Practical insights on AI risk, compliance, and risk management for financial services professionals.https://risktemplate.com/https://risktemplate.com/blog/2026-08-07-fincen-minnesota-gto-international-transfer-reporting/https://risktemplate.com/blog/2026-08-07-fincen-minnesota-gto-international-transfer-reporting/The FinCEN Minnesota GTO starts August 11. Banks and money transmitters need complete data and monthly reporting for covered $3,000 transfers.Fri, 07 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-07-finra-off-channel-individual-accountability-enforcement-2026/https://risktemplate.com/blog/2026-08-07-finra-off-channel-individual-accountability-enforcement-2026/The SEC ended its off-channel enforcement wave after 95 cases and $2.3 billion in penalties. FINRA didn't follow. While the SEC pivoted to fraud and fiduciary cases, FINRA fined BTIG $600,000 and started barring individuals from the industry. Here's what the divergence means for broker-dealer compliance programs.Fri, 07 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-07-occ-federal-savings-bank-va-loan-deceptive-marketing-ftc-act-2026/https://risktemplate.com/blog/2026-08-07-occ-federal-savings-bank-va-loan-deceptive-marketing-ftc-act-2026/The Federal Savings Bank of Chicago sent millions of mailers telling veterans they had 'available funds' — when accessing those funds required taking out a new VA cash-out refinance loan. Employees told consumers interest rates would decrease on what were actually permanent fixed-rate mortgages. The April 2026 OCC consent order requires restitution, a corrective action plan, and quarterly progress reports.Fri, 07 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-07-ofac-iran-crypto-exchanges-shadow-banking-sanctions-controls/https://risktemplate.com/blog/2026-08-07-ofac-iran-crypto-exchanges-shadow-banking-sanctions-controls/OFAC's August 7 Iran sanctions target crypto exchanges, exchange houses, wallets, and shell networks. Here is the control response for financial institutions.Fri, 07 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-06-aml-board-accountability-bsa-exam-2026-fincen-nprm-governance/https://risktemplate.com/blog/2026-08-06-aml-board-accountability-bsa-exam-2026-fincen-nprm-governance/FinCEN's April 2026 NPRM proposes formal board oversight as a required AML program component. OCC's revised exam procedures took effect February 2026. TD Bank's $3B penalty set the precedent. Here's what examiners now look for at the board level.Thu, 06 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-06-q2-2026-enforcement-escalation-controls-failures-compliance-strategy/https://risktemplate.com/blog/2026-08-06-q2-2026-enforcement-escalation-controls-failures-compliance-strategy/Corlytics tracked 37 major penalties totaling $931M in Q2 2026. The pattern isn't missing frameworks — it's firms ignoring the ones they already have. Here's what that means for your escalation and issues management process.Thu, 06 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-06-sec-financial-reporting-accounting-unit-icfr-audit-committee/https://risktemplate.com/blog/2026-08-06-sec-financial-reporting-accounting-unit-icfr-audit-committee/The SEC Financial Reporting and Accounting Unit puts specialist scrutiny back on accounting fraud, ICFR, audit evidence, and auditor conduct.Thu, 06 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-05-delaware-banking-modernization-money-transmitter-stablecoin-sb16-sb18-sb19-2026/https://risktemplate.com/blog/2026-08-05-delaware-banking-modernization-money-transmitter-stablecoin-sb16-sb18-sb19-2026/Governor Matt Meyer signed three bills on July 6, 2026 — the most significant update to Delaware's financial regulatory framework in 40+ years. Here is what changed and what compliance teams need to do now.Wed, 05 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-05-fdic-supervisory-appeals-office-60-day-bank-exam-window/https://risktemplate.com/blog/2026-08-05-fdic-supervisory-appeals-office-60-day-bank-exam-window/The FDIC supervisory appeals office is operational. Banks have 60 days to challenge eligible exam determinations—and the evidence clock starts early.Wed, 05 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-05-x-money-cross-river-bank-baas-sponsor-enforcement-compliance-2026/https://risktemplate.com/blog/2026-08-05-x-money-cross-river-bank-baas-sponsor-enforcement-compliance-2026/Cross River Bank is X Money's banking backbone. Its 2023 FDIC consent order for unsafe or unsound fair lending practices is the BaaS case study every compliance team needs to work through.Wed, 05 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-04-gotbit-sec-settlement-crypto-wash-trading-controls/https://risktemplate.com/blog/2026-08-04-gotbit-sec-settlement-crypto-wash-trading-controls/The Gotbit SEC settlement shows crypto market-manipulation risk is still live. Here are the wash-trading controls compliance teams should test.Tue, 04 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-04-new-york-bnpl-nydfs-proposed-regulation-licensing-compliance-2026/https://risktemplate.com/blog/2026-08-04-new-york-bnpl-nydfs-proposed-regulation-licensing-compliance-2026/NYDFS published comprehensive BNPL licensing and consumer protection rules on July 15, 2026, implementing New York's Buy-Now-Pay-Later Act. Here is what every BNPL provider in New York needs to know before the comment deadline closes and the final rule takes effect.Tue, 04 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-04-private-credit-ndfi-bank-exposure-federal-reserve-supervisory-examination-2026/https://risktemplate.com/blog/2026-08-04-private-credit-ndfi-bank-exposure-federal-reserve-supervisory-examination-2026/Federal Reserve examiners have named private credit and NDFI lending a top supervisory priority for 2026. Bank exposure to nonbank financial institutions sits at $1.4 trillion. Here is what your credit risk and counterparty risk programs need to look like before examiners ask.Tue, 04 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-03-cash-app-block-46-state-ag-settlement-fraud-disclosure-kyc-fintech-2026/https://risktemplate.com/blog/2026-08-03-cash-app-block-46-state-ag-settlement-fraud-disclosure-kyc-fintech-2026/On July 8, 2026, a bipartisan coalition of 46 state attorneys general announced a $45M settlement with Block Inc. over Cash App's fraud disclosure failures, identity verification gaps that enabled fraudsters, and the absence of any official customer support phone number. Combined with the January 2025 CFPB order, Block paid $220M in 18 months. Here's what that enforcement record means for your compliance program.Mon, 03 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-03-genius-act-stablecoin-cip-nprm-comment-deadline-august-2026/https://risktemplate.com/blog/2026-08-03-genius-act-stablecoin-cip-nprm-comment-deadline-august-2026/On June 18, 2026, FinCEN and four federal banking agencies proposed the first-ever Customer Identification Program requirements for permitted payment stablecoin issuers under the GENIUS Act. The comment period closes August 21. Here's what the rule requires, where it matters most, and what stablecoin compliance programs need to build.Mon, 03 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-03-nydfs-delta-dental-moveit-breach-notification-data-disposal-72-hour-rule/https://risktemplate.com/blog/2026-08-03-nydfs-delta-dental-moveit-breach-notification-data-disposal-72-hour-rule/On April 29, 2026, NYDFS issued a $2.25 million consent order against Delta Dental of New York—its first 2026 cybersecurity enforcement action. The underlying breach was a 2023 MOVEit zero-day. The violations were late notification, inadequate data disposal, and insufficient incident response plan detail. And the consent order bars insurance reimbursement. Here's what the enforcement record tells your program.Mon, 03 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-03-occ-baas-bank-partner-consent-order-fintech-tprm-program-risk-2026/https://risktemplate.com/blog/2026-08-03-occ-baas-bank-partner-consent-order-fintech-tprm-program-risk-2026/In May 2026, the OCC made public a consent order against Community Federal Savings Bank for BSA/AML deficiencies tied to fintech-partner payment processing growth—wire, ACH, and cross-border volume the bank couldn't supervise. Fintechs whose programs run through enforcement-action banks face program pause, enhanced scrutiny, or termination. Here's what your TPRM program needs to monitor.Mon, 03 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-03-ubs-125-million-aml-penalty-transaction-monitoring-failures/https://risktemplate.com/blog/2026-08-03-ubs-125-million-aml-penalty-transaction-monitoring-failures/The UBS AML penalty exposes FX wire data gaps, weak CDD, and failed remediation. Here is what compliance teams should test now.Mon, 03 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-02-lending-non-work-authorized-individuals-credit-risk-ecoa-interagency-guidance/https://risktemplate.com/blog/2026-08-02-lending-non-work-authorized-individuals-credit-risk-ecoa-interagency-guidance/On July 13, 2026, the OCC, FDIC, and NCUA issued interagency guidance telling financial institutions to apply safe-and-sound credit risk practices when lending to borrowers not legally authorized to work in the US. Here's what examiners will actually look for — and how to build a defensible program.Sun, 02 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-02-sensitive-exam-data-penetration-test-regulator-handling-joint-statement/https://risktemplate.com/blog/2026-08-02-sensitive-exam-data-penetration-test-regulator-handling-joint-statement/On July 16, 2026, the OCC, FDIC, and Federal Reserve issued a joint statement establishing coordinated protocols for how examiners handle your most sensitive security documentation — penetration test results, network diagrams, and IT control weaknesses. Here's what it means for your examination preparation.Sun, 02 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-01-ai-kill-switch-bank-exam-governance-vendor-risk/https://risktemplate.com/blog/2026-08-01-ai-kill-switch-bank-exam-governance-vendor-risk/A June 2026 survey found 72% of banks are unprepared to shut down a malfunctioning AI model or report an AI failure to regulators—the two most basic controls in any AI incident-response playbook. OCC and Fed examiners have made AI a permanent standing topic in every routine bank examination. Here's what kill switch documentation, vendor disentanglement testing, and data boundary enforcement look like when an examiner walks in.Sat, 01 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-01-cfpb-reg-b-disparate-impact-removal-ai-lending-state-fair-lending-2026/https://risktemplate.com/blog/2026-08-01-cfpb-reg-b-disparate-impact-removal-ai-lending-state-fair-lending-2026/The CFPB's Reg B final rule, effective July 21, 2026, removed the effects test from ECOA — but five states immediately reaffirmed their own disparate impact regimes, NYDFS issued an industry letter the same day, and CFPB Circular 2026-03 kept adverse action notice requirements fully in place for AI models. For any lender using algorithmic underwriting, this isn't deregulation. It's a compliance map with more moving parts.Sat, 01 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-01-circia-72-hour-cyber-incident-reporting-financial-institutions-2026/https://risktemplate.com/blog/2026-08-01-circia-72-hour-cyber-incident-reporting-financial-institutions-2026/CISA's final rule implementing CIRCIA is expected by September 2026 — but the 72-hour cyber incident reporting clock and 24-hour ransomware payment deadline are written into the statute and won't change regardless of when the rule drops. Financial institutions already juggling five overlapping reporting regimes need to add CISA to the matrix now, not after enforcement starts.Sat, 01 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-08-01-ecb-geopolitical-stress-test-2026-bcp-scenario-us-banks/https://risktemplate.com/blog/2026-08-01-ecb-geopolitical-stress-test-2026-bcp-scenario-us-banks/On July 31, 2026, the ECB published results of its thematic geopolitical risk reverse stress test covering 110 directly supervised euro area banks—and urged the sector to improve. The OCC's Spring 2026 Semiannual Risk Perspective added geopolitical risk as a prominent new concern for the first time. Most US bank business continuity programs are built for IT failures and natural disasters. They are not built for this class of scenario.Sat, 01 Aug 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-31-bank-holding-company-source-of-strength-fintech-subsidiaries/https://risktemplate.com/blog/2026-07-31-bank-holding-company-source-of-strength-fintech-subsidiaries/When a fintech gets a bank charter and forms a bank holding company, it inherits the source-of-strength obligation — a capital backstop requirement most fintech BHC playbooks don't address. The TS Banking Group July 2026 written agreement shows what happens when this surfaces at exam time.Fri, 31 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-31-exodus-ofac-crypto-wallet-sanctions-compliance-program/https://risktemplate.com/blog/2026-07-31-exodus-ofac-crypto-wallet-sanctions-compliance-program/OFAC's December 2025 settlement with Exodus Movement — $3.1 million for 254 apparent violations of the Iranian Transactions and Sanctions Regulations — is the clearest statement yet that non-custodial crypto wallets are in scope for sanctions obligations. The finding that staff advised Iranian users to use VPNs is the detail that turns a compliance failure into an egregious one.Fri, 31 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-31-federal-reserve-regulation-o-proposal-insider-lending-controls/https://risktemplate.com/blog/2026-07-31-federal-reserve-regulation-o-proposal-insider-lending-controls/The 2026 Regulation O proposal raises insider-lending thresholds and changes passive-fund treatment. Here is the bank control impact.Fri, 31 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-31-iuka-state-bank-federal-reserve-written-agreement-credit-bsa-aml/https://risktemplate.com/blog/2026-07-31-iuka-state-bank-federal-reserve-written-agreement-credit-bsa-aml/The Iuka State Bank written agreement maps Fed findings to 30- and 60-day fixes across credit, capital, liquidity, and BSA/AML.Fri, 31 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-31-occ-fdic-cra-proposal-2026-community-bank-changes/https://risktemplate.com/blog/2026-07-31-occ-fdic-cra-proposal-2026-community-bank-changes/The OCC-FDIC CRA proposal changes bank thresholds, lending tests, grant eligibility, and reporting. Here is the control impact.Fri, 31 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-30-dora-ict-incident-reporting-4-hour-clock-us-banks-eu-operations/https://risktemplate.com/blog/2026-07-30-dora-ict-incident-reporting-4-hour-clock-us-banks-eu-operations/DORA's ICT incident reporting timeline is the strictest in the world — 4 hours to initial notification, 72 hours to the intermediate report, one month to final. US banks with EU branches are subject to it and most have a gap between their US playbook and what Brussels actually requires.Thu, 30 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-30-fourth-party-risk-subcontractor-concentration-cloud-banking-exam/https://risktemplate.com/blog/2026-07-30-fourth-party-risk-subcontractor-concentration-cloud-banking-exam/Regulators don't use the phrase 'fourth-party risk' — they call it subcontractor risk, and the 2023 interagency guidance has specific requirements for it. Here's what examiners are looking for, what common MRAs look like, and how the CrowdStrike incident and UK Critical Third Party designations changed the calculus.Thu, 30 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-30-new-jersey-data-broker-law-a5328-fintech-compliance-2026/https://risktemplate.com/blog/2026-07-30-new-jersey-data-broker-law-a5328-fintech-compliance-2026/New Jersey signed A5328 on June 30, 2026, banning the sale of sensitive financial and personal data immediately and creating registration fees up to $1.5 million. GLBA covers some fintechs — but 'financial services' doesn't automatically mean exempt. Here's the analysis every fintech and data aggregator needs to run now.Thu, 30 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-30-zelle-ruling-authorized-push-payment-fraud-p2p-operator-compliance/https://risktemplate.com/blog/2026-07-30-zelle-ruling-authorized-push-payment-fraud-p2p-operator-compliance/A New York judge let the $1B+ Zelle fraud lawsuit proceed on July 21, 2026. The court found Early Warning Services prioritized speed-to-market over fraud controls it had already designed. If you operate a P2P payment product, this ruling is a blueprint of what state prosecutors will look for in your control gap.Thu, 30 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-29-california-delete-act-drop-system-august-2026-fintech-data-broker-compliance/https://risktemplate.com/blog/2026-07-29-california-delete-act-drop-system-august-2026-fintech-data-broker-compliance/California's DELETE Act requires data brokers to process consumer deletion requests through the DROP system starting August 1, 2026. The penalty is $200 per request per day. Most GLBA-covered financial institutions are exempt — but many fintechs aren't sure which category they're in. Here's how to run the analysis.Wed, 29 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-29-cfpb-reform-discussion-draft-21b-threshold-compliance-program-2026/https://risktemplate.com/blog/2026-07-29-cfpb-reform-discussion-draft-21b-threshold-compliance-program-2026/On July 24, 2026, the House Financial Services Committee published a 70-page CFPB restructuring draft. Here's what's in the five titles, what the $21B threshold change actually affects, and why the compliance programs that survive any version of this are built around legal obligations — not exam schedules.Wed, 29 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-29-nydfs-part-500-class-a-requirements-2026-examination-gaps/https://risktemplate.com/blog/2026-07-29-nydfs-part-500-class-a-requirements-2026-examination-gaps/NYDFS's Second Amendment to Part 500 created a new Class A tier for larger covered entities. The final compliance deadline passed November 1, 2024 — and 2026 is the first full examination cycle with all amended requirements in scope. Here's what examiners are finding and what covered entities are still getting wrong.Wed, 29 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-29-sec-8k-cybersecurity-materiality-four-day-clock-item-1-05/https://risktemplate.com/blog/2026-07-29-sec-8k-cybersecurity-materiality-four-day-clock-item-1-05/The four-day filing clock under SEC Item 1.05 starts at materiality determination — not discovery. Here's how companies structure that determination, what enforcement looks like two years in, and how to avoid the two failure modes that are generating penalties.Wed, 29 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-28-eu-ai-act-august-2026-transparency-obligations-high-risk-deferral/https://risktemplate.com/blog/2026-07-28-eu-ai-act-august-2026-transparency-obligations-high-risk-deferral/August 2, 2026 is five days away. The Digital Omnibus deferral is now final law. Here's what actually goes into effect on August 2 vs. what got moved to December 2027 — and the two-hour compliance check US fintechs should run now.Tue, 28 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-28-fincen-venezuela-bsa-enforcement-relief-policy/https://risktemplate.com/blog/2026-07-28-fincen-venezuela-bsa-enforcement-relief-policy/FinCEN Venezuela BSA enforcement relief runs through January 29, 2027, but only for eligible institutions making reasonable compliance efforts.Tue, 28 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-28-first-90-days-new-compliance-officer-inventory-checklist/https://risktemplate.com/blog/2026-07-28-first-90-days-new-compliance-officer-inventory-checklist/A compliance checklist template for your first 90 days: inventory obligations, issues, complaints, commitments, controls, access, and evidence first.Tue, 28 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-28-risk-appetite-breach-playbook-escalation-remediation/https://risktemplate.com/blog/2026-07-28-risk-appetite-breach-playbook-escalation-remediation/A KRI turning red isn't the problem — not knowing what to do next is. Here's the documented breach response playbook: validation, escalation, remediation, and what the board needs to see.Tue, 28 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-28-sec-simplify-asset-management-etf-compliance-order/https://risktemplate.com/blog/2026-07-28-sec-simplify-asset-management-etf-compliance-order/The SEC Simplify Asset Management order ties a $400,000 penalty to affiliate trades, VaR escalation, Form N-RN delays, and distribution notices.Tue, 28 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-28-vendor-due-diligence-contract-already-signed-recovery-plan/https://risktemplate.com/blog/2026-07-28-vendor-due-diligence-contract-already-signed-recovery-plan/Use this vendor risk assessment checklist when Risk is brought in after signature: contain access, assess gaps, add conditions, and record exposure.Tue, 28 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-ai-risk-assessment-questionnaire-role-based-evidence/https://risktemplate.com/blog/2026-07-27-ai-risk-assessment-questionnaire-role-based-evidence/Build an AI risk assessment questionnaire with clear owners, evidence fields, and independent challenge instead of one unreliable respondent.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-ffiec-business-continuity-personnel-succession-coverage/https://risktemplate.com/blog/2026-07-27-ffiec-business-continuity-personnel-succession-coverage/Build FFIEC business continuity management personnel coverage with tested backups, delegated authority, usable procedures, and recovery evidence.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-issue-management-framework-action-complete-risk-still-open/https://risktemplate.com/blog/2026-07-27-issue-management-framework-action-complete-risk-still-open/An issue management framework that separates action completion from closure through evidence, validation, recurrence checks, and risk acceptance.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-operational-risk-framework-components-rcsa-kri-loss-events-scenarios/https://risktemplate.com/blog/2026-07-27-operational-risk-framework-components-rcsa-kri-loss-events-scenarios/Five operational risk components — RCSA, KRIs, loss events, issues, and scenario analysis — only work when they feed each other. Here's the architecture and the artifact handoffs.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-rcsa-template-excel-workshop-notes-owner-sign-off-challenge-record/https://risktemplate.com/blog/2026-07-27-rcsa-template-excel-workshop-notes-owner-sign-off-challenge-record/The challenge record is what separates a defensible RCSA from a copy-paste exercise. Here's the Excel structure that carries workshop observations through second-line challenge to documented owner sign-off.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-regulatory-change-implementation-record-evidence-working-control/https://risktemplate.com/blog/2026-07-27-regulatory-change-implementation-record-evidence-working-control/A regulatory change log tells you when the alert arrived. An implementation record proves the alert became a working control. Here's what the evidence chain needs to contain.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-27-vendor-risk-questionnaire-review-evidence-contract-conditions/https://risktemplate.com/blog/2026-07-27-vendor-risk-questionnaire-review-evidence-contract-conditions/Review a vendor risk questionnaire by turning each answer into proof, a compensating control, a contract condition, escalation, or rejection.Mon, 27 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-26-aml-risk-assessment-excel-workbook-methodology-inherent-risk-traceable/https://risktemplate.com/blog/2026-07-26-aml-risk-assessment-excel-workbook-methodology-inherent-risk-traceable/A BSA/AML risk assessment that can't show its work fails the exam. Here's the Excel workbook structure that makes every inherent-risk score, control effectiveness rating, and residual score traceable to source data.Sun, 26 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-26-business-continuity-workaround-strategies-manual-procedures-financial-services/https://risktemplate.com/blog/2026-07-26-business-continuity-workaround-strategies-manual-procedures-financial-services/A BCP without documented manual workaround procedures isn't a continuity plan — it's a recovery plan. Here's the workaround template fields and critical-function structure FFIEC examiners expect to see.Sun, 26 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-26-enterprise-risk-management-framework-operating-cadence/https://risktemplate.com/blog/2026-07-26-enterprise-risk-management-framework-operating-cadence/Run an enterprise risk management framework with a practical monthly, quarterly, and annual cadence, named owners, and decision evidence.Sun, 26 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-26-incident-response-plan-lessons-learned-control-changes-effectiveness-closure/https://risktemplate.com/blog/2026-07-26-incident-response-plan-lessons-learned-control-changes-effectiveness-closure/Strengthen an incident response plan by converting lessons learned into owned control changes, effectiveness tests, and defensible closure evidence.Sun, 26 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-26-policy-exception-management-temporary-waiver-register/https://risktemplate.com/blog/2026-07-26-policy-exception-management-temporary-waiver-register/Add policy exception management to your policy management framework with approvals, compensating controls, expiry, and a waiver register.Sun, 26 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-26-privacy-impact-assessment-mixed-glba-non-glba-data-scope/https://risktemplate.com/blog/2026-07-26-privacy-impact-assessment-mixed-glba-non-glba-data-scope/Use a data privacy impact assessment template to separate GLBA and non-GLBA processing by data flow, purpose, person, use, and state-law scope.Sun, 26 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-25-ffiec-bcm-section-iii-b-risk-assessment-continuity-strategies/https://risktemplate.com/blog/2026-07-25-ffiec-bcm-section-iii-b-risk-assessment-continuity-strategies/Build an FFIEC BCM Section III.B risk assessment that traces threats, controls, gaps, continuity strategies, tests, and remediation.Sat, 25 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-25-grc-framework-small-risk-team-one-control-library/https://risktemplate.com/blog/2026-07-25-grc-framework-small-risk-team-one-control-library/A GRC program that runs on one control library, five traceable workflows, and a set of spreadsheets beats a half-implemented enterprise platform every time. Here's how to build it.Sat, 25 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-25-incident-response-decision-log-notification-clock-documentation/https://risktemplate.com/blog/2026-07-25-incident-response-decision-log-notification-clock-documentation/When a cyber event hits, every regulator wants the same thing: proof you made a good-faith materiality determination without unreasonable delay. Here's the decision log structure that creates that proof—whether the clock started or not.Sat, 25 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-25-model-risk-management-effective-challenge-documentation-disagreement/https://risktemplate.com/blog/2026-07-25-model-risk-management-effective-challenge-documentation-disagreement/Model risk management effective challenge needs a decision trail. Build a challenge memo that preserves evidence, responses, conditions, and escalation.Sat, 25 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-25-nist-ai-rmf-implementation-minimum-artifact-set-small-team/https://risktemplate.com/blog/2026-07-25-nist-ai-rmf-implementation-minimum-artifact-set-small-team/What a small risk team actually needs to produce for NIST AI RMF and FS AI RMF compliance — 12 artifacts across GOVERN, MAP, MEASURE, and MANAGE that hold up to examiner scrutiny.Sat, 25 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-25-tprm-lifecycle-raci-procurement-security-legal-handoffs/https://risktemplate.com/blog/2026-07-25-tprm-lifecycle-raci-procurement-security-legal-handoffs/A TPRM lifecycle RACI that assigns clear ownership at each stage — planning, due diligence, contracting, onboarding, monitoring, and offboarding — so findings don't fall between functions.Sat, 25 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-24-ai-governance-decision-log-production-approval/https://risktemplate.com/blog/2026-07-24-ai-governance-decision-log-production-approval/An AI governance framework example for logging approval conditions, dissent, evidence, owners, and expiry dates before an AI use case goes live.Fri, 24 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-24-compliance-monitoring-plan-excel-test-universe/https://risktemplate.com/blog/2026-07-24-compliance-monitoring-plan-excel-test-universe/Build a compliance monitoring plan template in Excel that traces risks and obligations to scope, evidence, exceptions, and remediation.Fri, 24 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-24-fincen-student-aid-fraud-alert-transaction-monitoring/https://risktemplate.com/blog/2026-07-24-fincen-student-aid-fraud-alert-transaction-monitoring/FinCEN's student aid fraud alert gives banks nine red flags, a SAR keyword, and a clear transaction-monitoring task for ACH refunds.Fri, 24 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-24-risk-assessment-template-excel-evidence-trail/https://risktemplate.com/blog/2026-07-24-risk-assessment-template-excel-evidence-trail/Build a risk assessment template in Excel that preserves evidence, challenge, approvals, and score history—not just a polished heat map.Fri, 24 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-24-vendor-due-diligence-without-soc-2-evidence-substitutes/https://risktemplate.com/blog/2026-07-24-vendor-due-diligence-without-soc-2-evidence-substitutes/A vendor due diligence checklist for evaluating security evidence when a vendor has no SOC 2 report, with a risk-based substitution matrix.Fri, 24 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-23-healthplex-nydfs-breach-notification-delay-determination-vs-investigation/https://risktemplate.com/blog/2026-07-23-healthplex-nydfs-breach-notification-delay-determination-vs-investigation/NYDFS fined Healthplex $2 million in August 2025 for notifying 4+ months after a breach. The failure wasn't forensics — it was a misunderstanding of when the 72-hour clock starts. The same mistake trips up banks under the FDIC's 36-hour rule.Thu, 23 Jul 2026 14:30:00 GMThttps://risktemplate.com/blog/2026-07-23-occ-core-provider-concentration-risk-fiserv-fis-jack-henry-community-banks/https://risktemplate.com/blog/2026-07-23-occ-core-provider-concentration-risk-fiserv-fis-jack-henry-community-banks/The OCC published Bulletin 2025-39 asking community banks hard questions about their relationships with Fiserv, FIS, and Jack Henry. The questions reveal exactly what examiners are now checking — and what most TPRM programs haven't addressed.Thu, 23 Jul 2026 14:00:00 GMThttps://risktemplate.com/blog/2026-07-23-magnolia-diagnostics-false-claims-act-investor-settlement/https://risktemplate.com/blog/2026-07-23-magnolia-diagnostics-false-claims-act-investor-settlement/The Magnolia Diagnostics False Claims Act settlement reached investors, requisition controls, and $24M in payments. Here is what to fix.Thu, 23 Jul 2026 12:00:00 GMThttps://risktemplate.com/blog/2026-07-23-eu-ai-act-high-risk-annex-iii-august-2-financial-services-compliance/https://risktemplate.com/blog/2026-07-23-eu-ai-act-high-risk-annex-iii-august-2-financial-services-compliance/The EU AI Act's Annex III high-risk AI obligations take effect August 2, 2026. Credit scoring models, creditworthiness assessment systems, and insurance risk pricing AI are all in scope. Here's what providers and deployers in financial services must have in place before the deadline—and what the Digital Omnibus deferred.Thu, 23 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-23-reg-e-fednow-rtp-error-resolution-instant-payments-dispute-compliance/https://risktemplate.com/blog/2026-07-23-reg-e-fednow-rtp-error-resolution-instant-payments-dispute-compliance/Reg E's 10-business-day provisional credit requirement applies to FedNow and RTP consumer transactions—but instant payment irrevocability means the fraud money is gone before you finish the investigation. Here's what your error resolution procedures actually need to say for instant payments, and where most programs have a documented gap.Thu, 23 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-22-fednow-network-intelligence-api-fraud-risk-controls-2026/https://risktemplate.com/blog/2026-07-22-fednow-network-intelligence-api-fraud-risk-controls-2026/On April 28, 2026, the Federal Reserve made pre-payment network-level fraud intelligence available to every FedNow participant. The data — receiver account behavioral trends derived from system-wide FedNow activity — is available before a transaction is approved. Most institutions haven't updated their fraud policies, controls, or KRIs to account for what this changes.Wed, 22 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-22-fincen-314b-fraud-information-sharing-2026-guide/https://risktemplate.com/blog/2026-07-22-fincen-314b-fraud-information-sharing-2026-guide/On June 12, 2026, FinCEN updated its Section 314(b) Fact Sheet to explicitly cover fraud — including pig butchering, romance scams, and mule account activity. Institutions can now share transaction records, device data, IP addresses, and video footage in real time with other registered participants. Here's what changed, what you can and can't share, and why most compliance teams are leaving this tool unused.Wed, 22 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-22-naic-ai-systems-evaluation-tool-12-state-pilot-insurer-compliance/https://risktemplate.com/blog/2026-07-22-naic-ai-systems-evaluation-tool-12-state-pilot-insurer-compliance/The NAIC's AI Systems Evaluation Tool is live in 12 states through September 2026, with full national adoption expected at the November NAIC Fall Meeting. Regulators are asking for four specific exhibits — AI inventory, governance framework, high-risk system detail, and data quality controls. If you're not in a pilot state yet, you have a narrow window to build these before they come for you.Wed, 22 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-22-united-texas-bank-occ-bsa-aml-crypto-national-charter-consent-order/https://risktemplate.com/blog/2026-07-22-united-texas-bank-occ-bsa-aml-crypto-national-charter-consent-order/When United Texas Bank converted to a national charter in May 2026, it arrived at the OCC already carrying a Federal Reserve BSA/AML consent order from 2024. Two months later, the OCC issued its own Cease and Desist. Here's what that sequence tells compliance teams about what national bank standards actually require for crypto-focused BSA/AML programs.Wed, 22 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-21-bcp-testing-ffiec-examiner-expectations-2026-documentation-frequency/https://risktemplate.com/blog/2026-07-21-bcp-testing-ffiec-examiner-expectations-2026-documentation-frequency/An annual tabletop that never fails anything is not a BCP test — it's theater. Here's what the FFIEC Business Continuity Management booklet actually requires, how 2026 examiners evaluate test programs, and what documentation makes your tests defensible.Tue, 21 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-21-cfpb-reg-b-disparate-impact-removed-july-2026-ai-lending-what-changes/https://risktemplate.com/blog/2026-07-21-cfpb-reg-b-disparate-impact-removed-july-2026-ai-lending-what-changes/The CFPB's Reg B amendment removing the effects test takes effect July 21, 2026. AI lenders aren't off the hook — Fair Housing Act disparate impact, state fair lending laws, GSE contracts, and ECOA disparate treatment still apply. Here's the complete picture.Tue, 21 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-21-fintech-bank-charter-surge-2026-baas-sponsor-bank-risk-occ-applications/https://risktemplate.com/blog/2026-07-21-fintech-bank-charter-surge-2026-baas-sponsor-bank-risk-occ-applications/OCC received more de novo charter applications in 2025 than the previous four years combined. Mercury got conditional approval in April 2026. Here's what's driving the charter surge, what types of charters are in play, and how to assess your BaaS exposure if you're not on the charter path.Tue, 21 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-21-fourth-party-risk-synapse-occ-fdic-subcontractor-monitoring/https://risktemplate.com/blog/2026-07-21-fourth-party-risk-synapse-occ-fdic-subcontractor-monitoring/Synapse collapsed and 100,000+ customers lost access to $265M in deposits they thought were FDIC-insured. The cause wasn't fraud — it was middleware risk nobody was watching. Here's what OCC and FDIC now expect from your fourth-party and subcontractor oversight program.Tue, 21 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-20-genius-act-deadline-missed-stablecoin-compliance-january-2027/https://risktemplate.com/blog/2026-07-20-genius-act-deadline-missed-stablecoin-compliance-january-2027/The July 18, 2026 statutory deadline for GENIUS Act implementing regulations came and went with zero final rules. The law still takes effect January 18, 2027. Here's what stablecoin issuers, custodians, and compliance teams should be building right now — using proposed rules as a working framework.Mon, 20 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-20-yotta-dfpi-fdic-insurance-marketing-compliance-fintech/https://risktemplate.com/blog/2026-07-20-yotta-dfpi-fdic-insurance-marketing-compliance-fintech/California's DFPI fined Yotta Technologies $1 million for telling 18,000 customers their deposits were FDIC-insured while moving their funds to an entity with no such coverage — even as the CEO's internal messages showed he knew it was happening. Here's what every fintech marketing and compliance team needs to take from this case.Mon, 20 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-19-cyber-incident-notification-timelines-occ-nydfs-sec-overlap-financial-institutions/https://risktemplate.com/blog/2026-07-19-cyber-incident-notification-timelines-occ-nydfs-sec-overlap-financial-institutions/When a cyber incident hits, you're not managing one notification obligation — you're managing six, with different triggers, different recipients, and different clocks. The OCC's 36-hour rule, NYDFS's 72-hour requirement, the SEC's 4-business-day materiality window, GLBA customer notices, FinCEN SAR filing, and bank partner contractual obligations all run simultaneously. Here's how to track them without missing one.Sun, 19 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-19-eu-ai-act-transparency-code-of-practice-july-22-deadline-financial-services/https://risktemplate.com/blog/2026-07-19-eu-ai-act-transparency-code-of-practice-july-22-deadline-financial-services/The EU Commission published the final Code of Practice on Transparency of AI-Generated Content on July 8, 2026, and the signatory deadline is July 22 at 18:00 CET. Signing gives you preferential regulatory positioning for Article 50 enforcement that begins August 2. Here's what financial services firms need to know before deciding.Sun, 19 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-18-cloud-concentration-risk-bcp-aws-outage-fintech-ffiec/https://risktemplate.com/blog/2026-07-18-cloud-concentration-risk-bcp-aws-outage-fintech-ffiec/A 15-hour AWS outage in October 2025 locked customers out of financial accounts and froze transactions across 1,000+ companies — and exposed how few fintechs had actually stress-tested their cloud concentration risk. Here's what the FFIEC BCM handbook requires, what the OCC's 2026 report found, and what your BCP needs to say about single-provider dependency.Sat, 18 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-18-federal-reserve-supervisory-operating-principles-self-disclosure-compliance/https://risktemplate.com/blog/2026-07-18-federal-reserve-supervisory-operating-principles-self-disclosure-compliance/On April 30, 2026, the Federal Reserve released a revised Statement of Supervisory Operating Principles with two policy changes that make self-identifying problems genuinely worthwhile. Self-disclosed deficiencies now get supervisory observation treatment instead of MRAs — if you start remediating promptly. Here's what that means and how to make your issues management program work for you in exams.Sat, 18 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-18-oregon-consumer-privacy-act-glba-exemption-financial-services/https://risktemplate.com/blog/2026-07-18-oregon-consumer-privacy-act-glba-exemption-financial-services/The Oregon Consumer Privacy Act's 30-day cure period ended January 1, 2026. The AG can now sue without notice. More importantly for financial services: the GLBA exemption is narrower than most assume, fintechs have significant exposure on non-NPI data, and Oregon requires something no other state does — a list of the specific named third parties that received consumer data.Sat, 18 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-18-sec-cybersecurity-disclosure-8k-flagstar-incident-response-financial-institutions/https://risktemplate.com/blog/2026-07-18-sec-cybersecurity-disclosure-8k-flagstar-incident-response-financial-institutions/In December 2024, Flagstar Bancorp paid $3.5M to settle SEC charges that it made misleading statements about a 2021 cyberattack — including disclosures that said no customer data was compromised when the company already knew 1.5 million records had been stolen. Here's what the SEC's growing cyber enforcement record means for your incident response program.Sat, 18 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-17-cfpb-2026-regulatory-agenda-h2-compliance-calendar/https://risktemplate.com/blog/2026-07-17-cfpb-2026-regulatory-agenda-h2-compliance-calendar/On July 6, the CFPB released its semiannual regulatory agenda — payday NPRM, Section 1033 do-over, mortgage servicing overhaul, and a 64% cut to nonbank exams. Here's what each item actually means and what compliance teams need to do before December.Fri, 17 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-17-connecticut-ctdpa-2026-amendments-fintech-nonbank-financial-services/https://risktemplate.com/blog/2026-07-17-connecticut-ctdpa-2026-amendments-fintech-nonbank-financial-services/Connecticut's CTDPA expanded on July 1, 2026 — lower thresholds, narrowed GLBA exemption, eliminated cure period, new profiling impact assessments. Here's what fintechs and nonbank lenders need to do now.Fri, 17 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-17-dora-first-ict-incident-report-2025-third-party-operational-risk-lessons/https://risktemplate.com/blog/2026-07-17-dora-first-ict-incident-report-2025-third-party-operational-risk-lessons/The ESAs published their first DORA ICT incident report in June 2026 — 3,383 major incidents, nearly one-third from third-party failures, only 10% cyber-related. Here's what the data means for your operational risk program.Fri, 17 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-17-interagency-tprm-guidance-2026-exam-findings-occ-fdic/https://risktemplate.com/blog/2026-07-17-interagency-tprm-guidance-2026-exam-findings-occ-fdic/OCC Bulletin 2023-17 and FDIC FIL-29-2023 turned three in June. Third-party risk programs that looked solid at launch are showing cracks under examination — incomplete due diligence, weak ongoing monitoring, critical activity designations that don't hold up, and subcontractor gaps that no one mapped. Here's what's getting flagged and what to fix.Fri, 17 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-16-fincen-aml-cft-program-overhaul-2026-compliance-program/https://risktemplate.com/blog/2026-07-16-fincen-aml-cft-program-overhaul-2026-compliance-program/FinCEN's April 2026 NPRM would fundamentally reform AML/CFT program requirements for every financial institution — and the Federal Reserve just issued its own separate proposal. Here's what the effectiveness mandate, risk assessment overhaul, and 'significant or systemic' enforcement standard mean for your compliance team.Thu, 16 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-16-genius-act-july-18-deadline-no-final-rules-stablecoin-2026/https://risktemplate.com/blog/2026-07-16-genius-act-july-18-deadline-no-final-rules-stablecoin-2026/July 18, 2026 was the statutory deadline for seven federal agencies to finalize GENIUS Act stablecoin rules. Six agencies, eight proposed rules, zero finals — and no fallback mechanism in the statute. Here's what the regulatory void means for stablecoin issuers, custodians, and the compliance teams supporting them.Thu, 16 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-16-nydfs-part-500-2026-enforcement-consent-orders-exam-findings/https://risktemplate.com/blog/2026-07-16-nydfs-part-500-2026-enforcement-consent-orders-exam-findings/All Part 500 amended requirements are now in effect. NYDFS has 27 consent orders and $144M in fines under its belt. Here's what examiners are finding — and what to do before they show up at your door.Thu, 16 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-16-occ-spring-2026-fraud-risk-program-operational-risk-ai-enhanced/https://risktemplate.com/blog/2026-07-16-occ-spring-2026-fraud-risk-program-operational-risk-ai-enhanced/The OCC's Spring 2026 Risk Perspective named fraud the primary driver of operational losses. But having a fraud operations team isn't a fraud risk program — examiners want second-line oversight, documented loss events, and KRIs that signal emerging exposure.Thu, 16 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-15-cyber-insurance-claims-financial-institutions-documentation-2026/https://risktemplate.com/blog/2026-07-15-cyber-insurance-claims-financial-institutions-documentation-2026/Claim denial rates have risen sharply as carriers shift from self-attestation to evidence-based verification. Here's what financial institutions must document before an incident — and why a denied claim still leaves you facing a regulatory examination.Wed, 15 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-15-fannie-mae-ll-2026-04-ai-governance-mortgage-sellers-servicers-august-2026/https://risktemplate.com/blog/2026-07-15-fannie-mae-ll-2026-04-ai-governance-mortgage-sellers-servicers-august-2026/Fannie Mae's AI/ML governance framework (LL-2026-04) takes effect August 6, 2026. Freddie Mac's equivalent hit March 3. Both cover all AI in origination and servicing, including vendor tools. Here's what a compliant program actually looks like.Wed, 15 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-15-occ-bulletin-2026-29-lending-loan-portfolio-risk-management-examination/https://risktemplate.com/blog/2026-07-15-occ-bulletin-2026-29-lending-loan-portfolio-risk-management-examination/OCC Bulletin 2026-29, issued June 25, 2026, replaces the 1998 lending handbook and rewrites examiner expectations for loan portfolio risk management. Here's what changed, what examiners will now test, and how to update your RCSA before your next safety-and-soundness exam.Wed, 15 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-15-sec-enforcement-2026-back-to-basics-fraud-focus-off-channel-investment-advisers/https://risktemplate.com/blog/2026-07-15-sec-enforcement-2026-back-to-basics-fraud-focus-off-channel-investment-advisers/The SEC has rescinded its no-deny settlement rule, backed away from off-channel enforcement, and refocused on fraud, fiduciary breaches, and direct investor harm. Here's how compliance programs need to adapt — and what FINRA is still doing.Wed, 15 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-14-california-admt-rules-glba-exemption-financial-services-cppa-2026/https://risktemplate.com/blog/2026-07-14-california-admt-rules-glba-exemption-financial-services-cppa-2026/The CPPA finalized ADMT regulations effective January 1, 2026 — and California's GLBA exemption is narrower than you think. Here's what financial institutions and fintechs actually need to do about automated decision-making, opt-out rights, and risk assessments.Tue, 14 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-14-sec-marketing-rule-deficiencies-testimonials-endorsements-2026/https://risktemplate.com/blog/2026-07-14-sec-marketing-rule-deficiencies-testimonials-endorsements-2026/The SEC's December 2025 risk alert on Marketing Rule deficiencies is a blueprint for your next exam. Here's what advisers are getting wrong on testimonials, endorsements, and third-party ratings — and the specific fixes to make before examiners arrive.Tue, 14 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-14-shadow-ai-financial-services-sec-8k-glba-safeguards-occ-2026/https://risktemplate.com/blog/2026-07-14-shadow-ai-financial-services-sec-8k-glba-safeguards-occ-2026/On May 11, 2026, CB Financial Services filed the first SEC Form 8-K triggered by an employee's unauthorized use of an AI tool — not an external attack. Here's what the GLBA Safeguards Rule, OCC 2026-13, and three other frameworks say your institution is responsible for managing, even when you don't know the tools exist.Tue, 14 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-14-trump-fintech-executive-order-august-november-2026-deadlines/https://risktemplate.com/blog/2026-07-14-trump-fintech-executive-order-august-november-2026-deadlines/The May 2026 executive order on fintech innovation set hard deadlines for every major federal financial regulator. The 90-day review window closes August 17. Here's what compliance teams at banks and fintechs need to track — and what won't change regardless of what regulators produce.Tue, 14 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-13-fdic-confidential-supervisory-information-rule-bank-fintech-data-sharing/https://risktemplate.com/blog/2026-07-13-fdic-confidential-supervisory-information-rule-bank-fintech-data-sharing/The FDIC's June 2026 proposed rule — the first major revision to its confidential information disclosure framework in approximately 30 years — would let banks share confidential supervisory information with fintech partners, auditors, and M&A counterparties without needing prior FDIC authorization. Comments are due August 31. Here's what changes and what your contracts need to reflect.Mon, 13 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-13-ffiec-cybersecurity-assessment-tool-retirement-replacement-2026/https://risktemplate.com/blog/2026-07-13-ffiec-cybersecurity-assessment-tool-retirement-replacement-2026/The FFIEC Cybersecurity Assessment Tool retired August 31, 2025, with no mandated replacement. NIST CSF 2.0 has become the de facto industry choice, but the transition isn't just swapping one framework for another. Here's what changed, what examiners look for now, and the documentation gaps most institutions missed.Mon, 13 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-13-occ-national-trust-bank-charter-stablecoin-issuer-genius-act-2027/https://risktemplate.com/blog/2026-07-13-occ-national-trust-bank-charter-stablecoin-issuer-genius-act-2027/Circle's final OCC approval on July 10, 2026 marks a turning point in crypto regulation. With the GENIUS Act's January 18, 2027 enforcement deadline approaching, stablecoin issuers that haven't started the charter application process are already behind. Here's what the charter actually requires — and what it doesn't.Mon, 13 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-13-software-supply-chain-bcp-testing-ffiec-crowdstrike-scenarios-2026/https://risktemplate.com/blog/2026-07-13-software-supply-chain-bcp-testing-ffiec-crowdstrike-scenarios-2026/A year after CrowdStrike brought down 8.5 million Windows devices and cost the banking sector $1.149 billion, financial institution BCP programs are expected to test software supply chain failure scenarios explicitly. Here's what changed in FFIEC guidance, what examiners now look for, and how to build a scenario that holds up.Mon, 13 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-12-ai-credit-model-adverse-action-cfpb-requirements-july-2026/https://risktemplate.com/blog/2026-07-12-ai-credit-model-adverse-action-cfpb-requirements-july-2026/CFPB's July 21 Reg B amendment removes disparate impact from ECOA—but three enforcement frameworks survived intact. Here's what AI credit model compliance actually looks like after the change, and where the real exam risk sits.Sun, 12 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-12-sec-2026-examination-priorities-investment-advisers-broker-dealers/https://risktemplate.com/blog/2026-07-12-sec-2026-examination-priorities-investment-advisers-broker-dealers/The SEC Division of Examinations released its FY 2026 priorities on November 17, 2025. Here's what's new, what changed from 2025, and the specific controls investment advisers and broker-dealers need to document before examiners arrive.Sun, 12 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-12-state-ag-cfpb-enforcement-fintech-ewa-bnpl-compliance-2026/https://risktemplate.com/blog/2026-07-12-state-ag-cfpb-enforcement-fintech-ewa-bnpl-compliance-2026/The CFPB's 2025 enforcement pullback didn't reduce regulatory risk for fintechs — it redistributed it. New York sued EWA providers. California expanded DFPI UDAAP authority. New Jersey issued a junk fees enforcement statement. Here's the new enforcement map and what your compliance program needs to address.Sun, 12 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-12-vendor-exit-plan-occ-2023-17-tprm-critical-third-party/https://risktemplate.com/blog/2026-07-12-vendor-exit-plan-occ-2023-17-tprm-critical-third-party/OCC 2023-17's fifth lifecycle stage — termination — is where TPRM documentation is thin, testing is rare, and examination findings are accumulating. Here's what a defensible vendor exit plan actually contains and the five gaps that generate MRAs.Sun, 12 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-11-cfpb-reg-b-spcp-for-profit-lenders-july-21-2026/https://risktemplate.com/blog/2026-07-11-cfpb-reg-b-spcp-for-profit-lenders-july-21-2026/While everyone was reading about disparate impact, a harder compliance problem was buried in the CFPB's Reg B overhaul: for-profit lenders can no longer use race, national origin, or sex as SPCP eligibility criteria. Here's the checklist before July 21.Sat, 11 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-11-cloud-provider-concentration-risk-occ-tprm-examination-2026/https://risktemplate.com/blog/2026-07-11-cloud-provider-concentration-risk-occ-tprm-examination-2026/Your bank relies on AWS, Azure, or GCP for critical operations. OCC examiners are asking hard questions about cloud dependency mapping, exit strategies, and concentration risk. Here's what they want to see—and where programs keep falling short.Sat, 11 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-11-occ-heightened-standards-700b-threshold-risk-governance-midsize-banks/https://risktemplate.com/blog/2026-07-11-occ-heightened-standards-700b-threshold-risk-governance-midsize-banks/The OCC's proposed rule would cut the number of banks subject to heightened standards from 38 to 8—releasing 30 mid-size banks from formal risk governance requirements. Here's what risk officers at those banks need to think through before dismantling anything.Sat, 11 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-11-rhode-island-ridtppa-glba-exemption-financial-services-2026/https://risktemplate.com/blog/2026-07-11-rhode-island-ridtppa-glba-exemption-financial-services-2026/Rhode Island's Data Transparency and Privacy Protection Act has been in effect since January 1, 2026. If you're a financial services firm relying on the GLBA exemption, here's what it covers, what it doesn't, and the no-cure-period enforcement risk you're carrying.Sat, 11 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-10-cyber-incident-multi-regulator-notification-sequencing-ffiec-circia-sec/https://risktemplate.com/blog/2026-07-10-cyber-incident-multi-regulator-notification-sequencing-ffiec-circia-sec/A single cyber incident at a bank or fintech can simultaneously trigger the FFIEC 36-hour rule, CIRCIA's 72-hour CISA notification, the SEC's 4-business-day Form 8-K requirement, and state breach notification deadlines — each starting from a different legal trigger. Here's how to sequence them without missing one.Fri, 10 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-10-eu-ai-act-article-50-transparency-chatbot-disclosure-financial-services/https://risktemplate.com/blog/2026-07-10-eu-ai-act-article-50-transparency-chatbot-disclosure-financial-services/EU AI Act Article 50 transparency obligations take effect August 2, 2026. Customer-facing chatbots must disclose AI status at first interaction. Deepfakes must be labeled. AI-generated public interest content must be flagged. Here's what financial services firms must do — and why the July 22 Code of Practice deadline still matters.Fri, 10 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-10-hurricane-season-bcp-testing-ffiec-financial-institutions-2026/https://risktemplate.com/blog/2026-07-10-hurricane-season-bcp-testing-ffiec-financial-institutions-2026/Atlantic hurricane season peaks in August–October. Most financial institution BCP programs won't survive an FFIEC examination if they haven't run a geographic threat scenario this year. Here's what examiners look for, what documentation you need, and the exercise vs. test distinction that keeps programs from getting credit for work they actually did.Fri, 10 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-10-mica-transition-deadline-us-crypto-companies-eu-casp-compliance/https://risktemplate.com/blog/2026-07-10-mica-transition-deadline-us-crypto-companies-eu-casp-compliance/The 18-month MiCA transitional period for crypto-asset service providers ended June 30, 2026. US exchanges and crypto firms that continue serving EU clients without authorization risk fines up to €5M or 3% of global turnover enforced simultaneously across 27 EU jurisdictions. Here's what changed, what the reverse solicitation exception actually allows, and the three paths forward.Fri, 10 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-09-ai-bec-wire-fraud-incident-response-playbook-2026/https://risktemplate.com/blog/2026-07-09-ai-bec-wire-fraud-incident-response-playbook-2026/The FBI's 2025 IC3 report logged $3.046 billion in BEC losses—86% via wire or ACH—with AI now generating the emails, cloning the voices, and running the deepfakes. Most financial institution IR playbooks were written before this threat existed. Here's the gap analysis and what to add before the next one hits.Thu, 09 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-09-connecticut-cdpa-july-2026-fintech-nonbank-compliance/https://risktemplate.com/blog/2026-07-09-connecticut-cdpa-july-2026-fintech-nonbank-compliance/Connecticut's expanded CDPA took effect July 1, 2026. It lowered the applicability threshold from 100,000 to 35,000 consumers, reclassified financial account information as sensitive data requiring consent before processing or sale, eliminated the guaranteed 60-day cure period, and stripped the entity-level GLBA exemption from fintechs and nonbank lenders. Here's what changed and what your program needs to address this week.Thu, 09 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-09-fdic-spring-2026-consumer-compliance-supervisory-highlights/https://risktemplate.com/blog/2026-07-09-fdic-spring-2026-consumer-compliance-supervisory-highlights/The FDIC's Spring 2026 Consumer Compliance Supervisory Highlights documented 1,155 violations from 2025 exams — with TILA/Reg Z alone accounting for 462, flood insurance violations generating $150 million in orders, and formal enforcement actions requiring $1.2 billion in restitution. Here's how to use the FDIC's own findings as a self-assessment checklist before your next examination.Thu, 09 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-09-fincen-314b-fraud-information-sharing-financial-institutions/https://risktemplate.com/blog/2026-07-09-fincen-314b-fraud-information-sharing-financial-institutions/FinCEN's June 12, 2026 guidance expanded the Section 314(b) safe harbor to explicitly cover fraud—wire fraud, bank fraud, mail fraud, computer fraud—without requiring an institution to connect the activity to money laundering first. Here's what changed, why it matters for BSA programs, and what enrollment and real-time sharing actually look like in practice.Thu, 09 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-09-kri-library-vs-building-kris-from-scratch/https://risktemplate.com/blog/2026-07-09-kri-library-vs-building-kris-from-scratch/Buy a pre-built KRI library or derive key risk indicators internally? Real thresholds, real trade-offs, and where each approach actually wins.Thu, 09 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-09-risk-register-template-free-vs-paid-vs-build-your-own/https://risktemplate.com/blog/2026-07-09-risk-register-template-free-vs-paid-vs-build-your-own/Free risk register template, paid toolkit, or build from scratch? An honest three-way comparison — time to deploy, coverage, maintenance, and when each wins.Thu, 09 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-08-federal-reserve-payment-account-fintech-access-2026/https://risktemplate.com/blog/2026-07-08-federal-reserve-payment-account-fintech-access-2026/The Federal Reserve proposed a special-purpose Payment Account in May 2026, offering eligible fintechs direct access to Fedwire Funds and FedNow without a bank charter. The comment period closes July 27. Here's who qualifies, what compliance the Fed requires, and why your institution should care even if you're not applying yet.Wed, 08 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-08-marquis-software-ransomware-breach-vendor-concentration-risk-banks/https://risktemplate.com/blog/2026-07-08-marquis-software-ransomware-breach-vendor-concentration-risk-banks/In August 2025, Akira ransomware hit Marquis Software Solutions through an unpatched SonicWall firewall. By the time breach notifications went out—over two months later—80 banks and credit unions had been exposed, 824,000 consumers' data was compromised, and a ransom had reportedly been paid. Here's what your third-party risk program should take from it.Wed, 08 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-08-occ-cfsb-consent-order-bsa-aml-fintech-sponsor-bank-payment-processing/https://risktemplate.com/blog/2026-07-08-occ-cfsb-consent-order-bsa-aml-fintech-sponsor-bank-payment-processing/On May 21, 2026, the OCC released a consent order against Community Federal Savings Bank—sponsor bank for Wise and Crypto.com—for BSA/AML failures tied directly to rapid payment processing growth. The core problem wasn't the fintech partners. It was that alert tuning, CDD, and staffing never scaled with transaction volume. Here's the operational risk lesson for every institution growing through fintech relationships.Wed, 08 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-08-occ-community-bank-exam-rightsizing-2026-bulletin-2025-24/https://risktemplate.com/blog/2026-07-08-occ-community-bank-exam-rightsizing-2026-bulletin-2025-24/Effective January 1, 2026, OCC Bulletin 2025-24 eliminated mandatory examination activities that aren't required by law for community banks. That means fair lending risk assessments and flood insurance transaction testing are no longer mandatory every exam cycle. Here's what actually changed, what didn't, and where compliance teams are misreading this shift.Wed, 08 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-07-agentic-ai-governance-framework-financial-services-2026/https://risktemplate.com/blog/2026-07-07-agentic-ai-governance-framework-financial-services-2026/SR 26-2 carved agentic AI out of model risk scope in April 2026. That didn't make the risk disappear — it moved the governance burden entirely onto you. Here's what a functional agentic AI governance framework looks like and why you need one before your next exam.Tue, 07 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-07-cre-loan-maturity-wall-2026-community-bank-stress-testing/https://risktemplate.com/blog/2026-07-07-cre-loan-maturity-wall-2026-community-bank-stress-testing/More than $1.5 trillion in commercial real estate loans mature in 2026. Roughly 31% of all U.S. banks are CRE-concentrated. Here's the stress-testing methodology community banks need — before examiners ask for it.Tue, 07 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-06-ai-foundation-model-concentration-risk-tprm-financial-institutions/https://risktemplate.com/blog/2026-07-06-ai-foundation-model-concentration-risk-tprm-financial-institutions/The Cambridge Centre for Alternative Finance's 2026 report found 76% of financial institutions rely on OpenAI, 57% on Google, and 35% on Anthropic — while 63% build on external models rather than their own. Under OCC 2023-17 and DORA, that's not just an AI strategy question. It's a third-party concentration risk your TPRM program probably isn't mapped to address.Mon, 06 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-06-biometric-data-financial-services-bipa-vendor-exemption-compliance/https://risktemplate.com/blog/2026-07-06-biometric-data-financial-services-bipa-vendor-exemption-compliance/Financial institutions have a GLBA-based exemption from Illinois' Biometric Information Privacy Act — but courts are actively splitting on whether that exemption extends to your KYC and identity verification vendors. Two unsettled circuit questions, $100M+ in recent settlements, and what your vendor contracts need to say before the 7th Circuit decides.Mon, 06 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-06-kyc-deepfake-document-fraud-identity-proofing-fincen-2026/https://risktemplate.com/blog/2026-07-06-kyc-deepfake-document-fraud-identity-proofing-fincen-2026/FinCEN's November 2024 alert formally put financial institutions on notice that AI-generated deepfakes are bypassing KYC onboarding at scale. Here's what's failing in the document+selfie stack, what examiners expect, and which controls are working in 2026.Mon, 06 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-06-sec-cyber-disclosure-rule-8k-item-105-materiality-2026/https://risktemplate.com/blog/2026-07-06-sec-cyber-disclosure-rule-8k-item-105-materiality-2026/The SEC's 4-business-day cyber incident disclosure rule has 2.5 years of enforcement history. Here's what the filings and enforcement actions reveal about common materiality determination failures — and how to build a decision protocol that survives SEC scrutiny in 2026.Mon, 06 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-05-genius-act-aml-compliance-stablecoin-issuer-fincen-ofac/https://risktemplate.com/blog/2026-07-05-genius-act-aml-compliance-stablecoin-issuer-fincen-ofac/The FinCEN/OFAC joint proposed rule for stablecoin issuers establishes a full BSA/AML compliance program requirement — SAR filing, CTR filing, CIP, CDD, and OFAC sanctions screening — with a technical wallet-blocking mandate that has no precedent in traditional financial services. Here's what Permitted Payment Stablecoin Issuers and their bank partners need to build.Sun, 05 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-05-power-telecom-resilience-bcp-ffiec-2026/https://risktemplate.com/blog/2026-07-05-power-telecom-resilience-bcp-ffiec-2026/The 2026 FFIEC BCM Booklet elevated power and telecommunications resilience from a supporting concern to a standalone examination focus. Here's what examiners now look for in generator testing, telecom redundancy documentation, and alternate site utility independence.Sun, 05 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-04-breach-notification-letter-template-customer-notice-requirements/https://risktemplate.com/blog/2026-07-04-breach-notification-letter-template-customer-notice-requirements/The content of a breach notification letter isn't optional — multiple regulatory frameworks specify exactly what must be in it, and enforcement actions from the FTC, SEC, and CFTC show how specific the mistakes regulators will charge you for. Here's what goes in the letter and how to build an approval process that holds up when the 30-day clock is running.Sat, 04 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-04-compliance-training-program-requirements-occ-fdic-cfpb-finra/https://risktemplate.com/blog/2026-07-04-compliance-training-program-requirements-occ-fdic-cfpb-finra/Most financial institutions have a training program. Fewer have one that survives examiner scrutiny. Here's what each regulator actually looks for — and the documentation gaps that turn a training calendar into an exam finding.Sat, 04 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-04-sr-26-2-community-regional-bank-model-risk-proportionality/https://risktemplate.com/blog/2026-07-04-sr-26-2-community-regional-bank-model-risk-proportionality/SR 26-2 and OCC 2026-13 replaced SR 11-7 on April 17, 2026 — and the proportionality principle changes what model risk management looks like for banks under $100 billion. Here's what's actually required, what's still expected, and how to calibrate your program.Sat, 04 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-04-vendor-financial-health-monitoring-critical-third-party-occ-2023-17/https://risktemplate.com/blog/2026-07-04-vendor-financial-health-monitoring-critical-third-party-occ-2023-17/OCC 2023-17's ongoing monitoring phase requires active financial health surveillance for critical third-party vendors — but most institutions treat it as an annual renewal checkbox. Here's what a defensible early warning program looks like, what warning signs to track, and what the Synapse collapse demonstrated about gaps in current practice.Sat, 04 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-03-genius-act-implementing-regulations-july-18-stablecoin-compliance-2026/https://risktemplate.com/blog/2026-07-03-genius-act-implementing-regulations-july-18-stablecoin-compliance-2026/Six federal agencies must finalize GENIUS Act implementing regulations by July 18, 2026. Here's what the OCC capital floor, FinCEN CIP rules, and the compliance timeline mean for stablecoin issuers right now.Fri, 03 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-03-liquidity-risk-kri-metrics-beyond-lcr-nsfr-early-warning/https://risktemplate.com/blog/2026-07-03-liquidity-risk-kri-metrics-beyond-lcr-nsfr-early-warning/LCR and NSFR tell regulators you're compliant. Liquidity KRIs tell you when you're three days from a crisis. Here are the 12 metrics every risk manager should be tracking — and what SVB's 31 open MRAs reveal about what happens when early warning breaks down.Fri, 03 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-03-minnesota-mcdpa-glba-exemption-fintech-compliance-2026/https://risktemplate.com/blog/2026-07-03-minnesota-mcdpa-glba-exemption-fintech-compliance-2026/Minnesota's Consumer Data Privacy Act uses a data-level GLBA exemption, not an entity-level one. Non-bank fintechs have been exposed since January 31, 2026 — with no notice-to-cure period and $7,500-per-violation penalties.Fri, 03 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-03-sr-26-2-occ-2026-13-model-risk-management-genai-gap/https://risktemplate.com/blog/2026-07-03-sr-26-2-occ-2026-13-model-risk-management-genai-gap/The interagency guidance that replaced SR 11-7 on April 17, 2026 is voluntary and principles-based — and it explicitly excludes generative AI and agentic AI from scope. Here's what changed, what examiners will still test, and the gap your AI governance program needs to close before the AI-specific RFI lands.Fri, 03 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-02-fca-pra-ps26-2-bcp-activation-regulatory-notification-march-2027/https://risktemplate.com/blog/2026-07-02-fca-pra-ps26-2-bcp-activation-regulatory-notification-march-2027/The FCA and PRA published PS26/2 in March 2026, establishing a new operational incident reporting regime that hardwires regulatory notification into BCP activation. Financial institutions with UK operations have until March 18, 2027 to comply. Here's what needs to change in your BCP.Thu, 02 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-02-genius-act-stablecoin-custodian-tprm-due-diligence-july-2026/https://risktemplate.com/blog/2026-07-02-genius-act-stablecoin-custodian-tprm-due-diligence-july-2026/The GENIUS Act's July 18, 2026 rulemaking deadline is 16 days away. When final rules land, every bank acting as a stablecoin custodian — or relying on one — will face vendor oversight obligations your standard TPRM template wasn't built to address. Here's the framework.Thu, 02 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-01-colorado-sb-26-189-admt-financial-institutions-compliance-2027/https://risktemplate.com/blog/2026-07-01-colorado-sb-26-189-admt-financial-institutions-compliance-2027/Colorado's SB 24-205 was repealed and replaced by SB 26-189 before it ever took effect. The new law drops the high-risk AI framework for a consumer-focused ADMT regime — and eliminates the prudential regulator exemption banks were counting on.Wed, 01 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-01-eu-ai-act-august-2-2026-compliance-checklist-transparency-gpai/https://risktemplate.com/blog/2026-07-01-eu-ai-act-august-2-2026-compliance-checklist-transparency-gpai/The Digital Omnibus pushed Annex III high-risk AI to December 2027 — but August 2, 2026 still brings Article 50 transparency requirements and full GPAI enforcement powers. Here's your verified 32-day checklist.Wed, 01 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-01-ftc-health-breach-notification-rule-non-hipaa-health-apps-fintech/https://risktemplate.com/blog/2026-07-01-ftc-health-breach-notification-rule-non-hipaa-health-apps-fintech/The FTC's 2024 amendments to the Health Breach Notification Rule dramatically expanded coverage to health apps, wellness platforms, and connected devices — with enforcement actions totaling $9+ million. Here's what every fintech and non-HIPAA health data holder needs to know.Wed, 01 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-07-01-supply-chain-cyber-incident-response-financial-institutions-third-party/https://risktemplate.com/blog/2026-07-01-supply-chain-cyber-incident-response-financial-institutions-third-party/Supply chain attacks are now the top global cyber threat. When Marquis Software ransomware hit 74+ banks and credit unions, those institutions owned the regulatory response even though their own systems were never touched. Here's the incident response playbook for incidents you didn't cause.Wed, 01 Jul 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-30-circia-72-hour-reporting-financial-institutions-compliance-guide/https://risktemplate.com/blog/2026-06-30-circia-72-hour-reporting-financial-institutions-compliance-guide/CIRCIA adds a fourth federal reporting clock alongside FFIEC's 36-hour rule, the SEC's 4-day rule, and FTC Safeguards' 30-day notification. Here's what financial services covered entities need to understand now — and the preparation steps that matter before the rule drops.Tue, 30 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-30-genius-act-fincen-cip-rule-stablecoin-issuers/https://risktemplate.com/blog/2026-06-30-genius-act-fincen-cip-rule-stablecoin-issuers/On June 22, 2026, FinCEN and four banking regulators jointly proposed the first Customer Identification Program requirements for permitted payment stablecoin issuers. Here's what the rule requires, who it covers, and why the comment deadline matters.Tue, 30 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-30-nydfs-frontier-ai-cybersecurity-guidance-may-2026/https://risktemplate.com/blog/2026-06-30-nydfs-frontier-ai-cybersecurity-guidance-may-2026/On May 21, 2026, NYDFS issued two companion industry letters warning that frontier AI models will fundamentally change the speed and scale of cyberattacks against financial institutions. The guidance doesn't create new legal requirements, but it will be cited in exams. Here's what NYDFS expects and what to document.Tue, 30 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-30-regulatory-examination-readiness-60-day-checklist-banks-fintechs/https://risktemplate.com/blog/2026-06-30-regulatory-examination-readiness-60-day-checklist-banks-fintechs/The notification letter arrives with 30–60 days' notice. What happens in those weeks determines whether you walk out with a clean report or spend the next year managing MRAs. Here's the pre-examination preparation framework that actually reduces examination duration and findings count.Tue, 30 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-29-cfpb-reg-b-disparate-impact-removal-ai-credit-model-compliance/https://risktemplate.com/blog/2026-06-29-cfpb-reg-b-disparate-impact-removal-ai-credit-model-compliance/The CFPB's final rule removing disparate impact from Regulation B takes effect July 21, 2026. Here's what changed, what didn't, and what AI-driven lenders need to document before the deadline.Mon, 29 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-29-credit-risk-kri-fintech-lenders-dpd-charge-off-concentration/https://risktemplate.com/blog/2026-06-29-credit-risk-kri-fintech-lenders-dpd-charge-off-concentration/Most fintech lenders track delinquency and charge-offs. Few connect them into a KRI framework that holds up under regulatory scrutiny. Here are the 7 credit risk metrics your risk function should be running — and the thresholds that trigger action.Mon, 29 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-29-occ-2026-supervisory-reset-risk-based-examination-community-banks/https://risktemplate.com/blog/2026-06-29-occ-2026-supervisory-reset-risk-based-examination-community-banks/The OCC eliminated mandatory exam activities for community banks, removed reputation risk from its toolkit, proposed narrowing MRA authority, and reorganized into bank-size-specific units. What changed, what it means for exam prep, and what examiners are still looking for in 2026.Mon, 29 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-29-tprm-fdic-examination-deficiencies-2024-interagency-guidance-gaps/https://risktemplate.com/blog/2026-06-29-tprm-fdic-examination-deficiencies-2024-interagency-guidance-gaps/The FDIC's 2024 Risk Review found that 35% of supervised institutions had at least one third-party risk management finding. Incomplete due diligence and inadequate ongoing monitoring are the top deficiencies. Here's what examiners are actually testing under the 2023 interagency guidance.Mon, 29 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-28-ai-vendor-contract-provisions-financial-institutions-7-critical-clauses/https://risktemplate.com/blog/2026-06-28-ai-vendor-contract-provisions-financial-institutions-7-critical-clauses/Financial institutions using AI vendors are signing contracts that don't cover model changes, bias audits, or incident notification timelines. Here are the 7 clauses examiners expect to see—and most agreements still lack.Sun, 28 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-28-interest-rate-risk-kri-irrbb-metrics-banks-credit-unions/https://risktemplate.com/blog/2026-06-28-interest-rate-risk-kri-irrbb-metrics-banks-credit-unions/SVB's collapse was a KRI failure before it was a capital failure. Here are the 8 interest rate risk in the banking book metrics your board should be seeing every quarter—and the thresholds that matter.Sun, 28 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-28-rule-206-4-7-annual-compliance-review-investment-adviser-sec-examination/https://risktemplate.com/blog/2026-06-28-rule-206-4-7-annual-compliance-review-investment-adviser-sec-examination/The SEC's 2026 examination priorities put compliance program effectiveness at the center of investment adviser exams. Rule 206(4)-7 always required advisers to evaluate adequacy and effectiveness annually — but examiners are now testing that standard with specificity. Here's what a compliant annual review actually looks like.Sun, 28 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-28-sec-2026-division-examinations-priorities-investment-advisers-broker-dealers/https://risktemplate.com/blog/2026-06-28-sec-2026-division-examinations-priorities-investment-advisers-broker-dealers/The SEC Division of Examinations published its 2026 examination priorities in November 2025. Here's the practitioner breakdown: fiduciary duty deficiencies, AI governance, Reg S-P incident response, Reg BI Form CRS, newly registered adviser targeting, and how the SEC's priorities overlap with FINRA's 2026 Oversight Report.Sun, 28 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-27-ai-audit-trail-requirements-financial-services-logging-documentation/https://risktemplate.com/blog/2026-06-27-ai-audit-trail-requirements-financial-services-logging-documentation/OCC 2026-13, NIST AI RMF, the FS AI RMF, and EU AI Act Article 12 all require documentation for AI systems. Here's what a defensible AI audit trail contains, how long to retain it, and how agentic AI changes the calculus.Sat, 27 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-27-finra-2026-regulatory-oversight-report-broker-dealer-exam-prep/https://risktemplate.com/blog/2026-06-27-finra-2026-regulatory-oversight-report-broker-dealer-exam-prep/FINRA's nearly 90-page 2026 Annual Regulatory Oversight Report dropped in December 2025. Here's a practitioner's walkthrough of the top deficiencies — Reg BI, GenAI governance, new AML fraud typologies, cybersecurity, and third-party vendor management — and what your compliance program needs to address now.Sat, 27 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-27-vendor-change-notification-tprm-material-changes/https://risktemplate.com/blog/2026-06-27-vendor-change-notification-tprm-material-changes/CrowdStrike's Channel File 291 update crashed 8.5 million Windows systems across financial services — and most affected institutions had no contractual right to advance notice. OCC 2023-17 and DORA both require change notification rights in vendor contracts. Here's what to require and how to operationalize it.Sat, 27 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-27-vendor-data-processing-agreement-gdpr-ccpa-required-provisions/https://risktemplate.com/blog/2026-06-27-vendor-data-processing-agreement-gdpr-ccpa-required-provisions/A data processing agreement isn't a checkbox — it's a legally required document with 8 mandatory provisions under GDPR Article 28 and overlapping requirements under CCPA, CPRA, and 20+ US state privacy laws. Here's what the clauses actually need to say, the sub-processor gap most contracts ignore, and the language DPAs routinely miss.Sat, 27 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-26-bcp-update-triggers-mid-year-review-ffiec/https://risktemplate.com/blog/2026-06-26-bcp-update-triggers-mid-year-review-ffiec/Annual BCP review isn't enough. The FFIEC BCM Handbook and ISO 22301 both identify specific events that require mid-cycle plan updates. Here's the six-trigger framework that keeps your program defensible year-round.Fri, 26 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-26-occ-36-hour-computer-security-incident-notification-rule/https://risktemplate.com/blog/2026-06-26-occ-36-hour-computer-security-incident-notification-rule/12 CFR Part 53 requires banking organizations to notify their primary federal regulator within 36 hours of a qualifying computer-security incident. Three years in, examiners are still finding the same gaps. Here's what to fix.Fri, 26 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-26-rcsa-risk-control-self-assessment-fintech-occ-fdic-2026/https://risktemplate.com/blog/2026-06-26-rcsa-risk-control-self-assessment-fintech-occ-fdic-2026/The OCC found that over half of large banks had weak operational risk and control frameworks in 2024. Outstanding supervisory findings are rising across all institution sizes. RCSA is where examiners are looking — here's how to build one that holds.Fri, 26 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-26-vendor-offboarding-compliance-occ-exit-process/https://risktemplate.com/blog/2026-06-26-vendor-offboarding-compliance-occ-exit-process/Morgan Stanley's $60M OCC fine traces directly to a vendor decommissioning failure. The 2023 interagency guidance requires exit planning to start at onboarding. Here's the compliance checklist most TPRM programs are missing.Fri, 26 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-25-bec-incident-response-financial-institutions-72-hour-window/https://risktemplate.com/blog/2026-06-25-bec-incident-response-financial-institutions-72-hour-window/Business Email Compromise caused $3.046 billion in losses in 2025. For financial institutions, the response playbook is different from ransomware — and the recovery window is measured in hours, not days. Here's what to do.Thu, 25 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-25-fincen-investment-adviser-aml-rule-delay-2028/https://risktemplate.com/blog/2026-06-25-fincen-investment-adviser-aml-rule-delay-2028/FinCEN published a final rule on December 31, 2025 postponing the investment adviser AML/CFT compliance deadline from January 2026 to January 2028. Here's what the delay actually says, why bank partners aren't waiting for FinCEN's timeline, and what to build in the next 18 months.Thu, 25 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-25-iso-42001-ai-management-system-certification-financial-services/https://risktemplate.com/blog/2026-06-25-iso-42001-ai-management-system-certification-financial-services/ISO/IEC 42001:2023 is the international AI management system standard with direct structural alignment to EU AI Act Articles 9-17. Here's what certification means, what it doesn't substitute for, and why it's becoming a vendor selection differentiator in regulated financial services.Thu, 25 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-25-state-privacy-law-enforcement-2026-texas-california-ag-consortium/https://risktemplate.com/blog/2026-06-25-state-privacy-law-enforcement-2026-texas-california-ag-consortium/Texas filed the first-ever lawsuit under a state comprehensive privacy law in January 2025. California hit Disney with a $2.75 million CCPA fine in February 2026. Eight AGs now share enforcement intelligence through a formal consortium. The 'nobody is actually enforcing this' assumption is over.Thu, 25 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-24-basel-iii-endgame-operational-risk-capital-business-indicator-formula/https://risktemplate.com/blog/2026-06-24-basel-iii-endgame-operational-risk-capital-business-indicator-formula/The March 2026 Basel III endgame re-proposals replace the Advanced Measurement Approach with a standardized formula for all Category I-IV banks — subjecting Category III-IV institutions to operational risk capital requirements for the first time. Here's what op risk teams need to understand and track.Wed, 24 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-24-occ-fdic-reputation-risk-final-rule-compliance-program-update/https://risktemplate.com/blog/2026-06-24-occ-fdic-reputation-risk-final-rule-compliance-program-update/The OCC and FDIC formally removed 'reputation risk' from their supervisory frameworks on June 9, 2026. Here's what the final rule actually prohibits, what it doesn't change, and what compliance teams need to update now.Wed, 24 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-23-baas-vendor-exit-planning-synapse-fdic-sponsor-banks/https://risktemplate.com/blog/2026-06-23-baas-vendor-exit-planning-synapse-fdic-sponsor-banks/Synapse's 2024 bankruptcy froze $265M in customer funds and exposed a critical gap in BaaS vendor exit planning. Consent orders against Thread Bank, Evolve, and others — plus the FDIC's proposed recordkeeping rule — have now defined what 'adequate' exit planning actually means.Tue, 23 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-23-cfpb-new-enforcement-principles-2026-what-it-means-compliance/https://risktemplate.com/blog/2026-06-23-cfpb-new-enforcement-principles-2026-what-it-means-compliance/The CFPB published its new Enforcement Principles on June 22, 2026 — a four-pillar framework that explicitly narrows when the Bureau will pursue formal action. The Bilt case, resolved without penalties the same week, is the first real-world example of what those principles look like applied.Tue, 23 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-23-federal-deregulation-pivot-2026-compliance-program-maintenance/https://risktemplate.com/blog/2026-06-23-federal-deregulation-pivot-2026-compliance-program-maintenance/Federal banking regulators have reduced exam frequency, softened model risk guidance, and repositioned enforcement as a last resort. The compliance trap is assuming that means you can do less. Here's what's actually happening to the risk landscape — and what compliance programs get wrong during deregulatory periods.Tue, 23 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-23-ransomware-ofac-sanctions-fincen-sar-financial-institutions/https://risktemplate.com/blog/2026-06-23-ransomware-ofac-sanctions-fincen-sar-financial-institutions/OFAC can fine your organization for paying a sanctioned ransomware group even if you didn't know they were on the SDN list. With Evil Corp, Conti, and dozens of other groups designated, the sanctions analysis happens in the first hours of an incident — not after the payment.Tue, 23 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-22-ai-chatbot-vendor-due-diligence-financial-services-compliance/https://risktemplate.com/blog/2026-06-22-ai-chatbot-vendor-due-diligence-financial-services-compliance/The CFPB has already flagged chatbot misinformation as a UDAAP risk. Colorado is eliminating the financial institution AI exemption in 2027. The EU AI Act's high-risk provisions are live. Before your AI chatbot vendor goes into production, here's the due diligence framework regulators expect you to have.Mon, 22 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-22-ai-vishing-help-desk-authentication-controls-financial-institutions/https://risktemplate.com/blog/2026-06-22-ai-vishing-help-desk-authentication-controls-financial-institutions/Vishing attacks surged 442% in H2 2024 and now dominate social engineering engagements. NYDFS issued its first vishing-specific advisory on February 6, 2026. Here's the authentication control framework — challenge protocols, identity verification procedures, and incident response steps — that regulators now expect to see.Mon, 22 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-22-maryland-modpa-sensitive-data-fintech-compliance/https://risktemplate.com/blog/2026-06-22-maryland-modpa-sensitive-data-fintech-compliance/Maryland's MODPA has been in enforcement since April 1, 2026 — and the GLBA entity-level exemption most fintechs assume protects them doesn't cover geolocation, biometrics, or marketing behavioral data. Here's where the gap is and what to do about it.Mon, 22 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-22-shadow-ai-bank-examination-2026-inventory-governance/https://risktemplate.com/blog/2026-06-22-shadow-ai-bank-examination-2026-inventory-governance/Examiners at OCC, Fed, and FDIC have elevated AI governance to a permanent exam priority — and they're finding unauthorized AI tools embedded in workflows that no one inventoried. Here's the shadow AI problem, what the CB Financial 8-K tells you, and how to build an inventory your examiners will actually accept.Mon, 22 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-21-deepfake-voice-cloning-fraud-incident-response-financial-institutions/https://risktemplate.com/blog/2026-06-21-deepfake-voice-cloning-fraud-incident-response-financial-institutions/When a deepfake call beats your fraud controls and a wire goes out, you have hours — not days — to act. This playbook covers the challenge protocol before a wire clears, wire recall procedures, SAR filing for deepfake fraud, evidence preservation, and what FinCEN and the FBI expect you to have documented.Sun, 21 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-21-eu-ai-act-august-2-2026-transparency-obligations-financial-services/https://risktemplate.com/blog/2026-06-21-eu-ai-act-august-2-2026-transparency-obligations-financial-services/Six weeks before the EU AI Act's August 2 enforcement date, most financial services teams are focused on the wrong deadline. Annex III high-risk AI got a 16-month reprieve — but Article 50 transparency, GPAI enforcement, and a full penalty regime are still landing on schedule.Sun, 21 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-20-cyber-insurance-requirements-2026-underwriter-controls-financial-services/https://risktemplate.com/blog/2026-06-20-cyber-insurance-requirements-2026-underwriter-controls-financial-services/Cyber insurance underwriting shifted from questionnaire to evidence-based in 2024-2026. MFA is no longer enough to check a box — underwriters want screenshots, deployment reports, and restore test logs. For financial services firms, here's the full list of what carriers are requiring before they bind, and how to organize your evidence file.Sat, 20 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-20-ncua-2026-supervisory-priorities-credit-union-exam-guide/https://risktemplate.com/blog/2026-06-20-ncua-2026-supervisory-priorities-credit-union-exam-guide/The NCUA released its 2026 supervisory priorities in January — six focus areas that will define every credit union exam this year. Here's what examiners are specifically testing: loan quality metrics, AI governance documentation, BSA risk-based tailoring, third-party vendor oversight, and fraud controls for payment systems.Sat, 20 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-19-basel-iii-endgame-2026-capital-planning-regional-banks/https://risktemplate.com/blog/2026-06-19-basel-iii-endgame-2026-capital-planning-regional-banks/The March 2026 Basel III Endgame re-proposal just closed comments. Here's what capital planning teams at regional and community banks need to model before the final rules drop — and why AOCI is the provision that deserves immediate attention.Fri, 19 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-19-fincen-cdd-exceptive-relief-beneficial-ownership-account-opening/https://risktemplate.com/blog/2026-06-19-fincen-cdd-exceptive-relief-beneficial-ownership-account-opening/FinCEN's February 2026 exceptive relief order eliminates the repeat beneficial ownership collection requirement under the CDD Rule. Here's exactly what changed, what didn't, and what BSA officers need to update now.Fri, 19 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-19-h2-2026-compliance-deadline-calendar-financial-services/https://risktemplate.com/blog/2026-06-19-h2-2026-compliance-deadline-calendar-financial-services/NACHA ACH Phase 2 just took effect. CFPB Reg B disparate impact changes hit July 21. EU AI Act transparency rules begin August 2. FFIEC CAMELS revision comments due August 17. Here's every material compliance deadline between now and December 2026 — and how to triage which ones need your attention first.Fri, 19 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-19-operational-resilience-vs-business-continuity-us-bank-framework/https://risktemplate.com/blog/2026-06-19-operational-resilience-vs-business-continuity-us-bank-framework/Business continuity planning is about recovering from disruptions. Operational resilience is about ensuring you never exceed the maximum tolerable impact on critical services — before, during, and after disruptions. US regulators are converging on the operational resilience standard. Here's what it means for your program.Fri, 19 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-18-ai-now-every-bank-exam-occ-fed-examiner-questions/https://risktemplate.com/blog/2026-06-18-ai-now-every-bank-exam-occ-fed-examiner-questions/The OCC and Federal Reserve have embedded AI oversight into every routine bank examination. Here's what examiners are asking about kill switches, data boundaries, and vendor AI chains — and what to have ready.Thu, 18 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-18-ccpa-2026-enforcement-disney-ford-playon-fintech-opt-out-lessons/https://risktemplate.com/blog/2026-06-18-ccpa-2026-enforcement-disney-ford-playon-fintech-opt-out-lessons/The CPPA's first major enforcement wave of 2026 — Disney's $2.75M opt-out settlement, Ford's $375K friction finding, and PlayOn's $1.1M GPC failure — establishes a clear enforcement playbook. Here's what fintechs and financial services companies need to fix before auditors show up.Thu, 18 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-18-dfast-2026-stress-test-results-internal-capital-planning/https://risktemplate.com/blog/2026-06-18-dfast-2026-stress-test-results-internal-capital-planning/The Federal Reserve releases 2026 bank stress test results on June 24 for 32 major lenders. The severely adverse scenario features 10% unemployment, a 40% CRE price decline, and a historically steep yield curve. Here's how to use the results in your internal capital planning program — and why they matter even if your institution isn't directly tested.Thu, 18 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-18-financial-data-transparency-act-joint-data-standards-compliance/https://risktemplate.com/blog/2026-06-18-financial-data-transparency-act-joint-data-standards-compliance/Nine federal agencies published the FDTA joint data standards final rule, effective October 1, 2026. No reporting requirements change yet — but the LEI is now the cross-agency entity identifier of record, and Phase 2 rulemakings that will change actual data submissions must be completed within two years. Here's what to track and do now.Thu, 18 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-17-dora-article-26-tlpt-threat-led-penetration-testing-requirements-2026/https://risktemplate.com/blog/2026-06-17-dora-article-26-tlpt-threat-led-penetration-testing-requirements-2026/DORA's advanced testing obligation under Article 26 is different from the ICT third-party risk requirements you've been building for. 2026 is the year national competent authorities begin issuing TLPT designations. Here's who is in scope, what a TLPT engagement actually covers, and what to have ready before you receive the call.Wed, 17 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-17-fdic-it-examination-2026-ursit-single-rating-technology-risk/https://risktemplate.com/blog/2026-06-17-fdic-it-examination-2026-ursit-single-rating-technology-risk/The FDIC is replacing the decades-old URSIT framework with a single IT rating organized around five focus areas: governance, cybersecurity, BCP, vendor management, and audit. Early 2026 examinations confirm the shift is already underway. Here's what community banks and their fintech partners need to prepare.Wed, 17 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-17-ftc-safeguards-rule-9-elements-non-bank-financial-institution-2026/https://risktemplate.com/blog/2026-06-17-ftc-safeguards-rule-9-elements-non-bank-financial-institution-2026/If you're a mortgage broker, payday lender, tax preparer, money transmitter, or collection agency — not a bank, not an SEC-registered adviser — the FTC Safeguards Rule is your data security regulation. Here's what the 9-element information security program actually requires, plus the breach notification obligation that became enforceable in May 2024.Wed, 17 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-17-regulation-e-p2p-payment-scam-liability-cash-app-investigation-standards/https://risktemplate.com/blog/2026-06-17-regulation-e-p2p-payment-scam-liability-cash-app-investigation-standards/The CFPB's $175M consent order against Block/Cash App wasn't about the fraud — it was about the investigation process. Here's what financial institutions must document, how the 10-business-day clock works, and where authorized P2P scam liability actually lives.Wed, 17 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-16-occ-2023-17-vendor-contract-provisions-critical-vendor-agreement/https://risktemplate.com/blog/2026-06-16-occ-2023-17-vendor-contract-provisions-critical-vendor-agreement/OCC Bulletin 2023-17 specifies exactly what should be in every critical vendor contract — from right-to-audit to subcontracting controls to exit planning. Here's the complete list, where most agreements fall short, and what to do when a large vendor won't accept the terms the guidance requires.Tue, 16 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-16-sec-regulation-sp-amendment-30-day-breach-notification-investment-advisers/https://risktemplate.com/blog/2026-06-16-sec-regulation-sp-amendment-30-day-breach-notification-investment-advisers/The SEC's 2024 amendment to Regulation S-P created a mandatory 30-day customer breach notification requirement for investment advisers, broker-dealers, and investment companies. Smaller entities just passed their June 3, 2026 compliance deadline. Here's what the rule actually requires — and the three operational gaps most firms haven't closed.Tue, 16 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-15-cfpb-section-1071-2026-small-business-lending-data-compliance/https://risktemplate.com/blog/2026-06-15-cfpb-section-1071-2026-small-business-lending-data-compliance/The CFPB's May 2026 final rule dramatically narrows Section 1071 — raising the threshold to 1,000 originations, cutting the small business revenue cap to $1M, and replacing tiered compliance dates with a single January 1, 2028 deadline. Here's what changed and what every covered lender needs to do before data collection begins.Mon, 15 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-15-eu-ai-act-2026-supervisory-priorities-srep-digital-omnibus-financial-services/https://risktemplate.com/blog/2026-06-15-eu-ai-act-2026-supervisory-priorities-srep-digital-omnibus-financial-services/The Digital Omnibus pushed the Annex III high-risk AI deadline to December 2027 — but the ECB, EBA, and ESMA are already probing AI governance through SREP cycles in 2026. Here's what financial institutions need to have ready now, and the Commission classification guidelines you can still comment on before July 23.Mon, 15 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-15-fincen-aml-cft-program-modernization-nprm-risk-based/https://risktemplate.com/blog/2026-06-15-fincen-aml-cft-program-modernization-nprm-risk-based/FinCEN's April 2026 NPRM would fundamentally restructure AML/CFT program requirements — adding a mandatory codified risk assessment, tying programs to National AML/CFT Priorities, and replacing the checkbox compliance standard with an effectiveness-based framework. Here's what BSA officers need to know before the final rule drops.Mon, 15 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-15-third-party-dependent-bcp-ffiec-occ-2023-17-vendor-verification/https://risktemplate.com/blog/2026-06-15-third-party-dependent-bcp-ffiec-occ-2023-17-vendor-verification/Collecting a vendor's BCP and verifying it are not the same thing. FFIEC BCM and the 2023 interagency third-party guidance both require institutions to actively assess critical vendor resilience — and bank examiners know the difference. Here's what the verification standard actually requires.Mon, 15 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-14-fcra-adverse-action-notice-requirements-fintech-ai-2026/https://risktemplate.com/blog/2026-06-14-fcra-adverse-action-notice-requirements-fintech-ai-2026/CFPB examiners found fintechs using AI credit models with 1,000+ variables failing to provide legally required adverse action notices. Here's what FCRA Section 615, ECOA Reg B, and the 2025 Supervisory Highlights require — and a 5-step compliance checklist.Sun, 14 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-14-hipaa-ocr-enforcement-2025-2026-settlement-patterns/https://risktemplate.com/blog/2026-06-14-hipaa-ocr-enforcement-2025-2026-settlement-patterns/OCR ended 2025 with 21 HIPAA settlements and civil monetary penalties — the second highest annual total ever — driven by two active enforcement initiatives. Here's what the Warby Parker $1.5M penalty, the Risk Analysis expansion, and the Right of Access trend mean for every covered entity and business associate.Sun, 14 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-14-instant-payments-fraud-controls-fednow-rtp-operational-risk/https://risktemplate.com/blog/2026-06-14-instant-payments-fraud-controls-fednow-rtp-operational-risk/FedNow and RTP are irrevocable, 24/7, and settling in seconds — and your fraud controls were built for ACH and wire. Here's the operational risk framework that bridges the gap before the fraud arrives.Sun, 14 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-14-synthetic-identity-fraud-response-detection-bust-out-financial-institutions/https://risktemplate.com/blog/2026-06-14-synthetic-identity-fraud-response-detection-bust-out-financial-institutions/Synthetic identity fraud is the defining fraud threat of 2026 — and your CIP wasn't built to catch it. Here's how financial institutions detect bust-out schemes, contain the exposure, and file the SARs that regulators expect.Sun, 14 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-13-camels-rating-system-ffiec-2026-revisions-exam-prep/https://risktemplate.com/blog/2026-06-13-camels-rating-system-ffiec-2026-revisions-exam-prep/The FFIEC proposed its first material CAMELS revision in 30 years in May 2026, with comments due August 17. Here's what each component measures, what moves composite ratings, and what the proposed changes mean before they take effect.Sat, 13 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-13-nth-party-risk-tprm-subcontracting-chain-occ-2023-17/https://risktemplate.com/blog/2026-06-13-nth-party-risk-tprm-subcontracting-chain-occ-2023-17/26% of financial institutions don't assess fourth-party risk at all. OCC 2023-17 made subcontracting oversight explicit. Here's how to map your vendor chain, what contract provisions you need, and what examiners expect to see.Sat, 13 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-13-regulatory-exam-preparation-playbook-occ-fdic-cfpb/https://risktemplate.com/blog/2026-06-13-regulatory-exam-preparation-playbook-occ-fdic-cfpb/The document request list arrives 2-4 weeks before examiners do. Here's how to manage the DRL, set up your exam response infrastructure, handle examiner interactions, and avoid the document production mistakes that create findings that didn't exist before the exam.Sat, 13 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-13-sensitive-data-state-privacy-laws-glba-erosion-fintech-2026/https://risktemplate.com/blog/2026-06-13-sensitive-data-state-privacy-laws-glba-erosion-fintech-2026/Montana and Connecticut just eliminated the GLBA entity-level exemption for non-depository financial institutions, effective October 2025 and July 2026. Here's what 'sensitive data' means across 20+ state laws and what controls you actually need.Sat, 13 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-12-colorado-sb-26-189-admt-compliance-program-implementation/https://risktemplate.com/blog/2026-06-12-colorado-sb-26-189-admt-compliance-program-implementation/Colorado SB 26-189, signed May 14, 2026, eliminates the financial institution exemption from SB 24-205 and creates three deployer obligations for covered ADMT. Here is how to build the compliance program your institution needs before the January 1, 2027 effective date.Fri, 12 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-12-communications-failure-bcp-telecom-email-collaboration/https://risktemplate.com/blog/2026-06-12-communications-failure-bcp-telecom-email-collaboration/AT&T's February 2024 outage lasted 11 hours and disrupted bank branches, fraud callbacks, and employee communications across the US. CrowdStrike's July 2024 update crashed the same Windows infrastructure that Microsoft Teams runs on. Most financial institution BCPs still treat communications as background infrastructure. Here's what your plan is missing.Fri, 12 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-12-how-to-evaluate-vendor-soc-2-report-tprm-guide/https://risktemplate.com/blog/2026-06-12-how-to-evaluate-vendor-soc-2-report-tprm-guide/Most TPRM programs collect SOC 2 reports. Few actually review them. Here is how to read the five sections that determine whether a vendor's audit gives you assurance or just a PDF in your files.Fri, 12 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-12-wire-transfer-fraud-incident-response-ucc-4a-playbook/https://risktemplate.com/blog/2026-06-12-wire-transfer-fraud-incident-response-ucc-4a-playbook/Wire fraud via Fedwire, CHIPS, and SWIFT cost businesses $2.6 billion in 2025. Here's the step-by-step incident response playbook, what UCC Article 4A determines about who pays, and what the SDNY's January 2025 ruling changed for consumer wire fraud.Fri, 12 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-11-cre-concentration-risk-policy-framework-examiner/https://risktemplate.com/blog/2026-06-11-cre-concentration-risk-policy-framework-examiner/31% of US banks exceeded the CRE concentration threshold at year-end 2024. Here's how to build the credit policy limits, stress testing methodology, and documentation artifacts that show you've made a deliberate, defensible risk decision — not just stumbled into concentration.Thu, 11 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-11-ftc-ai-policy-statement-financial-services-section-5/https://risktemplate.com/blog/2026-06-11-ftc-ai-policy-statement-financial-services-section-5/On March 7, 2026, the FTC issued its first comprehensive AI enforcement framework using Section 5 of the FTC Act — no new legislation required. Here's what the three-pillar framework means for financial services AI programs, and the four documentation gaps that create the most acute exposure.Thu, 11 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-11-nydfs-part-500-phase-3-mfa-asset-inventory-compliance-2026/https://risktemplate.com/blog/2026-06-11-nydfs-part-500-phase-3-mfa-asset-inventory-compliance-2026/The November 2025 Phase 3 requirements under 23 NYCRR Part 500 are now in effect — and the April 2026 certification must reflect full compliance. Here's what most covered entities are still getting wrong on universal MFA, asset inventory, and third-party service provider oversight.Thu, 11 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-11-occ-fdic-reputation-risk-rule-bank-compliance-program/https://risktemplate.com/blog/2026-06-11-occ-fdic-reputation-risk-rule-bank-compliance-program/The June 9, 2026 OCC/FDIC final rule prohibits regulators from citing reputation risk in examinations. Here's what changed, what the rule does and doesn't require, and the specific compliance program updates every bank and fintech needs to make.Thu, 11 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-10-account-takeover-incident-response-playbook-financial-institutions/https://risktemplate.com/blog/2026-06-10-account-takeover-incident-response-playbook-financial-institutions/ATO fraud hit $262 million in losses in 2025. The NY AG v. Citibank ruling changed the liability calculus. Here's the 72-hour incident response playbook and the Reg E obligations your policy needs to document.Wed, 10 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-10-fdic-2026-risk-review-bank-exam-priorities-cre-consumer-credit/https://risktemplate.com/blog/2026-06-10-fdic-2026-risk-review-bank-exam-priorities-cre-consumer-credit/The FDIC's 2026 Risk Review flags CRE concentrations, nonbank lending exposure, consumer credit delinquencies, and funding stability as the elevated-risk areas shaping supervisory priorities. Here's what compliance and risk teams at banks need to prepare for now.Wed, 10 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-10-nacha-ach-fraud-monitoring-phase-2-compliance-deadline-june-2026/https://risktemplate.com/blog/2026-06-10-nacha-ach-fraud-monitoring-phase-2-compliance-deadline-june-2026/Nacha's Phase 2 ACH fraud monitoring rules take effect June 19, 2026, eliminating the volume threshold and covering every non-consumer originator, TPSP, third-party sender, and RDFI. Here's who's covered, what's required, and the documentation checklist before the deadline.Wed, 10 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-10-occ-bulletin-2026-13-model-risk-management-sr-11-7-what-changed/https://risktemplate.com/blog/2026-06-10-occ-bulletin-2026-13-model-risk-management-sr-11-7-what-changed/The federal banking agencies replaced SR 11-7 with OCC Bulletin 2026-13 and SR 26-02 in April 2026. Here's what changed in validation, independence, and community bank expectations — plus the GenAI exclusion that creates a compliance gap your MRM team can't afford to ignore.Wed, 10 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-09-fs-ai-rmf-gap-assessment-230-control-objectives/https://risktemplate.com/blog/2026-06-09-fs-ai-rmf-gap-assessment-230-control-objectives/Treasury's Financial Services AI Risk Management Framework gives financial institutions 230 control objectives across four maturity stages. Here's the gap assessment workflow your team should run before the next exam cycle.Tue, 09 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-09-genius-act-stablecoin-compliance-july-2026-deadline/https://risktemplate.com/blog/2026-06-09-genius-act-stablecoin-compliance-july-2026-deadline/Federal agencies must finalize GENIUS Act implementing regulations by July 18, 2026 — 39 days from today. FinCEN's AML comment period closes today. Here's the compliance checklist stablecoin issuers and their bank partners need to build before the deadline hits.Tue, 09 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-09-sponsor-bank-failure-fintech-bcp-operational-continuity/https://risktemplate.com/blog/2026-06-09-sponsor-bank-failure-fintech-bcp-operational-continuity/The Synapse bankruptcy froze $265 million in fintech customer funds. Most fintech BCPs don't mention the bank partner failing at all. Here's how to plan for the scenario most compliance teams assume will never happen.Tue, 09 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-09-texas-tdpsa-financial-services-glba-exemption-compliance/https://risktemplate.com/blog/2026-06-09-texas-tdpsa-financial-services-glba-exemption-compliance/Texas TDPSA took effect July 1, 2024, with no revenue threshold and no processing volume threshold. The GLBA entity-level exemption is more limited than most financial institutions assume — your marketing stack, website analytics, and pre-application data are likely covered. Here's what you still need to do.Tue, 09 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-08-cfpb-reg-b-disparate-impact-eliminated-ai-credit-models-july-2026/https://risktemplate.com/blog/2026-06-08-cfpb-reg-b-disparate-impact-eliminated-ai-credit-models-july-2026/The CFPB's April 2026 Regulation B final rule eliminates disparate impact from ECOA enforcement, effective July 21, 2026. But the debiasing trap, state fair lending laws, and Fair Housing Act obligations remain. Here's the five-item compliance checklist for AI credit teams.Mon, 08 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-08-cppa-cybersecurity-audit-admt-financial-services-compliance-2026/https://risktemplate.com/blog/2026-06-08-cppa-cybersecurity-audit-admt-financial-services-compliance-2026/The CPPA's cybersecurity audit, privacy risk assessment, and ADMT regulations took effect January 1, 2026. A $1.35M record fine against Tractor Supply, a new Audits Division with independent examination authority, and an enforcement posture that no longer waits for consumer complaints — here's what financial institutions and fintechs with California customers must understand now.Mon, 08 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-08-dora-article-28-ict-third-party-risk-us-financial-institutions-2026/https://risktemplate.com/blog/2026-06-08-dora-article-28-ict-third-party-risk-us-financial-institutions-2026/DORA's transition year is over. Q1 2026 Register of Information submissions are under NCA review, 19 Critical ICT Third-Party Providers have been designated, and active enforcement has begun. Here's what US financial institutions with EU branches and subsidiaries are still getting wrong — and what to fix before supervisory follow-up arrives.Mon, 08 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-08-genai-model-risk-gap-occ-rfi-interim-governance/https://risktemplate.com/blog/2026-06-08-genai-model-risk-gap-occ-rfi-interim-governance/OCC Bulletin 2026-13 explicitly excluded generative AI and agentic AI from model risk guidance scope. The AI-specific RFI hasn't landed yet. Here's the interim governance framework banks should be building now.Mon, 08 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-07-baas-consent-order-tprm-minimum-standards-sponsor-bank/https://risktemplate.com/blog/2026-06-07-baas-consent-order-tprm-minimum-standards-sponsor-bank/From Cross River to Evolve, regulators have now issued consent orders against at least 10 BaaS-focused banks across three different agencies. The pattern is consistent enough to define TPRM minimum standards for any bank running a fintech partnership program — and what fintechs must build before their next sponsor bank due diligence review.Sun, 07 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-07-biometric-privacy-compliance-fintech-bipa-texas-cubi/https://risktemplate.com/blog/2026-06-07-biometric-privacy-compliance-fintech-bipa-texas-cubi/Most financial institutions assume GLBA exempts them from BIPA. It doesn't cover your KYC vendors — and Texas is enforcing its biometric law with billion-dollar settlements. Here's what your compliance program actually needs.Sun, 07 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-07-insider-threat-incident-response-financial-institutions/https://risktemplate.com/blog/2026-06-07-insider-threat-incident-response-financial-institutions/Insider threats are the incident type where almost every instinct is wrong. A step-by-step framework for financial services — from the first alert through separation, SAR filing, and breach notification — without destroying the investigation or creating wrongful termination exposure.Sun, 07 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-07-reputational-risk-kri-metrics-financial-institutions/https://risktemplate.com/blog/2026-06-07-reputational-risk-kri-metrics-financial-institutions/The OCC and FDIC eliminated reputation risk as a standalone examination category effective June 9, 2026. Here are 8 KRIs to track reputational exposure independently — before it shows up in customer attrition, bank partner friction, or a media cycle that doesn't need an MRA to hurt.Sun, 07 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-06-cfpb-section-1033-open-banking-rule-compliance-financial-institutions/https://risktemplate.com/blog/2026-06-06-cfpb-section-1033-open-banking-rule-compliance-financial-institutions/CFPB finalized its Section 1033 open banking rule in October 2024, requiring covered institutions to share consumer financial data via permissioned APIs. Then a federal court enjoined enforcement in October 2025. Here's what the rule requires, where the litigation stands, and why your compliance team should be building toward it anyway.Sat, 06 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-06-credit-risk-kri-delinquency-concentration-cecl-examiner-metrics/https://risktemplate.com/blog/2026-06-06-credit-risk-kri-delinquency-concentration-cecl-examiner-metrics/Non-performing loan ratios, net charge-off rates, and CRE concentration limits don't just show up in credit reviews — they're the metrics bank examiners use to spot trouble before it becomes an enforcement action. Here's the full credit risk KRI framework with Green/Amber/Red thresholds.Sat, 06 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-06-cybersecurity-kri-nydfs-part-500-ffiec-metrics/https://risktemplate.com/blog/2026-06-06-cybersecurity-kri-nydfs-part-500-ffiec-metrics/Compliance checkboxes tell you whether controls exist. Cybersecurity KRIs tell you whether they're functioning. Here are the 8 metrics NYDFS Part 500, the FFIEC IT Examination Handbook, and security-mature financial institutions actually track — with Green/Amber/Red thresholds and calibration guidance.Sat, 06 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-06-eu-ai-act-compliance-kri-high-risk-ai-program-metrics/https://risktemplate.com/blog/2026-06-06-eu-ai-act-compliance-kri-high-risk-ai-program-metrics/August 2, 2026 is the full enforcement date for EU AI Act high-risk system obligations. Banks, fintechs, and insurers using credit scoring, AML, or underwriting AI need more than a compliance checklist — they need KRIs that show whether the program is actually running. Here's the framework.Sat, 06 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-05-circia-final-rule-financial-institutions-72-hour-incident-reporting/https://risktemplate.com/blog/2026-06-05-circia-final-rule-financial-institutions-72-hour-incident-reporting/CISA's CIRCIA final rule arrived in May 2026. Financial institutions in critical infrastructure sectors now face a 72-hour mandatory incident reporting requirement to CISA — layered on top of FFIEC 36-hour, SEC 4-day, and NYDFS Part 500 obligations. Here's what each one actually covers and how to build a coordinated response.Fri, 05 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-05-colorado-sb-26-189-ai-law-financial-services-compliance/https://risktemplate.com/blog/2026-06-05-colorado-sb-26-189-ai-law-financial-services-compliance/Colorado's SB 26-189, signed May 14, 2026, replaces the original Colorado AI Act and eliminates the financial institution safe harbor. Here's what the new automated decision-making law requires before January 1, 2027.Fri, 05 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-04-bsa-aml-kri-transaction-monitoring-sar-filing-metrics/https://risktemplate.com/blog/2026-06-04-bsa-aml-kri-transaction-monitoring-sar-filing-metrics/Most BSA programs track activity. Few track program health. Here are the 10 BSA/AML KRIs that reveal whether your transaction monitoring, SAR filing, CDD, and independent testing pillars are working — including how to calibrate false positive rates, SAR conversion rates, and CDD completion metrics that hold up in examinations.Thu, 04 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-04-business-continuity-kri-bcp-testing-metrics/https://risktemplate.com/blog/2026-06-04-business-continuity-kri-bcp-testing-metrics/Annual BCP testing tells you if your plan can pass a drill. Business continuity KRIs tell you if it'll actually hold up. Here are eight metrics every practitioner should be tracking.Thu, 04 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-04-data-privacy-kri-dsar-backlog-consent-breach-response/https://risktemplate.com/blog/2026-06-04-data-privacy-kri-dsar-backlog-consent-breach-response/Eight data privacy KRIs every compliance team should be tracking in 2026 — covering DSAR completion rates, consent opt-out effectiveness, breach notification timeliness, and vendor DPA coverage, with threshold guidance and escalation triggers.Thu, 04 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-04-stress-testing-kri-scenario-results-board-triggers/https://risktemplate.com/blog/2026-06-04-stress-testing-kri-scenario-results-board-triggers/Most stress test results never make it into ongoing KRI programs. Here's how to convert scenario outputs — deposit runoff assumptions, capital floor breaches, credit loss projections — into calibrated KRI thresholds that fire automatically when conditions approach the scenario's breaking points.Thu, 04 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-03-ai-governance-dashboard-committee-reporting-kris/https://risktemplate.com/blog/2026-06-03-ai-governance-dashboard-committee-reporting-kris/Engineering telemetry is not an AI governance dashboard. Here's how to separate what risk committees and boards need to see from what ML ops monitors — with a practical KRI set for each layer.Wed, 03 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-03-ai-in-risk-management-financial-services-automate-safely-human-judgment/https://risktemplate.com/blog/2026-06-03-ai-in-risk-management-financial-services-automate-safely-human-judgment/Standard Chartered just announced 7,800 job cuts driven by AI. Here's the honest breakdown of which risk management tasks AI handles well, which need a human co-pilot, and which you should not automate at any price.Wed, 03 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-03-cash-burn-kri-fintech-runway-reserve-coverage-funding-dependency/https://risktemplate.com/blog/2026-06-03-cash-burn-kri-fintech-runway-reserve-coverage-funding-dependency/Cash burn metrics are finance reporting. Cash burn KRIs are risk management. Here's how to build the six indicators that turn your runway and reserve data into early warnings your risk program can actually act on.Wed, 03 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-03-contingency-funding-plan-kri-activation-triggers/https://risktemplate.com/blog/2026-06-03-contingency-funding-plan-kri-activation-triggers/Most CFPs have a trigger section. Most trigger sections are too vague to actually fire. Here's how to build contingency funding plan KRIs that activate the right tier at the right time — with evidence artifacts regulators will accept.Wed, 03 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-02-ai-incident-kri-output-errors-customer-harm-near-misses-remediation/https://risktemplate.com/blog/2026-06-02-ai-incident-kri-output-errors-customer-harm-near-misses-remediation/AI incidents don't announce themselves—they show up in complaint queues, credit disputes, and examiner findings. These KRIs measure what matters: error rates, customer harm, near misses, and how long your remediation pipeline is aging.Tue, 02 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-02-compliance-calendar-kris-track-deadlines-before-findings/https://risktemplate.com/blog/2026-06-02-compliance-calendar-kris-track-deadlines-before-findings/Most compliance teams find out about missed deadlines when a regulator asks. These KRIs catch deadline risk before it shows up as an MRA—covering upcoming obligations, owner slippage, evidence completeness, and late filing history.Tue, 02 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-02-deposit-concentration-kris-customer-sector-platform-dependency/https://risktemplate.com/blog/2026-06-02-deposit-concentration-kris-customer-sector-platform-dependency/Generic deposit metrics don't catch concentration failures. Here's how to build deposit concentration KRIs that actually warn you — covering top depositor concentration, sector exposure, brokered deposits, and platform dependency.Tue, 02 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-02-fair-lending-bias-kri-ai-models-approval-rates-disparate-impact/https://risktemplate.com/blog/2026-06-02-fair-lending-bias-kri-ai-models-approval-rates-disparate-impact/Periodic bias testing isn't monitoring — it's a snapshot. Here's how to build KRIs that track AI model fairness continuously: approval rate gaps, override patterns, adverse action drift, complaint signals, and validation exceptions.Tue, 02 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-01-ai-accountability-compliance-who-owns-risk-ai-generated-work/https://risktemplate.com/blog/2026-06-01-ai-accountability-compliance-who-owns-risk-ai-generated-work/AI is generating risk assessments, SAR narratives, board memos, and regulatory change summaries. But 'human-in-the-loop' without documented challenge is accountability theater. Here's what genuine ownership looks like — and what regulators are starting to require.Mon, 01 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-01-early-warning-indicators-vs-kri-liquidity-teams/https://risktemplate.com/blog/2026-06-01-early-warning-indicators-vs-kri-liquidity-teams/EWIs and KRIs are not the same thing — even when they measure the same metric. Here's how liquidity teams should design, separate, and connect them to CFP activation and board reporting.Mon, 01 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-01-exam-readiness-kris-evidence-gaps-repeat-requests-aging/https://risktemplate.com/blog/2026-06-01-exam-readiness-kris-evidence-gaps-repeat-requests-aging/Six key risk indicators for exam readiness that go beyond checklists — tracking evidence gap rates, repeat examiner requests, aging commitments, and validation completeness before the examiner asks.Mon, 01 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-06-01-internal-audit-kris-repeat-findings-delayed-remediation-weak-validation/https://risktemplate.com/blog/2026-06-01-internal-audit-kris-repeat-findings-delayed-remediation-weak-validation/Seven key risk indicators for internal audit health — repeat finding rates, CAP aging, failed validation, closure evidence quality, issue recurrence, management response delays, and risk acceptance patterns for high and critical findings.Mon, 01 Jun 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-31-ai-vendor-kri-model-drift-output-errors-complaints/https://risktemplate.com/blog/2026-05-31-ai-vendor-kri-model-drift-output-errors-complaints/Six KRIs for monitoring AI vendor performance in your environment — model update detection, output error rate, complaint attribution, drift indicators, contract gap rate, and incident notification lag. Built around FS AI RMF and NIST AI RMF monitoring requirements.Sun, 31 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-31-generative-ai-kri-hallucination-sensitive-data-escalation/https://risktemplate.com/blog/2026-05-31-generative-ai-kri-hallucination-sensitive-data-escalation/Six key risk indicators that show whether your GenAI deployment is failing in ways that are invisible until they reach a regulator — hallucination rates, sensitive data exposure events, prompt injection incidents, unsafe outputs, abstention failures, and human review bypasses.Sun, 31 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-31-policy-management-kri-overdue-reviews-exceptions-attestation/https://risktemplate.com/blog/2026-05-31-policy-management-kri-overdue-reviews-exceptions-attestation/Five key risk indicators that show whether your policy management program is actually working — before your examiner finds the policies that haven't been meaningfully reviewed in three years.Sun, 31 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-31-process-risk-kri-backlogs-workarounds-sla-breaches/https://risktemplate.com/blog/2026-05-31-process-risk-kri-backlogs-workarounds-sla-breaches/Six key risk indicators that catch operational process failures before they become loss events: backlog aging, manual workaround rate, SLA breach rate, error rate by process, rework volume, and handoff failure rate.Sun, 31 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-30-ai-model-inventory-kri-governance-drift/https://risktemplate.com/blog/2026-05-30-ai-model-inventory-kri-governance-drift/AI governance programs fail when the inventory they're built on goes stale. Here are the KRIs that measure inventory completeness, ownership gaps, risk-tier accuracy, and validation aging — before an examiner finds the gaps for you.Sat, 30 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-30-control-testing-kri-exception-rates-repeat-findings/https://risktemplate.com/blog/2026-05-30-control-testing-kri-exception-rates-repeat-findings/Six key risk indicators that show whether your control testing program is surfacing real risk or producing false greens — exception rates, repeat exception frequency, failed retesting, severity mix, owner response time, and overdue coverage.Sat, 30 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-30-issue-management-kri-aging-reopen-rates-missed-due-dates/https://risktemplate.com/blog/2026-05-30-issue-management-kri-aging-reopen-rates-missed-due-dates/Six key risk indicators that show whether your issues program is actually fixing things — issue aging by severity, due date extension rate, reopen rate, repeat root cause frequency, CAP validation failure rate, and evidence completeness at closure.Sat, 30 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-30-tprm-dashboard-kri-management-vs-board-reporting/https://risktemplate.com/blog/2026-05-30-tprm-dashboard-kri-management-vs-board-reporting/Your TPRM program has two audiences with completely different information needs. Here's how to separate operational vendor risk metrics from board-level indicators — with sample KRIs, escalation thresholds, and a structure that survives examiner scrutiny.Sat, 30 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-29-ai-risk-kri-model-drift-bias-hallucination-override/https://risktemplate.com/blog/2026-05-29-ai-risk-kri-model-drift-bias-hallucination-override/AI models fail gradually, not all at once. Here are the five KRI categories that catch model drift, bias signals, GenAI hallucination rates, human override patterns, and AI-specific complaint trends before an examiner does.Fri, 29 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-29-compliance-training-kri-completion-rates-not-enough/https://risktemplate.com/blog/2026-05-29-compliance-training-kri-completion-rates-not-enough/A 97% training completion rate sounds impressive until your BSA examiner asks what roles made up the 3% who didn't complete it. Here are the five training KRIs that actually predict compliance risk.Fri, 29 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-29-operational-loss-kri-loss-events-near-miss-recovery/https://risktemplate.com/blog/2026-05-29-operational-loss-kri-loss-events-near-miss-recovery/How to turn your loss event database into a functioning early warning system — KRIs for frequency trends, near-miss conversion, recovery velocity, root cause recurrence, and severity distribution shifts that actually warn you before the next event.Fri, 29 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-29-vendor-due-diligence-kris-overdue-reviews-missing-evidence/https://risktemplate.com/blog/2026-05-29-vendor-due-diligence-kris-overdue-reviews-missing-evidence/Your TPRM program tracks vendor performance. These 6 KRIs track whether your due diligence process itself is working — review completion rates, evidence currency, exception handling, and the program health gaps examiners find most often.Fri, 29 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-28-ai-governance-policy-template-financial-services/https://risktemplate.com/blog/2026-05-28-ai-governance-policy-template-financial-services/A practitioner's guide to writing an AI governance policy for financial services: tool classification, prohibited data inputs, human review requirements, vendor-embedded AI, exception approvals, and enforcement sections that hold up to regulatory scrutiny.Thu, 28 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-28-compliance-professional-ai-practice-plan-10-exercises/https://risktemplate.com/blog/2026-05-28-compliance-professional-ai-practice-plan-10-exercises/Standard Chartered is cutting 7,800 compliance and risk jobs by 2030. Fluency with AI isn't optional—it's the skill that determines whether you're the person directing AI or the one being replaced by it. Here are 10 exercises to build it.Thu, 28 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-28-fourth-party-risk-kris-monitoring-concentration/https://risktemplate.com/blog/2026-05-28-fourth-party-risk-kris-monitoring-concentration/You have no contract with fourth parties—but you inherit their failures. Here are the KRIs that surface cloud concentration, shared subcontractors, and upstream dependency risk before it becomes your incident.Thu, 28 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-28-operational-risk-kri-examples-25-metrics/https://risktemplate.com/blog/2026-05-28-operational-risk-kri-examples-25-metrics/A practitioner's guide to 25 operational risk KRIs grouped by loss events, incidents, process controls, issues management, people risk, customer impact, and vendor dependency — with thresholds, data sources, and escalation triggers.Thu, 28 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-27-ai-output-review-checklist-risk-compliance-teams/https://risktemplate.com/blog/2026-05-27-ai-output-review-checklist-risk-compliance-teams/When an AI draft lands on your desk, what standard do you apply before signing off? The nine-point review checklist that separates defensible AI use from supervised negligence — covering source verification, scope accuracy, missing risk, customer harm, fairness, escalation triggers, and regulatory defensibility.Wed, 27 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-27-kri-exceptions-document-escalate-close-red-indicators/https://risktemplate.com/blog/2026-05-27-kri-exceptions-document-escalate-close-red-indicators/A red KRI is a management obligation, not just a dashboard update. Here's the exception memo structure, escalation matrix, and validation evidence that makes your risk program defensible to examiners.Wed, 27 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-27-regulatory-change-kris-missed-deadlines-policy-lag/https://risktemplate.com/blog/2026-05-27-regulatory-change-kris-missed-deadlines-policy-lag/Most compliance programs track regulatory changes but don't measure whether the process is actually working. Here are the seven KRIs that show whether your regulatory change management function is keeping pace — before the examiner finds the gap.Wed, 27 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-27-third-party-incident-kri-vendor-outage-operational-resilience/https://risktemplate.com/blog/2026-05-27-third-party-incident-kri-vendor-outage-operational-resilience/Vendor outages become your operational resilience problem when you can't detect them early, classify them correctly, or respond within your impact tolerances. Here are the KRIs that tell you which risk is real.Wed, 27 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-26-ai-governance-framework-financial-services-risk-compliance/https://risktemplate.com/blog/2026-05-26-ai-governance-framework-financial-services-risk-compliance/An AI governance framework is not a policy document. It is an operating model. Here is what that operating model looks like for financial services teams navigating the FS AI RMF, SR 26-02, NIST AI RMF 1.1, and five regulatory deadlines hitting in 2026.Tue, 26 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-26-compliance-kris-metrics-program-health/https://risktemplate.com/blog/2026-05-26-compliance-kris-metrics-program-health/Most compliance dashboards report activity, not risk. Here's how to build compliance KRIs that show whether your program is actually functioning — across the four CMS pillars regulators test, with escalation triggers and board reporting guidance.Tue, 26 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-26-critical-vendor-kris-sla-breaches-incidents-control-failures-concentration-risk/https://risktemplate.com/blog/2026-05-26-critical-vendor-kris-sla-breaches-incidents-control-failures-concentration-risk/Critical vendors warrant a different level of KRI coverage than your Tier 2 and Tier 3 roster. Here's the board-level monitoring framework for SLA breach classification, incident patterns, control failures, and concentration exposure — with the escalation triggers regulators expect to see documented.Tue, 26 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-26-kri-data-quality-source-data-risk-dashboard/https://risktemplate.com/blog/2026-05-26-kri-data-quality-source-data-risk-dashboard/Your KRI definition is solid. Your thresholds are calibrated. But if the source data feeding those metrics is stale, inconsistently extracted, or manually patched, your green dashboard is lying to you.Tue, 26 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-25-ai-compliance-checklist-employees-risk-compliance-teams/https://risktemplate.com/blog/2026-05-25-ai-compliance-checklist-employees-risk-compliance-teams/A practical AI compliance checklist for financial services employees—covering tool authorization, data restrictions, customer-impacting decisions, source verification, output retention, and escalation triggers.Mon, 25 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-25-how-many-kris-too-many-kri-dashboard-metric-theater/https://risktemplate.com/blog/2026-05-25-how-many-kris-too-many-kri-dashboard-metric-theater/More KRIs don't mean better risk visibility. Here's how to prune your dashboard, identify metric theater, and build a KRI program boards and examiners actually trust.Mon, 25 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-25-partner-bank-liquidity-kris-fintechs-monitor/https://risktemplate.com/blog/2026-05-25-partner-bank-liquidity-kris-fintechs-monitor/When your sponsor bank runs into trouble, you find out last. Here's what liquidity KRIs fintechs can actually track—before a Synapse-scale event freezes your customers' funds.Mon, 25 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-25-what-ai-can-cannot-replace-compliance-work/https://risktemplate.com/blog/2026-05-25-what-ai-can-cannot-replace-compliance-work/Standard Chartered is cutting 7,800 jobs—mostly in compliance and risk. HSBC is upskilling 200,000. Here's the task-level map of what AI actually automates vs. what human compliance professionals still own.Mon, 25 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-24-ai-compliance-training-plan-risk-compliance-teams/https://risktemplate.com/blog/2026-05-24-ai-compliance-training-plan-risk-compliance-teams/A practical 30/60/90-day AI compliance training roadmap for risk and compliance professionals—covering failure modes, safe prompting, regulatory frameworks, and role-specific applications.Sun, 24 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-24-ai-risk-assessment-template-questions-compliance-approval/https://risktemplate.com/blog/2026-05-24-ai-risk-assessment-template-questions-compliance-approval/Before any AI tool goes live, compliance needs answers to nine question categories — use case scope, customer impact, data sensitivity, explainability, vendor reliance, bias/fairness, monitoring, issue ownership, and evidence retained.Sun, 24 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-24-incident-kri-volume-severity-time-to-contain-resolve-root-cause/https://risktemplate.com/blog/2026-05-24-incident-kri-volume-severity-time-to-contain-resolve-root-cause/How to build an incident KRI dashboard that measures what regulators actually care about—response times, severity patterns, repeat incident rates, and root cause closure.Sun, 24 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-24-kri-appetite-statements-board-approved-risk-appetite/https://risktemplate.com/blog/2026-05-24-kri-appetite-statements-board-approved-risk-appetite/Most KRI dashboards are designed without tracing thresholds back to the board-approved risk appetite statement. Here's how to close that gap — and why regulators will ask you to.Sun, 24 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-23-kri-governance-ownership-escalation-remediation/https://risktemplate.com/blog/2026-05-23-kri-governance-ownership-escalation-remediation/Most KRI programs have metrics but no real owners. When a KRI breaches amber, nothing happens because accountability was never built into the design. Here's the governance model — roles, RACI, threshold approval paths, and escalation chains — that makes a KRI program function under regulatory scrutiny.Sat, 23 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-23-leading-vs-lagging-kri-early-warning-indicators/https://risktemplate.com/blog/2026-05-23-leading-vs-lagging-kri-early-warning-indicators/Most KRI dashboards are filled with lagging metrics that confirm what already went wrong. Here's how to tell the difference, why it matters to regulators, and how to convert common lagging KRIs into genuine early warning signals.Sat, 23 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-22-business-email-compromise-incident-response-financial-institutions/https://risktemplate.com/blog/2026-05-22-business-email-compromise-incident-response-financial-institutions/BEC caused $3.04 billion in losses in 2025. Recovery depends almost entirely on speed. Here's the hour-by-hour playbook: wire recall steps, IC3 reporting, Financial Fraud Kill Chain, SAR requirements, and how to close the loop.Fri, 22 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-22-california-admt-regulations-fintech-ai-automated-decision-making/https://risktemplate.com/blog/2026-05-22-california-admt-regulations-fintech-ai-automated-decision-making/The CPPA's automated decision-making technology rules are live. Fintechs using AI for lending decisions, fraud detection, or customer scoring face new risk assessment, notice, and opt-out obligations starting in 2026 and 2027. Here's what compliance teams need to do.Fri, 22 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-22-ffiec-business-continuity-management-booklet-2026-update/https://risktemplate.com/blog/2026-05-22-ffiec-business-continuity-management-booklet-2026-update/In February 2026, the FFIEC removed 'reputation risk' from the BCM booklet under Executive Order 14331. Here's what changed, what stayed, and a section-by-section breakdown of what examiners verify when they open Appendix A.Fri, 22 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-22-nydfs-part-500-enforcement-2025-2026-cybersecurity-compliance/https://risktemplate.com/blog/2026-05-22-nydfs-part-500-enforcement-2025-2026-cybersecurity-compliance/NYDFS has issued more than $25 million in Part 500 cybersecurity fines since January 2025 — against PayPal, eight auto insurers, Healthplex, and Delta Dental. The violation patterns are consistent. Here's what every covered entity needs to fix before they're next.Fri, 22 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-21-aup-ongoing-monitoring-high-risk-customer-post-approval/https://risktemplate.com/blog/2026-05-21-aup-ongoing-monitoring-high-risk-customer-post-approval/Your AUP exception memo approved the customer. The compliance work isn't done — here's the behavioral monitoring framework, re-review triggers, and exit process that keeps the approval defensible over time.Thu, 21 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-21-fraud-kri-examples-fintechs-threshold-drift/https://risktemplate.com/blog/2026-05-21-fraud-kri-examples-fintechs-threshold-drift/The fraud KRIs you set at launch become misleading when your transaction volume triples. Here's the full set of fraud metrics fintech risk teams need — and the calibration rules that keep them honest as the business scales.Thu, 21 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-21-liquidity-kri-early-warning-indicators-fintech-banking/https://risktemplate.com/blog/2026-05-21-liquidity-kri-early-warning-indicators-fintech-banking/The metrics that matter for liquidity risk management — uninsured deposit concentration, deposit runoff rate, wholesale funding renewal, and six more — with CFP tier mapping and threshold guidance practitioners can actually use.Thu, 21 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-21-product-risk-kri-payments-stablecoins-bnpl/https://risktemplate.com/blog/2026-05-21-product-risk-kri-payments-stablecoins-bnpl/Chargeback rates, reserve coverage ratios, early delinquency — the key risk indicators fintech product teams and risk functions need to monitor after launch across payments, BNPL, and stablecoin products.Thu, 21 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-20-high-risk-merchant-policy-transaction-review-framework/https://risktemplate.com/blog/2026-05-20-high-risk-merchant-policy-transaction-review-framework/Merchant risk reviews that start and end with an industry code miss the actual risk. Here's the transaction-level framework that tells you whether a high-risk merchant is manageable — and what you need to document before approving or denying.Wed, 20 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-20-operational-risk-kri-dashboard-board-management-reporting/https://risktemplate.com/blog/2026-05-20-operational-risk-kri-dashboard-board-management-reporting/The board doesn't need your full KRI library — it needs risk movement, breach escalations, and appetite context. Here's exactly how to separate board-level reporting from management-level monitoring, with the regulatory framework and enforcement cases that make it non-negotiable.Wed, 20 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-20-sales-vs-compliance-high-risk-customer-review/https://risktemplate.com/blog/2026-05-20-sales-vs-compliance-high-risk-customer-review/The tension between sales urgency and compliance diligence doesn't have to kill deals. Here's the escalation framework, SLA structure, and approval process that resolves high-risk customer decisions in days instead of weeks — and the enforcement record that shows what happens when sales wins for a decade.Wed, 20 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-20-sponsor-bank-rfi-volume-kri-debanking-risk/https://risktemplate.com/blog/2026-05-20-sponsor-bank-rfi-volume-kri-debanking-risk/Rising requests for information from your sponsor bank are one of the earliest signals that a partnership is under stress — and one of the least-tracked KRIs in fintech programs. Here's how to build the indicator properly and what the thresholds mean.Wed, 20 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-19-aup-exception-memo-high-risk-customer-approval-documentation/https://risktemplate.com/blog/2026-05-19-aup-exception-memo-high-risk-customer-approval-documentation/When you approve a restricted or borderline customer, the memo is not bureaucratic overhead — it's your defense against the next examiner, bank partner audit, or internal escalation. Here's the format that holds up under scrutiny.Tue, 19 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-19-contingency-funding-plan-examples-defensible-language/https://risktemplate.com/blog/2026-05-19-contingency-funding-plan-examples-defensible-language/Generic CFP language won't survive an examiner's follow-up questions. Here's how to replace vague placeholder text with specific, testable CFP language — with real examples for funding sources, triggers, testing protocols, and escalation owners.Tue, 19 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-19-kri-vs-kpi-how-to-tell-whether-metric-measures-risk/https://risktemplate.com/blog/2026-05-19-kri-vs-kpi-how-to-tell-whether-metric-measures-risk/Most risk dashboards are full of KPIs labeled as KRIs. Here's how to tell the difference — and how to convert an activity metric into a real key risk indicator that gives you an early warning before the risk becomes a problem.Tue, 19 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-19-prohibited-vs-restricted-businesses-fintech-decision-framework/https://risktemplate.com/blog/2026-05-19-prohibited-vs-restricted-businesses-fintech-decision-framework/Industry labels alone don't tell you whether you can support a customer. Here's the transaction-level decision framework that separates 'never' from 'not without a process' — and what BaaS enforcement actions prove about getting this wrong.Tue, 19 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-18-acceptable-use-policy-template-fintech-prohibited-restricted/https://risktemplate.com/blog/2026-05-18-acceptable-use-policy-template-fintech-prohibited-restricted/A structural template for fintech acceptable use policies — covering the seven sections every AUP needs, a three-tier decision table, an approval path for restricted customers, and monitoring triggers that hold up to sponsor bank and examiner scrutiny.Mon, 18 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-18-cfp-fund-flow-testing-fintechs-liquidity-exercise/https://risktemplate.com/blog/2026-05-18-cfp-fund-flow-testing-fintechs-liquidity-exercise/A fund-flow test proves your contingency funding plan actually works — not just on paper. Here's how fintechs should map payment rails, confirm collateral, walk approval chains, and document gaps before a regulator does it for them.Mon, 18 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-18-key-risk-indicators-examples-operational-financial-risk/https://risktemplate.com/blog/2026-05-18-key-risk-indicators-examples-operational-financial-risk/40 ready-to-use KRI examples for operational and financial risk programs — each with risk measured, data source, owner, threshold idea, and escalation path.Mon, 18 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-18-restricted-business-due-diligence-cannabis-weapons-gambling-crypto/https://risktemplate.com/blog/2026-05-18-restricted-business-due-diligence-cannabis-weapons-gambling-crypto/A practitioner's due diligence checklist for fintechs evaluating five high-risk business categories — the questions that determine whether a restricted customer is manageable or a liability.Mon, 18 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-17-bank-partner-aup-alignment-sponsor-bank-risk-appetite/https://risktemplate.com/blog/2026-05-17-bank-partner-aup-alignment-sponsor-bank-risk-appetite/How to map your fintech AUP to your sponsor bank's prohibited and restricted business rules, when to pre-clear customers, how to document exceptions, and what rising RFI volume signals about bank partner discomfort.Sun, 17 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-17-contingency-funding-plan-triggers-liquidity-thresholds/https://risktemplate.com/blog/2026-05-17-contingency-funding-plan-triggers-liquidity-thresholds/Vague CFP triggers don't survive examiner scrutiny. Here's how to design Green/Yellow/Red liquidity thresholds with specific metrics, documented rationale, and clear ownership — so your CFP activates before it's too late.Sun, 17 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-17-kri-task-force-owners-functional-leads-board-reporting/https://risktemplate.com/blog/2026-05-17-kri-task-force-owners-functional-leads-board-reporting/KRI programs fail when analysts assign ownership bottom-up. Here's how to build a top-down KRI task force with functional leads, board reporting rules, and accountability structures that examiners and audit committees actually accept.Sun, 17 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-17-vendor-risk-kri-metrics-third-party-warning-signals/https://risktemplate.com/blog/2026-05-17-vendor-risk-kri-metrics-third-party-warning-signals/The vendor KRIs that actually warn you before a third-party failure becomes your problem: SLA trends, SOC report exceptions, concentration exposure, financial distress signals, and fourth-party drift.Sun, 17 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-16-cfp-evidence-binder-exam-readiness-documentation/https://risktemplate.com/blog/2026-05-16-cfp-evidence-binder-exam-readiness-documentation/Examiners don't just read your CFP — they ask for evidence that it works. Here's the complete list of documentation, test records, and artifacts that belong in a CFP evidence binder, organized by funding source and review cycle.Sat, 16 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-16-cfp-funding-sources-testing-prove-contingency-plan-works/https://risktemplate.com/blog/2026-05-16-cfp-funding-sources-testing-prove-contingency-plan-works/Most CFPs list contingent funding sources without proving they're accessible. Here's how to run fund-flow tests, build an evidence file, and show regulators that your liquidity plan actually works when it needs to.Sat, 16 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-16-cfp-ownership-treasury-finance-risk/https://risktemplate.com/blog/2026-05-16-cfp-ownership-treasury-finance-risk/Practical guide to CFP ownership: who drafts, who challenges, who approves. Three-lines-of-defense roles, board oversight, and what examiners expect after SR 10-6 and the 2023 addendum.Sat, 16 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-16-kri-thresholds-false-greens-false-reds/https://risktemplate.com/blog/2026-05-16-kri-thresholds-false-greens-false-reds/Set KRI thresholds that actually warn before risk materializes. Calibration methods, the 60-day parallel run, and how to fix dashboards stuck in alert fatigue or perpetual green.Sat, 16 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-16-sec-newell-black-hawk-cannabis-fund-final-judgment/https://risktemplate.com/blog/2026-05-16-sec-newell-black-hawk-cannabis-fund-final-judgment/Robert Newell raised $37M for cannabis funds and used investor money to pay earlier investors. Here's the May 2026 SEC judgment and what private-fund advisers should learn from it.Sat, 16 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-15-critical-vendor-exit-planning-termination-wind-down-strategy/https://risktemplate.com/blog/2026-05-15-critical-vendor-exit-planning-termination-wind-down-strategy/A practitioner's guide to building vendor exit strategies that satisfy OCC, FDIC, and Federal Reserve examiners — with lessons from the Synapse collapse and the six components every exit plan must cover.Fri, 15 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-15-eu-ai-act-digital-omnibus-deadline-deferral-financial-services/https://risktemplate.com/blog/2026-05-15-eu-ai-act-digital-omnibus-deadline-deferral-financial-services/The EU AI Act's Digital Omnibus deal, reached May 7, 2026, defers Annex III high-risk AI obligations from August 2, 2026 to December 2, 2027. Here's what changed, what didn't, and how financial services AI teams should use the extra 16 months.Fri, 15 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-15-ffiec-36-hour-computer-security-incident-notification-rule/https://risktemplate.com/blog/2026-05-15-ffiec-36-hour-computer-security-incident-notification-rule/A practitioner's guide to the federal banking agencies' computer-security incident notification rule — what triggers the 36-hour clock, the two-tier framework for banks vs. bank service providers, and the gray areas that catch incident response teams off guard.Fri, 15 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-15-fintech-acceptable-use-policy-high-risk-customers/https://risktemplate.com/blog/2026-05-15-fintech-acceptable-use-policy-high-risk-customers/How to build a fintech acceptable use policy that evaluates high-risk customers by actual platform use, not blunt industry labels.Fri, 15 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-15-glba-regulation-p-privacy-notice-requirements-financial-institutions/https://risktemplate.com/blog/2026-05-15-glba-regulation-p-privacy-notice-requirements-financial-institutions/A practitioner's guide to GLBA Regulation P: who must send privacy notices, what the initial and annual notice must include, when the FAST Act exception eliminates the annual requirement, and how opt-out rights actually work.Fri, 15 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-15-sec-adani-18-million-bribery-bond-disclosure-settlement/https://risktemplate.com/blog/2026-05-15-sec-adani-18-million-bribery-bond-disclosure-settlement/SEC settles Adani Green bond offering case for $18M, charging Gautam and Sagar Adani with materially false anti-bribery statements to US investors.Fri, 15 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-14-nydfs-delta-dental-moveit-cyber-settlement/https://risktemplate.com/blog/2026-05-14-nydfs-delta-dental-moveit-cyber-settlement/NYDFS's first 2026 cybersecurity enforcement penalizes Delta Dental for a six-month notification delay and lengthened MOVEit retention settings — not for getting hit. What practitioners should pull from the consent order.Thu, 14 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-14-operational-risk-scenario-analysis-methodology-best-practices/https://risktemplate.com/blog/2026-05-14-operational-risk-scenario-analysis-methodology-best-practices/A practitioner's guide to designing, facilitating, and defending operational risk scenario analysis — from workshop setup and expert elicitation to loss estimation and ICAAP integration.Thu, 14 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-14-privacy-impact-assessment-template-dpia-gdpr-us-state/https://risktemplate.com/blog/2026-05-14-privacy-impact-assessment-template-dpia-gdpr-us-state/A practitioner's guide to designing, conducting, and documenting privacy impact assessments — covering GDPR Article 35 DPIA requirements, California CPRA risk assessments (effective January 2026), and state law PIA triggers across 20+ US jurisdictions.Thu, 14 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-14-sec-doj-insider-trading-biglaw-attorneys-21-charged/https://risktemplate.com/blog/2026-05-14-sec-doj-insider-trading-biglaw-attorneys-21-charged/The SEC's May 6 complaint against 21 defendants tied to a decade-long Big Law M&A insider trading scheme is a master class in supervision failure. Here is what compliance functions should pull from the document-access trail.Thu, 14 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-13-crisis-communication-plan-bcp-financial-institutions/https://risktemplate.com/blog/2026-05-13-crisis-communication-plan-bcp-financial-institutions/Your BCP has 60 pages on recovery procedures and three paragraphs on communication. Here's what regulators actually test, the four audience streams every plan needs, and the pre-approved templates to build before the crisis hits.Wed, 13 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-13-eu-ai-act-article-5-prohibited-ai-systems-financial-services/https://risktemplate.com/blog/2026-05-13-eu-ai-act-article-5-prohibited-ai-systems-financial-services/Article 5 prohibitions have been in force since February 2025 and the enforcement regime launched August 2025. Here's what financial institutions must audit, stop doing, and document — with the credit scoring carve-out explained.Wed, 13 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-13-hipaa-security-rule-2025-final-rule-technical-safeguards/https://risktemplate.com/blog/2026-05-13-hipaa-security-rule-2025-final-rule-technical-safeguards/The biggest HIPAA Security Rule update since 2013 is arriving in 2026. Here's what the proposed final rule requires, what's actually changing, and how to run a gap assessment before the compliance deadline.Wed, 13 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-13-occ-consent-order-response-enforcement-anatomy/https://risktemplate.com/blog/2026-05-13-occ-consent-order-response-enforcement-anatomy/What an OCC consent order actually is, how it differs from a Formal Agreement, what the articles require, and what it takes to get out — with Wells Fargo as the documented case study.Wed, 13 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-13-sec-reign-financial-international-26-million-prime-bank-scheme/https://risktemplate.com/blog/2026-05-13-sec-reign-financial-international-26-million-prime-bank-scheme/SEC's $26M Reign Financial fraud case shows what happens when 'due diligence' is just a Google search. Control gaps, red flags, and what advisers should fix this week.Wed, 13 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-12-dsar-response-workflow-ccpa-gdpr-state-privacy-laws/https://risktemplate.com/blog/2026-05-12-dsar-response-workflow-ccpa-gdpr-state-privacy-laws/DSARs aren't optional, and mishandling them now costs seven figures. Here's the complete workflow — intake, identity verification, data collection, legal review, and documented response — built for teams managing multi-law obligations.Tue, 12 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-12-operational-loss-data-collection-loss-event-database/https://risktemplate.com/blog/2026-05-12-operational-loss-data-collection-loss-event-database/Most operational risk programs have an RCSA. Far fewer have a loss event database that's actually current, classified, and connected to risk monitoring. Here's how to build one that satisfies examiner expectations and makes the rest of your ORM program credible.Tue, 12 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-12-ransomware-incident-response-playbook-financial-institutions/https://risktemplate.com/blog/2026-05-12-ransomware-incident-response-playbook-financial-institutions/When ransomware hits your bank or fintech, the first 24 hours determine your regulatory exposure, recovery timeline, and whether your next call is to your CEO or your lawyer. Here's the phase-by-phase playbook.Tue, 12 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-12-svb-signature-bank-liquidity-failures-cfp-lessons/https://risktemplate.com/blog/2026-05-12-svb-signature-bank-liquidity-failures-cfp-lessons/Understand the critical lessons from the SVB and Signature Bank liquidity failures and how to strengthen your Contingency Funding Plan (CFP) to avoid similar pitfalls.Tue, 12 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-12-vendor-breach-response-critical-supplier-incident/https://risktemplate.com/blog/2026-05-12-vendor-breach-response-critical-supplier-incident/When a vendor calls to report a breach, your incident response clock starts immediately. Here's the step-by-step playbook — triage, regulatory obligations, customer notification, and vendor accountability.Tue, 12 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-11-bia-questionnaire-template-50-questions/https://risktemplate.com/blog/2026-05-11-bia-questionnaire-template-50-questions/Master your BIA with our comprehensive 50-question template, designed to identify critical business functions, RTOs, RPOs, and ensure robust business continuity planning. Download free template.Mon, 11 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-11-bsa-aml-independent-testing-program-ffiec-requirements/https://risktemplate.com/blog/2026-05-11-bsa-aml-independent-testing-program-ffiec-requirements/The second pillar of a BSA/AML program — and one of the most cited in enforcement actions. Here's what the FFIEC exam manual actually requires, what examiners test, and how to build independent testing that holds up.Mon, 11 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-11-eu-ai-act-high-risk-ai-systems-financial-services-compliance/https://risktemplate.com/blog/2026-05-11-eu-ai-act-high-risk-ai-systems-financial-services-compliance/Annex III of the EU AI Act covers credit scoring, insurance pricing, and financial standing assessment. Here's what the seven compliance obligations actually require — and who they apply to.Mon, 11 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-11-parmar-constellation-healthcare-212-million-securities-fraud-sentencing/https://risktemplate.com/blog/2026-05-11-parmar-constellation-healthcare-212-million-securities-fraud-sentencing/Former Constellation Healthcare CEO Parmjit Parmar got 5 years and $125M restitution for a $212M securities fraud built on fake subsidiaries. Here's what risk teams should rebuild this week.Mon, 11 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-10-compliance-calendar-template-regulatory-deadlines-filings/https://risktemplate.com/blog/2026-05-10-compliance-calendar-template-regulatory-deadlines-filings/How to build a compliance calendar that tracks every BSA, HMDA, Call Report, SAR, and exam deadline — with a 2026 reference template and the fields that survive an audit.Sun, 10 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-10-ffiec-it-examination-handbook-practitioner-walkthrough/https://risktemplate.com/blog/2026-05-10-ffiec-it-examination-handbook-practitioner-walkthrough/The FFIEC IT Handbook is 11 booklets and thousands of pages. Here's what examiners actually focus on, which booklets matter most for your institution, and how to prepare for each domain.Sun, 10 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-10-mra-remediation-playbook-matter-requiring-attention/https://risktemplate.com/blog/2026-05-10-mra-remediation-playbook-matter-requiring-attention/How to respond to an OCC, FDIC, or Fed MRA — the 5 Cs format, 30-day board response, MRIA timelines, and what gets you out of the supervisory dog house.Sun, 10 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-10-omb-m-26-11-civil-monetary-penalty-inflation-adjustment-cancelled-2026/https://risktemplate.com/blog/2026-05-10-omb-m-26-11-civil-monetary-penalty-inflation-adjustment-cancelled-2026/OMB Memo M-26-11 freezes federal civil monetary penalties at 2025 levels for the first time since FCPIAA 2015. What it means for OFAC, SEC, OCC enforcement.Sun, 10 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-10-state-privacy-laws-glba-safe-harbor-financial-institutions/https://risktemplate.com/blog/2026-05-10-state-privacy-laws-glba-safe-harbor-financial-institutions/Montana, Connecticut, Minnesota, California, and Oregon have narrowed or eliminated the GLBA entity-level exemption. If your financial institution assumes state privacy laws don't apply, you have a compliance gap.Sun, 10 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-09-control-testing-techniques-sampling-walkthroughs-evidence/https://risktemplate.com/blog/2026-05-09-control-testing-techniques-sampling-walkthroughs-evidence/A practitioner's guide to testing internal controls — statistical vs. nonstatistical sampling, how to run a walkthrough, what evidence examiners actually want, and where most testing programs fall short.Sat, 09 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-09-occ-criminal-regulatory-offenses-report-eo-14294/https://risktemplate.com/blog/2026-05-09-occ-criminal-regulatory-offenses-report-eo-14294/OCC's May 8, 2026 report under Executive Order 14294 catalogs every criminal regulatory offense the OCC or DOJ can enforce, with mens rea standards. What compliance teams should do now.Sat, 09 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-09-risk-scoring-techniques-likelihood-impact-examiner-pushback/https://risktemplate.com/blog/2026-05-09-risk-scoring-techniques-likelihood-impact-examiner-pushback/The L×I formula is nearly universal — but four common ways teams apply it turn defensible risk scores into examination findings. Here's what examiners flag and how to fix it.Sat, 09 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-09-sanctions-screening-techniques-ofac-false-positives/https://risktemplate.com/blog/2026-05-09-sanctions-screening-techniques-ofac-false-positives/How to calibrate your sanctions screening system to cut false positive volume, defend your match threshold to examiners, and document the tuning process OFAC expects.Sat, 09 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-09-vendor-risk-questionnaire-template-questions-that-surface-risk/https://risktemplate.com/blog/2026-05-09-vendor-risk-questionnaire-template-questions-that-surface-risk/Most vendor questionnaires produce clean checkboxes, not useful answers. Here are the specific questions — including AI vendor and fourth-party sections most templates miss — that reveal what's actually there.Sat, 09 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-08-access-control-policy-template-rbac-least-privilege/https://risktemplate.com/blog/2026-05-08-access-control-policy-template-rbac-least-privilege/Build a defensible access control policy covering RBAC, least privilege, privileged access management, and periodic user reviews. Includes the key sections examiners test under NIST 800-53 AC controls and the FFIEC IT Handbook.Fri, 08 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-08-incident-triage-techniques-severity-materiality-sec-4-day-clock/https://risktemplate.com/blog/2026-05-08-incident-triage-techniques-severity-materiality-sec-4-day-clock/How to classify incident severity correctly, build a working materiality decision process for SEC 8-K purposes, and avoid the documentation failures that turned early Form 8-K filings into SEC comment letters.Fri, 08 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-08-occ-semiannual-risk-perspective-spring-2026/https://risktemplate.com/blog/2026-05-08-occ-semiannual-risk-perspective-spring-2026/OCC's Spring 2026 Semiannual Risk Perspective flags credit, cyber, AI, and sanctions risk. What examiners will ask and how to align your program.Fri, 08 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-08-sar-template-narrative-writing-filing-triggers-mistakes/https://risktemplate.com/blog/2026-05-08-sar-template-narrative-writing-filing-triggers-mistakes/A practitioner's guide to SAR filing: thresholds by institution type, the 30/60-day clock, the five-W narrative framework, October 2025 FinCEN FAQ updates, and the 10 narrative mistakes that get your BSA program cited.Fri, 08 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-08-sec-ortiz-daveglo-oil-gas-undisclosed-compensation-broker-registration/https://risktemplate.com/blog/2026-05-08-sec-ortiz-daveglo-oil-gas-undisclosed-compensation-broker-registration/SEC final judgment against David Ortiz and DaveGlo Investment Group for $18M unregistered oil and gas sales. Compliance lessons on broker registration and undisclosed compensation.Fri, 08 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-08-vendor-due-diligence-techniques-questionnaire-verification/https://risktemplate.com/blog/2026-05-08-vendor-due-diligence-techniques-questionnaire-verification/A completed vendor questionnaire is the starting point, not the finish line. Here's how to verify self-reported answers, what documents to request, what red flags look like, and how to document your work so it survives an OCC or FDIC exam.Fri, 08 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-07-ai-red-teaming-techniques-stress-test-llms-deployment/https://risktemplate.com/blog/2026-05-07-ai-red-teaming-techniques-stress-test-llms-deployment/A practitioner's playbook for AI red teaming in financial services. Covers the five attack categories regulators care about, how to structure an exercise, what scoring looks like, and how to document results for examiners.Thu, 07 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-07-annual-compliance-risk-assessment-methodology-regulators/https://risktemplate.com/blog/2026-05-07-annual-compliance-risk-assessment-methodology-regulators/The compliance risk assessment is the foundation of every compliance management system that survives a regulatory exam. Here's the methodology regulators expect, the scoring model, and the gaps most often cited in exam findings.Thu, 07 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-07-bia-questionnaire-template-50-questions/https://risktemplate.com/blog/2026-05-07-bia-questionnaire-template-50-questions/Master business continuity with our BIA questionnaire template. Identify critical functions, assess impacts, and set recovery objectives with 50 essential questions.Thu, 07 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-07-doj-rivera-nuhfer-fara-pdvsa-50-million-venezuela-conviction/https://risktemplate.com/blog/2026-05-07-doj-rivera-nuhfer-fara-pdvsa-50-million-venezuela-conviction/DOJ convicted ex-Rep. David Rivera and lobbyist Esther Nuhfer for a $50M unregistered Venezuela lobbying scheme. What it means for FARA, sanctions, and AML programs.Thu, 07 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-07-gdpr-enforcement-2026-fines-patterns-us-companies/https://risktemplate.com/blog/2026-05-07-gdpr-enforcement-2026-fines-patterns-us-companies/€7.1 billion in cumulative fines and enforcement is accelerating. Here are the top penalties, the patterns DPAs are pursuing, and the specific gaps that keep landing US multinationals in trouble.Thu, 07 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-07-kyc-policy-template-customer-due-diligence-fintech/https://risktemplate.com/blog/2026-05-07-kyc-policy-template-customer-due-diligence-fintech/Build a defensible KYC policy covering all four pillars: CIP, risk rating, beneficial ownership, and ongoing monitoring. Includes the 2026 FinCEN exceptive relief update and lessons from Block's $80M and OKX's $504M enforcement actions.Thu, 07 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-06-cybersecurity-policy-template/https://risktemplate.com/blog/2026-05-06-cybersecurity-policy-template/Build a cybersecurity policy that satisfies NYDFS Part 500, NIST CSF 2.0, FTC Safeguards, and FFIEC. Required elements, control mappings, and what examiners flag.Wed, 06 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-06-disparate-impact-testing-techniques-statistical-methods/https://risktemplate.com/blog/2026-05-06-disparate-impact-testing-techniques-statistical-methods/The four statistical methods used in fair lending disparate impact testing — adverse impact ratio, regression analysis, Fisher's exact test, and BISG proxy methodology — and how to document them for exam readiness even after the federal regulatory shift.Wed, 06 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-06-doj-postal-treasury-check-theft-84-million/https://risktemplate.com/blog/2026-05-06-doj-postal-treasury-check-theft-84-million/Four defendants pleaded guilty to stealing $84M in Treasury checks from a Philly USPS facility and reselling them on Telegram. Banks stopped 87%. Here's how.Wed, 06 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-06-ofac-risk-assessment-template/https://risktemplate.com/blog/2026-05-06-ofac-risk-assessment-template/Build a defensible OFAC risk assessment using Treasury's five-component framework. Risk factors, scoring methodology, and what examiners look for.Wed, 06 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-06-sklarov-astor-450-million-stock-loan-fraud-scheme/https://risktemplate.com/blog/2026-05-06-sklarov-astor-450-million-stock-loan-fraud-scheme/SDNY indicted Vladimir Sklarov for a $450M stock-backed loan scheme using a fake Astor family-linked lender. Here's the control gap every counterparty diligence team needs to fix.Wed, 06 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-06-tabletop-exercise-facilitation-techniques-bcp-gap-discovery/https://risktemplate.com/blog/2026-05-06-tabletop-exercise-facilitation-techniques-bcp-gap-discovery/The facilitation mechanics that separate tabletop exercises that find real gaps from ones that generate paperwork. Role structure, inject design, hot wash technique, and the common mistakes that turn a good scenario into a wasted afternoon.Wed, 06 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-ai-risk-assessment-template-financial-services/https://risktemplate.com/blog/2026-05-05-ai-risk-assessment-template-financial-services/A pre-deployment AI risk assessment for banks and fintechs — model inventory, tiering, scorecard, and the controls examiners ask about under SR 26-02 and FS AI RMF.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-aml-risk-assessment-template-banks-fintechs/https://risktemplate.com/blog/2026-05-05-aml-risk-assessment-template-banks-fintechs/Build a defensible BSA/AML risk assessment using the FFIEC's inherent risk framework. Covers the four risk categories, scoring methodology, FinCEN's April 2026 NPRM requirements, and common exam deficiencies.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-data-classification-policy-template-tiers-defensible/https://risktemplate.com/blog/2026-05-05-data-classification-policy-template-tiers-defensible/Build a defensible data classification policy that maps to GLBA, CCPA, HIPAA, and PCI DSS. Includes the four-tier model, regulatory crosswalk, handling rules, and legal hold triggers.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-data-retention-policy-template-schedules-legal-hold-defensible-disposal/https://risktemplate.com/blog/2026-05-05-data-retention-policy-template-schedules-legal-hold-defensible-disposal/Build a data retention policy that survives a regulator's request and a litigator's subpoena. Retention schedules, legal hold workflows, and disposal proof.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-information-security-policy-template-fintech-community-bank/https://risktemplate.com/blog/2026-05-05-information-security-policy-template-fintech-community-bank/Build an information security policy that satisfies the FTC Safeguards Rule, FFIEC expectations, and bank examiner scrutiny. Includes required elements, structure, and common gaps.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-liquidity-stress-testing-techniques-run-off-wholesale-withdrawal/https://risktemplate.com/blog/2026-05-05-liquidity-stress-testing-techniques-run-off-wholesale-withdrawal/Go beyond the scenario labels. How to build defensible run-off rate assumptions, model wholesale funding cliff risk, and quantify contingent draw exposure — with the specific techniques examiners challenge.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-occ-bulletin-2026-13-mrm-revised-guidance/https://risktemplate.com/blog/2026-05-05-occ-bulletin-2026-13-mrm-revised-guidance/Banking regulators rescinded SR 11-7 and replaced it with principles-based MRM guidance. Here's what changed and what model risk teams need to do now.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-05-sec-elon-musk-twitter-13d-settlement-beneficial-ownership/https://risktemplate.com/blog/2026-05-05-sec-elon-musk-twitter-13d-settlement-beneficial-ownership/The SEC just closed the largest Section 13(d) penalty in agency history — $1.5M against the Elon Musk Revocable Trust for an 11-day delay disclosing a 5%+ stake in Twitter. Here's what every compliance officer monitoring the 5% threshold needs to know.Tue, 05 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-04-compliance-monitoring-testing-plan-risk-based/https://risktemplate.com/blog/2026-05-04-compliance-monitoring-testing-plan-risk-based/Examiners evaluate your compliance testing for substance, not form. A schedule that exists but produces no escalations is a red flag. Here's how to build a risk-based monitoring and testing program that actually holds up.Mon, 04 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-04-customer-identification-program-cip-template-banks-fintechs/https://risktemplate.com/blog/2026-05-04-customer-identification-program-cip-template-banks-fintechs/Build a defensible CIP under 31 CFR 1020.220. Required data, verification methods, the 2025 TIN exemption, and lessons from the LPL Financial $18M fine.Mon, 04 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-04-risk-matrix-template-5x5-vs-3x3-heat-map/https://risktemplate.com/blog/2026-05-04-risk-matrix-template-5x5-vs-3x3-heat-map/A risk matrix is only as good as the calibration behind it. Here's how to choose between 5x5 and 3x3, build defensible scoring criteria, and present the result in a way regulators and boards actually trust.Mon, 04 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-04-risk-register-template-fintech-examples-scoring/https://risktemplate.com/blog/2026-05-04-risk-register-template-fintech-examples-scoring/Build a fintech risk register that survives examiner scrutiny. 30+ real risks across BaaS, fraud, vendor, AI, and compliance — with scoring, owners, and controls.Mon, 04 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-cloud-concentration-risk-hyperscaler-regulatory-compliance/https://risktemplate.com/blog/2026-05-03-cloud-concentration-risk-hyperscaler-regulatory-compliance/DORA designated AWS, Microsoft, and Google Cloud as Critical ICT Third-Party Providers in November 2025 — the first formal regulatory oversight of hyperscalers in financial services. Here's how to assess, document, and manage cloud concentration risk before your next examination.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-community-bank-leverage-ratio-final-rule-8-percent-2026/https://risktemplate.com/blog/2026-05-03-community-bank-leverage-ratio-final-rule-8-percent-2026/Federal banking agencies finalized the 8% Community Bank Leverage Ratio with a 4-quarter grace period, effective July 1, 2026. Practitioner playbook for opt-in decisions and capital reporting.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-eu-ai-act-gpai-model-obligations-compliance-2026/https://risktemplate.com/blog/2026-05-03-eu-ai-act-gpai-model-obligations-compliance-2026/EU AI Act GPAI model obligations went live August 2, 2025. Enforcement fines up to 3% of global turnover kick in August 2, 2026. Here's what every general-purpose AI provider must document, what systemic risk triggers, and what downstream deployers need from their vendors.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-ftc-safeguards-rule-compliance-nonbank-financial-institutions/https://risktemplate.com/blog/2026-05-03-ftc-safeguards-rule-compliance-nonbank-financial-institutions/The FTC Safeguards Rule (16 CFR Part 314) applies to fintechs, mortgage brokers, auto dealers, tax preparers, and investment advisors — not just banks. Penalties reach $51,744 per violation per day. Here's what the 2021 and 2023 amendments require, what companies keep missing, and how to close the gaps.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-gdpr-enforcement-fines-2025-us-companies/https://risktemplate.com/blog/2026-05-03-gdpr-enforcement-fines-2025-us-companies/GDPR fines exceeded €1 billion in 2025 alone — eight of the ten biggest penalties hit US companies. TikTok's €530M fine, LinkedIn's €310M, and Google's third escalating penalty reveal a predictable enforcement pattern. Here's what practitioners need to fix before an inquiry lands.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-sec-jay-lucas-50m-private-equity-fraud-controls/https://risktemplate.com/blog/2026-05-03-sec-jay-lucas-50m-private-equity-fraud-controls/SEC charged Jay Lucas and Lucas Brand Equity with $50M fraud after 12 years of misappropriation. The control failures every PE adviser and CCO needs to fix.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-03-test-contingency-funding-plan-tabletop-exercises/https://risktemplate.com/blog/2026-05-03-test-contingency-funding-plan-tabletop-exercises/The 2023 Interagency Addendum specifically requires tested access to contingent funding sources. Here's how OCC, FDIC, NCUA, and Federal Reserve teams evaluate the testing record — with after-action review templates.Sun, 03 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-02-fourth-party-risk-vendor-vendor-problem/https://risktemplate.com/blog/2026-05-02-fourth-party-risk-vendor-vendor-problem/Fourth-party risk is the gap most TPRM programs ignore — until a subcontractor takes down operations. Here's how to map, monitor, and contract for it.Sat, 02 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-02-fourth-party-risk-vendors-vendor-problem/https://risktemplate.com/blog/2026-05-02-fourth-party-risk-vendors-vendor-problem/Fourth-party risk took down thousands of organizations via MOVEit, SolarWinds, and CrowdStrike. NYDFS October 2025 and DORA Articles 28-29 now codify what banks have to manage downstream. Here's the practical program.Sat, 02 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-02-nist-incident-response-framework-sp-800-61-rev-3-explained/https://risktemplate.com/blog/2026-05-02-nist-incident-response-framework-sp-800-61-rev-3-explained/NIST SP 800-61 Rev. 3 was finalized April 3, 2025, withdrawing the 2012 Rev. 2 that most incident response programs were built on. Here's what changed, what the CSF 2.0 restructuring means for your IR program, and what you need to update.Sat, 02 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-02-occ-fed-fdic-revised-model-risk-management-guidance-2026/https://risktemplate.com/blog/2026-05-02-occ-fed-fdic-revised-model-risk-management-guidance-2026/The 2026 interagency model risk management guidance retires SR 11-7 and OCC 2011-12. Principles-based, $30B threshold, AI carved out. What MRM teams need to do.Sat, 02 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-02-state-breach-notification-laws-50-state-comparison/https://risktemplate.com/blog/2026-05-02-state-breach-notification-laws-50-state-comparison/All 50 states have breach notification laws with varying deadlines, covered data types, and penalties. California just tightened its timeline to 30 days effective January 2026. Here's the practical guide to managing the patchwork.Sat, 02 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-02-vendor-onboarding-process-compliance-steps-most-companies-skip/https://risktemplate.com/blog/2026-05-02-vendor-onboarding-process-compliance-steps-most-companies-skip/Most vendor onboarding programs are procurement checklists with compliance labels. Here are the eight steps that get skipped most often — and what the 2023 OCC/FDIC/Fed interagency guidance actually requires before you grant a vendor access.Sat, 02 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-cyber-incident-response-playbook-detection-to-lessons-learned/https://risktemplate.com/blog/2026-05-01-cyber-incident-response-playbook-detection-to-lessons-learned/A step-by-step cyber incident response playbook covering all six phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Includes NIST SP 800-61 Rev. 3 alignment and CIRCIA reporting integration.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-doj-bank-fraud-mail-theft-scheme-lessons/https://risktemplate.com/blog/2026-05-01-doj-bank-fraud-mail-theft-scheme-lessons/Learn critical lessons for financial institutions from the DOJ's recent $5 million bank fraud and mail theft indictment, focusing on insider threats and control gaps.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-rcsa-methodology-workshop-facilitation-scoring-pitfalls/https://risktemplate.com/blog/2026-05-01-rcsa-methodology-workshop-facilitation-scoring-pitfalls/How to actually run a Risk and Control Self-Assessment — workshop prep, scoring matrices, inherent vs residual logic, and the seven pitfalls that turn RCSA into a check-the-box exercise.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-soc-2-vs-iso-27001-when-to-pick-which/https://risktemplate.com/blog/2026-05-01-soc-2-vs-iso-27001-when-to-pick-which/SOC 2 or ISO 27001? The right answer depends on your market, timeline, and customer base — not on which framework sounds more rigorous. A practitioner's comparison of costs, timelines, control overlap, and when both are worth it.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-three-lines-of-defense-roles-responsibilities-where-it-breaks/https://risktemplate.com/blog/2026-05-01-three-lines-of-defense-roles-responsibilities-where-it-breaks/The Three Lines of Defense (now Three Lines Model) defines how risk ownership, oversight, and independent assurance divide across an organization. Here's what each line actually does, the 2020 IIA update, and the failure modes that cause the whole thing to collapse.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-vendor-risk-assessment-template-questions-to-ask/https://risktemplate.com/blog/2026-05-01-vendor-risk-assessment-template-questions-to-ask/A practical vendor risk assessment template — the question domains, scoring approach, evidence to demand, and red flags that should kill a vendor before contract signature.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-05-01-vendor-risk-tiering-how-to-classify-vendors-by-criticality/https://risktemplate.com/blog/2026-05-01-vendor-risk-tiering-how-to-classify-vendors-by-criticality/A practical vendor risk tiering framework for compliance and risk teams: four scoring dimensions, four-tier model, and what each tier means for due diligence, monitoring, and examiner expectations under the 2023 OCC/FDIC/Fed interagency guidance.Fri, 01 May 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-30-key-risk-indicators-kri-guide-50-examples-by-domain/https://risktemplate.com/blog/2026-04-30-key-risk-indicators-kri-guide-50-examples-by-domain/What KRIs actually are, how to design and threshold them, and 50+ ready-to-use examples across operational, credit, compliance, cyber, liquidity, third-party, and model risk domains.Thu, 30 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-30-soc-2-readiness-assessment-gap-analysis-guide/https://risktemplate.com/blog/2026-04-30-soc-2-readiness-assessment-gap-analysis-guide/How to run a SOC 2 readiness gap analysis: the 4-phase process, most common findings, remediation priorities, and the 60–120 day timeline from gap to clean Type 1 report.Thu, 30 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-29-risk-appetite-statement-how-to-write-board-approval/https://risktemplate.com/blog/2026-04-29-risk-appetite-statement-how-to-write-board-approval/How to write a risk appetite statement that survives board scrutiny: the three-tier structure, qualitative vs quantitative elements, and how to make it operational.Wed, 29 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-29-soc-2-compliance-checklist-controls-auditors-test/https://risktemplate.com/blog/2026-04-29-soc-2-compliance-checklist-controls-auditors-test/SOC 2 compliance checklist mapped to all 9 Common Criteria: exact controls, evidence requirements, and the top audit exceptions that cause clean reports to go sideways.Wed, 29 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-28-how-to-build-enterprise-risk-management-framework-from-scratch/https://risktemplate.com/blog/2026-04-28-how-to-build-enterprise-risk-management-framework-from-scratch/Step-by-step guide to building an ERM framework: governance structure, risk appetite, risk taxonomy, RCSA, KRIs, and board reporting that actually works.Tue, 28 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-28-occ-bulletin-2026-13-model-risk-management-guidance-update/https://risktemplate.com/blog/2026-04-28-occ-bulletin-2026-13-model-risk-management-guidance-update/OCC, Fed, and FDIC rescinded SR 11-7 and OCC 2011-12 on April 17, 2026. Here's what changed, what's gone, and what practitioners need to do now under OCC Bulletin 2026-13.Tue, 28 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-28-soc-2-type-1-vs-type-2-which-one-do-you-actually-need/https://risktemplate.com/blog/2026-04-28-soc-2-type-1-vs-type-2-which-one-do-you-actually-need/SOC 2 Type 1 vs Type 2 explained: cost, timeline, what enterprise buyers actually accept, and when skipping straight to Type 2 is the right call.Tue, 28 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-27-coso-erm-framework-5-components-20-principles/https://risktemplate.com/blog/2026-04-27-coso-erm-framework-5-components-20-principles/COSO ERM 2017 framework explained: 5 components, all 20 principles, and how to implement it in your organization without creating a shelf document.Mon, 27 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-27-incident-response-plan-template-6-phases-what-templates-miss/https://risktemplate.com/blog/2026-04-27-incident-response-plan-template-6-phases-what-templates-miss/A practical guide to the 6-phase incident response lifecycle — Preparation through Lessons Learned — including what most IRP templates overlook: notification timelines, CIRCIA requirements, and NIST SP 800-61 Rev. 3.Mon, 27 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-27-sec-terrence-chalk-dr-cash-ponzi-fraud/https://risktemplate.com/blog/2026-04-27-sec-terrence-chalk-dr-cash-ponzi-fraud/Terrence Chalk, aka Dr. Cash, ran a Ponzi scheme targeting retirees for three years before the SEC and FBI caught up. Here's what compliance teams need to know.Mon, 27 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-27-vendor-risk-management-complete-process-onboarding-offboarding/https://risktemplate.com/blog/2026-04-27-vendor-risk-management-complete-process-onboarding-offboarding/The complete vendor risk management lifecycle explained: risk tiering, due diligence, contract controls, ongoing monitoring, and secure offboarding. Based on the 2023 OCC/FDIC/Fed interagency guidance.Mon, 27 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-27-what-is-soc-2-compliance-practitioner-guide/https://risktemplate.com/blog/2026-04-27-what-is-soc-2-compliance-practitioner-guide/SOC 2 compliance explained for practitioners: Trust Service Criteria, Type 1 vs Type 2, common audit findings, and how to get started.Mon, 27 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-26-doj-scam-center-strike-force-pig-butchering-702-million-aml-compliance/https://risktemplate.com/blog/2026-04-26-doj-scam-center-strike-force-pig-butchering-702-million-aml-compliance/The DOJ restrained $702M in crypto from pig-butchering scams and OFAC sanctioned 29 Cambodian entities including a bank. Here's what US compliance teams must do now.Sun, 26 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-26-early-warning-indicators-liquidity-stress-triggers/https://risktemplate.com/blog/2026-04-26-early-warning-indicators-liquidity-stress-triggers/A practical framework for designing Early Warning Indicators that actually trigger action — Measures, Escalation, Reporting, Integrated systems, and Thresholds. Aligned to BCBS, OCC, and Federal Reserve expectations.Sun, 26 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-26-genai-supply-chain-risk-third-party-model-dependencies-nist-ai-600-1/https://risktemplate.com/blog/2026-04-26-genai-supply-chain-risk-third-party-model-dependencies-nist-ai-600-1/Most financial institutions using GenAI APIs don't fully own their AI supply chain. NIST AI 600-1 says that's your problem. Here's what you need to control.Sun, 26 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-26-nist-ai-600-1-developer-deployer-operator-roles-obligations/https://risktemplate.com/blog/2026-04-26-nist-ai-600-1-developer-deployer-operator-roles-obligations/NIST AI 600-1 assigns different GenAI risk obligations to developers, deployers, and operators. Here's what each role actually owns—and where the gaps live.Sun, 26 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-25-doj-bec-credential-phishing-travel-agency-extradition-compliance/https://risktemplate.com/blog/2026-04-25-doj-bec-credential-phishing-travel-agency-extradition-compliance/DOJ extradited an Ivorian national for a $14M BEC phishing scheme targeting travel agencies. Here's how the attack worked and the 5 controls that could have stopped it.Sat, 25 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-25-genai-incident-disclosure-content-provenance-nist-ai-600-1/https://risktemplate.com/blog/2026-04-25-genai-incident-disclosure-content-provenance-nist-ai-600-1/What NIST AI 600-1 requires when your GenAI system fails: incident disclosure obligations, after-action review requirements, and content provenance tracking.Sat, 25 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-25-jay-lucas-lucas-brand-equity-sec-private-equity-fraud/https://risktemplate.com/blog/2026-04-25-jay-lucas-lucas-brand-equity-sec-private-equity-fraud/SEC filed a civil complaint against Jay Lucas and Lucas Brand Equity LLC on April 24, 2026, alleging he raised $50M from investors and spent it on his wife's skincare company, alimony, and luxury expenses.Sat, 25 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-25-john-fernandez-avail-progression-forex-fraud-final-judgment/https://risktemplate.com/blog/2026-04-25-john-fernandez-avail-progression-forex-fraud-final-judgment/A federal court entered a $5 million final judgment against John Fernandez, Avail Progression LLC, and Elite Generators LLC for running unregistered forex Ponzi schemes targeting 100+ investors.Sat, 25 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-25-occ-illinois-interchange-fee-prohibition-act-preemption-national-banks/https://risktemplate.com/blog/2026-04-25-occ-illinois-interchange-fee-prohibition-act-preemption-national-banks/The OCC issued two interim final actions preempting the Illinois Interchange Fee Prohibition Act. National banks and federal savings associations are not required to comply with the Illinois IFPA.Sat, 25 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-25-tevv-generative-ai-pre-deployment-testing-nist-ai-600-1/https://risktemplate.com/blog/2026-04-25-tevv-generative-ai-pre-deployment-testing-nist-ai-600-1/What NIST AI 600-1 requires before you deploy any GenAI system: the full TEVV testing protocol across all 12 risk categories, red-team requirements, and go/no-go gates.Sat, 25 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-24-finra-jpmorgan-securities-supervision-failure-rule-3110-10000-alerts/https://risktemplate.com/blog/2026-04-24-finra-jpmorgan-securities-supervision-failure-rule-3110-10000-alerts/FINRA's JPMorgan Securities action shows Rule 3110 compliance requires actual review — not just alert generation. Here's what compliance teams must fix now.Fri, 24 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-24-nist-ai-600-1-confabulation-hallucination-testing/https://risktemplate.com/blog/2026-04-24-nist-ai-600-1-confabulation-hallucination-testing/NIST AI 600-1 names confabulation as one of 12 GenAI risk categories. Here's what the framework actually requires — and how to build a testing program that satisfies it.Fri, 24 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-24-nist-ai-rmf-sr-26-02-fs-ai-rmf-crosswalk-financial-services/https://risktemplate.com/blog/2026-04-24-nist-ai-rmf-sr-26-02-fs-ai-rmf-crosswalk-financial-services/Three AI risk frameworks now apply to financial services. Here's how NIST AI RMF, SR 26-02, and the Treasury FS AI RMF fit together — and which one covers what.Fri, 24 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-24-sripetch-v-sec-supreme-court-disgorgement-enforcement/https://risktemplate.com/blog/2026-04-24-sripetch-v-sec-supreme-court-disgorgement-enforcement/SCOTUS heard oral argument April 20 in Sripetch v. SEC. The ruling will determine if the SEC must prove investor losses before seeking disgorgement — $6B+ per year at stake.Fri, 24 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-23-2026-crypto-compliance-roadmap-genius-act-clarity-act/https://risktemplate.com/blog/2026-04-23-2026-crypto-compliance-roadmap-genius-act-clarity-act/Your compliance calendar for the two biggest US crypto laws: GENIUS Act deadlines, CLARITY Act status, California DFAL, and what to build before January 2027.Thu, 23 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-23-cfpb-ecoa-disparate-impact-eliminated-regulation-b-fair-lending-compliance/https://risktemplate.com/blog/2026-04-23-cfpb-ecoa-disparate-impact-eliminated-regulation-b-fair-lending-compliance/CFPB's April 22 final rule removes disparate impact from Regulation B. Federal fair lending just changed permanently — but state exposure didn't. Here's what compliance teams need to act on before July 21.Thu, 23 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-23-nist-ai-100-1-seven-trustworthy-ai-characteristics-compliance/https://risktemplate.com/blog/2026-04-23-nist-ai-100-1-seven-trustworthy-ai-characteristics-compliance/NIST AI 100-1 defines seven trustworthiness characteristics that underpin the entire AI RMF. Here's what each one means, how they interact, the trade-offs NIST acknowledges, and how regulators are using them in exams.Thu, 23 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-23-nist-ai-rmf-manage-function-prioritize-treat-monitor-ai-risks/https://risktemplate.com/blog/2026-04-23-nist-ai-rmf-manage-function-prioritize-treat-monitor-ai-risks/The MANAGE function is where NIST AI RMF turns risk assessment into operational decisions. Learn what MG-1 through MG-4 require, how to structure risk treatment decisions, and what continuous AI risk monitoring looks like in practice.Thu, 23 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-23-nist-ai-rmf-measure-function-tevv-bias-testing-metrics/https://risktemplate.com/blog/2026-04-23-nist-ai-rmf-measure-function-tevv-bias-testing-metrics/How to implement the NIST AI RMF MEASURE function: TEVV methodology, 13 trustworthy characteristic subcategories, bias testing, and financial services alignment.Thu, 23 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-22-nist-ai-rmf-map-function-ai-risk-context-framing/https://risktemplate.com/blog/2026-04-22-nist-ai-rmf-map-function-ai-risk-context-framing/The MAP function is where NIST AI RMF risk management actually starts. Learn what MAP 1-5 require, how financial institutions implement them, and why most teams get this wrong.Wed, 22 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-22-state-money-transmitter-license-crypto-patchwork-compliance/https://risktemplate.com/blog/2026-04-22-state-money-transmitter-license-crypto-patchwork-compliance/49 states require money transmitter licenses for crypto businesses. OKX paid $505M for getting this wrong. Here's the state-by-state breakdown and how to build your licensing strategy.Wed, 22 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-22-voyager-pacific-capital-ponzi-fraud-sec-doj-compliance-lessons/https://risktemplate.com/blog/2026-04-22-voyager-pacific-capital-ponzi-fraud-sec-doj-compliance-lessons/The SEC charged Voyager Pacific Capital Management in a $25M real estate Ponzi that ran five years. Here's what compliance teams must fix before examiners ask.Wed, 22 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-21-agentic-ai-governance-compliance-gap/https://risktemplate.com/blog/2026-04-21-agentic-ai-governance-compliance-gap/SR 11-7, Reg E, and UDAAP weren't built for AI that acts autonomously. Here's where your compliance program has a blind spot—and what to build before regulators close it.Tue, 21 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-21-stablecoin-compliance-genius-act-consumer-protection/https://risktemplate.com/blog/2026-04-21-stablecoin-compliance-genius-act-consumer-protection/The GENIUS Act is law. Here's what permitted payment stablecoin issuers owe consumers—reserve requirements, redemption policies, fee disclosures, and bankruptcy protections.Tue, 21 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-20-continuous-monitoring-ai-models-drift-degradation-compliance-triggers/https://risktemplate.com/blog/2026-04-20-continuous-monitoring-ai-models-drift-degradation-compliance-triggers/SR 11-7 ongoing monitoring for AI models — drift detection, PSI thresholds, re-validation triggers, and what OCC examiners check in 2026.Mon, 20 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-20-crypto-complaint-handling-cfpb-scrutiny-platform-preparation/https://risktemplate.com/blog/2026-04-20-crypto-complaint-handling-cfpb-scrutiny-platform-preparation/CFPB pulled back, but state AGs and the GENIUS Act mean crypto platforms still need robust complaint handling. Here's what the Bitcoin Depot lawsuit revealed — and what your program needs.Mon, 20 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-19-ai-model-validation-best-practices-generative-ai/https://risktemplate.com/blog/2026-04-19-ai-model-validation-best-practices-generative-ai/Traditional SR 11-7 validation breaks with generative AI. Learn why deterministic testing fails for LLMs and what new validation approaches financial services firms actually need.Sun, 19 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-19-bitcoin-latinum-donald-basile-sec-saft-fraud-insured-crypto-compliance/https://risktemplate.com/blog/2026-04-19-bitcoin-latinum-donald-basile-sec-saft-fraud-insured-crypto-compliance/SEC charges Donald Basile with $16M SAFT fraud using fake 'insured' crypto claims. What compliance teams need to know about SAFT red flags and crypto CDD.Sun, 19 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-19-contingent-funding-sources-ranking-framework/https://risktemplate.com/blog/2026-04-19-contingent-funding-sources-ranking-framework/A tiered ranking framework for the actual contingent funding sources in your CFP — speed, capacity, cost, and stigma. Documented to satisfy the 2023 Interagency Addendum's tested-access requirement.Sun, 19 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-19-sec-hidden-wealth-radio-oil-gas-fraud-outside-business-activity-compliance/https://risktemplate.com/blog/2026-04-19-sec-hidden-wealth-radio-oil-gas-fraud-outside-business-activity-compliance/Three 'advisers' used radio shows and podcasts to sell $82M in unregistered oil & gas securities — pocketing $5.7M without disclosing it. Here's the OBA and RIA compliance breakdown.Sun, 19 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-19-udaap-crypto-state-ag-enforcement-risk/https://risktemplate.com/blog/2026-04-19-udaap-crypto-state-ag-enforcement-risk/DOJ dismantled its crypto enforcement unit. State AGs filled the vacuum — with UDAP laws that don't require proof of harm. Here's what crypto compliance teams need to know.Sun, 19 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-ai-explainability-documentation-show-work-examiners/https://risktemplate.com/blog/2026-04-18-ai-explainability-documentation-show-work-examiners/The model risk framework just changed. OCC 2026-13 is principles-based, GenAI is excluded, and CFPB still demands specific adverse action reasons. Here's what your explainability documentation package needs.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-building-compliance-management-system-cfpb-exam/https://risktemplate.com/blog/2026-04-18-building-compliance-management-system-cfpb-exam/The CFPB's Compliance Management Review evaluates four components — Board Oversight, Compliance Program, Consumer Complaint Response, and Compliance Audit. Here's how to build a CMS that functions every day, not just for exam prep.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-fintech-consumer-compliance-roadmap-tila-glba-state-licensing/https://risktemplate.com/blog/2026-04-18-fintech-consumer-compliance-roadmap-tila-glba-state-licensing/Fintechs face a layered consumer compliance stack — TILA disclosures, GLBA Safeguards Rule, ECOA adverse action notices, and state-by-state money transmitter licensing. Here's how to sequence the build and what each layer actually requires.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-liquidity-stress-testing-cfp-scenarios-methodology/https://risktemplate.com/blog/2026-04-18-liquidity-stress-testing-cfp-scenarios-methodology/Stress testing scenarios that examiners actually accept — idiosyncratic, market-wide, and combined shocks. How to defend your assumptions and integrate results back into your CFP.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-occ-bulletin-2011-12-sr-11-7-rescinded-new-model-risk-guidance-2026/https://risktemplate.com/blog/2026-04-18-occ-bulletin-2011-12-sr-11-7-rescinded-new-model-risk-guidance-2026/The 15-year model risk framework is gone. OCC 2026-13 and SR 26-2 replace it with tailored, risk-based principles. What changed, what was dropped, and what to do now.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-operational-resilience-bia-impact-tolerances-vs-rto/https://risktemplate.com/blog/2026-04-18-operational-resilience-bia-impact-tolerances-vs-rto/Traditional BIA produces RTOs. Operational resilience requires impact tolerances. They're different questions with different methodology — here's how to update your BIA process.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-18-scattered-spider-tyler-buchanan-guilty-plea-sms-phishing-lessons/https://risktemplate.com/blog/2026-04-18-scattered-spider-tyler-buchanan-guilty-plea-sms-phishing-lessons/Tyler Buchanan's April 2026 guilty plea exposes Scattered Spider's exact attack chain. What every risk and compliance team needs to check after this conviction.Sat, 18 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-17-contingency-funding-plan-template-components-exam/https://risktemplate.com/blog/2026-04-17-contingency-funding-plan-template-components-exam/Walk through each component of a Contingency Funding Plan from the examiner's perspective. What OCC, FDIC, and Federal Reserve teams actually flag — and how to fix gaps before the exam.Fri, 17 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-17-nist-ai-rmf-govern-function-ai-risk-culture-accountability-inventory/https://risktemplate.com/blog/2026-04-17-nist-ai-rmf-govern-function-ai-risk-culture-accountability-inventory/The GOVERN function is the foundation of NIST AI RMF compliance. Learn what GV-1 through GV-6 actually require and how financial institutions are implementing AI accountability structures.Fri, 17 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-17-occ-federal-savings-bank-va-loan-deceptive-advertising-veterans-consent-order/https://risktemplate.com/blog/2026-04-17-occ-federal-savings-bank-va-loan-deceptive-advertising-veterans-consent-order/The Federal Savings Bank hit with OCC consent order after sending millions of deceptive mailers to veterans falsely claiming 'available funds.' Here's what the UDAP failure means for your consumer compliance program.Fri, 17 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-17-reg-e-efta-crypto-compliance-stablecoin-genius-act/https://risktemplate.com/blog/2026-04-17-reg-e-efta-crypto-compliance-stablecoin-genius-act/The CFPB tried to extend Reg E to crypto, then withdrew it. The GENIUS Act left a consumer protection gap. Now state AGs are filling the void. Here's what crypto and stablecoin platforms need to do.Fri, 17 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-17-sec-nambiar-spartan-trading-ponzi-telegram-indian-american-fraud/https://risktemplate.com/blog/2026-04-17-sec-nambiar-spartan-trading-ponzi-telegram-indian-american-fraud/SEC charges Sudheesh Nambiar with a $43M Ponzi scheme defrauding 400+ Indian American investors through fabricated statements and Telegram chatrooms.Fri, 17 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-16-bnpl-compliance-cfpb-rule-rescission-consumer-obligations/https://risktemplate.com/blog/2026-04-16-bnpl-compliance-cfpb-rule-rescission-consumer-obligations/The CFPB rescinded its BNPL interpretive rule in May 2025 — but TILA, UDAP, state laws, and the New York BNPL Act still apply. Here's what compliance teams can't ignore.Thu, 16 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-16-fincen-bsa-whistleblower-program-proposed-rule-compliance-implications/https://risktemplate.com/blog/2026-04-16-fincen-bsa-whistleblower-program-proposed-rule-compliance-implications/FinCEN's proposed BSA whistleblower rule offers 10-30% of penalties over $1M. Compliance professionals get a 120-day waiting period before they can report externally.Thu, 16 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-16-genius-act-stablecoin-aml-fincen-ofac-ppsi-proposed-rule/https://risktemplate.com/blog/2026-04-16-genius-act-stablecoin-aml-fincen-ofac-ppsi-proposed-rule/The GENIUS Act's AML proposed rule imposes SAR filing, CDD, and sanctions compliance on payment stablecoin issuers. Compliance teams have until January 2027.Thu, 16 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-16-third-party-dependencies-bia-how-deep/https://risktemplate.com/blog/2026-04-16-third-party-dependencies-bia-how-deep/When mapping third-party dependencies in your BIA, one tier isn't enough for critical functions. Here's how to scope the analysis — and where going deeper actually matters.Thu, 16 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-15-bia-fintech-saas-cloud-api-dependencies/https://risktemplate.com/blog/2026-04-15-bia-fintech-saas-cloud-api-dependencies/Most fintech BIAs skip the part that matters most: the cloud platforms and third-party APIs your entire business runs on. Here's how to map those dependencies correctly — and what your bank partners will ask about them.Wed, 15 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-15-business-impact-analysis-banks-ffiec-requirements/https://risktemplate.com/blog/2026-04-15-business-impact-analysis-banks-ffiec-requirements/What the FFIEC BCM booklet actually requires in your BIA — critical function identification, interdependency analysis, recovery objectives, and what Appendix A examiners test at your next IT exam.Wed, 15 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-15-fair-lending-compliance-2026-state-ag-enforcement/https://risktemplate.com/blog/2026-04-15-fair-lending-compliance-2026-state-ag-enforcement/The CFPB closed disparate impact investigations and federal examiners stopped looking. State AGs didn't. Here's what your fair lending program needs to do now.Wed, 15 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-15-nist-ai-600-1-generative-ai-profile-12-risk-categories/https://risktemplate.com/blog/2026-04-15-nist-ai-600-1-generative-ai-profile-12-risk-categories/NIST AI 600-1 defines 12 GenAI-specific risk categories and 200+ controls. Here's what financial services teams need before examiners start asking.Wed, 15 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-15-sec-spartan-trading-ponzi-estate-enforcement-investment-adviser/https://risktemplate.com/blog/2026-04-15-sec-spartan-trading-ponzi-estate-enforcement-investment-adviser/The SEC is still pursuing the Spartan Trading Company fraud case in 2026 — years after the principals died in a murder-suicide. Here's what investment advisers need to know.Wed, 15 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-14-ai-fair-lending-udaap-risk-algorithmic-decisioning/https://risktemplate.com/blog/2026-04-14-ai-fair-lending-udaap-risk-algorithmic-decisioning/CFPB's UDAAP-as-discrimination gambit was vacated, but adverse action notice requirements still bite. Here's what AI lenders actually owe consumers in 2026.Tue, 14 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-14-bia-data-collection-surveys-interviews-workshops/https://risktemplate.com/blog/2026-04-14-bia-data-collection-surveys-interviews-workshops/The method you choose for BIA data collection determines whether your RTOs reflect operational reality or wishful thinking. A practitioner's guide to surveys, interviews, and workshops — when each method works, where each fails, and how to combine them.Tue, 14 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-14-doj-national-fraud-enforcement-division-compliance-implications/https://risktemplate.com/blog/2026-04-14-doj-national-fraud-enforcement-division-compliance-implications/The DOJ's NFED consolidates healthcare fraud, tax, and market fraud units under one command. Here's what changes for compliance officers and risk managers.Tue, 14 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-14-how-to-present-bia-findings-to-the-board-executive-summary/https://risktemplate.com/blog/2026-04-14-how-to-present-bia-findings-to-the-board-executive-summary/A 47-page BIA full of RTOs and dependency tables won't get board buy-in for BCP investment. Here's how to translate BIA findings into an executive summary that drives decisions and satisfies FFIEC board reporting requirements.Tue, 14 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-14-third-party-ai-vendor-risk-assessment-due-diligence-questionnaire/https://risktemplate.com/blog/2026-04-14-third-party-ai-vendor-risk-assessment-due-diligence-questionnaire/A third-party AI vendor risk questionnaire for financial services: model documentation, data use, bias controls, monitoring, incident response, and evidence.Tue, 14 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-cfpb-new-administration-changes-what-still-matters/https://risktemplate.com/blog/2026-04-13-cfpb-new-administration-changes-what-still-matters/The CFPB fired its director, dropped 40+ enforcement actions, and withdrew nearly 70 guidance documents. Here's what actually changed — and what compliance obligations remain regardless.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-common-regulatory-exam-findings-ai-deficiencies-fixes/https://risktemplate.com/blog/2026-04-13-common-regulatory-exam-findings-ai-deficiencies-fixes/These are the AI governance deficiencies regulators are actually finding in exams — incomplete model inventories, missing validation records, unmanaged vendor AI — and what to do about each one.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-consumer-complaint-management-program-cfpb-exam-manual/https://risktemplate.com/blog/2026-04-13-consumer-complaint-management-program-cfpb-exam-manual/CFPB examiners don't just check whether you respond to complaints — they evaluate your entire complaint management infrastructure. Here's exactly what the exam manual requires and where programs typically fall short.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-identifying-critical-business-functions-scoring-framework/https://risktemplate.com/blog/2026-04-13-identifying-critical-business-functions-scoring-framework/A step-by-step scoring methodology for identifying and tiering critical business functions in your BIA — with impact dimensions, scoring criteria, and real financial services examples.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-iran-crypto-sanctions-risk-strait-of-hormuz/https://risktemplate.com/blog/2026-04-13-iran-crypto-sanctions-risk-strait-of-hormuz/Iran demanding crypto tolls at the Strait of Hormuz exposes massive sanctions risk for banks, shipping companies, and crypto exchanges. Here's what compliance teams need to do now.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-setting-rto-rpo-quantify-defend-recovery-objectives/https://risktemplate.com/blog/2026-04-13-setting-rto-rpo-quantify-defend-recovery-objectives/How to derive RTO and RPO from real BIA data, set defensible numbers using the MTD hierarchy, and pass FFIEC examiner scrutiny on recovery objective methodology.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-13-sr-11-7-ai-systems-applying-model-risk-guidance-llms/https://risktemplate.com/blog/2026-04-13-sr-11-7-ai-systems-applying-model-risk-guidance-llms/How to actually implement SR 11-7 for LLMs: model inventory, governance ownership, documentation standards, and validation scope for in-house and vendor AI.Mon, 13 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-12-ai-governance-program-checklist-regulators-test/https://risktemplate.com/blog/2026-04-12-ai-governance-program-checklist-regulators-test/When examiners evaluate your AI governance program, they're checking specific items. Here's the complete checklist — mapped to SR 11-7, OCC guidance, and the GAO's 2025 findings.Sun, 12 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-12-udaap-risk-assessment-product-review-framework/https://risktemplate.com/blog/2026-04-12-udaap-risk-assessment-product-review-framework/UDAAP exam findings still happen even when the CFPB is pulling back. Here's how to conduct a real UDAAP product risk assessment across all three prongs.Sun, 12 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-11-ccpa-cpra-enforcement-2025-cppa-california-privacy-actions/https://risktemplate.com/blog/2026-04-11-ccpa-cpra-enforcement-2025-cppa-california-privacy-actions/The CPPA issued over $2.3 million in fines across multiple enforcement actions in 2025. Here's exactly what they found, what the common violation patterns are, and what compliance teams need to fix before they're next.Sat, 11 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-11-doj-erc-fraud-goode-mccoy-sentencing-compliance-lessons/https://risktemplate.com/blog/2026-04-11-doj-erc-fraud-goode-mccoy-sentencing-compliance-lessons/A Las Vegas business owner just got 54 months in prison for filing 1,227 fraudulent ERC returns. If your company claimed the credit, here's what to do now.Sat, 11 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-11-fincen-aml-cft-proposed-rule-bsa-program-reform/https://risktemplate.com/blog/2026-04-11-fincen-aml-cft-proposed-rule-bsa-program-reform/FinCEN's 2026 proposed rule fundamentally reforms BSA AML/CFT program requirements—shifting from paperwork to effectiveness. Here's what changes and what to do now.Sat, 11 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-11-how-to-conduct-business-impact-analysis-step-by-step/https://risktemplate.com/blog/2026-04-11-how-to-conduct-business-impact-analysis-step-by-step/A practitioner's guide to running a business impact analysis that satisfies FFIEC examiners and ISO 22301 requirements—from scoping and data collection through RTO/RPO setting, dependency mapping, and board reporting.Sat, 11 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-11-llm-model-risk-assessment-mrm-teams-testing/https://risktemplate.com/blog/2026-04-11-llm-model-risk-assessment-mrm-teams-testing/SR 11-7 wasn't written for language models. Here's what model risk management teams actually need to test for LLMs and generative AI—hallucination evaluation, red-teaming, adversarial testing, and continuous drift monitoring.Sat, 11 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-11-regulatory-change-management-program-compliance-fintech/https://risktemplate.com/blog/2026-04-11-regulatory-change-management-program-compliance-fintech/92% of compliance professionals say their role has become harder, and 77% still track regulatory changes manually. Here's how to build a program that closes the gap between when rules take effect and when your policies reflect them.Sat, 11 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-ai-business-continuity-plan-ai-system-failures-model-risk/https://risktemplate.com/blog/2026-04-10-ai-business-continuity-plan-ai-system-failures-model-risk/AI systems fail differently than traditional IT. Here's how to build AI failure scenarios into your BCP, set recovery objectives for models, and satisfy emerging regulatory requirements on AI resilience.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-annual-bcp-testing-calendar-schedule-track-continuity-exercises/https://risktemplate.com/blog/2026-04-10-annual-bcp-testing-calendar-schedule-track-continuity-exercises/Build an annual BCP testing calendar that satisfies FFIEC, ISO 22301, and NCUA examiners. Covers exercise types, scheduling by function criticality, tracking, and how to handle mid-year changes.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-doj-assuredpartners-apsf-aca-enrollment-fraud-160-million/https://risktemplate.com/blog/2026-04-10-doj-assuredpartners-apsf-aca-enrollment-fraud-160-million/DOJ's $160M resolution with AssuredPartners and APSF for ACA enrollment fraud shows exactly what happens when broker compliance programs ignore third-party marketer risk.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-dora-third-party-ict-risk-contracts-concentration-critical-providers/https://risktemplate.com/blog/2026-04-10-dora-third-party-ict-risk-contracts-concentration-critical-providers/DORA went live January 17, 2025. If your ICT vendor contracts haven't been updated, your Register of Information isn't filed, and you haven't mapped your concentration risk — here's exactly what needs to happen.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-occ-fdic-reputation-risk-final-rule-bank-supervision/https://risktemplate.com/blog/2026-04-10-occ-fdic-reputation-risk-final-rule-bank-supervision/The OCC and FDIC finalized a rule prohibiting examiners from using 'reputation risk' in supervision, effective June 9, 2026. What bank compliance teams need to update now.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-sec-cybersecurity-disclosure-rule-8k-materiality-enforcement/https://risktemplate.com/blog/2026-04-10-sec-cybersecurity-disclosure-rule-8k-materiality-enforcement/Flagstar said it had 'no evidence of unauthorized access.' The SEC disagreed. A practical breakdown of Form 8-K Item 1.05, how to build a defensible materiality determination process, and what early enforcement actions reveal about where companies are getting it wrong.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-sec-fy2025-enforcement-report-priorities-shift/https://risktemplate.com/blog/2026-04-10-sec-fy2025-enforcement-report-priorities-shift/SEC filed just 456 enforcement actions in FY2025—fewest in two decades. Here's what compliance officers must know about the SEC's priorities shift.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-10-supply-chain-business-continuity-lessons-covid-suez-chip-shortage/https://risktemplate.com/blog/2026-04-10-supply-chain-business-continuity-lessons-covid-suez-chip-shortage/Supply chain disruptions expose BCP gaps faster than almost any other event. COVID, the Suez blockage, and the chip shortage showed exactly where plans failed. Here's how to fix yours.Fri, 10 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-09-after-action-report-bcp-exercise-template/https://risktemplate.com/blog/2026-04-09-after-action-report-bcp-exercise-template/A practical after-action report template for BCP tabletop exercises. Covers the hot wash, finding format, corrective action tracking, and what FFIEC and ISO 22301 require.Thu, 09 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-09-business-continuity-maturity-model-measure-improve-program/https://risktemplate.com/blog/2026-04-09-business-continuity-maturity-model-measure-improve-program/A practical guide to the Business Continuity Maturity Model (BCMM). Learn the 5 maturity levels, how to self-assess your program, and how to prioritize improvements.Thu, 09 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-09-business-continuity-remote-hybrid-workforce/https://risktemplate.com/blog/2026-04-09-business-continuity-remote-hybrid-workforce/COVID forced every BCP program to confront a reality most hadn't planned for: running critical operations with 80% of your team working from kitchen tables. Five years later, hybrid work is the permanent baseline — and most BCPs still haven't caught up.Thu, 09 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-09-cyber-resilience-business-continuity-unified-response-framework/https://risktemplate.com/blog/2026-04-09-cyber-resilience-business-continuity-unified-response-framework/Most organizations run cyber incident response and BCP as separate programs — and that gap showed up badly in Change Healthcare, MOVEit, and dozens of other major ransomware events. Here's how to build a unified framework that actually works.Thu, 09 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-08-10-tabletop-exercise-scenarios-business-continuity/https://risktemplate.com/blog/2026-04-08-10-tabletop-exercise-scenarios-business-continuity/Most business continuity plans fail not because they're wrong, but because they've never been tested. Here are 10 tabletop exercise scenarios — with facilitator guidance — to stress-test your plan before a real incident does.Wed, 08 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-08-business-continuity-banks-credit-unions-occ-ncua-examination/https://risktemplate.com/blog/2026-04-08-business-continuity-banks-credit-unions-occ-ncua-examination/OCC and NCUA examiners don't just check if you have a BCP — they test whether it actually works. Here's what national banks and credit unions need to meet regulatory expectations and avoid exam findings.Wed, 08 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-08-business-continuity-plan-small-business-guide/https://risktemplate.com/blog/2026-04-08-business-continuity-plan-small-business-guide/Small businesses don't need a 200-page BCP. Here's a minimum viable framework covering OSHA, SBA, and HIPAA requirements — built for teams of 1-50.Wed, 08 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-08-business-continuity-saas-companies-uptime-sla-cloud-dr/https://risktemplate.com/blog/2026-04-08-business-continuity-saas-companies-uptime-sla-cloud-dr/SaaS companies have two BC obligations: protecting their own operations and surviving as the vendor when their customers' examiners come calling. Here's how to build a program that covers both.Wed, 08 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-08-how-to-test-contingency-funding-plan-tabletop-exercises/https://risktemplate.com/blog/2026-04-08-how-to-test-contingency-funding-plan-tabletop-exercises/SVB hadn't tested its discount window access since 2022. Learn how to design CFP tabletop exercises, stress scenarios, and simulation drills that satisfy OCC, FFIEC, and FINRA examiners.Wed, 08 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-08-svb-signature-bank-liquidity-failures-cfp-lessons/https://risktemplate.com/blog/2026-04-08-svb-signature-bank-liquidity-failures-cfp-lessons/SVB's own stress tests predicted its failure eight months early. Management changed the assumptions instead of fixing the balance sheet. Here's what the 2023 bank failures reveal about CFP design, testing, and governance — and what regulators now expect from every institution.Wed, 08 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-business-continuity-plan-healthcare-hipaa-patient-safety/https://risktemplate.com/blog/2026-04-07-business-continuity-plan-healthcare-hipaa-patient-safety/Healthcare BCP isn't just about uptime — it's about patient safety. Here's what HIPAA, CMS, and The Joint Commission actually require, and how to build a continuity plan that survives an OCR audit.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-cfp-governance-roles-responsibilities-board-reporting/https://risktemplate.com/blog/2026-04-07-cfp-governance-roles-responsibilities-board-reporting/Most contingency funding plans fail in execution, not design. The reason is almost always governance — unclear ownership, no board-level accountability, and triggers that nobody has authority to pull. Here's how to build a CFP governance structure regulators can actually examine.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-early-warning-indicators-liquidity-stress/https://risktemplate.com/blog/2026-04-07-early-warning-indicators-liquidity-stress/Build a practical EWI framework for liquidity stress monitoring. Covers the indicators regulators expect, how to set escalation thresholds, and the governance structure to act on signals before they become crises.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-fincen-canaccord-genuity-bsa-aml-record-penalty-broker-dealer/https://risktemplate.com/blog/2026-04-07-fincen-canaccord-genuity-bsa-aml-record-penalty-broker-dealer/FinCEN hit Canaccord Genuity with the largest-ever BSA penalty against a broker-dealer — $80M, coordinated with SEC and FINRA for $120M total. Here's what failed and what to fix now.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-identifying-prioritizing-contingent-funding-sources/https://risktemplate.com/blog/2026-04-07-identifying-prioritizing-contingent-funding-sources/Not all contingent funding sources are created equal. Here's how to rank your backup liquidity options by reliability, cost, and access speed — before you actually need them.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-iso-22301-documentation-requirements/https://risktemplate.com/blog/2026-04-07-iso-22301-documentation-requirements/ISO 22301:2019 mandates specific documented information across Clauses 4-10. Here's the complete list of required policies, procedures, and records — and what auditors actually check.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-07-iso-22301-gap-analysis-template-bcms-maturity/https://risktemplate.com/blog/2026-04-07-iso-22301-gap-analysis-template-bcms-maturity/ISO 22301 gap analysis maps where your BCMS falls short clause by clause. Use this template and scoring guide to assess maturity and prioritize before your certification audit.Tue, 07 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-06-common-cfp-exam-findings-deficiencies-regulators-flag/https://risktemplate.com/blog/2026-04-06-common-cfp-exam-findings-deficiencies-regulators-flag/The OCC, FDIC, and Fed repeatedly flag the same CFP deficiencies across examination cycles. Here's exactly what they find, why SVB is the case study, and what remediation actually looks like.Mon, 06 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-06-how-to-build-contingency-funding-plan-framework/https://risktemplate.com/blog/2026-04-06-how-to-build-contingency-funding-plan-framework/Learn how to create a robust contingency funding plan (CFP) for your financial institution with our step-by-step framework, covering regulatory requirements and best practices for liquidity risk management.Mon, 06 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-06-iso-22301-internal-audit-checklist-bcms-audit/https://risktemplate.com/blog/2026-04-06-iso-22301-internal-audit-checklist-bcms-audit/ISO 22301 Clause 9.2 requires documented internal audits at planned intervals. Use this clause-by-clause checklist to find gaps before your external auditor does.Mon, 06 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-06-liquidity-stress-testing-cfp-scenarios-assumptions-methodology/https://risktemplate.com/blog/2026-04-06-liquidity-stress-testing-cfp-scenarios-assumptions-methodology/Build a defensible CFP liquidity stress test: three required scenarios, assumption documentation, survival horizon metrics, and lessons from SVB's $18B 30-day deficit.Mon, 06 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-06-occ-rescinds-recovery-planning-guidelines-large-banks/https://risktemplate.com/blog/2026-04-06-occ-rescinds-recovery-planning-guidelines-large-banks/The OCC rescinded 12 CFR 30 Appendix E, eliminating mandatory recovery planning for $100B+ banks effective May 1, 2026. Here's what that means for your program.Mon, 06 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-06-operational-resilience-vs-business-continuity-regulatory-shift/https://risktemplate.com/blog/2026-04-06-operational-resilience-vs-business-continuity-regulatory-shift/Three major global regulatory frameworks — BCBS 2021, UK PS6/21, and EU DORA — have redefined business continuity into something practitioners barely recognize. Here's what changed and what it means for your program.Mon, 06 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-05-bia-it-systems-technology-dependency-mapping/https://risktemplate.com/blog/2026-04-05-bia-it-systems-technology-dependency-mapping/Most BIAs skip IT dependency mapping entirely — or treat it as an afterthought. Here's how to build the technology layer that makes your BIA actually useful for recovery planning.Sun, 05 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-05-bia-scoring-prioritization-methodology/https://risktemplate.com/blog/2026-04-05-bia-scoring-prioritization-methodology/A practical BIA scoring methodology for financial services. Score impact across 4 dimensions, assign criticality tiers, and set defensible RTO targets.Sun, 05 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-05-contingency-funding-plan-template-key-components/https://risktemplate.com/blog/2026-04-05-contingency-funding-plan-template-key-components/A contingency funding plan that sits in a drawer fails the moment you need it. Here are the components OCC, Fed, and FDIC examiners actually check — and how to build a CFP that survives both a liquidity event and a regulatory exam.Sun, 05 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-05-contingency-funding-plan-vs-business-continuity-plan/https://risktemplate.com/blog/2026-04-05-contingency-funding-plan-vs-business-continuity-plan/CFP and BCP sound similar but serve completely different functions. Here's how to tell them apart, who owns each, and when both trigger at the same time.Sun, 05 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-05-finra-proposed-rule-4610-broker-dealer-liquidity-risk-management/https://risktemplate.com/blog/2026-04-05-finra-proposed-rule-4610-broker-dealer-liquidity-risk-management/FINRA's proposed Rule 4610 would impose liquidity risk management requirements on about 125 broker-dealers. Here's what the rule covers, the controversial 'rebuttable presumption' conditions, and what firms should be doing now.Sun, 05 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-05-how-often-update-bia-maintenance-review-schedule/https://risktemplate.com/blog/2026-04-05-how-often-update-bia-maintenance-review-schedule/Your BIA isn't a one-time project. Learn FFIEC and ISO 22301 requirements for BIA review frequency, which triggers mandate an update, and how to build a defensible maintenance schedule.Sun, 05 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-04-ag-morgan-vincent-camarda-160-million-investment-adviser-fraud/https://risktemplate.com/blog/2026-04-04-ag-morgan-vincent-camarda-160-million-investment-adviser-fraud/Vincent Camarda of A.G. Morgan Financial Advisors pleaded guilty to $160M investment fraud. Here's what went wrong and the compliance red flags every firm should watch for.Sat, 04 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-04-ai-consequential-decision-making-compliance/https://risktemplate.com/blog/2026-04-04-ai-consequential-decision-making-compliance/How state and federal regulators define consequential AI decisions — and what compliance teams must do before January 2027 to avoid enforcement.Sat, 04 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-04-ai-consumer-data-rights-privacy-laws/https://risktemplate.com/blog/2026-04-04-ai-consumer-data-rights-privacy-laws/How consumer data rights like deletion, opt-out, and access apply when businesses use AI for automated decisions — mapped across CCPA, Colorado, Virginia, and 17 other state laws.Sat, 04 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-04-ai-model-validation-testing-techniques-ml-llm/https://risktemplate.com/blog/2026-04-04-ai-model-validation-testing-techniques-ml-llm/A practitioner's guide to ai model validation techniques that satisfy OCC SR 11-7, FFIEC, and CFPB requirements for ML and LLM models in financial services.Sat, 04 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-04-bia-vs-risk-assessment-difference-guide/https://risktemplate.com/blog/2026-04-04-bia-vs-risk-assessment-difference-guide/Business impact analysis vs risk assessment — learn the key differences, when to use each, and how to integrate both into your BCM program.Sat, 04 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-04-contingency-funding-plan-regulatory-requirements-finra-occ/https://risktemplate.com/blog/2026-04-04-contingency-funding-plan-regulatory-requirements-finra-occ/Contingency funding plan requirements vary by regulator, but most banks and larger credit unions need a CFP now. Here’s what OCC, Fed, FDIC, NCUA, and FINRA expect.Sat, 04 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-ai-training-data-governance-compliance/https://risktemplate.com/blog/2026-04-03-ai-training-data-governance-compliance/How to build an AI training data governance program that covers data quality, consent, provenance tracking, and regulatory compliance for financial services.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-doj-advanced-urology-14-million-false-claims-act-settlement/https://risktemplate.com/blog/2026-04-03-doj-advanced-urology-14-million-false-claims-act-settlement/Advanced Urology and Dr. Jitesh Patel will pay $14M to settle DOJ allegations of fraudulent billing and unnecessary procedures. Key compliance takeaways inside.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-illinois-ai-video-interview-act-compliance/https://risktemplate.com/blog/2026-04-03-illinois-ai-video-interview-act-compliance/Using HireVue or AI screening in Illinois? HB 3773 just expanded your obligations. A federal court ruled BIPA and AIVICA apply simultaneously — here's what that means for your consent flow, notice requirements, and litigation exposure.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-nyc-local-law-144-ai-bias-audit-requirements/https://risktemplate.com/blog/2026-04-03-nyc-local-law-144-ai-bias-audit-requirements/NYC Local Law 144 requires annual bias audits for AI hiring tools. Learn AEDT requirements, penalties, audit process, and what the Comptroller's enforcement review means for 2026.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-pii-handling-ai-llm-systems-compliance/https://risktemplate.com/blog/2026-04-03-pii-handling-ai-llm-systems-compliance/Practical guide to detecting, protecting, and managing PII in LLM systems — covering GLBA, CCPA, de-identification, and vendor contract requirements.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-sec-camarda-mcarthur-ag-morgan-160m-fraud/https://risktemplate.com/blog/2026-04-03-sec-camarda-mcarthur-ag-morgan-160m-fraud/Vincent Camarda of A.G. Morgan Financial Advisors pleads guilty to defrauding 400+ clients of $160M. What compliance professionals need to know about this investment adviser fraud case.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-state-ai-laws-tracker-2026-us-regulations/https://risktemplate.com/blog/2026-04-03-state-ai-laws-tracker-2026-us-regulations/45 states have introduced 1,561 AI bills in 2026 — already surpassing 2024's full-year total. Colorado, Texas, and California are the three to watch. Every enacted state AI law, organized by what your compliance team actually needs to do.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-03-what-is-a-contingency-funding-plan-guide/https://risktemplate.com/blog/2026-04-03-what-is-a-contingency-funding-plan-guide/A contingency funding plan (CFP) maps how your institution survives a liquidity crisis. Learn what a CFP is, who needs one, key components, and regulatory requirements.Fri, 03 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-02-ai-model-kill-switch-shutdown-controls/https://risktemplate.com/blog/2026-04-02-ai-model-kill-switch-shutdown-controls/Your AI model is making bad decisions in production. Do you have a documented shutdown plan? Most banks don't. Here's the kill switch framework examiners expect — decision criteria, authority matrix, fallback ops, and what the EU AI Act requires.Thu, 02 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-02-ai-model-monitoring-drift-detection-guide/https://risktemplate.com/blog/2026-04-02-ai-model-monitoring-drift-detection-guide/How to structure AI model monitoring: drift detection, performance thresholds, fairness checks, KRIs, alert owners, and governance evidence.Thu, 02 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-02-ai-operational-resilience-financial-services/https://risktemplate.com/blog/2026-04-02-ai-operational-resilience-financial-services/How to build AI operational resilience for financial services — dependency mapping, vendor concentration risk, BCP planning, and tabletop exercises for AI failures.Thu, 02 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-02-deepfake-detection-controls-financial-services/https://risktemplate.com/blog/2026-04-02-deepfake-detection-controls-financial-services/How financial institutions can detect and defend against deepfake fraud — from voice cloning scams to KYC bypass attacks. Practical controls, FinCEN red flags, and detection tech.Thu, 02 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-02-sec-pe-capital-prisno-unauthorized-fees-fiduciary-fraud/https://risktemplate.com/blog/2026-04-02-sec-pe-capital-prisno-unauthorized-fees-fiduciary-fraud/The SEC settled with Chicago-based P/E Capital and CEO Eliseo Prisno for charging 200+ clients $2.4M in undisclosed fees — including hijacking client login credentials to approve charges.Thu, 02 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-01-algorithmic-fairness-audit-compliance-guide/https://risktemplate.com/blog/2026-04-01-algorithmic-fairness-audit-compliance-guide/NYC LL 144 already requires annual bias audits — and a 2025 Comptroller report found most companies aren't complying. Colorado SB 205 hits January 2027. Here's the full audit lifecycle: scoping, testing methods, remediation, and documentation.Wed, 01 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-01-disparate-impact-testing-ai-lending-models/https://risktemplate.com/blog/2026-04-01-disparate-impact-testing-ai-lending-models/How to document disparate impact testing for AI lending models: data, metrics, controls, adverse action review, and compliance evidence.Wed, 01 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-01-occ-model-risk-management-ai-bulletin-2011-12/https://risktemplate.com/blog/2026-04-01-occ-model-risk-management-ai-bulletin-2011-12/A practical AI model risk management checklist for financial services: model inventory, validation evidence, monitoring, governance, and vendor AI controls.Wed, 01 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-01-prompt-injection-risk-compliance-financial-services/https://risktemplate.com/blog/2026-04-01-prompt-injection-risk-compliance-financial-services/OWASP ranks prompt injection #1 on their LLM Top 10. Gartner predicts 50%+ of successful AI attacks will use it through 2029. If your firm deploys any LLM, here are the four controls you need before the first incident — not after.Wed, 01 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-01-sec-charges-fullenkamp-sand-penny-stock-fraud/https://risktemplate.com/blog/2026-04-01-sec-charges-fullenkamp-sand-penny-stock-fraud/The SEC filed fraud charges against Jon Fullenkamp and Scott Sand for misappropriating millions through sham agreements and fraudulent preferred share issuances at two penny stock companies.Wed, 01 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-04-01-threat-modeling-agentic-payments-risk-framework/https://risktemplate.com/blog/2026-04-01-threat-modeling-agentic-payments-risk-framework/AI agents can now initiate payments autonomously. Your existing fraud controls were built for humans. Here's the threat model and control framework fintechs need now.Wed, 01 Apr 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-31-ai-model-risk-tiering-classification-guide/https://risktemplate.com/blog/2026-03-31-ai-model-risk-tiering-classification-guide/Build an AI model risk tiering methodology that accounts for autonomy, explainability, and data sensitivity. Includes a decision-tree framework and tier-specific oversight requirements.Tue, 31 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-31-bia-questionnaire-template-50-questions/https://risktemplate.com/blog/2026-03-31-bia-questionnaire-template-50-questions/A complete business impact analysis questionnaire template with 50 questions across 10 categories. Based on FFIEC, NIST SP 800-34, and ISO 22301 guidance.Tue, 31 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-31-iso-22301-certification-cost-timeline-roadmap/https://risktemplate.com/blog/2026-03-31-iso-22301-certification-cost-timeline-roadmap/ISO 22301 certification costs $15K-$60K+ depending on org size. Get realistic timelines, a month-by-month implementation roadmap, and tips to avoid common pitfalls.Tue, 31 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-31-iso-22301-vs-iso-27001-comparison-guide/https://risktemplate.com/blog/2026-03-31-iso-22301-vs-iso-27001-comparison-guide/ISO 22301 vs ISO 27001 compared side-by-side: scope, controls, certification process, and whether you need one, both, or neither.Tue, 31 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-31-sec-titanium-capital-henry-abdo-ponzi-scheme-fraud/https://risktemplate.com/blog/2026-03-31-sec-titanium-capital-henry-abdo-ponzi-scheme-fraud/The SEC secured final judgments against Titanium Capital LLC and founder Henry Abdo for a Ponzi scheme that defrauded 162 investors of $5.3 million. Here's what happened and what compliance teams should learn.Tue, 31 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-30-ai-explainability-requirements-financial-services/https://risktemplate.com/blog/2026-03-30-ai-explainability-requirements-financial-services/How to meet AI explainability requirements from the OCC, Fed, CFPB, and EU AI Act — with practical techniques for every model type.Mon, 30 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-30-ai-impact-assessment-guide-template/https://risktemplate.com/blog/2026-03-30-ai-impact-assessment-guide-template/AI impact assessments are now required under Colorado SB 205 and the EU AI Act. Learn who needs one, what to include, and how to build the process.Mon, 30 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-30-ai-model-documentation-requirements-examiners/https://risktemplate.com/blog/2026-03-30-ai-model-documentation-requirements-examiners/Map SR 11-7 and OCC 2011-12 documentation requirements to AI and ML models. Section-by-section template for model cards, training data provenance, and examiner-ready documentation.Mon, 30 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-30-sec-kenneth-welsh-wells-fargo-advisor-fraud/https://risktemplate.com/blog/2026-03-30-sec-kenneth-welsh-wells-fargo-advisor-fraud/The SEC secured a final judgment against Kenneth Welsh, a former Wells Fargo advisor who misappropriated $2.86M+ from clients over five years through 137 fraudulent transactions.Mon, 30 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-29-agentic-ai-risk-management-governance/https://risktemplate.com/blog/2026-03-29-agentic-ai-risk-management-governance/Practical governance framework for agentic AI systems. Covers new risk categories, permission models, audit trails, and the human-on-the-loop debate for financial services.Sun, 29 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-29-sec-krish-kumar-investment-fraud-lessons/https://risktemplate.com/blog/2026-03-29-sec-krish-kumar-investment-fraud-lessons/SEC charged Tulsa college student Krish Kumar with misappropriating nearly $7M from two investment funds. Here's what compliance officers at investment advisers need to know.Sun, 29 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-28-ai-bias-testing-methodologies-fair-lending/https://risktemplate.com/blog/2026-03-28-ai-bias-testing-methodologies-fair-lending/Learn the essential AI bias testing methodologies for fair lending compliance—disparate impact analysis, counterfactual fairness, calibration testing, and more—before your next exam.Sat, 28 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-28-ai-data-leakage-prevention-llm-sensitive-data/https://risktemplate.com/blog/2026-03-28-ai-data-leakage-prevention-llm-sensitive-data/Learn how to prevent AI data leakage from LLMs in financial services. Covers the 5 leakage vectors, OWASP LLM top risks, NIST controls, and a 90-day implementation roadmap.Sat, 28 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-28-generative-ai-acceptable-use-policy-template/https://risktemplate.com/blog/2026-03-28-generative-ai-acceptable-use-policy-template/Your employees are already using ChatGPT — do you have a policy? Build an AI acceptable use policy with data classification rules, prohibited uses, and tool approval workflows.Sat, 28 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-28-sec-commonwealth-financial-network-revenue-sharing-conflicts/https://risktemplate.com/blog/2026-03-28-sec-commonwealth-financial-network-revenue-sharing-conflicts/The SEC's final consent judgment against Commonwealth Financial Network for undisclosed revenue-sharing conflicts offers a critical compliance lesson: fiduciary duty means disclosing who pays you, fully.Sat, 28 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-27-ai-incident-response-plan-model-failure-playbook/https://risktemplate.com/blog/2026-03-27-ai-incident-response-plan-model-failure-playbook/How to build an AI incident response plan that covers model failures, hallucinations, bias events, and drift — with severity tiers, escalation paths, and containment controls.Fri, 27 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-27-ai-model-inventory-management-regulatory-exam/https://risktemplate.com/blog/2026-03-27-ai-model-inventory-management-regulatory-exam/Build an AI model inventory with ownership, use case, data, decision role, risk tier, vendor source, controls, monitoring, and review evidence.Fri, 27 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-27-llm-hallucination-risk-management-financial-services/https://risktemplate.com/blog/2026-03-27-llm-hallucination-risk-management-financial-services/How to detect, measure, and mitigate LLM hallucination risk in financial services — with real controls, metrics, and a regulatory-ready framework.Fri, 27 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-27-sec-284-million-municipal-bond-fraud/https://risktemplate.com/blog/2026-03-27-sec-284-million-municipal-bond-fraud/The SEC charged four individuals with fabricating documents to defraud investors in a $284 million municipal bond offering for a Mesa, Arizona sports complex. Here's what went wrong and what compliance teams can learn.Fri, 27 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-business-continuity-financial-services-regulatory-guide/https://risktemplate.com/blog/2026-03-26-business-continuity-financial-services-regulatory-guide/How financial institutions should build business continuity programs that satisfy OCC, FDIC, and Fed operational resilience expectations — with real enforcement examples and implementation guidance.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-colorado-ai-act-sb-205-compliance-guide/https://risktemplate.com/blog/2026-03-26-colorado-ai-act-sb-205-compliance-guide/Colorado SB 205 takes effect January 1, 2027. Learn who's covered, what counts as a high-risk AI system, required impact assessments, consumer notices, and your compliance checklist.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-iso-22301-business-continuity-requirements-guide/https://risktemplate.com/blog/2026-03-26-iso-22301-business-continuity-requirements-guide/Your auditor wants ISO 22301 alignment? Here's exactly what each clause requires, how it maps to FFIEC, and whether certification is actually worth the cost.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-nist-ai-rmf-1-1-changes-update-2026/https://risktemplate.com/blog/2026-03-26-nist-ai-rmf-1-1-changes-update-2026/The NIST AI RMF is in active revision as of 2026. Here's what's changing, what's staying stable, and what your AI risk program should do right now.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-sec-stuart-frost-investment-adviser-fiduciary-fraud/https://risktemplate.com/blog/2026-03-26-sec-stuart-frost-investment-adviser-fiduciary-fraud/The SEC obtained a final judgment against Stuart Frost for extracting $14M in undisclosed incubator fees from VC fund investors. Key lessons for investment adviser compliance programs in 2026.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-shadow-ai-governance-detection-controls/https://risktemplate.com/blog/2026-03-26-shadow-ai-governance-detection-controls/Shadow AI is spreading through financial services whether you know it or not. Here's how to detect it, assess the risk, and build a governance framework that actually works.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-26-sr-11-7-ai-model-risk-management-guide/https://risktemplate.com/blog/2026-03-26-sr-11-7-ai-model-risk-management-guide/SR 11-7 was written for spreadsheet models, not LLMs. Here's how each pillar of the framework must adapt for AI/ML — and where traditional MRM breaks down completely.Thu, 26 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-25-crisis-communication-plan-template-guide/https://risktemplate.com/blog/2026-03-25-crisis-communication-plan-template-guide/Build a crisis communication plan that covers customers, regulators, employees, and partners — with pre-drafted templates, escalation timelines, and real-world lessons.Wed, 25 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-25-sec-ozy-media-investor-fraud-enforcement/https://risktemplate.com/blog/2026-03-25-sec-ozy-media-investor-fraud-enforcement/SEC closes $50M Ozy Media fraud case — revenue inflated 100%, a YouTube exec impersonated on an investor call. What compliance teams must learn from this textbook failure.Wed, 25 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-25-tabletop-exercise-template-business-continuity/https://risktemplate.com/blog/2026-03-25-tabletop-exercise-template-business-continuity/Step-by-step tabletop exercise template with facilitator guide, scenario injects, and 3 ready-to-use scenarios for business continuity testing.Wed, 25 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-25-third-party-business-continuity-vendor-resilience/https://risktemplate.com/blog/2026-03-25-third-party-business-continuity-vendor-resilience/Learn how to assess vendor business continuity plans, monitor third-party resilience, and meet FFIEC requirements for vendor BCP oversight.Wed, 25 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-business-continuity-plan-template-complete-guide/https://risktemplate.com/blog/2026-03-24-business-continuity-plan-template-complete-guide/Free business continuity plan template with the 8 sections every BCP needs. Step-by-step guide for financial services teams building or rebuilding their BCP.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-business-continuity-testing-guide/https://risktemplate.com/blog/2026-03-24-business-continuity-testing-guide/How to test your BCP with tabletop exercises: scenarios, participant roles, evidence, after-action reports, and remediation tracking.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-business-continuity-vs-disaster-recovery-difference/https://risktemplate.com/blog/2026-03-24-business-continuity-vs-disaster-recovery-difference/Business continuity vs disaster recovery explained — what each covers, where they overlap, and why treating DR as your whole continuity program is a regulatory red flag.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-business-impact-analysis-template-guide/https://risktemplate.com/blog/2026-03-24-business-impact-analysis-template-guide/How to build a business impact analysis template with critical functions, impact ratings, RTO/RPO, dependencies, owners, and recovery evidence.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-disaster-recovery-plan-template-guide/https://risktemplate.com/blog/2026-03-24-disaster-recovery-plan-template-guide/Step-by-step disaster recovery plan template with recovery tiers, DR strategies, and testing schedules. Build a DRP aligned to your BIA and RTO/RPO targets.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-ffiec-business-continuity-management-requirements/https://risktemplate.com/blog/2026-03-24-ffiec-business-continuity-management-requirements/FFIEC business continuity requirements translated into BCP template fields, BIA evidence, tabletop tests, and examiner-ready documentation.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-rto-vs-rpo-recovery-objectives-guide/https://risktemplate.com/blog/2026-03-24-rto-vs-rpo-recovery-objectives-guide/RTO vs RPO explained with practical guidance on setting recovery objectives, tiering critical functions, and avoiding the mistakes that turn outages into disasters.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-24-sec-legacy-cares-284-million-municipal-bond-fraud/https://risktemplate.com/blog/2026-03-24-sec-legacy-cares-284-million-municipal-bond-fraud/The SEC's Legacy Cares case is a textbook municipal bond fraud—fabricated contracts, forged signatures, and a near-total investor wipeout. Here's what compliance practitioners need to know.Tue, 24 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-23-ai-ethics-vs-governance-framework-differences/https://risktemplate.com/blog/2026-03-23-ai-ethics-vs-governance-framework-differences/AI ethics and AI governance are not the same thing. Learn how ethics, governance, and model governance layer together — and why you need all three.Mon, 23 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-23-ai-governance-committee-roles-charter-guide/https://risktemplate.com/blog/2026-03-23-ai-governance-committee-roles-charter-guide/Build an effective AI governance committee with the right roles, a defensible charter, and a meeting cadence that actually works. Practical guide for financial services.Mon, 23 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-23-ai-oversight-who-owns-ai-risk/https://risktemplate.com/blog/2026-03-23-ai-oversight-who-owns-ai-risk/AI risk ownership is broken at most firms. Learn how to apply three lines of defense, assign accountability, and stop the 'everyone owns it' trap.Mon, 23 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-23-enterprise-ai-governance-scaling-oversight/https://risktemplate.com/blog/2026-03-23-enterprise-ai-governance-scaling-oversight/Scale AI governance across a large organization without killing innovation. Federated vs. centralized models, shadow AI controls, model inventories, and board reporting.Mon, 23 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-23-legacy-cares-municipal-bond-fraud-sec-enforcement/https://risktemplate.com/blog/2026-03-23-legacy-cares-municipal-bond-fraud-sec-enforcement/The SEC's Legacy Cares case shows how fabricated revenue documents collapsed a $284M municipal bond deal. Here's what compliance and risk teams need to know.Mon, 23 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-22-ai-compliance-framework-audit-ready-documentation/https://risktemplate.com/blog/2026-03-22-ai-compliance-framework-audit-ready-documentation/Build an AI compliance framework that survives regulatory exams. Model inventories, risk assessments, testing evidence, and documentation that proves you're compliant.Sun, 22 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-22-ai-governance-policy-template-guide/https://risktemplate.com/blog/2026-03-22-ai-governance-policy-template-guide/Build an AI governance policy that actually works. Covers scope, risk classification, approval workflows, monitoring, and exceptions — with section-by-section guidance.Sun, 22 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-22-ai-regulation-compliance-2026-requirements/https://risktemplate.com/blog/2026-03-22-ai-regulation-compliance-2026-requirements/Navigate the 2026 AI regulatory landscape — EU AI Act deadlines, state laws in Colorado, Illinois, and Texas, SEC enforcement priorities, and what compliance teams should do now.Sun, 22 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-22-nist-ai-rmf-vs-eu-ai-act-compliance-mapping/https://risktemplate.com/blog/2026-03-22-nist-ai-rmf-vs-eu-ai-act-compliance-mapping/Map the NIST AI Risk Management Framework against EU AI Act requirements. Build one AI governance program that satisfies both — with a practical crosswalk for financial services teams.Sun, 22 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-21-ai-governance-best-practices-regulated-industries/https://risktemplate.com/blog/2026-03-21-ai-governance-best-practices-regulated-industries/Tactical AI governance best practices from financial services, healthcare, and insurance. Model inventories, tiered oversight, cross-functional committees, and documentation that survives exams.Sat, 21 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-21-ai-risk-management-framework-financial-institutions/https://risktemplate.com/blog/2026-03-21-ai-risk-management-framework-financial-institutions/Build an AI risk management framework that identifies, assesses, and mitigates real AI risks. Includes risk taxonomy, tiering model, and 90-day roadmap.Sat, 21 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-21-responsible-ai-framework-principles-to-practice/https://risktemplate.com/blog/2026-03-21-responsible-ai-framework-principles-to-practice/Build a responsible AI framework that turns fairness, transparency, and accountability principles into operational controls. Includes bias testing, impact assessments, and 120-day roadmap.Sat, 21 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-21-sec-bin-hao-qidian-ponzi-chinese-american-fraud/https://risktemplate.com/blog/2026-03-21-sec-bin-hao-qidian-ponzi-chinese-american-fraud/The SEC obtained a final judgment against Bin Hao and Qidian LLC for a Ponzi scheme that targeted Chinese-American investors. Here's what compliance teams need to know about affinity fraud detection and controls.Sat, 21 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-20-ai-governance-framework-complete-guide/https://risktemplate.com/blog/2026-03-20-ai-governance-framework-complete-guide/Build an AI governance framework that actually works. 8 core components, maturity model, and 90-day implementation roadmap for risk practitioners.Fri, 20 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-20-business-continuity-plan-template-financial-services/https://risktemplate.com/blog/2026-03-20-business-continuity-plan-template-financial-services/A financial services BCP template guide covering BIA, RTO/RPO, dependency mapping, communication roles, tabletop testing, and examiner evidence.Fri, 20 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-20-nist-ai-rmf-implementation-guide/https://risktemplate.com/blog/2026-03-20-nist-ai-rmf-implementation-guide/A practical guide to implementing the NIST AI RMF across Govern, Map, Measure, and Manage — with actionable steps for financial services teams.Fri, 20 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-20-onemain-financial-13-ag-lawsuit-junk-fees-loan-packing/https://risktemplate.com/blog/2026-03-20-onemain-financial-13-ag-lawsuit-junk-fees-loan-packing/13 state AGs sued OneMain Financial for loan packing and junk fees on March 16, 2026. Here's what the case means for add-on product controls, fee disclosure, and state AG enforcement trends.Fri, 20 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-20-operational-risk-management-framework-guide/https://risktemplate.com/blog/2026-03-20-operational-risk-management-framework-guide/A practical guide to building an operational risk management framework — RCSA, KRIs, loss event tracking, and the ORM lifecycle for mid-size banks and fintechs.Fri, 20 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-20-sec-ofer-abarbanel-106-million-mutual-fund-fraud/https://risktemplate.com/blog/2026-03-20-sec-ofer-abarbanel-106-million-mutual-fund-fraud/The SEC obtained a final consent judgment ordering $106.5M in disgorgement against Ofer Abarbanel for orchestrating a mutual fund fraud scheme. Here's what happened and why it matters for fund compliance.Fri, 20 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-19-glba-overhaul-state-privacy-law-preemption/https://risktemplate.com/blog/2026-03-19-glba-overhaul-state-privacy-law-preemption/A new House bill would overhaul GLBA Title V and preempt state privacy laws for financial institutions. What practitioners need to know and do now.Thu, 19 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-19-incident-response-plan-template-fintech/https://risktemplate.com/blog/2026-03-19-incident-response-plan-template-fintech/Build a defensible incident response plan template for your fintech. Covers NIST phases, regulatory notification requirements, and what regulators actually check.Thu, 19 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-19-treasury-fs-ai-rmf-230-controls/https://risktemplate.com/blog/2026-03-19-treasury-fs-ai-rmf-230-controls/The FS AI RMF gives financial institutions 230 AI control objectives. A practical guide to prioritizing what matters and building your implementation roadmap.Thu, 19 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/2026-03-19-vendor-ai-risk-assessment-tprm/https://risktemplate.com/blog/2026-03-19-vendor-ai-risk-assessment-tprm/New survey data shows most financial institutions can't identify vendor AI use. A practical vendor AI risk assessment guide with due diligence questions and implementation roadmap.Thu, 19 Mar 2026 00:00:00 GMThttps://risktemplate.com/blog/ai-risk-assessment-framework-guide/https://risktemplate.com/blog/ai-risk-assessment-framework-guide/A comprehensive guide to identifying, assessing, and mitigating AI risks in regulated financial institutions—from model governance to third-party AI vendor oversight.Wed, 18 Mar 2026 00:00:00 GMT