AI Governance

On September 11, 2026, Japan's Financial Services Agency (FSA) issued a written warning against Bit Hills Inc., a British Virgin Islands-based entity that operates the online lending platform "CryptoPawn" without registration as a money lender. The action shows continued FSA enforcement against offshore, internet-based lenders that target Japanese residents. Compliance teams should use the warning to update screening, counterparty, and fraud-prevention controls.

The OCC, with the Federal Reserve, FDIC, and NCUA, has issued proposed guidance that would revise and replace existing third-party risk management guidance and ask banks to tailor their practices to the assessed risk of each relationship. The guidance is non-enforceable, but it will likely shape examiner expectations and would apply to community banks once final. Compliance teams should review current programs and consider submitting comments within 60 days of Federal Register publication.

The Norway Financial Supervisory Authority has issued a warning about "GM Trade / GM TradeAI," referencing a FINMA (Switzerland) warning-list entry. Compliance teams should treat the entities as unauthorized or high-risk and screen for any exposure, since the source content is minimal and details must be verified directly with FINMA.

In a speech at Global FinTech Fest 2026, MAS Managing Director Chia Der Jiun signaled that supervisory focus is on AI governance, agentic AI safeguards, and cyber resilience as AI-enabled threats escalate. The speech points to the pending Guidelines for AI Risk Management, the SAFR framework, and Nexus payments connectivity. Compliance teams should treat these as indicators of upcoming supervisory expectations, even though the speech itself is not binding.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about ambrielle-novairex-fr.com, a site originally blacklisted by France's Autorité des Marchés Financiers (AMF) under its crypto-currency category. Compliance teams should treat the domain as a high-risk, likely fraudulent or unauthorized platform and update screening and customer-protection controls accordingly.

ECB Executive Board member Philip Lane presented the September 2026 staff projections. They show 2026 headline HICP inflation of 3.0% (energy inflation of 9.3%) following an oil price shock tied to a conflict that began in March 2026, with real GDP growth of 1.2% to 1.4% projected for 2026 to 2028. This is a speech, not a rule, so it creates no direct compliance obligations. It does shape the macro assumptions behind stress testing, interest rate risk, credit risk, and capital planning at euro area institutions.

BaFin has warned against bi-ventures(.)de, biventures-kundenportal(.)de, and berlinventures(.)com, along with emails from the associated domains, for offering overnight and fixed-term deposit accounts without authorization. The warning is issued under Section 37 Paragraph 4 of the Banking Act. Compliance teams should treat it as a fraud typology and screening input, because it signals impersonation and unauthorized deposit-taking risk affecting customers, counterparties, and payment flows.