The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

SEC v. Meyer Global: The $46,020 Capital Call That Allegedly Wiped Out a Nearly $3 Million SpaceX Stake

SEC v. Meyer Global turns a missed SpaceX capital call into a control lesson for private fund advisers. Here is what compliance teams should test.

By Rebecca Leung · Sep 30, 2026

More in Breaking

91 more →

SEP 29
Travel + Leisure SEC Settlement: The $77M Loan-Portfolio Disclosure Failure
SEP 28
OTC Link Got Censured for Systems It Kept in Draft for Eight Years. Regulation SCI Doesn't Forgive 'Work in Progress'.
SEP 28
SEC AI Trading Scam Cases: Fake Registration Signals Helped Alleged Schemes Take $15.3M
SEP 28
SEC Fines Zoe Financial $450,000: The Algorithm Wasn't the Control
SEP 26
OFAC Just Codified Its Penalty Playbook. What 31 CFR Part 505 Means for Your Sanctions Compliance Program.
SEP 25
Nano Banc Failed at 0.82% Capital: The Enforcement Timeline Risk Teams Should Read

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

SR 26-2 Governs Your Models. It Doesn't Govern Your Generative AI. Here's the Gap Your Program Has to Fill.

The April 2026 interagency model risk guidance updated SR 11-7 for AI — then explicitly carved out generative and agentic AI. State examiners are already asking what fills the gap. Here's what your GenAI governance program actually needs to build.

By Rebecca Leung · Sep 23, 2026

More in AI Risk

112 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Operational Risk

The Fed's 2026 Risk Officer Survey Is Out. No Major Fraud Category Is Getting Better. Here's What Your Controls Are Flagging Late.

The Federal Reserve's 2026 Risk Officer Survey of 400+ financial institutions shows fraud rising or persisting in every payment channel. Debit card fraud is near-universal. Money mule accounts are discovered after funds disappear. Synthetic identities are defeating KYC. Here's the diagnostic checklist your program needs.

By Rebecca Leung · Sep 30, 2026

More in Operational Risk

274 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Data Privacy

CFPB's Section 1033 Rewrite Is at OIRA. What the Two Key Substantive Changes Mean for Banks, Fintechs, and Data Aggregators.

The CFPB sent its Section 1033 reconsideration NPRM to OIRA on August 6, 2026. Two proposed changes — allowing data access fees and tightening the 'authorized representative' standard — would reshape how open banking works in the U.S. Here's what each change means for your compliance program.

By Rebecca Leung · Sep 27, 2026

More in Privacy & Incidents

100 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

CISA Is Finalizing CIRCIA This Fall. Here's What Financial Services Needs to Build Before the 72-Hour Clock Starts.

The Cyber Incident Reporting for Critical Infrastructure Act final rule is expected this fall. Financial services firms face a new CISA reporting clock on top of existing SEC, NYDFS, and banking agency deadlines. Here is what practitioners need to build now.

By Rebecca Leung · Sep 29, 2026

More in Resilience

78 more →

Browse the Resilience archive →

From the archive

Browse all 789 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

SEC v. Meyer Global: The $46,020 Capital Call That Allegedly Wiped Out a Nearly $3 Million SpaceX Stake

More in Breaking

Travel + Leisure SEC Settlement: The $77M Loan-Portfolio Disclosure Failure

OTC Link Got Censured for Systems It Kept in Draft for Eight Years. Regulation SCI Doesn't Forgive 'Work in Progress'.

SEC AI Trading Scam Cases: Fake Registration Signals Helped Alleged Schemes Take $15.3M

SEC Fines Zoe Financial $450,000: The Algorithm Wasn't the Control

OFAC Just Codified Its Penalty Playbook. What 31 CFR Part 505 Means for Your Sanctions Compliance Program.

Nano Banc Failed at 0.82% Capital: The Enforcement Timeline Risk Teams Should Read

AI Risk

SR 26-2 Governs Your Models. It Doesn't Govern Your Generative AI. Here's the Gap Your Program Has to Fill.

More in AI Risk

State Examiners Just Got an AI Playbook. Here's What the CSBS Framework Means for Banks and Nonbank Fintechs.

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

Operational Risk

The Fed's 2026 Risk Officer Survey Is Out. No Major Fraud Category Is Getting Better. Here's What Your Controls Are Flagging Late.

More in Operational Risk

The New SEC Exam Handbook Turns Exam Readiness Into a Production-Control Test

Your TPRM Program Classifies Vendor Risk. It Doesn't Measure Vendor Concentration. Here's What Examiners Are Starting to Ask For.

The SEC Just Charged 38 Entities for Using Form ADV as a Fraud Tool. Here's What Legitimate Advisers Need to Fix Now.

The DOJ Just Charged Two Engineers for Trading Crypto on a DEX With Listing MNPI. Your MNPI Policy Probably Doesn't Cover This.

FTC Just Fined a Payment Processor $12 Million for Sham Merchants. Here's What 'Knowingly Facilitating Fraud' Actually Looks Like.

Stop Building for the October 1 Form PF Deadline. It Just Moved to July 2027 — for the Fourth Time.

Privacy & Incidents

CFPB's Section 1033 Rewrite Is at OIRA. What the Two Key Substantive Changes Mean for Banks, Fintechs, and Data Aggregators.

More in Privacy & Incidents

Both Reg S-P Deadlines Have Passed. Here's What SEC Examiners Are Now Checking When They Walk Into Your Firm.

Your Analytics Stack Is a GLBA Time Bomb. The Class Action Wave Targeting Financial Institutions That Use Meta Pixel Has Arrived.

California Just Fined GM $12.75 Million for Selling Driver Data Without Consent. Your Financial Data Practices Face the Same Scrutiny.

NYDFS's May Guidance on Heightened Cybersecurity Threats Is Now an Exam Reference. Here's What Your IR Program Needs to Show.

Montana and Connecticut Just Narrowed the GLBA Exemption. Every Nonbank Financial Institution Has New Privacy Obligations.

NYDFS Just Published a 'How-To' for Cyber Risk Assessments. Most of Yours Still Won't Pass.

Resilience

CISA Is Finalizing CIRCIA This Fall. Here's What Financial Services Needs to Build Before the 72-Hour Clock Starts.

More in Resilience

The UK Just Put AWS, Azure, Google Cloud, and Oracle Under Direct Financial Regulatory Oversight. Here's What US Financial Services Needs to Build for Cloud Concentration Risk.

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.