AI Governance

The CFTC's Part 165 establishes the framework for its whistleblower award program under Section 23 of the Commodity Exchange Act, including eligibility, submission procedures, confidentiality, and anti-retaliation protections. Compliance teams at CFTC-regulated firms should treat this as a core reference for internal reporting program design, because the rules reward employees who report externally and create incentives that interact directly with internal reporting channels.

Following a May-June 2026 risk-based inspection, Finanstilsynet identified elevated credit risk at Sparekassen Danmark and issued one formal order: the bank's compliance function must assess whether its compliance procedures and methods are effective, rather than relying mainly on document reviews. The solvency requirement was unchanged at 9.5 percent, but the findings show supervisory expectations for second-line testing and credit underwriting discipline that other institutions should heed.

The FCA's Perimeter Guidance Manual (PERG) sets out when firms need authorization or exemption under the Financial Services and Markets Act 2000. The current text carries a notice that PERG has not yet been updated for the new regulated activity of providing targeted support, and it highlights the cryptoasset guidance in PERG 18. Compliance teams should treat the perimeter analysis for these areas as provisional and watch for further FCA changes.

BaFin has warned the public about a series of nearly identical websites, run by unknown operators, that promote an AI-based investment platform under the names "Nevald," "Rendzyx," and "Zinsoren" without the required authorization. Compliance teams should treat the listed domains as indicators of investment fraud and use them to strengthen fraud detection, customer protection, and monitoring controls.

Nearly a quarter of senior business leaders surveyed by Deloitte say their organizations have yet to establish clear accountability when artificial intelligence produces a negative outcome. At the same time, 40% report allowing AI to execute decisions or take actions without human approval to at least a moderate degree.

ASIC Form 5290 is the notice a CCIV's responsible person must lodge when a financial product in a Product Disclosure Statement (PDS) relating to a CCIV sub-fund is no longer available to be recommended or offered to new clients. The notice is due within 5 business days of the cessation, and late fees apply. Compliance teams should build this trigger into product lifecycle and disclosure governance to avoid breaches of s1015D(2)(c) of the Corporations Act 2001.

ASIC Form 5299 is the notification a corporate collective investment vehicle (CCIV) must lodge when it files half-yearly financial reports as a disclosing entity. Lodgement is due within 75 days after the end of the accounting period, and late lodgement triggers fees. Compliance teams should confirm that sub-fund reporting, director sign-off, and lodgement calendars are in place. Note that the form version is dated 1 December 2023, while the update is listed as 2026-09-16, so this appears to be a republication of an existing form rather than a new requirement.