Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

Texas Stock Exchange offers equity stakes to lure first ten corporate listings

A Texas Stock Exchange rule filing, effective immediately under SEC fast-track procedures, creates an equity incentive program for the first wave of corporate listings. Compliance teams at issuers weighing a listing transfer, and rivals tracking exchange competition for listings, should note the eligibility thresholds and vesting conditions set out below.

• Rodeo II grants 100,000 restricted stock units in TXSE Group Inc. to each of the first ten qualifying Founding Partners.
• Primary listings require a trailing 90-trading-day average market cap of at least $3.5 billion; dual listings require at least $100 billion.
• Units vest 50% on the first anniversary and 50% on the second anniversary of continuous listing on TXSE.
• The program runs until all awards are allocated, December 31, 2026, or TXSE terminates it, whichever comes first.
• TXSE may increase the award pool to fifteen at its sole discretion, with public notice on its website.

NIST opens Cybersecurity Career Week, October 19-24, 2026

NIST's cybersecurity insights blog announces Cybersecurity Career Week, a workforce-awareness campaign rather than a rule or supervisory action. It lists a schedule of webinars, an in-person NCCoE event and a social media challenge aimed at people considering cybersecurity careers, plus pointers to the NICE Framework and CyberSeek tools.

• Cybersecurity Career Week, led by NIST's NICE Program, runs October 19-24, 2026.
• A webinar titled "Networking Like a Leader" is scheduled for October 14, 2026 from 1:00-2:00 PM ET.
• The NCCoE is hosting an in-person Cybersecurity Connections event on October 15, 2026 from 11:00 AM-1:30 PM ET.
• A six-day #mycyberjob media challenge runs across X, Instagram, Facebook and LinkedIn from October 19-24, 2026.
• Additional webinars on breaking into cybersecurity and student career pathways are scheduled for October 20 and October 21, 2026.

Sinaloa Cartel transporter pleads guilty to meth and marijuana trafficking

A DOJ press release details the guilty plea of a Mexican national who worked as a distributor and transporter for Sinaloa Cartel-affiliated traffickers. The case, brought under the Homeland Security Task Force initiative, illustrates federal prosecutors' continued focus on mid-level cartel logistics networks and the financial channels that support them.

• Hernandez Ochoa pleaded guilty to conspiracy to distribute 500 grams or more of methamphetamine and 1,000 kilograms or more of marijuana for importation into the United States.
• Court documents say he worked from 2015 to 2017 as a distributor and transporter using private planes, human couriers, tunnels, semi-trailer trucks and hidden vehicle compartments.
• He also coordinated transportation of cash for drug purchases and its repatriation from the U.S. after sale.
• Sentencing is scheduled for Feb. 2, 2027, and he faces a maximum penalty of life in prison.
• The Justice Department's Office of International Affairs assisted in his extradition, with cooperation from the Government of Mexico.

Washington state regulator publishes consumer guide to credit card billing cycles

This is a consumer-facing explainer from Washington's Department of Financial Institutions aimed at cardholders confused by statement balances versus app balances. It covers billing cycle mechanics, grace periods and the difference between a credit card balance and a checking account balance, intended as financial literacy content rather than new rulemaking.

• The post explains that a credit card purchase is effectively borrowing money with a promise to repay, usually with interest, unlike a debit card which draws funds immediately.
• Purchases and transactions accumulate during a billing cycle, and the card issuer produces a statement when that cycle ends.
• Paying the full statement balance by the due date will generally allow a cardholder to avoid interest on purchases if the card has a grace period.
• The statement balance, minimum payment and payment due date are described as three distinct pieces of information that tell a cardholder different things.
• The statement closing date is cited as the reason a newer purchase may not appear in the amount currently due.

SEC seeks OMB renewal of municipal advisor registration rules and forms

This is a routine Paperwork Reduction Act notice in which the SEC asks OMB to extend approval of the information-collection rules underpinning municipal advisor registration. It matters to compliance teams at municipal advisory firms because it quantifies, in granular detail, the ongoing filing burden they carry under Forms MA, MA-I, MA-W and MA-NR.

• As of December 31, 2025, approximately 419 municipal advisors were registered with the Commission.
• The Commission estimates 15 new Form MA applicants annually for each of the next three years, totalling 45 over the period.
• The average internal cost of compliance per hour for completing Forms MA and MA-I is estimated at approximately $271.
• Rule 15Ba1-8 requires municipal advisory firms to obtain and retain, for not less than five years, written consent to service of process from each associated person engaged in municipal advisory activities.
• The Commission estimates it will receive an average of 21 Form MA-W withdrawals and enter orders cancelling or revoking registration of 4 municipal advisors annually over the next three years.

Cboe EDGX adopts generic listing standards for options on multi-crypto-asset trusts

Cboe EDGX has filed a non-controversial rule change, operative on filing, that lets it list options on commodity-based trusts holding more than one crypto asset and on exchange-traded funds defined under Rule 6c-11. The standards copy rules the SEC already approved for affiliate Cboe Options. Comments are open until November 12, 2026, and the Commission may suspend the change within 60 days.

• Each crypto asset in a listed multi-asset trust must have an average daily market value of at least $700 million over the trailing 12 months and underlie a derivatives contract on a market with a comprehensive surveillance sharing agreement.
• The filing permits options on exchange-traded funds defined under Rule 6c-11, relying on that rule's portfolio transparency requirements as the anti-manipulation basis.
• Continued listing standards require the Exchange to review the market-value criterion monthly and consider suspending opening transactions if criteria are no longer met.
• The rules are substantively identical to Cboe Options standards approved by the SEC in April 2026 under SR-CBOE-2026-020.
• The change became operative on filing after the SEC waived the 30-day delay; written comments are due by November 12, 2026.

New Jersey brothers plead guilty to stealing $2.6 million in fake tax refunds

A DOJ guilty plea announcement details how two brothers used false Form 1041 trust filings to extract over $2.6 million combined in fraudulent IRS refund checks, then obstructed collection efforts with false nonresident filings. The case is part of DOJ's first National Tax Enforcement Surge, giving compliance and financial crime teams a window into current enforcement priorities.

• Ronald Chrichlow and Gordon Chrichlow pleaded guilty to theft of government funds after claiming false refunds of $978,126 and $1,643,172 on 2022 Form 1041 filings.
• The IRS issued Treasury checks for both amounts in March 2023, and Gordon Chrichlow used proceeds to buy a Porsche Taycan for approximately $117,364 and a house for approximately $686,258.
• After an IRS revenue officer was assigned in August 2023, the brothers filed false Form 1040-NR returns falsely claiming nonresident status and treaty-based tax exemption.
• Ronald Chrichlow earned $960,000 between 2021 and 2024 but did not file returns from 2022 to 2024, and separately claimed a false $93,228 refund for 2021.
• Gordon Chrichlow failed to file returns from 2021 through 2024 despite earning more than $1.4 million in gross income in those years.

Four Texans indicted over trust tax shelter tied to $200 million IRS loss

The indictment covers one case within DOJ's first National Tax Enforcement Surge, a nationwide push spanning early September to October 14. It details a promoted trust scheme, alleged obstruction of IRS audits, personal tax evasion and a separate fraudulent securities solicitation tied to one defendant, with charges carrying penalties up to 20 years per count on the most serious counts.

• The indictment alleges the trust scheme sheltered more than $1.5 billion in client income, causing an estimated $200 million tax loss to the IRS.
• Clients allegedly paid fees often exceeding $100,000 and were encouraged to backdate trusts and file amended returns claiming refunds.
• Weickgenant is charged with corrupt interference with the IRS, including instructing clients not to speak with investigators and not to comply with a court order enforcing an IRS summons.
• MacDonald is separately charged with wire fraud and transactions with criminally derived property over an alleged $2 million investor solicitation while under an SEC injunction barring unregistered securities sales.
• The case is one of 76 defendants charged nationwide under DOJ's first National Tax Enforcement Surge, covering an estimated $490 million in intended and estimated federal revenue loss.

DOJ opens Second Amendment probe into Pennsauken, New Jersey permit delays

The Justice Department has opened an investigation into whether Pennsauken, New Jersey unconstitutionally delays firearm permits. The inquiry is run by the Civil Rights Division's Second Amendment Section and rests on the Supreme Court's reasoning in Bruen. This item covers what the department is examining, the legal theory it is using, and how the Division is now deploying its gun-rights enforcement arm against local permitting systems.

• The investigation, opened October 14, 2026 under press release 26-1200, targets delays in issuing firearm licenses in Pennsauken, New Jersey.
• The inquiry focuses specifically on the Pennsauken Township Police Department's permitting system.
• The department relies on Bruen (2022), which it reads as treating lengthy processing wait times as an abusive use of a permitting scheme.
• AAG Harmeet K. Dhillon directed the Civil Rights Division's Second Amendment Section to run the investigation.
• The release states the investigation does not support any armed obstruction of federal or local law enforcement.

SEC trading chief details Rule 611 review, tokenised venue exemption and new derivatives

A speech by the SEC's Division of Trading and Markets director lays out the status of three live market structure initiatives: the proposed rescission of Rule 611, a conditional exemption for tokenised securities trading venues, and a wave of new derivatives products entering the market under SEC and CFTC jurisdiction. It matters because each affects execution obligations and venue registration status.

• The Division is analysing over 1,200 comment letters on the June 11 proposal to rescind Rule 611 and amend Rule 610(e) for locked and crossed markets.
• Chairman Atkins directed the Division to review Rule 610 access fee caps and Rule 612 minimum pricing increments by year-end, alongside any Rule 611 change.
• The Commission approved the Innovation Exemption on September 17, a five-year conditional exemption from the exchange definition for Tokenized Securities Venues trading tokenised NMS stocks.
• Five CFTC-registered DCMs, Coinbase, Kalshi, Bitnomial, NADEX and ICE Futures, filed Form 1-Ns in September to notice register as security futures exchanges.
• The Commission approved Cboe's proposal to list binary security options based on KPIs tied to NMS securities, and CME launched cash-settled single-stock futures on July 27.

NCUA proposes rolling back 2019 fidelity bond board oversight rules

NCUA is proposing to unwind several procedural requirements it added in 2019 for fidelity bond and insurance coverage at federally insured credit unions and corporate credit unions. The rule touches board approval processes, signatory rotation, bond form expiration, and minimum coverage formulas. Compliance officers at FICUs should read this now because the comment window closes December 14, 2026, and the changes affect who signs off on bond purchases.

• Comments on the proposed rule are due on or before December 14, 2026, under docket number NCUA-2026-1882.
• The proposal would remove the 2019 requirement that a FICU's full board review all fidelity bond purchase or renewal applications, allowing delegation to an individual board or supervisory/audit committee member.
• It would eliminate the 2019 rotation requirement barring the same board member from signing consecutive bond renewal agreements.
• Section 713.4(d), which imposes an automatic 10-year expiration on NCUA-approved bond forms, would be eliminated in its entirety.
• The Board proposes removing paragraphs (b) and (c) of Section 713.5, which contain advisory "should purchase" language and a formula tying additional coverage to daily cash on hand or money in transit.

NCUA proposes to finalize pandemic-era Central Liquidity Facility rule changes

NCUA is proposing to permanently adopt liquidity-access changes it made on an interim basis during the COVID-19 pandemic, while cleaning up provisions that have since lapsed under the CARES Act and the Consolidated Appropriations Act. The rule also trims documentation requirements for federally insured credit unions and adjusts capital stock subscription timing. Compliance and treasury teams at member credit unions should read this now rather than wait for the final rule.

• Comments on the proposed rule, docket NCUA-2026-1889, must be received by December 14, 2026.
• The proposal would permanently remove the six-month waiting period for new regular members to obtain CLF advances, a change first made by the April 29, 2020 interim final rule.
• Federally insured natural-person and corporate credit unions would no longer need to submit financial reports, charters and bylaws with CLF membership applications, since the CLF already obtains these through NCUA examinations.
• Non-federally insured credit unions not otherwise subject to NCUA examination would still have to provide financial reports and other information to the CLF to establish their financial condition.
• The Board received 15 comments on the two interim final rules, all of which supported the changes made.

IRS proposes rules tightening ACA premium tax credit eligibility under OBBBA

The IRS has issued proposed regulations under section 36B of the tax code to implement changes made by the One, Big, Beautiful Bill Act to the Affordable Care Act premium tax credit. Compliance, tax and benefits teams advising on health exchange enrollment or administering Form 1095-A reporting should review the comment and hearing timeline now.

• Written or electronic comments on REG-101576-26 must be received by November 30, 2026, via the Federal eRulemaking Portal or by mail.
• A telephonic public hearing is scheduled for December 8, 2026 at 10 a.m. ET, contingent on topic outlines being received by November 30, 2026.
• Requests to attend the public hearing must reach the IRS by 5 p.m. ET on December 4, 2026.
• For taxable years beginning after December 31, 2025, section 71305 of the OBBBA removes the excess APTC repayment limitation, requiring full repayment of any excess advance credit.
• Section 71302(a) of the OBBBA removes PTC eligibility for lawfully present aliens with household income below 100% of the Federal Poverty Level who are ineligible for Medicaid due to immigration status, effective for taxable years beginning after December 31, 2025.

Treasury finalises Treasury auction rule changes ahead of system upgrade

Treasury has issued a final rule amending the Uniform Offering Circular that governs the sale and issuance of marketable Treasury bills, notes and bonds. Most changes are technical, but one reworks how submitters hand over noncompetitive customer bids. The rule took effect on 15 October 2026, though the operationally significant pieces apply only when Treasury's upgraded auction system goes live.

• Submitters must provide each individual noncompetitive customer's name and bid amount before the noncompetitive auction close, and can no longer submit a summary bid amount.
• The amendments to 31 CFR 356.14 and 356.23 apply from the first auction conducted on Treasury's upgraded auction system, which Treasury will communicate in advance; all other changes apply from the effective date of 15 October 2026.
• Treasury is updating terminology across sections 356.15, 356.20, 356.21, 356.23 and others, including using 'award' and 'recognize' in place of 'accept' and 'tender'.
• Treasury removed references to http://www.treasurydirect.gov in sections 356.23(a) and 356.31(a), stating instead that it will make auction results available on its website.

CFPB seeks renewal of consumer complaint response survey, comments due Dec 14

A routine Paperwork Reduction Act notice from the CFPB seeking OMB extension of an existing information collection: the Consumer Response Company Response Survey. Relevant to firms that respond to CFPB consumer complaints, since survey results feed back to companies and inform CFPB's assessment of complaint handling.

• Comments on the extension request must be received by December 14, 2026 to be assured of consideration.
• The survey is approved under OMB Control Number 3170-0069 and docketed as CFPB-2026-0022.
• CFPB estimates 66,700 respondents and 4,669 total annual burden hours for the collection.
• The survey asks three questions about a company's complaint handling plus a narrative description supporting each answer.
• Survey results are shared with the responding company and used by CFPB as one of several inputs to assess response accuracy, completeness and timeliness.

SEC notices Clearlake, Pathway co-investment exemptive order application

The SEC has published notice of an exemptive application from Clearlake Private Markets Fund, Clearlake Capital RIC Management and Pathway Capital Management seeking relief to co-invest across affiliated business development companies and closed-end funds. This brief covers the filing's scope, deadlines and how interested parties can request a hearing before the order is granted.

• Applicants Clearlake Private Markets Fund, Clearlake Capital RIC Management, LLC and Pathway Capital Management, L.P. filed the application on August 10, 2026 and amended it on August 13, 2026.
• The requested order would permit certain BDCs and closed-end management investment companies to co-invest in portfolio companies with each other and with affiliated investment entities.
• The relief sought covers joint transactions otherwise prohibited by sections 17(d) and 57(a)(4) of the Investment Company Act and rule 17d-1.
• Hearing requests must reach the Commission by 5:30 p.m. Eastern time on November 3, 2026, accompanied by proof of service on the applicants.
• The order will be issued without a hearing unless the Commission orders one, per the standard exemptive application process.

CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device

CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.

• All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
• CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
• CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
• CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.

CISA flags Siemens WinCC privilege escalation flaw with no fix for V7.5

CISA has republished a Siemens ProductCERT advisory covering a high-severity privilege escalation flaw in SIMATIC WinCC, the SCADA system used across critical manufacturing, energy, healthcare, transport, government and financial services. Siemens has shipped fixes for two version lines but has none for V7.5. The flaw lets an authenticated user with database access execute commands on the underlying host.

• CVE-2026-59241 carries a CVSS v3.1 base score of 8.8 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• All versions of SIMATIC WinCC V7.5 are affected and no fix is currently available.
• Siemens has fixed the flaw in V8.0 Update 11 and V8.1 Update 7; users should update to those or later versions.
• An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host running WinCC.
• CISA recommends minimising network exposure, placing control systems behind firewalls and using secure remote access such as VPNs.

CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

• CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
• The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
• PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
• PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
• CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.

CISA flags five vulnerabilities in Siemens RUGGEDCOM APE1808 with Nozomi software

CISA has republished a Siemens ProductCERT advisory covering five vulnerabilities in RUGGEDCOM APE1808 devices running Nozomi Networks' Guardian/CMC software. The flaws range from low to high severity and touch dashboard, credential management, polling and login functions used across critical infrastructure deployments worldwide.

• Five CVEs affect all versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC: CVE-2026-33387, -33388, -33389, -33391 and -33920.
• CVE-2026-33389, an improper certificate validation flaw in Smart Polling, carries the highest individual CVSS 3.1 score of 7.5.
• CVE-2026-33388 scores 7.4 and allows a limited-privilege authenticated user to delete or edit Credentials Manager entries, potentially disrupting authentication.
• Siemens directs affected organizations to contact customer support directly to receive patch and update information rather than publishing a fix in the advisory.
• The advisory was initially released on 2026-10-13 and republished by CISA on 2026-10-22 as SSA-911336.

CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software

CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.

• Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
• CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
• The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
• CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
• Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.

CISA flags ZigBee DoS flaw in Siemens SENTRON 3NA COM Fuse

This advisory covers a medium-severity denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse units running firmware below V5.2, deployed worldwide across multiple critical infrastructure sectors. Operators running affected versions should read the fix path and recommended network protections before deciding on patch timing.

• CVE-2024-7322 affects SENTRON 3NA COM Fuse versions below V5.2 and carries a CVSS v3.1 base score of 5.8 (medium).
• An unsolicited encrypted rejoin response can change a ZigBee device's node ID, causing a denial-of-service condition.
• Recovery from the DoS condition requires the affected network to be re-established.
• Siemens' remediation is to update affected devices to V5.2 or later.
• The advisory lists deployment across critical manufacturing, transportation, energy, healthcare, financial services and government facilities sectors worldwide.

Siemens Software Center flaw under active exploitation, CISA confirms

CISA has republished a Siemens ProductCERT advisory covering a DLL hijacking flaw in Siemens Software Center, a tool used across critical manufacturing, energy, healthcare, financial services and government facilities deployments worldwide. The advisory notes active exploitation and directs users to apply the vendor's fix, which auto-updates on next startup.

• CVE-2026-110936 affects Siemens Software Center versions prior to V4.0.9.8 via an uncontrolled DLL search path (CWE-427).
• CVSS v3.1 base score is 6.7 (medium), with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, requiring local access and high privileges.
• Siemens states existing Software Center installations will be auto-updated to V4.0.9.8 or later on next startup.
• The advisory references a Siemens blog post providing additional information on current known active exploitation and how to detect it.
• Revision 3 of the advisory, dated 2026-10-19, added the reference to active exploitation, two days after initial publication.

CISA flags high-severity flaw in InterSystems IRIS for Health, TLS off by default

CISA has published an ICS Medical Advisory covering a cleartext transmission vulnerability in InterSystems IRIS for Health, a platform used across the healthcare sector worldwide. The flaw stems from TLS/SSL being disabled by default. Compliance and security teams running affected versions should review this briefing before deciding how urgently to act.

CISA flags out-of-bounds read flaw in Siemens Capital Embedded AR Classic

CISA has republished a Siemens ProductCERT advisory covering an out-of-bounds read vulnerability in Capital Embedded AR Classic, used across manufacturing, energy, transport, healthcare, financial services and government facility sectors worldwide. The advisory sets out which versions are fixed, which have no fix planned, and what mitigations operators should apply in the interim.

• CVE-2026-89208 is an out-of-bounds read vulnerability with a CVSS v3.1 base score of 5.3, rated medium severity.
• Capital Embedded AR Classic R20-11 versions before V2303 should be updated to V2303 or later, per Siemens' vendor fix.
• Siemens has no fix planned for Capital Embedded AR Classic 431-422 and recommends mitigation only.
• Siemens recommends applying network segmentation and placing ECUs behind properly configured gateways and firewalls for both affected versions.
• The product is deployed worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors.

CISA flags denial-of-service flaws in Siemens building automation controllers

CISA's advisory covers multiple remotely exploitable vulnerabilities in widely deployed Siemens building automation controllers used across critical manufacturing, energy, healthcare, financial services and government facilities worldwide. Compliance and OT security teams running APOGEE, TALON or Desigo PXC/PXM equipment should check which product lines have patches available versus those left on mitigation-only guidance.

• CISA released advisory ICSA-26-295-08 on October 22, 2026 covering Siemens APOGEE, TALON and Desigo PXC/PXM products.
• The highest-rated vulnerability, affecting APOGEE MBC (PPC) BACnet, carries a CVSS v3 base score of 8.2 across three CWE categories: out-of-bounds read, integer underflow and stack-based buffer overflow.
• Siemens has issued vendor fixes for APOGEE PXC Compact/Modular and TALON TC Compact/Modular, updating to V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet).
• Siemens states no fix is planned for APOGEE MBC/MEC (PPC) variants or any of the thirteen listed Desigo PXC/PXM controller models.
• Recommended mitigations for unpatched products include network segmentation behind gateways/firewalls and disabling the FTP/Web service, which Siemens says is off by default.

DOJ and HHS open six-month False Claims Act self-disclosure pilot for healthcare firms

The Justice Department's Civil Division and HHS have launched a six-month pilot giving healthcare companies a defined route to resolve potential False Claims Act violations by disclosing them voluntarily. The programme fixes the repayment multiplier at 1.25 to 1.6 and offers a coordinated civil release from FCA and certain HHS administrative liability. This briefing sets out who qualifies, what a disclosure must contain, and the deadline.

• The six-month FCA SDPP accepts self-disclosure submissions through April 22, 2027, and late or incomplete filings will not be reviewed.
• Self-disclosing companies must repay the government with a 1.25 to 1.6 multiplier, varying by timeliness, scope, senior-leadership involvement, financial benefit and successor liability.
• Participants must describe all relevant conduct, produce sufficient documents and set out remedial actions taken, submitting electronically to FCA-SDPP@usdoj.gov.
• Qualifying companies receive a coordinated civil release from liability under the federal False Claims Act and certain HHS administrative authorities.
• The pilot covers potential civil violations only; potential criminal conduct must be disclosed to DOJ's National Fraud Enforcement Division.

CFPB updates FOIA and Privacy Act records system, adds NARA inspection disclosure

A routine but mandatory Privacy Act notice from the CFPB updating its primary FOIA/Privacy Act records system. The segment covers what the modification actually changes: scope of records, system manager, retention schedule, and a new disclosure pathway to NARA. Useful for privacy and records officers tracking agency practice.

• Comments on the modified system of records notice must be received no later than November 20, 2026, the same date the new system becomes effective absent a contrary determination.
• A new routine use permits disclosure of records to the National Archives and Records Administration or other federal agencies conducting records management inspections under 44 U.S.C. 2904 and 2906.
• The Chief Privacy Officer is clarified as the system manager for records related to Privacy Act amendment requests under 12 CFR 1070.56.
• The authority for maintaining the system is broadened to explicitly include the Freedom of Information Act, the Privacy Act of 1974, and the Federal Records Act, 44 U.S.C. 3101.
• Categories of records and individuals covered are expanded to clearly include those requesting amendment of records, including initial appeals and statements of disagreement.

Washington regulator urges rate shopping within CFPB's 14 to 45 day window

A consumer education post from Washington State's Department of Financial Institutions walks through how lenders evaluate loan applications and how borrowers can compare offers without unnecessary credit score damage. It draws on CFPB guidance about credit inquiry timing for auto loans.

• The post states a lender may consider debt-to-income ratio, comparing monthly debt payments with gross monthly income, when evaluating an application.
• The CFPB is cited as stating that multiple inquiries for an auto loan made within a relatively short period are generally treated as a single inquiry for scoring purposes.
• The CFPB recommends keeping auto-loan shopping within a 14- to 45-day window, according to the post.
• The post advises comparing APR, interest rate, loan term and total cost rather than relying on monthly payment alone, since a longer loan term can lower payments while increasing total interest paid.
• The post recommends researching advertised rates first, then seeking actual prequalification or preapproval offers from a narrowed set of lenders within a focused shopping period.

IRS seeks comments on paperwork burden for ABLE disability savings accounts

A routine Paperwork Reduction Act notice covering the recordkeeping and reporting tied to qualified ABLE programs, the tax-favored savings accounts for eligible disabled individuals. The filing matters mainly to state agencies administering these programs and to compliance teams tracking OMB-approved collections rather than substantive tax changes.

• Comments on the information collection are due on or before December 14, 2026.
• The collection operates under OMB Control No. 1545-2293 and Regulatory Number TD 9923.
• The IRS states there is no change to the previously approved information collection, which is an extension of a currently approved collection.
• The estimated number of annual responses is 28,987, with an estimated time per response of 22 minutes.
• Estimated total annual burden hours are 10,729, covering individuals, households and states as the affected public.

CISA and Canadian Cyber Centre issue joint guidance on AI token consumption

CISA, Canada's Cyber Centre and partners released joint guidance on managing token consumption in third-party super intelligence services. It treats unmanaged token usage not as a billing nuisance but as an availability and resilience problem for critical infrastructure, and sets out practical steps to prioritise, monitor and optimise consumption while keeping human oversight of AI-enabled defence workflows.

• CISA, the Canadian Centre for Cyber Security and partners jointly published the guidance on 22 October 2026.
• The guidance names token exhaustion and denial-of-tokens or denial-of-wallet attacks as risks of unmanaged consumption.
• Recommended steps include prioritising token allocation, caching and reusable context, optimising data before submission, and monitoring consumption over time.
• Critical infrastructure owners are told to identify mission-critical functions dependent on SI and plan for reduced availability during outages, incidents or high demand.
• Cyber defenders are advised to run SI-enabled defence workflows while maintaining human oversight, governance and cybersecurity fundamentals.

US industrial production rose 0.7% in September as utilities surged

The Federal Reserve's September industrial production report, summarised by the ABA Banking Journal, shows headline output up 0.7% after a flat August, driven by utilities and consumer goods. Manufacturing managed only a modest gain as motor vehicle output fell. For bank economists and credit teams tracking the real economy, the composition matters as much as the headline.

• Total industrial production rose 0.7% in September and stood 2.2% above its year-earlier level at 104.0% of the 2017 average.
• Utilities output surged 3.5% and manufacturing rose 0.3%, while business equipment was unchanged among the major market groups.
• Motor vehicles and parts output fell 3.0%, dragging on durable manufacturing, which edged up just 0.1% for the month.
• Semiconductor and related electronic components output rose 28.4% in the third quarter, lifting durable manufacturing to a 3.8% annual growth rate.
• Capacity utilization moved up to 76.9%, which remains 2.5 percentage points below its 1972 to 2025 long-run average.

Fed posts change-in-control notice for Missouri's Midwest Regional Bancorp

The Federal Reserve has published a Change in Bank Control Act notice covering a family group seeking to acquire voting shares of Midwest Regional Bancorp, Inc. of Festus, Missouri, and indirectly its bank subsidiary. The notice sets a comment deadline and routes filings through the Federal Reserve Bank of St. Louis. It is a procedural publication, but it marks the start of the public clock.

• The notice is filed under the Change in Bank Control Act (12 U.S.C. 1817(j)) and section 225.41 of Regulation Y (12 CFR 225.41).
• The group acting in concert proposes to acquire voting shares of Midwest Regional Bancorp, Inc., Festus, Missouri, and indirectly Midwest Regional Bank, Clayton, Missouri.
• Written comments on the standards in paragraph 7 of the Act must be received no later than October 30, 2026.
• The applicants include two Bender family revocable living trusts, seven named individuals, and JJB Capital, LLC, with the filing routed through the Federal Reserve Bank of St. Louis.

Oklahoma landlord to pay $52,500 over refusal to rent to family with child

A DOJ civil rights settlement resolves a lawsuit against the owners of an Oklahoma City apartment complex accused of refusing to rent to a single mother once she disclosed her three-year-old son would live with her, a violation of the Fair Housing Act's familial status protections.

• Defendants agreed to pay $52,500 to the woman who was denied an apartment at The Vintage at Mesta Park.
• The lawsuit was filed in the U.S. District Court for the Western District of Oklahoma in August 2025, following events from July 2022.
• Defendant Jacqueline Fox allegedly told the woman she could not move in because no children had resided at the property in over eight years and it was not "kid friendly."
• The settlement requires defendants to implement a nondiscrimination policy and undergo training to prevent future familial status discrimination.
• HUD referred the case to DOJ after investigating the woman's complaint and issuing a charge of discrimination.

DOJ charges 15 in Los Angeles health care fraud takedown over $1.8bn in claims

The Justice Department's new National Fraud Enforcement Division unveiled a coordinated Los Angeles takedown spanning sober home, hospice, atherectomy, genetic testing and pharmacy fraud. For compliance leads at insurers and providers, the sweep shows how data analytics now drives case selection and how kickback-driven patient recruitment remains the common thread across schemes totalling over $1.8 billion in fraudulent claims.

• Nathan Young, David Young, Honey Phipps and Cody Phipps are charged over a scheme that billed private insurers more than $1.6 billion for sham substance abuse treatment, with co-defendant Nicholas Moore pleading guilty to assisting $199 million in fraudulent claims.
• Dr. Harold Tabaie and Hany Malek face a $135 million Medicare scheme for unnecessary atherectomies, a case DOJ says was identified through data analytics showing Tabaie as an extreme national billing outlier from 2016 through 2023.
• Three separate hospice schemes, charged against Geoffrey Jimenez, Dr. Richard Keech and Armani Raffi, allegedly billed Medicare over $138 million for patients who were not terminally ill, with non-death discharge rates far above the national average.
• Christina Mareik was indicted over a nearly $270 million Medi-Cal pharmacy scheme exploiting the suspension of prior-authorization requirements, with approximately $269,130,000 billed and at least approximately $178,746,000 paid.
• Doctors Hassan Badday and Robby Ayoub are charged with accepting per-patient kickbacks from a marketer for ApolloMDx laboratory in exchange for authorizing medically unnecessary genetic testing orders.

FTC sues ticket broker REPS over scheme to bypass purchase limits

The FTC referred a complaint to the Department of Justice against ticket broker REPS & Company and three executives, alleging systematic circumvention of ticket-issuer purchase limits under the Better Online Ticket Sales Act. The case touches on how resellers evade platform security controls and what obligations that law imposes on brokers operating at scale.

• The complaint alleges REPS purchased more than eight tickets for at least 83,500 events since 2022.
• REPS allegedly spent more than $1.3 billion to amass more than 18.5 million tickets.
• The complaint alleges REPS generated at least $120.8 million in profit reselling these tickets.
• One example cites $833,000 in profit from using 1,300 accounts to buy 7,624 tickets to a 2023 Beyonce Renaissance tour concert in Kansas City.
• The Commission voted 2-0 to refer the complaint to the DOJ, which filed it in the U.S. District Court for the Southern District of California.

Cboe EDGX bars unpriced orders outside regular hours ahead of 23x5 launch

Cboe EDGX has filed two clarifying amendments to its order-handling rules as it prepares to trade 23 hours a day, five days a week. The changes restrict execution of unpriced orders to regular trading hours and tighten the wording on when Day Orders entered overnight expire. The filing took effect immediately as non-controversial, with comments open until November 12, 2026.

• New text in Rule 11.1(a)(3) states that orders without a limit price will not be eligible for execution outside Regular Trading Hours, which are 9:30 a.m. to 4:00 p.m. Eastern Time.
• Rule 11.6(q)(2) is amended so a Day Order entered during Order Acceptance Queueing Time or the Overnight Trading Session expires at the end of Regular Trading Hours on the business day to which the Overnight Trading Session belongs.
• The Exchange filed the change as a non-controversial proposal under Section 19(b)(3)(A)(iii) and Rule 19b-4(f)(6), making it immediately effective.
• The amended rule text takes effect in December 2026 pending industry readiness, operative in conjunction with the Original Filing approved under SR-CboeEDGX-2026-019.
• Written comments must be submitted on or before November 12, 2026, referencing file number SR-CboeEDGX-2026-071.

FTC sues GovAssist and owner Scott Zuckerman over passport impersonation scheme

The FTC has filed suit against GovAssist LLC, Entry LLC and individual Scott Zuckerman, alleging they impersonated the US government to lure travellers seeking passport services. The case tests the agency's Impersonation Rule and reaches a defendant already operating under a prior FTC order. For compliance teams at advertisers and platforms, it maps how the FTC frames paid-search impersonation as an FTC Act violation.

• The FTC alleges GovAssist, Entry and Zuckerman impersonated the US State Department through paid Google search ads since at least October 2023.
• The complaint cites violations of the FTC Act, the Impersonation Rule and the Gramm-Leach-Bliley Act.
• Defendants advertised services starting at $89 while the lowest actual price was $119 plus a $29 shipping fee, totalling $148 as stated by the FTC.
• Individual defendant Scott Zuckerman ran the scheme while under a prior FTC order in the unrelated Support King LLC stalkerware case.
• The Commission authorised the complaint on a 2-0 vote; it was filed in the US District Court for the District of Puerto Rico.

OFAC clears 125 names in sanctions overhaul, issues first PAIPA licenses

The ABA's fortnightly digest of OFAC and State Department sanctions activity through Oct. 19 covers a 125-name delisting, the first general licenses under the Protecting American Intellectual Property Act, fresh Russia, Iran and Cuba measures, an ICC-related settlement, cartel designations and Venezuela earthquake-relief authorization. Screening and wind-down obligations run in several directions at once.

• On Oct. 5, OFAC removed 125 individuals and entities from its sanctions lists and updated 22 list entries to improve compliance screening.
• On Oct. 19, OFAC issued PAIPA General License 1 and General License 2 and added entities to its non-SDN menu-based sanctions list.
• OFAC reached a $175,015 settlement with Pegasus Worldwide Logistics over potential sanctions and reporting violations, and issued four ICC-related general licenses.
• On Oct. 15, State designated Cuba's BANCO INTERNACIONAL DE COMERCIO S.A. (BICSA) under E.O. 14404 and OFAC issued Russia- and Iran-related general licenses.
• OFAC issued Venezuela-related General License 60A authorizing transactions related to earthquake relief efforts and amended FAQ 1263.

DOJ and FTC sue California ticket broker over BOTS Act violations

The Justice Department's Civil Division, with the FTC, has filed a civil complaint against a California ticket broker and its executives for allegedly circumventing ticket-purchase limits at scale. This briefing covers who is named, the statutory basis, and the figures alleged in the filing.

• DOJ's Civil Division and the FTC filed a complaint against REPS & Company Inc. and three named executives: Ryan Pancheri, Brian Archibald, and Nicholas Totagrande.
• The complaint alleges violations of the FTC Act and the Better Online Ticket Sales (BOTS) Act, which bars circumventing ticket sellers' access controls.
• Defendants allegedly spent more than $1.3 billion to amass over 18.5 million tickets for thousands of events since 2022.
• The complaint alleges at least $120.8 million in profit from reselling the tickets on the secondary market.
• The case was filed in the U.S. District Court for the Southern District of California; the claims are allegations only, with no determination of liability.

DOJ sues St. Paul and Portland over mask and ID rules for federal officers

The Justice Department has filed complaints against two cities challenging local ordinances that regulate how federal law enforcement officers identify themselves and whether they may wear masks. The filings extend a wider Civil Division campaign against state and local measures it views as obstructing federal operations, a pattern compliance and government affairs teams tracking federal-local friction should note.

• DOJ filed lawsuits against St. Paul, Minnesota and Portland, Oregon on October 15, 2026, press release number 26-1209.
• The challenged laws are Saint Paul Code of Ordinances §§ 268A-268B and Portland City Code §§ 23.30.030 and 23.30.100.
• The complaints invoke the Supremacy Clause, arguing local governments cannot regulate equipment worn by federal officers on duty.
• Attorney General Blanche has directed the Civil Division to identify state and local laws impeding federal law enforcement operations nationwide.
• The department describes these filings as part of a series that has previously targeted New York, Virginia, Connecticut, New Jersey, California, Maryland, Philadelphia, Denver and Milwaukee.

Smuggler sentenced to five years for northern border human smuggling ring

A DOJ press release details the sentencing of Edgar Sanchez-Solis, a leader of an alien smuggling organization that moved migrants across the US-Canada border. The case, part of Operation Take Back America and Joint Task Force Alpha, outlines the scheme's structure, a 2023 vehicle chase, and co-defendants awaiting sentencing.

• Edgar Sanchez-Solis, 27, was sentenced to five years in prison for conspiracy to commit alien smuggling and five counts of alien smuggling for commercial advantage and private financial gain.
• The smuggling organization operated between December 2022 and April 2025 and smuggled hundreds of aliens from Mexico and Central and South America across the Canadian border into the United States.
• In May 2023, a van carrying smuggled aliens led US Border Patrol on a vehicle chase that ended when officers used a tire deflation device.
• Three co-defendants, Ignacio Diaz-Perez, Samuel Diaz-Perez, and Salvador Diaz-Diaz, pleaded guilty to related conspiracy and smuggling counts and are expected to be sentenced on November 23.
• Joint Task Force Alpha's work to date has resulted in more than 486 domestic and international arrests and more than 486 US convictions, according to the release.

San Diego man pleads guilty to evading over $6.7 million in taxes

The Justice Department announced a guilty plea in a tax evasion case involving an unreported income scheme tied to the sale of purported federal tax credits. The item covers the scale of unreported income, how proceeds were concealed and spent, and the sentencing timeline, relevant to compliance teams tracking enforcement trends in tax-related fraud.

• Peter L. Roper's businesses received nearly $19 million in income between 2010 and 2021 that was never reported to the IRS.
• Roper owed more than $6.7 million in federal income taxes on that unreported income.
• He spent $187,432.34 on a 2015 McLaren 650S Spider and $277,698.50 on a 2021 Aston Martin DBX using business funds.
• Roper concealed assets by titling them in the names of others and pleaded guilty to one count of tax evasion.
• Sentencing is scheduled for Jan. 8, with a maximum penalty of five years in prison.

US retail sales rise 0.8% in September, topping forecasts

A short data note from the ABA Office of the Chief Economist on the Commerce Department's September 2026 retail sales estimate, with the trade group's read on what it means for consumer lending demand. Useful for bank economists and lending teams tracking consumer demand signals.

• September 2026 retail and food services sales reached $745 billion, up 0.8% from August, exceeding the 0.3% market expectation.
• August 2026 retail sales growth was revised upward to 1.3% from an initial 1.1%.
• Gasoline station sales rose 6.4% in September, while sales excluding gas stations rose only 0.2%.
• Retail sales were up 6.2% year over year compared with September 2025.
• The ABA Office of the Chief Economist warns that sustained higher essential spending could hurt consumer loan performance.

Jamaican national pleads guilty to illegal voting in 2024 US election

A guilty plea in federal court in Trenton shows the Justice Department's Election Integrity Task Force pursuing individual noncitizen voting cases alongside broader actions. The case carries direct relevance for compliance teams monitoring how federal agencies coordinate on immigration and election-related enforcement, and signals continued prioritization of this enforcement area.

• Gaye Tyndale-Simpson, 55, a citizen of Jamaica, pleaded guilty to one count of voting by an alien in a federal election.
• The plea concerns votes cast in the November 2024 general election, held in part to elect a president.
• The charge carries a maximum penalty of up to 6 months in prison and a $100,000 fine.
• Sentencing before Judge Singh is scheduled for February 24, 2027.
• The case was investigated by the FBI, Homeland Security Investigations, the State Department's Diplomatic Security Service, and USCIS under the U.S. Attorney's Office's Election Integrity Task Force.

FTC wins $106.8 million judgment shutting down debt relief scheme

This item covers a default judgment and related stipulated orders closing out an FTC enforcement action against a debt relief operation accused of impersonating banks and government agencies. It matters for compliance teams at debt relief and credit services firms because it details the specific bans and asset turnover terms now attached to individuals and entities in the industry.

• The court entered a $106.8 million default judgment on October 14, 2026 against Accelerated Debt Settlement Inc. and six affiliated entities.
• Jeffrey Lakes faces a $104.3 million judgment, jointly and severally with other defendants, partially suspended after he turns over approximately $12.6 million in assets.
• Robert Knechtel's $37,299,828 judgment will be suspended based on his inability to pay.
• Elizabeth Reaney must transfer $175,000 or the title to her home in Scottsdale, Arizona.
• The order bans defendants from impersonating government entities or businesses, telemarketing, and misrepresenting credit report purposes or debt relief outcomes.

Village Capital to pay over $500,000 over servicemember loan rights violations

DOJ settled claims that VA home loan servicer Village Capital & Investment LLC mishandled Servicemembers Civil Relief Act interest rate protections and retaliated against borrowers who asserted their rights. The settlement sets out payment terms, a civil penalty and compliance obligations relevant to other VA loan servicers monitoring SCRA enforcement.

• DOJ alleges Village Capital failed to apply SCRA's 6% interest rate cap retroactively to at least 41 servicemembers' pre-service mortgage debts.
• The company will pay at least $425,000 to affected servicemembers plus a $79,380 civil penalty, the maximum for a first SCRA violation.
• DOJ alleges Village Capital misled borrowers by telling them their rate was already below 6% when it was in fact above 6%.
• The settlement requires Village Capital to revise policies and procedures and provide SCRA training to employees.
• DOJ alleges Village Capital retaliated against rate-benefit requesters by accelerating principal and falsely reporting their loans as delinquent to the VA.

US banks turn to podcasts for marketing as listenership reaches 158 million

The ABA Banking Journal profiles how community and regional banks use podcasting as a marketing and relationship tool. It draws on practitioners at South State Bank, Sunrise Banks and the former Keystone Bank, covering why they launched, how they measure results and what separates shows that gain traction from those that stall. A short, practical read for marketing and communications leads.

• RSS.com data cited in the piece puts US monthly podcast listeners at more than 158 million, about half of Americans aged 12 and over.
• Grandview Research forecasts the US podcasting market will grow by about 19 percent between 2025 and 2030.
• South State Bank's The Community Bank Podcast now averages about 3,500 downloads per month, up from roughly 500 at its 2020 launch.
• Practitioners stress defining a target audience and keeping production lean, with Sunrise Banks describing a setup of "a Yeti mic and then some graphic designer's time."
• There are approximately 4.5 million podcasts registered worldwide, making intentional promotion necessary to capture attention.

ISIS-inspired inmate gets 50 years for stabbing attack on prison guards

A Justice Department press release details the sentencing of Abdulrahman El Bahnasawy for a 2020 assault on two corrections officers at USP Allenwood while he was already incarcerated for plotting ISIS attacks in New York City. The release covers the sentence, the underlying conduct, and prior proceedings.

• Bahnasawy, 28, was sentenced to 50 years for the Dec. 7, 2020 attack on two corrections officers at USP Allenwood.
• The 50-year term runs consecutive to the 40-year sentence he is already serving for plotting a 2016 ISIS attack in New York City.
• Bahnasawy pleaded guilty in November 2025 to assault, assault with intent to commit murder, possession of contraband, and providing material support to ISIS.
• One of the two attacked corrections officers lost his right eye as a result of the assault.
• A note reading 'This is a terrorist attack for the Islamic State' was found in Bahnasawy's sock after he was restrained.

State Department waives child soldier arms restrictions for eight countries

The Child Soldiers Prevention Act bars certain US military assistance and arms sales to governments that recruit child soldiers unless the President certifies progress and waives the restriction. This notice records the annual national-interest determination covering eight countries and sets out exactly which categories of assistance each waiver unlocks.

• The waiver for the Central African Republic covers IMET assistance, excess defense articles and DCS licenses only.
• The DRC waiver is limited to IMET, peacekeeping operations assistance and DCS licenses.
• Ethiopia, Nigeria and Yemen receive full waivers of the section 404(a) prohibition with no stated limitation.
• Somalia's waiver is restricted to peacekeeping operations assistance and support under 10 U.S.C. 331 and 10 U.S.C. 333.
• The Russian Federation receives a waiver solely for DCS licenses connected to the International Space Station.