102 articles · Financial Services · page 1 of 6
Articles
Week of 19 October 2026
A lost zone is the failure banks plan for. Google’s London outage tested five layers of that plan
A power failure took down one zone of Google Cloud’s London region on 20 October 2026, the loss multi-zone banking systems are built to absorb. Services stalled anyway. Surviving a lost zone depends on five layers, and each has to be tested.
Week of 31 August 2026
Bank cyber gaps now arrive as observations the board never has to see
Two bank regulators narrowed formal findings to problems that threaten material financial harm, a year after a shared cyber checklist was retired. Many cyber weaknesses will now arrive as informal observations, so banks must decide for themselves what reaches the board.
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 deadline for stablecoin rules, but the law’s January 2027 backstop date stayed put. Banks could not wait for final text to choose their role, and the question of deposits ran through every choice.
Week of 13 July 2026
Fedwire’s ISO 20022 switch gave banks rich payment data their core systems still truncate
A year after Fedwire switched to ISO 20022, the richer payment message reached most US banks intact. The value inside it often did not, lost at the customer’s keyboard, inside banks’ own systems, or in screening and fraud tools never set up to read it.
Week of 22 June 2026
Why Europe’s accessibility law turns every bank release into evidence
A year after the European Accessibility Act began to apply, banks serving EU consumers have found that accessibility wears away with every release, new template and vendor update. What lasts is a steady, running record of evidence across four parts of the service.
Week of 1 June 2026
For a small adviser, Regulation S-P compliance is bought before the breach
The amended Regulation S-P reached smaller advisers and broker-dealers on June 3, 2026, and most had no in-house incident team. For them, compliance means buying in advance: people to respond, the evidence to decide, and the means to notify clients.
Week of 25 May 2026
Faster settlement, longer nights: what two years of T+1 tell Europe’s operations desks
America’s move to one-day settlement held because firms automated same-day trade matching and rethought who works when. Europe and the UK follow in October 2027, and the shift patterns and funding arrangements will be harder to build than the software.
Week of 18 May 2026
Searching by balance: how bribed bank insiders choose their targets
Bank insider cases prosecuted in 2026 show bribed employees selling three things: the search that finds wealthy customers, the screens that expose them, and the overrides that open doors. A bank can control all three without first catching the insider.
Week of 6 April 2026
When AI made flaws cheap to find, banks’ patch queues set the pace
An AI model that could find serious software flaws prompted a meeting with bank chief executives, yet most banks could not use it. Their test was how fast they could install the fixes that would follow.
Week of 2 March 2026
Iran’s war tested banks’ decision rights more than their defenses
After the strikes on Iran, the cyber warnings named old tricks banks already knew how to stop. The harder test was judgment under pressure: what to fix first, who could override a change freeze, and what to ask of the providers banks depend on.
Week of 19 January 2026
The easiest part of a card rate cap is cutting the rate
A late-night post proposed capping credit card interest at 10%, but no legal mechanism existed and January 20 came and went. For card issuers, cutting a rate is the easy part; the risk lives in everything a bank changes to make up for it.
Week of 15 December 2025
Crypto trust charters and community banks: the binding decision sits in the core
The OCC’s conditional approval of five crypto trust banks gave smaller banks and credit unions credible custody partners. The harder problem drew less notice: how any of it would show up in the ledger, statements and reports their core systems produce.
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
The SEC’s amended Regulation S-P took effect for larger firms on December 3, 2025, making notice to customers after a breach the default. Whether a firm could notify narrowly depended on evidence it had to keep long before anything went wrong.
Week of 24 November 2025
SitusAMC turned a mid-tier mortgage vendor into a top-tier bank exposure
A breach at SitusAMC, a real estate finance services firm few people had heard of, reached some of the largest U.S. banks. Vendor rankings built on spend and operational importance had missed a company holding sensitive data for many institutions at once.
Week of 17 November 2025
For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s
Brussels proposed delaying the AI Act’s high-risk rules, and credit scoring seemed to get breathing room. For consumer lenders it was a mirage: the GDPR, as Europe’s top court read it, and the Consumer Credit Directive’s November 2026 date still set the pace.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s final cybersecurity deadline, November 1, 2025, paired multi-factor login for everyone with a maintained inventory of every system. The login rule got the attention. The inventory was harder, and the annual sign-off by named executives made both personal.
Week of 20 October 2025
One region failed, many financial apps stalled: concentration risk sat in the dependencies
One Amazon Web Services region in Virginia faltered in October 2025, and financial apps that looked resilient on paper stalled anyway. The weak points were shared services and slow recoveries, so the answer is mapping dependencies and rehearsing degraded service, not reflexive multi-cloud.
Week of 8 September 2025
Why bank change control never saw the npm hijack
In September 2025, poisoned versions of widely used open-source code were live for about two hours. Bank change control was built to approve the code people write. This attack came in through code the build process fetched by itself, which nobody approves.
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
Regulators retired the tool community banks had used for a decade to check their cybersecurity on August 31, 2025. Most banks quickly picked a new framework. Fewer noticed they had also lost the step that told them how much security their business needed.
Week of 18 August 2025
How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for customer data access, the CFPB’s August 2025 notice moved open banking’s rules from regulation into contracts. Big banks could set prices, smaller ones would inherit them through vendors, and fintechs would redesign around them.