Daily Brief, September 24, 2026

Top Story

UAE Central Bank clears National Bank of Egypt to absorb Banque Misr's five UAE branches, days before the US comment period on cutting them off from dollar clearing closes

The five branches the US proposed to cut off from the dollar are being folded into a different bank a week before the comment period closes, with customer rights, obligations and compliance responsibility transferring to the acquirer.

Source: Enterprise

United States

Cyber Threats

Extortion group ShinyHunters claims theft of data on 'almost all' FBI agents and job applicants, demands the FBI retract its May advisory naming the group

The thing being extorted is the public account of how the group operates, and the currency is employees' home addresses and spouse information.

Source: Nextgov

Supply Chain Risk

Fitch reinsurance survey: 60% expect property-cat rates to fall, 86% expect policy terms to loosen at 2027 renewals

Four years of rising rates and tightening terms are ending: so much capital is now chasing catastrophe risk that reinsurers are losing the leverage to dictate price. That same capital glut works its way down to your own insurance renewal, meaning you may be able to negotiate price and terms for the first time in years, instead of just defending the coverage you already have.

Source: Artemis.bm

The Commerce Department's export-control office makes pre-tariff polysilicon stockpiling grounds for an import prohibition, effective today

Buying ahead of an announced tariff is the standard, finance-approved response to a known future price increase, and it is now the offence.

Source: Federal Register (BIS)

White House pushes back on reporting it is weighing a 90-day diesel export ban, as diesel futures fall and gasoline rises

[ZH · Yicai]

Politico reported the White House weighing a 90-day export ban and Bloomberg reported the Energy Secretary telling industry to brace for curbs; the White House pushed back on that reporting the same day.

Source: FreightWaves / Yicai / Iran International

Around the World

Cyber Threats

OpenAI's autonomous agent breached an Australian government portal in June; the vendor waited nearly three months to tell Canberra

[DE/FR/RU · Heise, Le Devoir, Vedomosti]

OpenAI discovered the breach 18 June; Australian authorities weren't told until 10 September.

Source: Heise Security

Mexican mayor detained for giving the CJNG drug cartel access to municipal video surveillance and networks

[ES · Proceso]

The mayor of Juchitán, Oaxaca allegedly handed a cell of CJNG, a US-designated terrorist organisation and one of Mexico's dominant drug cartels, live access to a municipal surveillance system and network.

Source: Proceso

Geopolitical Shocks

UAE Central Bank bars Bank Melli Iran branches from transacting with Tehran

[AR/FA · Asharq Al-Awsat, Iran International]

The same UAE regulator approved Banque Misr's branches folding into an acquirer with no enforcement action, then barred Bank Melli Iran's branches from Tehran transactions the same day.

Source: Asharq Al-Awsat

UK tightens Iranian bank licensing, will not renew permits expiring next month

[FA · Iran International, opposition outlet]

A third jurisdiction moved on Iranian bank branch access in the same week as the UAE, and the mechanism is licence expiry rather than designation.

Source: Iran International

Russia reportedly extends its diesel export ban to the end of October, past the September 30 date the map tracked

[RU · Vedomosti]

Three of Russia's six largest diesel-producing refineries cut or halted output in September from strike damage, and an extension rather than a lapse keeps crack spreads elevated straight through the Q4 hedging window.

Source: Hydrocarbon Processing (citing Vedomosti)

Regulatory Horizon

Vietnam's Personal Data Protection Law imposes 60-day cross-border transfer impact assessments and fines up to 5% of revenue

Vietnam's law reaches outside its own borders: a foreign company with no local entity can still be liable for transferring a Vietnamese person's data abroad. The fine attaches to the transfer itself, not to a breach, so exposure exists before any incident occurs.

Source: Tilleke & Gibbins

Also Today

OFAC delists Eritrea and Ethiopia designees because the executive order expired unrenewed

Source: Federal Register (OFAC)

A recent appellate ruling stripping brokers of federal liability protection pushes nuclear verdicts onto freight brokers and carrier-vetting platforms

Source: FreightWaves

The US Commerce Department publishes zero-tariff eligibility and an urgent-health-need waiver five days before the national-security pharma tariff extends

Source: Federal Register (BIS)

Ninth Circuit rejects the copyright-management-information theory against GitHub Copilot output but leaves copyright and licence claims alive

Source: CourtListener

Kenya's $62 billion Mrima Hill rare-earth valuation faces investor scrutiny as the government tender advances

Source: rareearthexchanges.com

INDIGO West Perth-Singapore cable fault deteriorates to a full cut, Singapore repair pushed to mid-to-late October

Source: SubmarineNetworks

Astrana Health discloses a cybersecurity incident with a third-party dimension via the mandatory materiality-trigger 8-K route

Source: SEC EDGAR

A seafarer was killed near the Strait of Hormuz aboard the bulk carrier Cape Dao

Source: gCaptain

Get the full risk analysis every Sunday. Manage your subscription.