Financial Services · Regulation & Compliance
Articles in this selection, newest first. Change the filters, or clear them to see every article.
24 articles · Financial Services · Regulation & Compliance · page 1 of 2
Articles
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 deadline for stablecoin rules, but the law’s January 2027 backstop date stayed put. Banks could not wait for final text to choose their role, and the question of deposits ran through every choice.
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
The SEC’s amended Regulation S-P took effect for larger firms on December 3, 2025, making notice to customers after a breach the default. Whether a firm could notify narrowly depended on evidence it had to keep long before anything went wrong.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s final cybersecurity deadline, November 1, 2025, paired multi-factor login for everyone with a maintained inventory of every system. The login rule got the attention. The inventory was harder, and the annual sign-off by named executives made both personal.
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
Regulators retired the tool community banks had used for a decade to check their cybersecurity on August 31, 2025. Most banks quickly picked a new framework. Fewer noticed they had also lost the step that told them how much security their business needed.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. What mattered to broker-dealers and advisers was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and the examiners kept knocking.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After hackers burrowed into U.S. phone networks, CISA urged targeted people to switch to encrypted messaging, just as regulators were fining brokers over unrecorded chats. The two demands meet on one answer: a firm-controlled channel that is encrypted, recorded and easy to use.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The CFPB’s rule let federal examiners into the biggest payment apps, and it lasted under six months. With Synapse’s collapse still fresh, the more lasting exposure lay elsewhere: in the law apps already owed and in the banks holding their customers’ money.
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments promised customers breach notice within 30 days and required service providers to warn firms within 72 hours. For brokers and advisers whose client data lives mostly with vendors, that second clock decides how well the first one works.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s first standards, published in January 2024, turned the question of when a tech outage is serious enough to report into a calculation over clients, transactions, downtime, data and cost. Banks that couldn’t feed the numbers couldn’t classify in time.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
In November 2023 a ransomware gang reported its own victim, MeridianLink, to the SEC. The vendor’s bank and credit union customers then faced their own notification deadlines with little more than an attacker’s boast and a vendor statement to go on.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The SEC’s private fund adviser rules, adopted in August 2023, were struck down ten months later. Firms that sorted the work into what investors would demand, what existing law already required and what only the rule required wasted very little.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
As banks failed in March 2023, the SEC proposed three cybersecurity measures on a single day, to little notice. Each served a different audience: the regulator, the customer and the market. Only the one protecting customers became law.
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
In January 2023, bank regulators warned about crypto. Most readers heard a verdict on whether banks could hold digital assets. The sharper warning concerned risk banks already carried through depositors, partners and customers, which most could not measure from their own data.
Week of 17 October 2022
If the CFPB’s funding fell, the statutes would still stand
An appeals court’s 2022 ruling that the consumer bureau’s funding was unconstitutional put a question mark over every CFPB rule for eighteen months. The sensible response was sorting: past orders, current rules and pending rules each carried a different kind of risk.
Week of 8 August 2022
Tornado Cash and the transfers nobody asked for
Treasury’s sanctions on Tornado Cash targeted software, not a person. Forbidden money could land in anyone’s wallet uninvited, the usual parties to screen did not exist, and the rule itself was soon under legal attack. Banks had to comply anyway.
Week of 25 April 2022
Why the CFPB’s dormant authority put fintech partners on the exam calendar
The CFPB dusted off a rarely used power to supervise nonbanks whose conduct puts consumers at risk, and exam readiness stopped being a problem for later. Fintechs had to build it before they scaled, and their sponsor banks had to check it.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
In October 2021 the FTC gave mortgage brokers, auto dealers, finance companies and tax preparers specific, bank-style security rules. The bigger shift was who answers for them: one named person, a written report to the board, and proof the program works.
Week of 9 August 2021
Who counts as a crypto broker mattered less than what brokers could not know
In August 2021, the Senate fought over who should count as a crypto “broker.” Banks and brokerages were clearly in. Their real problem was three kinds of data they did not have: what customers paid, where assets had been, and who sent them.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
In March 2021, five federal agencies asked banks and credit unions how they use AI. No new rule followed. But the questions mapped onto four tests existing rules already imposed, and those tests still frame how supervisors look at any model.
Week of 28 December 2020
Why the ownership registry never replaced the bank’s own file
The Anti-Money Laundering Act of 2020 promised banks a federal register of who really owns companies. The register was later cut back, the bank’s own duty to know its customers stayed, and a new whistleblower channel changed who could report weak programs.