Regulatory reporting and risk in financial services, week ending 16 October 2026

Week ending 16 October 2026 · 22 sources

US supervisors fine three banks over AML as debanking review lands

The OCC imposed a $750 million penalty on Bank of America and a $350m penalty on American Express National Bank, then released findings on debanking at the nine largest national banks 123. New Zealand regulators set out expectations on frontier AI cyber risk 4.

Which way the market is moving

US AML penalties land on large institutions

The OCC fined Bank of America $750 million and American Express National Bank $350m, and NYDFS reached a $33m settlement with SEB, all over AML failings 125.

The OCC imposed a $750 million civil money penalty on Bank of America, N.A. for violations of the Bank Secrecy Act and its implementing regulations 1. Days earlier it issued a $350m civil money penalty against American Express National Bank for deficiencies in its anti-money laundering programme 2.

In New York, the Department of Financial Services announced that Skandinaviska Enskilda Banken AB and its New York branch agreed to pay $33m over AML failures 5. Reuters reported that Citi is seeking a rapid resolution of its US regulatory burdens 9.

What it means: Supervisors are pricing AML control weaknesses at large and foreign institutions alike, so boards will want evidence that remediation findings are tracked to closure. Institutions with US operations should expect examiners to test whether issues raised earlier were fixed.

Questions for vendors:

  1. How does your platform link AML findings, remediation actions and evidence of closure in one audit trail?
  2. Can you show how a regulator's finding is mapped to the affected obligations, controls and owners?
  3. What reporting do you give boards on overdue remediation items and repeat findings?

In the registry: Arc Suite (DFIN), Compliance management (Protecht), Internal audit (Ideagen)

Debanking becomes a supervisory review topic

The OCC released findings from its supervisory review of debanking at the nine largest national banks it supervises 3.

The OCC released a report of findings from its supervisory review of debanking activities at the nine largest national banks it supervises, a group that includes JPMorgan Chase Bank 3. Axios reported that the regulator said big banks rejected customers over politics 6.

The report came a day after the same regulator announced its $750 million penalty against Bank of America for Bank Secrecy Act violations 13. Banks are being examined both on how they control financial crime risk and on how they decide to refuse or exit customers 31.

What it means: Customer exit decisions need documented, policy-based reasons that can be shown to a supervisor. Institutions should be able to evidence why an account was closed without relying on informal judgement.

Questions for vendors:

  1. Can your system record the policy basis and approver for each customer exit or refusal decision?
  2. How would we report exit decisions by reason to the board or a supervisor?
  3. How are policy changes on customer acceptance versioned and attested?

In the registry: Comply for RIA (Comply), Arc Suite (DFIN), Third-Party Risk Management (Corporater)

Reporting adjusts to IFRS 18 and new data releases

ECB Banking Supervision will let institutions report profit and loss under IAS 1 or IFRS 18, while APRA released new statistical publications 81011.

ECB Banking Supervision said institutions will have the option to report profit and loss under IAS 1 or IFRS 18 in regulatory reporting 8. The option covers the profit and loss view that supervisors receive from banks 8.

In Australia, APRA published its life insurance claims and disputes statistics on 16 October and its annual authorised deposit-taking institutions' points of presence statistics on 14 October 1011. It also published its annual reports archive, prepared under the Public Governance, Performance and Accountability Act 2013 12.

What it means: Institutions with European reporting obligations will need reporting tools that can carry two accounting presentations during transition. APRA's published statistics are built from regulated entity returns, so data quality in those returns shows up in public numbers.

Questions for vendors:

  1. Can your reporting engine produce profit and loss under both IAS 1 and IFRS 18 from the same ledger data?
  2. How do you manage template changes when a regulator offers a choice of standards?
  3. What validation do you run before APRA returns are lodged?

In the registry: APRA reporting (SolveXia), Compliance management (Protecht), Operational Risk Management (Noggin)

AI and cyber risk expectations sharpen

The RBNZ and FMA set out supervisory expectations on cyber risks from frontier AI, and AML buyers are weighing AI model provenance 47.

The Reserve Bank of New Zealand and the Financial Markets Authority outlined their supervisory expectations on cyber risks associated with frontier artificial intelligence 4. In financial crime compliance, Napier AI said institutions are now weighing where a model was trained, who built it and what data it learned from 7.

In Australia, iTnews reported that ASIC's security and data chiefs will leave in December and that the regulator wants a CISO, a CDAO and a contract CTO 13. FinTech Global argued that RegTech's AI advantage depends on data rather than summaries 14.

What it means: AI used in risk and compliance tools is becoming a third-party and operational risk question in its own right. Institutions should be ready to explain model origin, data use and cyber controls for AI they buy.

Questions for vendors:

  1. Where was your AI model trained, who built it and what data did it learn from?
  2. What controls address cyber risks from frontier AI in your product?
  3. Can we audit the data behind an AI-generated alert or summary?

In the registry: Internal audit (Ideagen), Comply for RIA (Comply), Third-Party Risk Management (Corporater)

Regulatory intelligence draws investment

RegTech deal funding was strong in the third quarter, and regulatory intelligence is being framed as core infrastructure 1516.

FinTech Global reported that strong September funding drove a strong third quarter for RegTech deals 15. Its coverage also framed regulatory intelligence as becoming vital infrastructure and asked whether compliance is becoming an engineering discipline 1617.

In India, NISM and CAMS are collaborating to provide a regulatory intelligence platform at a compliance lab 18. FinTech Global also asked whether cloud concentration has become a RegTech problem, which ties RegTech choices to third-party risk 19.

What it means: Funding and attention are moving to tools that track regulatory change, which widens buyer choice. Concentration on a few cloud providers means RegTech purchases belong inside third-party risk assessments.

Questions for vendors:

  1. Which cloud providers host your service and what is your exit plan if one fails?
  2. How quickly do regulatory updates reach our obligations register, and who verifies them?
  3. How is your funding position and ownership likely to change over the next two years?

In the registry: Compliance management (Protecht), Comply for RIA (Comply), Arc Suite (DFIN)

Regulation and supervision

Sources

  1. Office of the Comptroller of the Currency, 2026-10-13: OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance
  2. Finextra (security), 2026-10-09: Amex hit with $350m penalty for AML deficiencies
  3. Office of the Comptroller of the Currency, 2026-10-14: OCC Releases Report on Large Banks’ Debanking Activities
  4. Finextra (security), 2026-10-15: New Zealand regulators set out cyber and AI risk expectations
  5. Finextra, 2026-10-15: SEB pays $33m to NYDFS over AML failures
  6. Axios, 2026-10-15: Top regulator says big banks rejected customers over politics
  7. FinTech Global, 2026-10-15: Sovereign AI vs shared intelligence: AML’s new dilemma
  8. ECB Banking Supervision, 2026-10-15: Regulatory reporting on profit and loss: institutions will have option to report under IAS 1 or IFRS 18
  9. Reuters, 2026-10-12: Focus: Citi seeks rapid resolution of its US regulatory burdens
  10. APRA, 2026-10-15: Life insurance claims and disputes statistics
  11. APRA, 2026-10-13: Authorised deposit-taking institutions' points of presence statistics
  12. APRA, 2026-10-13: APRA Annual Reports archive
  13. iTnews, 2026-10-15: ASIC's security and data chiefs to leave in December
  14. FinTech Global, 2026-10-15: Why RegTech’s AI edge depends on data, not summaries
  15. FinTech Global, 2026-10-09: Powerful September funding drives strong third quarter for RegTech deals
  16. FinTech Global, 2026-10-14: Why regulatory intelligence is now becoming vital infrastructure – FinCrime Tech Awards 2026
  17. FinTech Global, 2026-10-13: Is compliance becoming an engineering discipline?
  18. CNBC TV18, 2026-10-15: NISM, CAMS collaborate to provide regulatory intelligence platform at compliance lab
  19. FinTech Global, 2026-10-09: Has cloud concentration become a RegTech problem?
  20. SEC, 2026-10-14: SEC Small Business Advisory Committee to Discuss IPO Modernization and Regulation Crowdfunding
  21. AFR, 2026-10-15: APRA reveals a whistleblower’s identity in TV comedy case study
  22. ifa, 2026-10-15: FAAA backs APRA keeping professional and intra-fund advice separate

About regulatory reporting and risk software

Regtech and risk software prepares regulatory returns and manages risk and compliance: reporting, governance, operational risk and controls.

Browse the products in the registry

Get the market overview every Monday: subscribe to the Vederca newsletter.