Regulatory Tracker

FinCEN assessed a $125 million civil money penalty against UBS Financial Services on Aug 03, 2026, for willful violations of the Bank Secrecy Act. The agency called it the largest BSA penalty ever imposed on a broker-dealer.

EU AI Act transparency obligations (Article 50) and the European Commission's enforcement powers over general-purpose AI providers became effective on August 2, 2026. The AI Office can impose fines up to 3% of global annual turnover or €15 million for violations.

The CFTC on Aug 03, 2026, ordered UBS Financial Services to pay $8 million for failing to supervise the configuration and operation of its AML transaction-monitoring systems for foreign-currency wire transfers.

FINRA fined UBS Financial Services $20 million on Aug 03, 2026 for anti-money-laundering violations. The firm failed to establish a compliance program reasonably designed to detect and report suspicious foreign-currency wire transactions.

The FDIC issued a second consent order against Lineage Bank on June 24, 2026, targeting risks from fintech partnerships and funding concentrations. Lineage Bank is a former partner of bankrupt fintech/BaaS platform Synapse.

On July 31, 2026, the Reserve Bank of India issued the 'Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026,' a sector-wide regulatory framework covering cybersecurity governance, incident response, and third-party risk management. The directions apply to all commercial banks and shape how they must manage risks from fintech partners, outsourced technology providers, and other vendors.

The Central Bank of Nigeria imposed ₦430 million in fines across 21 penalties on financial institutions in 2025 for delays in resolving customer complaints and failure to comply with CBN directives. The sanctions were disclosed in the CBN's 2025 annual report.

South Korea's Financial Supervisory Service (FSS) issued new third-party IT risk management guidelines for financial firms using external IT services such as cloud and SaaS. The guidance assigns the board of directors as the ultimate owner of third-party IT risk management.

Germany's BaFin announced it will oversee and enforce compliance around AI usage at banks and insurers, with authority to issue fines. This affects embedded finance and BaaS providers operating under German banking licences that use AI.

FinCEN announced it will not take supervisory or enforcement action against US financial institutions for certain technical breaches of the Bank Secrecy Act and related regulations when those breaches arise from providing financial services to Venezuela. The commitment took effect July 27, 2026 and runs until January 29, 2027.

The RBI imposed a ₹1 lakh penalty on Shajapur Jilla Sahakari Kendriya Bank Maryadit for failing to transfer eligible unclaimed amounts to the DEA Fund within the prescribed period.

The RBI imposed a ₹7 lakh penalty on Sangli District Central Cooperative Bank Ltd for contravening Section 20(1) of the Banking Regulation Act, 1949. The bank had sanctioned director-related loans.

The RBI imposed a ₹50,000 penalty on Citizen Cooperative Bank Ltd, Karnataka, for failing to comply with directions on income recognition, asset classification, and provisioning norms applicable to urban cooperative banks.

The RBI imposed a ₹10.10 lakh penalty on Raigad District Central Cooperative Bank Ltd for violating Section 20(1) of the Banking Regulation Act and failing to comply with credit information company membership directions.

The Delhi High Court ordered the winding up of Paytm Payments Bank Limited after the RBI cancelled its banking licence in April 2026 for persistent non-compliance. Girikumar M. Nair was appointed Official Liquidator.

The OCC denied Wise's application for a US national trust bank charter, citing BSA/AML/CFT deficiencies at Wise's US subsidiary. Wise US had agreed to pay a $4.2 million administrative fine tied to those compliance failures.

India's Enforcement Directorate (ED) investigated Pune-based Edsom Fintech Pvt. Ltd. for allegedly laundering ₹800 crore in proceeds from an illegal online betting syndicate ('ALL PANEL EXCHANGE') through shell entities, cryptocurrency, and a credit cooperative society's bank account. ED conducted raids in Mumbai, Pune, and Bengaluru, seizing documents, digital devices, and freezing several bank accounts.

The FDIC, OCC, and NCUA issued joint guidance on safety and soundness obligations when lending to individuals not legally authorized to work in the U.S., as noted in a July 23, 2026 legal update.

The OCC issued a proposed rule for payment stablecoin AML/CFT and sanctions compliance risk management, implementing requirements of the GENIUS Act for permitted payment stablecoin issuers. The American Fintech Council commented on the proposal.

U.S. banking agencies issued guidance on handling highly sensitive information during bank examinations, including requirements for on-site review and 72-hour breach notification for confidential supervisory information.

The Bank of Greece Credit and Insurance Committee suspended the authorization of NBL MONEY TRANSFER PAYMENT FOUNDATION S.A. on Jul 20, 2026. The action was taken under Article 153 of Law 4261/2014.

Nigeria's Federal High Court in Lagos dismissed a challenge to the FCCPC's authority over digital lending regulations, vacating an interim restraining order. The FCCPC announced that its 2025 Digital, Electronic, Online or Non-Traditional Consumer Lending (DEON) Regulations are now fully operational and enforceable.

Multiple U.S. regulators including the OCC, Fed, FDIC, NCUA, Treasury, FinCEN, and OFAC missed the July 18, 2026 statutory deadline under the GENIUS Act to finalize rules governing stablecoin reserve requirements, capital standards, BSA/AML, and foreign issuer access. Key frameworks remain in proposed-rule stage only.

The RBI on Jul 17, 2026 imposed monetary penalties on six companies, including Muthoot Finance, for non-compliance with regulatory norms. Muthoot Finance was fined Rs 5.80 lakh for failures in risk categorisation review and suspicious transaction reporting.