The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

The SEC's $64 million Croft & Frost offering fraud case shows how ignored warnings, sales incentives, and weak escalation controls compound losses.

By Rebecca Leung · Sep 14, 2026

More in Breaking

79 more →

SEP 10
SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test
SEP 9
FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity
SEP 4
The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program
SEP 3
Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.
SEP 1
Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack
SEP 1
SAR Confidentiality and Customer Communications: What Banks Can Now Say

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

The Fed, OCC, and FDIC rewrote model risk management in April 2026. SR 26-2 preserves the validation-first framework that's governed banking AI for 15 years — and explicitly carves out generative and agentic AI, leaving a governance gap at exactly the moment banks need it most.

By Rebecca Leung · Sep 11, 2026

More in AI Risk

109 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Compliance Strategy

Your BSA/AML Compliance Program Can't Scale in Arrears: What the CFSB Consent Order Means for Every Fintech

In April 2026, the OCC issued a consent order against Community Federal Savings Bank — sponsor bank for Wise, Crypto.com, Airwallex, ChipperCash, and LemFi — for BSA/AML compliance failures so severe that its alert system was auto-closing a very high percentage of suspicious-activity flags. Here's what that means for the fintechs riding those rails, and what every fintech compliance team can learn about scaling a BSA program that doesn't collapse under its own transaction volume.

By Rebecca Leung · Sep 13, 2026

More in Operational Risk

253 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

NYDFS Fined Delta Dental $2.25M for an IR Plan That Couldn't Answer the Right Questions. Can Yours?

NYDFS's first cyber enforcement action of 2026 — a $2.25 million penalty against Delta Dental — wasn't about missing firewalls or unpatched servers. It was about an incident response plan that didn't address regulatory reporting obligations clearly. Here are the five gaps regulators consistently find in incident response programs at financial services firms, and how to close them before an examiner does.

By Rebecca Leung · Sep 13, 2026

More in Privacy & Incidents

93 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

The October 2025 AWS DNS outage knocked out DynamoDB endpoints across multiple regions. Most financial institution BCPs treat cloud infrastructure as a given, not a dependency to plan around. Here's what FFIEC and DORA actually require — and what cloud-aware recovery planning looks like.

By Rebecca Leung · Sep 11, 2026

More in Resilience

75 more →

Browse the Resilience archive →

From the archive

Browse all 729 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

More in Breaking

SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test

FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity

The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program

Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.

Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack

SAR Confidentiality and Customer Communications: What Banks Can Now Say

AI Risk

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

More in AI Risk

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

The EU AI Office Started On-Site Audits August 30. Here's What September 2026's High-Risk AI Inspections Are Actually Requesting.

The FTC Just Put AI Pricing on Notice. What the Personalized Pricing Statement Means for Your Fintech.

The ESRB Upgraded AI Cyber Risk to 'Severe.' Here's the Five-Area Action Plan Europe's Biggest Banks Must File by October 31.

Operational Risk

Your BSA/AML Compliance Program Can't Scale in Arrears: What the CFSB Consent Order Means for Every Fintech

More in Operational Risk

IDScan.net Exposed 153 Million Driver's Licenses on the Dark Web. Your KYC Vendor's Breach Is Your CIP Problem.

NACHA Just Approved a $10 Million Same Day ACH Limit. Your Fraud Controls Were Built for $1 Million.

The CFPB Dropped Disparate Impact. State AGs Didn't.

OCC's 2026 Third-Party Risk Guidance Rewrite: What Banks Should Change Now

OFAC Just Sanctioned the $36 Billion Scam Factory. Here's What Your Compliance Program Needs to Find Next.

Everest Ransomware Hit Citizens Bank and Frost Bank Through a Vendor Nobody Will Name. Six Class Actions Later, Here's What Your TPRM Program Needs.

Privacy & Incidents

NYDFS Fined Delta Dental $2.25M for an IR Plan That Couldn't Answer the Right Questions. Can Yours?

More in Privacy & Incidents

The FTC Safeguards Rule's 9 Requirements Have Been Enforceable for Three Years. Here's What Non-Bank Financial Institutions Are Still Getting Wrong.

FTC Chairman Ferguson Says a Privacy Enforcement Surge Is Coming in H2 2026. Here's What Financial Services Companies Need in Place.

CISA's CIRCIA Is Finalizing This Month. Here's What the New 72-Hour Reporting Clock Means for Your Financial Services Incident Response Program.

CalPrivacy Has Issued Eight Data Broker Fines and Is Still Going. What the September 2026 Enforcement Advisory Means for Your Fintech.

PADFAA Is Real Enforcement Now: What Fintech Data Companies Need to Know Before the FTC Files Its First Case

The 36-Hour Notification Clock Doesn't Wait for Your Investigation. Here's What the OCC's June 2026 Cybersecurity Report Means for Your Incident Response Program.

Resilience

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

More in Resilience

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

Tabletop Exercise Evaluation Rubric: Ratings, Assignments, and Observation Notes

BIA Quality Assurance: Challenge Outliers and Calibrate Scores Across Business Units

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.