GRC Report Staff

BaFin has issued a warning against Zaif Co. Ltd., which recruits "office clerks working from home" through Telegram chats to receive third-party payments in their own bank accounts and forward them or convert them to cryptocurrency. The funds likely derive from fraud victims, so the scheme presents money laundering and mule account risks. Compliance teams should treat the warning as a typology and monitoring input for transaction surveillance and customer education.

BaFin has published Circulars 10/2026 (BA) and 11/2026 (BA), setting out its administrative practice and expectations for appointing refinancing register administrators under the KWG and trustees under the PfandBG, including their deputies. Institutions must demonstrate that candidates are independent, reliable, and sufficiently expert. Compliance teams at covered institutions should review their appointment files and processes against these expectations.

The FCA has published Feedback Statement FS26/1 summarizing 123 responses to its May 2026 joint Call for Input with the Bank of England on wholesale market tokenization. Respondents backed the proposed approach and identified post-trade activity, especially collateral movement, as the main opportunity. The statement imposes no new obligations, but it previews a joint roadmap due later in 2026 and a safeguarding consultation in the first half of 2027, so compliance teams should begin planning now.

The CNMV has completed its review of the first AML/CFT information reports (BCFT1, covering 2025) submitted by securities firms and agencies, asset managers, and crypto asset service providers. Overall report quality was adequate, but the CNMV found erroneous and inconsistent data and signs of possible compliance gaps, particularly in alert generation and special examinations. Compliance teams should expect these findings to inform further supervisory work.

BaFin has amended the Securities Institutions Audit Report Regulation and the Crowdfunding Service Providers Audit Regulation, effective September 11, 2026, to align audit requirements with DORA (Regulation (EU) 2022/2554). Auditors must now apply these more detailed requirements during annual audits, so compliance teams at affected firms should confirm their ICT risk documentation and evidence are audit-ready.

The FCA has issued a Call for Input, open until October 23, 2026, on whether tokenizing physical gold could improve trading, collateral mobilization, and settlement in UK wholesale markets. It also asks whether uncertainty over the collective investment scheme (CIS) and alternative investment fund (AIF) perimeter is holding back product development. Compliance teams should treat this as an early signal of policy direction and consider responding, because outcomes could include guidance, an "eligible gold token" classification, targeted exemptions, or a bespoke regime.

An ECB working paper (No 3280) finds that Federal Reserve policy changes pass through only weakly and unstably to stablecoin deposit rates in DeFi lending protocols, with short-run moves often in the opposite direction. It is research and not binding regulation, and the authors' views do not represent the ECB's. Even so, it signals supervisory attention to stablecoin and DeFi linkages with traditional finance, which matters for institutions with crypto exposure, tokenized-asset plans, or stablecoin-related partnerships.