United States Regulatory Updates

Key dates

2026-11-06

The final rule was published in the Federal Register at 91 FR 69955.

2027-02-04

Amendments to Investment Company Act rule 0-10 and Advisers Act rule 0-7 become effective.

2027-02-04 Deadline

The amendments to Advisers Act rule 203-3(b) and Form ADV become effective and compliance is required.

Suggested considerations

• Compliance teams may wish to assess whether the adviser or any relevant control group will qualify as a small entity under the revised less-than-$1 billion RAUM test once the amendments become effective.
• Advisers may wish to review Form ADV Item 12 procedures, reporting logic, and filing controls so that the revised definition is applied from the February 4, 2027 compliance date.
• Advisers and fund groups may wish to map control relationships and family-of-investment-companies aggregation methodology against the amended thresholds rather than treating each legal entity independently.
• Firms may wish to confirm that internal policies do not incorrectly treat the revised RFA thresholds as changes to SEC registration, exemption, fiduciary, reporting, custody, or other substantive obligations.
• Advisers relying on or considering a continuing hardship exemption may wish to review the conforming amendments to Advisers Act rule 203-3(b) and update related filing documentation.
• Regulatory-change inventories and future rulemaking impact assessments may benefit from recording the inflation-adjustment mechanism and monitoring subsequent Commission adjustment orders.

What changed

Effective February 4, 2027, rule 0-10 will increase the threshold for a registered investment company or business development company to qualify as a small entity from $50 million to $10 billion of net assets. Asset aggregation will use the Form N-CEN concept of a family of investment companies rather than the former group of related investment companies terminology.

Key dates

2026-11-05

CFTC issued the interpretation of the impartial access requirements in 17 CFR 38.151(b).

2026-12-05 Deadline

Thirty-day period expires for DCMs to cease domestic geographic restrictions that violate the impartial-access requirements or submit an explanation to the Division of Market Oversight why compliance is not feasible; the same period applies to addressing intermediary impediments or explaining why compliance is not feasible.

Suggested considerations

• DCMs should inventory all domestic geographic eligibility, onboarding, trading, product-access, and account-management restrictions and assess them against 17 CFR 38.151(b)'s requirements for impartial, transparent, and non-discriminatory access.
• DCMs should review whether state-based restrictions affect members, persons with trading privileges, independent software vendors, or access to particular products, including event contracts.
• DCMs should identify and review contractual, technical, and operational controls used by futures commission merchants, introducing brokers, and other intermediaries to determine whether they impose geographic restrictions inconsistent with the DCM's impartial-access requirements.
• DCMs should document the legal and operational basis for removing each restriction or, where removal is not feasible, prepare a fact-specific explanation for the Division of Market Oversight before the 30-day period expires.
• Compliance teams at intermediaries should map state-based geofencing, customer-location verification, product blocking, and position-management restrictions affecting access to DCM markets and assess whether those controls are required by applicable law, regulation, or court order.
• Affected firms should assess conflicts between the CFTC's interpretation and any state requirements or judicial orders, obtain legal analysis, and avoid treating the interpretation as automatically vacating an injunction or other binding court order.
• DCMs should retain evidence of governance review, intermediary oversight, customer communications, access testing, and remediation decisions in anticipation of possible fact-specific CFTC inquiry or enforcement.

What changed

The CFTC has applied the existing impartial-access requirements in 17 CFR 38.151(b) expressly to domestic geographic restrictions, including restrictions based on a market participant's state or location. DCMs must cease geographic restrictions that violate the rule within 30 days of the November 5, 2026 publication, or submit an explanation to the Division of Market Oversight stating why compliance is not feasible.

Key dates

2026-11-05

CFTC Division of Clearing and Risk issued the no-action letter and accompanying public release addressing trust companies used for daily settlements.

Suggested considerations

• Compliance teams may wish to identify any existing or proposed trust-company settlement arrangements and determine whether each arrangement is being governed under the DCO’s settlement-bank policies and procedures.
• DCOs should consider documenting that each trust company satisfies the applicable 17 CFR 39.14 settlement-bank criteria, including capitalization, creditworthiness, liquidity access, operational reliability, and regulatory status.
• Firms should consider reviewing account structures, settlement agreements, payment workflows, and legal opinions to confirm that transfers are irrevocable and unconditional no later than the time the relevant DCO or clearing-member account is debited or credited.
• DCOs may wish to assess credit, liquidity, concentration, and intraday settlement exposures arising from the use of each trust company and confirm that monitoring, escalation, collateral, and contingency arrangements remain adequate.
• Operations and resilience teams may wish to test the trust company’s connectivity, payment-failure procedures, recovery arrangements, and coordination with the DCO’s business-continuity and disaster-recovery plans.
• Legal and compliance teams should consider recording the no-action letter’s conditions and limits in the DCO’s regulatory inventory, noting that the relief is staff relief rather than a binding amendment to Part 39 and may not extend to materially different structures or facts.
• Clearing members may wish to confirm that their agreements with the DCO and trust company allocate settlement, segregation, insolvency, operational, and account-control risks consistently with the DCO’s approved procedures.

What changed

The letter provides staff no-action relief for a DCO that uses a trust company to conduct daily settlement, notwithstanding the distinction between a trust company and a settlement bank under the CFTC framework. It does not create a generally applicable exemption or amend 17 CFR Part 39; instead, it allows the arrangement provided the trust company is managed and controlled as a settlement bank.

Key dates

2026-11-04

The SEC adopted the amendments to Rules 0-10, 0-7, 203-3 and related Form ADV provisions.

Suggested considerations

• Compliance teams may wish to reassess the firm's status under Advisers Act Rule 0-7 and Investment Company Act Rule 0-10 using current Form ADV regulatory assets under management, fund-family relationships, net assets, and control relationships.
• Advisers and fund groups should distinguish the revised Regulatory Flexibility Act small-entity classification from SEC registration thresholds, eligibility for regulatory exemptions, and other substantive compliance obligations; the amendments do not alter those requirements.
• Fund administrators and regulatory reporting teams should review family-of-investment-companies aggregation data against Form N-CEN Item B.5 and prepare to apply the revised aggregation methodology when the amendments become effective.
• Advisers that rely on or may need a continuing hardship exemption from electronic filing should review the related Rule 203-3 and Form ADV amendments and confirm procedures, systems, and filing calendars before the compliance date.
• Compliance teams may wish to monitor the Federal Register for the publication date and calculate the 90-day effective and compliance date, since the SEC release does not yet provide a calendar date for that event.
• Regulatory policy teams should consider whether the broader small-entity population changes how the SEC's future rulemakings and Regulatory Flexibility Act analyses may affect the firm's cost and burden profile, without assuming that the classification creates immediate operational relief.

What changed

Rule 0-10 increases the net-asset threshold for an investment company, including a business development company, to $10 billion from $50 million and replaces the existing related-fund aggregation approach with a reference to a family of investment companies as used in Form N-CEN Item B.5. Rule 0-7 increases the investment-adviser small-entity threshold to less than $1 billion of regulatory assets under management from $25 million, eliminates the separate investment-adviser total-assets threshold, and makes conforming changes to the control-relationship tests.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2020-04-27

NCUA published the interim final rule establishing the PPP risk-weighting, PPP Loan Facility total-asset exclusion, and commercial-loan treatment.

2022-01-01

NCUA’s 2015 risk-based capital final rule became effective; the December 2021 final rule had already carried forward the relevant PPP treatment into the then-current capital adequacy framework.

2026-11-04

The final rule adopting the April 27, 2020 IFR without change becomes effective and is published at 91 FR 69493.

Suggested considerations

• Compliance teams may wish to confirm that risk-based capital reporting continues to assign a 0 percent risk weight only to loans meeting the applicable SBA PPP eligibility and coverage criteria.
• Credit unions that pledged PPP loans to the Federal Reserve PPP Loan Facility may wish to verify that the loans remain appropriately identified and excluded from total assets solely for the net worth ratio calculation under 12 CFR 702.2.
• Regulatory reporting and finance teams may wish to reconcile PPP-loan classifications across the general ledger, capital calculations, Call Report processes, and supporting documentation.
• Lending compliance teams may wish to confirm that qualifying PPP loans are not included as commercial loans for purposes of 12 CFR part 723, while other applicable lending, documentation, servicing, SBA-guarantee, and record-retention requirements remain separately addressed.
• Credit unions may wish to retain evidence supporting SBA guarantees, facility pledges, non-recourse funding, and the basis for any regulatory capital exclusions, particularly where legacy PPP balances remain on the balance sheet.
• Policy owners may wish to update regulatory inventories to identify the 2026 rule as a finalization of the 2020 IFR rather than as a new operational requirement.

What changed

Under 12 CFR part 702, covered loans issued under the SBA Paycheck Protection Program continue to receive a 0 percent risk weight for risk-based capital purposes. PPP loans pledged as collateral for a non-recourse borrowing through the Federal Reserve’s PPP Loan Facility continue to be excluded from total assets when calculating the net worth ratio under 12 CFR 702.2. Under 12 CFR part 723, PPP loans remain excluded from the definition of commercial loans.

Key dates

2026-11-04

The proposed rule was published in the Federal Register at 91 FR 69642.

2027-01-04 Deadline

Comments on RIN 3064-AG35 must be received by the FDIC.

2029-10-01

First proposed inflation-based adjustment to the section 360.9 covered-institution and larger-covered-institution thresholds.

Suggested considerations

• Affected banks should assess whether they meet the proposed covered-institution or larger-covered-institution thresholds using Call Report definitions and current deposit-account and asset data.
• Current part 370 institutions should map existing output files and deposit-account records against the 26 proposed mandatory fields in 12 CFR part 360 appendices C through G, identifying gaps in account title, ownership, relationship, beneficiary, domestic-versus-foreign, and other required data.
• Part 370 institutions should evaluate the effect of replacing their own deposit-insurance calculation systems with FDIC-calculation reliance, while preserving or redeveloping the provisional-hold capabilities required by proposed section 360.9.
• Larger covered institutions should inventory transactional accounts subject to the proposed account-holder contractual or disclosure requirement and determine which mortgage-servicer, fiduciary, real-estate, IOLTA, employee-benefit-plan, and trust-related accounts may be excluded.
• Compliance, operations, legal, and technology teams should review the proposed six-month implementation period for general requirements and 18-month period for provisional-hold requirements for institutions that are larger covered institutions on the final rule's effective date.
• Banks approaching the thresholds should establish monitoring for two consecutive quarters, the proposed 12-month implementation period after becoming a larger covered institution, and the proposed release mechanism after three consecutive quarters below the relevant threshold.
• Institutions should consider whether to submit comments by January 4, 2027, particularly on field-level data requirements, provisional-hold redevelopment, account-holder disclosures, transition timing, exemptions, and the CPI-W indexing methodology.
• Industry commentary indicates that the proposal is being read primarily as a burden-reduction measure for large banks, with estimated annual savings of approximately $33 million offset by approximately $14 million in transition costs; firms should nevertheless account for operational work associated with standardized data and provisional holds.

What changed

Proposed revised 12 CFR 360.9 would apply to insured depository institutions with at least $2 billion in deposits and either at least 250,000 deposit accounts or at least $20 billion in total assets, regardless of deposit-account count. A new category of larger covered institution would include institutions with at least $2 billion in deposits and two million or more deposit accounts. Part 370 institutions would generally become larger covered institutions under section 360.9, and would no longer need to operate systems capable of calculating deposit-insurance coverage themselves.

Key dates

2023-12-13

The SEC adopted the Treasury clearing amendments, including the trade-submission requirement implemented through Exchange Act Rule 17ad-22(e)(18)(iv)(A).

2026-10-30

The SEC issued exemptive relief for specified inter-affiliate and non-U.S. Treasury repo transactions.

2026-12-31 Deadline

Compliance date for applicable eligible secondary market cash transactions involving U.S. Treasury securities.

2027-06-30 Deadline

Compliance date for applicable eligible secondary market repo transactions involving U.S. Treasury securities.

Suggested considerations

• Firms should obtain and analyze the operative October 30, 2026 Section 36 exemptive order, including all limits, conditions, definitions, recordkeeping provisions, and any continuing reporting requirements.
• Compliance teams may wish to inventory all Treasury repo transactions by legal entity, counterparty location, direct-participant status, affiliate relationship, guarantee structure, and whether the transaction is market-facing or solely inter-affiliate.
• Firms should validate whether each proposed affiliate qualifies under Rule 17ad-22(a) as modified by the relief and confirm that the affiliate is not an investment company under Section 3 of the Investment Company Act of 1940.
• Broker-dealers and other direct participants should update trade-classification, order-management, confirmation, clearing-submission, exception-management, and surveillance controls to distinguish exempt transactions from transactions that must be submitted for clearing.
• Global firms should establish governance for monitoring any activity-based or volume-based limit applicable to non-U.S. repo relief, including data ownership, aggregation across affiliates and direct participants, calculation frequency, escalation thresholds, and evidence retained for supervisory review.
• Firms should continue implementation of the broader Treasury clearing framework and should not treat the relief as a basis for delaying preparations for the December 31, 2026 cash-market or June 30, 2027 repo compliance dates.
• Legal and compliance teams may wish to assess whether non-U.S. branches, foreign affiliates, guarantees by U.S. persons, or local-law requirements create additional obligations notwithstanding the SEC relief.

What changed

The relief applies to certain repo transactions involving non-U.S. counterparties, subject to specified limits and conditions. It also expands the inter-affiliate treatment for repos between a direct participant of a U.S. Treasury securities covered clearing agency and an affiliated entity that is not an investment company under Section 3 of the Investment Company Act of 1940, provided the affiliate otherwise meets the affiliated-counterparty definition in Rule 17ad-22(a).

Key dates

2026-10-30

FDIC Board unanimously approved the Notice of Proposed Rulemaking by notational vote.

Suggested considerations

• Compliance teams should obtain and review the complete NPRM, including proposed amendments, definitions, scope thresholds, transition provisions, and the Federal Register comment deadline, because the bulletin itself contains only a high-level announcement.
• Firms should map each insured depository institution against the current applicability criteria in 12 CFR part 370 and 12 CFR 360.9, documenting deposit-account counts, domestic deposits, total assets, existing exemptions, certifications, and any voluntary compliance elections.
• Affected institutions should inventory overlapping deposit-insurance determination, depositor-record, provisional-hold, data-format, and reporting capabilities to identify systems that could potentially be consolidated if the proposal is finalized.
• Technology, operations, deposit administration, legal, resolution-planning, and third-party-risk teams should assess whether current data lineage, account ownership and capacity coding, reconciliation, testing, and FDIC access processes would satisfy a revised standardized-record framework.
• Firms should consider submitting comments on the operational feasibility, treatment of affiliates and mergers, transition periods, testing expectations, treatment of custodial and pass-through accounts, and whether any proposed relief would create gaps in failure-day data availability.
• Institutions should continue complying with currently effective 12 CFR part 370 and 12 CFR 360.9 requirements until a final rule becomes effective and any applicable transition period expires.

What changed

The FDIC has proposed amendments concerning the framework used by large insured depository institutions to maintain depositor records and support rapid deposit-insurance determinations. Based on the FDIC’s accompanying policy direction and independent industry commentary, the proposal would likely preserve standardized depositor-record and data-access requirements while reducing or eliminating the need for institutions subject to 12 CFR part 370 to maintain separate, independent deposit-insurance determination systems.

Key dates

2026-10-29

The SEC announced charges against BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd and filed the related enforcement complaint in the U.S. District Court for the Northern District of California.

Suggested considerations

• Compliance teams may wish to review third-party crypto platforms, advisers, issuers, introducers, and promoters for unsupported claims that an SEC filing represents licensing, approval, endorsement, or authorization.
• Firms should consider independently verifying Form ADV, Form D, and other regulatory filings through official regulator databases and documenting the precise legal effect of each filing before relying on it in due diligence or investor communications.
• Marketing and financial-promotion controls may wish to test for claims of risk-free or guaranteed returns, extraordinary monthly performance, government approval, SEC registration, fake certificates, and statements that a Rule 506(c) filing authorizes operation of a crypto exchange.
• Firms with exposure to BG Wealth Sharing, DSJ Exchange, or associated promoters should consider escalating the relationship for legal, fraud, sanctions, counterparty, and suspicious-activity review and preserving relevant communications, transaction records, and onboarding materials.
• Investment advisers and other regulated firms may wish to assess whether referral, custody, payment, or platform relationships involving similar schemes create customer-protection, books-and-records, disclosure, or reputational risks.
• Compliance teams may wish to incorporate the related state and foreign warnings into typology monitoring, particularly indicators such as recruitment-based compensation, blocked withdrawals, advance exit or compliance fees, fake account balances, and periodic payments used to sustain investor confidence.

What changed

This is an enforcement action, not a new rule or generally applicable compliance requirement. The SEC alleges violations of the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934 by both entities, and violations of Sections 204(a) and 207 of the Investment Advisers Act of 1940 by BG Wealth. The SEC is seeking permanent injunctions, disgorgement with prejudgment interest, civil penalties against both entities, and conduct-based injunctions against BG Wealth.

Key dates

2026-10-28

FOMC statement released; target federal funds range maintained at 3.75% to 4.00% and ample-reserves policy continued.

Suggested considerations

• Compliance and risk teams may wish to record the October 28, 2026 target range of 3.75% to 4.00% and the 10-2 vote in regulatory change-management and market-risk records.
• Firms should consider reviewing interest-rate, basis, liquidity and funding-risk limits against scenarios involving a further 25-basis-point increase, including a possible December 2026 hike suggested by independent market commentary.
• Banks and other lenders may wish to assess the effect of persistently elevated rates on borrower affordability, refinancing risk, delinquency assumptions, fair-lending monitoring and customer communications.
• Treasury and finance teams should consider validating the treatment of the unchanged policy rate in transfer-pricing, liquidity-stress, valuation, hedge-accounting and capital-planning models.
• Broker-dealers, asset managers and leveraged funds may wish to reassess margin, collateral, redemption-liquidity and counterparty exposures under higher-for-longer rate scenarios.
• Compliance teams should consider monitoring the forthcoming FOMC implementation note and subsequent Federal Reserve communications for any operational details affecting reserve management or money-market conditions.
• Firms should consider documenting the distinction between this policy decision and a new regulatory rule: the statement contains no new prudential ratio, disclosure, reporting or customer-protection requirement.

What changed

The FOMC made no change to the federal funds target range, which remains 3.75% to 4.00%, and did not announce a change to its policy of maintaining ample reserves in the banking system. The statement upgraded its description of economic activity to expanding at a strong pace and characterized productivity growth and capital investment as strong or robust, while stating that inflation remains elevated. The Committee emphasized that it will assess additional information in determining the policy stance needed to return inflation to its 2% goal. Lisa D. Cook and Beth M.

Key dates

2026-10-20

Utah filed a state-court action against Kalshi entities and two Susquehanna trading firms, alleging violations of Utah gambling laws and seeking injunctive relief and recovery of profits.

2026-10-27

The CFTC announced its federal lawsuit against Utah and its commitment to block state enforcement affecting CFTC-registered prediction markets.

Suggested considerations

• Firms operating or supporting CFTC-registered event-contract markets should consider mapping their products, legal entities, affiliates, liquidity providers and customer-access arrangements against the Utah enforcement action and the CFTC’s requested injunction.
• Compliance teams may wish to monitor the federal case in the U.S. District Court for the District of Utah, the related Kalshi appeal, and the other state proceedings because the litigation may determine whether state gambling laws can be applied to federally regulated event contracts.
• Firms should consider preserving records supporting CFTC registration, designated-contract-market compliance, product listings, trade surveillance, customer eligibility, geolocation controls and communications concerning Utah residents.
• Market operators and intermediaries may wish to assess whether their current Utah access controls and disclosures remain appropriate in light of the conflicting federal and state positions, without assuming that the CFTC’s lawsuit presently provides a final safe harbor.
• Legal and regulatory teams may wish to distinguish CFTC-regulated transactions from unregulated or differently structured products, since the Commission’s position is directed at covered transactions on CFTC-regulated markets rather than all prediction, gaming or wagering activity.

What changed

The publication announces litigation rather than a new rule, supervisory requirement, or compliance deadline. The CFTC is asking a federal court to block Utah from investigating or enforcing state laws against transactions conducted on CFTC-regulated designated contract markets, including actions involving regulated entities’ affiliates and partners. The Commission’s stated legal position is that the Commodity Exchange Act gives it exclusive federal jurisdiction over these event contracts and preempts conflicting state restrictions.

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2026-09-30

The SEC issued the proposed rule, Release Nos. 33-11444, 34-106534, and IC-36351; this is the underlying proposal date, not an effective date for new obligations.

2026-10-05

The proposed rule was published in the Federal Register at 91 FR 63388.

2026-10-20

The SEC published a correction replacing the DATES section and confirming the comment deadline.

2026-12-04 Deadline

Comments on the proposed rule must be received by the SEC.

Suggested considerations

• Compliance teams may wish to calendar December 4, 2026 as the deadline for submitting comments to File No. S7-2026-34 and coordinate comments across legal, fund governance, distribution, operations, and investor-relations functions.
• Affected fund sponsors should consider assessing whether monthly or otherwise revised repurchase intervals, delayed initial repurchase offers, or more frequent discretionary repurchases would better align with portfolio liquidity and investor-liquidity expectations if the proposal is adopted.
• Registered closed-end funds and BDCs considering multiple share classes should consider mapping proposed Rule 18f-3 and Rule 17d-3 conditions against existing exemptive orders, board procedures, fee arrangements, allocation methodologies, distribution agreements, and conflict controls.
• Fund boards and advisers may wish to evaluate the anticipated written multiple-share-class plan, board approval requirements, class-level expense allocation, asset-based distribution and service-fee arrangements, and related disclosure controls.
• Operations and disclosure teams should consider a gap analysis for proposed changes to Form N-2, Form N-CEN, Form N-23c-3, shareholder reports, prospectus legends, expense examples, NAV and repurchase processing, and investor communications.
• Firms should continue treating the current Investment Company Act rules and existing exemptive orders as controlling until any final rule becomes effective and applicable transition or rescission provisions are issued.

What changed

The October 20, 2026 Federal Register correction replaces the prior DATES text in the October 5 proposal and expressly states that the release was published on October 5, 2026 and that comments must be received by December 4, 2026. The underlying proposal would amend Investment Company Act Rules 23c-3, 18f-3, and 17d-3 and related forms and rules to modernize interval-fund repurchase programs, including potentially allowing a first repurchase offer to be deferred for up to two years, monthly repurchase intervals, annual discretionary repurchases, and deduction of deferred sales loads from...

Key dates

2022-05-12

The CFTC filed its complaint against Alexandre and EminiFX, alleging fraudulent solicitation, misappropriation, and operation of an unregistered commodity pool.

2026-07-01

As of July 2026, the court-appointed receiver had returned more than $98 million to over 28,000 investors.

2026-10-19

The CFTC announced that the Southern District of New York had entered orders granting summary judgment, injunctive relief, and a civil monetary penalty against Alexandre and EminiFX.

Suggested considerations

• Compliance teams may wish to inventory products, investment clubs, managed accounts, and digital-asset offerings that pool customer contributions and obtain exposure to forex, futures, options, or other commodity interests.
• Firms should consider assessing whether their activities constitute operating a commodity pool or acting as a commodity pool operator or associated person under the Commodity Exchange Act and CFTC regulations, including whether registration or an available exemption is required.
• Firms should consider validating marketing claims about returns, automated trading, proprietary technology, trading results, and risk, with particular scrutiny of unusually high or consistent returns such as weekly performance representations.
• Compliance teams may wish to test segregation, custody, reconciliation, withdrawal, and use-of-funds controls to detect commingling, personal use of customer assets, payments to earlier investors, and unexplained transfers.
• Firms should consider maintaining evidence supporting reported performance, trading activity, investor statements, and asset ownership so that customer communications can be reconciled to underlying records.
• Digital-asset businesses may wish to review whether crypto terminology or a technology-focused structure obscures activities that remain subject to commodities, anti-fraud, registration, or customer-protection requirements.
• Firms should consider escalating suspected misappropriation, fabricated performance, or unregistered commodity-pool activity through applicable internal investigation, suspicious-activity, and regulatory-reporting processes.

What changed

This is a final enforcement outcome rather than a new rule or generally applicable regulatory amendment. The Southern District of New York entered summary judgment and injunctive relief against Alexandre and EminiFX, finding that the defendants made fraudulent representations, misappropriated investor funds, and operated as an unregistered commodity pool operator, with Alexandre acting in an unregistered associated-person capacity. The judgment imposes $228,576,962 of restitution, $15,049,500 of disgorgement subject to offset by restitution payments, and a $45,148,500 civil monetary penalty.

Key dates

2026-10-19

The proposed rule is published in the Federal Register as 91 FR 66022 and the public comment period begins.

2026-11-18 Deadline

Comments on the Notice of Proposed Rulemaking must be received by the CFTC.

Suggested considerations

• Compliance teams may wish to inventory sports-, political-, cultural-, and weather-related event contracts offered, intermediated, traded, or supported by the organization and document the current legal classification of each product.
• Firms may wish to assess whether affected activities could require CFTC registration, designated contract market or swap execution facility arrangements, swap data reporting, recordkeeping, customer-protection controls, business-conduct procedures, clearing or margin analysis, and applicable anti-manipulation and surveillance controls if the proposal is finalized.
• Platforms and intermediaries may wish to map product design, settlement terms, pricing, transferability, trading venue, customer type, and liquidity arrangements against the proposed swap definition and identify products whose classification is uncertain.
• Compliance teams may wish to monitor the separate CFTC treatment of casino-style gambling products and distinguish state- or tribally licensed sportsbook and casino wagers from market-traded event contracts; the companion treatment should not be assumed to apply to prediction-market products.
• Affected firms may wish to prepare comments addressing the scope of “event contract,” treatment of secondary-market trading, jurisdictional overlap with state gambling authorities, implementation timing, and any operational or cost impacts before the November 18, 2026 deadline.
• Legal and regulatory affairs teams may wish to track litigation and appeals concerning CFTC jurisdiction over prediction markets, because court developments could affect the interpretation or implementation of any final rule.

What changed

The Notice of Proposed Rulemaking, RIN 3038-AF82, would further define “swap” to explicitly include specified event contracts, including contracts tied to sports, politics, cultural events, and weather. The CFTC describes these instruments as financial products commonly understood in the trade to be swaps and seeks to resolve perceived ambiguity over their classification and regulatory jurisdiction.

Key dates

2026-10-19

The interim final rule becomes effective and 17 CFR 1.3 is amended to exclude qualifying casino-style gambling products from the CEA swap definition.

2026-11-18 Deadline

Comments on the interim final rule must be received by the CFTC through the specified submission channels.

Suggested considerations

• Firms offering sportsbook, casino, lottery, raffle, bingo, or other gaming products should consider documenting how each product satisfies both the Provider Test and Product Test, including the relevant state or tribal authorization and applicable gaming-law classification.
• Gaming operators should consider verifying that the provider is acting within the scope of its license or authorization and retaining evidence that the transaction is offered on house or other standardized terms rather than traded through a multilateral or individually negotiated market.
• Prediction-market operators, designated contract markets, swap execution facilities, swap dealers, and banks should consider reviewing event-linked products separately from traditional sportsbook wagers, with particular attention to venue, price formation, trading structure, and whether participants interact through competing bids and offers.
• Firms should consider reassessing products that combine sportsbook or casino-style features with exchange trading, bilateral dealer negotiation, or other market mechanisms, because the rule’s exclusion may not apply even where the underlying event resembles a conventional wager.
• Compliance teams may wish to update product inventories, legal opinions, customer disclosures, jurisdictional analyses, and surveillance or onboarding controls to reflect the distinction between authorized house wagers and exchange-traded event contracts.
• Interested parties should consider submitting comments to the CFTC on the Provider Test, the definition of transactions regulated as gaming or gambling, and alternative ways to distinguish swaps from traditional gambling products by November 18, 2026.
• Firms should consider separately assessing state gaming, tribal gaming, consumer-protection, tax, anti-money-laundering, and licensing requirements because exclusion from the CEA swap definition does not remove those obligations.

What changed

New 17 CFR 1.3(7) creates a two-part exclusion from the swap definition. Under the Provider Test, the product must be offered or entered into by a person licensed or otherwise authorized under state law or by a federally recognized Indian tribe under the Indian Gaming Regulatory Act, the provider must act within the scope of that authorization, and the transaction must be regulated as gaming or gambling under applicable state or tribal law.

Key dates

2026-10-15

The proposed rule is published in the Federal Register.

2026-12-14 Deadline

Public comments on the proposed amendments to 12 CFR parts 704 and 713 are due.

Suggested considerations

• Compliance teams may wish to review the proposal against existing policies and procedures under 12 CFR 704.18, 12 CFR 713, and 12 CFR 741.201, distinguishing provisions that would be removed from obligations that would remain.
• Credit unions should continue to maintain existing fidelity-bond coverage, deductibles, renewal processes, and NCUA-related approvals unless and until a final rule becomes effective.
• Boards and management may wish to assess whether current coverage remains adequate for fraud, dishonesty, theft, burglary, robbery, and other covered losses, and preserve documentation supporting the required board review.
• Credit unions and insurers may wish to evaluate whether the proposed flexibility in coverage amounts and deductibles affects policy terms, underwriting, renewal timing, or internal risk assessments.
• Interested parties may wish to submit comments by December 14, 2026, addressing the proposed treatment of coverage calculations, deductibles, bond forms, purchase and renewal procedures, and any transition or implementation concerns.

What changed

The proposal would amend 12 CFR part 713 and related corporate-credit-union requirements in 12 CFR 704.18 by eliminating or modifying prescriptive procedural requirements concerning fidelity-bond purchases and renewals, simplifying the rules governing coverage amounts and deductibles, and removing outdated requirements. The proposal would preserve the requirement that a federally insured credit union maintain adequate fidelity-bond coverage against losses involving fraud, dishonesty, theft, and other covered risks.

Key dates

2026-10-09

SEC issued the proposed amendments to Investment Company Act Rule 17a-7, Release No. IC-36358, File No. S7-2026-36.

2026-10-15

Proposed rule published in the Federal Register; the 60-day public-comment period begins.

2026-12-14 Deadline

Public comments are due, calculated as 60 days after Federal Register publication.

Suggested considerations

• Compliance teams may wish to inventory current and potential cross trades by asset class and valuation level, distinguishing Level 1, Level 2, and Level 3 positions and identifying fixed-income portfolios that could become eligible.
• Advisers may wish to design a documented pre-trade best-interest process for each participating registered fund, including consideration of open-market alternatives, alternative securities, and the option not to trade.
• Funds and advisers may wish to assess pricing-source governance, including unaffiliated-source due diligence, periodic reasonableness reviews, NAV-pricing consistency, and controls preventing use of amortized-cost values.
• CCOs may wish to map quarterly review, annual back-testing, subsequent-sale analysis, escalation, and reporting responsibilities across fund and adviser compliance functions.
• Boards and counsel may wish to assess amendments to Rule 38a-1 policies, board reporting, and governance materials in light of the proposed shift away from board-adopted Rule 17a-7 procedures.
• Operations and regulatory-reporting teams may wish to map internal asset classifications to Form N-PORT Item B.12 and Form N-MFP Item A.23, including controls for the preceding-12-month activity test and reconciliation of cross-trade and total purchases and sales.
• Records-management teams may wish to evaluate systems capable of retaining trade records, CCO review materials, and board reports for six years.
• Interested parties may wish to submit comments by the Federal Register deadline, addressing the 79 specific requests for comment, including Level 3 eligibility, bid-side NAV pricing, review frequency, scaling, and public-reporting impacts.

What changed

Eligible securities would expand from generally Level 1 securities with readily available market quotations to securities valued using inputs that are observable directly or indirectly, provided Level 2 inputs are the lowest level of inputs significant to measurement; Level 3 securities would remain excluded. The proposed independent current market price would be either the value used in the fund’s next NAV calculation on the trade date or a price the adviser reasonably determines represents current market value using one or more unaffiliated pricing sources, subject to periodic review.

Key dates

2021-01-01

Approximate beginning of the alleged delayed-allocation and cherry-picking conduct.

2023-10-31

Approximate end of the alleged conduct period.

2024-11-25

The SEC filed its civil complaint against Leech concerning the alleged allocation scheme.

2025-01-21

The district court reportedly stayed the SEC civil action pending resolution of the parallel criminal prosecution.

2026-06-05

The SEC instituted settled administrative proceedings against Western Asset, imposing a $100 million penalty and establishing a Fair Fund for affected investors.

2026-10-06

The SEC reported the consent resolution and final-judgment process against Leech, including a $3 million penalty, permanent injunctions and an officer-and-director bar.

Suggested considerations

• Firms should consider reviewing whether each block or derivatives trade is assigned to intended portfolios at or near execution, with documented reasons, approvals and timestamps for any necessary delay.
• Compliance teams may wish to test whether allocation systems and workflows prevent personnel from using intraday price movements, daily settlement prices or first-day performance to select recipient accounts.
• Firms should consider surveillance comparing execution time, allocation-entry time, settlement-price availability, subsequent performance and recipient portfolio across portfolio managers and strategies.
• Compliance teams may wish to investigate statistically significant differences in allocation latency, first-day gains and losses, reallocations, exception rates and benefits received by particular portfolios, fee arrangements or clients.
• Advisers should consider reconciling written fair-allocation and reallocation procedures with actual operating practices, including practices followed by chief investment officers and other highly senior personnel.
• Firms should consider preserving allocation instructions and related communications from trading platforms, order-management systems, email, messaging tools and manual worksheets in a form suitable for supervisory review.
• Compliance teams may wish to enhance escalation procedures for delayed allocations, repeated reallocations, unexplained exceptions and material performance differences among similarly situated accounts.
• Advisers should consider reviewing client disclosures and policies describing pro rata, fair or equitable allocation methodologies against the firm’s actual allocation logic and exceptions.

What changed

This is an enforcement resolution, not a new rule or prospective compliance deadline. It reinforces that delayed post-execution allocation can create an Advisers Act antifraud and fiduciary-duty violation where the decision-maker can observe market or settlement-price information before assigning trades to client portfolios. The matter also signals that written allocation policies are insufficient if firms do not operate, test and supervise them effectively, particularly for senior investment personnel.

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2024-12-01

The OCC issued the December 2024 cease-and-desist order requiring Bank of America to address deficient BSA/AML controls; the publication does not specify the precise day of issuance.

2026-10-13

The OCC announced the $750 million civil money penalty and coordinated action with FinCEN.

Suggested considerations

• Compliance teams may wish to perform a documented gap assessment against 12 CFR 21.21 and 12 CFR 21.11, including transaction monitoring, customer and activity risk coverage, escalation procedures, SAR timeliness and accuracy, and recordkeeping.
• Banks should consider testing whether potentially suspicious activity is consistently escalated to appropriately skilled investigators and whether alert disposition processes can demonstrate timely decisions on SAR filing.
• BSA officers and relevant personnel should consider competency-based training covering suspicious-activity identification, investigation, SAR preparation, trade-based money laundering indicators, and escalation responsibilities, with evidence of completion and effectiveness testing.
• Internal audit and independent testing functions may wish to assess whether their scope, expertise, sampling, issue validation, and reporting are capable of detecting systemic BSA/AML weaknesses rather than merely confirming policy existence.
• Management and boards of directors should consider reviewing BSA/AML remediation governance, resourcing, milestones, risk acceptance, issue escalation, and the treatment of repeated or overdue corrective actions.
• Banks with material trade finance, correspondent banking, card, payments, or cross-border activity should consider targeted testing for trade-based money laundering typologies and transaction-monitoring coverage gaps.
• Institutions operating under a consent order or cease-and-desist order should consider independently validating that remediation is complete and effective, rather than relying solely on management representations or closure of project milestones.
• Compliance teams may wish to compare their control framework with the broader market reading of the action: industry reporting characterized the case as a record penalty driven by systemic and longstanding failures, while professional commentary on the evolving BSA/AML framework emphasizes the distinction between establishing an effective program and maintaining it in operation.

What changed

The publication is an enforcement action, not a new generally applicable rule or safe harbor. It establishes a major OCC enforcement precedent that persistent failures to implement an effective BSA/AML program after a formal supervisory order can result in exceptionally large penalties, including where deficiencies affect transaction monitoring, SAR escalation and filing, personnel competence, training, and audit effectiveness.

Key dates

2026-10-13

Federal Register publication date for the ANPRM, published as 91 FR 64811 and document number 2026-20888.

2026-12-14 Deadline

Deadline for submitting comments to the CFTC on Regulation CTX, Regulation CAM, and the interpretation and implementation of CEA section 2(c)(2)(D).

Suggested considerations

• Compliance teams may wish to determine whether current or planned retail crypto products could constitute transactions covered by CEA section 2(c)(2)(D), including products described as spot, margin, leveraged, financed, perpetual, or otherwise structured to defer delivery.
• Firms should consider mapping current customer agreements, funding arrangements, custody models, delivery controls, and liquidation processes against the CFTC's preliminary positions on offers and actual delivery.
• Prospective venues may wish to assess the potential CAM operating model, including registration perimeter, governance, listing standards, market surveillance, position controls, execution, recordkeeping, cyber and system safeguards, proof-of-reserves, and customer-asset arrangements.
• FCMs, IBs, DCOs, custodians, and leverage providers should consider identifying the registrations, permissions, capital, segregation, margin, clearing, insolvency, and operational dependencies that a CAM structure could create.
• Crypto businesses may wish to prepare comments addressing the scope of section 2(c)(2)(D), the definition and practical test for actual delivery, treatment of fully paid open transactions, permissible crypto assets, and the allocation of responsibilities among CAMs, FCMs, DCOs, and leverage providers.
• Firms should monitor whether the CFTC follows the ANPRM with a formal proposed rule and should not treat the ANPRM as creating immediate registration, margin, reporting, or conduct obligations.
• Affected firms may wish to preserve evidence of product design, delivery capability, customer disclosures, surveillance controls, and legal analysis in anticipation of supervisory or enforcement scrutiny under the CFTC's stated interpretation of section 2(c)(2)(D).

What changed

The CFTC has published ANPRM RIN 3038-AF80, 91 FR 64811, concerning proposed Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets. Regulation CTX would seek to clarify when section 2(c)(2)(D) applies to crypto asset transactions, including the meaning of covered offers, actual delivery, and actual delivery of fully paid open transactions. Regulation CAM would create a crypto asset market subcategory of designated contract market registration under 17 CFR part 38, supported by related amendments or requirements under 17 CFR parts 1, 38, and 39.

Key dates

2026-10-09

CFTC announced publication of the NPRM concerning inclusion of certain event contracts in the definition of swap and identified a 30-day comment period beginning on Federal Register publication.

Suggested considerations

• Compliance teams may wish to inventory event contracts by underlying event, settlement structure, customer type, and current legal classification, including whether each product is a binary option, another swap, a future, a security-based swap, or a casino-style gambling product.
• Potential operators, DCMs, SEFs, registrants, trade associations, and affected customers should consider submitting written comments through Regulations.gov within 30 days after the NPRM is published in the Federal Register; the Federal Register publication date and resulting calendar deadline should be monitored because the CFTC release does not specify either date.
• Firms may wish to assess whether current exchange, venue, customer-eligibility, market-surveillance, anti-manipulation, product-certification, disclosure, margin, reporting, and recordkeeping controls would support treatment of relevant contracts as swaps under existing CFTC requirements.
• Operators currently relying on state licenses may wish to evaluate the potential need for DCM or SEF arrangements, CFTC registration, federal compliance infrastructure, and transitional management of overlapping state and federal obligations if the rule is finalized.
• DCMs and SEFs may wish to review product-listing governance against CEA section 5c(c)(5)(C), applicable core principles, and 17 CFR 40.2(c), including whether particular contracts are readily susceptible to manipulation or involve gaming or other activity contrary to the public interest.
• Legal and tax teams may wish to keep CEA classification separate from federal tax and information-reporting analysis, which the NPRM states will continue to depend on the Internal Revenue Code, Treasury regulations, and IRS guidance.
• Firms may wish to monitor the separate CFTC action concerning casino-style gambling products and assess how the two rulemakings interact for products near the boundary between event contracts and gambling wagers.

What changed

The NPRM, RIN 3038-AF82, would add proposed 17 CFR 1.3(Swap)(2)(i)(G): “Event contracts, including those based on sports-, politics-, cultural, and weather-related events.” The CFTC relies on several existing swap-definition provisions, including CEA section 1a(47)(A)(i), (ii), (iv), and (vi), covering options, transactions dependent on events with potential financial, economic, or commercial consequences, instruments commonly known as swaps, and combinations or permutations of covered instruments.

Key dates

2026-10-09

The CFTC announced the interim final rule.

Suggested considerations

• Firms should identify sportsbook, casino, lottery, bingo, raffle, and other wagering products in their portfolios and map each product against the provider, licensing, State or Tribal regulatory, and trading-venue conditions in 17 CFR 1.3(7).
• Licensed gaming operators should retain evidence that each relevant product is offered within the scope of the applicable State or Tribal authorization and is regulated as gaming or gambling under applicable law.
• Operators and market intermediaries should assess whether any product is traded on an exchange, board of trade, swap execution facility, or other multilateral or individually negotiated market, because that structure prevents reliance on the specific exclusion.
• Prediction-market and derivatives businesses should maintain a separate legal analysis for products that fail the exclusion; failure to qualify does not by itself establish that a product is a swap.
• CFTC-regulated market participants should compare the rule's house-versus-customer and price-formation distinctions with their event-contract inventories, exchange rules, clearing arrangements, and product approvals.
• Interested parties should consider submitting comments through Regulations.gov within 30 days after Federal Register publication, referencing RIN 3038-AF81 and the title "Further Definition of Swap to Exclude Casino-Style Gambling Products."
• Compliance teams should continue evaluating applicable State gaming, Tribal gaming, tax, consumer-protection, licensing, and other federal requirements because the rule addresses CEA classification only and does not displace those regimes.

What changed

The rule adds 17 CFR 1.3(7) to the definition of "Swap" and excludes an agreement, contract, or transaction offered or entered into by a person licensed or otherwise authorized under State law or by a federally recognized Indian tribe under the Indian Gaming Regulatory Act, 25 U.S.C. 2701 et seq., acting within the scope of that authorization and subject to State or Tribal gaming regulation. The product must not be traded on a board of trade, organized exchange, swap execution facility, or any other market where trades are executed multilaterally or are subject to individual negotiation.

Key dates

2026-10-09

SEC issued the proposal to amend Investment Company Act Rule 17a-7.

Suggested considerations

• Compliance teams may wish to determine which corporate, municipal and other fixed-income holdings are currently excluded from Rule 17a-7 cross-trading because they lack a readily available market quotation under the valuation-rule framework.
• Firms should consider assessing potential execution-cost savings, liquidity benefits and conflicts risks from expanded internal crossing, using the SEC’s indication that market impact is concentrated among larger fund families and that corporate-bond cross-trading materially declined after the valuation-rule compliance date.
• Registered fund advisers may wish to review pricing governance, independent price verification, best-execution analysis, allocation controls and conflict-management procedures in anticipation of any final rule.
• Firms may wish to map the data needed for the proposed aggregated cross-trade reporting and test whether existing order-management, compliance-monitoring and regulatory-reporting systems can capture it.
• Affected firms should consider submitting comments during the 60-day period after publication of the proposal in the Federal Register, particularly on eligible security classes, pricing methodologies, reporting granularity and oversight conditions.
• Until a final rule becomes effective, firms should continue applying the existing Section 17(a), Rule 17a-7 and Rule 2a-5 requirements and should not treat the proposal as a current exemption.

What changed

The proposal would amend Rule 17a-7, the exemption from Section 17(a) for specified purchases and sales between a registered investment company and certain affiliated persons. It would generally restore eligibility for cross-trading most fixed-income securities, which became substantially unavailable after the SEC’s adoption of the Investment Company Act valuation rule in 2020, while modernizing the conditions governing pricing and oversight to reflect more verifiable and transparent market pricing.

Key dates

2026-08-06

FDIC published the underlying proposed rule on extensions of credit to insiders in 91 FR 50730.

2026-10-05

Original comment-period closing date superseded by the extension.

2026-11-04 Deadline

Extended deadline for comments on the FDIC proposal under RIN 3064-AG26.

Suggested considerations

• Compliance teams may wish to review the August 6, 2026 proposal in 91 FR 50730 alongside the parallel Federal Reserve Regulation O proposal and identify differences affecting the institution's governance and lending processes.
• Affected institutions should consider submitting comments under RIN 3064-AG26 by November 4, 2026, particularly on the proposed $400,000 and $2 million thresholds, the interaction with the 5 percent statutory limitation, and the proposed five-year indexing methodology.
• Banks may wish to inventory current insider extensions of credit, board-approval events, exception controls, and related-party monitoring data to assess how the proposed thresholds would change approval volumes and control design.
• Compliance teams may wish to evaluate whether loan-origination, core-banking, employee-lending, board-reporting, and insider-identification systems can support revised thresholds and periodic indexed adjustments if the proposal is finalized.
• Institutions should continue applying the currently effective Federal Reserve Act requirements and existing 12 CFR 337 provisions until any final rule becomes effective; the comment-period extension does not change current compliance obligations.

What changed

The FDIC changed only the procedural deadline: the comment period originally scheduled to close October 5, 2026, now closes November 4, 2026. The underlying August 6, 2026 proposal remains unchanged and would increase the threshold for extensions of credit to executive officers not otherwise specifically authorized by section 22(g) of the Federal Reserve Act from $100,000 to $400,000.

Key dates

2026-10-08

Federal Reserve and OCC announced coordinated enforcement actions; the OCC imposed a $350 million civil money penalty on American Express National Bank and issued a cease-and-desist order. The Federal Reserve action applied to American Express Company and American Express Travel Related Services Company, Inc.

2027-01-06 Deadline

Approximate deadline for American Express National Bank to submit the OCC-required written Action Plan within 90 days of the October 8, 2026 order, subject to the order's day-counting conventions.

Suggested considerations

• Compliance teams may wish to reassess whether the institution's BSA/AML risk assessment adequately covers its largest and most economically significant products, customer segments, transaction channels, and trade-related activity.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and transaction-monitoring scenarios are appropriately calibrated to credit-card, charge-card, merchant, cross-border, and trade-based money-laundering risks.
• Management may wish to inventory staffing, subject-matter expertise, escalation capacity, data quality, model and rules governance, internal controls, independent testing, and BSA/AML training for employees and directors against the deficiencies identified in the coordinated orders.
• Compliance teams may wish to conduct a lookback of previously generated alerts and transactions to assess whether suspicious activity was timely investigated, escalated, documented, and reported through SARs, including whether systemic monitoring gaps affected historical activity.
• Boards and senior management should consider obtaining documented evidence that enterprise AML oversight is operating effectively at subsidiaries and that parent-level governance does not rely solely on narrow subsidiary or product risk assessments.
• Affected American Express entities should track the 90-day Action Plan submission requirement and prepare supporting remediation evidence, governance reporting, milestone tracking, and supervisory communications.
• Other regulated firms should consider treating the action as a supervisory signal that risk assessments, transaction monitoring, and SAR controls must be aligned to actual business volume and risk rather than to the products that are easiest to administer.

What changed

This is an enforcement action rather than a generally applicable new rule, but it establishes concrete remediation expectations for a large, complex card issuer. The coordinated OCC order requires American Express National Bank to submit, within 90 days of the October 8, 2026 order, an acceptable written Action Plan addressing all BSA/AML deficiencies and incorporating the order's substantive requirements; the OCC must provide prior written supervisory non-objection.

Key dates

2026-10-08

The OCC announced the cease-and-desist order and $350 million civil money penalty against American Express National Bank; the Federal Reserve announced a coordinated action against American Express Company and American Express Travel Related Services Company.

Suggested considerations

• Compliance teams may wish to reassess whether the BSA/AML risk assessment accurately reflects the institution's largest and most complex products, customer segments, payment flows, geographies, channels, and transaction types, rather than relying primarily on deposit-account risk.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and account-risk-rating processes provide sufficiently complete and reliable data for transaction monitoring and suspicious-activity reporting.
• Banks may wish to conduct a targeted lookback for trade-based money-laundering indicators in card, merchant, payment, cross-border, and related repayment activity, including activity involving insiders or connected accounts, and document escalation and reporting decisions.
• Compliance teams should consider validating that monitoring scenarios, alert thresholds, investigative workflows, case-management controls, quality assurance, and SAR filing processes can identify and report suspicious activity within applicable regulatory timeframes.
• Boards and senior management may wish to review whether BSA/AML staffing levels, expertise, reporting lines, technology, data governance, and independent-testing coverage are proportionate to the institution's size, complexity, and risk profile.
• Firms should consider strengthening role-based BSA/AML training for employees, directors, and senior management, with evidence of completion, competency, and periodic refreshers.
• Internal audit or another suitably independent function may wish to perform end-to-end testing of risk assessment, customer due diligence, monitoring, investigation, SAR decisioning, and governance controls, with tracked remediation and board-level reporting.
• U.S. banking organizations may wish to compare their programs against the OCC's findings and the market commentary emphasizing that the principal lesson is product-risk misalignment and the need for enterprise-wide controls, not merely remediation of isolated monitoring alerts.

What changed

This is an enforcement action and supervisory precedent, not a new generally applicable rule. The OCC required American Express National Bank to remediate a BSA/AML program that was not reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The findings specifically reinforce expectations that risk assessments cover the institution's actual product mix, including credit and charge cards; customer identification and customer due-diligence procedures support effective monitoring; transaction-monitoring and suspicious-activity reporting processes...

Key dates

2021-01-01

Beginning of the alleged cherry-picking period involving delayed allocations and disproportionate assignment of first-day gains and losses.

2023-10-31

End of the alleged cherry-picking period, described by the SEC as running through October 2023.

2024-11-01

The SEC filed its prior litigated district-court complaint against Leech; the source identifies November 2024 but does not specify the filing day.

2026-06-05

The SEC settled administrative proceedings against Western Asset, imposing a $100 million penalty, censure, cease-and-desist order, and Fair Fund process.

2026-10-06

The SEC announced its motion for entry of a consent final judgment against Leech; the judgment remains subject to court approval.

Suggested considerations

• Compliance teams may wish to review whether trade timestamps, allocation timestamps, order-entry records, and market settlement-price data permit detection of allocations made after material price movements are known.
• Firms should consider testing allocation controls for fairness and consistency across strategies, accounts, clients, and affiliated portfolios, including review of first-day gains and losses and unexplained deviations among portfolio managers.
• Firms should consider validating that written allocation, reallocation, and error-correction procedures are implemented in practice, with documented approvals, exception handling, and independent oversight.
• Compliance teams may wish to assess whether portfolio-manager trading and allocation practices diverge materially from peers or from client disclosures, and whether those differences trigger escalation, surveillance, or enhanced supervision.
• Investment advisers should consider reviewing supervisory arrangements for senior investment personnel, including evidence that surveillance alerts, exception reports, and known control weaknesses are investigated and remediated.
• Firms should consider preserving records sufficient to reconstruct the timing and rationale of trade placement, allocation, reallocation, and approval decisions, and reviewing whether disclosures accurately describe fair and equitable allocation practices.
• Affected firms may wish to monitor the court’s decision on the proposed Leech judgment and the administration of Western Asset’s Fair Fund; no general compliance deadline is stated in the publication.

What changed

This publication does not establish a new generally applicable rule; it advances a case-specific consent judgment, subject to court approval, against Leech. The proposed judgment includes a $3 million penalty, a permanent injunction against violations of the federal securities-law antifraud provisions, an officer-and-director bar, and a forthcoming associational bar. The related June 5, 2026 administrative settlement against Western Asset imposed a $100 million civil penalty, censure, and cease-and-desist order, with the penalty deposited into a Fair Fund for harmed investors.

Key dates

2026-10-06

Vice Chair Bowman delivered the speech announcing the Federal Reserve's planned five-region supervisory realignment and outlining proposed modernization initiatives.

2026-07-01

The revised Community Bank Leverage Ratio framework took effect, lowering the ratio from 9 percent to 8 percent.

2025-12-01

The FFIEC issued a request for information on streamlining the Call Report.

Suggested considerations

• Compliance teams may wish to monitor Federal Reserve, FDIC, OCC, and FFIEC proposals arising from the speech, particularly any proposal to index fixed-dollar thresholds, revise community-bank classifications, modify large-bank tailoring, or amend Regulation O.
• Community banks should consider assessing how a future increase in the Community Bank Leverage Ratio eligibility threshold or broader community-bank treatment could affect capital planning, reporting, examination scope, and supervisory expectations; the speech does not yet establish eligibility changes beyond the 8 percent ratio already effective July 1, 2026.
• Banks preparing mergers may wish to document the competitive effects of credit unions, nonbank lenders, Farm Credit institutions, branchless banks, and other local competitors in anticipation of possible changes to Federal Reserve merger analysis.
• Prospective de novo applicants should consider reviewing business plans, initial and ongoing capital assumptions, governance arrangements, and expected approval timelines against existing federal and state requirements while awaiting any clarification of standards or conditional-approval practices.
• Call Report filers may wish to review the December 2025 FFIEC request for information and preserve data on duplicative, low-value, or operationally burdensome reporting items for future comment opportunities.
• Banks may wish to map current supervisory issues and examination findings to material financial risks, recognizing that the Statement of Supervisory Operating Principles emphasizes prompt escalation and proportionate action rather than checklist-driven process findings.
• Community banks should consider comparing their third-party risk-management programs with the Federal Reserve's community-bank third-party risk-management guide and documenting due diligence, contract oversight, ongoing monitoring, and escalation practices.
• Boards and senior management may wish to track forthcoming CAMELS revisions and assess potential effects on management-rating governance, examination preparation, remediation prioritization, and communications with directors.

What changed

The Federal Reserve announced that it is beginning to realign its supervisory function into five geographic regions led by regional leaders accountable for all supervisory activity in each region, while retaining existing Reserve Bank staff and footprints. The speech states that the Board will later in 2026 consider increasing fixed-dollar asset thresholds in its regulations and establishing a five-year adjustment mechanism tied to inflation and economic growth.