AI control mapping, sanctions trigger tightening, and DeFi resilience expand risk teams’ remit

FCA Turns AI Oversight into a Control-Mapping Test

The FCA’s October 2026 supervisory expectations made AI oversight a control-mapping exercise under existing regimes: each use case now needs named senior-management ownership, pre-deployment testing across customer groups and adverse scenarios, meaningful human challenge and override, live monitoring for bias, drift, complaints, and exclusion risks, plus third-party resilience with fallback and exit arrangements. SK Telecom’s parallel move shows what this looks like in practice: user notice and explanations, defined performance indicators, corrective actions, and quantitative bias evaluation. AWS pushed the same direction from the tooling side with a governed-agent blueprint built around registry, approval workflows, policy controls, evaluations, guardrails, and audit logs.

The market signal is now sharper than last week’s move toward continuous control: firms are no longer being asked to state principles; they are being forced to map each AI system to specific obligations, tests, approvals, monitoring signals, and evidence. That is why adoption is slowing: Gartner expects more than 40% of agentic-AI projects to be canceled by end-2027, Deloitte says only 21% of organizations have mature agentic-AI governance, and McKinsey reports 6-8 month approval cycles with human oversight consuming 70-75% of variable operating costs in banking customer-service workflows.

For risk managers, the job is shifting from reviewing launch memos to running an auditable control environment. The edge now sits with teams that can design evidence, monitoring, and cross-functional controls fast enough to get AI into production without supervisory drag.

OFAC and EU Tighten the Next Layer of Jurisdictional Triggers

On October 21, 2026, OFAC designated five individuals, four entities, and nine vessels tied to an Iran sanctions-evasion network supporting petroleum trade and maritime services, while allowing only limited wind-down activity through November 20, 2026. That same week, the EU expanded its DRC regime to cover deliberate and grave obstruction of MONUSCO’s mandate and tightened arms, reporting, information-sharing, anti-circumvention, and penalty rules. It also clarified that Russia restrictions already capture refined petroleum products under CN code 2710, including diesel, and separately bar exports of jet fuel and fuel additives for Russia or Russian use.

The operational shift is now less about whether a counterparty is screened and more about which jurisdiction’s trigger is in play at each step of the transaction. UK guidance now says US or EU compliance is not a proxy for UK compliance; UK branches are directly covered, foreign subsidiaries can still be implicated through UK control or involvement, and prohibited professional services to Russia-linked counterparties may require an OFSI licence or exception. China’s revised drone controls, effective November 18, 2026, extend the same pressure into software, technical data, and component thresholds.

For teams, the priority is faster nexus analysis, licence triage, and evidence capture before payments, shipments, or services move. The groups that can connect screening, vessel data, product classification, and end-use review across legal, trade, procurement, and operations will control the pace of the function.

Bitsight Adds Threat Intelligence to Third-Party Triage

Bitsight’s 2026 release adds AI-driven threat context to third-party risk triage: Bitsight Beacon, Dark Web Intelligence for Supply Chains, Dynamic Vulnerability Exploitability scoring, and framework intelligence. Together, these tools continuously watch critical vendors for vulnerabilities, malicious activity, intrusions, stolen credentials, and compromise; map deep-, dark-, and open-web signals to specific suppliers and MITRE ATT&CK; predict which CVEs are likely to be exploited within 90 days; and auto-map vendor evidence to NIST CSF, ISO 27001, and SIG.

This builds on the move toward continuous surveillance by adding a more threat-informed layer to the workflow. The practical shift is clear: vendor reviews are moving from static scoring to supplier-specific prioritization based on observed attacker activity and exploit likelihood. For risk, procurement, and security teams, that means less manual evidence chasing and faster focus on the vendors most likely to create exposure. The release does not prove lower incident rates or quantified time savings, but it does show where the workflow is headed: AI-assisted triage, tighter evidence mapping, and more defensible decisions on which suppliers need immediate attention.

FCA Pulls DeFi Into Existing Resilience Rules

The FCA’s October 2026 consultation GC26/7 pushes operational resilience into DeFi, applying existing rules to regulated firms wherever they use or interact with decentralized finance; cryptoasset firms are expected to come into scope from October 2027. The change is not a new rulebook. It is a wider mapping obligation: firms must identify important business services, set impact tolerances, and map every supporting resource across trading, settlement, lending, staking, and stablecoin redemption.

That now explicitly includes smart contracts, oracles, bridges, key management, governance, incident response, client communications, and dependencies the firm does not control. The FCA is testing whether firms can produce supervisory-grade evidence for end-to-end services that span off-chain vendors and on-chain infrastructure, not just internal systems and traditional outsourcers. Because GC26/7 mirrors SYSC 15A rather than creating a separate DeFi regime, resilience standards are becoming technology-agnostic and following the service wherever it is delivered.

For practitioners, this extends the validation work already underway from owned environments into dependency assumptions in systems they cannot control. Expect more pressure for protocol literacy, tighter coordination across technology, legal, operations, and communications, and faster evidence production ahead of the FCA’s March 18, 2027 incident-reporting and third-party notification requirements.