◆ The Daily Brief
Enforcement actions, regulatory deep dives, and the frameworks worth your time. Updated weekdays. 671+ articles in the archive.
● Live · Updated daily
SEC · DOJ · OCC · FFIEC enforcement
Breaking Regulatory Compliance
The SEC sued 38 entities over false Form ADV filings. Here is how compliance teams should verify advisers when a public filing is not proof of approval.
By Rebecca Leung · Aug 27, 2026
◆ Models · Governance · NIST AI RMF
Long form · Updated weekly
Feature · AI Risk
The OCC's revised model risk guidance explicitly excludes generative and agentic AI. The Treasury's FS AI RMF fills the gap with 230 control objectives — including board-level reporting requirements. Here's what your board packet needs to show before the examiner asks.
By Rebecca Leung · Aug 27, 2026
◆ RCSA · KRIs · TPRM · Compliance Strategy
Frameworks · Deep dives
Feature · Compliance Strategy
SEC and FINRA enforcement against individual compliance officers is accelerating in 2025–2026. Here's what the three-part personal liability test actually means, what recent cases look like, and how to build a compliance function that protects the institution and the person running it.
By Rebecca Leung · Aug 27, 2026
◆ Data privacy laws · Incident response
State laws · IR playbooks
Feature · Incident Response
Filing the 36-hour OCC incident notification is not the end of the process. What follows—examiner review, documentation requests, and examination findings—is where incident response programs either hold up or fall apart. Here's what to prepare for.
By Rebecca Leung · Aug 22, 2026
◆ BCP · DR · Operational continuity
BCP · Disaster recovery
Feature · Business Continuity
Collecting your vendor's SOC 2 and test summary isn't FFIEC BCM compliance. Examiners want to see that you've integrated your critical vendors' continuity plans into your own BCP—with evidence of end-to-end testing and notification tracking.
By Rebecca Leung · Aug 23, 2026