This is the September 2026 edition of Five to Follow, our monthly curation of stories worth tracking beyond the headlines. It runs alongside our companion monthly article, Regulatory Digest, which covers the full sweep of developments, including smaller and sector-specific regulators.
Roblox’s enforceable undertaking tests what child-safety promises are worth
The eSafety Commissioner’s court-enforceable undertaking with Roblox, secured on 19–20 August 2026, shows what a regulator does once its first attempt at voluntary compliance has failed. Testing this year found that adults could still contact children under 16 without parental consent, and that children’s profiles and connections remained visible platform-wide, despite a 2025 commitment from Roblox, a February 2026 notice of intent from eSafety to test that commitment, and an April 2026 confirmation of interim improvements. The gaps persisted regardless.
What makes this worth following is the escalation ladder it reveals. eSafety did not move straight to formal enforcement; it gave Roblox multiple opportunities to self-correct before extracting a binding undertaking with teeth: adult-to-child contact restrictions, default-private children’s accounts, improved complaint handling, and an independent third-party audit of safety controls, including age-estimation technology, within three months. If Roblox breaches the agreement, eSafety can apply directly to the Federal Court for compliance orders, converting a negotiated commitment into something with judicial consequence.
The three-month audit deadline is the detail to watch here. It falls in November, and its outcome will show whether an enforceable undertaking, which is one of several compliance tools available to eSafety alongside infringement notices and civil penalty proceedings, can actually verify something as technically contestable as age-estimation accuracy, instead of relying on the platform’s own assurances. The approach also has resonance well beyond Australia: the UK’s Online Safety Act regime and Canada’s Bill C-34, the Safe Social Media Act introduced in June 2026, both face the same underlying question of how a regulator verifies platform safety commitments in practice. Read the eSafety media release.
APRA and ASIC test what “reducing burden” is allowed to remove
When two regulators jointly consult on removing requirements from a regime they jointly administer, the real question is which judgement calls determine what counts as burden versus substance. The Australian Prudential Regulation Authority (APRA) and the Australian Securities and Investments Commission (ASIC) opened consultation in the first days of September on streamlining the Financial Accountability Regime (FAR), proposing to remove key-functions requirements from the FAR regulator rules and drop the requirement to report accountable persons’ direct reports in accountability maps.
The numbers are not trivial: APRA estimates the changes will cut reporting obligations for roughly 4,500 accountable people and roughly halve the volume of accountability map updates industry-wide, with implementation targeted for early 2027. The FAR itself was designed, in the wake of the Hayne Royal Commission, to make individual accountability for misconduct traceable and enforceable. Removing elements of that traceability, elements even regulators frame as duplicative, is a genuine test of whether accountability regimes can be simplified without being hollowed out.
David Bradbury’s arrival as APRA deputy chair in the same week adds a leadership dimension worth tracking alongside the consultation itself: how a relatively new appointee positions themselves on a live question of regulatory scope will be an early signal of institutional direction. The consultation period will be the venue where industry, consumer advocates, and governance specialists test whether “streamlining” and “weakening” are being treated as synonyms or meaningfully distinct propositions. View the joint consultation paper
A grid regulator grades a monopoly’s delivery in public
New Zealand’s Electricity Authority Te Mana Hiko published a finding on 1 September that Transpower’s process for connecting new generation projects to the national grid has improved significantly since an earlier period of public criticism. It’s an unusually public grade for a regulated monopoly’s operational delivery, on one of the most politically salient questions in New Zealand’s energy transition.
Grid-connection delays have been a widely cited bottleneck in New Zealand’s push for faster deployment of renewable generation capacity. An improvement finding from the sector regulator carries real weight because it is independently verified rather than self-reported, and because the authority paired it with a quarterly report to the Minister for Energy on delivery against transition targets, linking operational performance directly to policy accountability.
The authority is simultaneously consulting on amendments to the Electricity Industry Participation Code, with submissions open until 14 September, giving the finding practical consequence beyond a standalone assessment. Watch whether the consultation formalises faster connection timeframes as an enforceable code obligation, or whether it stops at guidance. The difference between the two will determine whether this month’s finding becomes a durable standard or a one-off compliment.
The FCA’s new conduct rules land on 37,000 unfamiliar firms
The Financial Conduct Authority’s (FCA) new non-financial misconduct rules, which took effect 1 September 2026, extend conduct-rule coverage under the Code of Conduct sourcebook (COCON) to bullying, harassment, or violence with a work-related connection to an individual’s regulated role. Unlike previous conduct-rule extensions, this one reaches roughly 37,000 firms with no prior institutional experience of operating under formal conduct-rule obligations.
That gap in institutional experience is the story. Banks and insurers have spent years building the reporting lines, investigation protocols, and record-keeping practices that conduct-rule compliance demands. Smaller advisory firms, brokers, and other newly captured entities are building this infrastructure for the first time, often without dedicated compliance headcount. The FCA’s own guidance acknowledges that proportionate application matters, but proportionality is precisely the judgement that is hardest to get right in a firm’s first year under a new regime.
The FCA’s early supervisory commentary, and any enforcement action against a newly captured firm in the coming months, will be the clearest signal of how tightly the regulator intends to police a population it has not previously supervised on this dimension, and how much grace period, implicit or explicit, new entrants can expect. Read the FCA’s policy statement.
OSFI makes its own pipeline public
The Office of the Superintendent of Financial Institutions (OSFI) held its third Quarterly Release Day of 2026 on 10 September, followed by a virtual Industry Day on 24 September, continuing a cadence it established earlier in the year to make its own regulatory pipeline visible to the institutions it supervises, instead of leaving them to infer priorities from guidance documents alone.
The more structurally interesting development sits underneath that cadence: a working group convened on 23 September to progress OSFI’s Data Collection Modernization programme, ahead of a Regulatory Data Hub the regulator says will go live in late autumn 2026. A single portal for regulatory data submission, if it delivers on its ambition, would change how a prudential regulator’s supervisory relationship with industry is administered day to day: less periodic filing, more continuous data exchange.
The test will be whether the working group’s scope matches the ambition OSFI has set for the Hub itself. Modernisation programmes of this kind often narrow in practice as institutions push back on data standardisation costs. Whether that happens here, and how OSFI balances predictability against speed, won’t be clear until well into the Hub’s actual go-live. See OSFI’s release schedule
The September 2026 Regulatory Digest covers the month’s developments in full.
