Fintech · Industry brief

On September 17, 2026, the Federal Deposit Insurance Corporation issued a proposed rulemaking to modernize its bank merger review framework under the Bank Merger Act, aimed at reducing processing timelines and increasing predictability. The Proposal creates three processing tracks: de minimis transactions eligible for rapid five-day processing with deemed approval, expedited processing for corporate reorganizations and eligible depository institutions (30-45 days), and standard processing of 90-150 days depending on resulting institution size. Key changes include streamlined filing requirements, narrowed circumstances for removing filings from expedited processing, and a new notice-and-non-objection framework for significant asset transfers representing at least 25% increases in institutional assets. The Proposal substantially revises evaluation of statutory merger factors, particularly competition analysis. It would treat bank, thrift, and credit union deposits equally in Herfindahl-Hirschman Index calculations, allocate "centrally booked deposits" (including fintech deposits) across geographic markets based on population to account for nationwide digital banking, and establish an express competitive safe harbor at 1,800 HHI or 200-point increases. A new financial stability safe harbor would apply to transactions not involving systemically important institutions or targets under $20 billion. For transactions exceeding $50 billion in assets, the FDIC would add "fair banking" review to address discriminatory debanking practices. The Proposal also indexes dollar-based thresholds biennially to inflation. Comments are due November 23, 2026, per the Federal Register notice published September 22, 2026.

The U.S. Court of Appeals for the Second Circuit ruled in East Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Insurance Co. that the No Surprises Act does not create a private right of action allowing out-of-network providers to sue health plans over unpaid independent dispute resolution (IDR) awards. The court found that Congress designed a comprehensive administrative enforcement scheme delegating NSA enforcement to the Department of Labor, Treasury, and HHS rather than private litigants, and that Congress notably did not incorporate the FAA's provision for confirming arbitration awards into the NSA—a deliberate omission suggesting no intent for private enforcement. This Second Circuit decision joins the Fifth Circuit's June 2025 ruling in Guardian Flight, establishing binding authority in two federal circuits that providers must rely on administrative agency enforcement rather than federal court litigation to collect unpaid IDR determinations. (Source: Court of Appeals for the Second Circuit, case docket East Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Insurance Co.; Consumer Financial Services Law Monitor)

Revolut and Nubank, the world's two most-valued digital banks, obtained conditional approval for U.S. banking charters this year, with Brazil-based Nubank officially launching its U.S. offering in September 2026. Both companies are capitalizing on what analysts describe as an "unusually lax regulatory window" in the U.S., though they face significant challenges in a highly competitive market governed by multiple regulations and dominated by established competitors. United Kingdom-based Revolut, valued at $115 billion and planning an IPO in 2028, needs to justify its valuation through American success, while other foreign fintech entrants like Monzo have exited the U.S. market to focus on their home regions.

The FDIC and OCC finalized a joint rule defining "unsafe or unsound" banking practices, effective November 2, 2026, that requires enforcement actions and supervisory criticism to be based on material harm to a bank's financial condition or the Deposit Insurance Fund, rather than technical compliance issues or reputational concerns. The rule narrows the materiality standard for enforcement and for Matters Requiring Attention (MRAs) issued by examiners, with tailoring requirements calibrated to each institution's risk profile, capital structure, complexity, and asset size. However, the rule does not protect individual bank employees, directors, and other institution-affiliated parties (IAPs), who may still face personal enforcement actions for safety-and-soundness violations even if they do not constitute material institutional harm, and the rule does not limit enforcement actions based on violations of banking-related laws separate from safety-and-soundness standards.