AI Governance

The FDIC, Federal Reserve, NCUA, and OCC have jointly requested comment on proposed non-binding third-party risk management guidance that would rescind and replace the current guidance once finalized. A companion statement on community bank engagement with core service providers outlines factors the agencies will weigh in supervisory and enforcement decisions. Compliance teams should begin gap assessments now and consider submitting comments before the 60-day window closes.

In a speech delivered in his personal capacity, a PCAOB Board member urged the Board to revisit the audit firm metrics disclosure rule it adopted in 2024 and withdrew from SEC review in early 2025. He also outlined recent PCAOB initiatives, including amended QC 1000 (effective December 15, 2026), inspection modernization, and a draft 2026-2030 strategic plan. Compliance teams and audit committees should prepare for possible changes to audit oversight and firm transparency, though the remarks are not binding.

On September 11, 2026, the Hong Kong SFC issued a circular notifying licensed corporations, SFC-licensed virtual asset service providers (VASPs), and associated entities that amendments to the Haiti and Yemen UN sanctions regulations took effect immediately upon Gazette publication. The amendments renew financial sanctions and travel bans for both jurisdictions and revise Haiti's arms embargo requirements. Because there is no transition period, compliance teams must promptly confirm that screening and controls reflect the updated regimes.

Japan's Financial Services Agency (FSA) reported 15,418 inquiries to its Financial Services User Consultation Office for April 1 to June 30, 2026, down 347 from the prior quarter. Investment products drew the most inquiries (5,603), and the FSA identified 1,961 fraudulent investment solicitation cases, 1,616 involving some form of damage. Because the FSA feeds this data into supervisory monitoring, compliance teams should treat it as an indicator of likely examination and hearing priorities.

On September 11, 2026, BaFin warned consumers about loan offers on the website prokredits(.)com, operated under the name "Pro Kredits," which is offering loan agreements in Germany without the required authorization. The warning is a reminder that unlicensed lending activity remains an active fraud risk. Compliance teams should consider it in their fraud, onboarding, and counterparty monitoring controls.

The Netherlands Authority for Consumers and Markets (ACM) has told all energy suppliers in a letter that telemarketers may not pose as independent comparison services when selling energy contracts. Suppliers that use such intermediaries must show ACM what measures they are taking to ensure full compliance. The action reinforces that the contracting supplier is accountable for the entire sales process, including third-party sellers acting on its behalf.

At the 2026 Green Fintech Symposium, HKMA Chief Executive Eddie Yue called on the financial sector to use technology and data to direct capital to high-impact decarbonization projects and guard against greenwashing. The event introduced no new rules or deadlines, but it signals HKMA supervisory priorities on climate risk, ESG data integrity, and AI-enabled sustainable finance. Compliance teams should treat it as a directional indicator when planning ESG and climate-risk controls.