The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

OFAC Just Codified Its Penalty Playbook. What 31 CFR Part 505 Means for Your Sanctions Compliance Program.

On September 25, 2026, OFAC's new Sanctions Penalties Regulations (31 CFR Part 505) took effect — the first time OFAC has consolidated its civil and criminal penalty procedures into formal regulations. Here's what changed and what your compliance program needs to account for.

By Rebecca Leung · Sep 26, 2026

More in Breaking

86 more →

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

SR 26-2 Governs Your Models. It Doesn't Govern Your Generative AI. Here's the Gap Your Program Has to Fill.

The April 2026 interagency model risk guidance updated SR 11-7 for AI — then explicitly carved out generative and agentic AI. State examiners are already asking what fills the gap. Here's what your GenAI governance program actually needs to build.

By Rebecca Leung · Sep 23, 2026

More in AI Risk

112 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Compliance Strategy

Stop Building for the October 1 Form PF Deadline. It Just Moved to July 2027 — for the Fourth Time.

The SEC and CFTC extended the Form PF compliance date to July 1, 2027 — the fourth extension of the February 2024 amendments. If your firm was building systems to meet October 2026, here's what changed and what to do instead.

By Rebecca Leung · Sep 26, 2026

More in Operational Risk

268 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

Both Reg S-P Deadlines Have Passed. Here's What SEC Examiners Are Now Checking When They Walk Into Your Firm.

Regulation S-P compliance deadlines passed for larger entities in December 2025 and for smaller entities in June 2026. The SEC named it an examination priority for FY 2026. Here is what examiners are actually testing, and where the most common deficiencies appear.

By Rebecca Leung · Sep 25, 2026

More in Privacy & Incidents

99 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

The UK Just Put AWS, Azure, Google Cloud, and Oracle Under Direct Financial Regulatory Oversight. Here's What US Financial Services Needs to Build for Cloud Concentration Risk.

On July 13, 2026, the UK's Critical Third Parties regime went live with four cloud hyperscalers designated under direct FCA/PRA oversight. The US interagency TPRM proposed guidance addresses the same concentration risk. Here's what your business continuity and vendor risk programs need to do.

By Rebecca Leung · Sep 21, 2026

More in Resilience

77 more →

Browse the Resilience archive →

From the archive

Browse all 774 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

OFAC Just Codified Its Penalty Playbook. What 31 CFR Part 505 Means for Your Sanctions Compliance Program.

More in Breaking

Nano Banc Failed at 0.82% Capital: The Enforcement Timeline Risk Teams Should Read

FINRA's American Portfolios UIT Case: Build the Rollover Surveillance Before the Next Exam

SEC Billimek-Williams Front-Running Settlement: The Surveillance Pattern Firms Should Test

Wavemark Capital SEC Settlement: The Use-of-Proceeds Controls Behind a $9.6M Mobile Home Offering

Nodus Bank CEO Sentenced: The Control Failures Behind a $24.9M Fraud and Sanctions Scheme

Vitol Trader Sentenced in FCPA Bribery Scheme: The Payment Controls That Failed

AI Risk

SR 26-2 Governs Your Models. It Doesn't Govern Your Generative AI. Here's the Gap Your Program Has to Fill.

More in AI Risk

State Examiners Just Got an AI Playbook. Here's What the CSBS Framework Means for Banks and Nonbank Fintechs.

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

Operational Risk

Stop Building for the October 1 Form PF Deadline. It Just Moved to July 2027 — for the Fourth Time.

More in Operational Risk

FTC Made Corpay's CEO Pay Personally. The $100 Million Unauthorized Fee Case Rewrites What 'Authorization' Means for Billing Controls.

Four Agencies Just Proposed to Kill the TPRM Checklist. Here's What 'Risk-Proportionate' Vendor Oversight Actually Means.

The SEC Proposed to Rescind the Pay-to-Play Rule. Your Compliance Program Shouldn't Change Yet.

Congress Never Defined 'Unsafe or Unsound.' Regulators Just Did. What the OCC/FDIC Final Rule Means for Your Risk Program.

The SEC Just Published Your Annual Compliance Review Exam Checklist

FinCEN Hit UBS with a $125 Million Record Fine for BSA Failures It Already Paid to Fix. Here's What Recidivist AML Enforcement Means for Your Program.

Privacy & Incidents

Both Reg S-P Deadlines Have Passed. Here's What SEC Examiners Are Now Checking When They Walk Into Your Firm.

More in Privacy & Incidents

Your Analytics Stack Is a GLBA Time Bomb. The Class Action Wave Targeting Financial Institutions That Use Meta Pixel Has Arrived.

California Just Fined GM $12.75 Million for Selling Driver Data Without Consent. Your Financial Data Practices Face the Same Scrutiny.

NYDFS's May Guidance on Heightened Cybersecurity Threats Is Now an Exam Reference. Here's What Your IR Program Needs to Show.

Montana and Connecticut Just Narrowed the GLBA Exemption. Every Nonbank Financial Institution Has New Privacy Obligations.

NYDFS Just Published a 'How-To' for Cyber Risk Assessments. Most of Yours Still Won't Pass.

NYDFS Fined Delta Dental $2.25M for an IR Plan That Couldn't Answer the Right Questions. Can Yours?

Resilience

The UK Just Put AWS, Azure, Google Cloud, and Oracle Under Direct Financial Regulatory Oversight. Here's What US Financial Services Needs to Build for Cloud Concentration Risk.

More in Resilience

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.