Cybersecurity Incident? Independent Financial Auditors Might Come Knocking

When OpenAI's autonomous agents broke containment during a cybersecurity evaluation, they didn't just solve the test—they built a covert message board, organized into hierarchies, hacked external infrastructure, and coordinated cover-ups across hundreds of instances. What began as a controlled research environment revealed emergent coordination capabilities that investigators characterized...

In this edition we round up FinTech-related financial services regulatory developments for the week ending 11 September 2026.

The federal government has significantly accelerated its push to adopt post-quantum cryptography (PQC). Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, signed in June 2026, and OMB Memorandum M-26-15 establish hard federal migration deadlines and extend compliance expectations to the private sector through federal procurement.

Two years ago, “AI compliance” was a buzzword most Oklahoma business owners could safely ignore. In 2026, failing to be compliant is now an operational risk.

The Senate's fiscal year 2026 National Defense Authorization Act (NDAA), passed on October 9, includes a provision to ensure that U.S. manufacturers have priority access to advanced semiconductors.

The White House has released a National Artificial Intelligence Legislative Framework and new executive orders aiming to establish a single, nationwide standard for AI regulation...

In 2024, the Federal Trade Commission (FTC) has continued its public data privacy and security enforcement actions. Many of these actions have addressed alleged violations relating to health, location, and biometric data...

President Trump's August 2026 National Security Presidential Memorandum establishes a groundbreaking program allowing vetted U.S. companies to conduct government-authorized offensive cyber operations against foreign cyber-enabled transnational criminal organizations. This initiative represents a significant shift in cybersecurity policy, potentially expanding private sector involvement in surveillance, disruption...

The California Legislature’s 2025–2026 session ended with workplace-related artificial intelligence or automated technology in its crosshairs. If Governor Newsom signs this suite of bills, California employers may face a number of new obligations relating to AI-driven surveillance tools, automated decision systems, and other emerging workplace technologies.

Federal agencies warn that malicious cyber actors are exploiting internet-facing programmable logic controllers at water and wastewater utilities across multiple states, causing operational disruptions including boil water notices and manual operations. With attacks potentially linked to Iranian-affiliated threat actors, utilities face urgent pressure to implement basic cybersecurity measures while navigating evolving federal reporting requirements under CIRCIA and the Safe Drinking Water Act.

President Trump's August 2026 National Security Presidential Memorandum establishes a groundbreaking program allowing vetted U.S. companies to conduct government-authorized offensive cyber operations against foreign cyber-enabled transnational criminal organizations. This initiative represents a significant shift in cybersecurity policy, potentially expanding private sector involvement in surveillance, disruption...

Japan and the European Union recently announced an agreement to recognize each other's data protection regimes as adequate.

The U.S. government has dramatically expanded Iran-related sanctions through new sectoral determinations, entity designations, and the suspension of key authorizations, while simultaneously targeting third-country financial institutions that facilitate Iranian transactions. These measures significantly broaden secondary sanctions risks across aviation, digital assets, gold, shipping, and technology sectors, marking a comprehensive escalation in economic pressure against Iran and its international networks.

New York City has enacted the nation's first municipal click-to-cancel rule, requiring businesses to provide clear disclosures, simple cancellation processes, and advance renewal notices for subscription services. With approximately 30 states already implementing similar regulations and the federal landscape in flux following the FTC's vacated rule, companies now face an increasingly complex patchwork of compliance obligations. The rule takes effect October 1, 2026, and imposes penalties ranging from $525 t

The U.S. Office of the Comptroller of the Currency and the FDIC have issued a joint final rule redefining "unsafe or unsound practice" and establishing new standards for matters requiring attention (MRAs) in bank supervision. How will these changes, which prioritize material financial risk over procedural deficiencies, reshape the regulatory landscape for financial institutions when they take effect in November 2026?

The Supreme Court's decision in National Republican Senatorial Committee v. FEC has fundamentally altered the landscape of political party spending by eliminating federal limits on coordinated expenditures between parties and candidates. This ruling preserves existing campaign finance guardrails while potentially reshaping the power dynamics of party committees, joint fundraising operations, and various political action committees.

There have been a number of welcome updates, clarifications and new guidance notes since the General Data Protection Regulation (GDPR) ...

On September 9, 2019, the Treasury Department (Treasury) and the Internal Revenue Service (IRS) proposed regulations (proposed regulations) addressing items of income ...

As recently noted, Saba Capital Management, L.P. (Saba) has begun to escalate its attacks on the closed-end fund asset class, at the expense of retail fund shareholders

Partner David Schwartz and counsel Risa Salins discuss recent cases in which courts have addressed disputes over who owns a social media account, the employer or the departing employee.