Regulatory Tracker

Germany's BaFin announced it will oversee and enforce compliance around AI usage at banks and insurers, with authority to issue fines. This affects embedded finance and BaaS providers operating under German banking licences that use AI.

South Korea's Financial Supervisory Service (FSS) issued new third-party IT risk management guidelines for financial firms using external IT services such as cloud and SaaS. The guidance assigns the board of directors as the ultimate owner of third-party IT risk management.

FinCEN announced it will not take supervisory or enforcement action against US financial institutions for certain technical breaches of the Bank Secrecy Act and related regulations when those breaches arise from providing financial services to Venezuela. The commitment took effect July 27, 2026 and runs until January 29, 2027.

The RBI imposed a ₹7 lakh penalty on Sangli District Central Cooperative Bank Ltd for contravening Section 20(1) of the Banking Regulation Act, 1949. The bank had sanctioned director-related loans.

The RBI imposed a ₹1 lakh penalty on Shajapur Jilla Sahakari Kendriya Bank Maryadit for failing to transfer eligible unclaimed amounts to the DEA Fund within the prescribed period.

The RBI imposed a ₹10.10 lakh penalty on Raigad District Central Cooperative Bank Ltd for violating Section 20(1) of the Banking Regulation Act and failing to comply with credit information company membership directions.

The Delhi High Court ordered the winding up of Paytm Payments Bank Limited after the RBI cancelled its banking licence in April 2026 for persistent non-compliance. Girikumar M. Nair was appointed Official Liquidator.

The RBI imposed a ₹50,000 penalty on Citizen Cooperative Bank Ltd, Karnataka, for failing to comply with directions on income recognition, asset classification, and provisioning norms applicable to urban cooperative banks.

The OCC denied Wise's application for a US national trust bank charter, citing BSA/AML/CFT deficiencies at Wise's US subsidiary. Wise US had agreed to pay a $4.2 million administrative fine tied to those compliance failures.

India's Enforcement Directorate (ED) investigated Pune-based Edsom Fintech Pvt. Ltd. for allegedly laundering ₹800 crore in proceeds from an illegal online betting syndicate ('ALL PANEL EXCHANGE') through shell entities, cryptocurrency, and a credit cooperative society's bank account. ED conducted raids in Mumbai, Pune, and Bengaluru, seizing documents, digital devices, and freezing several bank accounts.

The OCC issued a proposed rule for payment stablecoin AML/CFT and sanctions compliance risk management, implementing requirements of the GENIUS Act for permitted payment stablecoin issuers. The American Fintech Council commented on the proposal.

The FDIC, OCC, and NCUA issued joint guidance on safety and soundness obligations when lending to individuals not legally authorized to work in the U.S., as noted in a July 23, 2026 legal update.

U.S. banking agencies issued guidance on handling highly sensitive information during bank examinations, including requirements for on-site review and 72-hour breach notification for confidential supervisory information.

The Bank of Greece Credit and Insurance Committee suspended the authorization of NBL MONEY TRANSFER PAYMENT FOUNDATION S.A. on Jul 20, 2026. The action was taken under Article 153 of Law 4261/2014.

Nigeria's Federal High Court in Lagos dismissed a challenge to the FCCPC's authority over digital lending regulations, vacating an interim restraining order. The FCCPC announced that its 2025 Digital, Electronic, Online or Non-Traditional Consumer Lending (DEON) Regulations are now fully operational and enforceable.

Multiple U.S. regulators including the OCC, Fed, FDIC, NCUA, Treasury, FinCEN, and OFAC missed the July 18, 2026 statutory deadline under the GENIUS Act to finalize rules governing stablecoin reserve requirements, capital standards, BSA/AML, and foreign issuer access. Key frameworks remain in proposed-rule stage only.

The RBI on Jul 17, 2026 imposed monetary penalties on six companies, including Muthoot Finance, for non-compliance with regulatory norms. Muthoot Finance was fined Rs 5.80 lakh for failures in risk categorisation review and suspicious transaction reporting.

The CFPB is preparing to unveil a new open banking rule addressing how banks price fintech access to consumer financial data. The bureau is considering a model where banks provide some data free but can charge above defined thresholds.

The Federal Reserve issued a prohibition order against James Burns, former chief lending officer of Heritage State Bank in Lawrenceville, Illinois. The action cited appraisal-related lending misconduct.

De Nederlandsche Bank fined payment institution CCV €2.65 million after 4,200 merchants went unmonitored for transaction activity over a 23-month period.

On July 15, 2026, Korea's Financial Services Commission (FSC) briefed the President on plans to overhaul bank governance, sanctions processes, and inspections, including pre-emptive inspections and rationalized sanction criteria. This is structural oversight reform rather than a discrete enforcement action.

The Reserve Bank of India (RBI) issued a draft framework on July 15, 2026, requiring banks and NBFCs to build stronger data security and data risk management systems in digital banking. This is supervisory guidance, not an enforcement action with penalties.

The PBoC Gansu branch warned and fined Lanzhou Anning Shenzhou Village Bank for violating account management rules and financial technology management regulations.

On July 13, 2026, UK regulators (Bank of England, FCA, and PRA) began formal oversight of critical third parties to the financial sector, including Microsoft, Google, Amazon, and Oracle as designated critical cloud providers.