Regulatory Update

Moraga – October 28, 2026 -- Atombeam has completed a SOC 2 Type 2 examination of the operations, systems and managed services behind its Neurpac data-compression solution, with independent firm MJD Advisors testing controls over a five-month audit window.

Audit covers April 1 to August 31, 2026 across three trust criteria

The report evaluates the Security, Availability and Confidentiality Trust Services Criteria. MJD Advisors assessed both the design suitability and the operating effectiveness of Atombeam's controls throughout the period. Unlike a Type 1 report, a Type 2 audit tests whether controls work over time, not only whether they are properly designed.

The result follows Atombeam's SOC 2 Type 1 audit, completed earlier this year.

Toronto – October 28, 2026 -- The Ontario Securities Commission has issued a receipt for CADC Reserve Trust's final prospectus dated October 22, 2026, qualifying a continuous offering of a Canadian dollar-referenced stablecoin in every Canadian province and territory at a fixed price of C$1.00 per token.

CADC Reserve Trust sells tokens through Authorized Participants

The issuer distributes CADC Tokens, which reference the Canadian dollar on a one-for-one basis, through a network of Authorized Participants. These may include registered crypto trading platforms, Canadian financial institutions and platforms that hold exemptive relief to trade stablecoins on a non-custodial basis. Participation is subject to the eligibility requirements in the prospectus and the applicable exemptive relief. Loon Payments Inc. is the servicer and administrator of the issuer.

Germany – October 28, 2026 -- Vendors selling to EU banks, hospitals or energy providers are being pulled into DORA and NIS2 obligations through contractual flow-down, regardless of where they are headquartered, according to Sergiy Lapin, CEO of Passeca Germany.

Customer contracts, not legal text, now define regulatory scope

Lapin says supplier contracts now carry DORA and NIS2 clauses even in countries where regulatory transposition is not finalized. His summary of the shift: "'We are not in scope' was the 2024 answer." By 2026, he argues, vendors must say their customers are in scope and prepare accordingly.

Passeca, a Hyperproof MSSP partner, offers incident response, security awareness, vCISO services and compliance support.

United States – October 28, 2026 -- The Pentagon's suspension of CMMC Phase II third-party assessment requirements has made contractors' own self-attestations the main compliance record, raising their exposure under the False Claims Act (FCA). Mandatory C3PAO certifications remain on hold following the Department of War's class deviation, but Phase I self-attestation is still fully active.

Phase I obligations and prime contractor requirements remain in force

Contractors must still self-attest compliance with NIST SP 800-171 Rev. 2 wherever DFARS 252.204-7012 applies. The 110 controls in that standard remain the legal baseline for any organization that processes or stores controlled unclassified information (CUI).

Reston, VA – October 27, 2026 -- SpiderOak has been named a Blue UAS Recognized Assessor and will deliver supply chain and cybersecurity evaluations for participating unmanned aircraft system (UAS) vendors, according to a March 3, 2026 announcement.

SpiderOak widens its drone compliance role across four 2025 announcements

On October 20, 2025, the company was authorized to perform cybersecurity evaluations on UAS seeking compliance with US Government baseline requirements. The March 2026 recognition adds supply chain assessment to that remit.

On December 16, 2025, SpiderOak said its services strengthen cyber resilience for the Army's Short-Range Reconnaissance (SRR) program and future unmanned systems across all domains.

Reston, VA – October 27, 2026 -- SpiderOak has been named a Blue UAS Recognized Assessor and will deliver supply chain and cybersecurity evaluations for participating UAS vendors, according to its March 3, 2026 announcement.

Drone fleet operators are increasingly concerned about malicious actors stealing their data. They also worry about spoofing and jamming attacks on their fleets as the number of UAVs flown for a wide variety of purposes grows.

SpiderOak built its drone security record over five announcements in eight months

On October 20, 2025, SpiderOak was authorized to perform cybersecurity evaluations on unmanned aerial systems seeking compliance with US Government baseline requirements.

On December 16, 2025, the company announced services to strengthen cyber resilience for the Army's Short-Range Reconnaissance (SRR) program and for future unmanned systems across all domains.

EU – October 27, 2026 -- The Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA) has published its Annual Work Programme for 2027. It lists digital operational resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring as the five key priorities for the EU financial sector.

ESAs continue DORA oversight of critical ICT third-party providers

Under the Digital Operational Resilience Act (DORA), the three authorities will continue oversight of critical ICT third-party service providers. They will also work to strengthen the financial sector's preparedness against cyber threats. Financial institutions that depend on external technology vendors remain within the supervisory scope.

European Union – October 27, 2026 -- National authorities across the European Economic Area (EEA) imposed more than 950 administrative sanctions and measures in 2025, with administrative fines totaling almost €82 million, according to the third Sanctions Report from the European Securities and Markets Authority (ESMA).

The number of sanctions and measures was stable compared with the past two years. The report also records an increased use of settlements.

Market abuse and MiFID breaches dominate enforcement activity

As in previous years, enforcement focused mainly on breaches of the Market Abuse Regulation and the Markets in Financial Instruments Directive and Regulation.

Germany, France and Spain account for two thirds of fine value

Enforcement remained concentrated in a small number of jurisdictions. Germany, France and Spain together accounted for two thirds of the total value of administrative fines across the EEA.

European Union – October 27, 2026 -- The EU will switch to T+1 settlement on 11 October 2027, and the European Securities and Markets Authority (ESMA) says the regulatory framework is now complete. ESMA is calling on market participants to finalise technical preparations, assess readiness across their entire ecosystems and start testing across the trading and settlement chain as soon as possible.

First compliance deadline for allocations and confirmations falls on 7 December 2026

Investment firms and their clients must comply with the new allocation and confirmation requirements from 7 December 2026. From that date, the amended RTS on Settlement Discipline makes two things mandatory:

- electronic, standardised communication channels and international messaging standards;
- machine-readable communication methods, except during temporary technical disruptions.

European Union – October 27, 2026 -- The European Securities and Markets Authority (ESMA) has finalised its revised Market Abuse Regulation (MAR) guidelines on delaying the disclosure of inside information, adding five legitimate interests that issuers can cite to justify a delay.

Under MAR, issuers must disclose inside information concerning them as soon as possible, so that investors are informed and insider dealing is prevented. Issuers may delay disclosure in specific circumstances to avoid prejudicing their legitimate interests. The guidelines give issuers a non-exhaustive list of such interests. The update completes the revised regulatory framework.

Five new legitimate interests follow public consultation

After a public consultation, ESMA added five situations in which a delay may be justified: