Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

NCUA proposes rolling back 2019 fidelity bond board oversight rules

NCUA is proposing to unwind several procedural requirements it added in 2019 for fidelity bond and insurance coverage at federally insured credit unions and corporate credit unions. The rule touches board approval processes, signatory rotation, bond form expiration, and minimum coverage formulas. Compliance officers at FICUs should read this now because the comment window closes December 14, 2026, and the changes affect who signs off on bond purchases.

• Comments on the proposed rule are due on or before December 14, 2026, under docket number NCUA-2026-1882.
• The proposal would remove the 2019 requirement that a FICU's full board review all fidelity bond purchase or renewal applications, allowing delegation to an individual board or supervisory/audit committee member.
• It would eliminate the 2019 rotation requirement barring the same board member from signing consecutive bond renewal agreements.
• Section 713.4(d), which imposes an automatic 10-year expiration on NCUA-approved bond forms, would be eliminated in its entirety.
• The Board proposes removing paragraphs (b) and (c) of Section 713.5, which contain advisory "should purchase" language and a formula tying additional coverage to daily cash on hand or money in transit.

NCUA proposes to finalize pandemic-era Central Liquidity Facility rule changes

NCUA is proposing to permanently adopt liquidity-access changes it made on an interim basis during the COVID-19 pandemic, while cleaning up provisions that have since lapsed under the CARES Act and the Consolidated Appropriations Act. The rule also trims documentation requirements for federally insured credit unions and adjusts capital stock subscription timing. Compliance and treasury teams at member credit unions should read this now rather than wait for the final rule.

• Comments on the proposed rule, docket NCUA-2026-1889, must be received by December 14, 2026.
• The proposal would permanently remove the six-month waiting period for new regular members to obtain CLF advances, a change first made by the April 29, 2020 interim final rule.
• Federally insured natural-person and corporate credit unions would no longer need to submit financial reports, charters and bylaws with CLF membership applications, since the CLF already obtains these through NCUA examinations.
• Non-federally insured credit unions not otherwise subject to NCUA examination would still have to provide financial reports and other information to the CLF to establish their financial condition.
• The Board received 15 comments on the two interim final rules, all of which supported the changes made.

IRS proposes rules tightening ACA premium tax credit eligibility under OBBBA

The IRS has issued proposed regulations under section 36B of the tax code to implement changes made by the One, Big, Beautiful Bill Act to the Affordable Care Act premium tax credit. Compliance, tax and benefits teams advising on health exchange enrollment or administering Form 1095-A reporting should review the comment and hearing timeline now.

• Written or electronic comments on REG-101576-26 must be received by November 30, 2026, via the Federal eRulemaking Portal or by mail.
• A telephonic public hearing is scheduled for December 8, 2026 at 10 a.m. ET, contingent on topic outlines being received by November 30, 2026.
• Requests to attend the public hearing must reach the IRS by 5 p.m. ET on December 4, 2026.
• For taxable years beginning after December 31, 2025, section 71305 of the OBBBA removes the excess APTC repayment limitation, requiring full repayment of any excess advance credit.
• Section 71302(a) of the OBBBA removes PTC eligibility for lawfully present aliens with household income below 100% of the Federal Poverty Level who are ineligible for Medicaid due to immigration status, effective for taxable years beginning after December 31, 2025.

Treasury finalises Treasury auction rule changes ahead of system upgrade

Treasury has issued a final rule amending the Uniform Offering Circular that governs the sale and issuance of marketable Treasury bills, notes and bonds. Most changes are technical, but one reworks how submitters hand over noncompetitive customer bids. The rule took effect on 15 October 2026, though the operationally significant pieces apply only when Treasury's upgraded auction system goes live.

• Submitters must provide each individual noncompetitive customer's name and bid amount before the noncompetitive auction close, and can no longer submit a summary bid amount.
• The amendments to 31 CFR 356.14 and 356.23 apply from the first auction conducted on Treasury's upgraded auction system, which Treasury will communicate in advance; all other changes apply from the effective date of 15 October 2026.
• Treasury is updating terminology across sections 356.15, 356.20, 356.21, 356.23 and others, including using 'award' and 'recognize' in place of 'accept' and 'tender'.
• Treasury removed references to http://www.treasurydirect.gov in sections 356.23(a) and 356.31(a), stating instead that it will make auction results available on its website.

CFPB seeks renewal of consumer complaint response survey, comments due Dec 14

A routine Paperwork Reduction Act notice from the CFPB seeking OMB extension of an existing information collection: the Consumer Response Company Response Survey. Relevant to firms that respond to CFPB consumer complaints, since survey results feed back to companies and inform CFPB's assessment of complaint handling.

• Comments on the extension request must be received by December 14, 2026 to be assured of consideration.
• The survey is approved under OMB Control Number 3170-0069 and docketed as CFPB-2026-0022.
• CFPB estimates 66,700 respondents and 4,669 total annual burden hours for the collection.
• The survey asks three questions about a company's complaint handling plus a narrative description supporting each answer.
• Survey results are shared with the responding company and used by CFPB as one of several inputs to assess response accuracy, completeness and timeliness.

SEC notices Clearlake, Pathway co-investment exemptive order application

The SEC has published notice of an exemptive application from Clearlake Private Markets Fund, Clearlake Capital RIC Management and Pathway Capital Management seeking relief to co-invest across affiliated business development companies and closed-end funds. This brief covers the filing's scope, deadlines and how interested parties can request a hearing before the order is granted.

• Applicants Clearlake Private Markets Fund, Clearlake Capital RIC Management, LLC and Pathway Capital Management, L.P. filed the application on August 10, 2026 and amended it on August 13, 2026.
• The requested order would permit certain BDCs and closed-end management investment companies to co-invest in portfolio companies with each other and with affiliated investment entities.
• The relief sought covers joint transactions otherwise prohibited by sections 17(d) and 57(a)(4) of the Investment Company Act and rule 17d-1.
• Hearing requests must reach the Commission by 5:30 p.m. Eastern time on November 3, 2026, accompanied by proof of service on the applicants.
• The order will be issued without a hearing unless the Commission orders one, per the standard exemptive application process.

Siemens RUGGEDCOM CROSSBOW controller has critical SQLite flaw, CVSS 9.8

CISA has republished a Siemens ProductCERT advisory detailing five vulnerabilities in the SQLite component embedded in RUGGEDCOM CROSSBOW Station Access Controller software used across critical infrastructure sectors. One flaw carries a CVSS v3 score of 9.8. Security and OT teams running affected versions should assess exposure and schedule the vendor update.

• Siemens has released RUGGEDCOM CROSSBOW SAC version V6.0 to remediate all five listed vulnerabilities, and recommends updating from any version below V6.0.
• CVE-2025-71316 is rated CVSS v3 9.8, critical, and involves insecure handling of Unicode-to-ANSI conversion in SQLite's sqldiff.exe that could allow an attacker to load an arbitrary DLL.
• CVE-2026-11822 and CVE-2026-11824 affect SQLite versions before 3.53.2 and involve heap-based buffer overflows in the FTS5 full-text search extension triggered via crafted database files.
• CVE-2025-6965 affects SQLite versions before 3.50.2 and can cause memory corruption when aggregate terms exceed available columns.
• Siemens ProductCERT reported the vulnerabilities to CISA, and the advisory is a verbatim republication of Siemens advisory SSA-765416.

CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device

CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.

• All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
• CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
• CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
• CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.

CISA flags Siemens WinCC privilege escalation flaw with no fix for V7.5

CISA has republished a Siemens ProductCERT advisory covering a high-severity privilege escalation flaw in SIMATIC WinCC, the SCADA system used across critical manufacturing, energy, healthcare, transport, government and financial services. Siemens has shipped fixes for two version lines but has none for V7.5. The flaw lets an authenticated user with database access execute commands on the underlying host.

• CVE-2026-59241 carries a CVSS v3.1 base score of 8.8 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• All versions of SIMATIC WinCC V7.5 are affected and no fix is currently available.
• Siemens has fixed the flaw in V8.0 Update 11 and V8.1 Update 7; users should update to those or later versions.
• An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host running WinCC.
• CISA recommends minimising network exposure, placing control systems behind firewalls and using secure remote access such as VPNs.

CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

• CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
• The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
• PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
• PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
• CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.

CISA flags five vulnerabilities in Siemens RUGGEDCOM APE1808 with Nozomi software

CISA has republished a Siemens ProductCERT advisory covering five vulnerabilities in RUGGEDCOM APE1808 devices running Nozomi Networks' Guardian/CMC software. The flaws range from low to high severity and touch dashboard, credential management, polling and login functions used across critical infrastructure deployments worldwide.

• Five CVEs affect all versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC: CVE-2026-33387, -33388, -33389, -33391 and -33920.
• CVE-2026-33389, an improper certificate validation flaw in Smart Polling, carries the highest individual CVSS 3.1 score of 7.5.
• CVE-2026-33388 scores 7.4 and allows a limited-privilege authenticated user to delete or edit Credentials Manager entries, potentially disrupting authentication.
• Siemens directs affected organizations to contact customer support directly to receive patch and update information rather than publishing a fix in the advisory.
• The advisory was initially released on 2026-10-13 and republished by CISA on 2026-10-22 as SSA-911336.

CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software

CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.

• Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
• CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
• The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
• CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
• Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.

CISA flags ZigBee DoS flaw in Siemens SENTRON 3NA COM Fuse

This advisory covers a medium-severity denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse units running firmware below V5.2, deployed worldwide across multiple critical infrastructure sectors. Operators running affected versions should read the fix path and recommended network protections before deciding on patch timing.

• CVE-2024-7322 affects SENTRON 3NA COM Fuse versions below V5.2 and carries a CVSS v3.1 base score of 5.8 (medium).
• An unsolicited encrypted rejoin response can change a ZigBee device's node ID, causing a denial-of-service condition.
• Recovery from the DoS condition requires the affected network to be re-established.
• Siemens' remediation is to update affected devices to V5.2 or later.
• The advisory lists deployment across critical manufacturing, transportation, energy, healthcare, financial services and government facilities sectors worldwide.

Siemens Software Center flaw under active exploitation, CISA confirms

CISA has republished a Siemens ProductCERT advisory covering a DLL hijacking flaw in Siemens Software Center, a tool used across critical manufacturing, energy, healthcare, financial services and government facilities deployments worldwide. The advisory notes active exploitation and directs users to apply the vendor's fix, which auto-updates on next startup.

• CVE-2026-110936 affects Siemens Software Center versions prior to V4.0.9.8 via an uncontrolled DLL search path (CWE-427).
• CVSS v3.1 base score is 6.7 (medium), with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, requiring local access and high privileges.
• Siemens states existing Software Center installations will be auto-updated to V4.0.9.8 or later on next startup.
• The advisory references a Siemens blog post providing additional information on current known active exploitation and how to detect it.
• Revision 3 of the advisory, dated 2026-10-19, added the reference to active exploitation, two days after initial publication.

CISA flags high-severity flaw in InterSystems IRIS for Health, TLS off by default

CISA has published an ICS Medical Advisory covering a cleartext transmission vulnerability in InterSystems IRIS for Health, a platform used across the healthcare sector worldwide. The flaw stems from TLS/SSL being disabled by default. Compliance and security teams running affected versions should review this briefing before deciding how urgently to act.

CISA flags out-of-bounds read flaw in Siemens Capital Embedded AR Classic

CISA has republished a Siemens ProductCERT advisory covering an out-of-bounds read vulnerability in Capital Embedded AR Classic, used across manufacturing, energy, transport, healthcare, financial services and government facility sectors worldwide. The advisory sets out which versions are fixed, which have no fix planned, and what mitigations operators should apply in the interim.

• CVE-2026-89208 is an out-of-bounds read vulnerability with a CVSS v3.1 base score of 5.3, rated medium severity.
• Capital Embedded AR Classic R20-11 versions before V2303 should be updated to V2303 or later, per Siemens' vendor fix.
• Siemens has no fix planned for Capital Embedded AR Classic 431-422 and recommends mitigation only.
• Siemens recommends applying network segmentation and placing ECUs behind properly configured gateways and firewalls for both affected versions.
• The product is deployed worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors.

CISA flags denial-of-service flaws in Siemens building automation controllers

CISA's advisory covers multiple remotely exploitable vulnerabilities in widely deployed Siemens building automation controllers used across critical manufacturing, energy, healthcare, financial services and government facilities worldwide. Compliance and OT security teams running APOGEE, TALON or Desigo PXC/PXM equipment should check which product lines have patches available versus those left on mitigation-only guidance.

• CISA released advisory ICSA-26-295-08 on October 22, 2026 covering Siemens APOGEE, TALON and Desigo PXC/PXM products.
• The highest-rated vulnerability, affecting APOGEE MBC (PPC) BACnet, carries a CVSS v3 base score of 8.2 across three CWE categories: out-of-bounds read, integer underflow and stack-based buffer overflow.
• Siemens has issued vendor fixes for APOGEE PXC Compact/Modular and TALON TC Compact/Modular, updating to V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet).
• Siemens states no fix is planned for APOGEE MBC/MEC (PPC) variants or any of the thirteen listed Desigo PXC/PXM controller models.
• Recommended mitigations for unpatched products include network segmentation behind gateways/firewalls and disabling the FTP/Web service, which Siemens says is off by default.

DOJ and HHS open six-month False Claims Act self-disclosure pilot for healthcare firms

The Justice Department's Civil Division and HHS have launched a six-month pilot giving healthcare companies a defined route to resolve potential False Claims Act violations by disclosing them voluntarily. The programme fixes the repayment multiplier at 1.25 to 1.6 and offers a coordinated civil release from FCA and certain HHS administrative liability. This briefing sets out who qualifies, what a disclosure must contain, and the deadline.

• The six-month FCA SDPP accepts self-disclosure submissions through April 22, 2027, and late or incomplete filings will not be reviewed.
• Self-disclosing companies must repay the government with a 1.25 to 1.6 multiplier, varying by timeliness, scope, senior-leadership involvement, financial benefit and successor liability.
• Participants must describe all relevant conduct, produce sufficient documents and set out remedial actions taken, submitting electronically to FCA-SDPP@usdoj.gov.
• Qualifying companies receive a coordinated civil release from liability under the federal False Claims Act and certain HHS administrative authorities.
• The pilot covers potential civil violations only; potential criminal conduct must be disclosed to DOJ's National Fraud Enforcement Division.

CFPB updates FOIA and Privacy Act records system, adds NARA inspection disclosure

A routine but mandatory Privacy Act notice from the CFPB updating its primary FOIA/Privacy Act records system. The segment covers what the modification actually changes: scope of records, system manager, retention schedule, and a new disclosure pathway to NARA. Useful for privacy and records officers tracking agency practice.

• Comments on the modified system of records notice must be received no later than November 20, 2026, the same date the new system becomes effective absent a contrary determination.
• A new routine use permits disclosure of records to the National Archives and Records Administration or other federal agencies conducting records management inspections under 44 U.S.C. 2904 and 2906.
• The Chief Privacy Officer is clarified as the system manager for records related to Privacy Act amendment requests under 12 CFR 1070.56.
• The authority for maintaining the system is broadened to explicitly include the Freedom of Information Act, the Privacy Act of 1974, and the Federal Records Act, 44 U.S.C. 3101.
• Categories of records and individuals covered are expanded to clearly include those requesting amendment of records, including initial appeals and statements of disagreement.

Washington regulator urges rate shopping within CFPB's 14 to 45 day window

A consumer education post from Washington State's Department of Financial Institutions walks through how lenders evaluate loan applications and how borrowers can compare offers without unnecessary credit score damage. It draws on CFPB guidance about credit inquiry timing for auto loans.

• The post states a lender may consider debt-to-income ratio, comparing monthly debt payments with gross monthly income, when evaluating an application.
• The CFPB is cited as stating that multiple inquiries for an auto loan made within a relatively short period are generally treated as a single inquiry for scoring purposes.
• The CFPB recommends keeping auto-loan shopping within a 14- to 45-day window, according to the post.
• The post advises comparing APR, interest rate, loan term and total cost rather than relying on monthly payment alone, since a longer loan term can lower payments while increasing total interest paid.
• The post recommends researching advertised rates first, then seeking actual prequalification or preapproval offers from a narrowed set of lenders within a focused shopping period.

IRS seeks comments on paperwork burden for ABLE disability savings accounts

A routine Paperwork Reduction Act notice covering the recordkeeping and reporting tied to qualified ABLE programs, the tax-favored savings accounts for eligible disabled individuals. The filing matters mainly to state agencies administering these programs and to compliance teams tracking OMB-approved collections rather than substantive tax changes.

• Comments on the information collection are due on or before December 14, 2026.
• The collection operates under OMB Control No. 1545-2293 and Regulatory Number TD 9923.
• The IRS states there is no change to the previously approved information collection, which is an extension of a currently approved collection.
• The estimated number of annual responses is 28,987, with an estimated time per response of 22 minutes.
• Estimated total annual burden hours are 10,729, covering individuals, households and states as the affected public.

CISA and Canadian Cyber Centre issue joint guidance on AI token consumption

CISA, Canada's Cyber Centre and partners released joint guidance on managing token consumption in third-party super intelligence services. It treats unmanaged token usage not as a billing nuisance but as an availability and resilience problem for critical infrastructure, and sets out practical steps to prioritise, monitor and optimise consumption while keeping human oversight of AI-enabled defence workflows.

• CISA, the Canadian Centre for Cyber Security and partners jointly published the guidance on 22 October 2026.
• The guidance names token exhaustion and denial-of-tokens or denial-of-wallet attacks as risks of unmanaged consumption.
• Recommended steps include prioritising token allocation, caching and reusable context, optimising data before submission, and monitoring consumption over time.
• Critical infrastructure owners are told to identify mission-critical functions dependent on SI and plan for reduced availability during outages, incidents or high demand.
• Cyber defenders are advised to run SI-enabled defence workflows while maintaining human oversight, governance and cybersecurity fundamentals.

US industrial production rose 0.7% in September as utilities surged

The Federal Reserve's September industrial production report, summarised by the ABA Banking Journal, shows headline output up 0.7% after a flat August, driven by utilities and consumer goods. Manufacturing managed only a modest gain as motor vehicle output fell. For bank economists and credit teams tracking the real economy, the composition matters as much as the headline.

• Total industrial production rose 0.7% in September and stood 2.2% above its year-earlier level at 104.0% of the 2017 average.
• Utilities output surged 3.5% and manufacturing rose 0.3%, while business equipment was unchanged among the major market groups.
• Motor vehicles and parts output fell 3.0%, dragging on durable manufacturing, which edged up just 0.1% for the month.
• Semiconductor and related electronic components output rose 28.4% in the third quarter, lifting durable manufacturing to a 3.8% annual growth rate.
• Capacity utilization moved up to 76.9%, which remains 2.5 percentage points below its 1972 to 2025 long-run average.

Fed posts change-in-control notice for Missouri's Midwest Regional Bancorp

The Federal Reserve has published a Change in Bank Control Act notice covering a family group seeking to acquire voting shares of Midwest Regional Bancorp, Inc. of Festus, Missouri, and indirectly its bank subsidiary. The notice sets a comment deadline and routes filings through the Federal Reserve Bank of St. Louis. It is a procedural publication, but it marks the start of the public clock.

• The notice is filed under the Change in Bank Control Act (12 U.S.C. 1817(j)) and section 225.41 of Regulation Y (12 CFR 225.41).
• The group acting in concert proposes to acquire voting shares of Midwest Regional Bancorp, Inc., Festus, Missouri, and indirectly Midwest Regional Bank, Clayton, Missouri.
• Written comments on the standards in paragraph 7 of the Act must be received no later than October 30, 2026.
• The applicants include two Bender family revocable living trusts, seven named individuals, and JJB Capital, LLC, with the filing routed through the Federal Reserve Bank of St. Louis.

Oklahoma landlord to pay $52,500 over refusal to rent to family with child

A DOJ civil rights settlement resolves a lawsuit against the owners of an Oklahoma City apartment complex accused of refusing to rent to a single mother once she disclosed her three-year-old son would live with her, a violation of the Fair Housing Act's familial status protections.

• Defendants agreed to pay $52,500 to the woman who was denied an apartment at The Vintage at Mesta Park.
• The lawsuit was filed in the U.S. District Court for the Western District of Oklahoma in August 2025, following events from July 2022.
• Defendant Jacqueline Fox allegedly told the woman she could not move in because no children had resided at the property in over eight years and it was not "kid friendly."
• The settlement requires defendants to implement a nondiscrimination policy and undergo training to prevent future familial status discrimination.
• HUD referred the case to DOJ after investigating the woman's complaint and issuing a charge of discrimination.

DOJ charges 15 in Los Angeles health care fraud takedown over $1.8bn in claims

The Justice Department's new National Fraud Enforcement Division unveiled a coordinated Los Angeles takedown spanning sober home, hospice, atherectomy, genetic testing and pharmacy fraud. For compliance leads at insurers and providers, the sweep shows how data analytics now drives case selection and how kickback-driven patient recruitment remains the common thread across schemes totalling over $1.8 billion in fraudulent claims.

• Nathan Young, David Young, Honey Phipps and Cody Phipps are charged over a scheme that billed private insurers more than $1.6 billion for sham substance abuse treatment, with co-defendant Nicholas Moore pleading guilty to assisting $199 million in fraudulent claims.
• Dr. Harold Tabaie and Hany Malek face a $135 million Medicare scheme for unnecessary atherectomies, a case DOJ says was identified through data analytics showing Tabaie as an extreme national billing outlier from 2016 through 2023.
• Three separate hospice schemes, charged against Geoffrey Jimenez, Dr. Richard Keech and Armani Raffi, allegedly billed Medicare over $138 million for patients who were not terminally ill, with non-death discharge rates far above the national average.
• Christina Mareik was indicted over a nearly $270 million Medi-Cal pharmacy scheme exploiting the suspension of prior-authorization requirements, with approximately $269,130,000 billed and at least approximately $178,746,000 paid.
• Doctors Hassan Badday and Robby Ayoub are charged with accepting per-patient kickbacks from a marketer for ApolloMDx laboratory in exchange for authorizing medically unnecessary genetic testing orders.

FTC sues ticket broker REPS over scheme to bypass purchase limits

The FTC referred a complaint to the Department of Justice against ticket broker REPS & Company and three executives, alleging systematic circumvention of ticket-issuer purchase limits under the Better Online Ticket Sales Act. The case touches on how resellers evade platform security controls and what obligations that law imposes on brokers operating at scale.

• The complaint alleges REPS purchased more than eight tickets for at least 83,500 events since 2022.
• REPS allegedly spent more than $1.3 billion to amass more than 18.5 million tickets.
• The complaint alleges REPS generated at least $120.8 million in profit reselling these tickets.
• One example cites $833,000 in profit from using 1,300 accounts to buy 7,624 tickets to a 2023 Beyonce Renaissance tour concert in Kansas City.
• The Commission voted 2-0 to refer the complaint to the DOJ, which filed it in the U.S. District Court for the Southern District of California.

Cboe EDGX bars unpriced orders outside regular hours ahead of 23x5 launch

Cboe EDGX has filed two clarifying amendments to its order-handling rules as it prepares to trade 23 hours a day, five days a week. The changes restrict execution of unpriced orders to regular trading hours and tighten the wording on when Day Orders entered overnight expire. The filing took effect immediately as non-controversial, with comments open until November 12, 2026.

• New text in Rule 11.1(a)(3) states that orders without a limit price will not be eligible for execution outside Regular Trading Hours, which are 9:30 a.m. to 4:00 p.m. Eastern Time.
• Rule 11.6(q)(2) is amended so a Day Order entered during Order Acceptance Queueing Time or the Overnight Trading Session expires at the end of Regular Trading Hours on the business day to which the Overnight Trading Session belongs.
• The Exchange filed the change as a non-controversial proposal under Section 19(b)(3)(A)(iii) and Rule 19b-4(f)(6), making it immediately effective.
• The amended rule text takes effect in December 2026 pending industry readiness, operative in conjunction with the Original Filing approved under SR-CboeEDGX-2026-019.
• Written comments must be submitted on or before November 12, 2026, referencing file number SR-CboeEDGX-2026-071.

FTC sues GovAssist and owner Scott Zuckerman over passport impersonation scheme

The FTC has filed suit against GovAssist LLC, Entry LLC and individual Scott Zuckerman, alleging they impersonated the US government to lure travellers seeking passport services. The case tests the agency's Impersonation Rule and reaches a defendant already operating under a prior FTC order. For compliance teams at advertisers and platforms, it maps how the FTC frames paid-search impersonation as an FTC Act violation.

• The FTC alleges GovAssist, Entry and Zuckerman impersonated the US State Department through paid Google search ads since at least October 2023.
• The complaint cites violations of the FTC Act, the Impersonation Rule and the Gramm-Leach-Bliley Act.
• Defendants advertised services starting at $89 while the lowest actual price was $119 plus a $29 shipping fee, totalling $148 as stated by the FTC.
• Individual defendant Scott Zuckerman ran the scheme while under a prior FTC order in the unrelated Support King LLC stalkerware case.
• The Commission authorised the complaint on a 2-0 vote; it was filed in the US District Court for the District of Puerto Rico.

OFAC clears 125 names in sanctions overhaul, issues first PAIPA licenses

The ABA's fortnightly digest of OFAC and State Department sanctions activity through Oct. 19 covers a 125-name delisting, the first general licenses under the Protecting American Intellectual Property Act, fresh Russia, Iran and Cuba measures, an ICC-related settlement, cartel designations and Venezuela earthquake-relief authorization. Screening and wind-down obligations run in several directions at once.

• On Oct. 5, OFAC removed 125 individuals and entities from its sanctions lists and updated 22 list entries to improve compliance screening.
• On Oct. 19, OFAC issued PAIPA General License 1 and General License 2 and added entities to its non-SDN menu-based sanctions list.
• OFAC reached a $175,015 settlement with Pegasus Worldwide Logistics over potential sanctions and reporting violations, and issued four ICC-related general licenses.
• On Oct. 15, State designated Cuba's BANCO INTERNACIONAL DE COMERCIO S.A. (BICSA) under E.O. 14404 and OFAC issued Russia- and Iran-related general licenses.
• OFAC issued Venezuela-related General License 60A authorizing transactions related to earthquake relief efforts and amended FAQ 1263.

DOJ and FTC sue California ticket broker over BOTS Act violations

The Justice Department's Civil Division, with the FTC, has filed a civil complaint against a California ticket broker and its executives for allegedly circumventing ticket-purchase limits at scale. This briefing covers who is named, the statutory basis, and the figures alleged in the filing.

• DOJ's Civil Division and the FTC filed a complaint against REPS & Company Inc. and three named executives: Ryan Pancheri, Brian Archibald, and Nicholas Totagrande.
• The complaint alleges violations of the FTC Act and the Better Online Ticket Sales (BOTS) Act, which bars circumventing ticket sellers' access controls.
• Defendants allegedly spent more than $1.3 billion to amass over 18.5 million tickets for thousands of events since 2022.
• The complaint alleges at least $120.8 million in profit from reselling the tickets on the secondary market.
• The case was filed in the U.S. District Court for the Southern District of California; the claims are allegations only, with no determination of liability.

DOJ sues St. Paul and Portland over mask and ID rules for federal officers

The Justice Department has filed complaints against two cities challenging local ordinances that regulate how federal law enforcement officers identify themselves and whether they may wear masks. The filings extend a wider Civil Division campaign against state and local measures it views as obstructing federal operations, a pattern compliance and government affairs teams tracking federal-local friction should note.

• DOJ filed lawsuits against St. Paul, Minnesota and Portland, Oregon on October 15, 2026, press release number 26-1209.
• The challenged laws are Saint Paul Code of Ordinances §§ 268A-268B and Portland City Code §§ 23.30.030 and 23.30.100.
• The complaints invoke the Supremacy Clause, arguing local governments cannot regulate equipment worn by federal officers on duty.
• Attorney General Blanche has directed the Civil Division to identify state and local laws impeding federal law enforcement operations nationwide.
• The department describes these filings as part of a series that has previously targeted New York, Virginia, Connecticut, New Jersey, California, Maryland, Philadelphia, Denver and Milwaukee.

Smuggler sentenced to five years for northern border human smuggling ring

A DOJ press release details the sentencing of Edgar Sanchez-Solis, a leader of an alien smuggling organization that moved migrants across the US-Canada border. The case, part of Operation Take Back America and Joint Task Force Alpha, outlines the scheme's structure, a 2023 vehicle chase, and co-defendants awaiting sentencing.

• Edgar Sanchez-Solis, 27, was sentenced to five years in prison for conspiracy to commit alien smuggling and five counts of alien smuggling for commercial advantage and private financial gain.
• The smuggling organization operated between December 2022 and April 2025 and smuggled hundreds of aliens from Mexico and Central and South America across the Canadian border into the United States.
• In May 2023, a van carrying smuggled aliens led US Border Patrol on a vehicle chase that ended when officers used a tire deflation device.
• Three co-defendants, Ignacio Diaz-Perez, Samuel Diaz-Perez, and Salvador Diaz-Diaz, pleaded guilty to related conspiracy and smuggling counts and are expected to be sentenced on November 23.
• Joint Task Force Alpha's work to date has resulted in more than 486 domestic and international arrests and more than 486 US convictions, according to the release.

San Diego man pleads guilty to evading over $6.7 million in taxes

The Justice Department announced a guilty plea in a tax evasion case involving an unreported income scheme tied to the sale of purported federal tax credits. The item covers the scale of unreported income, how proceeds were concealed and spent, and the sentencing timeline, relevant to compliance teams tracking enforcement trends in tax-related fraud.

• Peter L. Roper's businesses received nearly $19 million in income between 2010 and 2021 that was never reported to the IRS.
• Roper owed more than $6.7 million in federal income taxes on that unreported income.
• He spent $187,432.34 on a 2015 McLaren 650S Spider and $277,698.50 on a 2021 Aston Martin DBX using business funds.
• Roper concealed assets by titling them in the names of others and pleaded guilty to one count of tax evasion.
• Sentencing is scheduled for Jan. 8, with a maximum penalty of five years in prison.

US retail sales rise 0.8% in September, topping forecasts

A short data note from the ABA Office of the Chief Economist on the Commerce Department's September 2026 retail sales estimate, with the trade group's read on what it means for consumer lending demand. Useful for bank economists and lending teams tracking consumer demand signals.

• September 2026 retail and food services sales reached $745 billion, up 0.8% from August, exceeding the 0.3% market expectation.
• August 2026 retail sales growth was revised upward to 1.3% from an initial 1.1%.
• Gasoline station sales rose 6.4% in September, while sales excluding gas stations rose only 0.2%.
• Retail sales were up 6.2% year over year compared with September 2025.
• The ABA Office of the Chief Economist warns that sustained higher essential spending could hurt consumer loan performance.

Jamaican national pleads guilty to illegal voting in 2024 US election

A guilty plea in federal court in Trenton shows the Justice Department's Election Integrity Task Force pursuing individual noncitizen voting cases alongside broader actions. The case carries direct relevance for compliance teams monitoring how federal agencies coordinate on immigration and election-related enforcement, and signals continued prioritization of this enforcement area.

• Gaye Tyndale-Simpson, 55, a citizen of Jamaica, pleaded guilty to one count of voting by an alien in a federal election.
• The plea concerns votes cast in the November 2024 general election, held in part to elect a president.
• The charge carries a maximum penalty of up to 6 months in prison and a $100,000 fine.
• Sentencing before Judge Singh is scheduled for February 24, 2027.
• The case was investigated by the FBI, Homeland Security Investigations, the State Department's Diplomatic Security Service, and USCIS under the U.S. Attorney's Office's Election Integrity Task Force.

FTC wins $106.8 million judgment shutting down debt relief scheme

This item covers a default judgment and related stipulated orders closing out an FTC enforcement action against a debt relief operation accused of impersonating banks and government agencies. It matters for compliance teams at debt relief and credit services firms because it details the specific bans and asset turnover terms now attached to individuals and entities in the industry.

• The court entered a $106.8 million default judgment on October 14, 2026 against Accelerated Debt Settlement Inc. and six affiliated entities.
• Jeffrey Lakes faces a $104.3 million judgment, jointly and severally with other defendants, partially suspended after he turns over approximately $12.6 million in assets.
• Robert Knechtel's $37,299,828 judgment will be suspended based on his inability to pay.
• Elizabeth Reaney must transfer $175,000 or the title to her home in Scottsdale, Arizona.
• The order bans defendants from impersonating government entities or businesses, telemarketing, and misrepresenting credit report purposes or debt relief outcomes.

Village Capital to pay over $500,000 over servicemember loan rights violations

DOJ settled claims that VA home loan servicer Village Capital & Investment LLC mishandled Servicemembers Civil Relief Act interest rate protections and retaliated against borrowers who asserted their rights. The settlement sets out payment terms, a civil penalty and compliance obligations relevant to other VA loan servicers monitoring SCRA enforcement.

• DOJ alleges Village Capital failed to apply SCRA's 6% interest rate cap retroactively to at least 41 servicemembers' pre-service mortgage debts.
• The company will pay at least $425,000 to affected servicemembers plus a $79,380 civil penalty, the maximum for a first SCRA violation.
• DOJ alleges Village Capital misled borrowers by telling them their rate was already below 6% when it was in fact above 6%.
• The settlement requires Village Capital to revise policies and procedures and provide SCRA training to employees.
• DOJ alleges Village Capital retaliated against rate-benefit requesters by accelerating principal and falsely reporting their loans as delinquent to the VA.

US banks turn to podcasts for marketing as listenership reaches 158 million

The ABA Banking Journal profiles how community and regional banks use podcasting as a marketing and relationship tool. It draws on practitioners at South State Bank, Sunrise Banks and the former Keystone Bank, covering why they launched, how they measure results and what separates shows that gain traction from those that stall. A short, practical read for marketing and communications leads.

• RSS.com data cited in the piece puts US monthly podcast listeners at more than 158 million, about half of Americans aged 12 and over.
• Grandview Research forecasts the US podcasting market will grow by about 19 percent between 2025 and 2030.
• South State Bank's The Community Bank Podcast now averages about 3,500 downloads per month, up from roughly 500 at its 2020 launch.
• Practitioners stress defining a target audience and keeping production lean, with Sunrise Banks describing a setup of "a Yeti mic and then some graphic designer's time."
• There are approximately 4.5 million podcasts registered worldwide, making intentional promotion necessary to capture attention.

ISIS-inspired inmate gets 50 years for stabbing attack on prison guards

A Justice Department press release details the sentencing of Abdulrahman El Bahnasawy for a 2020 assault on two corrections officers at USP Allenwood while he was already incarcerated for plotting ISIS attacks in New York City. The release covers the sentence, the underlying conduct, and prior proceedings.

• Bahnasawy, 28, was sentenced to 50 years for the Dec. 7, 2020 attack on two corrections officers at USP Allenwood.
• The 50-year term runs consecutive to the 40-year sentence he is already serving for plotting a 2016 ISIS attack in New York City.
• Bahnasawy pleaded guilty in November 2025 to assault, assault with intent to commit murder, possession of contraband, and providing material support to ISIS.
• One of the two attacked corrections officers lost his right eye as a result of the assault.
• A note reading 'This is a terrorist attack for the Islamic State' was found in Bahnasawy's sock after he was restrained.

State Department waives child soldier arms restrictions for eight countries

The Child Soldiers Prevention Act bars certain US military assistance and arms sales to governments that recruit child soldiers unless the President certifies progress and waives the restriction. This notice records the annual national-interest determination covering eight countries and sets out exactly which categories of assistance each waiver unlocks.

• The waiver for the Central African Republic covers IMET assistance, excess defense articles and DCS licenses only.
• The DRC waiver is limited to IMET, peacekeeping operations assistance and DCS licenses.
• Ethiopia, Nigeria and Yemen receive full waivers of the section 404(a) prohibition with no stated limitation.
• Somalia's waiver is restricted to peacekeeping operations assistance and support under 10 U.S.C. 331 and 10 U.S.C. 333.
• The Russian Federation receives a waiver solely for DCS licenses connected to the International Space Station.

NCUA seeks comment on renewing five credit union reporting collections

The NCUA has published a Paperwork Reduction Act notice covering the renewal of five existing information collections it intends to submit to OMB for clearance. The filings span capital planning, supervisory stress testing, loan participation, the Central Liquidity Facility and premises rules. None is a new obligation, but the notice fixes the agency's burden estimates and opens a comment window that closes on December 21, 2026.

• Comments on all five collections are due by December 21, 2026, after which the requests go to OMB for clearance.
• Each collection is an extension of a previously approved collection, not a new requirement.
• Capital planning and stress testing (12 CFR 702-E) carries the highest estimated annual burden at 11,710 hours; loan participation (701.22) is estimated at 2,916 hours.
• Capital planning and stress testing rules apply to federally insured credit unions reporting $10 billion or more in assets on their March 31 Call Report, with plans due to NCUA by March 31 each year.
• Supervisory stress test tiers run from Tier I ($10bn to under $15bn) through Tier III ($20bn or more), with Tier II and III credit unions required to conduct the tests.

State Department delegates presidential appointments authority to office director

A routine Federal Register notice records a formal delegation of authority within the State Department, transferring specific administrative powers to the Office of Presidential Appointments. It affects internal State Department process rather than external regulated industries, but it documents how authority over diplomatic titling, accreditation and custody of the Great Seal is now exercised.

• Under Secretary for Management Jason Evans signed Delegation of Authority No. 629 on August 11, 2026, per the notice's summary.
• The delegation gives the Director and Deputy Director of the Office of Presidential Appointments authority to prescribe regulations and approve exceptions under the office's programs.
• The delegation covers approval of Minister-Counselor and Counselor diplomatic title exceptions where lack of title would impair mission functions.
• The delegation includes authority to approve accreditation of non-U.S. government personnel abroad, including personal services contractors, commercial contractors and grantees.
• The Director and Deputy Director also assume the role of Custodian of the Great Seal of the United States under this delegation.

SEC corrects comment deadline for interval fund share class proposal

The SEC has issued a correction to the DATES section of a proposed rule on interval fund modernization and multiple share classes for registered closed-end management companies. This brief covers what the correction changes, the affected release numbers, and the revised comment deadline firms should track.

• The correction applies to proposed rules document 2026-20360, originally published October 5, 2026 at page 63388 of the Federal Register.
• The corrected DATES section sets the comment deadline as December 4, 2026.
• The rulemaking covers 17 CFR Parts 239, 249, 270, and 274 under Release No. 33-11444, 34-106534, IC-36351, File No. S7-2026-34, RIN 3235-AN83.
• The correction notice was filed on October 19, 2026 at 8:45 a.m.

DOJ opens CRIPA probe into conditions at D.C. jail facilities

The Justice Department has notified D.C. Mayor Muriel Bowser that it is opening a federal civil rights investigation into the D.C. Department of Corrections. The probe follows allegations including excessive force, inadequate medical care and unsanitary conditions, and will test whether a pattern or practice of constitutional violations exists under CRIPA.

• The Justice Department notified D.C. Mayor Muriel Bowser on October 19, 2026 of a federal investigation into D.C. DOC correctional facilities.
• The investigation proceeds under the Civil Rights of Institutionalized Persons Act (CRIPA), covering patterns or practices of resistance to constitutional rights.
• Allegations include failure to protect inmates from excessive force, inadequate medical care, unsafe and unsanitary conditions, and inadequate nutrition.
• The Department cites numerous allegations plus a report from the District of Columbia's own Auditor as grounds for the probe.
• DOJ states it has not reached any conclusions regarding the allegations and is soliciting further information via civilrights.justice.gov/report/.

Washington DFI files Statement of Charges against Digital Access and Christina Habhab

The Washington State Department of Financial Institutions has entered a Statement of Charges naming Digital Access, LLC and an associated individual under the Uniform Money Services Act. The published record carries only the case identifier, the respondents, the date and the governing act, so this briefing reports what the filing states and no more.

• The DFI entered a Statement of Charges, case number C-26-4362-26-SC01, on 15 October 2026.
• The respondents are Digital Access, LLC (NMLS #2185177) and Christina C. Habhab (NMLS #2301318).
• The action is brought under the Uniform Money Services Act.
• The full order is published as a linked PDF, C-26-4362-26-SC01-Digital-Access-LLC-et-al_web.pdf.

Fraud now costs US financial firms $5.47 for every $1 lost, LexisNexis finds

Two industry studies quantify what fraud is costing US banks and financial services firms. LexisNexis puts the multiplier on each dollar of fraud at $5.47, up from $4 in 2021, while PYMNTS.com finds institutions now spend more than $2 to prevent every $1 that gets through. The data points to mobile channels, AI-generated techniques and a sharp divergence between large banks and fintechs.

• LexisNexis finds every $1 of fraud costs US financial services firms $5.47, up from $4 in 2021.
• Websites and mobile apps accounted for nearly 70% of fraud losses, and 96% of institutions reported more fraud targeting mobile channels.
• Institutions estimated AI-generated techniques contributed to 19% of fraud losses in the US.
• PYMNTS.com put losses per institution at $1.92 million in 2026, up 8% from $1.78 million in 2024, with prevention spend rising to $4.35 million.
• Nonbank fintech firms saw fraud losses rise from $800,000 to $2.84 million per institution, while large banks cut losses by nearly half.

Synchrony says 45 million US adults remain locked out by credit scoring

An opinion piece from Synchrony's chief credit officer makes the case that traditional credit scoring excludes tens of millions of creditworthy Americans, and describes how the firm's AI-driven underwriting system, Synchrony PRISM, uses alternative data to expand access. Compliance and risk teams tracking alternative data underwriting and consumer consent practices should note the specifics offered.

• The Federal Reserve recently reported that US credit card balances rose to $1.26 trillion.
• Synchrony's chief credit officer states that reliance on three-digit credit scores locks roughly 45 million US adults out of mainstream credit.
• Synchrony PRISM, launched in 2018, now analyzes tens of thousands of data signals and can pull up to 9,000 data points on an applicant in real time.
• In the initial phase of the OCC's Project REACh, Synchrony approved nearly 70,000 loans to individuals with no prior credit history.
• More than 60% of those Project REACh borrowers reached a prime credit score within a year, according to the piece.

SEC official warns on governance gaps in California JPA bond financings

A speech by the SEC's municipal securities chief to a California public finance conference lays out specific concerns about bond-issuing joint powers authorities, citing fee structures, board composition and disclosure failures, before turning briefly to risks in the fast-growing energy prepay bond sector.

• One JPA financed 14 essential housing projects with $2.5 billion in bond financing, and half have defaulted, dipped into reserves, or reported impairment.
• Another JPA has a 1% default rate, which the speech says is over 30 times the overall municipal bond default rate and over 100 times the default rate for general governmental bonds.
• Firms advising California JPAs received fees ranging from around $3.1 million to over $11.9 million per JPA for the fiscal year ended June 30, 2025.
• The two largest California statewide JPAs have retained almost $125 million in issuer fees since 2010.
• Energy prepay bonds have surpassed $100 billion outstanding in 2025 and now exceed 5% of the Bloomberg Municipal Index, with 37% average annual issuance growth.

FinCEN alerts banks to Iranian abuse of Shi'a religious charity networks

FinCEN has issued an alert to help financial institutions identify and report what it says is potential Iranian exploitation of religious charity networks, including khums payments from the global Shi'a community. It lists red flags and lands alongside fresh sanctions on a Cuban bank, both part of a campaign to isolate Iran financially.

• FinCEN issued the alert on October 15, 2026 to help institutions identify and report potential Iranian abuse of religious charity networks.
• The alert warns that Iran seeks to co-opt khums payments from the global Shi'a community to fund its activities.
• It sets out several red flags that may indicate activity tied to Iran's abuse of religious charity networks.
• The alert was issued alongside new sanctions on Cuba-based Banco Internacional de Comercio for allegedly supplying services to Iran, both part of Operation Economic Outcast.