GRC Report Staff

BaFin has warned against bi-ventures(.)de, biventures-kundenportal(.)de, and berlinventures(.)com, along with emails from the associated domains, for offering overnight and fixed-term deposit accounts without authorization. The warning is issued under Section 37 Paragraph 4 of the Banking Act. Compliance teams should treat it as a fraud typology and screening input, because it signals impersonation and unauthorized deposit-taking risk affecting customers, counterparties, and payment flows.

The BfDI has issued recommendations, based on a survey of 1,500 insured persons, urging the German Federal Government to strengthen transparency and granular user controls in the electronic patient file (ePA). From the end of October 2026, pseudonymized medication list data can be extracted for research unless insured persons object. Compliance teams at organizations handling German health data should treat this as a signal of regulatory expectations on consent, control, and transparency.

In his opening remarks at the 2026 Green Fintech Symposium, HKMA Chief Executive Eddie Yue presented a strategy that combines digital data infrastructure (the Commercial Data Interchange and Project CargoX), the next phase of the Hong Kong Taxonomy for Sustainable Finance, and market-led green fintech innovation. The speech sets no new binding requirements, but it signals supervisory priorities on greenwashing, transition-washing, and data-driven climate risk assessment. Compliance teams should treat the Taxonomy as the expected reference standard for sustainability claims and classifications.

HKMA Deputy Chief Executive Darryl Chan said Hong Kong is expanding sustainable finance access for SMEs through a Phase 2B Hong Kong Taxonomy consultation, a broader green debt grant scheme, and a free greenhouse gas emissions calculator. The speech is not binding, but it signals supervisory priorities. Compliance teams should watch the taxonomy consultation, which will shape how transition and adaptation activities are classified and disclosed.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about the website autorite-des-marches-financiers.com, which appears to impersonate France's financial markets regulator, the AMF. The notice relays the AMF's own blacklist entry for the domain. Compliance teams should treat this as a regulator-impersonation fraud indicator and update their screening and customer protection controls.

Japan's Financial Services Agency will not pursue administrative or criminal liability for reports and notifications with legal deadlines that are filed by November 27, 2026, if the earthquake prevented timely submission. The relief also covers reports with no statutory deadline and allows case-by-case extensions for affected institutions headquartered in Kumamoto Prefecture. Compliance teams should confirm eligibility and document the earthquake's impact on filing capacity.

The UK Financial Reporting Council has opened three investigations tied to State Oil Limited (part of the Prax Group): one into an individual accountant's conduct on financing arrangements, and two into statutory audits by KPMG LLP and PKF Littlejohn LLP. The opening of an investigation does not imply any finding of breach or misconduct, but it signals continued FRC scrutiny of audit quality and of professional conduct around financing arrangements. Compliance teams should note the read-across for audit oversight, lender and borrower reporting, and finance function governance.