The Risk Practitioner's Journal — Insights from the Field

● Live · Updated daily

Breaking

SEC · DOJ · OCC · FFIEC enforcement

Breaking Regulatory Compliance

Wavemark Capital SEC Settlement: The Use-of-Proceeds Controls Behind a $9.6M Mobile Home Offering

The Wavemark Capital SEC settlement shows how to test use of proceeds, disbursements, and investor reporting in private offerings.

By Rebecca Leung · Sep 21, 2026

More in Breaking

82 more →

SEP 20
Nodus Bank CEO Sentenced: The Control Failures Behind a $24.9M Fraud and Sanctions Scheme
SEP 20
Vitol Trader Sentenced in FCPA Bribery Scheme: The Payment Controls That Failed
SEP 14
SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore
SEP 10
SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test
SEP 9
FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity
SEP 4
The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program

Browse the Breaking archive →

◆ Models · Governance · NIST AI RMF

AI Risk

Long form · Updated weekly

Feature · AI Risk

State Examiners Just Got an AI Playbook. Here's What the CSBS Framework Means for Banks and Nonbank Fintechs.

The CSBS released a discretionary AI supervisory framework on September 16, 2026 — covering state-chartered banks and nonbank financial companies, and explicitly including the generative and agentic AI that federal model risk guidance left out. Here's what your next state exam conversation looks like.

By Rebecca Leung · Sep 20, 2026

More in AI Risk

111 more →

Browse the AI Risk archive →

◆ RCSA · KRIs · TPRM · Compliance Strategy

Operational Risk

Frameworks · Deep dives

Feature · Operational Risk

Your FedNow Send Function Goes Live Next Quarter. Here's What Your Fraud Controls and Operational Risk Program Need Before the First Transaction.

With 1,700+ FedNow participants and $271 billion processed in Q1 2026, instant payments are production infrastructure. But irrevocable, 24/7 settlement with a seconds-long authorization window breaks fraud programs built for ACH. Here's what your operational risk program needs to say about instant payments before you enable send.

By Rebecca Leung · Sep 19, 2026

More in Operational Risk

260 more →

Browse the Operational Risk archive →

◆ Data privacy laws · Incident response

Privacy & Incidents

State laws · IR playbooks

Feature · Incident Response

NYDFS's May Guidance on Heightened Cybersecurity Threats Is Now an Exam Reference. Here's What Your IR Program Needs to Show.

On May 21, 2026, NYDFS published explicit guidance on what regulated entities should do when cybersecurity risks spike — and told examiners to treat it as a reference point. Here's what the guidance actually requires, why 'voluntary' understates the stakes, and what your incident response program needs to fix before a NYDFS exam.

By Rebecca Leung · Sep 19, 2026

More in Privacy & Incidents

96 more →

Browse the Privacy & Incidents archive →

◆ BCP · DR · Operational continuity

Resilience

BCP · Disaster recovery

Feature · Business Continuity

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

The OCC's June 2026 Cybersecurity and Financial System Resilience Report shifts examiner expectations from control documentation to demonstrated, tested capability. Here is what that means for your program.

By Rebecca Leung · Sep 18, 2026

More in Resilience

76 more →

Browse the Resilience archive →

From the archive

Browse all 755 posts →

Open the complete archive →

Practitioner-grade analysis,filed daily.

Breaking

Wavemark Capital SEC Settlement: The Use-of-Proceeds Controls Behind a $9.6M Mobile Home Offering

More in Breaking

Nodus Bank CEO Sentenced: The Control Failures Behind a $24.9M Fraud and Sanctions Scheme

Vitol Trader Sentenced in FCPA Bribery Scheme: The Payment Controls That Failed

SEC's $64 Million Croft & Frost Offering Fraud Case: The Warning Email Compliance Teams Cannot Ignore

SEC's $3.02M Doximity Insider Trading Judgment: The MNPI Control Test

FinCEN Health Care Fraud Analysis: $17.5 Billion in Suspicious Activity

The OCC's New Two-Tier Violation Framework: What 'Substantive vs. Technical' Means for Your Compliance Program

AI Risk

State Examiners Just Got an AI Playbook. Here's What the CSBS Framework Means for Banks and Nonbank Fintechs.

More in AI Risk

The EU AI Act Gave You 16 More Months for Credit Scoring AI. Don't Waste Them.

SR 26-2 Covers Your Models. It Doesn't Cover Your AI Agents.

Texas's TRAIGA Has Been in Effect for Eight Months. If Your AI Touches Financial Decisions for Texas Residents, Here's What's Actually Required.

FINRA's 2026 Oversight Report Moved Agentic AI to Active Examination Priority. Examiners Are Now Asking About It. Here's What Broker-Dealers Need in Place.

Cox Media Group's 'Active Listening' Fallout: What the FTC Settlement Means for AI Vendor Due Diligence

The EU AI Office Started On-Site Audits August 30. Here's What September 2026's High-Risk AI Inspections Are Actually Requesting.

Operational Risk

Your FedNow Send Function Goes Live Next Quarter. Here's What Your Fraud Controls and Operational Risk Program Need Before the First Transaction.

More in Operational Risk

The Agencies Changed the Rules on Lending to Undocumented Borrowers. Here's What Your Underwriting and Fair Lending Programs Need to Fix.

New Silicon Valley Bank Review: The Seven Supervisory Failures Risk Teams Should Fix

The Basel III Endgame Re-Proposal Slashed Op Risk Capital. Here's What Your Operational Risk Program Still Has to Do.

The Regulators Just Proposed Scrapping the 2023 TPRM Guidance. Here's What the Replacement Says.

FinCEN's Eight AML/CFT Priorities Have Been Effective for Five Years. Here's Why Most Programs Still Treat Them as Compliance Wallpaper.

Your Vendor Had a Breach in November. You Found Out in July. Eight Months of Invisible Risk — and Your TPRM Contract Probably Allowed It.

Privacy & Incidents

NYDFS's May Guidance on Heightened Cybersecurity Threats Is Now an Exam Reference. Here's What Your IR Program Needs to Show.

More in Privacy & Incidents

Montana and Connecticut Just Narrowed the GLBA Exemption. Every Nonbank Financial Institution Has New Privacy Obligations.

NYDFS Just Published a 'How-To' for Cyber Risk Assessments. Most of Yours Still Won't Pass.

NYDFS Fined Delta Dental $2.25M for an IR Plan That Couldn't Answer the Right Questions. Can Yours?

The FTC Safeguards Rule's 9 Requirements Have Been Enforceable for Three Years. Here's What Non-Bank Financial Institutions Are Still Getting Wrong.

FTC Chairman Ferguson Says a Privacy Enforcement Surge Is Coming in H2 2026. Here's What Financial Services Companies Need in Place.

CISA's CIRCIA Is Finalizing This Month. Here's What the New 72-Hour Reporting Clock Means for Your Financial Services Incident Response Program.

Resilience

The OCC's 2026 Cybersecurity Report Changed the Standard. Documenting Controls Isn't Enough Anymore.

More in Resilience

AWS Went Down in October. Most BCPs Assumed It Wouldn't. Here's How to Fix That.

Your BCP Is a Document. The FFIEC BCM Booklet Wants a Management Process. Here's What Examiners Are Testing.

DORA's ICT Register: Only 40% Filed Before the March Deadline. What Enforcement Looks Like Now.

The Integration Requirement Your BCP Is Missing: What FFIEC Examiners Actually Check on Vendor Business Continuity

ISO 22301 Clause 9.3 Management Review: Agenda, Inputs, Decisions, and Evidence

Tabletop Exercise Evaluation Rubric: Ratings, Assignments, and Observation Notes

From the archive

The brief, in your inbox.

Practitioner-grade analysis,
filed daily.