🔥 1. EU sanctions are about to get much bigger
EU governments have agreed in principle to 1,646 new Russia-related sanctions designations, heavily targeting the military-industrial supply chain, including missile, drone, rocket-engine and specialist-material producers. Formal adoption is expected next week. Reuters
Why compliance people should care: sanctions screening is increasingly becoming supply-chain intelligence, not simply checking names against a list. Companies will need to understand ownership, suppliers, intermediaries and indirect exposure.
🪙 2. Binance is testing the limits of EU crypto regulation
EU regulators are scrutinising whether Binance can continue serving EU customers despite not obtaining a MiCA licence. The interesting issue is its reliance on “reverse solicitation”—the argument that customers approached Binance on their own initiative. Financial Times
This could become a major compliance precedent because it asks:
When does a regulatory exemption become a way of circumventing the underlying regulation?
That question extends well beyond crypto.
🕵️ 3. AMLA is moving from framework to operational rules
The EU's new Anti-Money Laundering Authority has finalised three important AML/CFT technical standards covering CDD, business relationships/occasional transactions, and group-wide AML controls. Sumsub
For compliance teams, this is significant because the EU AML regime is moving from “here are the principles” toward much more prescriptive expectations about what firms actually have to do.
Particularly interesting: the standards address electronic identification, non-face-to-face verification, PEP screening, governance and information-sharing across groups.
🤖 4. AI compliance has officially entered the enforcement era
The EU AI Act's enforcement machinery is now operational. Since 2 August 2026, the AI Office and national authorities have enforcement powers for several provisions, including prohibited AI practices and obligations concerning general-purpose AI models. Digital Strategy EU
That changes the conversation for compliance officers.
We're moving from:
“Do we have an AI policy?”
to:
“Can we demonstrate governance, documentation, controls and accountability for every relevant AI system?”
And the high-risk AI rules are still ahead, with major obligations coming in 2027–28. Digital Strategy EU
🔐 5. GDPR enforcement is getting more systematic
The European Data Protection Board has adopted a harmonised methodology for calculating GDPR administrative fines, alongside final guidance on the interaction between the DSA and GDPR. European Data Protection Board
That's worth watching because harmonisation can make enforcement more predictable—but potentially more consistently painful.
France is also producing some eye-catching enforcement: CNIL reports a €500,000 penalty against a hospital for inadequate patient-data security and an €825m fine against Uber over automated individual decisions concerning drivers. CNIL
🇺🇸 6. DOJ has sharpened its corporate-fraud priorities
The US DOJ's new Fraud Division has explicitly prioritised corporate fraud involving healthcare, government procurement, tax evasion and tariffs. It has also put greater emphasis on corporate-resolution compliance and whistleblower programmes. Debevoise
This is particularly interesting for compliance functions because it reinforces a trend toward:
compliance programme → evidence of effectiveness → enforcement outcome
rather than simply asking whether a company has policies on paper.