Global Regulatory News and Updates

Welcome to Carver's regulatory updates podcast for the week of October 03, 2026.

Starting in Indonesia, the Financial Services Authority, known as OJK, has officially revoked the business license of PT Credit Saison Indonesia Finance. This action follows the company's failure to resolve issues while under special supervision status. PT Credit Saison Indonesia Finance is now prohibited from conducting financing business and must proceed with liquidation. The company is required to settle all rights and obligations with debtors, creditors, and other parties. Additionally, PT Credit Saison Indonesia Finance must hold a general shareholders meeting within 30 working days from the license revocation date to decide on company dissolution and to form a liquidation team. Clear communication about the settlement mechanism must be provided to all stakeholders.

In Spain, the Ministry for the Ecological Transition and the Demographic Challenge, or El MITECO, has approved a Royal Decree-law aimed at protecting households and small and medium-sized enterprises from rising gas prices. The decree limits the weight of gas prices in the natural gas Last Resort Tariff formula to cap increases. Specifically, it restricts the gas price weight increase in the tariff formula to 35 percent relative to the current value, capping the tariff increase to about 15 percent starting October 1, 2026. Furthermore, the maximum price for butane gas bottles is set at 19.55 euros until June 30, 2027. The decree also increases liquefied natural gas reserves in the Winter Action Plan and doubles penalties for violations in the hydrocarbon sector to ensure energy affordability and supply security.

Turning to the European Union, the European Commission has launched a targeted consultation to gather insights on implementing an effective 'right to be forgotten' approach in financial services for cancer survivors. The consultation invites stakeholders, including cancer survivors, the medical community, and the insurance and banking sectors, to provide feedback. This input will inform the Commission’s next steps on regulatory or policy measures.

In Finland, a critical security vulnerability has been disclosed in FortiMail products. The vulnerability, identified as CVE-2026-104286, allows unauthenticated arbitrary file write through a path traversal flaw. This vulnerability is actively exploited and can lead to system compromise, malware installation, and unauthorized manipulation of email traffic. Users of FortiMail versions prior to 8.0.2, 7.6.7, 7.4.9, or 7.2.4 are urged to apply manufacturer patches immediately. If patching is not possible, users should disable the Identity-Based Encryption functionality or restrict FortiMail administrative interface access to trusted internal networks.

Similarly, in the Netherlands, multiple critical vulnerabilities have been identified in Citrix NetScaler ADC and NetScaler Gateway products, including two actively exploited vulnerabilities, CVE-2026-88771 and CVE-2026-88772. These vulnerabilities allow remote code execution and denial of service, posing severe security risks such as full network compromise and service outages. Security updates have been released to address these issues. Users are advised to install these updates promptly after securing memory dumps, disk images, and logs for forensic purposes. Good logging practices should be implemented, retaining logs for at least one month outside the Citrix system. Provided scan scripts and indicators of compromise should be used to detect any system compromise.

In Canada, a public alert has been issued regarding the same two critical Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772. These vulnerabilities have been actively exploited worldwide and allow remote code execution leading to full compromise of affected appliances. Organizations using these products are urged to review the Citrix security bulletin, prioritize remediation of internet-facing systems, investigate signs of compromise, and preserve forensic evidence.

In Spain and the European Union, the Spanish Agency of Medicines and Medical Devices, known as AEMPS, has reported ongoing supply disruptions affecting transdermal hormone replacement therapies, including Lenzetto. The supply issues began in April 2026. Gedeon Richter, the pharmaceutical company, has announced a progressive resumption of supply starting November 2026 and continuing into 2027. However, increased demand has caused intermittent stock issues for alternative products. Regulatory bodies continue to monitor the supply status closely and coordinate with pharmaceutical companies, healthcare professionals, and patient groups to mitigate health risks and ensure continuity of supply.

In the United Kingdom, the Prudential Regulation Authority, or PRA, has issued thematic feedback on accounting for International Financial Reporting Standard 9 expected credit losses, known as IFRS 9 ECL. The PRA reviewed auditors' reports from 2026, focusing on data governance, model risk, and climate risk in ECL accounting. The feedback highlights areas for improvement, including enhancing governance and controls over ECL data with clear accountability and data quality controls. It also calls for improved model risk management, such as completeness of post-model adjustments and ongoing model monitoring. Furthermore, firms are encouraged to develop capabilities to assess and incorporate climate-related credit risks into ECL processes using granular risk assessments and scenario analysis.

Finally, in Switzerland, the Swiss Agency for Therapeutic Products has updated the drug information for Librela, an injectable solution for dogs containing Bedinvetmab. The update includes new warnings for use in animals with immune-mediated preconditions or a history of seizures. New side effects have been added, including rare and very rare adverse reactions such as vomiting, diarrhea, seizures, paresis, paralysis, immune-mediated polyarthritis, and new bone formation affecting joints. Veterinary practitioners and manufacturers are advised to exercise caution when administering Librela to animals with immune-mediated diseases or known seizure disorders. Additional diagnostic measures and treatment discontinuation should be considered if new or worsened joint swelling or pain occurs.

That wraps up today's regulatory updates. Visit carveragents.ai for more information.