AI Governance

ASIC's Form 509 is the statutory summary of a company's affairs, lodged under section 497(1)(a)(i) of the Corporations Act 2001 when a company is wound up by creditors' voluntary liquidation. It must be lodged within 10 business days of the winding-up resolution meeting, together with Form 5604. Compliance teams should treat it as a routine procedural form rather than a new regulatory change, because the content is a form template dated 1 September 2017 and carries a 2026-09-15 date in the feed.

The ECB's Q2 2026 supervisory statistics for 108 significant institutions show capital at 16.00% CET1 and 20.13% total capital, with return on equity rising to 10.73%. Liquidity and funding ratios remain well above minimums but have eased year over year. This is a statistical release, not a new rule, but it gives compliance and risk teams useful peer benchmarks ahead of supervisory dialogue.

The Bank of England's PRA has updated its guidance on applying for capital waivers, CRR and Basel 3.1 permissions, and modifications by consent (MbC). Key developments include the extension of the Loan to Income (LTI) flow limit MbC to December 31, 2026, new Basel 3.1 permission pathways following PS1/26, and a stronger push toward Portal-based submissions. Compliance teams should verify which permissions and modifications apply to their firms and confirm that application and notification processes are current.

ASIC's Form 578 lets registered liquidators request deregistration of companies in court or creditors' voluntary liquidation when the liquidator is not acting or the company's affairs are fully wound up. It is an administrative form, not a new rule, but accurate and timely use matters for closing out liquidations cleanly. Compliance teams that deal with insolvent entities, whether as creditors, group owners, or service providers, should understand the process and its limits.

At the 10th Global Conference on Criminal Finances and Cryptoassets in Luxembourg, AMLA Executive Board Member Simonas Krepšta identified crypto assets as a strategic priority and outlined the Crypto Action Plan for 2026 and beyond. The message for compliance teams is that regulation alone is not enough: AMLA expects effective implementation, convergent supervision and stronger analytics across the EU crypto sector. Firms should anticipate closer supervisory scrutiny and a forthcoming AMLA report on crypto ML/TF risks.

The FCA has refreshed its operational resilience page to add frontier AI resources and to flag new incident and third party reporting requirements taking effect on 18 March 2027. The existing operational resilience rules remain fully in force, with the March 2025 compliance deadline now past. Compliance teams should confirm they can remain within impact tolerances and begin preparing for the new reporting regime.

“Who owns this service account?” Every security and compliance leader dreads that question during an audit. Too often, no one has a good answer. It points to an accountability model built for humans with badges, in an environment increasingly run by machines.