By FintTech Global
Click here to read the entire article
As AI reshapes financial services, compliance is moving beyond interpreting rules and managing controls. The challenge is increasingly one of engineering: translating regulatory obligations into systems that can adapt, act and demonstrate accountability.
Compliance has traditionally relied on people interpreting rules, managing controls and keeping pace with regulatory change. But as financial institutions grow more complex and AI becomes embedded in their operations, the limits of this approach are becoming harder to ignore. The challenge is no longer just understanding what the rules demand, but building the systems and processes to put them into practice consistently.
This is bringing compliance closer to engineering, where controls must be designed, tested and maintained rather than simply documented. For the RegTech industry, the question is whether this shift will fundamentally change how financial institutions build and manage their compliance functions.
In a new four-part RegTech Analyst Series, the focus shifts onto The Architecture of Compliance: Rebuilding RegTech for the AI era. This series examines compliance in the AI age, and what firms need to be paying attention to.
In the first part of a two-part series of part one we speak to key industry thought leaders to gauge their views.
Compliance: becoming a tech function?
Is compliance becoming a technology function? In the view of Areg Nzsdejan, CEO of Cardamon, increasingly, this is true.
“Turning a regulatory obligation into something a business can consistently execute requires structured data, workflows, controls and testing. Those are engineering problems, and compliance teams need to be involved in how they are solved,” he said.
The judgement, in his view, still matters hugely, as someone must decide what an obligation means for the firm and whether the resulting control is appropriate.
He added, “If that interpretation lives in one person’s inbox, every team ends up reconstructing it. Good infrastructure lets the business apply it consistently and revisit it when things change.”
Meanwhile, Zurab Kotaria, CEO of Identomat, sees that compliance is becoming increasingly tech-enabled but wouldn’t say it’s becoming purely a tech function.
“What is changing is the way compliance is delivered,” he said. “As businesses operate across more markets, regulations become more complex, and fraud becomes increasingly sophisticated, manual compliance processes simply cannot provide the speed and scale organisations need.”
Click here to continue reading
By Melina Druga, Financial Regulation News
The Federal Reserve Board recently released the results of the 2025 Survey of Consumer Finances, a representative picture of what Americans own, how and how much they borrow, and how they bank. It provides information on the economic conditions of American families.
The board also issued a summary report, examining changes in income, net worth, assets, debt, and financial vulnerability. When comparing the 2022 and 2025 surveys, most families experienced moderate increases in income and net worth, but an increasing subset of families have been experiencing financial stress.
Key findings include:
- Real median family income rose 7 percent surveys to $82,200 while real mean family income fell 6 percent to $145,200.
- Real median net worth rose by 2 percent to $215,900 while real mean net worth rose by 7 percent to $1.24 million.
- For families that owned a home, the median net housing value rose to $230,000.
- Retirement plan participation was up slightly to 65 percent.
- Participation in the stock market declined slightly from 58 percent in 2022 to 56 percent in 2025.
- The fraction of families with any type of debt remained about stable at 77 percent.
- The fraction of families with debt payment-to-income ratios greater than 40 percent increased from 6.5 to 8.6 percent.
Aaron Passman, CreditUnions.com/Callahan
Ghosts and goblins are one thing. Fraudsters, cybercriminals, and evolving threats are another. Explore how credit unions are strengthening defenses, balancing risk and innovation, and protecting members in a fast-changing landscape.
Spooky season is here, but it’s a little bit different for credit union leaders.
Ghosts, ghouls and goblins? Not scary enough. Credit union cybersecurity and fraud? Now that’ll keep a credit union leader up at night.
In honor of Cybersecurity Awareness Month, this week CreditUnions.com is all about cyber safety, fraud prevention, and more. In the days to come, keep your eyes peeled for:
- How layered defenses help members separate legitimate requests from potentially costly threats.
- A Q&A with the C-level leader whose legal background informs TruWest Credit Union’s approach to innovation, compliance, and cybersecurity.
- Why your credit union needs an “ethical hacker” on staff.
- Plus, test your cybersecurity knowledge with the latest Callahan quiz.
As always, now it’s your turn. How is your shop beefing up credit union cybersecurity? How has the threat landscape changed at your institution? What’s keeping you up at night and how are you responding? Drop us a line, and we might feature your story on CreditUnions.com.
Let’s get to work.
Amy Evans, Velera/CU Insight
Click here to read the entire article
For years, the financial services industry has been focused on building better digital banking experiences. Mobile apps, digital account opening and self-service tools are now table stakes as credit union members expect banking to be fast, convenient and available whenever—and wherever—they need it.
That digital push has raised the bar for convenience, but it hasn’t diminished the value of human connection and personal service. A member may want to handle routine banking from their phone, yet prefer to sit across from someone when making a major financial decision. In fact, 84% of Gen Z and Millennials value brands that create a cohesive experience across digital and physical touchpoints, according to a 2025 study by The Harris Poll and Quad.
Credit unions have an opportunity to create stronger connections between digital and in-person banking. This “phygital” approach brings technology and human interaction together, giving members the convenience of digital tools alongside the expertise and connection of in-person service.
Today’s members no longer think in terms of digital versus physical channels. They simply expect experiences to work seamlessly. Whether they’re opening an account, applying for a loan or seeking financial guidance, they want the flexibility to start in one channel and finish in another without losing momentum or context.
Start with the member’s journey
The starting point for phygital banking should be a clear understanding of the member experience: what members are trying to accomplish and where different forms of interaction add value.
Routine transactions should be simple and convenient, while more complex financial decisions may require a combination of technology and personal guidance. A member researching a new product, applying for a mortgage or navigating a fraud incident may move between self-service tools and employee support depending on the situation.
Members across generations increasingly prefer digital channels for low-stakes activities such as deposits, transfers and account maintenance. However, when an interaction becomes more complex, emotionally significant or uncertain, they want access to a trusted expert who can provide reassurance and guidance.
Journey mapping helps credit unions understand these shifts and identify where members encounter friction, what they need in different scenarios and where technology or human expertise can add the most value. Credit unions should avoid treating digital transformation as simply digitizing existing processes. Many credit unions have learned that automating individual tasks without considering the entire member journey can inadvertently create more friction instead of removing it.
Click here to continue reading.
By Tatiana Walk-Morris, Payments Dive
Click here to read the entire article
Some consumers will turn to buy now, pay later options for holiday shopping to spread costs over time, according to a survey by the digital processor.
Dive Brief:
- More than half (55%) of U.S. consumers have used, or considered using, buy now, pay later payment options in the past, according to results of a PayPal Holdings survey of 2,005 adults released Wednesday.
- Among consumers who’ve used, or considered BNPL payments, three-quarters expect to use these options during their holiday shopping this year, the digital payments provider said. That’s partly because 59% of consumers said they value BNPL payments as a way to stretch and control their holiday budget, the PayPal survey fielded last month found.
- About four in ten (42%) survey respondents said they would be more likely to make a purchase when BNPL options are offered.
- Dive Insight:
- PayPal’s survey results suggest consumers sometimes turn to a BNPL option because it gives them a “feeling” of more control over their budget for holiday spending, the release said.
About six in 10 (58%) of survey respondents said they’re more concerned than last year about finances ahead of this holiday season. Despite that anxiety, 64% of holiday shoppers anticipate spending the same or more than they did in 2025.
“What’s changing isn’t consumers’ desire to spend during the holidays, but how they’re going about it,” PayPal’s president of checkout solutions, Frank Keller, said in the release. “Shoppers are starting earlier and taking a more intentional approach, looking for deals, rewards and cash back to make every purchase count.”
PayPal is among the companies that provides consumers with options to make payments in installments. On that front, it competes with Klarna Group, as well as Affirm Holdings and Block’s Afterpay. BNPL entered the payments market about a decade ago with pitches for free financing, but over time many of the providers have added interest-bearing options to their offerings.
PayPal’s findings show an increased appetite for BNPL payments compared to the 2025 holiday season. Last year, the payment giant found that half of 1,000 U.S. respondents surveyed expected to use BNPL providers to pay for their holiday expenses. Shoppers who planned to use BNPL services did so because they wanted to spread the cost of purchases over time and take advantage of BNPL promotions, the release said.
Click here to continue reading
By Steve Durbin, SecurityWeek
Click here to read the entire article
– AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.
Not unlike the fictional Skynet sending increasingly sophisticated ‘Terminators’ as older versions of the monster failed to achieve their earthly missions, cyberattacks are growing more persistent and automated, further testing an organization’s security maturity. To stay in tune with future risks, it has become imperative to treat resilience as an operational objective in constant flux.
Emerging Threats And Building Resilience
Artificial Intelligence
AI is playing both sides of the fence, arming attackers and defenders alike. AI is automating key kill chain components like reconnaissance and vulnerability scanning, compressing time-to-exploit from days to mere hours. Expect phishing emails to be more contextual and convincing; voice and video deepfakes will be more difficult to distinguish from the real thing, as will synthetic identities (fake profiles) built on real and stolen information. This is hardly a case of fear mongering. In May 2026, scammers used AI-generated deepfakes to concoct a Zoom meeting impersonating Singapore’s prime minister, defrauding a business professional SGD 4.9 million.
Mitigate AI-Driven Attacks: Organizations should take stock of existing security tools and consider mothballing those that cannot keep pace with AI-driven attacks. To state the obvious, AI attacks should be addressed with AI defenses, especially AI-based detection capabilities that catch anomalies early, before the attack fully unfolds. Also strengthen incident management, since some attacks will inevitably get through.
Third Parties and Supply Chains
A typical organization is supported by a web of vendors, cloud providers, and other close partners. A breach in any one of these parties can have a domino effect on operations. Attackers hide behind backdoors in vendor software and exploit unmanaged apps and APIs. This software is already running inside the organization’s own systems, so the backdoor wears a cloak of trust as opposed to being an external intrusion. Unmanaged APIs exploit a similar opening, as a vendor platform already has permission to access systems directly. The fallout of such an intrusion is not restricted to the primary organization alone. It spreads its tentacles across the larger supply network. This is evident from a cyberattack on Australian manufacturer Mackay Sugar. The direct impact was that it shut down two mills and forced 1,300 farms to pause harvesting.
Strengthen Vendor, Supply Chain Oversight: Set-it and-forget-it vendor relationships should yield to transparency demands backed by continuous monitoring. Build a vendor ranking scorecard based on the sensitivity of the data they manage. Prioritize security resources for high-risk vendors with only the most necessary access privileges. Insist on robust security-centric contracts and hard metrics that track third-party risk exposure and supply chain resilience, rather than relying on periodic reviews and updates.
Quantum Computing
Quantum computers capable of breaking widely used public-key encryption such as RSA and ECC are still some years away. But you should be wary of the Harvest Now, Decrypt Later (HNDL) risk with long-lived data such as health records, financial information, and intellectual property. While this is a problem for the future, preparing for this scenario should begin now because post-quantum cryptography (PQC) migration is estimated to take from five to seven years for small enterprises and 12 to 15+ years for large organizations. That’s because the process involves discovering and replacing vulnerable cryptography across applications, infrastructure, hardware, and third-party dependencies rather than simply installing a software update.
Click here to continue reading
By Ben Udell, Financial Brand
Click here to read the entire article
While banks and credit unions debate whether customer or member data can be entered into Microsoft Copilot, ChatGPT, or other GenAI tools, consumers have already done it. They have tools that are more powerful than your bankers’ ability to provide financial advice, or your online or mobile solution’s ability to provide real planning and answers. While you debate what’s next, consumers are already doing it.
In this two-part series, I am going to explore what’s available to consumers right now and what impact this could have on how you provide financial guidance.
In this part, I’ll explore this changing dynamic from the perspective of the consumer. Consumers can connect ChatGPT, through Plaid, to your bank or credit union data. Consumers can now receive detailed account insight with the aid of GenAI.
Next week, in part two, I’ll explore this perspective on the impact to your bank or credit union. Most banks and credit unions are still working through hard internal questions on how to adopt artificial intelligence, what they’re not considering is how they need to meet the evolving needs of consumers, and where they’re losing relevance.
Key takeaway:The conversations around GenAI adoption and usage of private data are vitally important and need to continue. But while you’ve had endless internal conversations, likely with high anxiety about the use of data, consumers have jumped past you and are taking matters into their own hands.
Personal Financial Guidance with GenAI
In May 2026, OpenAI launched a personal finance experience inside ChatGPT. It connects to more than 12,000 banks, credit unions, credit card issuers, brokerages and other financial institutions (FIs) through Plaid. Your institution is very likely on that list, and you were not asked.
It’s simple to make this connection and even easier with the help of GenAI.
Prompt: “Walk me through the steps to connect my bank accounts to ChatGPT.”
You’ll be prompted to connect your accounts through Plaid through a recognizable sign in and approval process. A consumer can create this connection in just a few minutes.
Click here to continue reading
By Frank Diekmann, CU Daily
Click here to read the entire article
The Consumer Financial Protection Bureau is moving forward with a request to revise its credit card data collection program, seeking Office of Management and Budget approval and opening another round of public comments on reporting requirements for card issuers.
In a notice scheduled for publication Sept. 30 in the Federal Register, the CFPB requested revised approval for an existing information collection covering credit card pricing and availability, consumer card agreements and agreements involving colleges and universities.
The notice does not specify which data fields or reporting requirements would change. It identifies the request as a revision of a currently approved collection, rather than announcing final approval or new requirements taking effect.
The bureau estimates the collection would involve 520 respondents and require a combined 987 hours annually.
Three Reporting Components
According to the CFPB filing, the program includes three collections required by the Truth in Lending Act, the Credit Card Accountability Responsibility and Disclosure Act of 2009 and implementing regulations:
- Terms of Credit Card Plans Survey. The bureau must collect pricing and availability data from at least 150 issuers, including the 25 largest credit card issuers and at least 125 additional financial institutions selected by the CFPB.
- Quarterly Consumer Agreement Submissions. Card issuers with 10,000 or more open accounts must submit agreements between issuers and consumers for open-end consumer credit card plans.
- Annual College Agreement Submissions. Issuers must submit college credit card agreements to which they are parties, along with certain additional information about those agreements.
- The collections allow the CFPB to provide Congress and the public with a centralized, searchable repository of card terms and agreements, including information about arrangements between financial institutions and higher education institutions, the bureau said.
Additional Public Comment Period
The notice follows an initial 60-day comment period announced Feb. 6. The new notice provides 30 days after publication for additional comments, which OMB will review as part of its consideration of the request.
Click here to continue reading
By Liz Carey, Financial Regulation News
Legislation introduced by U.S. Sen. Tina Smith to safeguard the availability of terrorism risk insurance coverage passed the full Senate unanimously.
The Terrorism Risk Insurance Program Reauthorization Act of 2026, co-sponsored by U.S. Sens. Dave McCormick (R-PA), Ruben Gallego (D-AZ) and Thom Tillis (R-NC), would extend the Terrorism Risk Insurance Act of 2002 (TRIA), which created a federal reinsurance backstop to stabilize the private market and ensure that commercial policyholders could continue to obtain terrorism risk coverage.
“Without this bill, a potential terrorism event would mean an even greater financial catastrophe for businesses and taxpayers. It’s critical that we keep terrorism risk insurance available and affordable to businesses in Minnesota and across the country,” Smith said. “Extending this law will ensure housing development and major public events like Vikings games can continue. I’m heartened to see it pass with such strong bipartisan support and urge the House to pass this bill.”
After the 9/11 attacks in 2001, many insurance companies began to exclude terrorism risk from commercial insurance policies which left businesses and industries without coverage. That coverage gap threatened to damage the real estate, construction, energy, transportation and related industries. The TRIA created the federal backstop for the insurance and allowed the private market to ensure that commercial policy holders could continue to obtain terrorism risk coverage.
Lawmakers said that given the current threat landscape, allowing a lapse in terrorism coverage would expose policy holders to unnecessary financial risk and uncertainty.
Smith’s legislation would extend TRIA by seven years. The current legislation expires on Dec. 31, 2027.
The Terrorism Risk Insurance Act is also backed by the NFL, Major League Baseball, the National Association of Home Builders, the National Multifamily Housing Council, the American Council of Engineering Companies, and others.
Gabrielle Saulsbery, Banking Dive
Click here to read the entire article
Bastion Platforms Trust Co., Agora National Trust Bank, and Catena Trust Bank applied for charters in March, April, and May, respectively.
The Office of the Comptroller of the Currency conditionally approved three national trust charters Friday, including de novos Agora National Trust Bank and Catena Trust Bank, along with Bastion Platforms Trust Co., which sought to convert its state charter to a national license.
The three conditional trust banks-in-organization have been waiting to hear back from the regulator since they submitted their applications in April, May and March, respectively. They join nearly a dozen firms that have nabbed a conditional national trust charter – which allow entities to manage assets and act as fiduciaries, but not to take demand deposits or make loans – since late last year.
Bastion white-labels stablecoins for other firms, as well as oversees custody of reserves and customer wallets. Agora is the issuer of AUSD, a stablecoin first issued in August 2024.
Catena Labs, for its part, is developing financial infrastructure for AI agents, creating what founder Sean Neville has called an “AI-native bank” – something of which stablecoins, he said, would play a big part in the growth story.
Bastion founder Nassim Eddequiouaq wrote in a LinkedIn post Friday that, when he started the company, he expected stablecoins to eventually become core financial infrastructure.
“But for the world’s largest enterprises and financial institutions to adopt them, that infrastructure would need to meet the regulatory standards they already expect from their banks,” Eddequiouaq wrote.
“Stablecoins are moving into the financial mainstream, but institutional adoption depends on infrastructure that can meet an institutional standard,” he wrote. “We made the decision early to build Bastion for that standard. Today is an important validation of that decision, and we’re just getting started.”
Spokespeople from Catena and Agora did not immediately respond to requests for comment on their own conditional approvals.
Full approvals are subject to the satisfaction of conditions set forth by the OCC.
Bastion must maintain a minimum of $6 million in tier 1 capital. At least $3 million or 50% of its tier 1 capital (whichever is greater) must be held in eligible liquid assets for its first three years of operation, according to the OCC.
Click here to continue reading
By Stefan Dasic, Malware Bytes
Click here to read the entire article
Phishing follows whatever people want at the moment, and right now that includes AI subscriptions they don’t have to pay for. We recently uncovered a new variation on this theme: A fake Claude Max giveaway that uses a convincing Google sign-in window to steal login information.
Claude’s paid plans start at $20 a month and cost considerably more for higher usage limits, while free accounts have stricter limits. That makes the promise of a free upgrade an attractive lure.
Microsoft reported in June that it had seen a growing number of phishing, malicious advertising, and search-based campaigns impersonating services such as ChatGPT, Claude, DeepSeek and Copilot. Some claim that a payment has failed and send you to a fake checkout. Others offer an app download that installs malware.
The campaign we found takes a different approach. There is no form to collect card details and no download. Instead, it offers a free upgrade and asks you to sign in with your Google account.
What the page shows you and what it collects
The site announces that Anthropic has passed 100 million users and is thanking people by giving away 10,000 free one-month subscriptions to Claude Max, its highest-usage plan.
The presentation is careful, down to the real logo and colors, invented five-star reviews, and a long footer whose links lead almost entirely to genuine Anthropic pages. This is probably the most effective trust signal on the site, and it cost the operator nothing.
A counter claims that fewer than 750 of the 10,000 slots remain, dropping by a few every several seconds. Nothing is actually being counted. The number is generated inside your browser and resets when you reload the page, so every visitor sees the same manufactured shortage.
The frequently asked questions repeatedly promise that no payment details are needed. That part is true, which helps make the offer persuasive. Many people associate scams with requests for card details, and this page never asks for them.
What it wants instead is your Google login. Two sign-in options appear, but only one works. The Apple button produces a pre-written notice saying that the method is temporarily unavailable. The email box discards whatever you type into it and triggers the Google button instead. Every route leads to the same place, and the prize is far bigger than the lure suggests.
A Google account can provide access to email, documents, and the password-reset messages for other accounts. If you use Google to sign in to Claude, it could also give the criminals a route into your Claude account. Paid AI accounts are valuable in their own right because their usage allowances cost money. Last month, our research covered infostealers hijacking Claude accounts and using the victims’ paid allowances.
Click here to continue reading
By Tom Nawrocki, Payments Journal
Click here to read the entire article
For an industry that operates across 50 states, navigating prepaid regulation can feel like navigating 50 different rulebooks. With most regulatory action happening at the state rather than federal level, retailers and card manufacturers must keep up with a growing number of requirements—and ensure their products comply with the states with the strictest rules.
Javelin Strategy & Research’s 2026 Prepaid Regulatory Update: States Focus on Fraud and Cash-Outs report examines the legislative changes that affected the industry over the past year and what may be ahead as more states step up efforts to regulate the gift card industry.
“It’s really critical that those people who are interested in what’s happening on a regulatory basis understand it state by state,” said Jordan Hirschfield, Director of Prepaid at Javelin Strategy & Research and co-author of the report.
Two Paths Toward Fighting Fraud
A number of states are working to enhance fraud protection, but they are taking different approaches. Some are targeting the perpetrators, while others are focusing on the products themselves, requiring packaging designed to prevent bad actors from tampering with cards.
The Retail Gift Card Association favors measures that target perpetrators, viewing them as a way to punish the crime rather than impose costs on businesses to prevent it.
“The technology behind how to make a card secure is technically difficult,” said Hirschfield. “Getting the supply chain set up so that not just the card itself but the software that goes behind that card and the packaging that goes on top of the card, all conform to a certain state’s rules can be difficult and costly. At what point are you taking the benefit away from the consumer to try and prevent a crime instead of punishing the crime itself?”
Changes to State Laws
Maryland has led the way on regulations governing anti-fraud packaging and continues to have some of the most stringent requirements. Other states, however, have followed suit.
“New York is proposing to conceal all numbers on the card,” said John Vogl, Analyst and Content Specialist at Javelin, and co-author of the report. “This becomes a de facto national law just because New York is so big that all the issuers and designers would have to follow New York’s rules nationwide.”
If New York’s law passes, manufacturers would have just 180 days before it takes effect, leaving limited time to adapt. Either way, the potential changes create challenges not only for retailers sponsoring gift card programs, but also for card and packaging manufacturers. Multiple parties across the supply chain would be affected.
Meanwhile, California is raising its cashback limit to $15, meaning gift cards with balances of $15 or less can be redeemed for cash.
“This opens up the opportunity for more theft and fraud because if someone can compile enough cards with close to $15 on them, they stand to receive a decent amount of money,” said Hirschfield. “Five is a more common number—it’s hard to spend less than $5 in a lot of places, so being able to cash out the remaining balance is good customer service, regardless of if it was a rule. Once you get beyond $10 you might be inviting bad actors to participate. It also means you need more cash on hand, which might put your staff at risk.”
As a result, retailers operating in California need policies for that state that differ from those used at other locations. For national retailers, that could mean different employee training programs, applications, and even requirements for how much cash each store needs to keep on hand.
Opportunities in Gambling
While much of the regulatory activity is focused on gift cards and fraud prevention, regulation is also creating new opportunities for prepaid in other areas. One of those is gambling, where prepaid products are becoming an increasingly relevant way for consumers to fund betting accounts.
The number of states approving sports wagering appears to have plateaued, and the amount of money wagered has declined in authorized markets, partly as consumers turn to newer, less regulated platforms such as Kalshi and Polymarket.