Regulatory reporting and risk in financial services this week

Week ending 19 October 2026 · 25 sources

US supervisors press large banks on AML failings and debanking

The OCC imposed a $750 million civil money penalty on Bank of America and released findings on debanking at the nine largest national banks it supervises 12. The ECB will let institutions report profit and loss under IAS 1 or IFRS 18 3.

Which way the market is moving

US enforcement on AML and debanking

The OCC fined Bank of America $750 million over Bank Secrecy Act compliance and faulted large lenders over debanking 14.

The OCC announced a $750 million civil money penalty against Bank of America, N.A. for violations of the Bank Secrecy Act and its implementing regulations 1. Market coverage referred to a $1.2b penalty in total 9. Reuters reported Citi is seeking a rapid resolution of its US regulatory burdens 10, and the Financial Post reported TD and BMO are in the crosshairs of a US regulator 11.

Separately, the OCC released findings from its supervisory review of debanking at the nine largest national banks it supervises 2. Reuters reported the regulator faulted several large lenders over debanking practices 4. Axios reported the regulator said big banks rejected customers over politics 12.

What it means: AML control failures still draw large penalties, and customer exit decisions are now a supervisory topic. Institutions should be able to show documented, consistent grounds for closing accounts and evidence that financial crime controls operate as designed.

Questions for vendors:

  1. How does your platform record the rationale, approvals and policy basis behind each customer exit decision?
  2. Can you map Bank Secrecy Act or AML obligations to controls and test evidence an examiner can review?
  3. How do you track remediation actions from an enforcement order through to closure and board reporting?

In the registry: Arc Suite (DFIN), Compliance management (Protecht), Third-Party Risk Management (Corporater)

IFRS 18 option and the cost of compliance sprawl

The ECB will let institutions report profit and loss under IAS 1 or IFRS 18, as research shows compliance budgets absorbed by fragmented systems 38.

ECB Banking Supervision said institutions will have the option to report profit and loss under either IAS 1 or IFRS 18 in their regulatory reporting 3. The choice applies to the profit and loss reporting that supervised institutions submit 3.

Reporting change leans on clean data and joined-up systems. MCO research found financial services firms juggle nearly 14 compliance systems, and that much of their rising compliance investment is being absorbed by fragmented technology 8. FinTech Global commentary argued that RegTech's AI advantage depends on data, not summaries 13. It also described regulatory intelligence as becoming vital infrastructure 14.

What it means: Any institution facing a change in accounting presentation will need reporting systems that can run both bases and reconcile them. Consolidating overlapping compliance tools may free budget for that work.

Questions for vendors:

  1. Can your reporting engine produce profit and loss under both IAS 1 and IFRS 18 from the same data, with reconciliation?
  2. Which of our existing compliance systems could your platform replace, and how would data migrate?
  3. How do you trace a reported figure back to its source data and transformation rules?

In the registry: Compliance management (Protecht), Arc Suite (DFIN), APRA reporting (SolveXia)

Supervisors turn to AI risk and control evidence

New Zealand regulators set out expectations on frontier AI cyber risk, while compliance commentary stresses provenance and controls that work 76.

The RBNZ and the FMA outlined their supervisory expectations on cyber risks associated with frontier AI 7. The CUBE Read, covering 22 September to 2 October 2026, said compliance and risk teams can no longer rely on simply knowing that a rule exists, with AI provenance and second-layer risk reshaping compliance 6.

FinTech Global commentary said that as institutions adopt AI, pressure on compliance teams is shifting from interpreting regulation to ensuring it works in practice 5. Deutsche Bank implemented an on-premise AI platform across its capital markets and investment banking teams in Europe and North America 15.

What it means: Institutions using AI, including through vendors, should expect supervisors to ask for evidence of where model outputs come from and how cyber and control risks are managed. This sits within operational risk and third-party oversight, not only technology governance.

Questions for vendors:

  1. How does your product record the provenance of AI-generated outputs used in compliance or risk decisions?
  2. What controls and testing evidence can you provide on cyber risks from the AI models in your service?
  3. Where is our data processed when your AI features run, and can they run in our own environment?

In the registry: Internal audit (Ideagen), Comply for RIA (Comply), Arc Suite (DFIN)

APRA puts super fund sustainability in focus

The AFR reported APRA found one million Australians are in 'unsustainable' super funds 16.

The AFR reported APRA found one million Australians are in 'unsustainable' super funds 16. The FAAA backed APRA keeping professional and intra-fund advice separate 17. The AFR also reported that APRA revealed a whistleblower's identity in a TV comedy case study 18.

APRA published its annual authorised deposit-taking institution points of presence statistics on 14 October 19 and its life insurance claims and disputes statistics on 16 October 20. At ASIC, the security and data chiefs will leave in December, and the regulator wants a CISO, a CDAO and a 'contract CTO' 21.

What it means: Superannuation trustees should expect continued APRA attention on fund sustainability and the evidence behind it. All APRA-regulated entities should check that whistleblower and confidential data handling holds up when information reaches regulators.

Questions for vendors:

  1. How does your platform support trustees in reporting sustainability and member outcome metrics to the board and APRA?
  2. What controls protect the identity of whistleblowers in your case management workflow?

In the registry: APRA reporting (SolveXia), Third-Party Risk Management (Corporater), Internal audit (Ideagen)

US bills target thresholds and probe disclosure

The ABA backed a bill to update asset-based thresholds, while a Warren bill would push regulators to disclose bank probes 2223.

The ABA backed the TIER Act, which it said would modernise outdated asset-based thresholds for midsize and regional banks, increase transparency and reduce arbitrary burdens 22. The ABA said the bill would help regulators focus on actual risk 22.

A bill proposed by Senator Elizabeth Warren would push regulators to disclose bank probes, and bank executives could face industry bans, fines and criminal referrals under it 23. The SEC's Small Business Capital Formation Advisory Committee will meet on 27 October 2026 to continue discussing IPO modernisation 24.

What it means: US threshold changes could shift which rules apply to midsize and regional banks, so obligation registers need to handle threshold-driven applicability. Greater disclosure of probes would raise the reputational stakes of open supervisory matters.

Questions for vendors:

  1. Can your obligations register apply or retire requirements automatically when asset thresholds change?
  2. How do you track open supervisory findings and their status for executive and board reporting?

In the registry: Compliance management (Protecht), Arc Suite (DFIN), Regulatory Compliance Registers (LexisNexis Risk Solutions)

Regulation and supervision

Sources

  1. Office of the Comptroller of the Currency, 2026-10-13: OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance
  2. Office of the Comptroller of the Currency, 2026-10-14: OCC Releases Report on Large Banks’ Debanking Activities
  3. ECB Banking Supervision, 2026-10-15: Regulatory reporting on profit and loss: institutions will have option to report under IAS 1 or IFRS 18
  4. Reuters, 2026-10-14: US bank regulator faults several large lenders over debanking practices
  5. FinTech Global, 2026-10-16: Is compliance entering its engineering era?
  6. FinTech Global, 2026-10-16: CUBE: AI provenance and second-layer risk reshape compliance
  7. Finextra (security), 2026-10-15: New Zealand regulators set out cyber and AI risk expectations
  8. FinTech Global, 2026-10-16: Compliance sprawl: firms juggle nearly 14 systems, MCO finds
  9. Yahoo Finance, 2026-10-14: 3 RegTech Stocks Investors May Be Watching After Bank Of America’s $1.2b Penalty
  10. Reuters, 2026-10-12: Focus: Citi seeks rapid resolution of its US regulatory burdens
  11. Financial Post, 2026-10-16: TD and BMO are in the crosshairs of a U.S. regulator. Here's why
  12. Axios, 2026-10-15: Top regulator says big banks rejected customers over politics
  13. FinTech Global, 2026-10-15: Why RegTech’s AI edge depends on data, not summaries
  14. FinTech Global, 2026-10-14: Why regulatory intelligence is now becoming vital infrastructure – FinCrime Tech Awards 2026
  15. Finextra, 2026-10-16: Deutsche Bank rolls out on-premise AI system
  16. AFR, 2026-10-18: One million Australians in ‘unsustainable’ super funds: APRA
  17. ifa, 2026-10-15: FAAA backs APRA keeping professional and intra-fund advice separate
  18. AFR, 2026-10-15: APRA reveals a whistleblower’s identity in TV comedy case study
  19. APRA, 2026-10-13: Authorised deposit-taking institutions' points of presence statistics
  20. APRA, 2026-10-15: Life insurance claims and disputes statistics
  21. iTnews, 2026-10-15: ASIC's security and data chiefs to leave in December
  22. ABA Banking Journal, 2026-10-16: ABA supports bill to update regulatory thresholds
  23. Banking Dive, 2026-10-16: Epstein bill would push regulators to disclose bank probes
  24. SEC, 2026-10-14: SEC Small Business Advisory Committee to Discuss IPO Modernization and Regulation Crowdfunding
  25. CNBC TV18, 2026-10-15: NISM, CAMS collaborate to provide regulatory intelligence platform at compliance lab

About regulatory reporting and risk software

Regtech and risk software prepares regulatory returns and manages risk and compliance: reporting, governance, operational risk and controls.

Browse the products in the registry

Previous weeks

Get the market overview every Monday: subscribe to the Vederca newsletter.