The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

777 Partners' $500 Million Fraud Plea: The Collateral Control Failure Lenders Cannot Excuse

The 777 Partners fraud plea shows how double-pledged assets, restricted cash misuse, and doctored statements defeated lender controls.

By Rebecca Leung · Oct 15, 2026

More in Breaking

93 more →

OCT 12
Linqto SEC Fraud Case: The Pre-IPO Platform Controls That Allegedly Failed
SEP 30
SEC v. Meyer Global: The $46,020 Capital Call That Allegedly Wiped Out a Nearly $3 Million SpaceX Stake
SEP 29
Travel + Leisure SEC Settlement: The $77M Loan-Portfolio Disclosure Failure
SEP 28
OTC Link Got Censured for Systems It Kept in Draft for Eight Years. Regulation SCI Doesn't Forgive 'Work in Progress'.
SEP 28
SEC AI Trading Scam Cases: Fake Registration Signals Helped Alleged Schemes Take $15.3M
SEP 28
SEC Fines Zoe Financial $450,000: The Algorithm Wasn't the Control

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

Singapore's Regulator Just Made Banks Personally Accountable for AI Their Vendors Built. US Examiners Are Already Asking the Same Questions.

On October 7, 2026, Singapore's Monetary Authority of Singapore finalized AI risk management guidelines requiring financial institutions to remain accountable for all AI in their services — including systems built, operated, or supplied by third-party vendors. US bank examiners are already asking equivalent questions. Here's what the MAS framework reveals about where US AI governance requirements are heading.

By Rebecca Leung · Oct 8, 2026

More in AI Risk

116 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Compliance Strategy

The Fed Is Restructuring How It Supervises Banks. What Bowman's Five-Region Overhaul Means for Community Banks and Their Exams.

Federal Reserve Vice Chair for Supervision Michelle Bowman announced a five-region supervision restructuring, alongside the Community Bank Leverage Ratio cut to 8% that took effect July 1. Here's what changes, what stays the same, and what community bank compliance teams should actually do.

By Rebecca Leung · Oct 12, 2026

More in Operational Risk

289 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

The SEC's Reg S-P Deadline Has Passed. Division of Examinations Is Already Knocking. Here's What They're Looking For.

The June 3, 2026 Regulation S-P compliance deadline for smaller entities passed four months ago. The SEC's Division of Examinations listed Reg S-P in its FY2026 examination priorities. If you're a smaller RIA or broker-dealer and your incident response program is still 'in progress,' here's what the exam priorities say examiners will look at and where programs tend to fall short.

By Rebecca Leung · Oct 11, 2026

More in Privacy & Incidents

108 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

The OCC's June 2026 Cybersecurity Report Flagged Cloud Concentration Risk as Systemic. Most Bank BCPs Still Don't Have a Hyperscaler Outage Scenario.

The OCC's June 2026 Cybersecurity and Financial System Resilience Report warned that supply chain attacks target systems used by large numbers of organizations and called for a comprehensive approach to operational resilience. One failed hyperscaler can hit many of your vendors at once. Most BCPs model 'technology failure,' not 'AWS down for 48 hours with half your vendors also down.' Here's the gap and how to close it.

By Rebecca Leung · Oct 9, 2026

More in Resilience

79 more →

Browse the Resilience archive →

From the archive

Browse all 833 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

777 Partners' $500 Million Fraud Plea: The Collateral Control Failure Lenders Cannot Excuse

More in Breaking

Linqto SEC Fraud Case: The Pre-IPO Platform Controls That Allegedly Failed

SEC v. Meyer Global: The $46,020 Capital Call That Allegedly Wiped Out a Nearly $3 Million SpaceX Stake

Travel + Leisure SEC Settlement: The $77M Loan-Portfolio Disclosure Failure

OTC Link Got Censured for Systems It Kept in Draft for Eight Years. Regulation SCI Doesn't Forgive 'Work in Progress'.

SEC AI Trading Scam Cases: Fake Registration Signals Helped Alleged Schemes Take $15.3M

SEC Fines Zoe Financial $450,000: The Algorithm Wasn't the Control

AI Risk

Singapore's Regulator Just Made Banks Personally Accountable for AI Their Vendors Built. US Examiners Are Already Asking the Same Questions.

More in AI Risk

AI Governance Exceptions: How to Approve a Use Case With Open Testing Gaps Without Creating Permanent Waivers

Your AML Transaction Monitoring Runs on AI. Your Examiner Is About to Treat It Like a Model Under SR 26-2.

The FSB Just Finalized Its AI Governance Blueprint. What the 12 Sound Practices Mean for Your Financial Institution.

SR 26-2 Governs Your Models. It Doesn't Govern Your Generative AI. Here's the Gap Your Program Has to Fill.

State Examiners Just Got an AI Playbook. Here's What the CSBS Framework Means for Banks and Nonbank Fintechs.

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

Operational Risk

The Fed Is Restructuring How It Supervises Banks. What Bowman's Five-Region Overhaul Means for Community Banks and Their Exams.

More in Operational Risk

FinCEN's $125 Million UBS Penalty Breaks the Broker-Dealer Record Again — Three Months After It Was Set. The Lesson Is About What Happens After a Consent Order.

The EBA Just Finalized Its Third-Party Risk Guidelines for Non-ICT Services. If You Thought DORA Covered Your EU TPRM Program, Here's What You Missed.

The OCC Just Made Recovery Planning Optional for $100 Billion Banks. Here's What Still Exists Under Safety and Soundness.

The OCC Just Hit American Express With a $350 Million AML Fine. $13 Billion in Suspected Trade-Based Money Laundering. Here's What Every Bank's BSA Officer Needs to See.

FINRA Launched a Sweep on Worst-Of Structured Notes in May. Here's What Every Broker-Dealer Needs to Check Before the Letter Arrives.

The SEC's 54-Year No-Deny Rule Is Gone. Here's What Your Enforcement Response Playbook Needs Now.

Privacy & Incidents

The SEC's Reg S-P Deadline Has Passed. Division of Examinations Is Already Knocking. Here's What They're Looking For.

More in Privacy & Incidents

Texas's AI Law Changed What Your AI Vendors Owe You. TRAIGA's TDPSA Amendments Have Been in Effect Since January.

Congress Just Proposed to Rewrite GLBA's Privacy Rules. The GUARD Financial Data Act Requires Opt-In Consent, Deletion Rights, and AI Disclosure. Here's the Gap Analysis.

NCUA's 2026 Cybersecurity Report: Most Credit Union Incidents Involve Vendors the Regulator Can't Examine

Your Incident Response Plan Has the Wrong Trigger. Here's What Starts the SEC's 4-Business-Day Clock.

Your Reg S-P Compliance Deadline Passed in June. Now the SEC Is Examining for It.

Your Customer Wants Their Data Deleted. Federal Law Says You Can't. Here's How to Navigate the Conflict.

Resilience

The OCC's June 2026 Cybersecurity Report Flagged Cloud Concentration Risk as Systemic. Most Bank BCPs Still Don't Have a Hyperscaler Outage Scenario.

More in Resilience

BCP Change Management: The Product and Vendor Changes That Should Trigger a Mid-Cycle Continuity Review

The FFIEC CAT Is Retired. The OCC Just Updated Its Exam Checklist to NIST CSF 2.0. Here's the Govern Function Gap Most Financial Institutions Are Missing.

CISA Is Finalizing CIRCIA This Fall. Here's What Financial Services Needs to Build Before the 72-Hour Clock Starts.

The UK Just Put AWS, Azure, Google Cloud, and Oracle Under Direct Financial Regulatory Oversight. Here's What US Financial Services Needs to Build for Cloud Concentration Risk.

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.