The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test

The SEC's Doximity insider trading judgment exposes two MNPI control tests: earnings access and post-termination trading.

By Rebecca Leung · Sep 10, 2026

More in Breaking

78 more →

SEP 9
FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity
SEP 4
The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program
SEP 3
Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.
SEP 1
Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack
SEP 1
SAR Confidentiality and Customer Communications: What Banks Can Now Say
AUG 28
The OCC and FDIC Just Defined 'Unsafe or Unsound' for the First Time. What the New MRA Standard Means for Your Bank.

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

FINRA's 2026 Annual Regulatory Oversight Report formally classified agentic AI as an active supervisory priority, with examinations targeting broker-dealer governance in Q2-Q3 2026. Here is what examiners are asking about and what your program needs to have documented.

By Rebecca Leung · Sep 9, 2026

More in AI Risk

107 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Third-Party Risk

OCC's 2026 Third-Party Risk Guidance Rewrite: What Banks Should Change Now

The 2026 third-party risk guidance proposal rewrites vendor tiering and gives community banks leverage with core providers.

By Rebecca Leung · Sep 10, 2026

More in Operational Risk

248 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Data Privacy

FTC Chairman Ferguson Says a Privacy Enforcement Surge Is Coming in H2 2026. Here's What Financial Services Companies Need in Place.

FTC Chairman Andrew Ferguson publicly warned that reporters covering the FTC will 'have a hard time keeping up' with the number of privacy enforcement cases coming in the second half of 2026. The Kochava settlement and new Section 5 standalone data-security cases telegraph exactly what's in the crosshairs. Here's what financial services companies need to have documented before the cases start landing.

By Rebecca Leung · Sep 8, 2026

More in Privacy & Incidents

91 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

The FFIEC Business Continuity Management booklet shifted the examination standard from recovery planning to operational resilience — but most fintechs and community banks still have a document, not a management process. Here are the seven BCM components, the most common examination findings, and what a defensible program actually looks like.

By Rebecca Leung · Sep 6, 2026

More in Resilience

74 more →

Browse the Resilience archive →

From the archive

Browse all 716 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test

More in Breaking

FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity

The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program

Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.

Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack

SAR Confidentiality and Customer Communications: What Banks Can Now Say

The OCC and FDIC Just Defined 'Unsafe or Unsound' for the First Time. What the New MRA Standard Means for Your Bank.

AI Risk

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

More in AI Risk

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

The EU AI Office Started On-Site Audits August 30. Here's What September 2026's High-Risk AI Inspections Are Actually Requesting.

The FTC Just Put AI Pricing on Notice. What the Personalized Pricing Statement Means for Your Fintech.

The ESRB Upgraded AI Cyber Risk to 'Severe.' Here's the Five-Area Action Plan Europe's Biggest Banks Must File by October 31.

AI Governance Board Reporting in 2026: What the FS AI RMF and Examiner Expectations Actually Require

SEC GenesisAI Case: The Crowdfunding Controls Behind AI Revenue Claims

Operational Risk

OCC's 2026 Third-Party Risk Guidance Rewrite: What Banks Should Change Now

More in Operational Risk

Everest Ransomware Hit Citizens Bank and Frost Bank Through a Vendor Nobody Will Name. Six Class Actions Later, Here's What Your TPRM Program Needs.

DORA Is in Active Enforcement and 44% of Financial Institutions Still Have Gaps. Here's What Supervisors Are Finding — and What Your Program Needs to Fix Before They Get to You.

FinCEN Hit UBS With a Record $125 Million 'Willful' BSA Fine — and FINRA Added $20 Million More. What the Double-Barrel Enforcement Action Means for Your AML Program.

FinCEN's Southwest Border GTO Just Expired. Here's What MSBs in Four States Need to Know Now.

NYDFS Said It in October. Examiners Are Checking in 2026. What Your Vendor Program Needs to Reflect the Part 500 Third-Party Guidance.

FinCEN's Scam Center Alert: What BSA Officers Need to Do with FIN-2026-Alert005

Privacy & Incidents

FTC Chairman Ferguson Says a Privacy Enforcement Surge Is Coming in H2 2026. Here's What Financial Services Companies Need in Place.

More in Privacy & Incidents

CISA's CIRCIA Is Finalizing This Month. Here's What the New 72-Hour Reporting Clock Means for Your Financial Services Incident Response Program.

CalPrivacy Has Issued Eight Data Broker Fines and Is Still Going. What the September 2026 Enforcement Advisory Means for Your Fintech.

PADFAA Is Real Enforcement Now: What Fintech Data Companies Need to Know Before the FTC Files Its First Case

The 36-Hour Notification Clock Doesn't Wait for Your Investigation. Here's What the OCC's June 2026 Cybersecurity Report Means for Your Incident Response Program.

GM Paid $12.75M for Selling Driver Data Without Consent. Your Fintech May Have the Same Problem.

The FTC's 30-Day Breach Notification Requirement: What Non-Bank Fintechs Keep Getting Wrong

Resilience

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

More in Resilience

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

Tabletop Exercise Evaluation Rubric: Ratings, Assignments, and Observation Notes

BIA Quality Assurance: Challenge Outliers and Calibrate Scores Across Business Units

Operational Resilience Critical-Service Dependency Crosswalk: Reconcile Processes, Systems, Vendors, Facilities, and People

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.