The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

DOJ WHIP Whistleblower Rewards Put a 120-Day Clock on Internal Investigations

DOJ's WHIP whistleblower rewards pay $10,000-$30,000 after charges. The 120-day rule changes internal fraud investigation priorities.

By Rebecca Leung · Oct 20, 2026

More in Breaking

91 more →

OCT 19
FinCEN Found $270 Million in Student Aid Fraud Signals. Your July Alert Response Now Needs a Lookback.
OCT 15
777 Partners' $500 Million Fraud Plea: The Collateral Control Failure Lenders Cannot Excuse
OCT 12
Linqto SEC Fraud Case: The Pre-IPO Platform Controls That Allegedly Failed
SEP 30
SEC v. Meyer Global: The $46,020 Capital Call That Allegedly Wiped Out a Nearly $3 Million SpaceX Stake
SEP 29
Travel + Leisure SEC Settlement: The $77M Loan-Portfolio Disclosure Failure
SEP 28
OTC Link Got Censured for Systems It Kept in Draft for Eight Years. Regulation SCI Doesn't Forgive 'Work in Progress'.

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

Singapore's Regulator Just Made Banks Personally Accountable for AI Their Vendors Built. US Examiners Are Already Asking the Same Questions.

On October 7, 2026, Singapore's Monetary Authority of Singapore finalized AI risk management guidelines requiring financial institutions to remain accountable for all AI in their services — including systems built, operated, or supplied by third-party vendors. US bank examiners are already asking equivalent questions. Here's what the MAS framework reveals about where US AI governance requirements are heading.

By Rebecca Leung · Oct 8, 2026

More in AI Risk

108 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Compliance Strategy

The Fed Is Restructuring How It Supervises Banks. What Bowman's Five-Region Overhaul Means for Community Banks and Their Exams.

Federal Reserve Vice Chair for Supervision Michelle Bowman announced a five-region supervision restructuring, alongside the Community Bank Leverage Ratio cut to 8% that took effect July 1. Here's what changes, what stays the same, and what community bank compliance teams should actually do.

By Rebecca Leung · Oct 12, 2026

More in Operational Risk

267 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Data Privacy

Texas's AI Law Changed What Your AI Vendors Owe You. TRAIGA's TDPSA Amendments Have Been in Effect Since January.

The Texas Responsible AI Governance Act (TRAIGA, HB 149) took effect January 1, 2026, amending the TDPSA to add AI system processor obligations. Federally insured financial institutions get a carve-out from TRAIGA's non-discrimination rules — but not from the processor amendment. Here's what fintechs and banks using AI for Texas customers need to assess now.

By Rebecca Leung · Oct 10, 2026

More in Privacy & Incidents

94 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

BCP Change Management: The Product and Vendor Changes That Should Trigger a Mid-Cycle Continuity Review

Your annual BCP review passed board approval in January. Since then you've migrated to a new core system, added a critical vendor, and launched a new product. None of those changes triggered a BCP update. The FFIEC BCM booklet lists changes like those as triggers for updating the program.

By Rebecca Leung · Oct 6, 2026

More in Resilience

75 more →

Browse the Resilience archive →

From the archive

Browse all 765 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

DOJ WHIP Whistleblower Rewards Put a 120-Day Clock on Internal Investigations

More in Breaking

FinCEN Found $270 Million in Student Aid Fraud Signals. Your July Alert Response Now Needs a Lookback.

777 Partners' $500 Million Fraud Plea: The Collateral Control Failure Lenders Cannot Excuse

Linqto SEC Fraud Case: The Pre-IPO Platform Controls That Allegedly Failed

SEC v. Meyer Global: The $46,020 Capital Call That Allegedly Wiped Out a Nearly $3 Million SpaceX Stake

Travel + Leisure SEC Settlement: The $77M Loan-Portfolio Disclosure Failure

OTC Link Got Censured for Systems It Kept in Draft for Eight Years. Regulation SCI Doesn't Forgive 'Work in Progress'.

AI Risk

Singapore's Regulator Just Made Banks Personally Accountable for AI Their Vendors Built. US Examiners Are Already Asking the Same Questions.

More in AI Risk

AI Governance Exceptions: How to Approve a Use Case With Open Testing Gaps Without Creating Permanent Waivers

Your AML Transaction Monitoring Runs on AI. Your Examiner Is About to Treat It Like a Model Under SR 26-2.

The FSB Just Finalized Its AI Governance Blueprint. What the 12 Sound Practices Mean for Your Financial Institution.

State Examiners Just Got an AI Playbook. Here's What the CSBS Framework Means for Banks and Nonbank Fintechs.

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

Operational Risk

The Fed Is Restructuring How It Supervises Banks. What Bowman's Five-Region Overhaul Means for Community Banks and Their Exams.

More in Operational Risk

The EBA Just Finalized Its Third-Party Risk Guidelines for Non-ICT Services. If You Thought DORA Covered Your EU TPRM Program, Here's What You Missed.

The OCC Just Made Recovery Planning Optional for $100 Billion Banks. Here's What Still Exists Under Safety and Soundness.

The OCC Just Hit American Express With a $350 Million AML Fine. $13 Billion in Suspected Trade-Based Money Laundering. Here's What Every Bank's BSA Officer Needs to See.

FINRA Launched a Sweep on Worst-Of Structured Notes in May. Here's What Every Broker-Dealer Needs to Check Before the Letter Arrives.

The SEC's 54-Year No-Deny Rule Is Gone. Here's What Your Enforcement Response Playbook Needs Now.

The OCC and FDIC Just Redefined What Gets You an MRA. Here's What Your Bank Needs to Do Before November 2.

Privacy & Incidents

Texas's AI Law Changed What Your AI Vendors Owe You. TRAIGA's TDPSA Amendments Have Been in Effect Since January.

More in Privacy & Incidents

Congress Just Proposed to Rewrite GLBA's Privacy Rules. The GUARD Financial Data Act Requires Opt-In Consent, Deletion Rights, and AI Disclosure. Here's the Gap Analysis.

NCUA's 2026 Cybersecurity Report: Most Credit Union Incidents Involve Vendors the Regulator Can't Examine

Your Incident Response Plan Has the Wrong Trigger. Here's What Starts the SEC's 4-Business-Day Clock.

Your Customer Wants Their Data Deleted. Federal Law Says You Can't. Here's How to Navigate the Conflict.

Most Incident Response Plans Skip This Step. It's the One Regulators Will Ask About Six Months Later.

CFPB's Section 1033 Rewrite Is at OIRA. What the Two Key Substantive Changes Mean for Banks, Fintechs, and Data Aggregators.

Resilience

BCP Change Management: The Product and Vendor Changes That Should Trigger a Mid-Cycle Continuity Review

More in Resilience

The FFIEC CAT Is Retired. The OCC Just Updated Its Exam Checklist to NIST CSF 2.0. Here's the Govern Function Gap Most Financial Institutions Are Missing.

The UK Just Put AWS, Azure, Google Cloud, and Oracle Under Direct Financial Regulatory Oversight. Here's What US Financial Services Needs to Build for Cloud Concentration Risk.

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.