AI Governance

ASIC's Form COI4 requires unlicensed carried over instrument (COI) lenders to lodge an annual compliance certificate by 15 August each year. The certificate covers business activity data, oversight personnel, risk status, general conduct obligations, and dispute resolution outcomes. Compliance teams should note that the form is dated 31 October 2018 (guide dated 21 November 2014), even though the update is listed as 2026-09-16, so they should confirm whether the content has changed.

On September 16, 2026, BaFin issued a public warning that the unknown operators of xlla(.)tech are offering banking, financial, and cryptocurrency services in Germany without authorization. They pose as a fictitious Swiss company called "XLLA." Compliance teams should treat this as a fraud and sanctions-screening indicator and update their monitoring and customer-protection controls accordingly.

ASIC has extended its Consultation Agreement with the Financial Markets Standards Board (FMSB) by three years, to 25 September 2029. The extension deepens ASIC's engagement in shaping global wholesale market standards, but ASIC states that its participation is not an endorsement and that industry standards do not replace obligations under Australian law. Compliance teams should treat FMSB materials as informative good practice, not as a safe harbor.

A De Nederlandsche Bank working paper surveying 5,672 Dutch respondents finds that 71% know the official cash recommendation but only 58% hold the advised amount, which points to a preparedness gap among households. The paper is research and not binding regulation, but it signals supervisory attention to payment resilience, consumer communication, and fallback capacity. Compliance and operational resilience teams should treat it as an indicator of where expectations may be heading.

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning about fxr-ai.com, a website that France's Autorité des Marchés Financiers (AMF) placed on its blacklist of unauthorized crypto-asset derivatives offerings. Compliance teams should treat the site as a high-risk counterparty and fraud indicator, and update screening and monitoring controls accordingly.

The FCA's PS26/18 finalizes new PERG 18 perimeter guidance, largely as consulted on, to help firms determine whether their cryptoasset activities require authorization when the new regime begins on 25 October 2027. The application window opens 30 September 2026, and existing registrations or permissions will not convert automatically. Compliance teams should start perimeter assessments now, because the guidance does not yet reflect a pending statutory instrument that will change some business model outcomes.

The CFTC's Part 165 establishes the framework for its whistleblower award program under Section 23 of the Commodity Exchange Act, including eligibility, submission procedures, confidentiality, and anti-retaliation protections. Compliance teams at CFTC-regulated firms should treat this as a core reference for internal reporting program design, because the rules reward employees who report externally and create incentives that interact directly with internal reporting channels.