Legal & Compliance — September 21, 2026 Weekly
Legal & Compliance news & updates — every claim linked to a primary source.
Key Findings
Executive Summary (5)
- •The SEC's dual actions this week — proposing to eliminate the 70-year-old shareholder proposal rule while simultaneously creating a new tokenized stock trading exemption — represent the clearest articulation yet of the current Commission's regulatory philosophy: deregulate traditional corporate governance mechanisms while building new frameworks for digital asset markets. The combined effect, if finalized, would fundamentally alter the balance of power between shareholders, boards, and federal r…
- •The FTC's record enforcement week, with over $325 million in settlements against Amway, FleetCor, and Amazon, confirms that the agency's selective enforcement posture concentrates maximum resources on high-dollar consumer fraud cases while continuing to withdraw from broader regulatory theories — a pattern that compliance programs must now treat as the new normal rather than a transitional phase.
- •European and international legal institutions produced a dense cluster of consequential outputs this week: a new CJEU General Court president, a landmark GDPR consent opinion on marketing partnerships, the Netherlands ratifying the Ukraine claims commission convention, Qatar joining the HCCH, and the Council of Europe launching algorithmic discrimination detection tools — collectively signaling that European legal infrastructure is expanding and modernizing across multiple dimensions simultaneou…
- •The convergence of AI governance pressure from multiple directions — PwC data showing boards are underprepared, the UN calling for mandatory AI regulation, and the Council of Europe launching discrimination detection tools — indicates that AI compliance is transitioning from a voluntary best-practice domain to a mandatory regulatory obligation, with boards facing personal accountability for governance gaps.
- •Immigration enforcement reached a new operational intensity this week, with USCIS reporting simultaneous actions across voter fraud, attorney misconduct, and visa program exploitation — building on the prior week's first ATRC removal. Organizations with immigration-dependent workforces or legal service providers in the immigration space face a compliance environment operating at maximum institutional enforcement capacity.
Key Points (16)
- 1.The SEC proposed rescinding Rule 14a-8 on September 16, 2026, which would eliminate the 70-year-old federal shareholder proposal right and return determination of proposal inclusion to state law, companies, and shareholders [3].
- 2.The SEC issued an Innovation Exemption on September 17, 2026, creating 'tokenized securities venues' exempt from the definition of 'exchange,' enabling onchain trading of NMS stocks for the first time [3].
- 3.Amway and two affiliates agreed to pay $225 million and FleetCor agreed to pay $100 million to settle FTC enforcement actions announced September 17, 2026, representing the largest single-week FTC enforcement dollar volume in the current period [2].
- 4.The FTC also took action on September 16, 2026 to resolve antitrust concerns in the Beretta-Ruger firearm manufacturer stock purchase agreement [2].
- 5.USCIS reported three new enforcement actions this week: a Peruvian national indicted for illegal voting, a Houston immigration attorney arrested for fraud, and five defendants charged with H-2A visa program exploitation to smuggle aliens [1].
- 6.Savvas Papasavvas was elected President of the CJEU General Court on September 16, 2026, following the early termination of Marc van der Woude's term, serving through August 31, 2028 [6].
- 7.CJEU Advocate General Spielmann opined on September 17, 2026 in Groupe Canal+ (C-317/25) that consent for data use by unnamed 'partners' for direct marketing is invalid unless partner identities are known at the time of consent [6].
- 8.The CJEU ruled on September 17, 2026 that purchasing a plane ticket online does not give the passenger's home court jurisdiction for lost baggage claims (Vueling Airlines, C-876/24) [6].
- 9.Qatar became the 95th Member of the HCCH on September 17, 2026, following Indonesia's accession in August 2026 [9].
- 10.The Netherlands ratified the Council of Europe convention establishing an International Claims Commission for Ukraine on September 15, 2026 [10].
- 11.The Council of Europe launched a new tool to detect algorithmic discrimination on September 17, 2026, and a new business and human rights platform [10].
- 12.The EEOC announced multiple enforcement actions this week covering disability (Butterball, $230,000), religious discrimination (Design Cuisine/Elior), sexual harassment (Moore Comfort Home Care, $60,000), and pregnancy discrimination [11].
- 13.OCC and federal banking agencies sought comment on proposed revised third-party risk management guidance and issued an interagency statement on core service provider supervision on September 11, 2026 [8].
- 14.Wachtell Lipton identified ten shareholder activism trends for 2027, noting Japan accounted for approximately 25% of global activism campaigns in 2026 and proxy advisor influence is waning [4a].
- 15.PwC analysis found only 17% of S&P 500 boards have a technology committee and only 40% of directors use AI in their oversight role, highlighting a significant AI governance gap [4b].
- 16.China's new Measures for Public Security Organs' Supervision and Inspection of Cyberspace Security will take effect October 1, 2026, replacing the 2018 provisions [5].
Market Trends
FTC Enforcement Escalates with Landmark MLM and Payment Processor Settlements
This week's FTC actions reveal a pattern of record-setting enforcement against consumer-facing fraud: Amway and two affiliates agreed to pay $225 million to settle charges of unfair and deceptive MLM practices, FleetCor and its CEO agreed to pay $100 million for unauthorized fee charges against small business customers, and Amazon will accelerate and expand payments under last year's $2.5 billion Prime settlement — all announced September 17, 2026 [2]. The FTC also took action on September 16 to…
SEC Accelerates Tokenization and Market Structure Reform Agenda
The SEC issued an 'Innovation Exemption' on September 17, 2026, creating a new category of 'tokenized securities venues' (TSVs) exempt from the definition of 'exchange' under the Securities Exchange Act, enabling onchain trading of NMS stocks [3]. On September 16, the SEC proposed rescission of the shareholder proposal rule (Rule 14a-8) and reforms to the proxy solicitation process [3]. These actions, combined with the prior week's semiannual reporting and crypto asset proposals, indicate the SE…
US Immigration Enforcement Intensifies Across Multiple Vectors
USCIS reported three distinct enforcement actions this week: a Peruvian national indicted for illegally voting in a federal election (September 14), a Houston-area immigration attorney arrested in an alleged fraud scheme (September 17), and five defendants charged with exploiting the H-2A visa program to smuggle aliens (September 18) [1]. The H-2A visa fraud case, announced by the U.S. Attorney for the Southern District of Georgia, involved fraudulently obtained worker visas used to smuggle alie…
AI Governance Demands Intensify for Corporate Boards and Compliance Functions
Multiple authoritative sources this week converged on AI governance as a board-level imperative. PwC analysis published September 14, 2026 found that only 17% of S&P 500 boards have a technology committee (up from 15% in 2021) and only 40% of directors use AI in their oversight role [4b]. The UN human rights chief called for mandatory AI regulation to avoid 'existential risks,' stating that voluntary self-regulation is 'nowhere near sufficient' [14]. The Council of Europe launched a new tool to …
Shareholder Activism Landscape Shifts Ahead of 2027 Proxy Season
Wachtell Lipton analysis published September 15, 2026 identified ten trends for 2027 activism, noting that approximately 40% of 2026 campaigns involved M&A-related theses, Japan alone accounted for approximately 25% of all global activism campaigns in 2026, and proxy advisor influence is waning as institutional investors increasingly apply their own voting policies [4a]. The SEC's proposed rescission of Rule 14a-8 prompted an open letter from The Shareholder Commons warning that eliminating the …
Competitor Trends
SEC Rule 14a-8 Rescission Proposal Reshapes Corporate Governance Power Balance
The SEC's September 16, 2026 proposal to rescind Rule 14a-8 — the 70-year-old shareholder proposal rule — represents the most consequential corporate governance regulatory action of the current period. SEC Commissioner Uyeda's statement published September 17, 2026 framed the proposal as returning corporate governance to state law, arguing the SEC lacked authority to mandate shareholder proposal inclusion [4d]. Skadden published analysis on September 18, 2026 characterizing the proposal as 'majo…
Delaware Designated Director Liability Risks Clarified by Chancery Court
Mayer Brown analysis published September 20, 2026 examined three recent Delaware Chancery Court opinions (all by Vice Chancellor Laster) establishing that designated directors owe fiduciary duties to all stockholders, not to appointing stockholders, and that directors acting as agents of appointing stockholders may face personal liability for breach of loyalty [4e]. The analysis also addressed the 2025 amendments to DGCL §144, which now provide clarity on when designated directors are deemed con…
CJEU Issues New Rulings on GDPR Consent, Electoral Law, and Jurisdiction
On September 17, 2026, the CJEU issued multiple significant rulings: Advocate General Spielmann opined in Groupe Canal+ (C-317/25) that consent for data use by unnamed 'partners' for direct marketing is invalid unless partner identities are known at the time of consent [6]. The Court ruled in Erakond Eestimaa Rohelised (C-438/24) that excessive financial deposits for European election candidate registration infringe EU law [6]. The Court also ruled in Vueling Airlines (C-876/24) that purchasing …
OCC and Banking Agencies Propose Revised Third-Party Risk Management Framework
The OCC announced on September 11, 2026 that federal banking agencies are seeking comment on proposed revised third-party risk management guidance and issued an interagency statement on risk-based supervision of core service providers to community banking organizations [8]. Skadden published analysis on September 17, 2026 characterizing the proposed guidance as a significant development for day-to-day supervision of regulated financial institutions [7]. The OCC also announced September 2026 enfo…
CJEU General Court Elects New President Following Early Termination
On September 16, 2026, Savvas Papasavvas was elected President of the General Court of the European Union following the early termination of Marc van der Woude's term, serving from September 16, 2026 to August 31, 2028 [6]. The General Court also scheduled hearings for September 21-22, 2026 in joined cases Spain v. Parliament and Italy v. Parliament concerning a civil service entrance competition reserved for nationals of a specific nationality [6]. Leadership transitions at the General Court le…
Regulatory Trends
SEC Proposes Wholesale Rescission of Shareholder Proposal Rule
The SEC's September 16, 2026 proposal to rescind Rule 14a-8 and reform proxy solicitation rules marks a fundamental shift in federal securities regulation of corporate governance. The proposal would return determination of shareholder proposal rights to states, companies, and shareholders [3]. Commissioner Uyeda's statement noted that Rule 14a-8 has been 'co-opted to advance the agendas of various political interests' and that the SEC's legal authority to mandate proposal inclusion was questiona…
EU Cyber Resilience Act Reporting Now Active; China Cyberspace Rules Imminent
The EU Cyber Resilience Act's incident reporting obligations for manufacturers of products with digital elements took effect September 11, 2026, creating an active compliance requirement confirmed by both Hunton Privacy Blog and Privacy World Blog [5]. Separately, China's Ministry of Public Security promulgated new Measures for Public Security Organs' Supervision and Inspection of Cyberspace Security, which will take effect October 1, 2026, replacing the 2018 provisions [5]. Organizations with d…
Council of Europe Advances Human Rights Accountability Mechanisms
The Netherlands ratified the Council of Europe convention establishing an International Claims Commission for Ukraine on September 15, 2026, taking a further step toward setting up a compensation mechanism for Russia's war of aggression [10]. The Council of Europe also launched a new platform for business and human rights collaboration on September 17, 2026, and published a new tool to detect algorithmic discrimination [10]. The Committee of Ministers published latest decisions on ECHR judgment …
Qatar Joins HCCH as 95th Member; International Private Law Expands
On September 17, 2026, Qatar deposited its instrument of acceptance of the HCCH Statute, becoming the 95th Member of the Hague Conference on Private International Law [9]. This follows Indonesia becoming the 94th Member in August 2026. The HCCH's Experts' Group on Central Bank Digital Currencies held its sixth working meeting September 1-4, 2026, with over 35 delegates representing 13 HCCH Members and seven Observers [9]. The expanding HCCH membership and active CBDC working group signal that pr…
EEOC Maintains Active Enforcement Across Discrimination Categories
The EEOC announced multiple enforcement actions this week spanning disability, religious, sex, and pregnancy discrimination: Butterball agreed to pay $230,000 for disability discrimination (September 15), Design Cuisine and Elior North America were sued for refusing to hire a Muslim applicant wearing a hijab (September 17), Moore Comfort Home Care agreed to pay $60,000 for sexual harassment (September 16), and the EEOC recovered over $97,000 in two pregnancy discrimination charges (September 16)…
Sources Activity
Since last week
SEC Proposes Rescission of Rule 14a-8 Shareholder Proposal Right
On September 16, 2026, the SEC proposed rescinding Rule 14a-8, which has governed shareholder proposal rights for over 70 years, and reforming proxy solicitation rules [3]. Commissioner Uyeda's statement confirmed the proposal would return shareholder proposal determinations to state law [4d]. Skadden characterized this as 'major changes to federal proxy rules' [7]. If finalized, this would be the most consequential rollback of federal shareholder rights in the rule's history.
SEC Issues Innovation Exemption for Tokenized NMS Stock Trading
On September 17, 2026, the SEC issued an order creating time-limited exemptions for 'tokenized securities venues' (TSVs), enabling onchain trading of NMS stocks and exempting TSVs from the definition of 'exchange' and certain liquidity providers from the definition of 'dealer' under the Securities Exchange Act [3]. Commissioner Peirce's statement described the exemption as 'a major step forward in allowing individuals greater personal autonomy to own and trade their own assets' [4f]. The exempti…
FTC Secures $325M+ in Settlements Against Amway, FleetCor, and Amazon
On September 17, 2026, the FTC announced three major enforcement outcomes: Amway and affiliates agreed to pay $225 million for unfair and deceptive MLM practices, FleetCor and its CEO agreed to pay $100 million for unauthorized fee charges, and Amazon agreed to accelerate and expand payments under its $2.5 billion Prime settlement [2]. These actions represent the largest single-week enforcement dollar volume in the current reporting period and signal continued FTC focus on consumer-facing fraud …
USCIS Reports Multiple Immigration Fraud Enforcement Actions
Building on the prior week's first ATRC removal, USCIS this week reported three new enforcement actions: a Peruvian national indicted for illegally voting (September 14), a Houston immigration attorney arrested for fraud (September 17), and five defendants charged with exploiting the H-2A visa program to smuggle aliens (September 18) [1]. The H-2A exploitation case, announced by the U.S. Attorney for the Southern District of Georgia, involved fraudulently obtained worker visas used to smuggle al…
CJEU Elects New General Court President; Issues Key GDPR Consent Opinion
Savvas Papasavvas was elected President of the General Court on September 16, 2026, following the early termination of Marc van der Woude's term [6]. On September 17, Advocate General Spielmann opined in Groupe Canal+ (C-317/25) that consent for data use by unnamed 'partners' for direct marketing is invalid unless partner identities are known at the time of consent — a ruling with significant implications for data-sharing marketing arrangements across the EU [6].
Watchlist — Upcoming Deadlines
China new Measures for Public Security Organs' Supervision and Inspection of Cyberspace Security take effect, replacing 2018 provisions
Source: Hunton Privacy BlogCJEU Open Day 2026 — annual public event at the Court of Justice of the European Union
Source: Court of Justice of the European Union (CURIA)World Justice Project releases the 2026 WJP Rule of Law Index
Source: Council of Europe NewsStrategic Insights (10)
- 1.The SEC's Rule 14a-8 rescission proposal creates an immediate strategic question for companies: if the rule is finalized, shareholder proposal rights will be determined by state law, primarily Delaware, creating a race-to-the-bottom risk as states compete for corporate domicile by offering varying levels of shareholder access. Companies should begin scenario planning for a post-Rule 14a-8 governance environment now.
- 2.The SEC's Innovation Exemption for tokenized NMS stocks is explicitly time-limited and designed to generate data for permanent rulemaking — companies and market participants that engage with TSVs during the exemption period will effectively be shaping the permanent regulatory framework through their operational experience.
- 3.The CJEU's Groupe Canal+ opinion on GDPR consent for unnamed marketing partners has immediate compliance implications: any data-sharing arrangement where consent is obtained for use by 'partners' without identifying those partners at the time of consent is now at risk of being deemed invalid across the EU. Marketing and data teams should audit consent language immediately.
- 4.The FTC's $225 million Amway settlement is the largest MLM enforcement action in FTC history and signals that multi-level marketing business models face existential regulatory scrutiny — companies with MLM or direct sales structures should conduct immediate compliance reviews of their compensation and recruitment practices.
- 5.The OCC's proposed revised third-party risk management guidance, combined with the interagency statement on core service providers, signals that banking regulators are moving toward a more prescriptive framework for vendor oversight — financial institutions should treat the comment period as an opportunity to shape guidance that will govern their technology vendor relationships for years.
- 6.The Delaware Chancery Court's designated director opinions, analyzed by Mayer Brown this week, create a clear compliance imperative for private equity and venture capital firms: directors appointed by investors must be trained to understand that their fiduciary duties run to all stockholders, not to the appointing investor, and governance agreements that purport to require constituency representation are unenforceable under Delaware law.
- 7.China's new cyberspace security inspection rules taking effect October 1, 2026 create an immediate compliance deadline for companies with digital operations in China — the new rules replace the 2018 provisions and require updated compliance manuals and procedures within days of this report.
- 8.The HCCH's active CBDC working group, now at its sixth meeting, is developing private international law frameworks for central bank digital currencies — financial institutions and fintech companies should monitor these outputs closely as they will determine cross-border legal treatment of CBDCs in the 95-member HCCH network.
- 9.The EEOC's simultaneous enforcement across disability, religious, pregnancy, and sexual harassment categories this week — despite the broader federal deregulatory environment — confirms that employment discrimination enforcement remains a priority area where companies cannot assume reduced scrutiny.
- 10.The Wachtell Lipton finding that Japan accounted for approximately 25% of global activism campaigns in 2026 is a significant data point for multinational companies: activism preparedness strategies that were once US-centric must now be adapted for APAC markets, particularly Japan, where local rules and shareholder dynamics differ substantially from US practice.
Trust Summary
17 sources cited this weekDetected across 30 monitored URLs you selected — one URL can surface multiple articles.
Each source is weighted by its trust level. Single-source claims are flagged as unverified during AI synthesis.
Sources
Source for USCIS enforcement actions this week including the Peruvian national indicted for illegal voting (September 14), Houston immigration attorney arrested for fraud (September 17), and five defendants charged with H-2A visa program exploitation (September 18).
Source for FTC enforcement actions including the $225 million Amway settlement, $100 million FleetCor settlement, Amazon Prime payment expansion, Beretta-Ruger antitrust action (all September 17, 2026), and price transparency FAQs for auto dealers (September 15, 2026).
Source for SEC actions including the Innovation Exemption for tokenized NMS stock trading (September 17), proposed rescission of Rule 14a-8 and proxy solicitation reforms (September 16), and XBRL filing exemptive relief (September 14).
Source for corporate governance analysis including PwC board AI oversight analysis (September 14), DATs and crypto-pivot shareholder activism risks (September 14), Wachtell Lipton ten activism trends for 2027 (September 15), executive security expansion data (September 15), open letter on shareholder proposals (September 16), Commissioner Uyeda statement on Rule 14a-8 rescission (September 17), ESG red state AG attack analysis (September 17), Commissioner Peirce Innovation Exemption statement (September 18), forced CEO departures analysis (September 19), and designated directorships risks (September 20).
Source for privacy and cybersecurity developments including the FTC's rescission of the 2021 Health App Breach Policy Statement (September 16 post), EU Cyber Resilience Act reporting obligations in effect (September 11), Dutch DPA Uber fine, Delaware privacy law expansion, and China's new cyberspace security inspection rules effective October 1, 2026.
Source for CJEU developments including election of Savvas Papasavvas as General Court President (September 16), Advocate General Spielmann opinion on GDPR consent for unnamed marketing partners in Groupe Canal+ (September 17), Vueling Airlines jurisdiction ruling (September 17), Erakond Eestimaa Rohelised electoral deposit ruling (September 17), and upcoming Spain/Italy v. Parliament hearings (September 21-22).
Source for Skadden analysis including SEC major proxy rule changes and Rule 14a-8 rescission (September 18), US federal banking agencies proposed third-party risk management guidance (September 17), OCC and FDIC finalized standards for unsafe or unsound practices (September 10), and Delaware Court of Chancery Section 144 safe harbor analysis.
Source for OCC actions including September 2026 enforcement actions announcement (September 17), proposed third-party risk management guidance and interagency statement on core service providers (September 11), and expanded examination cycle eligibility interim final rule (September 10).
Source for Qatar's accession as the 95th HCCH Member on September 17, 2026, and the sixth working meeting of the Experts' Group on Central Bank Digital Currencies held September 1-4, 2026.
Source for Council of Europe developments including the Netherlands ratifying the Ukraine International Claims Commission convention (September 15), new business and human rights platform launch (September 17), algorithmic discrimination detection tool launch (September 17), and Committee of Ministers ECHR implementation decisions for 20 countries (September 18).
Source for EEOC enforcement actions including Butterball disability discrimination settlement ($230,000, September 15), Design Cuisine/Elior religious discrimination lawsuit (September 17), Moore Comfort Home Care sexual harassment settlement ($60,000, September 16), and two pregnancy discrimination charge recoveries totaling over $97,000 (September 16).
Source for Latham analysis including AI regulation in APAC diverging approaches (September 15), European Commission guidelines on exclusionary conduct by dominant firms (September 15), SEC transfer agent modernization and tokenized securities framework (September 17), and SEC staff risk alert on investment adviser annual compliance reviews (September 18).
Source for Delaware Personal Data Privacy Act amendments analysis (September 16) and US AI law 2026 midyear state update covering state AI development and deployment laws (September 16).
Source for UN developments including UN human rights chief Türk's call for mandatory AI regulation (September 14), UN General Assembly high-level week coverage (September 16-20), UN Crime Congress on technology transforming crime (September 19), and gender equality report finding 171 years needed at current progress rates (September 19).
Source for legal profession news including federal judiciary plans to release AI recommendations (September 18), OpenAI introducing a new AI model for law firms (September 18), product liability cases reaching a 10-year high per Lex Machina report (September 16), and AI changing plaintiffs law firm operations (September 16).
Source for Baker McKenzie analysis including Australia's modern slavery failure-to-prevent offence consultation, Singapore MAS stablecoins framework consultation, Mexico AML general rules, and Colombia identity theft law requiring updated verification protocols.
Source for EDPB news confirming stable enforcement activity this week, with the most recent substantive items being the French CNIL fines (September 9-11) and Irish DPC HSE decision (September 3). No new EDPB plenary decisions were issued during the reporting week.
Get Legal & Compliance monitored every week
This report was built from primary sources only — no aggregators. Pick your themes and sources, and OriginBrief delivers a cited report like this every week. Start your 7-day free trial — plans from $33/mo.
Start your 7-day free trial