Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

FCA finds private market conflicts controls lagging behind business complexity

The FCA has published detailed findings from its multi-firm review of how private market firms identify, manage and disclose conflicts of interest. It covers asset managers, AIFMs and advisers in private equity, private credit and real estate, and sets out where governance and controls have failed to keep pace with growing business complexity. The regulator expects firms to close gaps and signals targeted follow-up work.

• The review assessed firms against SYSC 10, COLL 8.5.7, COBS 2.3A.8R, COBS 11.7 and COBS 11.7A, running in two phases: a questionnaire followed by on-site visits.
• On cross-fund transfers and continuation vehicles weaker frameworks relied more heavily on existing governance, disclosure or investor consent; on gifts and entertainment they relied on policy thresholds and generic approvals; and on information barriers they relied on staff training, judgement and informal safeguards.
• Only 52% of phase 1 firms said internal audit had a role in reviewing the conflicts framework and its application.
• The FCA criticised firms whose conflicts frameworks reflected the legal form of UK activities as advisory-only while UK staff were involved in significant, conflict-generating parts of the investment lifecycle.
• In one case a firm sold a fund asset to an internal fund at NAV rather than pursuing external buyer interest, and could not explain why or how the NAV price served the selling fund.

FCA chair calls for cross-border testing of cloud and AI risks to finance

In a lecture honouring the late Michael D. Gill, FCA Chair Ashley Alder argues that financial risk now travels across firms, sectors and borders faster than regulators built in silos can track. He sets out why the UK's Critical Third Parties Regime, supervisory intelligence-sharing and joint crisis exercises need to expand internationally. Relevant for firms watching how operational resilience obligations may extend beyond financial services.

• The FCA, Bank of England and Prudential Regulation Authority's Critical Third Parties Regime currently covers major cloud computing providers, marking the first time UK financial regulators have extended reach outside the financial sector.
• The FCA hosted a financial crime conference this year with more than 400 attendees from government, regulators, industry, professional bodies and tech firms.
• The UK participated in a G7 cyber crisis simulation exercise earlier this year to test cross-border coordination during a major incident.
• The Global Financial Innovation Network, which Alder says the FCA is leading on a quantum toolkit due next month, draws on insights from 25 members including US regulators.
• The FCA is working with the Monetary Authority of Singapore to develop tools supporting safe, responsible AI adoption.

FCA finds uneven conflicts management across private market firms

The FCA has published findings from a review of how private market firms identify, manage and disclose conflicts of interest. Standards varied considerably across private equity, private credit and real estate, with some firms failing to keep controls in step with their own growth. The regulator wants firms to act on the findings, and signals a wider supervisory focus on private markets and investor outcomes.

• The FCA review covered conflicts of interest and fair customer treatment across private equity, private credit and real estate.
• Recurring weaknesses were found in cross-fund transfers and multi-party transactions, gifts and entertainment, and information barriers.
• The FCA expects firms to identify, record, manage and disclose conflicts effectively and to demonstrate investors are treated fairly.
• Separately, the FCA is examining governance and conflicts concerns relating to the use of private credit to fund consumer litigation claims.

FCA consults on Financial Crime Guide updates covering AI, crypto and sanctions

The FCA has opened CP26/38, a consultation on updates to its Financial Crime Guide intended to keep firms' systems and controls aligned with emerging risks. It spans seven areas, from fraud and sanctions to the incoming cryptoasset regime. Anyone supervised for financial crime under the MLRs should read the proposals and respond before the December deadline.

• The consultation opened 23 October 2026 and closes for responses on 24 December 2026.
• Proposed changes span seven areas including fraud, sanctions, proliferation financing, data security and money laundering.
• Crypto-related updates are intended to reflect the new cryptoasset regime arriving from October 2027.
• The FCA will publish feedback and the final Financial Crime Guide text in a Policy Statement.
• The FCA is exploring publishing standalone guidance without prior consultation where it is not required, to be consolidated into the Guide later.

FCA restricts six Annex 1 lenders over money laundering control concerns

The FCA has placed restrictions on six unregulated lenders registered as Annex 1 firms after raising concerns about their anti-money laundering controls during application assessments. The action sits within a wider review of roughly 900 registered firms. This segment covers who is affected, what the restrictions require, and the due diligence reminder the FCA directed at regulated firms dealing with the sector.

• The FCA imposed voluntary restrictions on six Annex 1 firms after concerns about their AML controls surfaced during application assessments.
• Restrictions limit new customers and new business, constrain payments from existing customers, and require independent AML reviews or, for Kingscrown Finance Ltd, an orderly wind-down of its loan book.
• The FCA is assessing responses to an information request sent to around 900 registered Annex 1 firms to identify and disrupt financial crime risks.
• The FCA reminded regulated firms that an Annex 1 firm's registration does not replace their own due diligence, including confirming registration status and conducting independent checks.

Fed invites comment on Security Bancshares bid to add lending activities

The Federal Reserve has published a routine section 4 notice flagging that Security Bancshares Corporation of Wewoka, Oklahoma, intends to engage in nonbanking activities permitted under Regulation Y. The notice opens a short public comment window and names the Reserve Bank handling the filing. It is brief, but it is the formal point at which interested persons can contest whether the proposal meets the statutory standards.

• Security Bancshares Corporation, Wewoka, Oklahoma, proposes to engage in lending activities under section 225.28(b)(1) of Regulation Y and to acquire debt in default under section 225.28(b)(vii).
• Written comments on whether the proposal complies with section 4 of the BHC Act must be received no later than November 9, 2026.
• The Federal Reserve Bank of Kansas City is the Reserve Bank handling the filing, with comments accepted by email at KCApplicationComments@kc.frb.org.
• Comments received are subject to public disclosure and will be made available without change, including any identifying information.

Euro area consumers see inflation ticking up, growth outlook deteriorating

The ECB's monthly Consumer Expectations Survey tracks euro area households' views on inflation, income, growth and housing, feeding directly into policy analysis. This release covers September 2026 fieldwork and shows a notable widening gap between rising price expectations and weakening growth sentiment, worth watching for anyone tracking consumer demand or credit conditions.

• Median perceived inflation over the past 12 months rose to 3.6% in September from 3.5% in August, with 12-month-ahead expectations up to 3.1% from 3.0%.
• Expectations for economic growth over the next 12 months fell to -1.5% in September from -1.2% in August.
• Expected unemployment rate 12 months ahead increased to 11.3% from 11.0%, with the bottom income quintile expecting 13.6% versus 9.7% for the top quintile.
• Expected mortgage interest rates in 12 months' time stayed at 4.9%, while home price growth expectations rose to 3.5% from 3.4%.
• The net percentage of households reporting tighter credit access, both over the past 12 months and expected ahead, increased compared with August.

US adds two ICC-linked individuals and the Court itself to OFAC blocking list

The State Department has published a notice placing two named individuals and the International Criminal Court on OFAC's Specially Designated Nationals and Blocked Persons List under the Executive Order 14203 sanctions programme targeting the ICC. This item sets out who was designated, on what date, under which criterion, and what the blocking means for any firm with exposure to funds or property connected to those persons.

• Tomoko Akane (DOB 28 Jun 1956, nationality Japan) and Abdoulaye Seye (DOB 09 May 1967, nationality Senegal) were added to the SDN List as of 18 August 2026, both located in The Hague.
• The International Criminal Court, address Oude Waalsdorperweg 10, The Hague, was added to the SDN List as of 9 October 2026.
• All three designations cite section 1(a)(ii)(A) of Executive Order 14203, covering direct engagement in an ICC effort to act against a protected person without the consent of that person's country of nationality.
• All property and interests in property of the designated persons subject to U.S. jurisdiction are blocked.
• Enquiries are directed to Samuel Parker, Deputy Assistant Secretary, Division for Counter Threat Finance and Sanctions, at iccsanctions@state.gov.

ECB supervisor urges system-wide stress tests to catch AI financing risks

A keynote from the ECB Supervisory Board member responsible for stress testing sets out how the framework is evolving beyond bank-only, scenario-based exercises toward system-wide and exploratory tools. It matters because it signals where ECB and ESRB stress-testing priorities, and future data requests to banks, are heading over the next two years.

• The ESRB has launched a project to develop a desktop-based system-wide stress test by 2028, building on recommendations of its High-Level Group.
• The 2026 reverse stress test on geopolitical risk asked banks to design scenarios depleting at least 300 basis points of their CET1 ratios.
• The exercise found some banks' risk assessments lacked granularity and that certain mitigating management actions were not credible once replicated across institutions.
• The ECB's 2025 macroprudential stress test extension used a top-down system-wide model to examine contagion between banks, investment funds and insurance corporations.
• The speech cites the Bank of England's system-wide exploratory scenarios and the first French system-wide stress test, run jointly by the Banque de France, ACPR and AMF, as comparable precedents.

Treasury proposes rules defining large institutional investors barred from buying homes

Treasury has issued a notice of proposed rulemaking to implement section 1001 of the 21st Century ROAD to Housing Act, which bars large institutional investors from buying single-family homes subject to exceptions. The rule defines undefined statutory terms and clarifies enforcement before the prohibition takes effect. Comments are due November 23, 2026.

• Comments on the proposed rule must be received on or before November 23, 2026.
• The statutory prohibition and exceptions take effect January 7, 2027, 180 days after the Act's July 11, 2026 enactment.
• A renovate-to-rent program requires improvements of at least 15 percent of the purchase price, with a non-exclusive safe harbor at 10 percent for structural or core system elements.
• Civil penalties under section 1001(d) can reach the greater of $1 million or three times the purchase price of the property, and a purchase violating the Act involving more than one large institutional investor counts as a single violation for calculating the maximum penalty.
• Treasury states it intends further rulemakings on other aspects of section 1001, including compliance procedures, reporting, recordkeeping, and enforcement actions.

OCC publishes stablecoin application forms as GENIUS Act final rule lands

The OCC has sent OMB a new information collection carrying the application forms that stablecoin issuers must file under the GENIUS Act, published alongside the related final rule. It sets out exactly what domestic permitted payment stablecoin issuers and foreign issuers must submit, the factors the OCC will weigh, and a burden estimate of 4,915 hours across 40 expected respondents.

• Comments on the new information collection (OMB control number 1557-NEW) are due by November 23, 2026, with the collection already sent to OMB for 30-day review.
• The final rule implementing the GENIUS Act for OCC-jurisdiction stablecoin issuers is published elsewhere in the same Federal Register issue; the Act was enacted July 18, 2025 and takes effect January 18, 2026.
• Permitted payment stablecoin issuer applications under 12 CFR 15.30 must include a business plan, reserve, redemption and risk management policies and Interagency Biographical and Financial Reports for directors, officers and principal shareholders.
• Foreign issuer registration under 12 CFR 15.32 requires a Treasury determination of a comparable home regime under section 18, consent to US jurisdiction and certification of no material misrepresentations.
• The OCC estimates 40 respondents, 40 annual responses and 4,915 total annual burden hours, a figure one commenter said materially understates the work required.

FDIC reopens comment on Volcker Rule paperwork burden, no changes proposed

A routine Paperwork Reduction Act renewal notice from the FDIC covering its Volcker Rule information collection under 12 CFR part 351. No substantive or methodological changes are proposed. Compliance teams at covered state nonmember banks and state savings associations should note the comment deadline and the burden estimate, which has fallen slightly from the previous cycle.

• Comments on the renewal must be submitted to the FDIC on or before November 13, 2026.
• The prior 60-day comment period, published July 31, 2026, drew no comments.
• Total estimated annual burden for the collection is 3,815 hours, down 234 hours from the previous renewal.
• The collection applies to FDIC-supervised insured depository institutions subject to 12 CFR part 351, excluding those with total consolidated assets of $10 billion or less and trading assets and liabilities of five percent or less of total consolidated assets.
• The FDIC states there is no change in the substance or methodology of the information collection.

SEC notices exemptive application from RTW Biotech Growth Fund over share classes

A routine but consequential SEC notice: RTW Biotech Growth Fund and RTW Investments, LP have applied for exemptive relief that would let the closed-end fund adopt a multi-class share structure with early withdrawal charges and asset-based fees. The notice opens a window for interested parties to request a hearing before the order issues.

• RTW Biotech Growth Fund and RTW Investments, LP filed the exemptive application on August 28, 2026.
• The applicants seek exemptions from sections 18(a)(2), 18(c) and 18(i) and rule 23c-3 of the Investment Company Act of 1940, plus an order under section 17(d) and rule 17d-1.
• Relief sought would permit multiple share classes, early withdrawal charges, and asset-based distribution and/or service fees.
• Hearing requests must be received by the Commission by 5:30 p.m. Eastern time on November 2, 2026, accompanied by proof of service on applicants.
• Absent a hearing order, the SEC will issue the requested exemptive order without further notice.

State Dept seeks comment on citizenship-abroad forms, 275,000 respondents

A routine but binding Paperwork Reduction Act notice from State's Bureau of Consular Affairs opens comment on two forms used to document U.S. citizenship acquired abroad. Compliance teams handling expat or cross-border family services should note the comment window and burden estimates before the collections go to OMB.

• Comments on both collections are due by December 22, 2026, submitted through Regulations.gov under Docket Number DOS-2026-1123.
• DS-2029, the Application for Consular Report of Birth Abroad, carries an estimated 113,212 respondents at 60 minutes average response time, for 113,212 total burden hours.
• DS-5507, the Affidavit of Physical Presence or Residence, Parentage, and Support, carries an estimated 162,161 respondents at 30 minutes average response time, for 81,081 total burden hours.
• Both collections are listed as required to obtain or retain a benefit, meaning respondents must complete them to secure the underlying citizenship or nationality determination.
• Email and regular mail comment options have been suspended, with all submissions centralized through Regulations.gov or a dedicated comment email address.

US housing starts fall again in September, missing forecasts at 1.221m

The American Bankers Association's DataBank note reads the September Census Bureau housing report for banks with mortgage and construction exposure. Starts fell for the month, missed market expectations and ran below a year ago, continuing a decline the ABA traces to a 2022 peak. The single forward-looking positive is multifamily permitting. This is a short indicator piece, useful for pipeline and credit-demand context.

• September housing starts were 1.221 million SAAR, below the 1.305 million market expectation and 5.2% under the revised August figure of 1.288 million.
• The September reading was 7.4% below the September 2025 rate of 1.319 million, continuing a decline the ABA dates to a 2022 peak.
• Single-unit starts fell 4.6% and multiunit starts fell 6.7% for the month, while single-unit permits fell 4% and multiunit permits rose 6.1%.
• Starts in the South rose 6.1% from August to 714,000, the only region up for the month.
• The ABA Office of the Chief Economist cites affordability, labor shortages, input costs and elevated mortgage rates, and says residential building could remain subdued.

Texas Stock Exchange offers equity stakes to lure first ten corporate listings

A Texas Stock Exchange rule filing, effective immediately under SEC fast-track procedures, creates an equity incentive program for the first wave of corporate listings. Compliance teams at issuers weighing a listing transfer, and rivals tracking exchange competition for listings, should note the eligibility thresholds and vesting conditions set out below.

• Rodeo II grants 100,000 restricted stock units in TXSE Group Inc. to each of the first ten qualifying Founding Partners.
• Primary listings require a trailing 90-trading-day average market cap of at least $3.5 billion; dual listings require at least $100 billion.
• Units vest 50% on the first anniversary and 50% on the second anniversary of continuous listing on TXSE.
• The program runs until all awards are allocated, December 31, 2026, or TXSE terminates it, whichever comes first.
• TXSE may increase the award pool to fifteen at its sole discretion, with public notice on its website.

NIST opens Cybersecurity Career Week, October 19-24, 2026

NIST's cybersecurity insights blog announces Cybersecurity Career Week, a workforce-awareness campaign rather than a rule or supervisory action. It lists a schedule of webinars, an in-person NCCoE event and a social media challenge aimed at people considering cybersecurity careers, plus pointers to the NICE Framework and CyberSeek tools.

• Cybersecurity Career Week, led by NIST's NICE Program, runs October 19-24, 2026.
• A webinar titled "Networking Like a Leader" is scheduled for October 14, 2026 from 1:00-2:00 PM ET.
• The NCCoE is hosting an in-person Cybersecurity Connections event on October 15, 2026 from 11:00 AM-1:30 PM ET.
• A six-day #mycyberjob media challenge runs across X, Instagram, Facebook and LinkedIn from October 19-24, 2026.
• Additional webinars on breaking into cybersecurity and student career pathways are scheduled for October 20 and October 21, 2026.

Sinaloa Cartel transporter pleads guilty to meth and marijuana trafficking

A DOJ press release details the guilty plea of a Mexican national who worked as a distributor and transporter for Sinaloa Cartel-affiliated traffickers. The case, brought under the Homeland Security Task Force initiative, illustrates federal prosecutors' continued focus on mid-level cartel logistics networks and the financial channels that support them.

• Hernandez Ochoa pleaded guilty to conspiracy to distribute 500 grams or more of methamphetamine and 1,000 kilograms or more of marijuana for importation into the United States.
• Court documents say he worked from 2015 to 2017 as a distributor and transporter using private planes, human couriers, tunnels, semi-trailer trucks and hidden vehicle compartments.
• He also coordinated transportation of cash for drug purchases and its repatriation from the U.S. after sale.
• Sentencing is scheduled for Feb. 2, 2027, and he faces a maximum penalty of life in prison.
• The Justice Department's Office of International Affairs assisted in his extradition, with cooperation from the Government of Mexico.

Washington state regulator publishes consumer guide to credit card billing cycles

This is a consumer-facing explainer from Washington's Department of Financial Institutions aimed at cardholders confused by statement balances versus app balances. It covers billing cycle mechanics, grace periods and the difference between a credit card balance and a checking account balance, intended as financial literacy content rather than new rulemaking.

• The post explains that a credit card purchase is effectively borrowing money with a promise to repay, usually with interest, unlike a debit card which draws funds immediately.
• Purchases and transactions accumulate during a billing cycle, and the card issuer produces a statement when that cycle ends.
• Paying the full statement balance by the due date will generally allow a cardholder to avoid interest on purchases if the card has a grace period.
• The statement balance, minimum payment and payment due date are described as three distinct pieces of information that tell a cardholder different things.
• The statement closing date is cited as the reason a newer purchase may not appear in the amount currently due.

SEC seeks OMB renewal of municipal advisor registration rules and forms

This is a routine Paperwork Reduction Act notice in which the SEC asks OMB to extend approval of the information-collection rules underpinning municipal advisor registration. It matters to compliance teams at municipal advisory firms because it quantifies, in granular detail, the ongoing filing burden they carry under Forms MA, MA-I, MA-W and MA-NR.

• As of December 31, 2025, approximately 419 municipal advisors were registered with the Commission.
• The Commission estimates 15 new Form MA applicants annually for each of the next three years, totalling 45 over the period.
• The average internal cost of compliance per hour for completing Forms MA and MA-I is estimated at approximately $271.
• Rule 15Ba1-8 requires municipal advisory firms to obtain and retain, for not less than five years, written consent to service of process from each associated person engaged in municipal advisory activities.
• The Commission estimates it will receive an average of 21 Form MA-W withdrawals and enter orders cancelling or revoking registration of 4 municipal advisors annually over the next three years.

Cboe EDGX adopts generic listing standards for options on multi-crypto-asset trusts

Cboe EDGX has filed a non-controversial rule change, operative on filing, that lets it list options on commodity-based trusts holding more than one crypto asset and on exchange-traded funds defined under Rule 6c-11. The standards copy rules the SEC already approved for affiliate Cboe Options. Comments are open until November 12, 2026, and the Commission may suspend the change within 60 days.

• Each crypto asset in a listed multi-asset trust must have an average daily market value of at least $700 million over the trailing 12 months and underlie a derivatives contract on a market with a comprehensive surveillance sharing agreement.
• The filing permits options on exchange-traded funds defined under Rule 6c-11, relying on that rule's portfolio transparency requirements as the anti-manipulation basis.
• Continued listing standards require the Exchange to review the market-value criterion monthly and consider suspending opening transactions if criteria are no longer met.
• The rules are substantively identical to Cboe Options standards approved by the SEC in April 2026 under SR-CBOE-2026-020.
• The change became operative on filing after the SEC waived the 30-day delay; written comments are due by November 12, 2026.

New Jersey brothers plead guilty to stealing $2.6 million in fake tax refunds

A DOJ guilty plea announcement details how two brothers used false Form 1041 trust filings to extract over $2.6 million combined in fraudulent IRS refund checks, then obstructed collection efforts with false nonresident filings. The case is part of DOJ's first National Tax Enforcement Surge, giving compliance and financial crime teams a window into current enforcement priorities.

• Ronald Chrichlow and Gordon Chrichlow pleaded guilty to theft of government funds after claiming false refunds of $978,126 and $1,643,172 on 2022 Form 1041 filings.
• The IRS issued Treasury checks for both amounts in March 2023, and Gordon Chrichlow used proceeds to buy a Porsche Taycan for approximately $117,364 and a house for approximately $686,258.
• After an IRS revenue officer was assigned in August 2023, the brothers filed false Form 1040-NR returns falsely claiming nonresident status and treaty-based tax exemption.
• Ronald Chrichlow earned $960,000 between 2021 and 2024 but did not file returns from 2022 to 2024, and separately claimed a false $93,228 refund for 2021.
• Gordon Chrichlow failed to file returns from 2021 through 2024 despite earning more than $1.4 million in gross income in those years.

Four Texans indicted over trust tax shelter tied to $200 million IRS loss

The indictment covers one case within DOJ's first National Tax Enforcement Surge, a nationwide push spanning early September to October 14. It details a promoted trust scheme, alleged obstruction of IRS audits, personal tax evasion and a separate fraudulent securities solicitation tied to one defendant, with charges carrying penalties up to 20 years per count on the most serious counts.

• The indictment alleges the trust scheme sheltered more than $1.5 billion in client income, causing an estimated $200 million tax loss to the IRS.
• Clients allegedly paid fees often exceeding $100,000 and were encouraged to backdate trusts and file amended returns claiming refunds.
• Weickgenant is charged with corrupt interference with the IRS, including instructing clients not to speak with investigators and not to comply with a court order enforcing an IRS summons.
• MacDonald is separately charged with wire fraud and transactions with criminally derived property over an alleged $2 million investor solicitation while under an SEC injunction barring unregistered securities sales.
• The case is one of 76 defendants charged nationwide under DOJ's first National Tax Enforcement Surge, covering an estimated $490 million in intended and estimated federal revenue loss.

DOJ opens Second Amendment probe into Pennsauken, New Jersey permit delays

The Justice Department has opened an investigation into whether Pennsauken, New Jersey unconstitutionally delays firearm permits. The inquiry is run by the Civil Rights Division's Second Amendment Section and rests on the Supreme Court's reasoning in Bruen. This item covers what the department is examining, the legal theory it is using, and how the Division is now deploying its gun-rights enforcement arm against local permitting systems.

• The investigation, opened October 14, 2026 under press release 26-1200, targets delays in issuing firearm licenses in Pennsauken, New Jersey.
• The inquiry focuses specifically on the Pennsauken Township Police Department's permitting system.
• The department relies on Bruen (2022), which it reads as treating lengthy processing wait times as an abusive use of a permitting scheme.
• AAG Harmeet K. Dhillon directed the Civil Rights Division's Second Amendment Section to run the investigation.
• The release states the investigation does not support any armed obstruction of federal or local law enforcement.

SEC trading chief details Rule 611 review, tokenised venue exemption and new derivatives

A speech by the SEC's Division of Trading and Markets director lays out the status of three live market structure initiatives: the proposed rescission of Rule 611, a conditional exemption for tokenised securities trading venues, and a wave of new derivatives products entering the market under SEC and CFTC jurisdiction. It matters because each affects execution obligations and venue registration status.

• The Division is analysing over 1,200 comment letters on the June 11 proposal to rescind Rule 611 and amend Rule 610(e) for locked and crossed markets.
• Chairman Atkins directed the Division to review Rule 610 access fee caps and Rule 612 minimum pricing increments by year-end, alongside any Rule 611 change.
• The Commission approved the Innovation Exemption on September 17, a five-year conditional exemption from the exchange definition for Tokenized Securities Venues trading tokenised NMS stocks.
• Five CFTC-registered DCMs, Coinbase, Kalshi, Bitnomial, NADEX and ICE Futures, filed Form 1-Ns in September to notice register as security futures exchanges.
• The Commission approved Cboe's proposal to list binary security options based on KPIs tied to NMS securities, and CME launched cash-settled single-stock futures on July 27.

NCUA proposes rolling back 2019 fidelity bond board oversight rules

NCUA is proposing to unwind several procedural requirements it added in 2019 for fidelity bond and insurance coverage at federally insured credit unions and corporate credit unions. The rule touches board approval processes, signatory rotation, bond form expiration, and minimum coverage formulas. Compliance officers at FICUs should read this now because the comment window closes December 14, 2026, and the changes affect who signs off on bond purchases.

• Comments on the proposed rule are due on or before December 14, 2026, under docket number NCUA-2026-1882.
• The proposal would remove the 2019 requirement that a FICU's full board review all fidelity bond purchase or renewal applications, allowing delegation to an individual board or supervisory/audit committee member.
• It would eliminate the 2019 rotation requirement barring the same board member from signing consecutive bond renewal agreements.
• Section 713.4(d), which imposes an automatic 10-year expiration on NCUA-approved bond forms, would be eliminated in its entirety.
• The Board proposes removing paragraphs (b) and (c) of Section 713.5, which contain advisory "should purchase" language and a formula tying additional coverage to daily cash on hand or money in transit.

NCUA proposes to finalize pandemic-era Central Liquidity Facility rule changes

NCUA is proposing to permanently adopt liquidity-access changes it made on an interim basis during the COVID-19 pandemic, while cleaning up provisions that have since lapsed under the CARES Act and the Consolidated Appropriations Act. The rule also trims documentation requirements for federally insured credit unions and adjusts capital stock subscription timing. Compliance and treasury teams at member credit unions should read this now rather than wait for the final rule.

• Comments on the proposed rule, docket NCUA-2026-1889, must be received by December 14, 2026.
• The proposal would permanently remove the six-month waiting period for new regular members to obtain CLF advances, a change first made by the April 29, 2020 interim final rule.
• Federally insured natural-person and corporate credit unions would no longer need to submit financial reports, charters and bylaws with CLF membership applications, since the CLF already obtains these through NCUA examinations.
• Non-federally insured credit unions not otherwise subject to NCUA examination would still have to provide financial reports and other information to the CLF to establish their financial condition.
• The Board received 15 comments on the two interim final rules, all of which supported the changes made.

IRS proposes rules tightening ACA premium tax credit eligibility under OBBBA

The IRS has issued proposed regulations under section 36B of the tax code to implement changes made by the One, Big, Beautiful Bill Act to the Affordable Care Act premium tax credit. Compliance, tax and benefits teams advising on health exchange enrollment or administering Form 1095-A reporting should review the comment and hearing timeline now.

• Written or electronic comments on REG-101576-26 must be received by November 30, 2026, via the Federal eRulemaking Portal or by mail.
• A telephonic public hearing is scheduled for December 8, 2026 at 10 a.m. ET, contingent on topic outlines being received by November 30, 2026.
• Requests to attend the public hearing must reach the IRS by 5 p.m. ET on December 4, 2026.
• For taxable years beginning after December 31, 2025, section 71305 of the OBBBA removes the excess APTC repayment limitation, requiring full repayment of any excess advance credit.
• Section 71302(a) of the OBBBA removes PTC eligibility for lawfully present aliens with household income below 100% of the Federal Poverty Level who are ineligible for Medicaid due to immigration status, effective for taxable years beginning after December 31, 2025.

UAE central bank AML unit and ADGM's FSRA sign AML/CFT cooperation MOU

The Central Bank of the UAE's Anti-Money Laundering and Suspicious Cases Unit and the FSRA of Abu Dhabi Global Market have signed a memorandum of understanding to cooperate on AML/CFT. The agreement commits both to regular discussions and coordinated training. For firms operating in ADGM, it signals tighter domestic coordination between the free-zone regulator and the federal AML authority.

• The AMLSCU at the Central Bank of the UAE and the FSRA of ADGM signed an AML/CFT cooperation MOU on 2 May 2016.
• Both parties committed to regular discussions on issues of mutual interest and to coordinating AML/CFT training and technical assistance.
• The FSRA regulates financial institutions and DNFBPs in ADGM for compliance with UAE AML/CFT laws and ADGM AML/CFT regulations and rules.
• The MOU was signed by Abdulrahim Mohammed Al Awadhi of the AMLSCU and Richard Teng, Chief Executive Officer of the FSRA.

Treasury finalises Treasury auction rule changes ahead of system upgrade

Treasury has issued a final rule amending the Uniform Offering Circular that governs the sale and issuance of marketable Treasury bills, notes and bonds. Most changes are technical, but one reworks how submitters hand over noncompetitive customer bids. The rule took effect on 15 October 2026, though the operationally significant pieces apply only when Treasury's upgraded auction system goes live.

• Submitters must provide each individual noncompetitive customer's name and bid amount before the noncompetitive auction close, and can no longer submit a summary bid amount.
• The amendments to 31 CFR 356.14 and 356.23 apply from the first auction conducted on Treasury's upgraded auction system, which Treasury will communicate in advance; all other changes apply from the effective date of 15 October 2026.
• Treasury is updating terminology across sections 356.15, 356.20, 356.21, 356.23 and others, including using 'award' and 'recognize' in place of 'accept' and 'tender'.
• Treasury removed references to http://www.treasurydirect.gov in sections 356.23(a) and 356.31(a), stating instead that it will make auction results available on its website.

CFPB seeks renewal of consumer complaint response survey, comments due Dec 14

A routine Paperwork Reduction Act notice from the CFPB seeking OMB extension of an existing information collection: the Consumer Response Company Response Survey. Relevant to firms that respond to CFPB consumer complaints, since survey results feed back to companies and inform CFPB's assessment of complaint handling.

• Comments on the extension request must be received by December 14, 2026 to be assured of consideration.
• The survey is approved under OMB Control Number 3170-0069 and docketed as CFPB-2026-0022.
• CFPB estimates 66,700 respondents and 4,669 total annual burden hours for the collection.
• The survey asks three questions about a company's complaint handling plus a narrative description supporting each answer.
• Survey results are shared with the responding company and used by CFPB as one of several inputs to assess response accuracy, completeness and timeliness.

SEC notices Clearlake, Pathway co-investment exemptive order application

The SEC has published notice of an exemptive application from Clearlake Private Markets Fund, Clearlake Capital RIC Management and Pathway Capital Management seeking relief to co-invest across affiliated business development companies and closed-end funds. This brief covers the filing's scope, deadlines and how interested parties can request a hearing before the order is granted.

• Applicants Clearlake Private Markets Fund, Clearlake Capital RIC Management, LLC and Pathway Capital Management, L.P. filed the application on August 10, 2026 and amended it on August 13, 2026.
• The requested order would permit certain BDCs and closed-end management investment companies to co-invest in portfolio companies with each other and with affiliated investment entities.
• The relief sought covers joint transactions otherwise prohibited by sections 17(d) and 57(a)(4) of the Investment Company Act and rule 17d-1.
• Hearing requests must reach the Commission by 5:30 p.m. Eastern time on November 3, 2026, accompanied by proof of service on the applicants.
• The order will be issued without a hearing unless the Commission orders one, per the standard exemptive application process.

ADGM opens first public consultation on draft founding legislation

This is ADGM's announcement that it has launched the first phase of public consultation on the draft legislation underpinning its new financial centre, covering company law, insolvency, employment and property regulations ahead of its first licence applications.

• ADGM published draft legislation covering Companies, Insolvency, Employment, Operating Regulations, Property and Strata regulations for public comment.
• More than 16 major international financial institutions and industry bodies took part in a pre-open market consultation before the drafts were released.
• The public comment period on the draft legislation runs until Thursday 5 February.
• Chairman Ahmed Ali Al Sayegh said ADGM expects to receive its first licence applications later in the year.
• ADGM stated this is the first of several phases of open market consultation, with further draft legislation to follow in coming months.

Siemens RUGGEDCOM CROSSBOW controller has critical SQLite flaw, CVSS 9.8

CISA has republished a Siemens ProductCERT advisory detailing five vulnerabilities in the SQLite component embedded in RUGGEDCOM CROSSBOW Station Access Controller software used across critical infrastructure sectors. One flaw carries a CVSS v3 score of 9.8. Security and OT teams running affected versions should assess exposure and schedule the vendor update.

• Siemens has released RUGGEDCOM CROSSBOW SAC version V6.0 to remediate all five listed vulnerabilities, and recommends updating from any version below V6.0.
• CVE-2025-71316 is rated CVSS v3 9.8, critical, and involves insecure handling of Unicode-to-ANSI conversion in SQLite's sqldiff.exe that could allow an attacker to load an arbitrary DLL.
• CVE-2026-11822 and CVE-2026-11824 affect SQLite versions before 3.53.2 and involve heap-based buffer overflows in the FTS5 full-text search extension triggered via crafted database files.
• CVE-2025-6965 affects SQLite versions before 3.50.2 and can cause memory corruption when aggregate terms exceed available columns.
• Siemens ProductCERT reported the vulnerabilities to CISA, and the advisory is a verbatim republication of Siemens advisory SSA-765416.

CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device

CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.

• All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
• CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
• CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
• CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.

CISA flags Siemens WinCC privilege escalation flaw with no fix for V7.5

CISA has republished a Siemens ProductCERT advisory covering a high-severity privilege escalation flaw in SIMATIC WinCC, the SCADA system used across critical manufacturing, energy, healthcare, transport, government and financial services. Siemens has shipped fixes for two version lines but has none for V7.5. The flaw lets an authenticated user with database access execute commands on the underlying host.

• CVE-2026-59241 carries a CVSS v3.1 base score of 8.8 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• All versions of SIMATIC WinCC V7.5 are affected and no fix is currently available.
• Siemens has fixed the flaw in V8.0 Update 11 and V8.1 Update 7; users should update to those or later versions.
• An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host running WinCC.
• CISA recommends minimising network exposure, placing control systems behind firewalls and using secure remote access such as VPNs.

CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

• CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
• The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
• PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
• PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
• CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.

CISA flags five vulnerabilities in Siemens RUGGEDCOM APE1808 with Nozomi software

CISA has republished a Siemens ProductCERT advisory covering five vulnerabilities in RUGGEDCOM APE1808 devices running Nozomi Networks' Guardian/CMC software. The flaws range from low to high severity and touch dashboard, credential management, polling and login functions used across critical infrastructure deployments worldwide.

• Five CVEs affect all versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC: CVE-2026-33387, -33388, -33389, -33391 and -33920.
• CVE-2026-33389, an improper certificate validation flaw in Smart Polling, carries the highest individual CVSS 3.1 score of 7.5.
• CVE-2026-33388 scores 7.4 and allows a limited-privilege authenticated user to delete or edit Credentials Manager entries, potentially disrupting authentication.
• Siemens directs affected organizations to contact customer support directly to receive patch and update information rather than publishing a fix in the advisory.
• The advisory was initially released on 2026-10-13 and republished by CISA on 2026-10-22 as SSA-911336.

CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software

CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.

• Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
• CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
• The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
• CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
• Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.

CISA flags ZigBee DoS flaw in Siemens SENTRON 3NA COM Fuse

This advisory covers a medium-severity denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse units running firmware below V5.2, deployed worldwide across multiple critical infrastructure sectors. Operators running affected versions should read the fix path and recommended network protections before deciding on patch timing.

• CVE-2024-7322 affects SENTRON 3NA COM Fuse versions below V5.2 and carries a CVSS v3.1 base score of 5.8 (medium).
• An unsolicited encrypted rejoin response can change a ZigBee device's node ID, causing a denial-of-service condition.
• Recovery from the DoS condition requires the affected network to be re-established.
• Siemens' remediation is to update affected devices to V5.2 or later.
• The advisory lists deployment across critical manufacturing, transportation, energy, healthcare, financial services and government facilities sectors worldwide.

Siemens Software Center flaw under active exploitation, CISA confirms

CISA has republished a Siemens ProductCERT advisory covering a DLL hijacking flaw in Siemens Software Center, a tool used across critical manufacturing, energy, healthcare, financial services and government facilities deployments worldwide. The advisory notes active exploitation and directs users to apply the vendor's fix, which auto-updates on next startup.

• CVE-2026-110936 affects Siemens Software Center versions prior to V4.0.9.8 via an uncontrolled DLL search path (CWE-427).
• CVSS v3.1 base score is 6.7 (medium), with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, requiring local access and high privileges.
• Siemens states existing Software Center installations will be auto-updated to V4.0.9.8 or later on next startup.
• The advisory references a Siemens blog post providing additional information on current known active exploitation and how to detect it.
• Revision 3 of the advisory, dated 2026-10-19, added the reference to active exploitation, two days after initial publication.

CISA flags high-severity flaw in InterSystems IRIS for Health, TLS off by default

CISA has published an ICS Medical Advisory covering a cleartext transmission vulnerability in InterSystems IRIS for Health, a platform used across the healthcare sector worldwide. The flaw stems from TLS/SSL being disabled by default. Compliance and security teams running affected versions should review this briefing before deciding how urgently to act.

CISA flags out-of-bounds read flaw in Siemens Capital Embedded AR Classic

CISA has republished a Siemens ProductCERT advisory covering an out-of-bounds read vulnerability in Capital Embedded AR Classic, used across manufacturing, energy, transport, healthcare, financial services and government facility sectors worldwide. The advisory sets out which versions are fixed, which have no fix planned, and what mitigations operators should apply in the interim.

• CVE-2026-89208 is an out-of-bounds read vulnerability with a CVSS v3.1 base score of 5.3, rated medium severity.
• Capital Embedded AR Classic R20-11 versions before V2303 should be updated to V2303 or later, per Siemens' vendor fix.
• Siemens has no fix planned for Capital Embedded AR Classic 431-422 and recommends mitigation only.
• Siemens recommends applying network segmentation and placing ECUs behind properly configured gateways and firewalls for both affected versions.
• The product is deployed worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors.

CISA flags denial-of-service flaws in Siemens building automation controllers

CISA's advisory covers multiple remotely exploitable vulnerabilities in widely deployed Siemens building automation controllers used across critical manufacturing, energy, healthcare, financial services and government facilities worldwide. Compliance and OT security teams running APOGEE, TALON or Desigo PXC/PXM equipment should check which product lines have patches available versus those left on mitigation-only guidance.

• CISA released advisory ICSA-26-295-08 on October 22, 2026 covering Siemens APOGEE, TALON and Desigo PXC/PXM products.
• The highest-rated vulnerability, affecting APOGEE MBC (PPC) BACnet, carries a CVSS v3 base score of 8.2 across three CWE categories: out-of-bounds read, integer underflow and stack-based buffer overflow.
• Siemens has issued vendor fixes for APOGEE PXC Compact/Modular and TALON TC Compact/Modular, updating to V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet).
• Siemens states no fix is planned for APOGEE MBC/MEC (PPC) variants or any of the thirteen listed Desigo PXC/PXM controller models.
• Recommended mitigations for unpatched products include network segmentation behind gateways/firewalls and disabling the FTP/Web service, which Siemens says is off by default.

PRA and FCA plan to scrap pre-approval for most senior manager roles

The PRA and FCA have opened consultations to strip back the Senior Managers and Certification Regime, removing regulator pre-approval for many functions and scrapping the Certification Regime entirely for roles below senior manager level. This covers what changes, what stays, and the consultation deadline compliance and HR teams need to track.

• The PRA and FCA opened parallel consultations on 22 October 2026 to streamline SM&CR, with feedback invited until 22 January.
• Regulator pre-approval will be removed for roles including Chief Actuaries and Chairs of Risk and Audit Committees, replaced by firm notification.
• The Certification Regime will be scrapped for around 139,000 individuals below senior manager level, removing them from annual checks and the Financial Services Register.
• The reforms are expected to reduce PRA SM&CR pre-approvals by 43% and halve the overall burden of the PRA regime.
• CEOs, CFOs and Chairs will continue to require regulator pre-approval and fit and proper tests before appointment.

FCA chief signals more assertive use of powers to tackle digital-era market risks

A speech by FCA chief executive Nikhil Rathi sets out how the regulator intends to respond to AI, tokenisation and other fast-moving technology without slowing innovation. It signals a shift from rulemaking toward more assertive supervisory action, a rethink of AML processes, and new leadership roles tasked with cutting duplicative compliance burden while expanding the FCA's reach into unregulated sources of harm.

• FCA chief executive Nikhil Rathi delivered the speech at the Corporation of the City of London's annual City Dinner on 22 October 2026.
• Rathi said as much as 8% of banks' workforces are dedicated to combatting financial crime, and called for better outcomes from those resources.
• The FCA is integrating over 60,000 professional services businesses into its regulatory ambit.
• New chief operating officer Johan Sekora, formerly of Swedish banks' intelligence sharing efforts, will lead work to look beyond KYC processes toward uncovering actual money laundering.
• Deputy chief executive Sarah Pritchard will engage firms to streamline duplicative compliance assurance, including a review of the three lines of defence model.

DOJ and HHS open six-month False Claims Act self-disclosure pilot for healthcare firms

The Justice Department's Civil Division and HHS have launched a six-month pilot giving healthcare companies a defined route to resolve potential False Claims Act violations by disclosing them voluntarily. The programme fixes the repayment multiplier at 1.25 to 1.6 and offers a coordinated civil release from FCA and certain HHS administrative liability. This briefing sets out who qualifies, what a disclosure must contain, and the deadline.

• The six-month FCA SDPP accepts self-disclosure submissions through April 22, 2027, and late or incomplete filings will not be reviewed.
• Self-disclosing companies must repay the government with a 1.25 to 1.6 multiplier, varying by timeliness, scope, senior-leadership involvement, financial benefit and successor liability.
• Participants must describe all relevant conduct, produce sufficient documents and set out remedial actions taken, submitting electronically to FCA-SDPP@usdoj.gov.
• Qualifying companies receive a coordinated civil release from liability under the federal False Claims Act and certain HHS administrative authorities.
• The pilot covers potential civil violations only; potential criminal conduct must be disclosed to DOJ's National Fraud Enforcement Division.

FCA proposes scrapping Certification Regime in second phase of SM&CR overhaul

The FCA has opened CP26/37, the second phase of its Senior Managers and Certification Regime review. It proposes removing the Certification Regime, retiring the Directory of certified persons, cutting the number of Senior Management Functions and raising the thresholds for the Enhanced regime. The consultation closes on 22 January 2027, with final rules expected in the first half of that year.

• The consultation opened on 22 October 2026 and closes on 22 January 2027, with final rules expected in the first half of 2027.
• The FCA proposes removing the Certification Regime and retiring its Directory of certified and assessed persons.
• Certain Senior Management Functions would be removed and other roles made notified, while Enhanced regime thresholds would be raised.
• Firms would no longer make ongoing submissions of Statements of Responsibilities and Management Responsibilities Maps, and Conduct Rule breach reporting thresholds would rise.
• The regime binds all firms currently in scope, including third-country branches, and firms due to enter scope such as cryptoasset firms.

CFPB updates FOIA and Privacy Act records system, adds NARA inspection disclosure

A routine but mandatory Privacy Act notice from the CFPB updating its primary FOIA/Privacy Act records system. The segment covers what the modification actually changes: scope of records, system manager, retention schedule, and a new disclosure pathway to NARA. Useful for privacy and records officers tracking agency practice.

• Comments on the modified system of records notice must be received no later than November 20, 2026, the same date the new system becomes effective absent a contrary determination.
• A new routine use permits disclosure of records to the National Archives and Records Administration or other federal agencies conducting records management inspections under 44 U.S.C. 2904 and 2906.
• The Chief Privacy Officer is clarified as the system manager for records related to Privacy Act amendment requests under 12 CFR 1070.56.
• The authority for maintaining the system is broadened to explicitly include the Freedom of Information Act, the Privacy Act of 1974, and the Federal Records Act, 44 U.S.C. 3101.
• Categories of records and individuals covered are expanded to clearly include those requesting amendment of records, including initial appeals and statements of disagreement.

Washington regulator urges rate shopping within CFPB's 14 to 45 day window

A consumer education post from Washington State's Department of Financial Institutions walks through how lenders evaluate loan applications and how borrowers can compare offers without unnecessary credit score damage. It draws on CFPB guidance about credit inquiry timing for auto loans.

• The post states a lender may consider debt-to-income ratio, comparing monthly debt payments with gross monthly income, when evaluating an application.
• The CFPB is cited as stating that multiple inquiries for an auto loan made within a relatively short period are generally treated as a single inquiry for scoring purposes.
• The CFPB recommends keeping auto-loan shopping within a 14- to 45-day window, according to the post.
• The post advises comparing APR, interest rate, loan term and total cost rather than relying on monthly payment alone, since a longer loan term can lower payments while increasing total interest paid.
• The post recommends researching advertised rates first, then seeking actual prequalification or preapproval offers from a narrowed set of lenders within a focused shopping period.