GRC Report Staff

The FCA has refreshed its operational resilience page to add frontier AI resources and to flag new incident and third party reporting requirements taking effect on 18 March 2027. The existing operational resilience rules remain fully in force, with the March 2025 compliance deadline now past. Compliance teams should confirm they can remain within impact tolerances and begin preparing for the new reporting regime.

ASIC has published Form 520, the Declaration of Solvency that a majority of directors must sign and lodge under section 494 of the Corporations Act 2001 before a company enters a members' voluntary winding up. The declaration carries personal exposure for directors, because it attests that the company can pay its debts in full within 12 months of the winding up commencing. Compliance and legal teams handling entity rationalization or restructuring should confirm their internal processes support an accurate, properly supported declaration.

Japan's Financial Services Agency promulgated Cabinet Office Ordinance amendments under the Financial Instruments and Exchange Act (FIEA) that relax rules on group company bond solicitation and on domestic venture funds investing in overseas venture funds, and that designate rights in depositary receipts without physical certificates as securities. The first two amendments take effect September 16, 2026, and the third on October 5, 2026, so compliance teams have little time to assess impacts and update procedures.

More than a year after the European Union's Digital Operational Resilience Act took effect, Deloitte surveyed 50 financial entities across 13 countries to examine when they expected to achieve full compliance with the regulation.

Meta had planned to introduce new commercial terms on October 30 that could give it access to content published on the websites of businesses using its services. The company would be able to use that material to develop its own products, including artificial intelligence features, without necessarily giving publishers a choice over how their work was used.

The Dutch Data Protection Authority (AP) has published its enforcement policy after receiving questions from organizations about how it conducts proceedings against those suspected of violating privacy rules.

The Central Bank of the United Arab Emirates has fined the local branch of an unnamed foreign bank approximately $54.5 million (AED 200 million) after examinations found significant and repeated failures in its anti-money laundering controls, governance and sanctions compliance. Two senior executives were also penalized, and the bank must undertake a mandatory remediation programme subject to independent validation.