Practical insights from the field — for financial services risk and compliance professionals.
Examiners don't just read your CFP — they ask for evidence that it works. Here's the complete list of documentation, test records, and artifacts that belong in a CFP evidence binder, organized by funding source and review cycle.
Most CFPs list contingent funding sources without proving they're accessible. Here's how to run fund-flow tests, build an evidence file, and show regulators that your liquidity plan actually works when it needs to.
Practical guide to CFP ownership: who drafts, who challenges, who approves. Three-lines-of-defense roles, board oversight, and what examiners expect after SR 10-6 and the 2023 addendum.
Set KRI thresholds that actually warn before risk materializes. Calibration methods, the 60-day parallel run, and how to fix dashboards stuck in alert fatigue or perpetual green.
Robert Newell raised $37M for cannabis funds and used investor money to pay earlier investors. Here's the May 2026 SEC judgment and what private-fund advisers should learn from it.
A practitioner's guide to building vendor exit strategies that satisfy OCC, FDIC, and Federal Reserve examiners — with lessons from the Synapse collapse and the six components every exit plan must cover.
The EU AI Act's Digital Omnibus deal, reached May 7, 2026, defers Annex III high-risk AI obligations from August 2, 2026 to December 2, 2027. Here's what changed, what didn't, and how financial services AI teams should use the extra 16 months.
A practitioner's guide to the federal banking agencies' computer-security incident notification rule — what triggers the 36-hour clock, the two-tier framework for banks vs. bank service providers, and the gray areas that catch incident response teams off guard.
How to build a fintech acceptable use policy that evaluates high-risk customers by actual platform use, not blunt industry labels.
A practitioner's guide to GLBA Regulation P: who must send privacy notices, what the initial and annual notice must include, when the FAST Act exception eliminates the annual requirement, and how opt-out rights actually work.
SEC settles Adani Green bond offering case for $18M, charging Gautam and Sagar Adani with materially false anti-bribery statements to US investors.
NYDFS's first 2026 cybersecurity enforcement penalizes Delta Dental for a six-month notification delay and lengthened MOVEit retention settings — not for getting hit. What practitioners should pull from the consent order.
A practitioner's guide to designing, facilitating, and defending operational risk scenario analysis — from workshop setup and expert elicitation to loss estimation and ICAAP integration.
A practitioner's guide to designing, conducting, and documenting privacy impact assessments — covering GDPR Article 35 DPIA requirements, California CPRA risk assessments (effective January 2026), and state law PIA triggers across 20+ US jurisdictions.
The SEC's May 6 complaint against 21 defendants tied to a decade-long Big Law M&A insider trading scheme is a master class in supervision failure. Here is what compliance functions should pull from the document-access trail.
Your BCP has 60 pages on recovery procedures and three paragraphs on communication. Here's what regulators actually test, the four audience streams every plan needs, and the pre-approved templates to build before the crisis hits.
Article 5 prohibitions have been in force since February 2025 and the enforcement regime launched August 2025. Here's what financial institutions must audit, stop doing, and document — with the credit scoring carve-out explained.
The biggest HIPAA Security Rule update since 2013 is arriving in 2026. Here's what the proposed final rule requires, what's actually changing, and how to run a gap assessment before the compliance deadline.
What an OCC consent order actually is, how it differs from a Formal Agreement, what the articles require, and what it takes to get out — with Wells Fargo as the documented case study.
SEC's $26M Reign Financial fraud case shows what happens when 'due diligence' is just a Google search. Control gaps, red flags, and what advisers should fix this week.
DSARs aren't optional, and mishandling them now costs seven figures. Here's the complete workflow — intake, identity verification, data collection, legal review, and documented response — built for teams managing multi-law obligations.
Most operational risk programs have an RCSA. Far fewer have a loss event database that's actually current, classified, and connected to risk monitoring. Here's how to build one that satisfies examiner expectations and makes the rest of your ORM program credible.
When ransomware hits your bank or fintech, the first 24 hours determine your regulatory exposure, recovery timeline, and whether your next call is to your CEO or your lawyer. Here's the phase-by-phase playbook.
Understand the critical lessons from the SVB and Signature Bank liquidity failures and how to strengthen your Contingency Funding Plan (CFP) to avoid similar pitfalls.
When a vendor calls to report a breach, your incident response clock starts immediately. Here's the step-by-step playbook — triage, regulatory obligations, customer notification, and vendor accountability.
Master your BIA with our comprehensive 50-question template, designed to identify critical business functions, RTOs, RPOs, and ensure robust business continuity planning. Download free template.
The second pillar of a BSA/AML program — and one of the most cited in enforcement actions. Here's what the FFIEC exam manual actually requires, what examiners test, and how to build independent testing that holds up.
Annex III of the EU AI Act covers credit scoring, insurance pricing, and financial standing assessment. Here's what the seven compliance obligations actually require — and who they apply to.
Former Constellation Healthcare CEO Parmjit Parmar got 5 years and $125M restitution for a $212M securities fraud built on fake subsidiaries. Here's what risk teams should rebuild this week.
How to build a compliance calendar that tracks every BSA, HMDA, Call Report, SAR, and exam deadline — with a 2026 reference template and the fields that survive an audit.
The FFIEC IT Handbook is 11 booklets and thousands of pages. Here's what examiners actually focus on, which booklets matter most for your institution, and how to prepare for each domain.
How to respond to an OCC, FDIC, or Fed MRA — the 5 Cs format, 30-day board response, MRIA timelines, and what gets you out of the supervisory dog house.
OMB Memo M-26-11 freezes federal civil monetary penalties at 2025 levels for the first time since FCPIAA 2015. What it means for OFAC, SEC, OCC enforcement.
Montana, Connecticut, Minnesota, California, and Oregon have narrowed or eliminated the GLBA entity-level exemption. If your financial institution assumes state privacy laws don't apply, you have a compliance gap.
A practitioner's guide to testing internal controls — statistical vs. nonstatistical sampling, how to run a walkthrough, what evidence examiners actually want, and where most testing programs fall short.
OCC's May 8, 2026 report under Executive Order 14294 catalogs every criminal regulatory offense the OCC or DOJ can enforce, with mens rea standards. What compliance teams should do now.
The L×I formula is nearly universal — but four common ways teams apply it turn defensible risk scores into examination findings. Here's what examiners flag and how to fix it.
How to calibrate your sanctions screening system to cut false positive volume, defend your match threshold to examiners, and document the tuning process OFAC expects.
Most vendor questionnaires produce clean checkboxes, not useful answers. Here are the specific questions — including AI vendor and fourth-party sections most templates miss — that reveal what's actually there.
Build a defensible access control policy covering RBAC, least privilege, privileged access management, and periodic user reviews. Includes the key sections examiners test under NIST 800-53 AC controls and the FFIEC IT Handbook.
How to classify incident severity correctly, build a working materiality decision process for SEC 8-K purposes, and avoid the documentation failures that turned early Form 8-K filings into SEC comment letters.
OCC's Spring 2026 Semiannual Risk Perspective flags credit, cyber, AI, and sanctions risk. What examiners will ask and how to align your program.
A practitioner's guide to SAR filing: thresholds by institution type, the 30/60-day clock, the five-W narrative framework, October 2025 FinCEN FAQ updates, and the 10 narrative mistakes that get your BSA program cited.
SEC final judgment against David Ortiz and DaveGlo Investment Group for $18M unregistered oil and gas sales. Compliance lessons on broker registration and undisclosed compensation.
A completed vendor questionnaire is the starting point, not the finish line. Here's how to verify self-reported answers, what documents to request, what red flags look like, and how to document your work so it survives an OCC or FDIC exam.
A practitioner's playbook for AI red teaming in financial services. Covers the five attack categories regulators care about, how to structure an exercise, what scoring looks like, and how to document results for examiners.
The compliance risk assessment is the foundation of every compliance management system that survives a regulatory exam. Here's the methodology regulators expect, the scoring model, and the gaps most often cited in exam findings.
Master business continuity with our BIA questionnaire template. Identify critical functions, assess impacts, and set recovery objectives with 50 essential questions.
DOJ convicted ex-Rep. David Rivera and lobbyist Esther Nuhfer for a $50M unregistered Venezuela lobbying scheme. What it means for FARA, sanctions, and AML programs.
€7.1 billion in cumulative fines and enforcement is accelerating. Here are the top penalties, the patterns DPAs are pursuing, and the specific gaps that keep landing US multinationals in trouble.
Build a defensible KYC policy covering all four pillars: CIP, risk rating, beneficial ownership, and ongoing monitoring. Includes the 2026 FinCEN exceptive relief update and lessons from Block's $80M and OKX's $504M enforcement actions.
Build a cybersecurity policy that satisfies NYDFS Part 500, NIST CSF 2.0, FTC Safeguards, and FFIEC. Required elements, control mappings, and what examiners flag.
The four statistical methods used in fair lending disparate impact testing — adverse impact ratio, regression analysis, Fisher's exact test, and BISG proxy methodology — and how to document them for exam readiness even after the federal regulatory shift.
Four defendants pleaded guilty to stealing $84M in Treasury checks from a Philly USPS facility and reselling them on Telegram. Banks stopped 87%. Here's how.
Build a defensible OFAC risk assessment using Treasury's five-component framework. Risk factors, scoring methodology, and what examiners look for.
SDNY indicted Vladimir Sklarov for a $450M stock-backed loan scheme using a fake Astor family-linked lender. Here's the control gap every counterparty diligence team needs to fix.
The facilitation mechanics that separate tabletop exercises that find real gaps from ones that generate paperwork. Role structure, inject design, hot wash technique, and the common mistakes that turn a good scenario into a wasted afternoon.
A pre-deployment AI risk assessment for banks and fintechs — model inventory, tiering, scorecard, and the controls examiners ask about under SR 26-02 and FS AI RMF.
Build a defensible BSA/AML risk assessment using the FFIEC's inherent risk framework. Covers the four risk categories, scoring methodology, FinCEN's April 2026 NPRM requirements, and common exam deficiencies.
Build a defensible data classification policy that maps to GLBA, CCPA, HIPAA, and PCI DSS. Includes the four-tier model, regulatory crosswalk, handling rules, and legal hold triggers.
Build a data retention policy that survives a regulator's request and a litigator's subpoena. Retention schedules, legal hold workflows, and disposal proof.
Build an information security policy that satisfies the FTC Safeguards Rule, FFIEC expectations, and bank examiner scrutiny. Includes required elements, structure, and common gaps.
Go beyond the scenario labels. How to build defensible run-off rate assumptions, model wholesale funding cliff risk, and quantify contingent draw exposure — with the specific techniques examiners challenge.
Banking regulators rescinded SR 11-7 and replaced it with principles-based MRM guidance. Here's what changed and what model risk teams need to do now.
The SEC just closed the largest Section 13(d) penalty in agency history — $1.5M against the Elon Musk Revocable Trust for an 11-day delay disclosing a 5%+ stake in Twitter. Here's what every compliance officer monitoring the 5% threshold needs to know.
Examiners evaluate your compliance testing for substance, not form. A schedule that exists but produces no escalations is a red flag. Here's how to build a risk-based monitoring and testing program that actually holds up.
Build a defensible CIP under 31 CFR 1020.220. Required data, verification methods, the 2025 TIN exemption, and lessons from the LPL Financial $18M fine.
A risk matrix is only as good as the calibration behind it. Here's how to choose between 5x5 and 3x3, build defensible scoring criteria, and present the result in a way regulators and boards actually trust.
Build a fintech risk register that survives examiner scrutiny. 30+ real risks across BaaS, fraud, vendor, AI, and compliance — with scoring, owners, and controls.
DORA designated AWS, Microsoft, and Google Cloud as Critical ICT Third-Party Providers in November 2025 — the first formal regulatory oversight of hyperscalers in financial services. Here's how to assess, document, and manage cloud concentration risk before your next examination.
Federal banking agencies finalized the 8% Community Bank Leverage Ratio with a 4-quarter grace period, effective July 1, 2026. Practitioner playbook for opt-in decisions and capital reporting.
EU AI Act GPAI model obligations went live August 2, 2025. Enforcement fines up to 3% of global turnover kick in August 2, 2026. Here's what every general-purpose AI provider must document, what systemic risk triggers, and what downstream deployers need from their vendors.
The FTC Safeguards Rule (16 CFR Part 314) applies to fintechs, mortgage brokers, auto dealers, tax preparers, and investment advisors — not just banks. Penalties reach $51,744 per violation per day. Here's what the 2021 and 2023 amendments require, what companies keep missing, and how to close the gaps.
GDPR fines exceeded €1 billion in 2025 alone — eight of the ten biggest penalties hit US companies. TikTok's €530M fine, LinkedIn's €310M, and Google's third escalating penalty reveal a predictable enforcement pattern. Here's what practitioners need to fix before an inquiry lands.
SEC charged Jay Lucas and Lucas Brand Equity with $50M fraud after 12 years of misappropriation. The control failures every PE adviser and CCO needs to fix.
The 2023 Interagency Addendum specifically requires tested access to contingent funding sources. Here's how OCC, FDIC, NCUA, and Federal Reserve teams evaluate the testing record — with after-action review templates.
Fourth-party risk is the gap most TPRM programs ignore — until a subcontractor takes down operations. Here's how to map, monitor, and contract for it.
Fourth-party risk took down thousands of organizations via MOVEit, SolarWinds, and CrowdStrike. NYDFS October 2025 and DORA Articles 28-29 now codify what banks have to manage downstream. Here's the practical program.
NIST SP 800-61 Rev. 3 was finalized April 3, 2025, withdrawing the 2012 Rev. 2 that most incident response programs were built on. Here's what changed, what the CSF 2.0 restructuring means for your IR program, and what you need to update.
The 2026 interagency model risk management guidance retires SR 11-7 and OCC 2011-12. Principles-based, $30B threshold, AI carved out. What MRM teams need to do.
All 50 states have breach notification laws with varying deadlines, covered data types, and penalties. California just tightened its timeline to 30 days effective January 2026. Here's the practical guide to managing the patchwork.
Most vendor onboarding programs are procurement checklists with compliance labels. Here are the eight steps that get skipped most often — and what the 2023 OCC/FDIC/Fed interagency guidance actually requires before you grant a vendor access.
A step-by-step cyber incident response playbook covering all six phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Includes NIST SP 800-61 Rev. 3 alignment and CIRCIA reporting integration.
Learn critical lessons for financial institutions from the DOJ's recent $5 million bank fraud and mail theft indictment, focusing on insider threats and control gaps.
How to actually run a Risk and Control Self-Assessment — workshop prep, scoring matrices, inherent vs residual logic, and the seven pitfalls that turn RCSA into a check-the-box exercise.
SOC 2 or ISO 27001? The right answer depends on your market, timeline, and customer base — not on which framework sounds more rigorous. A practitioner's comparison of costs, timelines, control overlap, and when both are worth it.
The Three Lines of Defense (now Three Lines Model) defines how risk ownership, oversight, and independent assurance divide across an organization. Here's what each line actually does, the 2020 IIA update, and the failure modes that cause the whole thing to collapse.
A practical vendor risk assessment template — the question domains, scoring approach, evidence to demand, and red flags that should kill a vendor before contract signature.
A practical vendor risk tiering framework for compliance and risk teams: four scoring dimensions, four-tier model, and what each tier means for due diligence, monitoring, and examiner expectations under the 2023 OCC/FDIC/Fed interagency guidance.
What KRIs actually are, how to design and threshold them, and 50+ ready-to-use examples across operational, credit, compliance, cyber, liquidity, third-party, and model risk domains.
How to run a SOC 2 readiness gap analysis: the 4-phase process, most common findings, remediation priorities, and the 60–120 day timeline from gap to clean Type 1 report.
How to write a risk appetite statement that survives board scrutiny: the three-tier structure, qualitative vs quantitative elements, and how to make it operational.
SOC 2 compliance checklist mapped to all 9 Common Criteria: exact controls, evidence requirements, and the top audit exceptions that cause clean reports to go sideways.
Step-by-step guide to building an ERM framework: governance structure, risk appetite, risk taxonomy, RCSA, KRIs, and board reporting that actually works.
OCC, Fed, and FDIC rescinded SR 11-7 and OCC 2011-12 on April 17, 2026. Here's what changed, what's gone, and what practitioners need to do now under OCC Bulletin 2026-13.
SOC 2 Type 1 vs Type 2 explained: cost, timeline, what enterprise buyers actually accept, and when skipping straight to Type 2 is the right call.
COSO ERM 2017 framework explained: 5 components, all 20 principles, and how to implement it in your organization without creating a shelf document.
A practical guide to the 6-phase incident response lifecycle — Preparation through Lessons Learned — including what most IRP templates overlook: notification timelines, CIRCIA requirements, and NIST SP 800-61 Rev. 3.
Terrence Chalk, aka Dr. Cash, ran a Ponzi scheme targeting retirees for three years before the SEC and FBI caught up. Here's what compliance teams need to know.
The complete vendor risk management lifecycle explained: risk tiering, due diligence, contract controls, ongoing monitoring, and secure offboarding. Based on the 2023 OCC/FDIC/Fed interagency guidance.
SOC 2 compliance explained for practitioners: Trust Service Criteria, Type 1 vs Type 2, common audit findings, and how to get started.
The DOJ restrained $702M in crypto from pig-butchering scams and OFAC sanctioned 29 Cambodian entities including a bank. Here's what US compliance teams must do now.
A practical framework for designing Early Warning Indicators that actually trigger action — Measures, Escalation, Reporting, Integrated systems, and Thresholds. Aligned to BCBS, OCC, and Federal Reserve expectations.
Most financial institutions using GenAI APIs don't fully own their AI supply chain. NIST AI 600-1 says that's your problem. Here's what you need to control.
NIST AI 600-1 assigns different GenAI risk obligations to developers, deployers, and operators. Here's what each role actually owns—and where the gaps live.
DOJ extradited an Ivorian national for a $14M BEC phishing scheme targeting travel agencies. Here's how the attack worked and the 5 controls that could have stopped it.
What NIST AI 600-1 requires when your GenAI system fails: incident disclosure obligations, after-action review requirements, and content provenance tracking.
SEC filed a civil complaint against Jay Lucas and Lucas Brand Equity LLC on April 24, 2026, alleging he raised $50M from investors and spent it on his wife's skincare company, alimony, and luxury expenses.
A federal court entered a $5 million final judgment against John Fernandez, Avail Progression LLC, and Elite Generators LLC for running unregistered forex Ponzi schemes targeting 100+ investors.
The OCC issued two interim final actions preempting the Illinois Interchange Fee Prohibition Act. National banks and federal savings associations are not required to comply with the Illinois IFPA.
What NIST AI 600-1 requires before you deploy any GenAI system: the full TEVV testing protocol across all 12 risk categories, red-team requirements, and go/no-go gates.
FINRA's JPMorgan Securities action shows Rule 3110 compliance requires actual review — not just alert generation. Here's what compliance teams must fix now.
NIST AI 600-1 names confabulation as one of 12 GenAI risk categories. Here's what the framework actually requires — and how to build a testing program that satisfies it.
Three AI risk frameworks now apply to financial services. Here's how NIST AI RMF, SR 26-02, and the Treasury FS AI RMF fit together — and which one covers what.
SCOTUS heard oral argument April 20 in Sripetch v. SEC. The ruling will determine if the SEC must prove investor losses before seeking disgorgement — $6B+ per year at stake.
Your compliance calendar for the two biggest US crypto laws: GENIUS Act deadlines, CLARITY Act status, California DFAL, and what to build before January 2027.
CFPB's April 22 final rule removes disparate impact from Regulation B. Federal fair lending just changed permanently — but state exposure didn't. Here's what compliance teams need to act on before July 21.
NIST AI 100-1 defines seven trustworthiness characteristics that underpin the entire AI RMF. Here's what each one means, how they interact, the trade-offs NIST acknowledges, and how regulators are using them in exams.
The MANAGE function is where NIST AI RMF turns risk assessment into operational decisions. Learn what MG-1 through MG-4 require, how to structure risk treatment decisions, and what continuous AI risk monitoring looks like in practice.
How to implement the NIST AI RMF MEASURE function: TEVV methodology, 13 trustworthy characteristic subcategories, bias testing, and financial services alignment.
The MAP function is where NIST AI RMF risk management actually starts. Learn what MAP 1-5 require, how financial institutions implement them, and why most teams get this wrong.
49 states require money transmitter licenses for crypto businesses. OKX paid $505M for getting this wrong. Here's the state-by-state breakdown and how to build your licensing strategy.
The SEC charged Voyager Pacific Capital Management in a $25M real estate Ponzi that ran five years. Here's what compliance teams must fix before examiners ask.
SR 11-7, Reg E, and UDAAP weren't built for AI that acts autonomously. Here's where your compliance program has a blind spot—and what to build before regulators close it.
The GENIUS Act is law. Here's what permitted payment stablecoin issuers owe consumers—reserve requirements, redemption policies, fee disclosures, and bankruptcy protections.
SR 11-7 ongoing monitoring for AI models — drift detection, PSI thresholds, re-validation triggers, and what OCC examiners check in 2026.
CFPB pulled back, but state AGs and the GENIUS Act mean crypto platforms still need robust complaint handling. Here's what the Bitcoin Depot lawsuit revealed — and what your program needs.
Traditional SR 11-7 validation breaks with generative AI. Learn why deterministic testing fails for LLMs and what new validation approaches financial services firms actually need.
SEC charges Donald Basile with $16M SAFT fraud using fake 'insured' crypto claims. What compliance teams need to know about SAFT red flags and crypto CDD.
A tiered ranking framework for the actual contingent funding sources in your CFP — speed, capacity, cost, and stigma. Documented to satisfy the 2023 Interagency Addendum's tested-access requirement.
Three 'advisers' used radio shows and podcasts to sell $82M in unregistered oil & gas securities — pocketing $5.7M without disclosing it. Here's the OBA and RIA compliance breakdown.
DOJ dismantled its crypto enforcement unit. State AGs filled the vacuum — with UDAP laws that don't require proof of harm. Here's what crypto compliance teams need to know.
The model risk framework just changed. OCC 2026-13 is principles-based, GenAI is excluded, and CFPB still demands specific adverse action reasons. Here's what your explainability documentation package needs.
The CFPB's Compliance Management Review evaluates four components — Board Oversight, Compliance Program, Consumer Complaint Response, and Compliance Audit. Here's how to build a CMS that functions every day, not just for exam prep.
Fintechs face a layered consumer compliance stack — TILA disclosures, GLBA Safeguards Rule, ECOA adverse action notices, and state-by-state money transmitter licensing. Here's how to sequence the build and what each layer actually requires.
Stress testing scenarios that examiners actually accept — idiosyncratic, market-wide, and combined shocks. How to defend your assumptions and integrate results back into your CFP.
The 15-year model risk framework is gone. OCC 2026-13 and SR 26-2 replace it with tailored, risk-based principles. What changed, what was dropped, and what to do now.
Traditional BIA produces RTOs. Operational resilience requires impact tolerances. They're different questions with different methodology — here's how to update your BIA process.
Tyler Buchanan's April 2026 guilty plea exposes Scattered Spider's exact attack chain. What every risk and compliance team needs to check after this conviction.
Walk through each component of a Contingency Funding Plan from the examiner's perspective. What OCC, FDIC, and Federal Reserve teams actually flag — and how to fix gaps before the exam.
The GOVERN function is the foundation of NIST AI RMF compliance. Learn what GV-1 through GV-6 actually require and how financial institutions are implementing AI accountability structures.
The Federal Savings Bank hit with OCC consent order after sending millions of deceptive mailers to veterans falsely claiming 'available funds.' Here's what the UDAP failure means for your consumer compliance program.
The CFPB tried to extend Reg E to crypto, then withdrew it. The GENIUS Act left a consumer protection gap. Now state AGs are filling the void. Here's what crypto and stablecoin platforms need to do.
SEC charges Sudheesh Nambiar with a $43M Ponzi scheme defrauding 400+ Indian American investors through fabricated statements and Telegram chatrooms.
The CFPB rescinded its BNPL interpretive rule in May 2025 — but TILA, UDAP, state laws, and the New York BNPL Act still apply. Here's what compliance teams can't ignore.
FinCEN's proposed BSA whistleblower rule offers 10-30% of penalties over $1M. Compliance professionals get a 120-day waiting period before they can report externally.
The GENIUS Act's AML proposed rule imposes SAR filing, CDD, and sanctions compliance on payment stablecoin issuers. Compliance teams have until January 2027.
When mapping third-party dependencies in your BIA, one tier isn't enough for critical functions. Here's how to scope the analysis — and where going deeper actually matters.
Most fintech BIAs skip the part that matters most: the cloud platforms and third-party APIs your entire business runs on. Here's how to map those dependencies correctly — and what your bank partners will ask about them.
What the FFIEC BCM booklet actually requires in your BIA — critical function identification, interdependency analysis, recovery objectives, and what Appendix A examiners test at your next IT exam.
The CFPB closed disparate impact investigations and federal examiners stopped looking. State AGs didn't. Here's what your fair lending program needs to do now.
NIST AI 600-1 defines 12 GenAI-specific risk categories and 200+ controls. Here's what financial services teams need before examiners start asking.
The SEC is still pursuing the Spartan Trading Company fraud case in 2026 — years after the principals died in a murder-suicide. Here's what investment advisers need to know.
CFPB's UDAAP-as-discrimination gambit was vacated, but adverse action notice requirements still bite. Here's what AI lenders actually owe consumers in 2026.
The method you choose for BIA data collection determines whether your RTOs reflect operational reality or wishful thinking. A practitioner's guide to surveys, interviews, and workshops — when each method works, where each fails, and how to combine them.
The DOJ's NFED consolidates healthcare fraud, tax, and market fraud units under one command. Here's what changes for compliance officers and risk managers.
A 47-page BIA full of RTOs and dependency tables won't get board buy-in for BCP investment. Here's how to translate BIA findings into an executive summary that drives decisions and satisfies FFIEC board reporting requirements.
A third-party AI vendor risk questionnaire for financial services: model documentation, data use, bias controls, monitoring, incident response, and evidence.
The CFPB fired its director, dropped 40+ enforcement actions, and withdrew nearly 70 guidance documents. Here's what actually changed — and what compliance obligations remain regardless.
These are the AI governance deficiencies regulators are actually finding in exams — incomplete model inventories, missing validation records, unmanaged vendor AI — and what to do about each one.
CFPB examiners don't just check whether you respond to complaints — they evaluate your entire complaint management infrastructure. Here's exactly what the exam manual requires and where programs typically fall short.
A step-by-step scoring methodology for identifying and tiering critical business functions in your BIA — with impact dimensions, scoring criteria, and real financial services examples.
Iran demanding crypto tolls at the Strait of Hormuz exposes massive sanctions risk for banks, shipping companies, and crypto exchanges. Here's what compliance teams need to do now.
How to derive RTO and RPO from real BIA data, set defensible numbers using the MTD hierarchy, and pass FFIEC examiner scrutiny on recovery objective methodology.
How to actually implement SR 11-7 for LLMs: model inventory, governance ownership, documentation standards, and validation scope for in-house and vendor AI.
When examiners evaluate your AI governance program, they're checking specific items. Here's the complete checklist — mapped to SR 11-7, OCC guidance, and the GAO's 2025 findings.
UDAAP exam findings still happen even when the CFPB is pulling back. Here's how to conduct a real UDAAP product risk assessment across all three prongs.
The CPPA issued over $2.3 million in fines across multiple enforcement actions in 2025. Here's exactly what they found, what the common violation patterns are, and what compliance teams need to fix before they're next.
A Las Vegas business owner just got 54 months in prison for filing 1,227 fraudulent ERC returns. If your company claimed the credit, here's what to do now.
FinCEN's 2026 proposed rule fundamentally reforms BSA AML/CFT program requirements—shifting from paperwork to effectiveness. Here's what changes and what to do now.
A practitioner's guide to running a business impact analysis that satisfies FFIEC examiners and ISO 22301 requirements—from scoping and data collection through RTO/RPO setting, dependency mapping, and board reporting.
SR 11-7 wasn't written for language models. Here's what model risk management teams actually need to test for LLMs and generative AI—hallucination evaluation, red-teaming, adversarial testing, and continuous drift monitoring.
92% of compliance professionals say their role has become harder, and 77% still track regulatory changes manually. Here's how to build a program that closes the gap between when rules take effect and when your policies reflect them.
AI systems fail differently than traditional IT. Here's how to build AI failure scenarios into your BCP, set recovery objectives for models, and satisfy emerging regulatory requirements on AI resilience.
Build an annual BCP testing calendar that satisfies FFIEC, ISO 22301, and NCUA examiners. Covers exercise types, scheduling by function criticality, tracking, and how to handle mid-year changes.
DOJ's $160M resolution with AssuredPartners and APSF for ACA enrollment fraud shows exactly what happens when broker compliance programs ignore third-party marketer risk.
DORA went live January 17, 2025. If your ICT vendor contracts haven't been updated, your Register of Information isn't filed, and you haven't mapped your concentration risk — here's exactly what needs to happen.
The OCC and FDIC finalized a rule prohibiting examiners from using 'reputation risk' in supervision, effective June 9, 2026. What bank compliance teams need to update now.
Flagstar said it had 'no evidence of unauthorized access.' The SEC disagreed. A practical breakdown of Form 8-K Item 1.05, how to build a defensible materiality determination process, and what early enforcement actions reveal about where companies are getting it wrong.
SEC filed just 456 enforcement actions in FY2025—fewest in two decades. Here's what compliance officers must know about the SEC's priorities shift.
Supply chain disruptions expose BCP gaps faster than almost any other event. COVID, the Suez blockage, and the chip shortage showed exactly where plans failed. Here's how to fix yours.
A practical after-action report template for BCP tabletop exercises. Covers the hot wash, finding format, corrective action tracking, and what FFIEC and ISO 22301 require.
A practical guide to the Business Continuity Maturity Model (BCMM). Learn the 5 maturity levels, how to self-assess your program, and how to prioritize improvements.
COVID forced every BCP program to confront a reality most hadn't planned for: running critical operations with 80% of your team working from kitchen tables. Five years later, hybrid work is the permanent baseline — and most BCPs still haven't caught up.
Most organizations run cyber incident response and BCP as separate programs — and that gap showed up badly in Change Healthcare, MOVEit, and dozens of other major ransomware events. Here's how to build a unified framework that actually works.
Most business continuity plans fail not because they're wrong, but because they've never been tested. Here are 10 tabletop exercise scenarios — with facilitator guidance — to stress-test your plan before a real incident does.
OCC and NCUA examiners don't just check if you have a BCP — they test whether it actually works. Here's what national banks and credit unions need to meet regulatory expectations and avoid exam findings.
Small businesses don't need a 200-page BCP. Here's a minimum viable framework covering OSHA, SBA, and HIPAA requirements — built for teams of 1-50.
SaaS companies have two BC obligations: protecting their own operations and surviving as the vendor when their customers' examiners come calling. Here's how to build a program that covers both.
SVB hadn't tested its discount window access since 2022. Learn how to design CFP tabletop exercises, stress scenarios, and simulation drills that satisfy OCC, FFIEC, and FINRA examiners.
SVB's own stress tests predicted its failure eight months early. Management changed the assumptions instead of fixing the balance sheet. Here's what the 2023 bank failures reveal about CFP design, testing, and governance — and what regulators now expect from every institution.
Healthcare BCP isn't just about uptime — it's about patient safety. Here's what HIPAA, CMS, and The Joint Commission actually require, and how to build a continuity plan that survives an OCR audit.
Most contingency funding plans fail in execution, not design. The reason is almost always governance — unclear ownership, no board-level accountability, and triggers that nobody has authority to pull. Here's how to build a CFP governance structure regulators can actually examine.
Build a practical EWI framework for liquidity stress monitoring. Covers the indicators regulators expect, how to set escalation thresholds, and the governance structure to act on signals before they become crises.
FinCEN hit Canaccord Genuity with the largest-ever BSA penalty against a broker-dealer — $80M, coordinated with SEC and FINRA for $120M total. Here's what failed and what to fix now.
Not all contingent funding sources are created equal. Here's how to rank your backup liquidity options by reliability, cost, and access speed — before you actually need them.
ISO 22301:2019 mandates specific documented information across Clauses 4-10. Here's the complete list of required policies, procedures, and records — and what auditors actually check.
ISO 22301 gap analysis maps where your BCMS falls short clause by clause. Use this template and scoring guide to assess maturity and prioritize before your certification audit.
The OCC, FDIC, and Fed repeatedly flag the same CFP deficiencies across examination cycles. Here's exactly what they find, why SVB is the case study, and what remediation actually looks like.
Learn how to create a robust contingency funding plan (CFP) for your financial institution with our step-by-step framework, covering regulatory requirements and best practices for liquidity risk management.
ISO 22301 Clause 9.2 requires documented internal audits at planned intervals. Use this clause-by-clause checklist to find gaps before your external auditor does.
Build a defensible CFP liquidity stress test: three required scenarios, assumption documentation, survival horizon metrics, and lessons from SVB's $18B 30-day deficit.
The OCC rescinded 12 CFR 30 Appendix E, eliminating mandatory recovery planning for $100B+ banks effective May 1, 2026. Here's what that means for your program.
Three major global regulatory frameworks — BCBS 2021, UK PS6/21, and EU DORA — have redefined business continuity into something practitioners barely recognize. Here's what changed and what it means for your program.
Most BIAs skip IT dependency mapping entirely — or treat it as an afterthought. Here's how to build the technology layer that makes your BIA actually useful for recovery planning.
A practical BIA scoring methodology for financial services. Score impact across 4 dimensions, assign criticality tiers, and set defensible RTO targets.
A contingency funding plan that sits in a drawer fails the moment you need it. Here are the components OCC, Fed, and FDIC examiners actually check — and how to build a CFP that survives both a liquidity event and a regulatory exam.
CFP and BCP sound similar but serve completely different functions. Here's how to tell them apart, who owns each, and when both trigger at the same time.
FINRA's proposed Rule 4610 would impose liquidity risk management requirements on about 125 broker-dealers. Here's what the rule covers, the controversial 'rebuttable presumption' conditions, and what firms should be doing now.
Your BIA isn't a one-time project. Learn FFIEC and ISO 22301 requirements for BIA review frequency, which triggers mandate an update, and how to build a defensible maintenance schedule.
Vincent Camarda of A.G. Morgan Financial Advisors pleaded guilty to $160M investment fraud. Here's what went wrong and the compliance red flags every firm should watch for.
How state and federal regulators define consequential AI decisions — and what compliance teams must do before June 2026 to avoid enforcement.
How consumer data rights like deletion, opt-out, and access apply when businesses use AI for automated decisions — mapped across CCPA, Colorado, Virginia, and 17 other state laws.
A practitioner's guide to ai model validation techniques that satisfy OCC SR 11-7, FFIEC, and CFPB requirements for ML and LLM models in financial services.
Business impact analysis vs risk assessment — learn the key differences, when to use each, and how to integrate both into your BCM program.
Contingency funding plan requirements vary by regulator, but most banks and larger credit unions need a CFP now. Here’s what OCC, Fed, FDIC, NCUA, and FINRA expect.
How to build an AI training data governance program that covers data quality, consent, provenance tracking, and regulatory compliance for financial services.
Advanced Urology and Dr. Jitesh Patel will pay $14M to settle DOJ allegations of fraudulent billing and unnecessary procedures. Key compliance takeaways inside.
Using HireVue or AI screening in Illinois? HB 3773 just expanded your obligations. A federal court ruled BIPA and AIVICA apply simultaneously — here's what that means for your consent flow, notice requirements, and litigation exposure.
NYC Local Law 144 requires annual bias audits for AI hiring tools. Learn AEDT requirements, penalties, audit process, and what the Comptroller's enforcement review means for 2026.
Practical guide to detecting, protecting, and managing PII in LLM systems — covering GLBA, CCPA, de-identification, and vendor contract requirements.
Vincent Camarda of A.G. Morgan Financial Advisors pleads guilty to defrauding 400+ clients of $160M. What compliance professionals need to know about this investment adviser fraud case.
45 states have introduced 1,561 AI bills in 2026 — already surpassing 2024's full-year total. Colorado, Texas, and California are the three to watch. Every enacted state AI law, organized by what your compliance team actually needs to do.
A contingency funding plan (CFP) maps how your institution survives a liquidity crisis. Learn what a CFP is, who needs one, key components, and regulatory requirements.
Your AI model is making bad decisions in production. Do you have a documented shutdown plan? Most banks don't. Here's the kill switch framework examiners expect — decision criteria, authority matrix, fallback ops, and what the EU AI Act requires.
How to structure AI model monitoring: drift detection, performance thresholds, fairness checks, KRIs, alert owners, and governance evidence.
How to build AI operational resilience for financial services — dependency mapping, vendor concentration risk, BCP planning, and tabletop exercises for AI failures.
How financial institutions can detect and defend against deepfake fraud — from voice cloning scams to KYC bypass attacks. Practical controls, FinCEN red flags, and detection tech.
The SEC settled with Chicago-based P/E Capital and CEO Eliseo Prisno for charging 200+ clients $2.4M in undisclosed fees — including hijacking client login credentials to approve charges.
NYC LL 144 already requires annual bias audits — and a 2025 Comptroller report found most companies aren't complying. Colorado SB 205 hits Feb 2026. Here's the full audit lifecycle: scoping, testing methods, remediation, and documentation.
How to document disparate impact testing for AI lending models: data, metrics, controls, adverse action review, and compliance evidence.
A practical AI model risk management checklist for financial services: model inventory, validation evidence, monitoring, governance, and vendor AI controls.
OWASP ranks prompt injection #1 on their LLM Top 10. Gartner predicts 50%+ of successful AI attacks will use it through 2029. If your firm deploys any LLM, here are the four controls you need before the first incident — not after.
The SEC filed fraud charges against Jon Fullenkamp and Scott Sand for misappropriating millions through sham agreements and fraudulent preferred share issuances at two penny stock companies.
AI agents can now initiate payments autonomously. Your existing fraud controls were built for humans. Here's the threat model and control framework fintechs need now.
Build an AI model risk tiering methodology that accounts for autonomy, explainability, and data sensitivity. Includes a decision-tree framework and tier-specific oversight requirements.
A complete business impact analysis questionnaire template with 50 questions across 10 categories. Based on FFIEC, NIST SP 800-34, and ISO 22301 guidance.
ISO 22301 certification costs $15K-$60K+ depending on org size. Get realistic timelines, a month-by-month implementation roadmap, and tips to avoid common pitfalls.
ISO 22301 vs ISO 27001 compared side-by-side: scope, controls, certification process, and whether you need one, both, or neither.
The SEC secured final judgments against Titanium Capital LLC and founder Henry Abdo for a Ponzi scheme that defrauded 162 investors of $5.3 million. Here's what happened and what compliance teams should learn.
How to meet AI explainability requirements from the OCC, Fed, CFPB, and EU AI Act — with practical techniques for every model type.
AI impact assessments are now required under Colorado SB 205 and the EU AI Act. Learn who needs one, what to include, and how to build the process.
Map SR 11-7 and OCC 2011-12 documentation requirements to AI and ML models. Section-by-section template for model cards, training data provenance, and examiner-ready documentation.
The SEC secured a final judgment against Kenneth Welsh, a former Wells Fargo advisor who misappropriated $2.86M+ from clients over five years through 137 fraudulent transactions.
Practical governance framework for agentic AI systems. Covers new risk categories, permission models, audit trails, and the human-on-the-loop debate for financial services.
SEC charged Tulsa college student Krish Kumar with misappropriating nearly $7M from two investment funds. Here's what compliance officers at investment advisers need to know.
Learn the essential AI bias testing methodologies for fair lending compliance—disparate impact analysis, counterfactual fairness, calibration testing, and more—before your next exam.
Learn how to prevent AI data leakage from LLMs in financial services. Covers the 5 leakage vectors, OWASP LLM top risks, NIST controls, and a 90-day implementation roadmap.
Your employees are already using ChatGPT — do you have a policy? Build an AI acceptable use policy with data classification rules, prohibited uses, and tool approval workflows.
The SEC's final consent judgment against Commonwealth Financial Network for undisclosed revenue-sharing conflicts offers a critical compliance lesson: fiduciary duty means disclosing who pays you, fully.
How to build an AI incident response plan that covers model failures, hallucinations, bias events, and drift — with severity tiers, escalation paths, and containment controls.
Build an AI model inventory with ownership, use case, data, decision role, risk tier, vendor source, controls, monitoring, and review evidence.
How to detect, measure, and mitigate LLM hallucination risk in financial services — with real controls, metrics, and a regulatory-ready framework.
The SEC charged four individuals with fabricating documents to defraud investors in a $284 million municipal bond offering for a Mesa, Arizona sports complex. Here's what went wrong and what compliance teams can learn.
How financial institutions should build business continuity programs that satisfy OCC, FDIC, and Fed operational resilience expectations — with real enforcement examples and implementation guidance.
Colorado SB 205 takes effect June 30, 2026. Learn who's covered, what counts as a high-risk AI system, required impact assessments, consumer notices, and your compliance checklist.
Your auditor wants ISO 22301 alignment? Here's exactly what each clause requires, how it maps to FFIEC, and whether certification is actually worth the cost.
The NIST AI RMF is in active revision as of 2026. Here's what's changing, what's staying stable, and what your AI risk program should do right now.
The SEC obtained a final judgment against Stuart Frost for extracting $14M in undisclosed incubator fees from VC fund investors. Key lessons for investment adviser compliance programs in 2026.
Shadow AI is spreading through financial services whether you know it or not. Here's how to detect it, assess the risk, and build a governance framework that actually works.
SR 11-7 was written for spreadsheet models, not LLMs. Here's how each pillar of the framework must adapt for AI/ML — and where traditional MRM breaks down completely.
Build a crisis communication plan that covers customers, regulators, employees, and partners — with pre-drafted templates, escalation timelines, and real-world lessons.
SEC closes $50M Ozy Media fraud case — revenue inflated 100%, a YouTube exec impersonated on an investor call. What compliance teams must learn from this textbook failure.
Step-by-step tabletop exercise template with facilitator guide, scenario injects, and 3 ready-to-use scenarios for business continuity testing.
Learn how to assess vendor business continuity plans, monitor third-party resilience, and meet FFIEC requirements for vendor BCP oversight.
Free business continuity plan template with the 8 sections every BCP needs. Step-by-step guide for financial services teams building or rebuilding their BCP.
How to test your BCP with tabletop exercises: scenarios, participant roles, evidence, after-action reports, and remediation tracking.
Business continuity vs disaster recovery explained — what each covers, where they overlap, and why treating DR as your whole continuity program is a regulatory red flag.
How to build a business impact analysis template with critical functions, impact ratings, RTO/RPO, dependencies, owners, and recovery evidence.
Step-by-step disaster recovery plan template with recovery tiers, DR strategies, and testing schedules. Build a DRP aligned to your BIA and RTO/RPO targets.
FFIEC business continuity requirements translated into BCP template fields, BIA evidence, tabletop tests, and examiner-ready documentation.
RTO vs RPO explained with practical guidance on setting recovery objectives, tiering critical functions, and avoiding the mistakes that turn outages into disasters.
The SEC's Legacy Cares case is a textbook municipal bond fraud—fabricated contracts, forged signatures, and a near-total investor wipeout. Here's what compliance practitioners need to know.
AI ethics and AI governance are not the same thing. Learn how ethics, governance, and model governance layer together — and why you need all three.
Build an effective AI governance committee with the right roles, a defensible charter, and a meeting cadence that actually works. Practical guide for financial services.
AI risk ownership is broken at most firms. Learn how to apply three lines of defense, assign accountability, and stop the 'everyone owns it' trap.
Scale AI governance across a large organization without killing innovation. Federated vs. centralized models, shadow AI controls, model inventories, and board reporting.
The SEC's Legacy Cares case shows how fabricated revenue documents collapsed a $284M municipal bond deal. Here's what compliance and risk teams need to know.
Build an AI compliance framework that survives regulatory exams. Model inventories, risk assessments, testing evidence, and documentation that proves you're compliant.
Build an AI governance policy that actually works. Covers scope, risk classification, approval workflows, monitoring, and exceptions — with section-by-section guidance.
Navigate the 2026 AI regulatory landscape — EU AI Act deadlines, state laws in Colorado, Illinois, and Texas, SEC enforcement priorities, and what compliance teams should do now.
Map the NIST AI Risk Management Framework against EU AI Act requirements. Build one AI governance program that satisfies both — with a practical crosswalk for financial services teams.
Tactical AI governance best practices from financial services, healthcare, and insurance. Model inventories, tiered oversight, cross-functional committees, and documentation that survives exams.
Build an AI risk management framework that identifies, assesses, and mitigates real AI risks. Includes risk taxonomy, tiering model, and 90-day roadmap.
Build a responsible AI framework that turns fairness, transparency, and accountability principles into operational controls. Includes bias testing, impact assessments, and 120-day roadmap.
The SEC obtained a final judgment against Bin Hao and Qidian LLC for a Ponzi scheme that targeted Chinese-American investors. Here's what compliance teams need to know about affinity fraud detection and controls.
Build an AI governance framework that actually works. 8 core components, maturity model, and 90-day implementation roadmap for risk practitioners.
A financial services BCP template guide covering BIA, RTO/RPO, dependency mapping, communication roles, tabletop testing, and examiner evidence.
A practical guide to implementing the NIST AI RMF across Govern, Map, Measure, and Manage — with actionable steps for financial services teams.
13 state AGs sued OneMain Financial for loan packing and junk fees on March 16, 2026. Here's what the case means for add-on product controls, fee disclosure, and state AG enforcement trends.
A practical guide to building an operational risk management framework — RCSA, KRIs, loss event tracking, and the ORM lifecycle for mid-size banks and fintechs.
The SEC obtained a final consent judgment ordering $106.5M in disgorgement against Ofer Abarbanel for orchestrating a mutual fund fraud scheme. Here's what happened and why it matters for fund compliance.
A new House bill would overhaul GLBA Title V and preempt state privacy laws for financial institutions. What practitioners need to know and do now.
Build a defensible incident response plan template for your fintech. Covers NIST phases, regulatory notification requirements, and what regulators actually check.
The FS AI RMF gives financial institutions 230 AI control objectives. A practical guide to prioritizing what matters and building your implementation roadmap.
New survey data shows most financial institutions can't identify vendor AI use. A practical vendor AI risk assessment guide with due diligence questions and implementation roadmap.
A comprehensive guide to identifying, assessing, and mitigating AI risks in regulated financial institutions—from model governance to third-party AI vendor oversight.