To keep receiving your weekly insights, all you need to do is subscribe to our new Consumer Financial Services Weekly Newsletter — it’s quick and easy.
We’ll see you there!
To keep you informed of recent activities, below are several of the most significant federal events that have influenced the Consumer Financial Services industry over the past week.
Federal Activities:
On October 14, the Office of the Comptroller of the Currency (OCC) released its final report on its review of debanking at the nine largest national banks it supervises, as part of implementing Executive Order 14331, “Guaranteeing Fair Access to Banking for All Americans,” and the Consumer Financial Protection Bureau (CFPB) announced the same day that it will investigate whether those banks and others have complied with federal consumer financial protection laws. The OCC’s review covered 2020 through September 2025 and drew on nearly 100,000 complaints, hundreds of individual bank decisions, and about 420,000 pages of bank documents. It found that the banks’ broad and inexact reputation risk policies lacked clear, measurable, objective criteria, produced inconsistent outcomes, and let public opinion and stakeholder views influence decisions. It also found that industry-specific restrictions (such as on coal and firearms) could disproportionately burden smaller businesses. The OCC further criticized banks’ reliance on negative news and third-party sources, and it said account closure communications often gave little or no explanation. It noted that state fair access laws likely prompted policy revisions, but cautioned that changes in policy language may not reflect changes in practice and that reputation risk may persist under labels such as “franchise” or “brand” risk. The OCC said it has eliminated reputation risk from its supervisory framework and issued Bulletin 2025-22, which allows it to consider debanking in licensing filings and Community Reinvestment Act examinations. It is also considering further rulemaking on discrimination based on political or religious beliefs and on reputation risk, as well as further Bank Secrecy Act (BSA) steps addressing pretextual account terminations. Comptroller of the Currency Jonathan V. Gould said the OCC is not forcing banks to serve every customer but that banks should use objective, risk-based criteria, and that “there is more work to do.” The CFPB, which Acting Director Mark Paoletta said will “fully investigate,” pointed to the Equal Credit Opportunity Act, the Fair Credit Reporting Act, and the prohibition on unfair, deceptive, or abusive acts or practices (UDAAP). It is also reviewing its own examination materials and complaint data. For more information, click here.
On October 14, the Federal Reserve Board’s Division of Supervision and Regulation issued SR 26-8, which updates the criteria for state member banks (SMBs) and U.S. branches and agencies of foreign banks to qualify for an expanded 18-month examination cycle instead of a 12-month cycle. The letter explains that § 903 of the 21st Century ROAD to Housing Act amended § 10(d) of the Federal Deposit Insurance Act to raise the asset threshold for the 18-month cycle from $3 billion to $6 billion. It also notes that the Board’s interim final rule, published September 14, 2026, and issued jointly with the OCC and Federal Deposit Insurance Corporation (FDIC), made parallel changes to Regulations H and K. An SMB with less than $6 billion in total assets may qualify if it is well capitalized, has CAMELS management and composite ratings of “1” or “2,” is not subject to a formal enforcement proceeding, and has not undergone a change in control in the preceding 12 months. A U.S. branch or agency of a foreign bank with less than $6 billion in total assets may qualify if it has a ROCA composite rating of “1” or “2,” meets specified capital or asset-maintenance requirements, is not subject to a formal enforcement action, and has not experienced a change in control. The Federal Reserve may consider additional factors for branches and agencies and retains the authority to examine institutions more frequently. The letter also directs Reserve Banks to conduct a BSA/anti-money laundering (AML) compliance program review every 18 months for institutions on the extended cycle and to review and modify alternate examination program agreements with state banking agencies as appropriate. SR 26-8 supersedes SR 18-7. For more information, click here.
On October 14, the U.S. Department of Housing and Urban Development (HUD) announced that its Federal Housing Administration (FHA) will allow build-to-rent communities to qualify for FHA-insured financing under two multifamily mortgage insurance programs, effective immediately. Build-to-rent communities are multifamily rental properties made up of single-family homes, duplexes, or triplexes, including both site-built and manufactured homes. They will now be treated under the same terms and conditions as traditional multifamily rental developments, subject to the specific requirements in the accompanying Mortgagee Letter. The updated policy applies to FHA’s § 221(d)(4) program for new construction and its § 223(f) program for acquisition or refinancing of recently developed rental communities. HUD said the change is meant to increase rental housing supply, particularly in light of manufactured housing innovation. Secretary Scott Turner said the agency is “eliminating barriers to spur development, expand rental options, and improve housing affordability.” HUD also said the change supports President Donald Trump’s efforts to remove barriers to housing and aligns with Executive Order 14376, “Stopping Wall Street from Competing with Main Street Homebuyers.” For more information, click here.
On October 14, the National Credit Union Administration (NCUA) Board requested comments on the 12th round of proposed regulatory changes under the NCUA Deregulation Project, with comments due by 11:59 p.m. ET on December 14, 2026. The proposals would clarify agency guidance or remove unnecessary, redundant, overly prescriptive, obsolete, or unduly burdensome requirements in the Code of Federal Regulations. They include amendments to 12 C.F.R. 704 and 713 to simplify fidelity bond requirements for federally insured and corporate credit unions, including requirements on bond purchases and renewals, approved bond forms, and guidance on coverage levels. They also include a change to 12 C.F.R. 721 clarifying that federal credit unions may apply directly to the Board to approve an activity not already recognized as an incidental power, without first obtaining an advisory opinion. In addition, the NCUA proposes to update 12 C.F.R. 725 by incorporating regulatory changes adopted during the COVID-19 pandemic, removing outdated provisions, simplifying Central Liquidity Facility membership and reporting requirements, allowing more flexibility for capital stock subscription adjustments, and making technical updates. Comments may be submitted through Regulations.gov. For more information, click here.
On October 8, the FHA issued Mortgagee Letter 2026-11, which updates the Minimum Decision Credit Score (MDCS) methodology to allow the use of alternative credit score models, FICO 10T and VantageScore 4.0, alongside Classic FICO, in all FHA-insured Title II Single Family mortgage programs. The letter is effective for case numbers assigned on or after January 1, 2027. FHA said the new models use trended data and nontraditional credit information, such as rent and utilities, to better quantify risk and increase access to homeownership. FHA will continue to require a tri-merge credit report, and the existing minimum credit score thresholds remain unchanged. Under the new methodology, a mortgagee first selects a score for each Credit Score Model Type submitted (the middle score if three differ, the lowest if two differ, or the single score if only one is reported). The Borrower-Level Score is the lowest of those selected scores, and the MDCS is the lowest Borrower-Level Score among all borrowers. The same model types must be used for all borrowers, the credit report in the case binder must include every model type submitted, and a transaction is ineligible if the MDCS is below 500. The letter also makes conforming terminology changes to HUD Handbook 4000.1 and removes the MDCS reference from the Home Equity Conversion Mortgage (HECM) program’s eligibility requirements because HECMs do not rely on credit scores. For more information, click here.
On October 8, HUD published a 60-day notice in the Federal Register seeking public comment on a proposed revision of a currently approved information collection titled “FHA Catalyst: Multifamily Applications, and Portal + Loan Underwriting System (PLUS).” The collection supports two FHA systems. Catalyst is an existing web-based portal through which FHA multifamily lenders upload and submit applications for FHA multifamily mortgage insurance. PLUS is a new web-based application that will let FHA multifamily and health care lenders request FHA Project Numbers and view the real-time status of their applications. HUD said additional lender portal functions will be added to PLUS in later phases, and PLUS will likely replace the multifamily lender functions in Catalyst in 2027. Respondents are FHA-approved mortgagees, including MAP lenders, state and local housing finance agencies, and Fannie Mae and Freddie Mac. HUD estimates 590 total annual burden hours and a total annual cost of $26,550, based on FHA Project Number requests through PLUS, application submissions through Catalyst, and Catalyst access requests. HUD asks for comment on whether the collection is necessary and has practical utility, the accuracy of its burden estimate, ways to improve the quality, utility, and clarity of the information collected, and ways to minimize the burden, including through automated collection techniques. Comments are due 60 days after publication, which would be December 7, 2026. For more information, click here.
On October 7, the OCC announced in News Release 2026-86 that Gould had convened a panel of community bankers in Minneapolis, MN, on October 6 to discuss efforts to combat financial fraud, in support of the Trump administration’s priority of eliminating fraud and protecting Americans from illicit activity. Gould noted that nonmortgage fraud reports in Minnesota more than doubled between 2020 and 2024 and that suspicious activity report filings related to check fraud rose nearly 300% over the same period. He also said billions of dollars intended for children, disabled seniors, and special needs services were diverted to people who cheated the system. He reaffirmed the OCC’s support for community banks and its participation in a whole-of-government effort to stop those exploiting the U.S. financial system. Gould announced a new tool that lets community bankers report suspected payments fraud involving OCC-regulated institutions directly to an OCC fraud task force. He also reminded banks of the OCC’s bulletin on the Financial Crimes Enforcement Network’s (FinCEN) 314(b) guidance, which enhances information sharing among institutions. The release cited Federal Trade Commission (FTC) Consumer Sentinel Network data showing 15,601 Minnesota fraud reports in 2026, with total losses of $86.5 million and a median loss of $288. It also highlighted Treasury’s Do Not Pay program, which in the last fiscal year screened more than 1.1 billion federal payments totaling about $3.7 trillion and identified and returned approximately 13,500 payments totaling $175 million that would have gone to deceased individuals. For more information, click here.
On October 7, Freddie Mac issued Selling Bulletin 2026-13, updating its Single-Family Seller/Servicer Guide. The bulletin retires the standalone GreenCHOICE Mortgages offering, effective for applications received on or after January 25, 2027 (and earlier applications settling on or after March 1, 2027), and folds it into an expanded CHOICEReno eXPress Mortgage with a uniform 15% maximum financed renovation cost limit, eligibility for all property types and manually underwritten mortgages, and broader debt payoff flexibility. For settlements on or after November 9, 2026, seller-owned modified mortgages may reflect a payment reduction from a principal curtailment and recast, and those settled within six months of the original note date may be Accept Mortgages without re-underwriting or a new appraisal, with more mortgage types becoming eligible, including second home, investment property, and manufactured home mortgages. The bulletin also takes immediate effect on several points: multiwide manufactured homes are eligible in shared equity programs, Freddie Mac’s written approval is no longer required for manufactured homes on leasehold estates, ACE and ACE+ PDR eligibility extends to investment property refinances, and the Guide allows a title endorsement for solar panel UCC-1 financing statements. Additional updates cover flood insurance requirements for condominium projects with more than 25% commercial space (effective December 6, 2026) and a system-specific license for the new FreddieHome platform (effective October 14, 2026). For more information, click here.
On October 6, the Financial Industry Regulatory Authority (FINRA) announced that it fined Revere Securities LLC $800,000 for AML and supervisory violations tied to small-cap initial public offerings (IPOs) for foreign-based issuers. As part of the settlement, Revere must retain a third-party consultant to review its compliance with FINRA rules, report recommendations for remediating its supervisory procedures and systems, and implement them. FINRA found that Revere, which has served since 2022 as a lead underwriter or selling group member for predominantly foreign-based small-cap IPOs (more than 40 involving issuers operating in Hong Kong or China), handled offerings bearing hallmarks of potential “ramp-and-dump” schemes. It also found that Revere failed to detect and report potentially suspicious transactions and lacked a reasonable customer identification and due diligence program. Some issuers’ stock prices spiked right after the IPO and then rapidly collapsed, causing millions of dollars in secondary market losses. Revere accounts also showed signs of manipulation, including coordinated trading and trading a significant share of daily volume. FINRA cited multiple seemingly unrelated customers who opened accounts on the same dates, listed the same residential addresses, and traded in identical or similar patterns. In one instance, Revere allocated more than $1.5 million in IPO shares, almost all of its allotment, to eight customers referred by a foreign broker-dealer. Four of them claimed to be unemployed yet reported income above $200,000, and seven of the eight applications contained contradictory information about the source of funds. The stock rose 318% on IPO day and then fell more than 50% by the close. All eight customers sent same-day liquidation instructions from IP addresses traced to countries other than where they purportedly lived, and Revere flagged none of these factors as suspicious. Revere had already engaged a consultant to review its AML program before the settlement, and it consented to FINRA’s findings without admitting or denying the charges. FINRA noted that the matter reflects its heightened focus on small-cap issuers, including an ongoing review of firm practices that it announced in October 2025. For more information, click here.
On October 6, the Government Accountability Office (GAO) published a report (GAO-27-108874) finding that restrictions enacted under the Homebuyers Privacy Protection Act of 2025 may curb unwanted mortgage solicitations while preserving opportunities to comparison shop. The report explains that when homebuyers apply for a mortgage, credit reporting agencies could previously sell their contact and credit information, known as “trigger leads,” to lenders and brokers with no existing relationship, without the homebuyer’s consent, which led to dozens of calls and texts in a short period. Industry stakeholders said trigger leads can encourage comparison shopping, but GAO noted that this benefit may be limited, since federal survey results suggest no more than 3.5% of homebuyers may have obtained a loan through competing offers based on trigger leads. Consumer advocates and industry stakeholders also cited drawbacks, including overwhelming and confusing solicitation volumes, exposure to misleading or deceptive practices, and privacy concerns. The act’s restrictions, which took effect in March 2026, limit credit reporting agencies’ ability to provide residential mortgage trigger leads to parties that have an existing relationship with, or consent from, the homebuyer. GAO said that not enough time has passed to determine their effects, but that if effectively implemented, they could reduce solicitation volume while preserving comparison shopping.For more information, click here.
On October 1, as part of Operation Economic Outcast, the U.S. Department of the Treasury announced coordinated action against the A7 Network, a Russia-linked shadow banking network used by the Iranian regime to evade sanctions. FinCEN proposed a rule under § 9714(a) of the Combating Russian Money Laundering Act that would prohibit transmittals of funds involving the A7 Network’s Sub-Agents. The comment period will close 30 days after the proposed rule is published in the Federal Register. FinCEN also issued an alert with red flags to help financial institutions detect and report related suspicious activity. The Office of Foreign Assets Control (OFAC) sanctioned the A7 Network as a significant transnational criminal organization. The network is led by sanctioned and convicted fraudster Ilan Mironovich Shor and builds on OFAC’s August 14, 2025, designations of A7 LLC and Old Vector LLC. Sub-Agents are third-country companies that disguise sanctioned payments as ordinary commercial activity, using falsified trade documents and misleading goods descriptions. The A7 Network claimed to process more than 2,000 transactions a day as of January 2026, with a volume of more than 7.5 trillion rubles (about $91.5 billion). FinCEN found that Sub-Agents processed more than $17 billion between January 2025 and June 2026. They also served the Central Bank of Iran, the IRGC, Iran-backed terrorist groups, and cybercriminals, and were used for Iranian oil sales and weapons procurement. The A7A5 token, a blocked ruble-backed token issued by Old Vector LLC, is part of the network. As a result of the OFAC action, all property and interests in property of the A7 Network, including transactions involving Sub-Agents acting for it, that are in the U.S. or in the control of U.S. persons are blocked and must be reported to OFAC. The same applies to entities owned 50% or more by blocked persons. The release also warned of civil and criminal penalty exposure, including strict liability civil penalties, and noted that FinCEN’s whistleblower program may reward information leading to enforcement actions with penalties over $1 million. For more information, click here.
On September 30, the CFPB’s Office of Inspector General (OIG) issued a management alert (Report 2026-IT-C-015) warning that hardware assets at former CFPB regional offices may not be appropriately secured. During an ongoing audit, the OIG found that the CFPB left hardware assets at regional offices it vacated in March 2026 and has not verified whether those assets are properly secured. The OIG noted that the CFPB maintains data that, if exposed, could reveal consumers’ and businesses’ private information, undermine public trust, and compromise enforcement of consumer financial laws. Because of the urgency of the issue, the alert includes a recommendation that the CFPB secure the hardware assets, and the agency has agreed to do so. For more information, click here.
On September 3, the OCC’s Chief Counsel’s Office, through Principal Deputy Chief Counsel Will C. Giles, issued Interpretive Letter No. 1194. It concluded that a national bank may offer personal guarantee insurance (PGI) in connection with its commercial lending business under 12 U.S.C. § 24 (Seventh) and § 302 of the Gramm-Leach-Bliley Act (GLBA). PGI protects a personal guarantor against the risk that the primary borrower defaults and the guarantor becomes liable on the guarantee. Under the bank’s proposal, PGI would be an optional product sold in partnership with an unaffiliated managing general agent and issued by an unaffiliated carrier. A wholly owned bank subsidiary, a captive PGI cell, would reinsure the policy in favor of the carrier. The guarantor would owe a 5 to 10% co-insurance or deductible, and the carrier would pay the remainder, with the PGI cell reimbursing the carrier. The OCC reasoned that its prior precedent, including Interpretive Letter No. 886, treats credit-related insurance as an “authorized product” under GLBA § 302. That precedent defines credit-related insurance as products that guarantee or secure payment of an outstanding obligation in a credit transaction if the borrower cannot pay. The OCC found that PGI fits this definition. The loan guarantee is the “outstanding obligation,” the guarantor is the “borrower,” and the guarantor’s creditworthiness is part of the lender’s underwriting analysis. Because PGI is credit-related insurance, it is an authorized product that a national bank may provide as principal. The OCC cautioned that its conclusion rests on the facts represented and that different facts could lead to a different result. It also noted in a footnote that forming the subsidiary or conducting the new activity in it may require a notice or application under 12 C.F.R. § 5.34. For more information, click here.
State Activities:
On October 13, the California Department of Financial Protection and Innovation (DFPI) published a report on its 2025 enforcement and consumer protection results under the California Consumer Financial Protection Law (CCFPL). The report said California acted while the federal government rolled back protections. DFPI reported more than $1.4 million in penalties against bad actors and more than $200,000 returned to affected Californians. It also reported 391 enforcement actions against regulated financial entities, a 94% increase over the prior year. DFPI added nearly 200 crypto-related scams to its Crypto Scam Tracker, a 30% increase. The California Attorney General’s Office used the Tracker’s data to deactivate 48 scam websites. The department handled 2,970 CCFPL-related consumer complaints, a 24% increase, with debt collection and crypto assets the top two categories. It also engaged more than 38,000 Californians through scam, fraud, and financial literacy outreach. The report highlights an action in which DFPI led an 11-state coalition that secured $4.2 million in compensation for 660 victims of a company that falsely promised its online training course would guarantee a six-figure sales career. It also describes the shutdown of crypto kiosk operators that failed to protect consumers scammed through Bitcoin ATMs. In addition, DFPI said it expanded protections in 2025 by regulating companies involved in debt settlement services, income-based advances (early wage access), private postsecondary education financing, and student debt relief. DFPI Commissioner KC Mohseni said the state will keep cracking down on predatory practices and fraudulent financial products. For more information, click here.
On October 9, Michigan Governor Gretchen Whitmer signed Senate Bill 198 into law as Act No. 113 of the Public Acts of 2026, enacting the Motor Vehicle Dealer Data Collection Act, which took effect immediately. The act responds to dealer concerns that manufacturers and third-party vendors have sought broad, sometimes unilateral, access to data in dealer management and customer relationship management systems. It bars manufacturers and third parties from requiring dealers to grant direct or indirect access to their “dealer data system,” and lets dealers instead push data in a STAR-compliant (or equivalent cybersecurity standard) electronic format. Third parties may not access, share, sell, copy, use, or transmit “protected dealer data” without the dealer’s “prior express written consent.” That consent must be in a separate document, identify the parties, and specify the scope, data fields, and duration of the sharing. Dealers may revoke or amend consent without cause on 60 days’ notice, or immediately for cause. Manufacturers may not condition any program, bonus, incentive, rebate, or payment on consent. A manufacturer need not pay a benefit, however, if a dealer declines to provide data reasonably necessary for that specific program. Manufacturers may not reach beyond a defined category of “required manufacturer data” without consent, and any data access charge must be limited to actual, disclosed third-party costs. The act also prohibits “cyber ransom” and unreasonable fees or technical restrictions. Manufacturers, authorized integrators, and other third parties must indemnify dealers for damages from violations, including those by their vendors or agents, with the dealer bearing the burden of proof. Dealer data vendors must adopt a standardized framework with open APIs for authorized integrators. Agreements with vendors and integrators must be terminable within 90 days of notice, with secure data transition, deletion or return of data, disclosure of third parties that received the data, and dealer audit rights. The act does not cover data generated outside a dealer data system, such as vehicle-generated or connected-device data, and it does not alter other data protection laws. Entities serving Michigan dealers may need to review their agreements and data-sharing practices for compliance. For more information, click here.
On October 8, 34 state financial regulatory agencies, led by Alaska, Arkansas, Georgia, Illinois, North Carolina, Ohio, and Washington, announced a $2.5 million settlement with Coinme Inc., a Seattle-based cryptocurrency money transmitter and virtual currency kiosk operator, for violations of BSA and anti-money laundering (AML) laws. Under the settlement, Coinme agreed to terminate its virtual currency kiosk operations by January 1, 2027, or pay an additional $4 million penalty. Coinme also agreed to hire an independent consultant to review the comprehensiveness and effectiveness of its BSA/AML program and to submit a report to the states within six months. After the report is filed, Coinme will have 12 months to correct any deficiencies the review identifies.For more information, click here.