Find the Right GRC Solution

Search and compare GRC technology built for the problems you’re trying to solve

Compliance & Ethics

EIOPA Confirms Q&A 2753 Will Be Amended to Align CIC 86-88 Reporting with ITS 2.10.0

EIOPA has agreed that the 2023 ITS amendments (taxonomy 2.10.0) conflict with its earlier Q&A 2753 on mapping loan CIC codes 86, 87 and 88 to Solvency II balance sheet lines R0240 and R0250. Q&A 2753 will be amended, but the revised wording has not yet been published. Insurers should treat the ITS as the governing text and review their S.02.01 and S.06.02 mappings for consistency.

ECB Working Paper Finds Austrian Loan Moratoria Boosted Investment Without Raising Defaults

An ECB working paper (No 3282) analyzes the 2020 Austrian corporate loan moratoria. It finds a 44% take-up rate, higher investment and profitability, and no spike in defaults once repayments resumed. The paper is research, not binding regulation, and does not represent ECB views. It can still inform how banks and compliance teams prepare for future crisis relief programs, including forbearance, staging, and stigma risks.

Bundesbank Executive Board Raises No Objections to Nimmermann Nomination

The Deutsche Bundesbank's Executive Board completed its statutory consultation under section 7 (3) of the Bundesbank Act on September 16, 2026, and raised no objections to Dr Philipp Nimmermann's nomination. The outcome has been communicated to the Bundesrat. This is a governance and personnel update with no new regulatory obligations, but compliance teams should track the resulting leadership change and the pending allocation of portfolios.

Norway FSA Flags swissinvestmentsa.ch on Warning List Citing FINMA Alert

The Norway Financial Supervisory Authority (Finanstilsynet) has published a warning on the website swissinvestmentsa.ch, which the source material links to a prior warning from the Swiss regulator FINMA. Compliance teams should treat the domain as a suspected unauthorized or fraudulent investment operation and update screening and client-protection controls accordingly.

ESAs Issue Operational Instructions to Improve DORA Major ICT Incident Reporting Quality

On September 16, 2026, the ESAs published 14 operational instructions to harmonize how major ICT-related incidents are reported under DORA and to fix recurring data quality issues. The instructions are non-binding "best efforts" guidance, but they were agreed with competent authorities and signal supervisory expectations. Compliance teams should align reporting templates and procedures now to avoid rejected, inconsistent, or duplicated submissions.

FINRA Fines Webull $4.2 Million Over Anti-Money Laundering & Trading Oversight Failures

The Financial Industry Regulatory Authority (FINRA) has fined Webull $4.2 million for widespread failures in its anti-money laundering controls, identity theft prevention program and oversight of customer trade execution, citing deficiencies that persisted for years as the online brokerage rapidly expanded.

Dutch ACM Drafts Policy Rule on Telecom Contract Expiration and Best-Rate Notices

The Netherlands Authority for Consumers and Markets (ACM) has issued a draft policy rule clarifying how telecom providers must notify customers about expiring contracts, free termination rights, and cheaper rates. The rule targets loyalty penalties and sets specific requirements for timing, format, and content. Providers should assess their current communications now, as consultation closes 27 October 2026 and a final rule is expected before year-end.