Weekly brief / 4 Oct 2026
An AI-assisted transaction check, proposed custody routes, sensitive paper records and active vulnerabilities all test what the next operator receives — and whether they can challenge it.
Five-minute read / one-minute scan
Weekly Judgement
Week ending 4 Oct 2026 · Edition 16
Editorial correction (4 October 2026): the DPC announced its final decision on 1 October; only the full written decision remains to be published. Earlier copy confused the final decision with its full text.
What happened
OpenAI reports Chatham checks AI-assisted transaction comparisons against experienced reviewers. The SEC has proposed new crypto-custody pathways; the UK NCA reports a confiscation order after conviction; Ireland’s DPC requires DPIAs and controls after paper-record failings; and CISA has added two exploited vulnerabilities.
Why it matters
Controls can fail between steps. If the receiving person or system cannot see the authorised instruction, the comparison and any exception, they cannot challenge or own the final record.
What to do
Replay one high-impact record from instruction to decision. Collect the evidence each step receives and ask the next owner to resolve a mismatch. Use the first gap you find to assign one specific control fix.
The weekly readout
A control may work at its source and still fail when evidence, authority or responsibility passes to the next person or system.
OpenAI reports that Chatham is comparing an AI-assisted transaction-validation application with experienced reviewers. The SEC has proposed new crypto-custody pathways; the NCA reports a post-conviction confiscation order; Ireland’s DPC has ordered DPIAs and controls after paper-record failings; and CISA has added two vulnerabilities to its known-exploited catalog.
Reviewers need to know what was authorised, what changed, which exception was raised and who accepted the result. Custody and disposal controls matter just as much as the system that created the record.
Choose a transfer that can change a customer, trading or compliance outcome. Follow the original instruction through the evidence received and the final decision.
Keep the source record, comparison, exception disposition and receiving owner together. The first missing link is the next control fix.
Top 5
Each title links to its primary source. The Signals pages carry the wider source trail and retained material.
Start with one decision-critical process and its original instruction.
Ask for the record that shows how the final decision was reached.
Supplier claims and regulator summaries are labelled; the judgement is our editorial interpretation.
Regulatory Horizon
Use the published horizon to review official dates, evidence and action windows alongside this week’s operating questions.
A practical register of upcoming regulatory dates and their operating implications.
Reading the signals
Three places to ask for the evidence that survives a transfer.
Chatham says its application compares transaction terms and flags discrepancies, while results are checked against experienced reviewers before broader automation. The useful evidence is how a mismatch reaches a qualified decision-maker.
The proposal would allow self-custody in specified circumstances and state trust companies as custodians. It is not adopted; firms can use the consultation to assess access, recovery and oversight choices against their current arrangements.
The DPC’s final decision was notified to CHI at Tallaght on 10 September and announced on 1 October. It reprimanded CHI, ordered two DPIAs finalised and sent within four weeks, and required the measures to be implemented; the full written decision will follow. That makes custody, access and confidential-waste controls a current governance issue.
Executive challenge
Carry one into a committee, 1:1 or control review.