Fintech · Industry brief

On August 5, NYDFS settled a $250,000 cybersecurity enforcement action against a licensed money transmitter for violations of New York's cybersecurity regulation 23 NYCRR Part 500. The investigation, triggered by a September 2022 ransomware attack that encrypted over half the company's servers, found the firm failed to conduct adequate risk assessments, design a sufficient cybersecurity program, and maintain written policies for systems, network security, and patching of third-party applications. NYDFS noted the company's annual risk assessment overlooked cybersecurity-specific risks and threats, and its patching policies covered only a limited number of third-party software products, exposing it to known vulnerabilities. The penalty considered the company's cooperation, size, limited revenue, and remediation of deficiencies.

On July 31, the U.S. Court of Appeals for the 10th Circuit affirmed dismissal of a retail brokerage firm's Administrative Procedure Act challenge to the SEC's authority to enforce Bank Secrecy Act suspicious activity report requirements against broker-dealers through Exchange Act Rule 17a-8. The court held that the SEC's filing of an enforcement complaint did not constitute final agency action reviewable under the APA, finding that the complaint did not determine rights or obligations or produce legal consequences sufficient to meet the standard established in FTC v. Standard Oil Co. of California. The court noted the SEC's longstanding and well-publicized enforcement posture on SAR requirements dating to at least 2002 when FinCEN extended those requirements to broker-dealers, and referenced an earlier $12 million civil penalty obtained by the SEC against an affiliated self-clearing broker-dealer for thousands of SAR violations, which was affirmed by the 2nd Circuit. (Source: JD Supra, citing 10th Circuit decision.)

A lawsuit filed in May 2026 challenging the CFPB's April 2026 amendments to Regulation B is proceeding through summary judgment motions in U.S. District Court for the District of Columbia. The National Fair Housing Alliance, Rise Economy, BLDS LLC, and SolasAI contend the CFPB exceeded its authority by eliminating disparate-impact liability under the Equal Credit Opportunity Act, narrowing discouragement prohibitions, and modifying Special Purpose Credit Program requirements. Judge Beryl A. Howell has established a briefing schedule extending into January 2027, with plaintiffs' summary judgment motion due September 29, 2026 and defendants' opposition and cross-motion due November 10, 2026. The amended Regulation B provisions became effective July 21, 2026, and plaintiffs did not seek preliminary injunctive relief. Court docket: National Fair Housing Alliance et al. v. CFPB, No. 1:26-cv-01820 (D.D.C.).