GRC Report Staff

The OCC issued proposed third-party risk management guidance that would let banks scale oversight to the magnitude and likelihood of harm from each relationship, rather than following broad, process-driven approaches. It also clarified its risk-based supervision and enforcement of core service providers to help community banks facing due diligence, monitoring, and contract challenges. Compliance teams should assess how their current frameworks would change and consider submitting comments.

The Administrative Review Tribunal affirmed ASIC's five-year bans on former advisers Andrew Hanley and Shane Monte Silva, finding that advisers cannot outsource fact-finding or Statement of Advice content to unlicensed telemarketers or paraplanners. The decisions confirm that these obligations fall personally on the adviser and signal continued enforcement focus on high-volume, templated superannuation switching advice and lead-generation arrangements. Compliance teams at advice licensees should treat this as a clear benchmark for adviser involvement and supervision.

BaFin has issued a public warning about schelhammer-systems(.)com, whose unknown operators are suspected of offering banking, financial, and cryptocurrency services in Germany without the required authorization. The warning is a consumer-protection and fraud-prevention signal. Compliance teams should treat it as a trigger to update screening lists, monitor for related payment flows, and reinforce fraud awareness.

Germany's current account surplus widened to EUR $21.2 Billion in July 2026, up EUR $2.3 Billion from June, driven by a larger goods surplus. The financial account swung to net capital imports of EUR $3.8 Billion, with heavy foreign purchases of German public-sector bonds. This is a statistical release rather than a rule change, but it offers context for compliance and risk teams monitoring cross-border flows, counterparty exposure, and reporting.

On September 11, 2026, BaFin issued a warning about the website protrader-finanz(.)de and emails from info@protrader-finanz(.)de, whose operators are allegedly offering fixed-term deposit investments without the required authorization. The notice is a consumer and market protection alert, not a new rule, but it gives compliance teams actionable indicators for fraud detection, customer protection, and sanctions or blocklist screening.

A Hong Kong Monetary Authority research memorandum finds that private equity (PE) ownership of Asia-Pacific (APAC) insurers is rising and is associated with larger allocations to opaque, higher-risk private credit (PC). The paper is not a rule or a directive, but it signals supervisory attention to contagion risk between the private finance ecosystem and insurers. Compliance and risk teams should treat it as an early indicator of possible scrutiny of investment governance, capital treatment, and disclosure.

The FDIC, Federal Reserve, NCUA, and OCC have jointly requested comment on proposed non-binding third-party risk management guidance that would rescind and replace the current guidance once finalized. A companion statement on community bank engagement with core service providers outlines factors the agencies will weigh in supervisory and enforcement decisions. Compliance teams should begin gap assessments now and consider submitting comments before the 60-day window closes.