The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

The SEC's $64 million Croft & Frost offering fraud case shows how ignored warnings, sales incentives, and weak escalation controls compound losses.

By Rebecca Leung · Sep 14, 2026

More in Breaking

79 more →

SEP 10
SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test
SEP 9
FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity
SEP 4
The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program
SEP 3
Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.
SEP 1
Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack
SEP 1
SAR Confidentiality and Customer Communications: What Banks Can Now Say

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

Regulation (EU) 2026/1744 deferred high-risk AI obligations to December 2027 — but Article 50, GPAI, and prohibited practices still apply now. Here's what changed, what didn't, and what financial services teams need to do before the clock runs out.

By Rebecca Leung · Sep 15, 2026

More in AI Risk

110 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Compliance Strategy

FinCEN's Eight AML/CFT Priorities Have Been Effective for Five Years. Here's Why Most Programs Still Treat Them as Compliance Wallpaper.

FinCEN issued the first-ever national AML/CFT priorities in June 2021 — a legal mandate to redesign risk-based programs around current threats. Five years later, most compliance programs acknowledge the priorities exist while doing nothing structurally different. That gap is becoming an examination risk.

By Rebecca Leung · Sep 16, 2026

More in Operational Risk

255 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Data Privacy

NYDFS Just Published a 'How-To' for Cyber Risk Assessments. Most of Yours Still Won't Pass.

On September 10, 2026, NYDFS issued comprehensive guidance on how to conduct risk assessments under Part 500. It identifies common failures and what 'based on' actually means. Here's what every covered entity needs to review.

By Rebecca Leung · Sep 15, 2026

More in Privacy & Incidents

94 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

The October 2025 AWS DNS outage knocked out DynamoDB endpoints across multiple regions. Most financial institution BCPs treat cloud infrastructure as a given, not a dependency to plan around. Here's what FFIEC and DORA actually require — and what cloud-aware recovery planning looks like.

By Rebecca Leung · Sep 11, 2026

More in Resilience

75 more →

Browse the Resilience archive →

From the archive

Browse all 738 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

More in Breaking

SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test

FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity

The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program

Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.

Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack

SAR Confidentiality and Customer Communications: What Banks Can Now Say

AI Risk

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

More in AI Risk

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

The EU AI Office Started On-Site Audits August 30. Here's What September 2026's High-Risk AI Inspections Are Actually Requesting.

The FTC Just Put AI Pricing on Notice. What the Personalized Pricing Statement Means for Your Fintech.

Operational Risk

FinCEN's Eight AML/CFT Priorities Have Been Effective for Five Years. Here's Why Most Programs Still Treat Them as Compliance Wallpaper.

More in Operational Risk

Your Vendor Had a Breach in November. You Found Out in July. Eight Months of Invisible Risk — and Your TPRM Contract Probably Allowed It.

Your BSA/AML Compliance Program Can't Scale in Arrears: What the CFSB Consent Order Means for Every Fintech

IDScan.net Exposed 153 Million Driver's Licenses on the Dark Web. Your KYC Vendor's Breach Is Your CIP Problem.

NACHA Just Approved a $10 Million Same Day ACH Limit. Your Fraud Controls Were Built for $1 Million.

The CFPB Dropped Disparate Impact. State AGs Didn't.

OCC's 2026 Third-Party Risk Guidance Rewrite: What Banks Should Change Now

Privacy & Incidents

NYDFS Just Published a 'How-To' for Cyber Risk Assessments. Most of Yours Still Won't Pass.

More in Privacy & Incidents

NYDFS Fined Delta Dental $2.25M for an IR Plan That Couldn't Answer the Right Questions. Can Yours?

The FTC Safeguards Rule's 9 Requirements Have Been Enforceable for Three Years. Here's What Non-Bank Financial Institutions Are Still Getting Wrong.

FTC Chairman Ferguson Says a Privacy Enforcement Surge Is Coming in H2 2026. Here's What Financial Services Companies Need in Place.

CISA's CIRCIA Is Finalizing This Month. Here's What the New 72-Hour Reporting Clock Means for Your Financial Services Incident Response Program.

CalPrivacy Has Issued Eight Data Broker Fines and Is Still Going. What the September 2026 Enforcement Advisory Means for Your Fintech.

PADFAA Is Real Enforcement Now: What Fintech Data Companies Need to Know Before the FTC Files Its First Case

Resilience

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

More in Resilience

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

Tabletop Exercise Evaluation Rubric: Ratings, Assignments, and Observation Notes

BIA Quality Assurance: Challenge Outliers and Calibrate Scores Across Business Units

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.