The Compliance Week That Quietly Changed the Rules

Three regions moved in different directions this week. The EU's highest court pushed back on member states trying to tax their way around climate policy. The US doubled down on financial crime enforcement. And France rewrote its data sovereignty playbook. Here is what you actually need to pay attention to.

EU Climate Policy: Courts Are Enforcing the Rules Now

The EU Court of Justice overturned Hungary's attempt to tax companies that receive free carbon allowances under the EU ETS. Hungary had created a national levy that effectively wiped out the financial benefit of those free allocations — the mechanism designed to ease the cost of decarbonization for covered industries.

The court's ruling is clear: member states cannot unilaterally undermine instruments that are part of the EU's centrally coordinated climate policy. For businesses operating across EU jurisdictions, this is a reminder that national tax authorities are not free to improvise on top of EU regulatory frameworks. Any national-level compliance cost that touches EU-harmonized rules is now legally exposed.

Meanwhile, the EU's avian influenza emergency response expanded into Bulgaria and Poland, triggering mandatory protection and surveillance zones. Poultry sector businesses in those regions need to treat this as an active compliance obligation, not background news.

US Financial Crime: Two Rules, One Clear Direction

Two separate US proposals landed this week and they point in the same direction. The Federal Reserve and FinCEN both published updates to AML and counter-terrorism financing frameworks requiring financial institutions to shift toward risk-based resource allocation.

The core change: regulators want banks to stop treating compliance as a checkbox exercise and start concentrating resources on genuinely high-risk clients and transaction types. That means building documented risk assessment processes, not just running transactions through blanket screening tools.

For compliance teams, the practical implication is a documentation burden. You need to show your methodology, not just your results. Institutions that cannot explain why they allocated resources the way they did will be exposed in the next examination cycle.

Separately, the FCC moved to require license holders to disclose foreign adversary ownership. Telecom and media companies with any international ownership structure need to review this carefully before the comment period closes.

France: Data Sovereignty Gets a Legal Architecture

France published two significant data rules this week that together sketch a coherent privacy-by-design approach.

First: a formal derogation process for government bodies that need to use private cloud infrastructure for sensitive data. When no suitable public cloud option exists, agencies can now request an official exemption — but the request requires detailed justification and a two-month review window. For cloud providers serving French public sector clients, this creates a defined pathway where there was previously legal ambiguity.

Second: naturalization records are now blocked from search engine indexing by default. Newly naturalized citizens' names and nationality changes will be published on Légifrance but not indexable by Google or other engines. For HR and background-check vendors operating in France, this changes what is reliably findable about an individual's legal status.

What to Watch Next Week

• US AML rule comment period closes: prepare formal responses if you are a covered institution
• EU ETS quarterly reporting deadline approaching: verify your allowance accounting is clean after the Hungary ruling
• France private cloud derogation submissions open: relevant if you are a public sector vendor