102 articles · Financial Services · page 2 of 6
Articles
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
A hacking group known for working through one industry at a time reached U.S. insurers in June 2025, and a warning became a deadline. Financial firms needed a pre-agreed surge mode: a clear trigger, tighter help-desk rules and containment planned around stolen identities.
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage began with a routine policy update that reached every region at once. For banks, asking how a provider releases code and settings reveals far more than its promised uptime figure.
Week of 12 May 2025
Cheap contracts, valuable access: the market behind Coinbase’s bribed agents
Coinbase’s May 2025 disclosure showed criminals simply buying customer data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
The Iberian grid failed in April 2025 and bank systems largely held, yet customers still could not pay for groceries. Payment resilience lives at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. What mattered to broker-dealers and advisers was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and the examiners kept knocking.
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s most candid account of its own weaknesses sits with a regulator it can neither audit nor replace. Banks still control what they write, how it travels and how they respond when the holder is breached.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record beat a multi-person approval process without breaking it: attackers simply changed what the approvers saw on screen. Any bank approving payments through software carries the same risk at four points, from how the screen is built to recovery.
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The CFPB was told to stop work in February 2025, but consumer law stayed the same. What vanished were three outside nudges firms relied on: exam deadlines, published lessons from peers and federal follow-up on complaints. Each had to be rebuilt in-house.
Week of 13 January 2025
DORA’s register of information made every bank a data supplier to EU oversight of its vendors
DORA’s register of technology suppliers looked like paperwork. In fact it was a dataset supervisors would pool to spot concentration and pick critical providers, and its quality depended on three data problems most vendor programs had never solved: identity, dependency and depth.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After hackers burrowed into U.S. phone networks, CISA urged targeted people to switch to encrypted messaging, just as regulators were fining brokers over unrecorded chats. The two demands meet on one answer: a firm-controlled channel that is encrypted, recorded and easy to use.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The CFPB’s rule let federal examiners into the biggest payment apps, and it lasted under six months. With Synapse’s collapse still fresh, the more lasting exposure lay elsewhere: in the law apps already owed and in the banks holding their customers’ money.
Week of 11 November 2024
FinCEN’s deepfake alert was a job-design problem for three groups of staff
FinCEN’s November 2024 deepfake alert read like a checklist for compliance teams. Its harder message was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new authority, incentives and ways to escalate.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s open banking rule was final and in court on the same day. Banks could neither wait out the lawsuit nor build blindly, so the smart move was sorting the work by how much each piece would be regretted if the rule fell.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no new rules. Because the CEO and security chief already sign a yearly compliance certification, though, it turned four AI risks into evidence those executives must be able to show.
Week of 5 August 2024
How the August 2024 selloff found brokerages’ capacity limit before the first trade
As markets tumbled on August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat before the first trade, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.
Week of 8 July 2024
A credit union’s promises in an outage are set by its architecture, years before the attack
When ransomware took Patelco’s digital banking offline, members asked four simple questions: can I use my money, what happened to my data, how do I get back in, and who pays. Most of the answers had been decided years earlier.
Week of 10 June 2024
Why banking-as-a-service margins never covered the cost of knowing whose money it was
The Fed’s order against Evolve exposed a mismatch built into banking-as-a-service. Sponsor banks earned more as balances grew, but the cost of reconciliation, oversight and partner failure grew with every new program. Banks that priced only the revenue ended up carrying the costs.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 attacks on Snowflake customers broke nothing in the platform itself. They used passwords stolen from infected computers, often contractors’, and walked out with bulk data. Every step, from theft to login to extraction, was a lock the customer held.
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments promised customers breach notice within 30 days and required service providers to warn firms within 72 hours. For brokers and advisers whose client data lives mostly with vendors, that second clock decides how well the first one works.
Week of 11 March 2024
Why the AI Act left bank credit models with the supervisor they already had
Europe’s new AI law did not hand bank credit models to a new regulator. It routed them through the banking supervisor banks already knew, and let existing governance count for some duties. The real work was finding what model risk management never covered.