Regulatory Tracker

The FDIC, OCC, and NCUA issued joint guidance on safety and soundness obligations when lending to individuals not legally authorized to work in the U.S., as noted in a July 23, 2026 legal update.

The OCC issued a proposed rule for payment stablecoin AML/CFT and sanctions compliance risk management, implementing requirements of the GENIUS Act for permitted payment stablecoin issuers. The American Fintech Council commented on the proposal.

U.S. banking agencies issued guidance on handling highly sensitive information during bank examinations, including requirements for on-site review and 72-hour breach notification for confidential supervisory information.

The Bank of Greece Credit and Insurance Committee suspended the authorization of NBL MONEY TRANSFER PAYMENT FOUNDATION S.A. on Jul 20, 2026. The action was taken under Article 153 of Law 4261/2014.

Nigeria's Federal High Court in Lagos dismissed a challenge to the FCCPC's authority over digital lending regulations, vacating an interim restraining order. The FCCPC announced that its 2025 Digital, Electronic, Online or Non-Traditional Consumer Lending (DEON) Regulations are now fully operational and enforceable.

Multiple U.S. regulators including the OCC, Fed, FDIC, NCUA, Treasury, FinCEN, and OFAC missed the July 18, 2026 statutory deadline under the GENIUS Act to finalize rules governing stablecoin reserve requirements, capital standards, BSA/AML, and foreign issuer access. Key frameworks remain in proposed-rule stage only.

The RBI on Jul 17, 2026 imposed monetary penalties on six companies, including Muthoot Finance, for non-compliance with regulatory norms. Muthoot Finance was fined Rs 5.80 lakh for failures in risk categorisation review and suspicious transaction reporting.

The CFPB is preparing to unveil a new open banking rule addressing how banks price fintech access to consumer financial data. The bureau is considering a model where banks provide some data free but can charge above defined thresholds.

The Federal Reserve issued a prohibition order against James Burns, former chief lending officer of Heritage State Bank in Lawrenceville, Illinois. The action cited appraisal-related lending misconduct.

De Nederlandsche Bank fined payment institution CCV €2.65 million after 4,200 merchants went unmonitored for transaction activity over a 23-month period.

The Reserve Bank of India (RBI) issued a draft framework on July 15, 2026, requiring banks and NBFCs to build stronger data security and data risk management systems in digital banking. This is supervisory guidance, not an enforcement action with penalties.

On July 15, 2026, Korea's Financial Services Commission (FSC) briefed the President on plans to overhaul bank governance, sanctions processes, and inspections, including pre-emptive inspections and rationalized sanction criteria. This is structural oversight reform rather than a discrete enforcement action.

The PBoC Gansu branch warned and fined Lanzhou Anning Shenzhou Village Bank for violating account management rules and financial technology management regulations.

On July 13, 2026, UK regulators (Bank of England, FCA, and PRA) began formal oversight of critical third parties to the financial sector, including Microsoft, Google, Amazon, and Oracle as designated critical cloud providers.

On July 13, 2026, the UK's Critical Third Parties (CTP) regulatory regime officially went live, bringing four major cloud providers — AWS, Google Cloud, Microsoft, and Oracle — under direct joint oversight by the Bank of England, PRA, and FCA. The regime focuses on operational resilience and systemic risk to the UK financial system.

On Jul 7, 2026, the Federal Reserve proposed a rule requiring Board-supervised banks to maintain risk-based AML/CFT programs under the BSA. The proposal covers 858 institutions and aligns with FinCEN requirements and the Anti-Money Laundering Act of 2020.

The Federal Reserve Board issued an enforcement action against TS Banking Group, Inc. and TS Contrarian Bancshares, Inc. on Jul 9, 2026. The nature of the action was not disclosed in the posting.

The California DFPI took enforcement action against Navitas for unlicensed lending, as listed in the agency's July 2026 monthly bulletin. Details of the penalty were not disclosed in the available source text.

Senator Pete Ricketts introduced S. 4839, the Bank-Fintech Partnership Enhancement Act, which would require the Federal Reserve, OCC, FDIC, and NCUA to study bank and credit union fintech partnerships.

U.S. senators introduced a bill on June 22, 2026 to study fintech deals with banks and credit unions. The legislation signals growing congressional attention on the risks and structures of bank-fintech arrangements.

The OCC tightened application standards with greater transparency on application denials, as part of broader regulatory moves affecting digital finance and embedded banking models in June 2026.

The CFPB adopted new enforcement principles prioritizing actual consumer harm, due process, collaboration with institutions, and efficiency. The framework encourages self-reporting and voluntary remediation over adversarial enforcement actions.

The OCC released its June 2026 batch of enforcement actions on June 18, 2026. The release confirms enforcement actions were taken but specific bank names, fintech partnerships, and detailed violations have not yet been publicly enumerated in available summaries.

A multi-agency proposed rule from FinCEN, the Federal Reserve, OCC, FDIC, and NCUA would align stablecoin issuers with bank-like compliance expectations and address illicit finance risk. The rulemaking targets the growing intersection of banking and digital asset services.