The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

The SEC's $64 million Croft & Frost offering fraud case shows how ignored warnings, sales incentives, and weak escalation controls compound losses.

By Rebecca Leung · Sep 14, 2026

More in Breaking

79 more →

SEP 10
SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test
SEP 9
FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity
SEP 4
The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program
SEP 3
Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.
SEP 1
Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack
SEP 1
SAR Confidentiality and Customer Communications: What Banks Can Now Say

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

Regulation (EU) 2026/1744 deferred high-risk AI obligations to December 2027 — but Article 50, GPAI, and prohibited practices still apply now. Here's what changed, what didn't, and what financial services teams need to do before the clock runs out.

By Rebecca Leung · Sep 15, 2026

More in AI Risk

110 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Operational Risk

New Silicon Valley Bank Review: The Seven Supervisory Failures Risk Teams Should Fix

The new Silicon Valley Bank review says supervisors saw risks but failed to act. Here is how banks can repair escalation and decision rights.

By Rebecca Leung · Sep 18, 2026

More in Operational Risk

258 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Data Privacy

Montana and Connecticut Just Narrowed the GLBA Exemption. Every Nonbank Financial Institution Has New Privacy Obligations.

Montana's privacy law amendments took effect October 1, 2025. Connecticut's took effect July 1, 2026. Both states moved from a broad entity-level GLBA exemption to a narrower data-level exemption — meaning fintechs, nonbank mortgage companies, and other non-depository financial institutions that relied on GLBA for blanket coverage are now subject to state privacy law for data outside GLBA's scope.

By Rebecca Leung · Sep 17, 2026

More in Privacy & Incidents

95 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

The OCC's June 2026 Cybersecurity and Financial System Resilience Report shifts examiner expectations from control documentation to demonstrated, tested capability. Here is what that means for your program.

By Rebecca Leung · Sep 18, 2026

More in Resilience

76 more →

Browse the Resilience archive →

From the archive

Browse all 746 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

More in Breaking

SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test

FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity

The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program

Colorado Just Sued EarnIn for $16 Million in Tips. Every EWA Provider Should Read the Complaint.

Lugano Diamonds SEC Fraud Case: How $1B in Alleged Fake Revenue Beat the Control Stack

SAR Confidentiality and Customer Communications: What Banks Can Now Say

AI Risk

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

More in AI Risk

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

The EU AI Office Started On-Site Audits August 30. Here's What September 2026's High-Risk AI Inspections Are Actually Requesting.

The FTC Just Put AI Pricing on Notice. What the Personalized Pricing Statement Means for Your Fintech.

Operational Risk

New Silicon Valley Bank Review: The Seven Supervisory Failures Risk Teams Should Fix

More in Operational Risk

The Basel III Endgame Re-Proposal Slashed Op Risk Capital. Here's What Your Operational Risk Program Still Has to Do.

The Regulators Just Proposed Scrapping the 2023 TPRM Guidance. Here's What the Replacement Says.

FinCEN's Eight AML/CFT Priorities Have Been Effective for Five Years. Here's Why Most Programs Still Treat Them as Compliance Wallpaper.

Your Vendor Had a Breach in November. You Found Out in July. Eight Months of Invisible Risk — and Your TPRM Contract Probably Allowed It.

Your BSA/AML Compliance Program Can't Scale in Arrears: What the CFSB Consent Order Means for Every Fintech

IDScan.net Exposed 153 Million Driver's Licenses on the Dark Web. Your KYC Vendor's Breach Is Your CIP Problem.

Privacy & Incidents

Montana and Connecticut Just Narrowed the GLBA Exemption. Every Nonbank Financial Institution Has New Privacy Obligations.

More in Privacy & Incidents

NYDFS Just Published a 'How-To' for Cyber Risk Assessments. Most of Yours Still Won't Pass.

NYDFS Fined Delta Dental $2.25M for an IR Plan That Couldn't Answer the Right Questions. Can Yours?

The FTC Safeguards Rule's 9 Requirements Have Been Enforceable for Three Years. Here's What Non-Bank Financial Institutions Are Still Getting Wrong.

FTC Chairman Ferguson Says a Privacy Enforcement Surge Is Coming in H2 2026. Here's What Financial Services Companies Need in Place.

CISA's CIRCIA Is Finalizing This Month. Here's What the New 72-Hour Reporting Clock Means for Your Financial Services Incident Response Program.

CalPrivacy Has Issued Eight Data Broker Fines and Is Still Going. What the September 2026 Enforcement Advisory Means for Your Fintech.

Resilience

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

More in Resilience

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

Tabletop Exercise Evaluation Rubric: Ratings, Assignments, and Observation Notes

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.