Regulatory Enforcement + Compliance

Subscribe to Regulatory Enforcement + Compliance via RSS

On September 16, the Conference of State Bank Supervisors (CSBS) released a new supervisory resource designed to help state examiners assess the use and risks of artificial intelligence (AI) at state-chartered banks and state-licensed nonbank financial institutions. The publicly available framework also gives regulated institutions insight into examiners’ general approach, the types of questions they may ask, and the information they may request regarding an institution’s AI-based products, services, and tools.

On September 17, the U.S. Court of Appeals for the Second Circuit handed down a fantastic ruling for payors defending against private enforcement of No Surprises Act (NSA) independent dispute resolution (IDR) payment determinations. In East Coast Advanced Plastic Surgery, LLC v. Cigna Health & Life Insurance Co., the court held that the NSA does not create a private right of action allowing out-of-network providers to sue health plans that fail to pay IDR payment determinations.

This article republished on insideARM on September 23, 2026.

If you needed a reminder that state attorneys general are treating unlicensed debt collection as a serious enforcement priority, Massachusetts just delivered one. On August 31, the Suffolk Superior Court entered a Final Judgment by Consent resolving the Massachusetts Attorney General’s long-running case against several debt buyers and their owner. Under the terms of the order, the defendants must pay roughly $52 million in debt relief for more than 6,000 Massachusetts consumers, and permanently cease all debt buying, selling, and collection activities involving Massachusetts consumers.

On September 8, the Department of Labor’s Employee Benefits Security Administration (EBSA) issued Field Assistance Bulletin No. 2026-03, outlining how it will enforce the Mental Health Parity and Addiction Equity Act’s (MHPAEA) nonquantitative treatment limitation (NQTL) requirements going forward. The bulletin follows through on EBSA’s January 2026 announcement identifying mental health/substance use disorder (MH/SUD) benefit barriers as a national enforcement priority, and responds to sustained industry complaints that prior NQTL enforcement and comparative analyses requirements created confusion and unnecessary compliance burdens.

On September 9, the Federal Communications Commission (FCC) released a Report and Order and Further Notice of Proposed Rulemaking (FNPRM) (FCC-CIRC 2609-05) substantially revising the consent-revocation rules that were set to take effect January 31, 2027 under the Telephone Consumer Protection Act (TCPA). The new rules take effect just 30 days after Federal Register publication, superseding that delayed date entirely, so businesses have far less runway than expected.

The Federal Trade Commission (FTC) has entered into a stipulated order for permanent injunction against 5967 Ventures, LLC, doing business as Humboldt Merchant Services, resolving allegations that the payment processor facilitated fraud by opening and maintaining payment processing accounts for shell companies and merchants engaged in deceptive practices. The order, filed on September 8 in the U.S. District Court for the Eastern District of Michigan, carries significant implications for the payment processing industry.

In a significant en banc decision issued on August 11, 2026, the U.S. Court of Appeals for the Fifth Circuit largely affirmed a district court ruling that invalidated key portions of the federal agencies’ rules governing the calculation of the “qualifying payment amount” (QPA) under the No Surprises Act (NSA). The court’s decision has major implications for how insurers calculate the benchmark rate at the center of the NSA’s independent dispute resolution (IDR) process.

The Federal Trade Commission’s Bureau of Consumer Protection has issued an alert warning consumers about a growing scam in which fraudsters create near-perfect clones of legitimate car dealership websites, sometimes using AI, to trick buyers into paying upfront for vehicles that don’t exist. Victims show up at the real dealership only to find no record of their order, their payment, or their car.

On July 20, Pennsylvania Governor Josh Shapiro signed Senate Bill 992 (the Bill) into law, with an effective date of October 19, 2026. The amendments modernize the Telemarketer Registration Act (the Act) for the first time in almost three decades to address today’s technology, including robocalls, text messages, ringless voicemails, and AI-generated messaging and impose new compliance obligations on businesses that contact Pennsylvania consumers by phone or text. Significant changes are discussed below.