Live 262 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network

Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

Regulatory heat map

Where it's moving right now · select a region to filter
Category
Country
Regulator
DOJ Criminal Division 99 Federal Register — SEC 56 American Bankers Association — newsroom 47 CISA Advisories 37 BIS Press Releases 36 FCA 29 European Central Bank 26 HM Revenue & Customs 20 SEC Press Releases 16 Bank of England 15 Washington State DFI 14 Regulus Weekend Edition 14 US Federal Trade Commission — press releases 14 Financial Stability Board 14 FCA Publications 12 SFC Hong Kong 11 OCC Bulletins 11 FINRA 10 Federal Register — Treasury 10 CFTC — Commodity Futures Trading Commission 10 Federal Register — State Department 9 Securities and Exchange Commission 8 ISDA 8 Federal Reserve 8 ECB Banking Supervision 8 CSSF Luxembourg 8 SEC Speeches and Statements 7 HKMA — Hong Kong Monetary Authority 7 European Commission Digital Strategy 7 Deutsche Bundesbank — speeches 7 ADGM Abu Dhabi — announcements 7 Federal Register — NCUA 6 Federal Register — CFTC 6 ESMA 6 Bank of England Publications 6 Bank Negara Malaysia 6 Single Resolution Board 5 International Criminal Court 5 UK Competition and Markets Authority 5 NIST 4 IC3 — FBI Internet Crime Complaint Center 4 FMA Austria 4 Federal Register — Federal Reserve 4 Deutsche Bundesbank 4 Brdr.Hkma 4 Bank Policy Institute 4 Amlcft.Bnm 4 AFM Netherlands 4 FCDO — sanctions announcements 3 HM Treasury 3 Financial Services and the Treasury Bureau 3 Federal Reserve Speeches 3 UK DSIT 3 CFTC Enforcement 3 ASEANAPOL 3 AMF France 3 Alliance for Financial Inclusion 3 US Treasury — press releases 2 UN — press releases 2 Department for Business and Trade — export control 2 NIST — cybersecurity and identity updates 2 National Crime Agency UK 2 Hong Kong Exchanges and Clearing Limited 2 HM Treasury Consultations 2 Federal Register — FDIC 2 Federal Register — CFPB 2 Press Releases | FDIC.gov 2 European Data Protection Board 2 CFPB 2 Bank of Ghana 2 ACPR 2 UN News — global perspective 1 UK Finance — news 1 Texas State Securities Board 1 Singapore Police Force 1 Sveriges Riksbank 1 Osaka Exchange 1 OFSI 1 NCSC UK 1 MAS — Monetary Authority of Singapore 1 Euronext 1 International Association for Trusted Blockchain Applications 1 European Commission — Migration and Home Affairs 1 Govinfo 1 GFMA — Global Financial Markets Association 1 Finanstilsynet Norway 1 Federal Register — OCC 1 Federal Register — FinCEN 1 Federal Register — Industry and Security Bureau 1 Eurex 1 European Payments Council 1 EDB Singapore — Economic Development Board 1 CSSF / Banque centrale du Luxembourg 1 Cyber Security Agency of Singapore 1 Croatian Financial Services Supervisory Agency (HANFA) 1 Companies House 1 Commerce Commission New Zealand 1 Bank for International Settlements 1 Banco de España 1 Bank of Russia 1 Banco de la República 1 Banco Central de Bolivia (BCB) 1
Showing
country: United States × since: all × Clear all

Filtered

Cards Wire 351–400 of 422
BPIU Bank Policy Institute Source document ↗
United States Bank Policy Institute Governance & Accountability ✓ 17 claims 19 Oct 2026

FDIC and OCC propose easing rules on sharing confidential supervisory information

The FDIC and OCC have proposed reworking the rules that govern how banks handle confidential supervisory information. BPI, which supports much of the direction, sets out where the proposals fall short: imprecise definitions, prescriptive confidentiality agreements, limited third-party disclosure categories and no notice before discretionary agency disclosures. This explainer is the fastest route to what is on the table and what BPI wants changed.

  • The FDIC and OCC proposals would expand when banks may share their own CSI without obtaining prior regulatory approval.
  • BPI wants CSI defined precisely so institution-generated materials do not become CSI merely because they are shared with or reviewed by the FDIC or OCC.
  • BPI recommends notice and an opportunity to object before an agency makes a discretionary disclosure of institution-specific CSI.
  • BPI asks that prescriptive confidentiality-agreement requirements be replaced with a principles-based framework.
  • BPI urges the FDIC and OCC to work with the Federal Reserve to align the banking agencies' CSI regulations.
Source document
RWE Regulus Weekend Edition Source document ↗
United States Regulus Weekend Edition AI, Technology & Data ✓ 19 claims 18 Oct 2026

CISA audited its own network tool and found a password hardcoded as 'Malcolm'

The lighter file this week is really a file about self-administration: the body that polices everyone's patching disclosed seven flaws in its own monitoring tool, including a password named after the product and an unauthenticated route to wiping forensic data. Alongside it, two US transparency portals returned access-control screens instead of notices, and HMRC amended the same export process twice in three months. The joke is free; the discipline it rewards is not.

  • CISA advisory ICSA-26-280-01, updated 15 October 2026, lists seven CVEs in CISA's own Malcolm tool, including a passwordSecret hardcoded as "Malcolm".
  • Malcolm fixes split across v26.08.0 and v26.09.0, so an operator who stops at v26.08.0 leaves CVE-2026-107333 and CVE-2026-107362 open.
  • Federal Register pages for an SEC CME Securities Clearing notice dated 13 October and a Treasury information-sharing collection dated 9 October returned access-control screens with no operative text.
  • HMRC amended its export examination-premises approval process on 8 October 2026, three months after an 8 July 2026 revision, and these notices carry the force of law.
  • CISA reports no known public exploitation of the Malcolm flaws to date.
Source document
RWE Regulus Weekend Edition Source document ↗
United States Regulus Weekend Edition Financial Crime ✓ 19 claims 18 Oct 2026

DOJ and Labor debar Cloudera from PERM for two years in US-worker bias settlement

A quiet week for sanctions designations and AML fines, but the enforcement that did land is instructive. The headline action pairs a Labor Department debarment with a DOJ civil-rights penalty from one set of facts. Alongside it, AMLA opened its simplified-CDD consultation channel and the ABA signalled where it sees fraud moving. Five minutes on what bit and what to watch.

  • Cloudera will be debarred from the PERM program for two years, fund $1.4 million in back pay and pay $600,000 in civil penalties.
  • DOJ described the Cloudera resolution as the fourteenth settlement since it relaunched its Protecting U.S. Workers Initiative in 2025, resolving an April lawsuit over recruitment for seven positions.
  • AMLA's expression-of-interest window for in-person Frankfurt roundtables on simplified customer due diligence closed 18 October 2026 at 23h59 CEST, with sessions running 9 November to 2 December.
  • The ABA's fraud-management award citation for M&T Bank's Karen Boyer foregrounded payment threats, social engineering, scams and account takeover as the current retail-banking fraud frontier.
Source document
FED Federal Reserve Source document ↗
United States Federal Reserve Prudential & Capital ✓ 13 claims 18 Oct 2026

Fed clears Isabella Bank Corporation to acquire Grand River Commerce in Michigan

The Federal Reserve Board approved Isabella Bank Corporation's application to acquire Grand River Commerce and its subsidiary Grand River Bank, both of Grandville, Michigan. The approval also covers the merger of the two banks and the operation of Grand River's branches. For anyone tracking community-bank consolidation in the Midwest, this is the clean grant and the issued order that follow it.

  • The Federal Reserve Board approved Isabella Bank Corporation's acquisition of Grand River Commerce, Inc., announced October 5, 2026.
  • The approval lets Isabella Bank Corporation indirectly acquire Grand River Bank of Grandville, Michigan.
  • The Board also approved Isabella Bank's merger with Grand River Bank and the operation of branches at Grand River Bank's locations.
  • The approval is accompanied by an order published as a PDF and recorded in the Board's votes.
Source document
SEC SEC Press Releases Source document ↗
United States SEC Press Releases Governance & Accountability ✓ 15 claims 18 Oct 2026

SEC proposes to rescind Rule 14a-8 and modernise proxy solicitation process

The SEC has issued two proposing releases on its proxy rules under the Securities Exchange Act of 1934. One would rescind Rule 14a-8 and amend Rule 14a-4(c); the other modernises the proxy solicitation process. Comment periods run 60 days from Federal Register publication. This segment covers what each release changes and the statutory-authority argument driving the first.

  • The SEC proposed to rescind Rule 14a-8 under the Securities Exchange Act of 1934, citing statutory authority limits and intrusion into state law.
  • Rescission would leave the role of shareholder proposals to state law and company governing documents.
  • The Commission proposed amendments to Rule 14a-4(c) on discretionary proxy voting authority.
  • Solicitation amendments would eliminate the annual-report delivery requirement, drop the incorporation-by-reference delivery deadline, remove Notices of Exempt Solicitation, and cut the broker search period from 20 to five business days.
  • Both comment periods remain open for 60 days after Federal Register publication.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 21 claims 18 Oct 2026

CISA flags six Eclipse Milo flaws exposing OPC UA servers to credential theft and denial of service

CISA's October 15 industrial-control advisory covers multiple vulnerabilities in Eclipse Foundation's Eclipse Milo OPC UA server software. The flaws range from authorization bypasses to a password-recovery padding oracle and several denial-of-service conditions. For operators in chemical, critical manufacturing, energy and water sectors, the practical sting is that affected 0.6.x deployments cannot be patched in place and must be migrated to 1.1.5 or later.

  • CISA advisory ICSA-26-288-01, released October 15, 2026, covers vulnerabilities in Eclipse Milo versions 0.6.0 through 1.1.4.
  • CVE-2026-60007, a padding-oracle flaw enabling password recovery, carries a CVSS v4 base score of 9.1, rated critical.
  • The Eclipse Foundation recommends upgrading to Eclipse Milo 1.1.5; there are no 0.6.x releases with the fixes, requiring migration.
  • Successful exploitation could delete protected data, recover credentials and impersonate users, or stop the server responding to all clients.
  • Affected deployments span the chemical, critical manufacturing, energy, and water and wastewater sectors worldwide.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 21 claims 18 Oct 2026

CISA flags seven flaws in its own Malcolm network-monitoring tool, top score 8.1

CISA has published advisory ICSA-26-280-01 covering seven CVEs in Malcolm, its own network traffic analysis platform, deployed worldwide across energy, IT and water sectors. The defects range from unauthenticated access to the Arkime backend to a CSRF route that can permanently delete captured traffic. This segment walks through what each flaw allows, which versions are affected, and where the fixes landed.

  • Advisory ICSA-26-280-01 covers seven CVEs in CISA Malcolm, affecting versions up to and including v26.08.0.
  • CVE-2026-107333, an RBAC path-normalization bypass, carries the highest score at CVSS v3 8.1 HIGH and was patched in v26.09.0.
  • CVE-2026-107362, a server-side request forgery in the FilePond upload component, was also patched in v26.09.0.
  • CVE-2026-107337 lets an attacker use CSRF against the kiosk Flask endpoint to run control.py --wipe, permanently deleting captured traffic; it was fixed in v26.08.0.
  • CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to date.
Source document
ABN American Bankers Association — newsroom Source document ↗
United States American Bankers Association — newsroom Financial Crime ✓ 15 claims 18 Oct 2026

ABA names Robertson and Boyer for Distinguished Service Awards in AML/CFT and fraud

The American Bankers Association has announced its Distinguished Service Awards for AML/CFT and fraud management. The recognitions went to two senior financial-crime practitioners for contributions to professional education and industry collaboration. This is a professional-recognition item rather than a rule change, but it signals where the industry's trade body places weight in its financial-crime training and community-building work.

  • Rebecca Schauer Robertson of Blue Ridge Bank received the ABA Distinguished Service Award for AML/CFT, recognizing a 30-year career in financial services.
  • Karen Boyer of M&T Bank received the ABA Distinguished Service Award for Fraud Management, cited for work on payment threats, social engineering, scams and account takeover.
  • Both were honored on October 14, 2026 at the ABA AML and Fraud Conference in Arlington, Virginia.
  • Robertson served on the founding boards of the Certified AML and Fraud Professional certification and the ABA AML and Fraud School, and helped design the school's curriculum.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 26 claims 18 Oct 2026

CISA flags seven flaws in Red Lion N-Tron 700 switches, including hard-coded credentials

CISA has updated its advisory on Red Lion Controls N-Tron 700 Series industrial switches, detailing seven vulnerabilities that range from default factory credentials to unauthenticated firmware uploads and a scriptable reboot loop. The devices are deployed worldwide across commercial facilities, communications, critical manufacturing and IT sectors. This segment sets out what is affected, the remediation path, and where the operational risk concentrates.

  • Affected versions are N-Tron 700 Series firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier; Red Lion recommends upgrading to version 3.11.1 or greater.
  • CVE-2026-32645 concerns default factory administrative credentials that persist even after other administrator accounts are configured.
  • CVE-2026-33367 allows SNMP to retrieve configuration files, modify accounts and settings, and initiate firmware or bootloader changes without any authentication.
  • CVE-2026-28745, scored CVSS v4 9.3 (critical), involves passwords stored in the configuration file using weak encryption.
  • CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it at this time.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Conduct & Consumer ✓ 17 claims 18 Oct 2026

Cloudera barred from PERM program two years, pays $1.4m back pay over US-worker bias

The Justice Department's Civil Rights Division and the Department of Labor announced a coordinated resolution with Cloudera Inc. over alleged discrimination against qualified US workers during PERM recruitment. The settlement pairs a two-year debarment from the labor certification program with a back-pay fund, civil penalties and ongoing compliance obligations. For any employer running PERM sponsorship, this item signals how the two agencies are now working the same case in tandem.

  • Cloudera will be barred from participating in the PERM program for two years, following DOL's earlier suspension of its PERM processing.
  • The company will establish a $1.4 million back-pay fund for qualified US workers who tried to apply for the jobs at issue but were not given fair consideration.
  • Cloudera will pay $600,000 in civil penalties and resolves a DOJ lawsuit filed in April alleging INA violations across seven PERM positions.
  • Cloudera accepts compliance obligations including enhanced monitoring, revised PERM procedures and reporting requirements.
  • DOJ said this is the fourteenth settlement since it relaunched its Protecting U.S. Workers Initiative in 2025.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 10 claims 16 Oct 2026

NIST, NSA and CISA issue voluntary incident response guide for super intelligence training

Three US agencies have published joint guidance addressing what happens when advanced AI systems take actions that conflict with human oversight controls during training or evaluation. The document sets out voluntary practices for detecting, containing and recovering from such incidents, aimed at organisations developing cutting-edge, non-public systems.

  • NIST, the NSA's Super Intelligence Security Center and CISA jointly published the guidance on October 16, 2026.
  • The practices are voluntary and aimed particularly at pre-deployment, cutting-edge SI agents with reduced safeguards or other high-risk, non-public systems.
  • An SI control incident is defined as uninstructed agent actions that conflict with or compromise policies, controls or security measures scoping the task and human oversight.
  • The document outlines ten core practices covering access limitation, activity monitoring, evidence preservation and shutdown of undesired behavior, rebuilding from verified baselines, and reporting incidents and near-misses to relevant government agencies and affected parties.
  • The guidance states organisations should test controls and validate containment before resuming SI agent activities.
Source document
ABN American Bankers Association — newsroom Source document ↗
United States American Bankers Association — newsroom Digital Assets ✓ 13 claims 16 Oct 2026

Banking groups ask Fed for 60 more days to comment on stablecoin rules

Four bank trade groups have asked the Federal Reserve to extend comment on its two Genius Act stablecoin proposals, arguing the Fed's prudential framework is explicitly benchmarked to an OCC rule that is about to change. The request bears on timing, not substance, but shapes how much scrutiny the final rules receive before they bind issuers.

  • The Fed issued two companion proposed rules implementing its Genius Act responsibilities in late September 2026.
  • One proposal covers approval procedures for a subsidiary to become a board-supervised permitted payment stablecoin issuer (PPSI); the other sets reserves, capital, redemption, risk management, custody and reporting requirements.
  • ABA, BPI, CBA and ICBA have requested a 60-day extension, moving the comment deadline from November 30 to January 29.
  • OCC Comptroller Gould has stated the OCC intends to finalize its own stablecoin rule by November 2026, which the groups say would change the benchmark the Fed's proposal is tied to.
  • The associations also urged the Fed to coordinate timing and effective dates with other agencies and keep PPSI requirements consistent across regulators.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Governance & Accountability ✓ 10 claims 16 Oct 2026

DOJ settles with Lexington, Mississippi over policing practices found unlawful in 2024

The Justice Department has reached a settlement with the City of Lexington, Mississippi and its police department following a 2024 federal findings report that identified a pattern of civil rights violations. The agreement covers fines and fees, bail practices, conflicts of interest, and use-of-force policies, and follows an investigation opened in March 2023.

  • The settlement follows the Department's September 26, 2024 findings report identifying a pattern or practice of civil rights violations by the Lexington Police Department.
  • The City and LPD will amend policies regarding fines and fees, bail and release criteria, and potential conflicts of interest.
  • LPD will revise its policies on stops, searches, arrests, and use of force, and update reporting and review procedures for such officer activity.
  • The investigation was initiated in March 2023 under 34 U.S.C. 12601 by the Civil Rights Division's Special Litigation Section and the U.S. Attorney's Office for the Southern District of Mississippi.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 10 claims 16 Oct 2026

Puerto Rico bank chairman gets 62 months for $23.6 million fraud scheme

The former board chairman and co-owner of Nodus International Bank, a Puerto Rican International Banking Entity, was sentenced to 62 months in prison for a wire fraud conspiracy that drained the bank of more than $23.6 million and contributed to its collapse. The DOJ account details the mechanics of the scheme and its regulatory concealment.

  • Ramirez was sentenced to 62 months in prison, three years of supervised release, and forfeiture of approximately $13.6 million.
  • From 2017 to 2023 Ramirez conspired to invest more than $11 million of Nodus Bank's funds in a Miami-based lender for his own and a co-conspirator's benefit.
  • Between January 2018 and September 2021 Ramirez induced the bank's board to purchase at least 47 promissory notes totaling approximately $25.3 million from a company he jointly owned.
  • On April 28, 2023, without OCIF authorization, Ramirez caused Nodus Bank to purchase a loan portfolio totaling approximately $26 million, most of it delinquent or nonperforming.
  • The DOJ states Ramirez's actions caused Nodus Bank to lose at least $23,613,371.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 17 claims 16 Oct 2026

Ransomware Remediation Firm Owner Charged With Secretly Paying Hackers, Overbilling Clients

DOJ charged MonsterCloud owner Zohar Pinhasi with wire fraud after alleging he told clients he could decrypt ransomware without paying attackers, while secretly negotiating and paying the ransoms himself and marking up the cost dramatically. The indictment details a specific $8,200 ransom payment billed to a client at $150,000, illustrating the alleged margin across the scheme.

  • Pinhasi faces two counts of wire fraud and one count of wire fraud conspiracy, each carrying a maximum 20-year penalty.
  • The indictment alleges that in or around August 2023, Pinhasi paid a cybercriminal approximately $8,200 and charged the client approximately $150,000.
  • Prosecutors say Pinhasi charged MonsterCloud clients more than $19 million over the course of the alleged scheme.
  • The indictment alleges Pinhasi paid more than $8 million in ransom payments to cybercriminals while telling clients he avoided paying ransoms.
  • The FBI and CISA have issued joint guidance advising against paying ransoms, stating it does not guarantee data decryption or prevent leaks.
Source document
NIST NIST Source document ↗
United States NIST AI, Technology & Data ✓ 15 claims 16 Oct 2026

NIST Demonstrates Chip-Scale Frequency Comb for Portable Optical Clocks

NIST and the University of Maryland's JQI have demonstrated a chip-based optical frequency comb designed to work without tethering to laboratory equipment. The technology underpins optical atomic clocks and could eventually support navigation for drones, vehicles and submarines when GPS signals are jammed or unavailable.

  • NIST and JQI researchers demonstrated the chip-based frequency comb in a result announced October 16, 2026.
  • The design sends light from two lasers around a single microresonator ring, avoiding power-hungry stabilization equipment required by earlier single-laser methods.
  • Each fabrication wafer contains more than 400 chips, and each chip houses up to 300 ring-shaped resonators.
  • NIST states the technology could support mobile optical atomic clocks used for navigation when GPS is unavailable or jammed, and for oil, gas and mineral exploration.
Source document
NIST NIST Source document ↗
United States NIST AI, Technology & Data ✓ 14 claims 16 Oct 2026

NIST Backs White House 'Golden Age of Science' Push, Joins Genesis Mission

NIST has announced support for the White House Office of Science and Technology Policy's 'Science: A New Golden Age' report and said it intends to join the Genesis Mission Consortium, a federal initiative using super intelligence for scientific discovery. The announcement sets out which NIST datasets and infrastructure will be made available and names the focus areas NIST expects to contribute to.

  • NIST announced on October 8, 2026 its support for OSTP Director Michael Kratsios' 'Science: A New Golden Age' report.
  • NIST intends to participate as a federal agency partner in the Genesis Mission Consortium, part of the Genesis Mission SI-for-science program.
  • NIST named specific resources it will contribute, including AM-Bench, the JARVIS computational materials database, the Materials Data Repository, the Public Data Repository and the National Technical Reports Library.
  • NIST said its focus areas within the Genesis Mission will include biotechnology, quantum science, and materials design and discovery.
  • NIST Director Arvind Raman said the agency will deliver measurement technology and standards infrastructure to support the initiative.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 15 claims 16 Oct 2026

CISA Links Integrity Technology Group to Global Hacking Campaign Targeting US Infrastructure

CISA, the FBI, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain jointly published a technical advisory on October 8, 2026 detailing tactics used by Integrity Technology Group-enabled threat actors against US critical infrastructure and global targets. It maps tools, exploited CVEs and MITRE ATT&CK techniques for network defenders.

  • The advisory is co-authored by the FBI, CISA, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain, published October 8, 2026.
  • Eight CVEs are listed as exploited, including CVE-2019-11510, CVE-2021-22205 and CVE-2021-3199.
  • Threat actors use EBurst to conduct password spraying and guessing against Microsoft Exchange interfaces including ECP, EWS, OWA and PowerShell.
  • Persistence is established via SoftEther VPN installers disguised with names such as conhost.exe or dllhost.exe, connecting to listed domains including hmbcloud[.]com and 98aiblog[.]com.
  • The FBI observed threat actors restricting access to exfiltrated data to IP addresses from Xiamen, China, in some instances.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 17 claims 16 Oct 2026

CISA details five flaws in energy-sector tools openPDC and openHistorian

CISA has published an advisory covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software deployed worldwide in the energy sector for grid data collection and storage. The advisory sets out affected versions, remediation status and mitigation steps for operators running these systems, with Docker image deployments left without a vendor fix for several of the flaws.

  • CISA's advisory lists five vulnerabilities affecting openPDC versions below 2.9.477/2.9.482 and openHistorian versions below 2.8.580/2.8.585.
  • CVE-2026-100730 and CVE-2026-105278 each carry a CVSS 3.1 base score of 9.8, rated critical.
  • Grid Protection Alliance has no fix planned for the Docker image and does not recommend its production use, per the advisory.
  • A Modbus connection feature (CVE-2026-101022) lets an authenticated user target arbitrary internal network destinations, enabling internal network mapping.
  • Shubham Raj of Causal Security reported the vulnerabilities to CISA, which released the advisory on 8 October 2026.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 17 claims 16 Oct 2026

CISA Warns of Four Flaws in Satel Netco Design, Advises Upgrade to V2.1.7

CISA's advisory details four vulnerabilities affecting versions of Satel Netco Design prior to v2.1.7, deployed worldwide in the communications sector. The flaws range from stored cross-site scripting to path traversal issues that could allow file creation or modification. Compliance and security teams running this software should review patch status now.

  • CISA released advisory ICSA-26-281-03 on October 8, 2026, covering Satel Netco Design versions prior to v2.1.7.
  • CVE-2026-101024, a relative path traversal flaw in the export function, scores 8.8 on CVSS v3.1 and could allow arbitrary code execution under certain conditions.
  • CVE-2026-105269 is a stored cross-site scripting vulnerability exploitable by an authenticated user with Network Operator privileges, scoring 6.8 on CVSS v3.1.
  • Satel advises users to update to Satel Netco Design v2.1.7 to remediate all four vulnerabilities.
  • Alex Williams of Pellera Technologies reported the vulnerabilities to CISA, which states no known public exploitation has occurred.
Source document
NIST NIST Source document ↗
United States NIST Governance & Accountability ✓ 15 claims 16 Oct 2026

NIST data show fentanyl adulterants rising and shifting across U.S. regions

NIST chemists analyzed thousands of fentanyl residue samples collected nationwide to map how toxic adulterants change over time and by region. The study, run through the RaDAR program, aims to give public health officials and first responders near-real-time warning of dangerous compounds entering local drug supplies so treatment protocols can adapt accordingly.

  • NIST analyzed 4,563 drug residue samples collected nationwide between January 2024 and June 2026 as part of the RaDAR program.
  • Xylazine, a veterinary anesthetic common on the East Coast, is being replaced by medetomidine, a more potent sedative causing severe withdrawal symptoms.
  • BTMPS, an industrial plastics chemical that can cause eye inflammation and burning, has appeared in both eastern and western fentanyl samples since summer 2024.
  • Samples in early 2024 typically contained one to two additives; six or more compounds are now common.
  • Western U.S. fentanyl samples contain fewer additives on average but at higher concentrations than eastern samples.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 19 claims 16 Oct 2026

Dual-National Mule Network Leader Pleads Guilty in $7 Million Laundering Scheme

A Ukrainian-Russian dual citizen has pleaded guilty to leading an international money laundering operation that used thousands of deceived U.S. residents as money mules to move stolen funds abroad. The case illustrates how cybercrime proceeds are laundered through layered infrastructure and victims unwittingly recruited as intermediaries.

  • YMCO recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen from over 750 U.S. bank accounts.
  • Korniev admitted YMCO was responsible for over $14.7 million in actual and intended losses by confirmed victims.
  • He admitted intending to launder over $9.7 million from cybercriminals and having laundered at least $7 million.
  • Korniev faces a minimum penalty of two years and a maximum of 50 years in prison, with sentencing set for a later date.
  • Four other individuals previously convicted in the YMCO scheme received sentences ranging from around 37 to 63 months and were ordered to pay over $9.1 million in restitution each.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 15 claims 16 Oct 2026

Oklahoma chiropractor gets 14 years for $30 million health care fraud scheme

A federal jury conviction following a 12-day trial has resulted in a 14-year prison sentence for an Oklahoma DME company owner. The case illustrates how telemedicine networks, shell marketing firms and unenrolled billing entities were combined to extract payments from federal health programs serving seniors, service members and veterans.

  • Loftis was sentenced to 14 years in prison after a 12-day jury trial that ended in July 2026.
  • Loftis and co-conspirators submitted over $30 million in false and fraudulent claims and were paid over $8 million.
  • Loftis paid over a million dollars in illegal kickbacks, including through a shell marketing company, to marketers, telemedicine companies and a call center.
  • The scheme used sham doctors' orders generated by telemedicine providers who often never spoke to beneficiaries, including one case billing eight braces for a single beneficiary.
  • Loftis was ordered to pay over $8 million in restitution and to forfeit over $560,000.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 11 claims 16 Oct 2026

Tennessee Counseling Center Owner Sentenced for Employment Tax Fraud

A DOJ press release details the sentencing of a former Tennessee counseling center owner for willfully failing to remit withheld employment taxes and failing to file required quarterly returns over a five-year period. The case, prosecuted by the newly formed National Fraud Enforcement Division, illustrates continuing federal enforcement priority on payroll tax withholding failures by small business owners.

  • Mari Alexander was sentenced to 3 years' probation and ordered to pay $1,048,840 in restitution to the United States.
  • From 2015 through 2020, she willfully failed to pay over to the IRS payroll taxes withheld from employees of her Tennessee counseling center.
  • She failed to file more than 20 quarterly employment tax returns with the IRS during that period.
  • Alexander pleaded guilty on April 15, 2026, to one count of willful failure to account for and pay over employment taxes.
  • IRS Criminal Investigation investigated the case, which was prosecuted by the National Fraud Enforcement Division's Tax Section.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 18 claims 16 Oct 2026

Texas man indicted over $6.9M false tax-refund scheme using pandemic credits

A Western District of Texas grand jury has charged an Austin tax preparer with conspiring to file nine false refund claims built on fabricated wage figures and pandemic-era tax credits. The case shows how the Justice Department's new Fraud Division is pursuing COVID-relief credit abuse, and how a co-conspirator's earlier guilty plea sets up the preparer's prosecution.

  • The indictment was returned on September 15, 2026 in the Western District of Texas against John Labee of Austin.
  • Nine false returns for Divine Grinde claimed the Employee Retention Credit and Sick and Family Leave Credit on fabricated wage and tax figures, for a business with no employees.
  • The fraudulent claims sought approximately $6.9 million, of which the IRS paid over $1.1 million.
  • Co-conspirator Andrea Dotson pleaded guilty on March 10, 2026 for her role in the offense.
  • Labee faces a maximum of 10 years for conspiring to file false claims and 5 years for each count of filing false claims.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 13 claims 16 Oct 2026

Illinois woman gets 13 months for $3.5 million COVID tax credit fraud scheme

A federal sentencing confirms the scale of ongoing pandemic-era tax credit fraud enforcement. This item covers the September 2026 sentencing of an Illinois woman who conspired to file false Employee Retention Credit and Sick and Family Leave Credit claims, detailing the amounts claimed, paid, and the restitution now owed.

  • Lakeibia Fannin was sentenced on September 25, 2026, to 13 months in prison for conspiracy to defraud the government with respect to claims.
  • Fannin claimed more than $3.5 million in fraudulent COVID-19 tax credit refunds, of which more than $1.4 million was actually paid.
  • Co-conspirator Candies Goode-McCoy was sentenced in April 2026 to 54 months in prison for her role in the same scheme.
  • U.S. District Judge Andrew P. Gordon ordered Fannin to serve three years of supervised release and pay $1,455,835.24 in restitution.
  • Fannin used proceeds for personal benefit, including vacations, a cruise, jewelry, designer clothes and a car.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 14 claims 16 Oct 2026

Kansas software CEO gets 19 years for $1bn telemedicine Medicare fraud scheme

DOJ sentencing release covering the conclusion of a telemedicine fraud case affecting over 346,000 Medicare beneficiaries. Relevant to compliance teams at telehealth platforms, DME suppliers and pharmacies screening for kickback and billing integrity risk, and to health insurers refining audit controls against sham doctors' orders.

  • Brett Blackman, 43, of Johnson County, Kansas, was sentenced to 19 years in prison after a 23-day jury trial ending in April 2026.
  • DME suppliers and pharmacies paying kickbacks billed Medicare and other insurers more than $1 billion, of which insurers paid out more than $450 million.
  • Medicare was fraudulently billed for orthotic braces for more than 346,000 beneficiaries, with at least 21 orthotics billed for over 1,200 of them.
  • Co-defendant Gary Cox was sentenced to 15 years in prison in December 2025.
  • Blackman's restitution and forfeiture obligations will be determined by the court at a later date.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 20 claims 16 Oct 2026

Minnesota staffing firm owner and son indicted over employment tax and wire fraud

A federal grand jury in Minnesota has charged a staffing agency owner and his son with willfully failing to pay over employment taxes and conspiring to commit wire fraud by faking workers' compensation certificates. The case shows how the DOJ's new Fraud Division is pairing payroll-tax enforcement with client-facing fraud allegations against a single business.

  • Ku Kelvin Vue and Travis Vue are charged with willfully failing to collect and pay over employment taxes from Q3 2020 through Q2 2022 and with conspiracy to commit wire fraud.
  • The indictment alleges UniSelect did not maintain workers' compensation coverage and that the Vues created false policy certificates to deceive clients.
  • Both defendants face a maximum of 20 years in prison on the wire fraud conspiracy count and five years on each employment-tax count.
  • Travis Vue is additionally charged with filing a false 2020 return reporting zero wages and faces up to three years for that count.
  • IRS Criminal Investigation is investigating; the Fraud Division's Tax Section is prosecuting.
Source document
US US Federal Trade Commission — press releases Source document ↗
United States US Federal Trade Commission — press releases Financial Crime ✓ 15 claims 16 Oct 2026

FTC distributes $9.8m to 65,022 consumers over Walmart wire-transfer fraud failures

The FTC is distributing refunds to consumers who lost money to scammers routing fraud-induced transfers through Walmart's wire services. The payments stem from a June 2025 settlement in which Walmart was accused of inadequate anti-fraud controls, training and customer warnings. This segment covers who gets paid, the deadline to cash checks, and the conduct obligations the settlement imposed.

  • The FTC is sending payments totaling more than $9.8 million to 65,022 affected consumers.
  • The redress stems from Walmart's June 2025 settlement over alleged failure to stop scammers using its wire-transfer services.
  • The settlement requires Walmart to take appropriate actions to detect and prevent fraud-induced money transfers.
  • Recipients must cash their checks within 90 days, and Rust Consulting Inc. administers the payments.
  • The FTC said its actions led to more than $435 million in consumer redress across the country in 2025.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 18 claims 16 Oct 2026

Russian national extradited from Sweden to New York over chips bound for Russia

The DOJ charged a Russian national extradited from Sweden with running a procurement network that routed US-made dual-use electronic components to Russia through Hong Kong front companies. The complaint spans conduct from March 2022 to April 2023 and carries three conspiracy counts. For anyone screening distributors in third-country transshipment hubs, the fact pattern is the point.

  • Suvorov was extradited from Sweden to the Northern District of New York on Oct. 15, 2026, with an initial appearance expected Oct. 16 in Albany.
  • The complaint alleges he maintained Hong Kong front companies, including GS Group Limited, to order US components while hiding that end users were in Russia.
  • Conduct is alleged to span roughly March 2022 to April 2023, with some components usable in military communication, radar and precision-location systems.
  • The three counts carry maximum penalties of up to 20 years (money laundering), five years (outbound smuggling) and 20 years (Export Control Reform Act violation).
  • The FBI and the Department of Commerce's Bureau of Industry and Security are investigating the case.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 15 claims 15 Oct 2026

DOJ and HHS-OIG make the Fraud Division the single door for criminal health care self-disclosures

The Justice Department's National Fraud Enforcement Division and HHS-OIG have resolved a long-standing dual-reporting problem for health care fraud. A single disclosure to the Fraud Division now carries the benefits of both DOJ's Corporate Enforcement Policy and the OIG Self-Disclosure Protocol. This segment covers what changed, how the two agencies divided criminal from civil conduct, and the trap for firms that disclose only to OIG.

  • One disclosure to the Fraud Division's Health Care Fraud Section now automatically confers HHS-OIG SDP benefits, with no additional OIG portal submission required.
  • HHS-OIG updated its SDP to state criminal conduct should go to DOJ; disclosing only to OIG generally will not qualify a company for a declination.
  • The Fraud Division was created on 7 April 2026; its Health Care Fraud Section runs nine strike forces and has charged more than 6,200 defendants since 2007.
Source document
FED Federal Reserve Source document ↗
United States Federal Reserve Conduct & Consumer ✓ 20 claims 15 Oct 2026

Fed's 2025 Survey of Consumer Finances shows median income up 7%, net worth up 2%

The Federal Reserve's triennial Survey of Consumer Finances is the most detailed public dataset on what American families own, owe and how they bank. The 2025 results show gains concentrated at median levels alongside declines in mean income, a slip in stock-market participation, and a rise in families carrying heavy debt-service burdens. For anyone calibrating consumer-credit or vulnerability models, this is primary data.

  • Real median family income rose 7 percent to $82,200 between the 2022 and 2025 surveys, while real mean income fell 6 percent to $145,200.
  • Real median net worth rose 2 percent to $215,900 and real mean net worth rose 7 percent to $1.24 million.
  • The share of families with debt payment-to-income ratios above 40 percent increased from 6.5 to 8.6 percent, a level last seen in the 2013 survey.
  • Stock-market participation declined to 56 percent in 2025 from 58 percent in 2022, while median holdings among those invested grew 36 percent to $77,400.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 19 claims 15 Oct 2026

DOJ indicts construction firm owner, three employees over $5m payroll tax and loan fraud

A federal grand jury has charged Arthur Nelson and three associates tied to his Brooklyn, later New Jersey, construction subcontracting companies with a multi-year scheme spanning employment tax evasion, false corporate filings, undisclosed foreign accounts and fraudulent loan applications. This segment breaks down who is charged with what, the exposure each faces, and where the financial-crime risk sits for lenders and sureties.

  • Four defendants charged in EDNY over a scheme running April 2017 to May 2024 involving at least approximately $5 million in unreported wages.
  • Nelson allegedly underreported business gross receipts by approximately $13 million and faces two FBAR counts; wire fraud conspiracy carries a 20-year maximum.
  • A second scheme allegedly submitted false financial documents to lenders and surety providers; Devocion also charged with grand-jury obstruction.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 22 claims 15 Oct 2026

DOJ charges three Mexican citizens over $74M IRS tax refund fraud scheme

An unsealed federal indictment accuses two brothers and a third man of running a long-running scheme that exploited the IRS's Individual Taxpayer Identification Number system to extract more than $74 million in fraudulent tax refunds. The case shows how identity documents and check-cashing routes convert benefit-program vulnerabilities into cash, and sits inside the new Fraud Division's enforcement push.

  • Three Mexican citizens charged with a scheme to defraud the IRS of over $74 million via fraudulent tax returns filed under false ITINs.
  • The co-conspirators allegedly cashed more than 16,000 U.S. Treasury refund checks through a check-cashing company from 2019 to the present.
  • Fraud and money laundering counts carry maximum 20-year sentences; two defendants also face immigration false-statement charges up to 15 years.
Source document
FED Federal Reserve Speeches Source document ↗
United States Federal Reserve Speeches Prudential & Capital ✓ 17 claims 15 Oct 2026

Bowman says Fed knew of SVB risks nine months before failure, faults Basel and FSB reports

Fed Vice Chair for Supervision Michelle Bowman uses a Bangkok address to preview preliminary findings of an independent SVB review she commissioned. She argues supervisors held the key risk information months ahead of the failure but lacked clear accountability to act, and she takes the unusual step of criticising the BCBS and FSB for building post-crisis work on incomplete earlier reports.

  • Preliminary review finds Fed supervisors knew of SVB's interest rate and liquidity risk at least nine months before FDIC receivership but did not act.
  • SVB had 54 matters requiring attention or immediate attention between 2019 and failure, none requiring remediation of core financial risks.
  • Bowman says the BCBS and FSB took language nearly verbatim from earlier flawed US reports rather than independently verifying findings.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 17 claims 15 Oct 2026

CISA flags critical flaws in dcm4che DICOM archive letting attackers delete and forge medical images

CISA's medical advisory covers six vulnerabilities in J4Care's dcm4chee-arc-light, a DICOM archive used in healthcare settings worldwide. The flaws range from missing authentication and authorization to denial-of-service conditions, with top CVSS v3 scores of 9.1. For anyone running medical imaging infrastructure, this is a patch-now item: the defaults ship insecure, and the vendor fix is already out.

  • Six CVEs affect dcm4chee-arc-light 5.35.1; J4Care recommends upgrading to release 5.35.2 or later.
  • In the default configuration, the archive and HL7 listener accept unauthenticated requests, enabling retrieval, forgery and patient-record reassignment.
  • Top CVSS v3 base score is 9.1 (critical); CISA reports no known public exploitation to date.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 21 claims 15 Oct 2026

CISA warns of path-traversal flaw in Thermo Fisher Torrent Suite; fix in 5.22

CISA's medical advisory ICSMA-26-288-01 covers a single path-traversal vulnerability in Thermo Fisher's Torrent Suite Software, used in the healthcare and public health sector worldwide. The segment runs through what the flaw allows, which versions are affected, the vendor's fix and the defensive measures CISA recommends for firms running the product.

  • CVE-2026-107777 is a path-traversal flaw letting an authenticated attacker read arbitrary files on the Torrent Server accessible to the web service account.
  • All Torrent Suite Software versions 5.18 and earlier are affected; Thermo Fisher recommends updating to version 5.22 or later.
  • The vulnerability is scored CVSS v3.1 6.5 (medium) and CVSS v4 7.1 (high), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
  • CISA reports no known public exploitation specifically targeting this vulnerability at this time.
  • The product is deployed worldwide in the healthcare and public health sector.
Source document
UN UN News — global perspective Source document ↗
United States UN News — global perspective Financial Crime ✓ 24 claims 15 Oct 2026

US sanctions International Criminal Court as an institution, pledges to ban transactions

Washington has moved from sanctioning individual ICC judges and prosecutors to designating the court itself, with the Secretary of State promising to ban transactions with the institution. This segment covers what the escalation means for banks and intermediaries that process payments for, or cooperate with, the court, and the pressure now placed on allied jurisdictions.

  • The US sanctioned the ICC as an institution on 9 October 2026, adding to measures already in place against 13 judges and prosecutors.
  • Secretary of State Marco Rubio pledged to ban transactions with the court and said Washington expects allies to 'rein in the court'.
  • UN Secretary-General Guterres condemned the move as a 'serious blow'; the UN reaffirmed cooperation under the relationship agreement approved on 13 September 2004.
Source document
ICCC International Criminal Court Source document ↗
United States International Criminal Court Financial Crime ✓ 18 claims 15 Oct 2026

ICC rejects US sanctions imposed on the Court as an institution

The International Criminal Court has publicly rejected US sanctions imposed on the institution itself, an escalation beyond earlier measures against individual officials. The statement matters less for its condemnation than for what it asks: the Court is turning to its States Parties to secure the means to keep functioning. For firms, the live question is sanctions exposure when dealing with an ICC under US designation.

  • The United States has imposed sanctions on the International Criminal Court as an institution, which the Court calls an unprecedented step.
  • The institutional measure follows earlier designations against thirteen ICC judges and prosecutors, according to the statement.
  • President Tomoko Akane said the Court will continue to discharge its mandate with independence and impartiality, acting only on law and evidence.
  • The Court calls on its 125 States Parties to take concrete action, including ensuring it has the necessary means to continue its work.
  • The statement says it has made considerable efforts, with States Parties, to ensure the continuity and resilience of its activities.
Source document
ICCC International Criminal Court Source document ↗
United States International Criminal Court Financial Crime ✓ 14 claims 15 Oct 2026

ICC victims fund warns US sanctions on court threaten reparations financial channels

The ICC's Trust Fund for Victims has responded to US sanctions imposed on the court, warning that financial channels, services and partnerships underpinning reparations and victim assistance are at risk of disruption. For banks and corporates with any exposure to ICC-linked payments or donations, this segment flags where a designation against an international body collides with ordinary counterparty and correspondent-banking decisions.

  • The Trust Fund for Victims warns US sanctions imposed on the ICC on 9 October 2026 may disrupt financial channels, services and partnerships behind its reparative mandate.
  • Affected programmes include reparations and assistance for physical, psychosocial and socio-economic rehabilitation, education, peacebuilding and memorialisation.
  • The Fund appealed directly to states, corporations and individuals to renew financial support for victims and the ICC's reparative mandate.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 15 claims 15 Oct 2026

Bosnian arms dealer gets 60 months for brokering North Korean missile sale

A District of New Mexico sentencing closes a case built on 2020 negotiations to broker anti-aircraft missiles out of North Korea. For sanctions and export-control teams it is a clean illustration of how US jurisdiction attaches to brokering and attempt conduct by a foreign national, even when no goods ever move.

  • Micev was sentenced to 60 months after pleading guilty under IEEPA and the North Korea Sanctions Regulations.
  • Conduct involved brokering SA-18 Igla surface-to-air missiles from North Korea without OFAC authorisation; the deal fell through over price.
  • The case was built on 2020 conduct including falsified documentation and a meeting in Ankara, Turkey; no missiles were delivered.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 25 claims 15 Oct 2026

DOJ Fraud Division's first national tax surge brings actions against 76 defendants over $490M

The Justice Department's newly created National Fraud Enforcement Division ran its first coordinated tax-fraud push between early September and mid-October 2026. This segment covers who was charged, the structure of the surge, and the recurring fraud typologies — pandemic-era credits, sham trusts and preparer schemes — that compliance and financial-crime teams should expect to see sustained.

  • First-ever National Tax Enforcement Surge produced actions against 76 defendants with estimated intended loss exceeding $490,000,000.
  • 23 new-charge actions hit 31 defendants (over $350M intended loss); around 39 trials, pleas and sentencings affected another 45 defendants (nearly $140M).
  • Recurring typologies include fake COVID-19 credits, fuel-tax refunds, sham trust shelters, and ITIN-based Treasury check fraud.
Source document
IC3 IC3 — FBI Internet Crime Complaint Center Source document ↗
United States IC3 — FBI Internet Crime Complaint Center Financial Crime ✓ 20 claims 15 Oct 2026

FBI warns of election fraud schemes targeting donors ahead of 2026 US midterms

The FBI's Internet Crime Complaint Center has updated its 2024 election-fraud advisory for the 2026 midterms, cataloguing how scammers solicit donations, sell undelivered merchandise and harvest personal data. It details four scheme types and the growing role of AI-generated voices, images and messages. A short, practical read for financial-crime and fraud-prevention teams tracking consumer-facing threat patterns.

  • IC3 updated its 2024 election-fraud alert (I-102924-PSA) to cover the 2026 US midterms, warning of financial fraud and PII theft.
  • Four schemes are named: campaign investment pools, fake PACs/ScamPACs, online merchandise non-delivery, and fraudulent voter-registration pages.
  • The FBI warns AI tools now generate realistic voices, images and messages impersonating candidates, campaigns and trusted contacts, raising detection difficulty.
Source document
DOJ DOJ Criminal Division Source document ↗
United States DOJ Criminal Division Financial Crime ✓ 18 claims 15 Oct 2026

DOJ charges 16 over alleged illegal voting and citizenship fraud across 11 districts

The Justice Department announced election-crime charges against 16 individuals in cases spread across the country, from voting by aliens to false citizenship claims and double voting. For compliance and government-affairs readers, it is the latest in a run of DOJ election-integrity enforcement, naming defendants, districts and alleged conduct. This item sets out who was charged, where, and on what basis.

  • Sixteen individuals charged across districts including New Mexico, Eastern Pennsylvania, Alabama, Missouri, Ohio, Idaho, New Jersey, Hawaii and Kentucky.
  • Allegations span voting as a non-citizen, casting a deceased spouse's absentee ballot, voting twice in the 2024 election and false citizenship claims.
  • Cuban national Andre's Garcia allegedly voted in at least 15 elections over 20 years, including at least 13 federal elections.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 22 claims 15 Oct 2026

CISA flags high-severity privilege-escalation flaw in Inductive Automation's Ignition platform

CISA has published an ICS advisory on a CVSS 8.8 authorization flaw in Inductive Automation's Ignition software, used across critical manufacturing, energy and IT sectors worldwide. This segment covers what the vulnerability allows, which versions are affected, the fixed builds, and the defensive measures CISA sets out for operators running the platform on control-system networks.

  • CVE-2026-92817 allows an authenticated low-level user to escalate to Designer-level access and run arbitrary code on the Ignition Gateway.
  • Affected builds are Ignition 8.1.0-8.1.54 and 8.3.0-8.3.8; fixes shipped in 8.3.9 (August 2025) and 8.1.55 (September 2026).
  • CVSS v3.1 base score is 8.8 (HIGH); CISA reports no known public exploitation targeting the flaw at this time.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 19 claims 15 Oct 2026

CISA adds exploited Ivanti Connect Secure zero-day to KEV catalog, urges immediate patching

CISA has flagged an actively exploited zero-day in Ivanti Connect Secure VPN appliances and added it to the Known Exploited Vulnerabilities catalog. The flaw enables unauthenticated remote command execution used for credential theft and data exfiltration. This segment covers the affected versions, why standard detection tooling falls short, and the recovery steps CISA endorses for suspected compromise.

  • CVE-2026-104935 is a zero-day authentication bypass enabling remote, unauthenticated arbitrary command execution; added to CISA's KEV Catalog on Oct. 13, 2026.
  • Affected: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; version 22.8 reaches end of life Jan. 31, 2027.
  • Ivanti's Integrity Checker Tool may miss exploitation because threat actor commands execute in memory; network and memory forensics required.
Source document
CISA CISA Advisories Source document ↗
United States CISA Advisories AI, Technology & Data ✓ 18 claims 15 Oct 2026

CISA flags unauthenticated video access in Swann SWIFI-SE2KIC cameras

CISA's October 13 advisory details three medium-severity vulnerabilities in Swann Communications' SWIFI-SE2KIC camera firmware. All stem from missing authentication and allow a local-network attacker to see video without logging in. The segment covers what is affected, the severity scoring, and why the mitigation list — rather than a patch — is the operative response for anyone running these devices.

  • Three CWE-306 missing-authentication flaws in Swann SWIFI-SE2KIC firmware <=2.0.22 allow unauthenticated viewing of live video, snapshots and real-time streams.
  • All rated medium (CVSS v3.1 base 6.2); CISA says the vulnerabilities are not remotely exploitable and reports no known public exploitation.
  • Swann provided interim mitigations rather than a cited patch: secure the router/firewall, avoid internet-exposed RTSP, and use strong unique passwords.
Source document
OCC OCC Bulletins Source document ↗
United States OCC Bulletins Financial Crime ✓ 12 claims 15 Oct 2026

US regulators clarify how banks may use mobile driver's licences under CIP Rule

The OCC, FinCEN, Federal Reserve, FDIC and NCUA have jointly issued FAQs on treating verifiable digital credentials, including state-issued mobile driver's licences, under the Customer Identification Program Rule. This segment covers what the guidance addresses, who it binds, and why onboarding and BSA teams should read the underlying document before relying on digital ID at account opening.

  • Interagency FAQs issued September 8, 2026 by the OCC, FinCEN, Federal Reserve, FDIC and NCUA on verifiable digital credentials under the CIP Rule.
  • Guidance covers the definition of a VDC, application of the CIP Rule at 31 CFR 1020.220, and amended terminology in previously issued FAQs.
  • Applies to all national banks, federal savings associations and federal branches and agencies, including community banks with up to $30 billion in assets.
Source document
SEC SEC Press Releases Source document ↗
United States SEC Press Releases Financial Crime ✓ 17 claims 15 Oct 2026

SEC charges New Jersey founder over alleged $16 million affinity Ponzi scheme

The SEC has filed fraud charges against Ernest Ossei Boateng and two New Jersey entities he controls over an alleged six-year Ponzi scheme that targeted an affinity community. The case covers classic hallmarks: guaranteed-return pitches, fake 'investment insurance', misappropriation and Ponzi-like payments. Worth a few minutes for anyone tracking affinity fraud enforcement and adviser antifraud exposure.

  • SEC alleges Boateng and two New Jersey companies raised about $16 million from over 200 inexperienced investors between January 2020 and March 2026.
  • Complaint alleges $5.8 million misappropriated for personal use, $6.6 million in Ponzi-like payments, and over $750,000 in day-trading losses.
  • Charges include antifraud violations of the Securities Act, Exchange Act and Advisers Act; SEC seeks injunctions, disgorgement and civil penalties.
Source document
OCC OCC Bulletins Source document ↗
United States OCC Bulletins Governance & Accountability ✓ 15 claims 15 Oct 2026

US agencies propose to replace interagency third-party risk guidance with a risk-tailored approach

Four US banking agencies have jointly proposed guidance that would revise and replace their existing third-party risk management expectations. The pitch is calibration: align oversight to the risk of each relationship rather than treating every vendor as high-risk. This segment covers what the proposal changes, who it would bind, the comment window, and why the non-enforceable framing matters for examiners and banks alike.

  • Proposed interagency guidance would revise and replace existing third-party risk management guidance across the OCC, Federal Reserve, FDIC and NCUA.
  • The guidance would not set enforceable standards or prescriptive requirements, and non-compliance would not result in supervisory action.
  • Comments are due 60 days from publication in the Federal Register; the guidance would apply to community banks when final.
Source document