applications. Further targeted changes are expected through an October consultation.

EIOPA's Eurofi article argues that private credit, Asset Intensive Reinsurance (AIR), and ICT third-party dependencies should be assessed together, because their capacity to interact and amplify one another is what creates systemic risk. The article is not a binding rule, but it signals supervisory priorities. Compliance teams should expect closer scrutiny of AIR, illiquid asset exposures, and DORA implementation.

The ECB's September 2026 wage tracker update shows negotiated wage growth of 2.7% in Q1 2027 and 2.8% in Q2 2027, up modestly from 2.2% in 2026 (smoothed). This is a statistical release, not a regulatory mandate, but it informs the monetary policy outlook, interest rate expectations, and the wage and inflation assumptions used in financial institutions' risk models and stress tests. Employee coverage for 2027 is still low (32.5% in Q1 and 25.1% in Q2), so the forward-looking figures are likely to be revised.

The European Central Bank has published the September 2026 membership list of the Digital Euro Rulebook Development Group (RDG). The group includes market representatives from banks, payment institutions, third-party providers, consumers, merchants, and SMEs, along with Eurosystem central banks and observers from EU institutions. Compliance teams should treat this as a signal of who is shaping the digital euro's scheme-level rules and where to direct engagement and monitoring efforts.

EIOPA's article, published in connection with Eurofi, argues that the Insurance Distribution Directive (IDD) is broadly technology-neutral but must be applied consistently as AI chatbots, digital platforms, and agentic AI blur the lines between insurance, investment, and crypto-asset distribution. Supervisory focus is expected to move from individual products and firms to the governance of the entire digital customer journey. Compliance teams should assess now whether their AI-enabled tools could be treated as insurance distribution.

The SEC approved FINRA's new Rule 3290 on September 15, 2026. It replaces Rules 3270 (Outside Business Activities) and 3280 (Private Securities Transactions) with a single consolidated rule and eliminates reporting of non-investment-related activities. The effective date has not been announced, so compliance teams should begin planning policy and procedure updates now.

The European Parliament has confirmed Thomas Gstädtner as Executive Director of the European Banking Authority (EBA) for a renewable five-year term. The appointment introduces no new regulatory requirements, but it marks a leadership transition that compliance teams should monitor for possible shifts in the EBA's operational priorities and supervisory engagement.