IT Security & Privacy

OSFI will hold its third Quarterly Release Day on September 10, 2026, followed by a virtual Industry Day on September 24, 2026. The sessions cover the final Capital Adequacy Requirements (CAR) Guideline 2027, the final crypto-asset capital and liquidity guideline, Guideline E-15 peer review expectations, AI-driven cyber threats, and Data Collection Modernization. Compliance teams at federally regulated institutions should register and prepare questions, since these topics carry near-term implementation obligations.

FinCEN issued an alert and financial trend analysis on digital asset investment scams ("pig butchering") run by Southeast Asia-based scam centers. The analysis covers 33,904 BSA reports filed between September 8, 2023, and December 31, 2025, totaling approximately USD $12.7 Billion in suspected activity. Compliance teams should update detection scenarios with the newly published red flags and strengthen SAR reporting and information sharing.

The Netherlands Data Protection Authority (Autoriteit Persoonsgegevens) has published a downloadable GDPR processing register template, plus a companion privacy notice template, for small and medium-sized enterprises in 10 industries. The templates are practical guidance rather than new law, but they signal the regulator's expectations for Article 30 recordkeeping. Compliance teams should use them as a benchmark for their own programs and for assessing SME vendors and partners.

APRA has imposed license conditions, a higher minimum liquidity requirement, and an AUD $50 Million operational risk capital add-on on ING Bank Australia Limited after the bank disclosed multi-year miscalculations that overstated its Liquidity Coverage Ratio (LCR). Reported LCR was around 160 percent, but the true figure was substantially lower and at times fell below the 100 percent minimum under APS 210. The action shows that APRA treats inaccurate prudential reporting as a governance and risk management failure, not a technical error.

On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection. The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose. Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.

Hundreds of Metropolitan Police officers and staff used an unapproved third-party platform to share personal information about suspected shoplifters, including children, over an 18-month period without adequate data protection safeguards or oversight, according to findings released by the UK's Information Commissioner's Office (ICO).

The Dutch Data Protection Authority (AP) has formally objected to the draft decree implementing the revised EU Human Trafficking Directive. It found that the GDPR legal bases of public interest task and legal obligation are not properly established in law. Without further regulation, processing of victims' personal data, including special category and criminal data, could be unlawful. Compliance teams should treat this as a signal of how strictly regulators apply the Article 6(3) requirement.