The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

The Exodus OFAC Settlement: What a $3.1M Crypto Wallet Enforcement Action Teaches About Sanctions Compliance Programs

OFAC's December 2025 settlement with Exodus Movement — $3.1 million for 254 apparent violations of the Iranian Transactions and Sanctions Regulations — is the clearest statement yet that non-custodial crypto wallets are in scope for sanctions obligations. The finding that staff advised Iranian users to use VPNs is the detail that turns a compliance failure into an egregious one.

By Rebecca Leung · Jul 30, 2026

More in Breaking

65 more →

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

EU AI Act August 2, 2026: What's Going Live, What Got Pushed to December 2027, and What US Fintechs Need to Do This Week

August 2, 2026 is five days away. The Digital Omnibus deferral is now final law. Here's what actually goes into effect on August 2 vs. what got moved to December 2027 — and the two-hour compliance check US fintechs should run now.

By Rebecca Leung · Jul 27, 2026

More in AI Risk

92 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Compliance Strategy

Bank Holding Company Source-of-Strength: What Fintechs Getting Bank Charters Haven't Accounted For

When a fintech gets a bank charter and forms a bank holding company, it inherits the source-of-strength obligation — a capital backstop requirement most fintech BHC playbooks don't address. The TS Banking Group July 2026 written agreement shows what happens when this surfaces at exam time.

By Rebecca Leung · Jul 30, 2026

More in Operational Risk

200 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Data Privacy

New Jersey's A5328 Is the Costliest Data Broker Law in the Country — and It's Already in Effect for Sensitive Data

New Jersey signed A5328 on June 30, 2026, banning the sale of sensitive financial and personal data immediately and creating registration fees up to $1.5 million. GLBA covers some fintechs — but 'financial services' doesn't automatically mean exempt. Here's the analysis every fintech and data aggregator needs to run now.

By Rebecca Leung · Jul 29, 2026

More in Privacy & Incidents

76 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

DORA's 4-Hour Incident Reporting Clock: What US Banks with EU Operations Are Missing in Their Playbooks

DORA's ICT incident reporting timeline is the strictest in the world — 4 hours to initial notification, 72 hours to the intermediate report, one month to final. US banks with EU branches are subject to it and most have a gap between their US playbook and what Brussels actually requires.

By Rebecca Leung · Jul 29, 2026

More in Resilience

65 more →

Browse the Resilience archive →

From the archive

Browse all 593 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

The Exodus OFAC Settlement: What a $3.1M Crypto Wallet Enforcement Action Teaches About Sanctions Compliance Programs

More in Breaking

Iuka State Bank Written Agreement: The Fed's 30-Day Credit Risk and BSA/AML Remediation List

FinCEN's Venezuela BSA Enforcement Relief: What Banks Must Document Before Relying on It

SEC's Simplify Asset Management Order: Four ETF Controls That Failed at Once

FinCEN's Student Aid Fraud Alert: The ACH Refund Pattern Banks Need to Tune Now

Magnolia Diagnostics False Claims Act Settlement: Why Investors Paid Part of the $24 Million

United Texas Bank's OCC Consent Order at Charter Conversion: The BSA/AML Lesson for Crypto Banking

AI Risk

EU AI Act August 2, 2026: What's Going Live, What Got Pushed to December 2027, and What US Fintechs Need to Do This Week

More in AI Risk

AI Risk Assessment Questionnaire: Split the Questions Between the Business Owner, Technology Team, and Independent Reviewer

NIST AI RMF Implementation: The Minimum Artifact Set for a Team That Cannot Build 200 Controls

AI Governance Decision Log: The Missing Artifact Between Committee Meetings and Production Approval

August 2 Is Ten Days Away: What the EU AI Act's High-Risk Deadline Actually Requires from Financial Services AI

Your State Regulator Is About to Ask for Your AI Inventory: What the NAIC's 12-State Pilot Means for Insurance AI Governance

CFPB Deleted Disparate Impact from Reg B. Here's What Actually Changed for AI Lenders Today.

Operational Risk

Bank Holding Company Source-of-Strength: What Fintechs Getting Bank Charters Haven't Accounted For

More in Operational Risk

Federal Reserve Regulation O Proposal: Rebuild the Control Logic, Not Just the Limits

Fourth-Party Risk: What the 2023 Interagency Guidance Actually Requires When Your Vendor's Vendor Is the Exposure

The Zelle Ruling and What Every P2P Payment Operator Has to Fix in Its Fraud Control Framework

The House CFPB Reform Discussion Draft: What the $21B Supervisory Threshold and Congressional Appropriations Proposal Mean for Your Compliance Program

The First 90 Days as a New Compliance Officer: Inventory Before You Rewrite

Risk Appetite Breach Playbook: What Happens After a Limit Turns Red

Privacy & Incidents

New Jersey's A5328 Is the Costliest Data Broker Law in the Country — and It's Already in Effect for Sensitive Data

More in Privacy & Incidents

California's DELETE Act: The August 1, 2026 DROP Deadline and the GLBA Exemption Test Every Fintech Needs to Pass

The SEC's Four-Day Clock: How to Make a Cyber Incident Materiality Call Under Item 1.05

After the Incident: Turn Lessons Learned Into Control Changes That Stay Closed

Privacy Impact Assessment for Mixed GLBA and Non-GLBA Data: Scope the Data, Not the Entity

Incident Response Decision Log: Document Why a Notification Clock Did—or Did Not—Start

Four Months Late: What the NYDFS Healthplex $2M Penalty Says About When the Notification Clock Actually Starts

Resilience

DORA's 4-Hour Incident Reporting Clock: What US Banks with EU Operations Are Missing in Their Playbooks

More in Resilience

Personnel Continuity Under FFIEC BCM: Succession Is Not a List of Phone Numbers

Business Continuity Workaround Strategies: Document the Manual Process Before the System Goes Down

FFIEC BCM Section III.B Risk Assessment: Turn Threats Into Continuity Strategies

BCP Testing That Actually Satisfies Examiners: What FFIEC Requires Beyond Your Annual Tabletop

The October 2025 AWS Outage Was a BCP Exam That Most Fintechs Didn't Know They Were Taking

Software Supply Chain Failure BCP Scenarios: What FFIEC Guidance and Post-CrowdStrike Expectations Require Financial Institutions to Test in 2026

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.