This week's edition of Risk and Compliance weekly highlights includes the new requirements for handling data protection complaints under the Data (Use and Access) Act 2025, which are now in force, the latest sanctions developments, including OFSI’s largest Russia sanctions penalty to date, the government’s response to its AML/CTF supervision reform consultation and FATF’s updates to its AML/CFT grey and black lists. We also examine where the new corporate criminal liability regime under the Crime and Policing Act 2026 is likely to have its greatest enforcement impact and the compliance and governance changes organisations should make.