Outsourcing does not outsource accountability | 28 September 2026

Executive view

Edition: 28 September 2026. This catch-up edition was prepared and approved for publication on 15 October 2026, Cayman time. Developments and watchpoints retain their historical context as at the edition date; this is not a current-status update. The catch-up review timestamp records preparation for this release, not a claimed historical review time.

Invenire’s focus this week is the distinction between assigning work and retaining accountability. For boards and executive teams, the useful question is not simply whether a supplier, policy or audit exists. It is whether the organisation can explain what protection it provides, who owns any gaps and what evidence supports that assessment.

Our recommendation is to challenge three areas together: outsourced control ownership, the justification for collecting and retaining customer data, and the evidence supporting resilience claims.

Americas

Coverage note. Two developments are selected for this edition: Cayman AML audit expectations and US stablecoin proposals. This is a selected briefing, not an exhaustive jurisdictional update.

Cayman Islands — AML audit expectations require judgement, not a reflexive new audit

CIMA published updated anti-money laundering and sanctions FAQs on 24 September, following rules that took effect on 18 September. Its clarification distinguishes a risk-based audit programme from an automatic requirement to commission a new audit solely because the rules commenced. It also reinforces that outsourcing does not transfer a regulated entity’s accountability.

CIMA — Updated AML and Sanctions Rules FAQs, 24 September 2026 (opens in a new tab)

For regulated firms and trust and company service providers, our recommendation is to document why the audit’s scope, frequency and independence are appropriate. Management should be able to connect findings to accountable owners, remediation dates and evidence of closure, rather than treat receipt of an audit report as the endpoint.

United States — Stablecoin proposals put operating discipline alongside reserve backing

On 24 September, the Federal Reserve proposed requirements for payment stablecoin issuers under its supervision. The proposals address permissible reserve assets, capital, risk management and related supervisory arrangements. These are proposals, not final rules or blanket permission for firms to launch new services.

Federal Reserve — Proposed stablecoin rules, 24 September 2026 (opens in a new tab)

For firms considering participation, our view is that commercial feasibility should be assessed alongside the operating model: safeguarding, reconciliations, service dependencies, incident response and the ability to explain responsibilities across the issuer, custodian and technology provider.

Europe

Coverage note. Two developments are selected: Ireland’s location-data decision and a labelled Monday update on ESMA’s work programme.

Ireland — Google’s location-data decision highlights the need to evidence lawful use

On 21 September, Ireland’s Data Protection Commission announced €403 million in fines following its inquiry into Google’s processing of location data between May 2018 and February 2020. The findings concerned lawfulness and fairness, accountability, transparency and retention. The regulator said its full decision would follow.

Data Protection Commission — Google location-data decision, 21 September 2026 (opens in a new tab)

The practical question for financial and professional services firms is whether each material use of personal data has a defensible purpose, an appropriate legal basis, understandable customer information and a retention period that is actually implemented. We recommend testing those connections in a live customer journey, rather than reviewing the privacy notice in isolation.

European Union — ESMA’s 2027 programme points towards sustained technology oversight

In a Monday update on 28 September, ESMA’s annual work programme set out continued Digital Operational Resilience Act (DORA) activity, including critical ICT third-party oversight, incident analysis and supervisory coordination. A work programme indicates planned supervisory activity; it is not itself a new compliance deadline.

ESMA — Annual Work Programme 2027 (PDF) (opens in a new tab)

Our recommendation is to use it when planning 2027 assurance coverage. Supplier information, incident records and remediation evidence should tell a consistent story about how important services are protected.

Africa

Coverage note. Selected coverage focuses on Kenya’s payments consultation and South Africa’s earlier RelyComply incident. No Nigeria item is included; this does not imply that no relevant developments occurred.

Kenya — Payments reform is an opportunity to influence the operating requirements

Kenya’s National Treasury and Central Bank opened consultation on a draft National Payment System Policy and Bill. The proposals seek a more interoperable, inclusive payment system, supported by risk management and consumer and data protection. At this stage, they remain consultation proposals.

Central Bank of Kenya — Draft National Payment System Policy and Bill consultation, 21 September 2026 (opens in a new tab)

Banks, payment providers and fintechs should assess potential implications for their own payment journeys and supplier arrangements before responding. Our suggested emphasis is practical: responsibility for failed transactions, customer communications, fraud handling, data exchange and operational recovery.

South Africa — Continuing watch: the RelyComply incident raises supplier-assurance questions

In its 16 September disclosure, RelyComply said it had detected a cyber incident on 8 September involving a third-party application and access to certain customer-data systems. Its account described containment, rebuilding and credential changes. This is an earlier incident retained on the watchlist, not a newly reported event for this week.

RelyComply — Company account of the cyber incident, 16 September 2026 (opens in a new tab)

For users of outsourced screening and due-diligence services, our recommendation is to verify the affected data and integrations, complete any required credential changes and retain evidence of the supplier’s response. A service supporting a compliance control should receive the same operational scrutiny as other important dependencies.

Leadership priorities

Ask for ownership, not reassurance. For one important outsourced service, identify who accepts residual risk, who receives incident information and who can authorise a fallback.

Test the evidence behind one customer-data process. Follow the information from collection to deletion, checking the stated purpose against actual use and access.

Make assurance actionable. Select an overdue audit or supplier finding and challenge whether its proposed closure would demonstrably reduce exposure.

Upcoming key dates

These are the watchpoints identified for the 28 September edition. Milestones preceding the catch-up publication date are retained for historical context.

General information and risk commentary, not legal advice. Regulatory applicability depends on the entity, activity and jurisdiction.