Fintech · Industry brief

On August 20, 2026, the Federal Reserve Board issued an enforcement action with SouthPoint Bancshares, Inc. and announced termination of an enforcement action with Deutsche Bank AG, DB USA Corporation, and Deutsche Bank AG New York Branch. Additionally, the Federal Reserve issued enforcement actions against former employees of Regions Bank and United Community Bank on the same date, with a separate enforcement action against a former Regions Bank employee issued on August 13, 2026 (Source: Federal Reserve Board press releases).

FTC settled with Doxo, Inc. for $2.1 million on August 17, 2026 for deceptive bill-payment advertising, undisclosed delivery fees, and unauthorized recurring subscription enrollment (FTC settlement). DOJ secured a guilty plea from Thomas Emil Eide on August 21, 2026 for bank fraud conspiracy involving fake companies and straw owners used to obtain merchant payment-processing accounts that would otherwise be denied (DOJ guilty plea). The Federal Reserve and Alabama State Banking Department entered a Written Agreement with SouthPoint Bancshares on August 14, 2026 requiring improved capital planning, liquidity governance, and source-of-strength remediation, with restrictions on dividends and capital distributions pending supervisory approval (Federal Reserve / Alabama State Banking Department Written Agreement).

In August 2026, the California Department of Financial Protection and Innovation (DFPI) entered into an $825,000 consent order with Academy Mortgage Corporation resolving a March 2023 ransomware attack affecting 284,443 people. DFPI's enforcement action emphasized cybersecurity documentation deficiencies as substantive violations, citing inadequate risk assessments, absence of formal security audits between 2017 and 2023, deficient vulnerability management, and lack of comprehensive asset inventory. The regulator treated recordkeeping gaps—including missing incident response plans, inadequate audit-finding documentation, and insufficient forensic reporting—as violations of the California Residential Mortgage Lending Act, the Gramm-Leach-Bliley Act, and the Safeguards Rule, signaling that regulators view governance and documentation gaps alongside technical controls as material compliance failures warranting penalties.

UK fintech investment collapsed to £1.8bn in H1 2026, the lowest since 2016, down two-thirds from £5.0bn in H1 2025, according to KPMG's Pulse of Fintech report. Deal count fell to a decade low with 205 UK fintech M&A, PE, and VC transactions completed, down from 281 year-on-year, though the UK retained its European top spot. Ebury secured the largest deal at £543m PE investment, followed by Paymentology's £129m and 9fin's £124m fundraising. AI-related fintech investment bucked the trend, growing to £445m across 79 deals (25% of total UK investment) from £382m across 67 deals in H1 2025, with the UK leading Europe. Cybersecurity fintech funding surged to £90m across seven deals from £0.04m in H1 2025, rising from fourth to first position in Europe. Globally, fintech M&A activity strengthened to £49.9bn across 394 deals in H1 2026 from £27.3bn in H2 2025, with payments attracting £32.5bn and AI-focused fintechs drawing £15.7bn across all transaction types.