The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

FinCEN's Student Aid Fraud Alert: The ACH Refund Pattern Banks Need to Tune Now

FinCEN's student aid fraud alert gives banks nine red flags, a SAR keyword, and a clear transaction-monitoring task for ACH refunds.

By Rebecca Leung · Jul 23, 2026

More in Breaking

61 more →

JUL 23
Magnolia Diagnostics False Claims Act Settlement: Why Investors Paid Part of the $24 Million
JUL 21
United Texas Bank's OCC Consent Order at Charter Conversion: The BSA/AML Lesson for Crypto Banking
JUL 14
SEC's 'Back to Basics' Enforcement Pivot: What the 2026 Mid-Year Update Means for Investment Advisers and Broker-Dealers
JUN 22
CFPB's New Enforcement Principles: What the Bilt Case Tells You About How the Bureau Intends to Police Consumer Finance
JUN 19
NCUA 2026 Supervisory Priorities: What Credit Union Examiners Are Testing for AI, Lending, and BSA/AML Compliance
JUN 16
Regulation E and P2P Payment Scam Liability: What the $175M Cash App Consent Order Tells Banks About Their Investigation Process

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

NIST AI RMF Implementation: The Minimum Artifact Set for a Team That Cannot Build 200 Controls

What a small risk team actually needs to produce for NIST AI RMF and FS AI RMF compliance — 12 artifacts across GOVERN, MAP, MEASURE, and MANAGE that hold up to examiner scrutiny.

By Rebecca Leung · Jul 24, 2026

More in AI Risk

90 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Operational Risk

Enterprise Risk Management After Approval: The Operating Cadence That Keeps ERM Alive

Run an enterprise risk management framework with a practical monthly, quarterly, and annual cadence, named owners, and decision evidence.

By Rebecca Leung · Jul 25, 2026

More in Operational Risk

187 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

Incident Response Decision Log: Document Why a Notification Clock Did—or Did Not—Start

When a cyber event hits, every regulator wants the same thing: proof you made a good-faith materiality determination without unreasonable delay. Here's the decision log structure that creates that proof—whether the clock started or not.

By Rebecca Leung · Jul 24, 2026

More in Privacy & Incidents

71 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

FFIEC BCM Section III.B Risk Assessment: Turn Threats Into Continuity Strategies

Build an FFIEC BCM Section III.B risk assessment that traces threats, controls, gaps, continuity strategies, tests, and remediation.

By Rebecca Leung · Jul 24, 2026

More in Resilience

62 more →

Browse the Resilience archive →

From the archive

Browse all 563 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

FinCEN's Student Aid Fraud Alert: The ACH Refund Pattern Banks Need to Tune Now

More in Breaking

Magnolia Diagnostics False Claims Act Settlement: Why Investors Paid Part of the $24 Million

United Texas Bank's OCC Consent Order at Charter Conversion: The BSA/AML Lesson for Crypto Banking

SEC's 'Back to Basics' Enforcement Pivot: What the 2026 Mid-Year Update Means for Investment Advisers and Broker-Dealers

CFPB's New Enforcement Principles: What the Bilt Case Tells You About How the Bureau Intends to Police Consumer Finance

NCUA 2026 Supervisory Priorities: What Credit Union Examiners Are Testing for AI, Lending, and BSA/AML Compliance

Regulation E and P2P Payment Scam Liability: What the $175M Cash App Consent Order Tells Banks About Their Investigation Process

AI Risk

NIST AI RMF Implementation: The Minimum Artifact Set for a Team That Cannot Build 200 Controls

More in AI Risk

AI Governance Decision Log: The Missing Artifact Between Committee Meetings and Production Approval

August 2 Is Ten Days Away: What the EU AI Act's High-Risk Deadline Actually Requires from Financial Services AI

Your State Regulator Is About to Ask for Your AI Inventory: What the NAIC's 12-State Pilot Means for Insurance AI Governance

CFPB Deleted Disparate Impact from Reg B. Here's What Actually Changed for AI Lenders Today.

Sign or Skip: The EU AI Act Transparency Code of Practice Decision Financial Services Firms Have Three Days to Make

Fannie Mae LL-2026-04: What Mortgage Sellers and Servicers Must Build Before August 6 — and Why Freddie Mac's March 3 Deadline Already Exposed Gaps

Operational Risk

Enterprise Risk Management After Approval: The Operating Cadence That Keeps ERM Alive

More in Operational Risk

Policy Exception Management: Stop Temporary Waivers From Becoming the Real Policy

GRC Framework for a Small Risk Team: One Control Library, Five Workflows, No Enterprise Platform

Third-Party Risk Management Lifecycle RACI: Fix the Handoffs Between Procurement, Security, Legal, Business Owners, and Risk

Compliance Monitoring Plan in Excel: Convert the Risk Assessment Into a Defensible Test Universe

Risk Assessment Template in Excel: Build the Evidence Trail, Not Just the Heat Map

Vendor Due Diligence Without a SOC 2: What Evidence Can Actually Substitute

Privacy & Incidents

Incident Response Decision Log: Document Why a Notification Clock Did—or Did Not—Start

More in Privacy & Incidents

Four Months Late: What the NYDFS Healthplex $2M Penalty Says About When the Notification Clock Actually Starts

Three Clocks, One Incident: How to Manage the Overlapping Cyber Notification Timelines Under OCC, NYDFS, and SEC Rules

Oregon's Privacy Law Has a Feature No Other State Has — and Financial Services Companies Are Probably in Scope

The Flagstar Blueprint: What the SEC's $3.5M Fine Teaches Every Financial Institution About Cyber Incident Disclosure

Connecticut's CTDPA Just Got a Lot Bigger — And Fintechs May Not Know They're Covered

NYDFS Part 500 in 2026: What 27 Consent Orders and $144M in Fines Tell You About Examiner Priorities

Resilience

FFIEC BCM Section III.B Risk Assessment: Turn Threats Into Continuity Strategies

More in Resilience

BCP Testing That Actually Satisfies Examiners: What FFIEC Requires Beyond Your Annual Tabletop

The October 2025 AWS Outage Was a BCP Exam That Most Fintechs Didn't Know They Were Taking

Software Supply Chain Failure BCP Scenarios: What FFIEC Guidance and Post-CrowdStrike Expectations Require Financial Institutions to Test in 2026

Hurricane Season BCP Testing: What FFIEC Examiners Expect Financial Institutions to Document Before October

Power and Telecommunications Resilience: What the 2026 FFIEC BCM Booklet Requires You to Document and Test

Your BCP Activation Just Became a Regulatory Notification Trigger: What FCA/PRA PS26/2 Requires by March 2027

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.