Norway's Datatilsynet fined Xandr (Microsoft) ~€8.6M — its largest ever — for relaying Grindr users' data into real-time bidding with no valid Article 9 basis. "Assumed consent" defence rejected; Xandr named a joint controller. #compliance #privacy cybereyeq.com/?utm_source=x&…

SEC's proposed Regulation Crypto Assets (Release 33-11434) closes for comment tomorrow, 20 Oct — setting when certain crypto assets fall outside securities treatment. A last US window before the GENIUS Act takes effect 18 Jan 2027. #compliance #crypto cybereyeq.com/?utm_source=x&…

CISA added an actively exploited BeyondTrust Remote Support flaw (CVE-2026-102764) to the KEV catalog on 16 Oct, starting a BOD 26-04 remediation clock for federal agencies. Inventory and patch now. #compliance #cybersecurity cybereyeq.com/?utm_source=x&…

The 11th Circuit vacated the injunction on Georgia's SB 351 (15 Oct, NetChoice v. Carr): the state can now enforce age verification and under-16 parental consent for social media. NetChoice's facial challenge failed. #compliance #GRC cybereyeq.com/?utm_source=x&…

EBA classified Circle's USDC as the first significant e-money token under MiCA (14 Oct). From 12 Nov the EBA directly supervises its reserves, own funds and liquidity; France's ACPR keeps conduct. #compliance #MiCA cybereyeq.com/?utm_source=x&…

FedRAMP opened RFC-0035 on 14 Oct: it would relax the Class D rule on CMVP-validated cryptographic modules from MUST to SHOULD, and allow post-quantum crypto at agency request. Comments due 17 Nov. #compliance #FedRAMP cybereyeq.com/?utm_source=x&…

A Cologne court barred Snapchat from using “My AI” chatbot data for ads without a legal basis, from pre-ticked consent boxes, and from pre-selecting alcohol/gambling ads for minors. #compliance #GDPR cybereyeq.com/?utm_source=x&…

UK scrapped the per-lender 15% cap on high loan-to-income mortgage lending. PRA and FCA published PS19/26 on 14 Oct; firms now set their own high-LTI strategy within risk appetite. In force 28 Oct. #compliance #bankingregulation cybereyeq.com/?utm_source=x&…

FDA finalized its guidance on postapproval manufacturing changes to biosimilar and interchangeable products (91 FR 64931, 13 Oct). It aligns with ICH Q5E and finalizes the July 2024 draft. Non-binding. #compliance #GRC cybereyeq.com/?utm_source=x&…

US Treasury agencies hit Bank of America with a $1.2B FinCEN penalty for willful Bank Secrecy Act/AML failures (13 Oct) — plus a $750M OCC fine, its largest ever, and an $11.6M OFAC sanctions settlement. #compliance #GRC cybereyeq.com/?utm_source=x&…

White House "Super Intelligence Force" says AI firms must report model security incidents "immediately" (9 Oct, per Axios). No statute, deadline or penalty named — a signalled expectation, not binding law. #AIgovernance #compliance cybereyeq.com/?utm_source=x&…

SEC proposes its biggest overhaul of fund cross-trading Rule 17a-7 in years — opening most fixed-income to affiliated cross trades under value-based pricing. Comment: 60 days post-FR. cybereyeq.com/?utm_source=x&… #compliance #SEC

CFTC proposes folding event contracts — sports, politics, weather — into the legal definition of a 'swap,' and carves casino-style gambling out. Comment: 30 days post-FR-publication. cybereyeq.com/?utm_source=x&… #compliance #CFTC

Italy's Garante: email tracking-pixel guidelines become enforceable 29 Oct 2026. Individual-level open-tracking needs prior consent; every pixel needs advance disclosure. cybereyeq.com/?utm_source=x&… #compliance #privacy

The UK ICO says ten leading AI developers — incl. Google, Meta, OpenAI, Anthropic — agreed to tighten transparency, rights mechanisms and safeguards for foundation models under UK GDPR. Agentic-AI call for evidence closes 20 Nov. cybereyeq.com/?utm_source=x&… #compliance #AIgovernance

FinCEN has withdrawn two dormant crypto AML proposals: the 2020 "unhosted wallet" recordkeeping/reporting rule and the 2023 CVC-mixing special measure (Section 311). Existing BSA/AML, OFAC and GENIUS Act stablecoin duties are unaffected. cybereyeq.com/?utm_source=x&… #compliance #AML

Türkiye's new regulation (Official Gazette 33396) bars under-15s from social media and makes a state-issued age token the only accepted proof of age. In force 1 Nov 2026; existing accounts verify by 31 Mar 2027. cybereyeq.com/?utm_source=x&… #GRC #ageverification

FDA's comment window on its discussion paper for generative-AI medical devices closes 19 Oct (docket FDA-2026-N-7874). It floats a two-axis risk framework and a premarket "competency assessment" — direction-setting, not binding. cybereyeq.com/?utm_source=x&… #AIgovernance #compliance

California's SB 923 extends the CCPA right to delete to data a business got "from or about" you — including from third parties and data brokers. Online-only firms must add a web request channel. Effective 1 Jan 2027. cybereyeq.com/?utm_source=x&… #privacy #compliance

UK PRA proposes indexing 128 prudential thresholds — from a £320bn capital-reporting line to a £7,500 credit-union limit — to nominal GDP, not ad hoc updates. First auto-adjustment 2031; consultation closes 7 Feb. (CP13/26) cybereyeq.com/?utm_source=x&… #compliance #GRC