Quarterly Update — Q3 GRC Matters

This is the abridged version of our Q3 2026 Quarterly Update for private fund managers and fund distributors. This quarter's regulatory developments and enforcement cases reinforce themes we have been working through with firms for years: effective AML oversight, independent investment decisions, conflicts management, market conduct and operational resilience. They are reminders of why these controls matter, rather than an entirely new compliance agenda.

AML and regulatory resources

Our Q3 MLRO Resources keep the jurisdiction-by-jurisdiction format. Items for the review agenda:

• Hong Kong sanctions and screening. Confirm the quarter's UN sanctions updates reached your administrator or onboarding provider, and that potential matches were resolved and recorded.

• Country risk. Make sure the June FATF Plenary changes and the SFC's July circular flow into your own country-risk assessment, not just the screening vendor's database.

• Cayman funds. Review how AML responsibilities are allocated between the fund, its AML officers, the manager and the administrator.

• Activity-specific SFC circulars. The phishing-resistant authentication and simplified eDDA circulars depend on your activities and channels. The private-market exposure circular concerns SFC-authorised funds and is not a blanket new requirement for private funds.

SFC enforcement: the key lessons

• Market surveillance does not stop at the broker. The SFC's restriction notice freezing over HK$125 million linked to suspected IPO fraud is a suspected matter, not a finding, but it shows where attention sits. IPO participation and subsequent trading should be explainable by strategy, mandate and contemporaneous records.

• AML oversight must make sense of the activity. Victory Securities and Zheng Da International were disciplined for failing to address activity inconsistent with client profiles, with the failures attributed to the responsible officer as senior management. Low likelihood is no reason to be blind to red flags.

• Investor preferences must not displace independent judgement. The HK$6.8 million fine against China Industrial Securities International Asset Management involved structured-note arrangements entered into at an investor's request without clear commercial rationale. Could an independent reviewer distinguish your investment decision from an instruction you were expected to implement?

• Operational resilience, the basics. Luk Fook Securities was fined HK$2.1 million after a ransomware attack: the SFC's first disciplinary action arising from an actual cyberattack, and the deficiencies were fundamental.

Cybersecurity, third parties and AI

The regulators' first cross-sectoral Cyber Mapping exercise found no major "unknown-unknown" sources of systemic cyber risk, but highlighted critical third-party providers and increasingly complex connections. The message is to show that the basics work: access and leaver controls, patching, authentication, restorable backups and incident testing that involves management and critical providers.

Third parties share the perimeter. We recommend updated due diligence on where your critical providers use AI, the models, cloud platforms and subcontractors involved, and how incident notification connects with your own arrangements. Firms relying on a single large language model should keep the ability to "lift the foot off": reduce its use, switch to a tested alternative or pause. We will be moderating a panel on these risks at the AIMA APAC Annual Forum on 29 October. Looking forward to seeing you there.

China and Japan

China. Our China Analysis (April–September 2026) reinforces existing expectations. Review who introduces Mainland investors and whether sales materials match the fund documents; offshore incorporation does not by itself answer the cross-border question; and track the September consultation on private-fund fundraising separately from rules in force. Consider your exposure and prepare for review.

Japan. Firms using Japanese distribution partners should review product descriptions, sales assurances and monitoring of the distribution chain. Governance and stewardship developments should be assessed separately from questions of permission to market or manage a fund in Japan.

United States

• Annual review. The SEC's Risk Alert on annual compliance reviews sets out six deficiency areas. Record what was tested, what was found and who owns the actions, and close prior-year findings with evidence. The SEC has also published a new Exam Handbook.

• Rule changes. The Form PF compliance date moves to 1 July 2027; the SEC has proposed rescinding the pay-to-play rule (a proposal only); the CFTC has proposed CPO registration relief for SEC-registered advisers; and the SEC's custody proposal would also amend the audit provision used by private fund advisers, with comments due by 7 December 2026.

• Enforcement. Cases such as Adit Ventures, Hatteras and Zoe Financial reinforce familiar themes: consent for principal transactions, a reasonable basis for recommendations, and disclosure of conflicts, including in automated processes.

• FINRA. Regulatory Notice 26-17 changes adviser bulk-order allocations from 16 November 2026, and new Rule 3290 will replace Rules 3270 and 3280 once FINRA announces its effective date.

Access the full resources

The full Quarterly Update, our Q3 MLRO Resources, SFC Enforcement Analysis, China Analysis and Japan Analysis are held in our Datasite Archive, which is available to clients and friends of the firm on request. Request Datasite access or contact your Cognitive GRC consultant to discuss priorities for your monitoring and annual review.

The majority of regulatory focus is in line with global direction of travel and therefore not much of a surprise so we should all be prepared. However, not wanting to be complacent we are re-enforcing the focus on areas that we have highlighted before. We need to stay on our toes for both operational and market challenges and take the opportunity to improve and prepare for times when regulatory change is the focus of disruption. As such we have dove deep on conflicts, updated training, refined onboarding, re-examined data security administration, the new cayman standards, US adjustments, and global standards. We continue to examine options on cybersecurity as we watch cautiously on developments in AI.

This article provides general information, not legal advice. Applicability depends on the entity, activities, products and jurisdiction. Consultations, suspected matters and ongoing proceedings should be distinguished from final rules and findings.