Regulatory Compliance Digest | Q4 2026

Newsletter

October 29, 2026

The Regulatory Compliance Digest’s Q4 2026 issue summarizes the latest updates from FFIEC, Financial Crimes Enforcement Network (FinCEN), Consumer Financial Protection Bureau (CFPB), Federal Deposit Insurance Corporation (FDIC) and federal bank regulatory agencies, in addition to other hot topics in the regulatory environment. Cherry Bekaert’s Regulatory Compliance Digest is intended to keep you informed of regulatory changes in advance of their effective date so your institution can remain compliant by the time of enactment.

Before detailing the regulatory updates, our professionals highlight the rising importance of key risk indicators for strong governance and maintaining regulatory compliance.

Using Key Risk Indicators To Drive Accountability

Regulators are shifting their focus to the strength of institutions’ compliance programs, and the foundation of an effective consumer compliance approach is disciplined governance, supported by key risk indicators (KRIs). Institutions that treat compliance as a periodic review function often detect problems only after they have spread. By contrast, a mature compliance management system identifies risk early, routes it to the right decision-makers, and verifies that corrective action is completed and sustained.

Governance establishes who owns risk, who provides oversight, and when issues must be escalated. KRIs translate operational activity into signals that management and the board can use to assess whether the institution is operating within its compliance risk appetite.

Key Risk Indicators: Turning Activity Into Actionable Signals

Key risk indicators should measure conditions that precede or accompany compliance breakdowns. They are most useful when each indicator has a defined owner, data source, reporting frequency, threshold, and required response. A dashboard without escalation criteria describes risk, while a mature KRI framework governs it. KRIs typically fall into four main categories, including:

Issue Aging and Repeat Findings: Track the percentage of open issues beyond committed due dates and the percentage that repeat a prior theme. Aging indicates weak execution and repetition suggests the underlying cause was not corrected.
Fee Reversals and Complaint Velocity: Measure month‑over-month changes in fee reversals, representment volume, and complaints relative to account or transaction volume. Segment results by product and channel to identify concentrations.
Fair Lending Disparity Measures: Monitor approval, pricing, and exception outcomes across relevant protected-class comparisons. Predetermined moderate and high thresholds should trigger progressively stronger review, including model analysis and tighter override controls.
Testing Coverage and Pass Rates: Report the percentage of high-risk processes tested, trends in control pass rates, and vendor testing completion against plan. Coverage and outcomes should be presented together so that a strong pass rate is not mistaken for assurance when testing is incomplete.

Each KRI should use thresholds aligned with the institution’s risk appetite. A moderate threshold may require management review, root-cause analysis, and a documented action plan. A high threshold should require immediate escalation to executive leadership or the appropriate board committee. Certain events should bypass routine reporting cycles entirely, including a red-rated indicator, an issue more than 30 days past due, a regulatory inquiry, or a failed third‑party compliance test.

Reporting Should Demonstrate Oversight

A monthly executive dashboard should show indicator trends, new and aging issues, examination and audit status, and remediation milestones against committed dates. A quarterly board risk package ideally connects those details to risk appetite, material root causes, regulatory change, and third-party portfolio health. Reporting should emphasize movement, concentration, and decisions required rather than presenting static totals without context.

Meeting minutes are a critical part of the control environment, and should document the questions directors and executives asked, the commitments management made, and whether follow-up occurred. This evidence demonstrates credible challenge and allows examiners to determine whether governance operated in practice.

A Practical Implementation Roadmap

First 30 Days

Confirm accountable owners for major compliance processes and review core fee mechanics, represented NSF patterns, and digital account-opening fee workflows for potential UDAAP exposure. Define the initial KRI inventory, data sources, reporting frequency, and escalation paths.

Next 90 Days

Formalize third-party risk tiering, perform independent fair lending statistical analysis, assess servicing backlogs, and establish monthly executive reporting. Validate that every red or overdue indicator has a named owner, corrective action, and committed completion date.

By 180 Days and Beyond

Replace manual spreadsheets with controlled compliance tracking and automated transaction testing where risk and volume justify the investment. Establish permanent line-of-business checkpoints, validate KRI thresholds against observed experience, and periodically reassess whether reporting continues to predict emerging risk.

Regulatory Updates

CFPB Issues Updated Special Information Booklet

On September 15, 2026, the CFPB released an updated version of its “Your Home Loan Toolkit,” a guide for prospective homebuyers navigating real estate settlement services and mortgage costs.

Defining Unsafe or Unsound Practices

On August 27, 2026, the OCC and FDIC adopted a final rule to define the term “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act and to revise the supervisory framework for the issuance of matters requiring attention.

Effective November 2, 2026, the final rule defines unsafe or unsound practices as conduct that is “contrary to generally accepted standards of prudent operation of a depository institution” and will either harm the institution in the future, if continued, or has already materially harmed the financial institution.

Telemarketing Sales Rule Fees

On August 26, 2026, the Federal Trade Commission amended its Telemarketing Sales Rule by updating the fees charged to entities accessing the National Do Not Call Registry as required by the Do-Not-Call Registry Fee Extension Act of 2007. The revised fees will become effective October 1, 2026.

Interagency Rescission of the Special Purpose Credit Programs Under the Equal Credit Opportunity Act and Regulation B

Effective August 25, 2026, a group of agencies — the FDIC, the National Credit Union Administration (NCUA), Office of the Comptroller of the Currency (OCC), Consumer Financial Protection Bureau, U.S. Department of Housing and Urban Development (HUD), the Department of Justice (DOJ), and the Federal Housing Finance Agency (FHFA) — issued a notice to inform the public of the rescission of the “Interagency Statement on Special Purpose Credit Programs Under the Equal Credit Opportunity Act and Regulation B”, dated February 22, 2022. The agencies are rescinding the interagency statement to make clear that:

Creditors may not discriminate against borrowers based on prohibited characteristics
Creditors should not rely upon the interagency statement or other related issuances going forward

Interagency Guidance on Lending to Individuals Not Legally Authorized to Work in the United States

On July 13, 2026, the federal bank regulatory agencies issued guidance to remind supervised financial institutions of existing supervisory expectations with respect to credit risk management, particularly as it relates to borrowers who are not legally authorized to work in the United States.

“Lending to individuals who are not legally authorized to work in the United States may present elevated credit risk because a borrower’s ability to generate income, maintain employment, and remain financially stable may be subject to greater uncertainty,” the guidance states. Among other things, the guidance advises financial institutions to identify, measure, monitor, and control these risks through safe and sound underwriting practices.

The guidance also advises financial institutions to carefully consider the June 8, 2026 “Statement on Ability To Repay and Immigration Status,” issued by the CFPB, reminding creditors of their obligations under the Truth in Lending Act as implemented by Regulation Z, and the Equal Credit Opportunity Act, as implemented by Regulation B, as they relate to non-work authorized borrowers.

Bank Secrecy Act (BSA)/Anti-money Laundering (AML) OFAC Update

Sanctions Penalties Regulations

On September 25, 2026, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) added the Sanctions Penalties Regulations, which consolidate previously existing information regarding penalties applicable to multiple sanctions programs implemented by OFAC.

Whistleblower Bulletin Issued Regarding Iran

Announced by Secretary of the Treasury Scott Bessent on August 24, 2026, Operation Economic Outcast is severing the remaining economic lifelines that sustain the Iranian regime. Treasury has “mapped the networks, facilitators, and financial channels that Iran uses to smuggle oil, evade sanctions, and fund terror.”

Working with partners across the U.S. government, the European Union, the United Kingdom, Gulf partners, and others, Treasury is targeting any source of the regime’s illicit revenue, as well as its sanctions evasion schemes to move funds. Treasury warned that any entity facilitating money laundering or sanctions evasion on behalf of Iran risks being cut off from the U.S. financial system. It also expanded secondary sanctions exposure for those who continue doing business with the Iranian regime and will accelerate the pace of U.S. enforcement.

FAQs Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule

On September 8, 2026, FinCEN, Board of Governors of the Federal Reserve System, FDIC, NCUA, and the OCC issued two new frequently asked questions (FAQs) that “address the use of state-issued mobile driver’s licenses and other government-issued digital credentials, which may be used to verify the identities of natural person customers under the Customer Identification Program (CIP) rule.”

FinCEN Assesses Historic $125 Million Penalty Against UBS Financial Services Inc. for Recidivist BSA Violations

On September 2, 2026, FinCEN renewed, with modifications, a geographic targeting order (GTO) requiring certain money services businesses (MSBs) to file additional currency transaction reports) with FinCEN. As modified, the GTO requires MSBs located in certain ZIP codes in New Mexico and Texas near the U.S. southwest border (covered businesses) to report through cash transactions of $1,000 or more through a CTR form.

The terms of the GTO are effective September 3, 2026, through March 1, 2027. However, MSBs that were not required to report under the GTO published by FinCEN on March 10, 2026, and that would be required to report under this GTO have until October 3, 2026, to comply with the terms of this GTO. In addition, the filing deadline for all reports filed under this GTO is 30 days after the date on which the transaction takes place, instead of the usual 15 days for CTRs.

Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications With Customers

On September 2, 2026, the Board of Governors of the Federal Reserve System, the FDIC, the NCUA, and the OCC, along with FinCEN, issued a joint statement to clarify confidentiality requirements related to suspicious activity reports (SARs). The joint statement will aid banks when communicating with their customers regarding potentially fraudulent transactions, other suspicious activity, or account closures.

FinCEN Analysis: Financial Institutions Flagged Nearly $5 Billion Linked to Suspected Human Smuggling

On August 13, 2026, FinCEN issued its Financial Trend Analysis showing that financial institutions flagged nearly $5 billion linked to suspected human smuggling over a three-year period. The report, which analyzed patterns and trends identified in BSA data between 2023 and 2025, identified several consistent indicators, including unverifiable relationships between originators and beneficiaries, transactions sent along common migration routes, and excessive cash activity conducted along the southwest border of the United States.

Beneficial Ownership Information Reporting Requirement Revision

On August 14, 2026, FinCEN issued the final rule to adopt as final and with certain limited changes the interim final rule issued on March 26, 2025, which narrowed beneficial ownership information (BOI) reporting requirements under FinCEN’s regulations implementing the Corporate Transparency Act (CTA).

“In particular, this final rule not only continues to exempt reporting companies from having to report the BOI of U.S. person beneficial owners and U.S. person beneficial owners from having to provide BOI to reporting companies,” the summary stated. “It also exempts reporting companies from having to submit information about their U.S. person company applicants to FinCEN and exempts U.S. person company applicants from any obligation to provide their information. In addition, the final rule exempts all U.S. persons from the requirement to update information already provided to FinCEN in connection with obtaining a FinCEN identifier.”

Geographic Targeting Order Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota

On August 14, 2026, FinCEN issued geographic targeting order, requiring banks and money transmitters located in the Counties of Hennepin and Ramsey, Minnesota to retain and report records of certain payments of $3,000 or more. This action is effective on August 11, 2026.

FinCEN Assesses Historic $125 Million Penalty Against UBS Financial Services Inc. for Recidivist BSA Violations

On August 3, 2026, FinCEN assessed a $125,000,000 civil money penalty against UBS Financial Services Inc. (UBSFS) for willful violations of the Bank Secrecy Act.This is the largest penalty ever imposed against a broker-dealer for BSA violations to date.

FDIC Encourages Voluntary Information Sharing Under 314(b) of the USA PATRIOT Act

On July 9, 2026, FinCEN announced updated guidance issued on June 12, 2026, that clarified how financial institutions can voluntarily share information under section 314(b) of the USA PATRIOT Act. The FDIC recognized fraud and other unlawful activity are a significant and growing concern nationwide for banks and consumers, and encouraged financial institutions to participate in the 314(b) program as a means to share information, mitigate potential losses, or increase suspicious activity detection.

FinCEN Alert on Fraud Schemes Targeting Federal Student Aid

On July 24, 2026, FinCEN issued an alert, in consultation with the U.S. Department of Education’s (ED) Office of Inspector General (ED-OIG) and the Federal Bureau of Investigation (FBI), to urge financial institutions to be vigilant in detecting, identifying, and reporting suspicious activity connected to fraud schemes targeting ED’s Office of Federal Student Aid (FSA) programs.

The alert states, “Fraud rings use stolen and fraudulent identities, as well as other tactics, to enroll in educational institutions and unlawfully acquire funds from Federal student aid programs. The schemes not only result in losses to Federal student aid programs, but also, in some cases, real students face difficulties enrolling in classes because of the number of fraudulently enrolled ’students.’”

OFAC Updating Website and Contact Information, and Authorizations for Payments for Legal Services

On July 27, 2026, the OFAC adopted a final rule to update website and contact information in certain parts of the Code of Federal Regulations (CFR). Additionally, OFAC amended one CFR part to update general licenses authorizing payments for legal services from funds originating outside the U.S. to replace the reporting requirement in the general license with a recordkeeping requirement. OFAC is also updating its regulations to correct an erroneous cross‑reference.

Let us be your Guide Forward

If you would like to discuss any compliance matters for your institution, please contact Cherry Bekaert’s Financial Institutions or Risk Advisory team today.

Connect With Us

DISCLAIMER
External links to other websites outside of www.cbh.com are being provided as a convenience and for informational purposes only. The links do not constitute an endorsement or an approval by Cherry Bekaert of any of the information, products, services, or opinions of the organization or individual. Cherry Bekaert bears no responsibility for the accuracy, legality, or content of the external websites or for that of subsequent links. Contact the external website for answers to questions regarding its content.