Senior Managers / Governance in United States

Key dates

2026-11-05

CFTC issued the interpretation of the impartial access requirements in 17 CFR 38.151(b).

2026-12-05 Deadline

Thirty-day period expires for DCMs to cease domestic geographic restrictions that violate the impartial-access requirements or submit an explanation to the Division of Market Oversight why compliance is not feasible; the same period applies to addressing intermediary impediments or explaining why compliance is not feasible.

Suggested considerations

• DCMs should inventory all domestic geographic eligibility, onboarding, trading, product-access, and account-management restrictions and assess them against 17 CFR 38.151(b)'s requirements for impartial, transparent, and non-discriminatory access.
• DCMs should review whether state-based restrictions affect members, persons with trading privileges, independent software vendors, or access to particular products, including event contracts.
• DCMs should identify and review contractual, technical, and operational controls used by futures commission merchants, introducing brokers, and other intermediaries to determine whether they impose geographic restrictions inconsistent with the DCM's impartial-access requirements.
• DCMs should document the legal and operational basis for removing each restriction or, where removal is not feasible, prepare a fact-specific explanation for the Division of Market Oversight before the 30-day period expires.
• Compliance teams at intermediaries should map state-based geofencing, customer-location verification, product blocking, and position-management restrictions affecting access to DCM markets and assess whether those controls are required by applicable law, regulation, or court order.
• Affected firms should assess conflicts between the CFTC's interpretation and any state requirements or judicial orders, obtain legal analysis, and avoid treating the interpretation as automatically vacating an injunction or other binding court order.
• DCMs should retain evidence of governance review, intermediary oversight, customer communications, access testing, and remediation decisions in anticipation of possible fact-specific CFTC inquiry or enforcement.

What changed

The CFTC has applied the existing impartial-access requirements in 17 CFR 38.151(b) expressly to domestic geographic restrictions, including restrictions based on a market participant's state or location. DCMs must cease geographic restrictions that violate the rule within 30 days of the November 5, 2026 publication, or submit an explanation to the Division of Market Oversight stating why compliance is not feasible.

Key dates

2026-11-05

CFTC Division of Clearing and Risk issued the no-action letter and accompanying public release addressing trust companies used for daily settlements.

Suggested considerations

• Compliance teams may wish to identify any existing or proposed trust-company settlement arrangements and determine whether each arrangement is being governed under the DCO’s settlement-bank policies and procedures.
• DCOs should consider documenting that each trust company satisfies the applicable 17 CFR 39.14 settlement-bank criteria, including capitalization, creditworthiness, liquidity access, operational reliability, and regulatory status.
• Firms should consider reviewing account structures, settlement agreements, payment workflows, and legal opinions to confirm that transfers are irrevocable and unconditional no later than the time the relevant DCO or clearing-member account is debited or credited.
• DCOs may wish to assess credit, liquidity, concentration, and intraday settlement exposures arising from the use of each trust company and confirm that monitoring, escalation, collateral, and contingency arrangements remain adequate.
• Operations and resilience teams may wish to test the trust company’s connectivity, payment-failure procedures, recovery arrangements, and coordination with the DCO’s business-continuity and disaster-recovery plans.
• Legal and compliance teams should consider recording the no-action letter’s conditions and limits in the DCO’s regulatory inventory, noting that the relief is staff relief rather than a binding amendment to Part 39 and may not extend to materially different structures or facts.
• Clearing members may wish to confirm that their agreements with the DCO and trust company allocate settlement, segregation, insolvency, operational, and account-control risks consistently with the DCO’s approved procedures.

What changed

The letter provides staff no-action relief for a DCO that uses a trust company to conduct daily settlement, notwithstanding the distinction between a trust company and a settlement bank under the CFTC framework. It does not create a generally applicable exemption or amend 17 CFR Part 39; instead, it allows the arrangement provided the trust company is managed and controlled as a settlement bank.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2023-12-13

The SEC adopted the Treasury clearing amendments, including the trade-submission requirement implemented through Exchange Act Rule 17ad-22(e)(18)(iv)(A).

2026-10-30

The SEC issued exemptive relief for specified inter-affiliate and non-U.S. Treasury repo transactions.

2026-12-31 Deadline

Compliance date for applicable eligible secondary market cash transactions involving U.S. Treasury securities.

2027-06-30 Deadline

Compliance date for applicable eligible secondary market repo transactions involving U.S. Treasury securities.

Suggested considerations

• Firms should obtain and analyze the operative October 30, 2026 Section 36 exemptive order, including all limits, conditions, definitions, recordkeeping provisions, and any continuing reporting requirements.
• Compliance teams may wish to inventory all Treasury repo transactions by legal entity, counterparty location, direct-participant status, affiliate relationship, guarantee structure, and whether the transaction is market-facing or solely inter-affiliate.
• Firms should validate whether each proposed affiliate qualifies under Rule 17ad-22(a) as modified by the relief and confirm that the affiliate is not an investment company under Section 3 of the Investment Company Act of 1940.
• Broker-dealers and other direct participants should update trade-classification, order-management, confirmation, clearing-submission, exception-management, and surveillance controls to distinguish exempt transactions from transactions that must be submitted for clearing.
• Global firms should establish governance for monitoring any activity-based or volume-based limit applicable to non-U.S. repo relief, including data ownership, aggregation across affiliates and direct participants, calculation frequency, escalation thresholds, and evidence retained for supervisory review.
• Firms should continue implementation of the broader Treasury clearing framework and should not treat the relief as a basis for delaying preparations for the December 31, 2026 cash-market or June 30, 2027 repo compliance dates.
• Legal and compliance teams may wish to assess whether non-U.S. branches, foreign affiliates, guarantees by U.S. persons, or local-law requirements create additional obligations notwithstanding the SEC relief.

What changed

The relief applies to certain repo transactions involving non-U.S. counterparties, subject to specified limits and conditions. It also expands the inter-affiliate treatment for repos between a direct participant of a U.S. Treasury securities covered clearing agency and an affiliated entity that is not an investment company under Section 3 of the Investment Company Act of 1940, provided the affiliate otherwise meets the affiliated-counterparty definition in Rule 17ad-22(a).

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2026-09-30

The SEC issued the proposed rule, Release Nos. 33-11444, 34-106534, and IC-36351; this is the underlying proposal date, not an effective date for new obligations.

2026-10-05

The proposed rule was published in the Federal Register at 91 FR 63388.

2026-10-20

The SEC published a correction replacing the DATES section and confirming the comment deadline.

2026-12-04 Deadline

Comments on the proposed rule must be received by the SEC.

Suggested considerations

• Compliance teams may wish to calendar December 4, 2026 as the deadline for submitting comments to File No. S7-2026-34 and coordinate comments across legal, fund governance, distribution, operations, and investor-relations functions.
• Affected fund sponsors should consider assessing whether monthly or otherwise revised repurchase intervals, delayed initial repurchase offers, or more frequent discretionary repurchases would better align with portfolio liquidity and investor-liquidity expectations if the proposal is adopted.
• Registered closed-end funds and BDCs considering multiple share classes should consider mapping proposed Rule 18f-3 and Rule 17d-3 conditions against existing exemptive orders, board procedures, fee arrangements, allocation methodologies, distribution agreements, and conflict controls.
• Fund boards and advisers may wish to evaluate the anticipated written multiple-share-class plan, board approval requirements, class-level expense allocation, asset-based distribution and service-fee arrangements, and related disclosure controls.
• Operations and disclosure teams should consider a gap analysis for proposed changes to Form N-2, Form N-CEN, Form N-23c-3, shareholder reports, prospectus legends, expense examples, NAV and repurchase processing, and investor communications.
• Firms should continue treating the current Investment Company Act rules and existing exemptive orders as controlling until any final rule becomes effective and applicable transition or rescission provisions are issued.

What changed

The October 20, 2026 Federal Register correction replaces the prior DATES text in the October 5 proposal and expressly states that the release was published on October 5, 2026 and that comments must be received by December 4, 2026. The underlying proposal would amend Investment Company Act Rules 23c-3, 18f-3, and 17d-3 and related forms and rules to modernize interval-fund repurchase programs, including potentially allowing a first repurchase offer to be deferred for up to two years, monthly repurchase intervals, annual discretionary repurchases, and deduction of deferred sales loads from...

Key dates

2026-10-15

The proposed rule is published in the Federal Register.

2026-12-14 Deadline

Public comments on the proposed amendments to 12 CFR parts 704 and 713 are due.

Suggested considerations

• Compliance teams may wish to review the proposal against existing policies and procedures under 12 CFR 704.18, 12 CFR 713, and 12 CFR 741.201, distinguishing provisions that would be removed from obligations that would remain.
• Credit unions should continue to maintain existing fidelity-bond coverage, deductibles, renewal processes, and NCUA-related approvals unless and until a final rule becomes effective.
• Boards and management may wish to assess whether current coverage remains adequate for fraud, dishonesty, theft, burglary, robbery, and other covered losses, and preserve documentation supporting the required board review.
• Credit unions and insurers may wish to evaluate whether the proposed flexibility in coverage amounts and deductibles affects policy terms, underwriting, renewal timing, or internal risk assessments.
• Interested parties may wish to submit comments by December 14, 2026, addressing the proposed treatment of coverage calculations, deductibles, bond forms, purchase and renewal procedures, and any transition or implementation concerns.

What changed

The proposal would amend 12 CFR part 713 and related corporate-credit-union requirements in 12 CFR 704.18 by eliminating or modifying prescriptive procedural requirements concerning fidelity-bond purchases and renewals, simplifying the rules governing coverage amounts and deductibles, and removing outdated requirements. The proposal would preserve the requirement that a federally insured credit union maintain adequate fidelity-bond coverage against losses involving fraud, dishonesty, theft, and other covered risks.

Key dates

2026-10-09

SEC issued the proposed amendments to Investment Company Act Rule 17a-7, Release No. IC-36358, File No. S7-2026-36.

2026-10-15

Proposed rule published in the Federal Register; the 60-day public-comment period begins.

2026-12-14 Deadline

Public comments are due, calculated as 60 days after Federal Register publication.

Suggested considerations

• Compliance teams may wish to inventory current and potential cross trades by asset class and valuation level, distinguishing Level 1, Level 2, and Level 3 positions and identifying fixed-income portfolios that could become eligible.
• Advisers may wish to design a documented pre-trade best-interest process for each participating registered fund, including consideration of open-market alternatives, alternative securities, and the option not to trade.
• Funds and advisers may wish to assess pricing-source governance, including unaffiliated-source due diligence, periodic reasonableness reviews, NAV-pricing consistency, and controls preventing use of amortized-cost values.
• CCOs may wish to map quarterly review, annual back-testing, subsequent-sale analysis, escalation, and reporting responsibilities across fund and adviser compliance functions.
• Boards and counsel may wish to assess amendments to Rule 38a-1 policies, board reporting, and governance materials in light of the proposed shift away from board-adopted Rule 17a-7 procedures.
• Operations and regulatory-reporting teams may wish to map internal asset classifications to Form N-PORT Item B.12 and Form N-MFP Item A.23, including controls for the preceding-12-month activity test and reconciliation of cross-trade and total purchases and sales.
• Records-management teams may wish to evaluate systems capable of retaining trade records, CCO review materials, and board reports for six years.
• Interested parties may wish to submit comments by the Federal Register deadline, addressing the 79 specific requests for comment, including Level 3 eligibility, bid-side NAV pricing, review frequency, scaling, and public-reporting impacts.

What changed

Eligible securities would expand from generally Level 1 securities with readily available market quotations to securities valued using inputs that are observable directly or indirectly, provided Level 2 inputs are the lowest level of inputs significant to measurement; Level 3 securities would remain excluded. The proposed independent current market price would be either the value used in the fund’s next NAV calculation on the trade date or a price the adviser reasonably determines represents current market value using one or more unaffiliated pricing sources, subject to periodic review.

Key dates

2021-01-01

Approximate beginning of the alleged delayed-allocation and cherry-picking conduct.

2023-10-31

Approximate end of the alleged conduct period.

2024-11-25

The SEC filed its civil complaint against Leech concerning the alleged allocation scheme.

2025-01-21

The district court reportedly stayed the SEC civil action pending resolution of the parallel criminal prosecution.

2026-06-05

The SEC instituted settled administrative proceedings against Western Asset, imposing a $100 million penalty and establishing a Fair Fund for affected investors.

2026-10-06

The SEC reported the consent resolution and final-judgment process against Leech, including a $3 million penalty, permanent injunctions and an officer-and-director bar.

Suggested considerations

• Firms should consider reviewing whether each block or derivatives trade is assigned to intended portfolios at or near execution, with documented reasons, approvals and timestamps for any necessary delay.
• Compliance teams may wish to test whether allocation systems and workflows prevent personnel from using intraday price movements, daily settlement prices or first-day performance to select recipient accounts.
• Firms should consider surveillance comparing execution time, allocation-entry time, settlement-price availability, subsequent performance and recipient portfolio across portfolio managers and strategies.
• Compliance teams may wish to investigate statistically significant differences in allocation latency, first-day gains and losses, reallocations, exception rates and benefits received by particular portfolios, fee arrangements or clients.
• Advisers should consider reconciling written fair-allocation and reallocation procedures with actual operating practices, including practices followed by chief investment officers and other highly senior personnel.
• Firms should consider preserving allocation instructions and related communications from trading platforms, order-management systems, email, messaging tools and manual worksheets in a form suitable for supervisory review.
• Compliance teams may wish to enhance escalation procedures for delayed allocations, repeated reallocations, unexplained exceptions and material performance differences among similarly situated accounts.
• Advisers should consider reviewing client disclosures and policies describing pro rata, fair or equitable allocation methodologies against the firm’s actual allocation logic and exceptions.

What changed

This is an enforcement resolution, not a new rule or prospective compliance deadline. It reinforces that delayed post-execution allocation can create an Advisers Act antifraud and fiduciary-duty violation where the decision-maker can observe market or settlement-price information before assigning trades to client portfolios. The matter also signals that written allocation policies are insufficient if firms do not operate, test and supervise them effectively, particularly for senior investment personnel.

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2024-12-01

The OCC issued the December 2024 cease-and-desist order requiring Bank of America to address deficient BSA/AML controls; the publication does not specify the precise day of issuance.

2026-10-13

The OCC announced the $750 million civil money penalty and coordinated action with FinCEN.

Suggested considerations

• Compliance teams may wish to perform a documented gap assessment against 12 CFR 21.21 and 12 CFR 21.11, including transaction monitoring, customer and activity risk coverage, escalation procedures, SAR timeliness and accuracy, and recordkeeping.
• Banks should consider testing whether potentially suspicious activity is consistently escalated to appropriately skilled investigators and whether alert disposition processes can demonstrate timely decisions on SAR filing.
• BSA officers and relevant personnel should consider competency-based training covering suspicious-activity identification, investigation, SAR preparation, trade-based money laundering indicators, and escalation responsibilities, with evidence of completion and effectiveness testing.
• Internal audit and independent testing functions may wish to assess whether their scope, expertise, sampling, issue validation, and reporting are capable of detecting systemic BSA/AML weaknesses rather than merely confirming policy existence.
• Management and boards of directors should consider reviewing BSA/AML remediation governance, resourcing, milestones, risk acceptance, issue escalation, and the treatment of repeated or overdue corrective actions.
• Banks with material trade finance, correspondent banking, card, payments, or cross-border activity should consider targeted testing for trade-based money laundering typologies and transaction-monitoring coverage gaps.
• Institutions operating under a consent order or cease-and-desist order should consider independently validating that remediation is complete and effective, rather than relying solely on management representations or closure of project milestones.
• Compliance teams may wish to compare their control framework with the broader market reading of the action: industry reporting characterized the case as a record penalty driven by systemic and longstanding failures, while professional commentary on the evolving BSA/AML framework emphasizes the distinction between establishing an effective program and maintaining it in operation.

What changed

The publication is an enforcement action, not a new generally applicable rule or safe harbor. It establishes a major OCC enforcement precedent that persistent failures to implement an effective BSA/AML program after a formal supervisory order can result in exceptionally large penalties, including where deficiencies affect transaction monitoring, SAR escalation and filing, personnel competence, training, and audit effectiveness.

Key dates

2026-10-09

SEC issued the proposal to amend Investment Company Act Rule 17a-7.

Suggested considerations

• Compliance teams may wish to determine which corporate, municipal and other fixed-income holdings are currently excluded from Rule 17a-7 cross-trading because they lack a readily available market quotation under the valuation-rule framework.
• Firms should consider assessing potential execution-cost savings, liquidity benefits and conflicts risks from expanded internal crossing, using the SEC’s indication that market impact is concentrated among larger fund families and that corporate-bond cross-trading materially declined after the valuation-rule compliance date.
• Registered fund advisers may wish to review pricing governance, independent price verification, best-execution analysis, allocation controls and conflict-management procedures in anticipation of any final rule.
• Firms may wish to map the data needed for the proposed aggregated cross-trade reporting and test whether existing order-management, compliance-monitoring and regulatory-reporting systems can capture it.
• Affected firms should consider submitting comments during the 60-day period after publication of the proposal in the Federal Register, particularly on eligible security classes, pricing methodologies, reporting granularity and oversight conditions.
• Until a final rule becomes effective, firms should continue applying the existing Section 17(a), Rule 17a-7 and Rule 2a-5 requirements and should not treat the proposal as a current exemption.

What changed

The proposal would amend Rule 17a-7, the exemption from Section 17(a) for specified purchases and sales between a registered investment company and certain affiliated persons. It would generally restore eligibility for cross-trading most fixed-income securities, which became substantially unavailable after the SEC’s adoption of the Investment Company Act valuation rule in 2020, while modernizing the conditions governing pricing and oversight to reflect more verifiable and transparent market pricing.

Key dates

2026-08-06

FDIC published the underlying proposed rule on extensions of credit to insiders in 91 FR 50730.

2026-10-05

Original comment-period closing date superseded by the extension.

2026-11-04 Deadline

Extended deadline for comments on the FDIC proposal under RIN 3064-AG26.

Suggested considerations

• Compliance teams may wish to review the August 6, 2026 proposal in 91 FR 50730 alongside the parallel Federal Reserve Regulation O proposal and identify differences affecting the institution's governance and lending processes.
• Affected institutions should consider submitting comments under RIN 3064-AG26 by November 4, 2026, particularly on the proposed $400,000 and $2 million thresholds, the interaction with the 5 percent statutory limitation, and the proposed five-year indexing methodology.
• Banks may wish to inventory current insider extensions of credit, board-approval events, exception controls, and related-party monitoring data to assess how the proposed thresholds would change approval volumes and control design.
• Compliance teams may wish to evaluate whether loan-origination, core-banking, employee-lending, board-reporting, and insider-identification systems can support revised thresholds and periodic indexed adjustments if the proposal is finalized.
• Institutions should continue applying the currently effective Federal Reserve Act requirements and existing 12 CFR 337 provisions until any final rule becomes effective; the comment-period extension does not change current compliance obligations.

What changed

The FDIC changed only the procedural deadline: the comment period originally scheduled to close October 5, 2026, now closes November 4, 2026. The underlying August 6, 2026 proposal remains unchanged and would increase the threshold for extensions of credit to executive officers not otherwise specifically authorized by section 22(g) of the Federal Reserve Act from $100,000 to $400,000.

Key dates

2026-10-08

Federal Reserve and OCC announced coordinated enforcement actions; the OCC imposed a $350 million civil money penalty on American Express National Bank and issued a cease-and-desist order. The Federal Reserve action applied to American Express Company and American Express Travel Related Services Company, Inc.

2027-01-06 Deadline

Approximate deadline for American Express National Bank to submit the OCC-required written Action Plan within 90 days of the October 8, 2026 order, subject to the order's day-counting conventions.

Suggested considerations

• Compliance teams may wish to reassess whether the institution's BSA/AML risk assessment adequately covers its largest and most economically significant products, customer segments, transaction channels, and trade-related activity.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and transaction-monitoring scenarios are appropriately calibrated to credit-card, charge-card, merchant, cross-border, and trade-based money-laundering risks.
• Management may wish to inventory staffing, subject-matter expertise, escalation capacity, data quality, model and rules governance, internal controls, independent testing, and BSA/AML training for employees and directors against the deficiencies identified in the coordinated orders.
• Compliance teams may wish to conduct a lookback of previously generated alerts and transactions to assess whether suspicious activity was timely investigated, escalated, documented, and reported through SARs, including whether systemic monitoring gaps affected historical activity.
• Boards and senior management should consider obtaining documented evidence that enterprise AML oversight is operating effectively at subsidiaries and that parent-level governance does not rely solely on narrow subsidiary or product risk assessments.
• Affected American Express entities should track the 90-day Action Plan submission requirement and prepare supporting remediation evidence, governance reporting, milestone tracking, and supervisory communications.
• Other regulated firms should consider treating the action as a supervisory signal that risk assessments, transaction monitoring, and SAR controls must be aligned to actual business volume and risk rather than to the products that are easiest to administer.

What changed

This is an enforcement action rather than a generally applicable new rule, but it establishes concrete remediation expectations for a large, complex card issuer. The coordinated OCC order requires American Express National Bank to submit, within 90 days of the October 8, 2026 order, an acceptable written Action Plan addressing all BSA/AML deficiencies and incorporating the order's substantive requirements; the OCC must provide prior written supervisory non-objection.

Key dates

2026-10-08

The OCC announced the cease-and-desist order and $350 million civil money penalty against American Express National Bank; the Federal Reserve announced a coordinated action against American Express Company and American Express Travel Related Services Company.

Suggested considerations

• Compliance teams may wish to reassess whether the BSA/AML risk assessment accurately reflects the institution's largest and most complex products, customer segments, payment flows, geographies, channels, and transaction types, rather than relying primarily on deposit-account risk.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and account-risk-rating processes provide sufficiently complete and reliable data for transaction monitoring and suspicious-activity reporting.
• Banks may wish to conduct a targeted lookback for trade-based money-laundering indicators in card, merchant, payment, cross-border, and related repayment activity, including activity involving insiders or connected accounts, and document escalation and reporting decisions.
• Compliance teams should consider validating that monitoring scenarios, alert thresholds, investigative workflows, case-management controls, quality assurance, and SAR filing processes can identify and report suspicious activity within applicable regulatory timeframes.
• Boards and senior management may wish to review whether BSA/AML staffing levels, expertise, reporting lines, technology, data governance, and independent-testing coverage are proportionate to the institution's size, complexity, and risk profile.
• Firms should consider strengthening role-based BSA/AML training for employees, directors, and senior management, with evidence of completion, competency, and periodic refreshers.
• Internal audit or another suitably independent function may wish to perform end-to-end testing of risk assessment, customer due diligence, monitoring, investigation, SAR decisioning, and governance controls, with tracked remediation and board-level reporting.
• U.S. banking organizations may wish to compare their programs against the OCC's findings and the market commentary emphasizing that the principal lesson is product-risk misalignment and the need for enterprise-wide controls, not merely remediation of isolated monitoring alerts.

What changed

This is an enforcement action and supervisory precedent, not a new generally applicable rule. The OCC required American Express National Bank to remediate a BSA/AML program that was not reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The findings specifically reinforce expectations that risk assessments cover the institution's actual product mix, including credit and charge cards; customer identification and customer due-diligence procedures support effective monitoring; transaction-monitoring and suspicious-activity reporting processes...

Key dates

2021-01-01

Beginning of the alleged cherry-picking period involving delayed allocations and disproportionate assignment of first-day gains and losses.

2023-10-31

End of the alleged cherry-picking period, described by the SEC as running through October 2023.

2024-11-01

The SEC filed its prior litigated district-court complaint against Leech; the source identifies November 2024 but does not specify the filing day.

2026-06-05

The SEC settled administrative proceedings against Western Asset, imposing a $100 million penalty, censure, cease-and-desist order, and Fair Fund process.

2026-10-06

The SEC announced its motion for entry of a consent final judgment against Leech; the judgment remains subject to court approval.

Suggested considerations

• Compliance teams may wish to review whether trade timestamps, allocation timestamps, order-entry records, and market settlement-price data permit detection of allocations made after material price movements are known.
• Firms should consider testing allocation controls for fairness and consistency across strategies, accounts, clients, and affiliated portfolios, including review of first-day gains and losses and unexplained deviations among portfolio managers.
• Firms should consider validating that written allocation, reallocation, and error-correction procedures are implemented in practice, with documented approvals, exception handling, and independent oversight.
• Compliance teams may wish to assess whether portfolio-manager trading and allocation practices diverge materially from peers or from client disclosures, and whether those differences trigger escalation, surveillance, or enhanced supervision.
• Investment advisers should consider reviewing supervisory arrangements for senior investment personnel, including evidence that surveillance alerts, exception reports, and known control weaknesses are investigated and remediated.
• Firms should consider preserving records sufficient to reconstruct the timing and rationale of trade placement, allocation, reallocation, and approval decisions, and reviewing whether disclosures accurately describe fair and equitable allocation practices.
• Affected firms may wish to monitor the court’s decision on the proposed Leech judgment and the administration of Western Asset’s Fair Fund; no general compliance deadline is stated in the publication.

What changed

This publication does not establish a new generally applicable rule; it advances a case-specific consent judgment, subject to court approval, against Leech. The proposed judgment includes a $3 million penalty, a permanent injunction against violations of the federal securities-law antifraud provisions, an officer-and-director bar, and a forthcoming associational bar. The related June 5, 2026 administrative settlement against Western Asset imposed a $100 million civil penalty, censure, and cease-and-desist order, with the penalty deposited into a Fair Fund for harmed investors.

Key dates

2026-10-06

Vice Chair Bowman delivered the speech announcing the Federal Reserve's planned five-region supervisory realignment and outlining proposed modernization initiatives.

2026-07-01

The revised Community Bank Leverage Ratio framework took effect, lowering the ratio from 9 percent to 8 percent.

2025-12-01

The FFIEC issued a request for information on streamlining the Call Report.

Suggested considerations

• Compliance teams may wish to monitor Federal Reserve, FDIC, OCC, and FFIEC proposals arising from the speech, particularly any proposal to index fixed-dollar thresholds, revise community-bank classifications, modify large-bank tailoring, or amend Regulation O.
• Community banks should consider assessing how a future increase in the Community Bank Leverage Ratio eligibility threshold or broader community-bank treatment could affect capital planning, reporting, examination scope, and supervisory expectations; the speech does not yet establish eligibility changes beyond the 8 percent ratio already effective July 1, 2026.
• Banks preparing mergers may wish to document the competitive effects of credit unions, nonbank lenders, Farm Credit institutions, branchless banks, and other local competitors in anticipation of possible changes to Federal Reserve merger analysis.
• Prospective de novo applicants should consider reviewing business plans, initial and ongoing capital assumptions, governance arrangements, and expected approval timelines against existing federal and state requirements while awaiting any clarification of standards or conditional-approval practices.
• Call Report filers may wish to review the December 2025 FFIEC request for information and preserve data on duplicative, low-value, or operationally burdensome reporting items for future comment opportunities.
• Banks may wish to map current supervisory issues and examination findings to material financial risks, recognizing that the Statement of Supervisory Operating Principles emphasizes prompt escalation and proportionate action rather than checklist-driven process findings.
• Community banks should consider comparing their third-party risk-management programs with the Federal Reserve's community-bank third-party risk-management guide and documenting due diligence, contract oversight, ongoing monitoring, and escalation practices.
• Boards and senior management may wish to track forthcoming CAMELS revisions and assess potential effects on management-rating governance, examination preparation, remediation prioritization, and communications with directors.

What changed

The Federal Reserve announced that it is beginning to realign its supervisory function into five geographic regions led by regional leaders accountable for all supervisory activity in each region, while retaining existing Reserve Bank staff and footprints. The speech states that the Board will later in 2026 consider increasing fixed-dollar asset thresholds in its regulations and establishing a five-year adjustment mechanism tied to inflation and economic growth.

Key dates

2026-10-06

The proposed rule was published in the Federal Register at 91 FR 63676 and the comment period opened.

2026-12-07 Deadline

Comments on the proposed rule are due to the SEC.

Suggested considerations

• Compliance teams may wish to determine whether existing or proposed fund products could use the regulated-fund performance-compensation pathway and map each arrangement against the proposed 20% net-gains cap, specified-period methodology, governance requirements, and board-determination condition.
• Advisers and fund sponsors should consider inventorying current performance-fee arrangements and identifying clients who could become eligible under the proposed accredited-investor route, without treating the proposal as authority to implement changes before adoption and an applicable compliance date.
• Fund sponsors may wish to assess the operational and disclosure impact of separately reporting performance-based compensation in Forms N-1A, N-2, and N-CSR, including fee-table, prospectus, financial-reporting, and board-material changes.
• Adviser compliance programs should consider reviewing Rule 205-3 eligibility controls, investor-classification procedures, accredited-investor evidence, client look-through analysis, and controls for the related Rule 203A-3, Rule 204-3, and Form ADV amendments.
• Fund boards and advisers may wish to evaluate how performance-fee proposals would affect fiduciary-duty analysis, conflicts management, valuation, incentive alignment, investor communications, and approval documentation.
• Affected firms should consider submitting comments by December 7, 2026, particularly on the 20% cap, specified performance period, governance conditions, disclosure design, accredited-investor eligibility, and transition or compliance-period issues.

What changed

Proposed amendments to Investment Advisers Act Rule 205-3 would create an additional route for registered investment advisers to receive compensation based on capital gains or capital appreciation from registered management investment companies and business development companies, collectively referred to as regulated funds.

Key dates

2026-08-27

The FDIC Board unanimously approved the final rule on unsafe or unsound practices and MRAs and the interim final rule on Road to Housing Act reciprocal deposits by notational vote.

Suggested considerations

• Compliance teams may wish to inventory open MRAs, supervisory recommendations, and section 8 enforcement matters and assess whether each matter satisfies the new material-harm, Deposit Insurance Fund risk, prudent-operation, or legal-violation criteria.
• Banks should consider mapping existing policies, procedures, reporting controls, documentation findings, and governance issues to the new distinction between MRAs, supervisory observations, and other violations, while retaining controls for matters that could affect capital, asset quality, earnings, liquidity, market-risk sensitivity, consumer outcomes, or receivership risk.
• Management and board committees may wish to prepare for examiner requests for the objective facts, risk analysis, and reasoning supporting any MRA or unsafe-or-unsound-practice conclusion, including evidence of how the bank assessed reasonably foreseeable conditions.
• Banks using reciprocal deposits should consider recalculating their permissible nonbrokered reciprocal-deposit capacity under the tiered liability formula and updating brokered-deposit classification, liquidity, deposit reporting, internal limits, and regulatory reporting controls.
• Potential agent institutions should verify their eligibility under the revised definition, including the applicable capital and examination-rating requirements and the broadened CAMELS-based criteria.
• Treasury, balance-sheet management, and deposit operations teams may wish to model the effect of the expanded reciprocal-deposit exclusion on funding concentration, liquidity stress assumptions, deposit pricing, and brokered-deposit monitoring.
• Legal and regulatory-affairs teams should monitor the Federal Register publication of both rules, confirm the effective dates, review any interim-final-rule comment opportunity, and determine whether implementation or comments are appropriate.
• Banks should consider reviewing examiner lookback requests and suspicious-activity review scopes against the related OCC examination guidance, which generally limits lookbacks involving failures to detect or report suspicious activity to one year or less unless heightened approval is obtained.

What changed

The final supervisory rule defines an unsafe or unsound practice as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and that, if continued, is likely to materially harm the bank's financial condition or present a material risk of loss to the Deposit Insurance Fund, or that has materially harmed the bank's financial condition.

Key dates

2026-08-27

The OCC issued Bulletin 2026-42 announcing the notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to inventory open and recently closed MRAs arising from alleged legal or regulatory violations and assess whether each matter would satisfy one or more of the proposed substantive-violation criteria.
• Firms should consider strengthening documentation linking examination findings to duration, frequency, systemic characteristics, financial-condition effects, books-and-records impacts, customer harm, restitution, or insider misconduct.
• Banks may wish to separate remediation plans for legal or regulatory violations from broader supervisory enhancements, because the proposal would limit examiner authority over technical violations to directing correction of the violation itself.
• Compliance and examination-management teams should consider preparing comments or internal positions on the undefined terms more than minimal, systemic, pattern, and meaningfully impact, including how those terms should be applied to isolated but high-severity events.
• Management may wish to review escalation thresholds so that technical-violation treatment does not result in under-escalation of recurring findings that could become systemic or satisfy the proposed substantive criteria.
• Banks should monitor the Federal Register publication of the notice of proposed rulemaking and calculate the 30-day comment period from that publication date rather than from the OCC bulletin date.
• Legal and regulatory-change teams may wish to assess this proposal alongside the OCC-FDIC final rule and related supervisory reforms concerning unsafe or unsound practices, MRAs, and material financial risk, while treating the proposal as nonfinal until adopted.

What changed

The proposed rule would provide that the OCC may issue an MRA for a violation of a banking or banking-related law or regulation only when the violation is substantive. A violation would be substantive when its nature, duration, frequency, or severity could meaningfully impact the bank or its customers, and at least one of five criteria would need to be met: the violation is systemic or constitutes a pattern; it has had or could reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the bank's financial condition; it has had or could reasonably be expected...

Key dates

2026-08-27

OCC issued revised PPM 5310-3 and PPM 5400-11; PPM 5310-3 replaces the May 25, 2023 manual, PPM 5400-11 replaces the February 27, 2026 version, and OCC Bulletin 2023-16 is rescinded.

Suggested considerations

• Compliance teams may wish to map open MRAs, enforcement orders, capital directives, and supervisory findings against the new material-harm, Deposit Insurance Fund risk, and substantive-violation thresholds.
• Banks should consider reviewing issue-management taxonomies and governance procedures so that MRAs, other violations, and supervisory observations are recorded and escalated according to their distinct consequences.
• Board and committee reporting processes may warrant review because supervisory observations do not automatically require board presentation or a corrective-action plan, whereas MRAs and enforcement actions remain subject to formal remediation and validation expectations.
• Large and complex banks should consider reassessing whether deficiencies that might previously have produced a community-bank-level supervisory response could receive faster escalation under the revised tailoring framework.
• Banks with existing enforcement actions may wish to assess whether their remediation evidence demonstrates substantial compliance with the essential requirements of each order and whether remaining issues are minor and isolated.
• Capital management teams may wish to review procedures for the institution of and termination of individual minimum capital ratios under the revised enforcement manual.
• Legal and regulatory change teams should monitor Federal Register publication of the joint OCC-FDIC final rule and calculate the actual effective date rather than relying on the bulletin date.
• Internal audit and compliance functions may wish to preserve objective factual support for responses to MRAs and other supervisory communications, particularly where the bank believes an issue does not meet the new risk-based threshold.

What changed

Revised PPM 5310-3 replaces the May 25, 2023 version and structures the OCC enforcement framework around escalation, tailoring, and focus. The OCC generally intends to provide banks an opportunity to remediate deficiencies through supervision before initiating a Section 8 enforcement action, although it retains authority to act at any time when legally supportable and warranted.

Key dates

2026-08-27

OCC revised PPM 5310-3 and PPM 5400-11, issued Bulletin 2026-41, and published the proposed rulemaking notice concerning substantive and technical violations. The proposed rule's 30-day comment period begins only upon Federal Register publication.

Suggested considerations

• Compliance teams may wish to map open and recently closed MRAs and enforcement actions against the revised material-financial-risk threshold and the stated tailoring factors of capital structure, complexity, activities, and asset size.
• Banks should consider documenting objective facts, legal violations, financial-risk consequences, customer impact, duration, frequency, severity, and remediation status supporting the classification and closure of examination findings.
• Large and complex banks may wish to reassess escalation risk because the OCC expressly permits enforcement action for practices that might not produce the same response at a community bank.
• Banks should consider reviewing corrective-action plans to confirm that each action is directly tied to a specific deficiency and is proportionate to the risk, while preserving evidence of substantial compliance with existing orders.
• Compliance teams may wish to distinguish substantive violations from potential technical violations in issue-management inventories, including systemic or repeated conduct, customer restitution, books-and-records impacts, financial-condition effects, and insider misconduct.
• Banks should consider monitoring the Federal Register for publication of the proposed rule and calculating the 30-day comment period from that publication date; affected institutions may wish to submit comments on the proposed substantive-versus-technical framework.
• Examiners may identify lower-level weaknesses as supervisory observations rather than MRAs; banks should consider maintaining internal governance and risk records for such observations without assuming that the OCC may require a board action plan or track remediation in the same manner as an MRA.

What changed

Revised PPM 5310-3, Bank Enforcement Action and Related Matters, replaces the May 25, 2023 version and emphasizes escalation, tailoring, and focused corrective action. The OCC generally expects to provide a bank an opportunity to remediate deficiencies through supervision before taking an enforcement action under section 8 of the Federal Deposit Insurance Act, although it retains authority to act at any time when legally supportable.

Key dates

2026-08-27

OCC and FDIC issued the joint final rule through OCC Bulletin 2026-40. The bulletin applies to all OCC-supervised banks; it does not state the Federal Register publication date, effective date, or a firm compliance deadline.

Suggested considerations

• Firms should identify the final rule’s Federal Register publication and effective date, because the OCC bulletin itself does not state either date or a compliance deadline, and should monitor OCC and FDIC implementation guidance before relying on any transition treatment.
• Compliance teams may wish to inventory open MRAs, supervisory recommendations, enforcement matters, and examination findings and map each item to the final rule’s material-financial-risk, DIF-risk, actual-violation, or already-caused-harm criteria.
• Firms should consider separating board-level MRA remediation obligations from discretionary management responses to supervisory observations and documenting why a weakness is treated under one category rather than another.
• Risk and compliance functions may wish to enhance evidence files supporting assessments of likelihood, materiality, current and reasonably foreseeable conditions, and impacts on capital, asset quality, earnings, liquidity, and market-risk sensitivity.
• Banks should consider documenting how supervisory requirements and remediation plans are tailored to asset size, complexity, activities, capital structure, and other financial-risk factors, particularly where the institution has heightened systemic, concentration, liquidity, or operational complexity.
• Legal and compliance teams may wish to distinguish actual violations of banking or banking-related laws and regulations from prudential weaknesses, because an actual violation can support an MRA without separately satisfying the prudent-operation and material-risk test.
• Boards and senior management should consider reviewing governance procedures so that MRAs receive required escalation and tracking while supervisory observations are clearly identified as non-binding potential enhancements.
• Firms should consider preparing a process for requesting and retaining the objective facts and reasoning underlying an MRA or unsafe-and-unsound-practice determination, as the rule requires examiners to share that basis.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either is likely, if continued, to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. “Likely” requires more than a merely possible risk; relevant financial-condition effects include impacts on capital, asset quality, earnings, liquidity, and sensitivity to market risk.

Key dates

2026-08-27

OCC and FDIC issued the final rule and OCC published Bulletin 2026-40 describing its application to OCC-supervised banks.

Suggested considerations

• Compliance teams may wish to map existing and anticipated MRAs, enforcement commitments, supervisory recommendations, and examination findings against the new material-financial-risk and actual-violation criteria.
• Firms should consider separating board-level corrective-action items from nonbinding supervisory observations and documenting why each issue does or does not meet the MRA threshold.
• Risk and compliance functions may wish to update issue-taxonomy and escalation procedures to assess impacts on capital, asset quality, earnings, liquidity, sensitivity to market risk, and the Deposit Insurance Fund.
• Banks should consider retaining objective evidence and documented reasoning supporting materiality assessments, including institution-specific factors such as asset size, complexity, activities, and capital structure.
• Management and boards may wish to review outstanding policies, process, and documentation findings to determine whether they remain mandatory remediation matters, are better treated as supervisory observations, or independently constitute violations of banking or banking-related law.
• OCC-supervised banks should monitor the related examination guidance and assess whether planned lookbacks, independent-consultant requirements, or suspicious-activity review scopes are affected by the revised supervisory approach described in industry reporting.
• Firms should track Federal Register publication and calculate the 60-day effective date once publication occurs; the August 27, 2026 announcement date is not itself the effective date.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either, if continued, is likely to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. Relevant financial-condition impacts include capital, asset quality, earnings, liquidity, and sensitivity to market risk; reputation concerns unrelated to financial condition are excluded.

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2022-12-23

The SDNY entered the initial consent orders finding Ellison liable on two CFTC fraud counts and Wang liable on one fraud count; the trading and registration bans run from this date.

2026-08-19

The CFTC announced entry of the supplemental consent orders, continued cooperation requirements, and final sanctions resolving its enforcement actions against Ellison and Wang.

Suggested considerations

• Compliance teams may wish to update individual sanctions, registration-eligibility, and trading-eligibility records for Ellison and Wang, using December 23, 2022 as the start date for the applicable bans.
• CFTC registrants should consider screening applicants, employees, directors, officers, consultants, and controlled-account traders against the specific five-year trading prohibitions and registration prohibitions before permitting covered activity.
• Firms should consider obtaining and reviewing the operative supplemental and initial consent orders to determine the precise scope of prohibited trading, registration, and cooperation-related provisions rather than relying only on the press release.
• Digital asset and derivatives firms may wish to retain evidence of due diligence and escalation decisions concerning former FTX or Alameda personnel, counterparties, and beneficial owners.
• Compliance teams may wish to assess whether the resolution's treatment of substantial cooperation and the absence of additional monetary relief creates a relevant precedent for internal investigations, voluntary cooperation, document preservation, and regulator-engagement protocols.
• Firms should continue treating the permanent antifraud injunctions under Commodity Exchange Act Section 6(c)(1) and CFTC Regulation 180.1 as conduct restrictions applicable to Ellison and Wang; the resolution does not create a general exemption from those provisions for other market participants.
• Affected firms may wish to coordinate CFTC, SEC, bankruptcy, and criminal-case screening because the CFTC sanctions are distinct from the SEC officer-and-director restrictions and the criminal forfeiture order.

What changed

The supplemental consent orders finalize the CFTC's actions against Ellison and Wang in conjunction with their initial December 23, 2022 consent orders. Ellison is subject to a five-year trading ban and a 10-year registration ban; Wang is subject to a five-year trading ban and an eight-year registration ban. Both must continue cooperating with the Commission and remain permanently enjoined from violating the antifraud provisions charged under the Commodity Exchange Act and CFTC regulations. The bans run from the date of the initial consent orders rather than from August 19, 2026.

Key dates

2025-09-10

Tricolor and affiliates filed for Chapter 7 bankruptcy and moved toward liquidation.

2025-12-17

The U.S. Attorney’s Office for the Southern District of New York announced criminal charges against Tricolor executives in connection with the alleged fraud.

2026-08-18

The SEC announced the civil enforcement action against Daniel Chu, Jerome Kollar, and Ameryn Seibold in the U.S. District Court for the Southern District of New York.

Suggested considerations

• Firms should consider performing a targeted review of whether the same receivable, loan, vehicle, inventory item, or other asset can be pledged across multiple warehouse facilities, securitizations, lenders, or managed accounts, including through affiliates and special-purpose vehicles.
• Compliance teams may wish to test collateral eligibility and borrowing-base reporting back to source-level records, payment histories, lien and ownership data, servicing systems, and independent third-party evidence rather than relying solely on management certifications.
• Securitization sponsors, underwriters, and investors should consider reviewing controls for detecting loans that are delinquent, charged off, non-paying, fictitious, materially impaired, or otherwise ineligible but reported as current or eligible.
• Firms should consider reconciling loan-level collateral tapes across all funding channels and establishing exception escalation, independent sign-off, segregation of duties, and documented remediation for duplicate identifiers or inconsistent pledging data.
• Finance and compliance functions may wish to assess whether offering documents, investor presentations, lender certificates, and management meetings accurately describe liquidity constraints, funding needs, collateral encumbrances, and portfolio performance.
• Boards and senior-management committees should consider reviewing governance over collateral operations, securitization disclosures, liquidity reporting, related-party or affiliate financing, and controls over executive certifications.
• Investment managers and lenders may wish to incorporate independent collateral verification, borrowing-base audit rights, data-access rights, concentration and duplication analytics, and covenant triggers into new and renewed transactions.
• Firms with relevant exposure should consider preserving records, communications, collateral tapes, system audit trails, certifications, underwriting files, and exception reports in light of parallel SEC and criminal proceedings.

What changed

The publication does not introduce a new rule, threshold, filing requirement, or compliance deadline. It announces an enforcement complaint under the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934, including alleged control-person liability against Chu and aiding-and-abetting liability against all three defendants. The SEC seeks injunctions, disgorgement with prejudgment interest, civil penalties, and officer-and-director bars against Chu and Kollar.

Key dates

2026-08-14

The CFPB announced and implemented the cessation of discretionary publication of complaint narratives and associated visualizations in the Consumer Complaint Database; previously published narratives remain subject to proactive FOIA Reading Room disclosure.

Suggested considerations

• Compliance teams may wish to continue treating CFPB complaints as supervisory and potential enforcement inputs, notwithstanding the removal of narratives from the public database.
• Firms should consider maintaining controls that support complete, accurate, and timely responses to CFPB complaints, including documented investigation, escalation, remediation, and quality-assurance procedures.
• Complaint-management owners may wish to monitor whether the removal of public narratives affects internal trend analysis and should preserve their own historical complaint records and supporting evidence.
• Legal and regulatory affairs teams should consider reviewing previously published complaint narratives concerning the firm in the CFPB FOIA Reading Room and assessing whether existing disclosure, litigation, reputation, and remediation processes remain appropriate.
• Firms should consider retaining evidence supporting complaint responses because complaint information may continue to be shared with prudential regulators, the FTC, and federal or state agencies, and may remain accessible through FOIA.
• Management may wish to avoid interpreting the change as a basis for reducing complaint-governance staffing, monitoring, root-cause analysis, or board and senior-management reporting.

What changed

The CFPB will no longer publish consumer-submitted complaint narratives or related data visualizations in the Consumer Complaint Database. The Bureau characterizes publication of these materials as discretionary rather than statutorily required and states that the materials are unverified, potentially misleading, and not necessarily evidence of legal violations.

Key dates

2026-08-14

Effective date of FinCEN final rule "Beneficial Ownership Information Reporting Requirement Revision" (91 FR 52508; RIN 1506-AB67), permanently narrowing CTA BOI reporting to foreign reporting companies and codifying exemptions for U.S. persons and domestic reporting companies.

Suggested considerations

• Compliance teams at foreign reporting companies should review the revised 31 CFR 1010.380 definition of "reporting company" and confirm that their entity meets the narrowed criteria (foreign formation plus registration to do business in a U.S. State or Tribal jurisdiction), updating BOI reporting inventories and scoping accordingly.
• Foreign reporting companies should update BOI reporting procedures to ensure that reports capture beneficial owners who are non-U.S. persons while excluding U.S. person beneficial owners, including revising data collection forms, internal instructions, and system logic to avoid collecting or transmitting U.S. person BOI under the CTA framework.
• Firms involved in foreign pooled investment vehicles registered in the United States may wish to revise governance and reporting processes so that BOI reports for such vehicles identify only the individual exercising substantial control (or greatest authority over strategic management) who is not a U.S. person, and cease including U.S. controllers where they qualify as U.S. persons.
• Corporate secretarial and entity management functions should update CTA/BOI scoping matrices to remove domestic corporations, LLCs, and similar entities from BOI reporting obligations and to reflect that only qualifying foreign entities remain in scope, while maintaining awareness of other AML and KYC obligations that may still apply independently of the CTA.
• Onboarding and registration workflows for foreign entities should be reviewed so that BOI reporting triggers, timelines, and responsibilities are aligned with the final rule’s foreign-only scope, including any remaining deadlines tied to registration dates, and that staff understand that U.S. person company applicant information is no longer required for CTA reporting.
• Firms maintaining records of U.S. person beneficial owners and company applicants for CTA purposes may wish to reassess retention policies, ensuring that any continued collection or storage of such data is for other legal or risk-management purposes rather than CTA compliance, and that privacy notices and data minimization practices reflect the updated regulatory position.
• Compliance teams should revise CTA-related policies, procedures, and training materials to incorporate the exemptions for U.S. persons holding FinCEN IDs, clarifying that these individuals are no longer required to update or correct BOI previously provided to obtain the identifier, and documenting any residual obligations under other BSA or AML rules.
• Banks, broker-dealers, and other AML-regulated firms should consider the impact of reduced BOI availability for U.S. persons on their own customer due diligence, beneficial ownership, and risk assessment frameworks, and evaluate whether internal KYC standards or other regulatory requirements (such as customer due diligence rules) necessitate separate collection of U.S. person ownership information irrespective of FinCEN’s CTA exemptions.

What changed

The definition and scope of "reporting company" under 31 CFR 1010.380, as implemented under 31 U.S.C. 5336, are now permanently narrowed so that entities previously defined as domestic reporting companies are exempt from BOI reporting requirements, including initial, updated, and corrected BOI reports. Foreign reporting companies remain subject to BOI reporting, but the rule confirms that they are exempt from reporting beneficial ownership information for any U.S. person beneficial owners; those U.S.

Key dates

2026-08-12

SEC announcement of the administrative proceeding

2026-08-22 Deadline

Payment deadline for the $28 million penalty by Wells Fargo Clearing Services, LLC and the $7 million penalty by Wells Fargo Advisors Financial Network, LLC, within 10 days of entry of the order

Suggested considerations

• Compliance teams may wish to review whether written supervisory procedures specifically address the risks of cash sweep and bank deposit sweep arrangements.
• Firms may wish to assess whether product selection, monitoring, escalation, and exception-handling controls are documented and operating as intended.
• Broker-dealers and advisers may wish to test whether disclosures, advisor training, and supervisory review processes match the actual operation of sweep programs.
• Firms may wish to examine whether affiliated deposit-product conflicts, yield incentives, and client-cash allocation defaults are identified and mitigated in practice.
• Operational risk and compliance functions may wish to evaluate whether periodic reviews capture changes in interest-rate conditions and client behavior that can affect sweep-program risk.

What changed

The order reflects SEC action under Sections 203(e) and 203(k) of the Investment Advisers Act and Section 15(b) of the Exchange Act, with cease-and-desist relief for violations of Section 206(4) of the Advisers Act and Rule 206(4)-7. The SEC’s settled resolution imposed a censure and civil penalties of $28 million on Wells Fargo Clearing Services, LLC and $7 million on Wells Fargo Advisors Financial Network, LLC, payable within 10 days of entry of the order.

Key dates

2026-08-12

SEC administrative proceeding and release for Santander Securities LLC

Suggested considerations

• Compliance teams may wish to review mutual fund share-class selection controls to confirm lower-cost alternatives are identified and used when available.
• Firms may wish to reassess whether 12b-1 fee compensation is clearly disclosed in client-facing materials and account documentation.
• Supervisory teams may wish to test whether review procedures flag cases where a cheaper share class was available but not selected.
• Firms may wish to examine whether representative compensation or revenue-sharing arrangements could bias share-class recommendations.
• Compliance functions may wish to verify that remediation processes can identify and reimburse affected clients where share-class selection increased costs.

What changed

The SEC charged Santander Securities LLC with willful violations of Advisers Act Sections 206(2) and 207 in connection with recommending mutual fund share classes that paid 12b-1 fees while lower-cost share classes were available for the same funds. The order alleges inadequate disclosure of the conflict created by the firm’s and associated persons’ receipt of 12b-1 compensation, and it describes the conduct as a breach of fiduciary duty and disclosure obligations.

Key dates

2014-01-01

Start of the relevant conduct period during which Trustcore selected and held mutual fund share classes paying 12b-1 fees where lower-cost alternatives were available

2018-03-28

End of the relevant conduct period examined in the SEC’s administrative proceeding

2019-03-11

Date of the SEC’s administrative order against Trustcore Financial Services, LLC under the Investment Advisers Act of 1940

2020-12-31

Closure date of Trustcore’s affiliated broker-dealer, TrustCore Investments, LLC, referenced as subsequent context

Suggested considerations

• Firms should consider reviewing mutual fund share class selection methodologies to confirm that, where multiple classes of the same fund are available, the process appropriately prioritizes lower-cost share classes for clients unless a documented, client-specific rationale justifies a different choice.
• Compliance teams may wish to assess whether existing Form ADV, advisory agreements, and other client-facing disclosure documents clearly describe 12b-1 fees, revenue-sharing, and other distribution or affiliate compensation, including how these payments arise from share class selection and the resulting conflicts of interest.
• Advisory firms should consider mapping and documenting all compensation flows between the adviser, affiliated broker-dealers, and associated persons that are tied to mutual fund holdings, including 12b-1 fees and other distribution-related payments, to support clear conflict identification and disclosure.
• Firms may wish to evaluate supervisory controls and surveillance around mutual fund share class usage, including periodic reviews or exception reports designed to detect legacy, higher-cost, or revenue-generating share classes that remain in client accounts where lower-cost alternatives exist.
• Compliance teams should consider testing whether advisory personnel understand the firm’s fiduciary obligations under the Advisers Act in the context of fee-driven product selection, and whether training materials adequately cover share class conflicts and disclosure expectations.
• Advisory firms may wish to implement or enhance procedures requiring documentation of the rationale for any recommendation or retention of mutual fund share classes that pay 12b-1 fees or other distribution fees, especially where cheaper classes of the same fund are available to the client.
• Firms should consider reviewing and, where needed, updating policies governing interactions between advisory and brokerage affiliates, to ensure that incentives tied to fund distribution or 12b-1 fees do not undermine client best interest or the adviser’s fiduciary duty.
• Compliance teams may wish to benchmark their practices against prior SEC share class selection initiatives and enforcement matters, using this order as an example of the types of conflicts, disclosure gaps, and remedial undertakings the SEC is prepared to pursue.

What changed

This publication does not introduce new rules but memorializes a final SEC enforcement action and related undertakings under the Investment Advisers Act of 1940. The SEC imposed a formal cease-and-desist order against Trustcore Financial Services, LLC for violations of Section 206(2) (fraudulent conduct by an investment adviser) and Section 207 (untrue statements or omissions of material fact in filings with the SEC), in connection with the adviser’s selection and retention of mutual fund share classes that paid 12b-1 fees where lower-cost share classes were available.

Key dates

2019-04-01

Start of the period covered by the SEC’s findings on untimely SAR investigations and filings

2024-03-31

End of the period covered by the SEC’s findings on untimely SAR investigations and filings

2024-08-12

SEC press release and administrative order were posted

2024-09-11 Deadline

Civil penalty payment due within 30 days of the order’s entry, assuming the posted order date reflects the entry date

Suggested considerations

• Compliance teams may wish to review SAR investigation aging standards against current internal procedures, especially for matters involving subpoenas, law-enforcement requests, or regulatory inquiries.
• Firms should consider whether escalation triggers, ownership, and sign-off responsibilities for SAR determinations are clearly documented across surveillance, legal, and compliance functions.
• Broker-dealers may wish to test whether case-management tools can identify stalled investigations and flag items approaching internal filing deadlines or reasonable-period expectations.
• Dual registrants may wish to assess whether broker-dealer and advisory compliance workflows are coordinated for suspicious-activity matters that cut across business lines.
• Training for relevant personnel may wish to be reviewed to ensure that SAR timeliness expectations and escalation protocols are understood by front office, surveillance, legal, and operations staff.

What changed

The publication does not create new rules or thresholds. It documents an enforcement action under Exchange Act Section 17(a) and Rule 17a-8, which require broker-dealers to file SARs for suspicious transactions and related activity. The SEC’s order emphasizes that firms must conduct and complete SAR investigations within a reasonable period of time, especially when the activity is connected to law-enforcement or regulatory inquiries. The outcome also shows that the SEC may treat delayed investigation and filing as a standalone compliance failure even without a substantive fraud finding.

Key dates

2017-06-01

Beginning of the conduct period identified by the SEC for the undisclosed or inadequately disclosed rollover and referral incentive-compensation practices.

2022-02-01

End of the conduct period identified by the SEC for the disclosure and policies-and-procedures failures.

2025-01-17

The SEC issued the settled administrative order against Transamerica Financial Advisors, LLC.

Suggested considerations

• Compliance teams may wish to compare conflict disclosures against actual compensation practices to confirm that conditional language does not understate incentives that are being paid in practice.
• Firms may wish to review rollover-related compensation arrangements for specificity in Form ADV brochures, client agreements, training materials, and sales communications.
• Compliance teams may wish to test whether policies and procedures under Rule 206(4)-7 are designed to identify, monitor, and remediate gaps between business practices and client disclosures.
• Firms should consider whether representative-level incentive compensation tied to referrals or rollovers warrants heightened supervision, approval workflows, or additional conflict controls.
• Firms may wish to assess whether retirement rollover supervision includes review of disclosure consistency, repapering, and cross-functional sign-off when compensation structures change.

What changed

This is an enforcement action, not a new rule or interpretive release, so it does not amend the underlying regulatory text. The SEC found violations of Sections 206(2) and 206(4) of the Investment Advisers Act of 1940 and Rule 206(4)-7 because the firm allegedly paid incentive compensation to investment adviser representatives for referrals and retirement rollovers from at least 2017-06-01 through 2022-02-01, while earlier disclosures used language suggesting the firm merely 'may' provide incentives.

Key dates

2021-07-09

SEC announced settled administrative proceedings against Kestra Advisory Services, LLC and Kestra Private Wealth Services, LLC

2026-08-12

SEC administrative proceedings index and SEC newsroom list the Kestra Private Wealth Services matter under Release No. 34-106110

Suggested considerations

• Compliance teams may wish to review whether disclosures about affiliated compensation, markups, and related conflicts are specific and prominent enough for advisory clients.
• Firms should consider testing mutual fund trade processing and fee assessment workflows for undisclosed economic benefits to affiliates.
• Dual registrants may wish to assess whether advisory and broker-dealer compliance functions are coordinated so disclosures, operations, and compensation schedules are aligned.
• Firms may wish to examine whether written policies and procedures are detailed enough to detect and prevent conflicts tied to transaction fees and non-transaction service fees.
• Wealth management firms may wish to compare client-facing disclosures against internal agreements and operational fee flows to identify inconsistencies.
• Compliance teams may wish to consider periodic testing of conflict disclosures and fee practices to determine whether similar issues would be identified before an exam or enforcement review.

What changed

This is an enforcement order, not a rulemaking, so it does not create new requirements. It nonetheless reinforces that investment advisers must provide full and fair disclosure of conflicts created when an affiliated broker-dealer receives compensation from mutual fund trades and related services, including situations described by the SEC as fee markups. The order also underscores the need for written compliance policies and procedures reasonably designed to prevent violations, which the SEC tied to Rule 206(4)-7.

Suggested considerations

• Compliance teams may wish to review whether advertising approval workflows are designed to identify statements that could be materially false or misleading under Advisers Act standards.
• Firms may wish to verify that marketing claims are supported by current documentation before use, especially where claims relate to qualifications, capabilities, or other material attributes.
• Teams may wish to confirm that all promotional channels, including websites, PDFs, presentations, email campaigns, and social media, are included in supervisory review.
• Firms may wish to assess whether recordkeeping processes preserve final and pre-approved versions of advertisements and the support for material claims.
• Compliance teams may wish to consider whether training for marketing and advisory personnel clearly addresses the prohibition on untrue statements of material fact in advertisements.

What changed

This publication is an enforcement order, not a new rulemaking, so it does not create new generally applicable obligations. It applies existing Investment Advisers Act advertising standards by finding that the firm violated Section 206(4) and Rule 206(4)-1(a)(5) through advertisements containing untrue statements of material fact. The order also requires a cease-and-desist remedy and imposes a $200,000 civil money penalty, payable within 10 days of the order’s entry.

Key dates

2019-08-01

SEC civil action filed in the District of Massachusetts

2024-03-29

District court entered final judgment against Commonwealth

2024-04-01

Whistleblower notice lists the qualifying judgment/order date

2024-07-05

Whistleblower notice last reviewed or updated

Suggested considerations

• Compliance teams may wish to review whether Form ADV and client-facing disclosures describe revenue-sharing arrangements with enough specificity to explain the actual conflict and the related economic incentive.
• Firms may wish to assess whether disclosures address not only the existence of revenue sharing, but also whether it may steer recommendations toward higher-cost mutual fund share classes over cheaper alternatives.
• Firms may wish to test whether policies and procedures under Rule 206(4)-7 expressly cover identification, escalation, review, and disclosure of revenue-sharing conflicts.
• CCOs may wish to confirm that they are being kept fully informed of revenue-sharing arrangements and related conflicts, especially where those arrangements can affect product recommendations or supervision.
• Compliance functions may wish to evaluate whether representatives understand the structure of revenue-sharing payments and how those economics may influence client recommendations.
• Dual registrants may wish to align broker-dealer and advisory disclosures so that the conflict is not described in one channel while omitted or softened in another.

What changed

This was an enforcement action, not a rulemaking, so it did not create new industry-wide requirements. The SEC alleged violations of Section 206(2), Section 206(4), and Rule 206(4)-7 of the Investment Advisers Act based on inadequate disclosure of material conflicts of interest and failure to adopt and implement adequate compliance policies and procedures.

Key dates

2021-07-09

SEC announced and settled the Kestra Advisory Services administrative proceeding

2021-07-09 Deadline

Order required payment of disgorgement, prejudgment interest, and civil penalty within ten days of entry of the order

Suggested considerations

• Compliance teams may wish to review whether client disclosures describe all forms of affiliated compensation, revenue sharing, and other economic benefits that could influence recommendations.
• Firms should consider whether Form ADV narratives, client agreements, and supervisory documentation are consistent on affiliate compensation and conflict disclosure.
• Dual registrants may wish to map advisory and brokerage compensation streams in their conflict inventories to confirm that material conflicts are captured and escalated.
• Firms should consider whether written compliance policies and procedures are tailored to actual business practices, rather than existing only in generic form.
• Compliance functions may wish to test whether supervisory reviews can detect compensation arrangements that create disclosure obligations under the Advisers Act.
• Wealth management organizations may wish to assess training for advisers and supervisors on when affiliate compensation and shared revenue arrangements must be disclosed to clients.

What changed

This was not a new rulemaking; it was an SEC enforcement order applying existing requirements under Sections 206(2) and 206(4) of the Investment Advisers Act of 1940 and Rule 206(4)-7. The Commission found that Kestra AS failed to disclose two types of compensation received by its affiliated broker-dealer and predecessor firm, including compensation tied to conflicts of interest, and that clients therefore lacked material information needed to assess those conflicts.

Key dates

2026-08-12

SEC release date for the administrative proceeding listing

Suggested considerations

• Compliance teams may wish to review municipal underwriting due diligence files to confirm that offering materials, issuer representations, and internal review steps are documented and consistent.
• Firms may wish to assess supervisory controls over municipal securities underwriting to ensure responsibilities, escalation paths, and sign-off procedures are clearly assigned.
• Broker-dealers may wish to re-check training for public finance personnel on disclosure accuracy, antifraud standards, and recordkeeping expectations.
• Firms with both brokerage and advisory businesses may wish to keep advisory fiduciary controls distinct from municipal underwriting controls so that governance frameworks do not blur separate regulatory obligations.
• Compliance functions may wish to compare this matter with prior SEC actions involving the firm to identify recurring control themes in disclosures, supervision, and product/distribution practices.

What changed

This publication does not introduce a new regulatory requirement or rulemaking obligation. It reflects an SEC administrative cease-and-desist proceeding under the federal securities laws, with the public descriptions indicating an antifraud theory connected to municipal securities underwriting and inadequate due diligence. The available materials also indicate this is separate from the firm’s earlier 2019 SEC matter involving share class selection and 12b-1 fee disclosure issues, so it should not be conflated with that prior advisory-fiduciary case.

Suggested considerations

• Compliance teams may wish to review mutual fund share class selection logic to confirm whether lower-cost eligible share classes were available and used where appropriate.
• Firms should consider whether 12b-1 fee revenue is fully identified in conflict inventories and disclosed clearly in Form ADV and related client materials.
• Advisory supervision may wish to test whether recommendations are consistent with a client-first or best-interest framework when fund share class options differ in cost.
• Firms may wish to evaluate whether exception handling for higher-cost share class usage is documented, approved, and supported by a client-specific rationale.
• Compliance functions may wish to assess whether remediation and restitution calculations are available if historical share class selection issues are identified.

What changed

This was not a new rulemaking or interpretive release; it was an SEC administrative enforcement action based on alleged breaches of fiduciary duty and inadequate disclosure tied to mutual fund share class selection and 12b-1 fee revenue. The SEC’s order indicates the firm recommended, purchased, or held higher-cost share classes for clients despite lower-cost alternatives being available, and the firm received compensation through 12b-1 fees that created a conflict.

Key dates

2014-01-01

Start of relevant conduct period during which Investacorp Advisory Services, Inc. recommended or retained mutual fund share classes with 12b-1 fees despite lower-cost alternatives being available

2018-03-30

End of relevant conduct period covered by the SEC administrative order against Investacorp Advisory Services, Inc.

2026-08-12

SEC issues administrative order in Release No. 34-106089, File No. 3-19037, imposing cease-and-desist relief, censure, disgorgement, and prejudgment interest on Investacorp Advisory Services, Inc.

Suggested considerations

• Firms should consider reviewing mutual fund share-class selection policies and procedures to confirm that, where clients are eligible, the lowest-cost available share class of a given fund is systematically considered and documented, particularly in accounts where the firm or an affiliate receives 12b-1 fees.
• Compliance teams may wish to evaluate Form ADV Part 2A, advisory brochures, and other client disclosures to determine whether receipt of 12b-1 fees and similar distribution or servicing compensation is clearly described as a material conflict of interest, including the incentives it creates for advisers and affiliated broker-dealers.
• Advisory firms with affiliated broker-dealers should consider mapping compensation flows, including 12b-1 fees and revenue sharing, between entities to identify where those arrangements could reasonably influence share-class recommendations, and whether enhanced disclosure or conflict-mitigation controls are warranted.
• Firms may wish to implement or refine surveillance and testing to identify accounts invested in higher-cost mutual fund share classes when a lower-cost share class of the same fund appears available to that client, and to assess whether any such positions reflect policy exceptions or potential remediation candidates.
• Investment committees and disclosure governance bodies should consider comparing actual fund-share-class usage patterns against stated policies and disclosures in advisory brochures, wrap-fee program documents, and client agreements to confirm alignment and identify gaps in describing conflicts tied to 12b-1 fee receipt.
• Firms that historically received 12b-1 fees or similar fund distribution compensation during periods comparable to 2014–2018 may wish to consider whether a retroactive review of share-class selection and client eligibility is appropriate and whether any client reimbursement, remediation, or supplemental disclosure exercises are advisable in light of the SEC’s enforcement posture.
• Compliance and supervisory functions should consider updating training for investment adviser representatives and registered representatives to ensure they understand how mutual fund share-class selection, 12b-1 fee arrangements, and affiliated broker-dealer compensation can create fiduciary and disclosure risk under the Advisers Act.
• Legal and compliance teams may wish to revisit enterprise-level conflicts of interest inventories to ensure that mutual fund share-class selection practices, 12b-1 fee arrangements, and related revenue-sharing structures are explicitly captured, assessed, and tied to appropriate controls and disclosures.

What changed

The publication does not introduce new rules or amend existing regulations; it is an enforcement settlement applying existing fiduciary and disclosure obligations under the Investment Advisers Act of 1940, including Sections 203(e) and 203(k). The order confirms that the SEC considers the practice of placing advisory clients into mutual fund share classes that charge 12b-1 fees when lower-cost, non-12b-1 share classes of the same fund are available to be a material conflict of interest when the adviser or an affiliated broker-dealer receives those fees.

Key dates

2026-08-12

SEC administrative-proceedings listing date for the AXA Advisors matter

Suggested considerations

• Compliance teams may wish to review whether mutual fund share class selection processes systematically identify the lowest-cost eligible class for each account type and client segment.
• Firms may wish to assess whether disclosures in Form ADV, client agreements, and supervisory materials clearly describe 12b-1 compensation and other share-class conflicts.
• Supervisory teams may wish to confirm that representatives’ incentives tied to 12b-1 revenue are identified, reviewed, and mitigated or disclosed where necessary.
• Firms may wish to document a defensible comparison process for share classes and retain evidence supporting the selected class for each recommendation.
• Compliance functions may wish to evaluate whether prior-client remediation procedures are calibrated for situations where clients were placed in more expensive share classes than necessary.

What changed

This publication is an enforcement order, not a rulemaking or policy statement. The order requires AXA Advisors to cease and desist from future violations of Sections 206(2) and 207 of the Advisers Act, is accompanied by a censure, and imposes monetary relief totaling $1,134,152, consisting of $972,007.36 in disgorgement and $162,144.64 in prejudgment interest. The order also directs payment to affected investors, reflecting the SEC’s view that inadequate share-class selection and conflict disclosure can require remediation.

Key dates

2025-12-29

NCUA published the proposed rule to remove 12 CFR 701.25(b)

2026-02-27 Deadline

Public comment period closed

2026-08-06

Final rule published in the Federal Register at 91 FR 50664

2026-09-08 Deadline

Final rule becomes effective and 12 CFR 701.25(b) is removed

Suggested considerations

• Compliance teams may wish to confirm that internal lending policies still reflect the remaining limits in 12 CFR 701.25(a) and any other applicable provisions, even though the separate policy requirement in paragraph (b) has been removed.
• Boards may wish to review whether any internal approval process for loans to other credit unions remains desirable as a governance control, particularly where state law, bylaws, or enterprise risk practices still support formal approval.
• State-chartered credit unions may wish to verify whether state law or state supervisory expectations still require board approval or written policies for loans to other credit unions.
• Monitoring teams may wish to update regulatory inventories, policy cross-references, and exam prep materials to reflect that 12 CFR 701.25(b) is no longer codified effective 2026-09-08.
• Training and procedure documents may wish to distinguish between the removed board-policy requirement and the continuing statutory and regulatory loan limits that still apply.

What changed

The final rule removes the documentation requirement in 12 CFR 701.25(b) that required board approval of all loans to other credit unions and written policies governing those loans. NCUA states that federal credit unions remain subject to statutory requirements on loans to credit unions, and the remaining limits and requirements in § 701.25 continue to apply. The rule does not change the aggregate loan limit in § 701.25(a), which remains 25% of the lending federal credit union’s paid-in and unimpaired capital and surplus.

Key dates

2026-02-25

NCUA published the proposed rule for public comment.

2026-04-27

Public comment period closed after NCUA received 15 comments.

2026-08-06

NCUA published the final rule in the Federal Register at 91 FR 50680.

2026-09-08 Deadline

Final rule becomes effective.

Suggested considerations

• Compliance teams may wish to review and update FCU written policies for purchases, sales, and pledges of eligible obligations so they no longer mirror the removed prescriptive checklist and instead reflect the board’s own risk-based framework.
• Credit unions may wish to confirm that internal governance documents still address conflicts of interest and compensation consistently with bylaws and fiduciary-duty expectations, even though the detailed regulatory text has been removed.
• Firms should consider updating any procedures, training materials, and control inventories that reference the old paragraph structure or the former 12 CFR 701.23(h) cross-reference.
• Compliance teams may wish to validate that transaction approval, due diligence, documentation, and agreement-review processes continue to be embedded in policy at a level appropriate to the institution’s risk profile, even though the rule is less prescriptive.
• Federal credit unions may wish to brief boards and relevant committees on the shift from a checklist-based rule to a principles-based framework so governance oversight remains aligned with supervisory expectations.

What changed

['The rule removes the mandated lists of items that FCU written policies must address for purchases, sales, and pledges of eligible obligations under 12 CFR 701.23(b)(6), (c), and (d). FCUs still must maintain written policies for these activities, but the regulation no longer prescribes a detailed checklist of required policy contents.', 'The rule removes the detailed conflicts-of-interest and compensation provision formerly in 12 CFR 701.23(g).

Key dates

2026-03-25

NCUA issued the proposed rule to remove the prescriptive requirements

2026-05-26 Deadline

Public comment period closed

2026-08-06

Final rule was published in the Federal Register at 91 FR 50677

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to review current indirect vehicle lending policies to confirm they no longer reference the removed 50% and 100% net-worth limits.
• Boards may wish to document a board-approved risk appetite and concentration framework for third-party serviced indirect vehicle loans.
• Credit unions may wish to align vendor oversight, due diligence, and servicing controls with their internal policies since the prior waiver pathway is no longer the operative framework.
• State-chartered federally insured credit unions may wish to verify any conforming updates needed to insurance-related procedures and governance materials.
• Compliance functions may wish to update training, policy manuals, and examination binders to reflect that supervision will now focus on principles-based oversight rather than the deleted rule text.

What changed

The final rule removes 12 CFR 701.21(h) in full, eliminating the existing concentration limits, the 30-month step-up to a higher limit, the waiver process to a Regional Director, the related response timeline, and the embedded definition framework tied to that paragraph. NCUA also states that it removed the parallel requirement in 12 CFR 741.203(c) and the related citation in 12 CFR 746.201(c), as part of the same deregulatory package.

Key dates

2026-02-25

NCUA issued the proposed rule removing 12 CFR 701.26; public comments were invited through April 27, 2026

2026-04-27 Deadline

Public comment deadline on the proposal

2026-08-06

Final rule published in the Federal Register at 91 FR 50674

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to remove references to 12 CFR 701.26 from policies, procedures, and training materials once the rule is effective.
• Firms should consider confirming that contract templates still include written terms addressing audit rights, information security, business continuity, indemnification, performance metrics, data ownership and return, termination, and dispute resolution.
• Credit unions involved in shared operational arrangements may wish to review whether documentation now reflects the updated clarification in 12 CFR 721.3.
• Firms may wish to confirm that third-party risk management, vendor oversight, and due diligence controls remain aligned with existing supervisory expectations despite the regulatory deletion.

What changed

The final rule rescinds 12 CFR 701.26, which had addressed FCU authority to enter written contracts for assets or services relating to daily operations and required those agreements to be in writing. NCUA states that the contractual authority already exists under the FCU Act and incidental powers authority, so the regulation was redundant. The Board also amended 12 CFR 721.3 to formally clarify that credit unions may act as representatives in shared operational arrangements with other credit unions or organizations, and that fixed assets may be shared.

Key dates

2026-08-06

FDIC published the notice of proposed rulemaking in the Federal Register

2026-10-05 Deadline

Comments on the proposal must be received by the FDIC

Suggested considerations

• Compliance teams may wish to map current insider-lending policies against the proposed $400,000 and $2,000,000 thresholds to assess operational impact if finalized.
• Firms may wish to review board-approval workflows and escalation triggers so systems can be updated quickly if the proposal is adopted.
• Institutions may wish to evaluate whether existing exception reporting, insider tracking, and credit administration procedures will need revision to reflect periodic indexing rather than fixed thresholds.
• Commenters may wish to submit feedback by the October 5, 2026 comment deadline if the proposed thresholds or indexing methodology would create implementation issues.

What changed

The proposal amends 12 CFR 337.3 for extensions of credit to insiders of FDIC-supervised institutions. It would increase the threshold for certain extensions of credit to executive officers not otherwise specifically authorized by statute from $100,000 to $400,000, and it would increase the threshold for extensions of credit to insiders requiring prior approval by the board of directors from $500,000 to $2,000,000. The FDIC also proposes to establish an indexing methodology to periodically update those dollar thresholds over time.

Key dates

2026-08-06

CFTC published the proposed rule in the Federal Register at 91 FR 50926.

2026-10-05 Deadline

Public comments on the proposal must be received by this date.

Suggested considerations

• Compliance teams may wish to review current affiliate structures involving FCMs, SEFs, DCMs, DCOs, and trading affiliates to identify where the proposal would create new disclosure, surveillance, or conflict-management obligations.
• Firms may wish to map any shared personnel, technology, office space, or information flows between affiliated entities and assess whether additional controls would be needed to protect regulatory impartiality.
• Market-regulation and legal teams may wish to assess whether existing board, committee, and disciplinary-panel processes would satisfy the proposed independence and conflict-management expectations.
• FCMs may wish to inventory current disclosures to customers and counterparties and determine whether additional affiliate-relationship disclosures would be needed if the rule is finalized.
• Affected entities may wish to prepare comment letters before the 2026-10-05 deadline if they want to influence the final scope of the proposal.