The Risk Practitioner's Journal — Insights from the Field

◆ The Daily Brief

Practitioner-grade analysis,
filed daily.

Enforcement actions, regulatory deep dives, and the frameworks worth your time. Updated weekdays. 495+ articles in the archive.

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

CFPB's New Enforcement Principles: What the Bilt Case Tells You About How the Bureau Intends to Police Consumer Finance

The CFPB published its new Enforcement Principles on June 22, 2026 — a four-pillar framework that explicitly narrows when the Bureau will pursue formal action. The Bilt case, resolved without penalties the same week, is the first real-world example of what those principles look like applied.

By Rebecca Leung · Jun 22, 2026

More in Breaking

57 more →

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

Agentic AI in Financial Services 2026: The Governance Framework Your Board Doesn't Know It Needs

SR 26-2 carved agentic AI out of model risk scope in April 2026. That didn't make the risk disappear — it moved the governance burden entirely onto you. Here's what a functional agentic AI governance framework looks like and why you need one before your next exam.

By Rebecca Leung · Jul 6, 2026

More in AI Risk

80 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Operational Risk

1,155 Violations and $1.2 Billion in Restitution: What the FDIC's Spring 2026 Supervisory Highlights Say About Where Your Program Gets Tested

The FDIC's Spring 2026 Consumer Compliance Supervisory Highlights documented 1,155 violations from 2025 exams — with TILA/Reg Z alone accounting for 462, flood insurance violations generating $150 million in orders, and formal enforcement actions requiring $1.2 billion in restitution. Here's how to use the FDIC's own findings as a self-assessment checklist before your next examination.

By Rebecca Leung · Jul 8, 2026

More in Operational Risk

158 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

AI-Powered BEC Stole $3 Billion in 2025: What Your Incident Response Playbook Is Missing

The FBI's 2025 IC3 report logged $3.046 billion in BEC losses—86% via wire or ACH—with AI now generating the emails, cloning the voices, and running the deepfakes. Most financial institution IR playbooks were written before this threat existed. Here's the gap analysis and what to add before the next one hits.

By Rebecca Leung · Jul 8, 2026

More in Privacy & Incidents

60 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

Power and Telecommunications Resilience: What the 2026 FFIEC BCM Booklet Requires You to Document and Test

The 2026 FFIEC BCM Booklet elevated power and telecommunications resilience from a supporting concern to a standalone examination focus. Here's what examiners now look for in generator testing, telecom redundancy documentation, and alternate site utility independence.

By Rebecca Leung · Jul 4, 2026

More in Resilience

57 more →

Browse the Resilience archive →

From the archive

495 posts in total

Practitioner-grade analysis,filed daily.

Breaking

CFPB's New Enforcement Principles: What the Bilt Case Tells You About How the Bureau Intends to Police Consumer Finance

More in Breaking

NCUA 2026 Supervisory Priorities: What Credit Union Examiners Are Testing for AI, Lending, and BSA/AML Compliance

Regulation E and P2P Payment Scam Liability: What the $175M Cash App Consent Order Tells Banks About Their Investigation Process

Nacha ACH Fraud Monitoring Phase 2: The June 22 Compliance Deadline Every Financial Institution Is Treating as Optional (It Isn't)

NYDFS Part 500 Enforcement in 2025-2026: What $25 Million in Fines Reveals About What Regulators Actually Check

SEC's Final Judgment Against Black Hawk's Robert Newell: How a $37M Cannabis Fund Became a Ponzi Case Study

SEC Adani $18M Settlement: When Anti-Bribery Disclosures Become Securities Fraud

AI Risk

Agentic AI in Financial Services 2026: The Governance Framework Your Board Doesn't Know It Needs

More in AI Risk

SR 26-2 for Community and Regional Banks: What the Proportionality Principle Actually Requires

SR 26-2 and OCC 2026-13: What the New Model Risk Management Guidance Changes — and the GenAI Gap Your Program Needs to Close

EU AI Act August 2, 2026: Your 32-Day Compliance Checklist — What's Still Required After the Omnibus Deferral

NYDFS Put Every Regulated Entity on Notice About Frontier AI Cyber Risk — Here's What the May 21 Guidance Requires

CFPB Reg B Overhaul Takes Effect July 21: What the Disparate Impact Removal Actually Means for AI Credit Models

AI Audit Trail in Financial Services: What to Log, How Long to Keep It, and What Examiners Test

Operational Risk

1,155 Violations and $1.2 Billion in Restitution: What the FDIC's Spring 2026 Supervisory Highlights Say About Where Your Program Gets Tested

More in Operational Risk

FinCEN's June 2026 Update Turns Section 314(b) Into a Real-Time Fraud-Fighting Tool

The Marquis Software Breach: What 80 Banks and Credit Unions Need to Learn About Vendor Concentration Risk

What the OCC's CFSB Consent Order Says About BSA/AML Risk in Fintech Payment Partnerships

OCC's 2026 Exam Rightsizing: What Community Banks Should Stop Doing—and What Still Gets You Written Up

The 2026 CRE Loan Maturity Wall: How Community Banks Should Stress-Test Their Commercial Real Estate Portfolios Right Now

AI Foundation Model Concentration Risk: When Your Entire AI Stack Depends on Three Vendors

Privacy & Incidents

AI-Powered BEC Stole $3 Billion in 2025: What Your Incident Response Playbook Is Missing

More in Privacy & Incidents

Connecticut's CDPA Took Effect Last Tuesday: Financial Account Data Is Now Sensitive Data, the Threshold Dropped to 35,000, and There's No 60-Day Grace Period

Biometric Data in Financial Services: The BIPA Exemption Isn't as Broad as Your Vendors Think

KYC in the Deepfake Era: Why Document + Selfie Verification Is Failing and What Actually Works

Breach Notification Letter Template: What the Law Requires, What Regulators Charge For, and Why Your Approval Process Fails Under Pressure

Minnesota's MCDPA Has Been Enforcing Since January — Your GLBA Exemption Doesn't Cover What You Think It Does

FTC Health Breach Notification Rule: What Non-HIPAA Health Data Holders Must Report and When

Resilience

Power and Telecommunications Resilience: What the 2026 FFIEC BCM Booklet Requires You to Document and Test

More in Resilience

Your BCP Activation Just Became a Regulatory Notification Trigger: What FCA/PRA PS26/2 Requires by March 2027

BCP Update Triggers: When FFIEC Requires You to Revise Your Business Continuity Plan Between Annual Reviews

Third-Party Dependent BCP: What FFIEC BCM and OCC 2023-17 Require You to Verify About Vendor Continuity

Communications Failure BCP: When Your Telecom, Email, and Collaboration Platforms Go Down Simultaneously

When Your Bank Partner Fails: The BCP Scenario Fintechs Keep Skipping Until It's Too Late

Business Continuity KRIs: Metrics That Show Whether Your BCP Is Actually Working

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.