The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack

The Lugano Diamonds SEC fraud case shows how alleged fake revenue, inventory, and vendor records survived acquisition and audit controls.

By Rebecca Leung · Sep 1, 2026

More in Breaking

74 more →

SEP 1
SAR Confidentiality and Customer Communications: What Banks Can Now Say
AUG 28
The OCC and FDIC Just Defined 'Unsafe or Unsound' for the First Time. What the New MRA Standard Means for Your Bank.
AUG 27
SEC False Form ADV Cases: 38 Fake Advisers Turned a Public Filing Into a Trust Signal
AUG 25
SEC Free-Riding Case: The Instant Deposit Credit Controls Broker-Dealers Need to Test
AUG 20
SEC's Tricolor Fraud Case: The Double-Pledging Controls Lenders Missed
AUG 11
FINRA's 24 Enforcement Review Recommendations: Read Them as Proposals, Not Rules

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

The ESRB Upgraded AI Cyber Risk to 'Severe.' Here's the Five-Area Action Plan Europe's Biggest Banks Must File by October 31.

ESRB Warning ESRB/2026/3 and the ECB's July 7 supervisory letter require significant institutions to submit AI-enabled cybersecurity action plans by October 31, 2026. Here's what the six-area framework covers and what it means for US institutions with EU operations.

By Rebecca Leung · Sep 1, 2026

More in AI Risk

103 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Operational Risk

The OCC's Spring 2026 Risk Perspective Named Three Operational Threats. Here's What Your Program Needs to Fix.

The OCC's Spring 2026 Semiannual Risk Perspective shifted focus from credit risk to operational resilience—flagging legacy technology, rising fraud, and sophisticated cyber threats as the top concerns. Here's what that means for your risk program.

By Rebecca Leung · Aug 30, 2026

More in Operational Risk

236 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

The FTC's 30-Day Breach Notification Requirement: What Non-Bank Fintechs Keep Getting Wrong

The FTC's Safeguards Rule amendment has required non-bank financial institutions to report data breaches to the FTC within 30 days since May 13, 2024. The clock starts when any employee discovers the breach — not when legal decides it's reportable. Here's what most fintech incident response plans still don't address.

By Rebecca Leung · Aug 29, 2026

More in Privacy & Incidents

85 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

Collecting your vendor's SOC 2 and test summary isn't FFIEC BCM compliance. Examiners want to see that you've integrated your critical vendors' continuity plans into your own BCP—with evidence of end-to-end testing and notification tracking.

By Rebecca Leung · Aug 23, 2026

More in Resilience

72 more →

Browse the Resilience archive →

From the archive

Browse all 685 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack

More in Breaking

SAR Confidentiality and Customer Communications: What Banks Can Now Say

The OCC and FDIC Just Defined 'Unsafe or Unsound' for the First Time. What the New MRA Standard Means for Your Bank.

SEC False Form ADV Cases: 38 Fake Advisers Turned a Public Filing Into a Trust Signal

SEC Free-Riding Case: The Instant Deposit Credit Controls Broker-Dealers Need to Test

SEC's Tricolor Fraud Case: The Double-Pledging Controls Lenders Missed

FINRA's 24 Enforcement Review Recommendations: Read Them as Proposals, Not Rules

AI Risk

The ESRB Upgraded AI Cyber Risk to 'Severe.' Here's the Five-Area Action Plan Europe's Biggest Banks Must File by October 31.

More in AI Risk

AI Governance Board Reporting in 2026: What the FS AI RMF and Examiner Expectations Actually Require

SEC GenesisAI Case: The Crowdfunding Controls Behind AI Revenue Claims

AI Is Now a Standing Examination Topic at Every Bank. Here's What the OCC and Federal Reserve Are Actually Asking.

EU AI Act Enforcement Started August 2. Here's What US Fintechs With EU Customers Need to Fix Right Now.

Human-Review Control Test for AI Decisions: Authority, Override Quality, Escalation, and Rubber-Stamp Risk

AI Chatbot Production-Sampling Plan: Golden Prompts, Live Outputs, Harm Ratings, Escalation, and Evidence

Operational Risk

The OCC's Spring 2026 Risk Perspective Named Three Operational Threats. Here's What Your Program Needs to Fix.

More in Operational Risk

Reputation Risk Is Gone from Bank Supervision. Here's What the OCC-FDIC Final Rule Actually Changes.

The FDIC Is Building a Fintech Certification Program. What BISDO and RAMP Mean for Your Third-Party Risk Program.

FDIC Reciprocal Deposits Rule: The New $30 Billion Cap Is Not a Liquidity Free Pass

FINRA's Reg BI Enforcement Wave Is Here: 134 Cases, 72% Surge, and the Supervisory Failures Driving Them

The SEC's Whistleblower Program Just Had Its Best Quarter Ever. What That Means for Your Internal Compliance Program.

CCO Personal Liability in 2026: What the SEC and FINRA Are Now Charging Compliance Officers With

Privacy & Incidents

The FTC's 30-Day Breach Notification Requirement: What Non-Bank Fintechs Keep Getting Wrong

More in Privacy & Incidents

NYDFS Fined a Money Transmitter $250K for Its Risk Assessment, Not the Ransomware. What Even Limited-Exempt Entities Must Have.

After the 36-Hour Clock Stops: What OCC Examiners Review Following a Bank Cyber Incident

SEC Regulation S-P's June 2026 Deadline Has Passed: What Smaller Investment Advisers Still Need to Fix in Their Incident Response Programs

Global Privacy Control for Financial Services: A State-by-State Scope Test

California Just Fined a Data Broker $116K for Making Opt-Out Too Hard. Your Fintech's Data Practices Are Next.

Washington MHMDA for Fintech: The GLBA Data Exemption and CPA Enforcement

Resilience

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

More in Resilience

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

Tabletop Exercise Evaluation Rubric: Ratings, Assignments, and Observation Notes

BIA Quality Assurance: Challenge Outliers and Calibrate Scores Across Business Units

Operational Resilience Critical-Service Dependency Crosswalk: Reconcile Processes, Systems, Vendors, Facilities, and People

Tabletop Exercise Injects: Build an MSEL That Tests Decisions

FCA Operational Resilience: Six Evidence Checks From Its One-Year Observations

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.