Insights · Looking Back
Financial Services
The Looking Back articles on financial services, in order.
101 articles
January 2020
February 2020
Week of 10 February 2020
What the Equifax indictment changed for banks, and what it did not
The Justice Department charged four Chinese military officers over the 2017 Equifax breach. For banks, the indictment settled who did it and changed nothing that mattered operationally: the data stayed exposed, the entry point stayed ordinary and accountability stayed with the data holder.
Week of 17 February 2020
Morgan Stanley and E*Trade: wealth scale is a client-data problem
Morgan Stanley’s deal for E*Trade, months after Schwab agreed to buy TD Ameritrade, bet on joining self-directed, advised and workplace channels. Whether such scale pays depends on three layers of integration, and the client layer comes first for firms of any size.
March 2020
Week of 2 March 2020
Why the FFIEC’s pandemic statement was an evidence checklist
The FFIEC’s March 6, 2020, statement restated pandemic expectations from the avian flu era. Its value lay in what examiners would later ask institutions to show: staged decisions, critical operations run with fewer people, and service providers coping with the same disruption.
Week of 23 March 2020
Forbearance on request: what the CARES Act asked of loan servicers
The CARES Act gave borrowers with federally backed mortgages forbearance on request and told lenders how to report accommodated accounts. Servicing built for case-by-case exceptions had to run intake, credit reporting and exit planning at volume, mostly from home.
April 2020
May 2020
Week of 18 May 2020
Small-dollar loans, alternative data and the governance attached
The May 2020 interagency principles invited banks and credit unions back into small-dollar lending and accepted new data and technology in underwriting. Using cash-flow data responsibly required three disciplines: consented data access, model risk management and fair lending controls for automated decisions.
Week of 25 May 2020
Why valid when made left bank-fintech lenders two open questions
The OCC’s May 29, 2020, rule said a national bank loan’s permissible interest survives its sale. That settled one question for bank-fintech lending. It left open who the true lender is, and how the bank proves it oversees the program.
June 2020
Week of 15 June 2020
What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, and €1.9 billion of its cash probably never existed. Partners relying on those signals learned that three checks cannot be delegated: where the money comes from, whether customer funds are visible, and how to leave.
Week of 29 June 2020
Why Form CRS was the easy part of Regulation Best Interest
Broker-dealers had to comply with Regulation Best Interest and deliver Form CRS from June 30, 2020. The disclosure document was a contained project. Showing that each recommendation met the standard, and that conflicts were controlled, required data most firms did not capture.
August 2020
Week of 3 August 2020
Capital One’s cloud penalty was a verdict on sequencing
The OCC’s $80 million penalty did not say the cloud was unsafe. It said a bank moved critical operations before its risk management could describe, test and monitor them, and it priced that gap.
Week of 24 August 2020
Low for long: the rate forecast hidden in bank technology budgets
The Fed’s August 2020 framework change gave banks a credible reason to plan for years of near-zero rates. Many technology business cases quietly assumed it, in deposit forecasts, channel metrics and contract terms that later came due.
September 2020
October 2020
December 2020
January 2021
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
The banking agencies’ proposed notification rule looked like a deadline. The harder work sat upstream of it: a named judgment about what counts as material disruption, and vendor notices that reach the people making that judgment in time.
Week of 25 January 2021
GameStop’s buy button was switched off in the clearinghouse
When retail brokers stopped customers buying GameStop on January 28, 2021, the cause sat in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app are one system, though three teams own them.
February 2021
March 2021
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again put business email compromise at the top of its loss table. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 22 March 2021
Each Archegos lender already held enough data to act
Archegos is usually told as a story of positions hidden across many prime brokers. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
The March 2021 interagency request for information on AI produced no new rule. Its questions mapped onto four supervisory tests that existing rules already imposed, and that examiners still apply to any model in a bank or credit union.
June 2021
Week of 7 June 2021
Why Basel’s 1,250% risk weight pointed banks toward custody
The Basel Committee’s June 2021 consultation made holding bitcoin on a bank balance sheet prohibitively expensive in capital. That split the bank crypto question into three businesses with different economics, holding, safeguarding and moving value, and only one was priced out.
Week of 14 June 2021
Juneteenth tested how many calendars a bank really runs
Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it showed that a business day is defined in three places, payment rails, customer commitments and the workforce, usually owned by different teams.
Week of 21 June 2021
TransUnion won Ramirez, and name-only matching still lost
The Supreme Court’s June 2021 ruling narrowed who can sue over inaccurate credit file flags. The facts underneath were an entity resolution failure that banks and fintechs share, and the ruling changed none of the three things that govern it.
July 2021
August 2021
September 2021
October 2021
Week of 11 October 2021
FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
FinCEN’s October 2021 trend analysis showed that suspicious activity reports can map a criminal economy, but only when filers record cyber indicators in usable form. That choice, made at the investigator’s desk, decides the data’s value inside the bank too.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
The FTC’s amended Safeguards Rule gave mortgage brokers, auto dealers, finance companies and tax preparers specific security controls. The harder change was governance: one qualified individual, a written report to the board, and evidence that the program ran.
November 2021
Week of 8 November 2021
Robinhood’s phone-call breach argues for support access sized to one customer
In November 2021, one socially engineered support employee gave an attacker reach into millions of customer records at a retail brokerage. The fix sits in three places: the agent on the phone, the tools behind them, and what customers are taught to trust.
Week of 29 November 2021
Inflation’s first casualty in bank IT was the change budget
When the Fed dropped “transitory” in late November 2021, bank and credit union technology budgets faced a quiet squeeze. Run costs rose automatically through contracts, wages and usage pricing, so the money for modernization absorbed the difference.
February 2022
Week of 7 February 2022
Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 to a $3.6 billion seizure in 2022 because the ledger never forgets. The decisive links sat at regulated firms, so banks’ own records of crypto-linked activity need to be built to be read years later.
Week of 14 February 2022
In Ukraine’s bank DDoS, the rumor outran the outage
The February 2022 denial-of-service attacks on Ukrainian state banks caused short disruptions, paired with false texts saying ATMs had failed. A bank’s availability in a crisis includes what customers believe about their money, so communication and alternative channels belong in the resilience plan.
Week of 28 February 2022
Russia’s sanctions tested banks’ ownership data more than their name lists
The sanctions on Russia from late February 2022 came in fast waves, from several governments, against sprawling corporate groups. Screening names against lists caught the obvious cases. Exposure sat in unnamed subsidiaries, effective dates and jurisdiction-specific rules, all of them data problems.
April 2022
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
An April 2022 federal advisory described North Korean operators courting crypto-firm engineers with fake recruiting and trojanized apps. For any financial firm, a job approach reaches the people with the most access through a channel security rarely watches, so controls must assume one will succeed.
Week of 25 April 2022
Why the CFPB’s dormant authority put fintech partners on the exam calendar
By reviving a rarely used power to supervise nonbanks whose conduct poses risks to consumers, the CFPB made exam readiness something fintechs had to build before scale, and something their sponsor banks had to check.
May 2022
July 2022
August 2022
September 2022
Week of 19 September 2022
What a stolen license number proves, and what banks treated it as proving
The Optus breach put millions of identity document numbers in criminals’ hands. Banks had used those numbers as proof of identity at account opening, in the contact center and in their own files. Each use needed a different fix.
Week of 26 September 2022
Recordkeeping fails where the approved channel is slower than a text
The SEC and CFTC fined large Wall Street firms over employees’ business texts on personal phones. The rules were old and capture tools existed. The failures came from convenience, and fixing them meant channels, supervision and capture assurance moving together.
October 2022
Week of 17 October 2022
If the CFPB’s funding fell, the statutes would still stand
A federal appeals court called the consumer bureau’s funding unconstitutional, and for eighteen months every CFPB rule carried a question mark. Compliance teams had to sort the bureau’s past orders, current rules and pending rules, because each faced a different risk.
Week of 24 October 2022
For credit unions, the 1033 outline was a question for the core processor
The CFPB’s first open banking outline opened a small business review. For small banks and credit unions, compliance would arrive as a product from their core and digital banking vendors, so their decisions were about coverage, cost and contracts.
November 2022
December 2022
January 2023
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
The January 2023 joint statement was read as a verdict on what banks could do with crypto. Its sharper warning was about exposure banks already had through depositors, partners and customers, which most could not measure from their own data.
Week of 16 January 2023
DORA’s two-year runway, measured in contract renewals
DORA gave EU financial firms two years to comply, with no carve-out for existing ICT contracts. For most firms the binding constraint was not policy writing or testing but the calendar on which they could reopen agreements with technology providers.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
The ransomware attack on ION’s cleared derivatives software showed that sector-wide disruption often starts at specialized post-trade vendors that many firms share and few rank as critical. Finding them, grading them and rehearsing life without them are three separate jobs.
February 2023
March 2023
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank is remembered as a liquidity and supervision failure. For the fintechs, broker-dealers and companies that banked there, it was a supplier failure: cash, payment flows and dependent services all ran through one provider nobody had assessed as critical.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
Amid the bank failures, the SEC proposed a cyber rule for market entities, amendments to Regulation S-P and a wider Regulation SCI on one day. Each answered a different audience: the regulator, the customer and the market. Only the customer rule was adopted.
May 2023
July 2023
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s Local Law 144 made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder prerequisite was finding every tool that scores candidates, deciding which were in scope, and naming an owner for each.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining turned on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
August 2023
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 rating actions confirmed that the spring’s bank stress would become a lasting earnings squeeze. Regional bank technology budgets had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for a smaller margin.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The private fund adviser rules adopted in August 2023 were vacated ten months later. Advisers that sorted the work into what investors would demand, what existing law already required and what only the rule required spent little that was wasted.
September 2023
October 2023
November 2023
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
When LockBit hit ICBC’s U.S. broker-dealer in November 2023, Treasury trades still had to settle. Every market participant could have been in any of three seats, and each seat needed a different plan written before the day.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
When ALPHV publicized its SEC complaint against MeridianLink in November 2023, the vendor’s bank and credit union customers faced their own notification questions with only an attacker’s claim and a vendor statement to go on. Their work split into facts, regulators and customers.
January 2024
February 2024
March 2024
May 2024
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments gave customers a 30-day breach notice and required service providers to report within 72 hours. For broker-dealers and advisers whose customer data sits mostly with vendors, that second clock decides how well the first one works.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 campaign against Snowflake customers broke no platform. It used passwords stolen from infected machines, often contractors’, and walked out with bulk data. Each stage, from theft to login to extraction, was a control point the customer owned.
June 2024
July 2024
August 2024
October 2024
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no requirements. Because Part 500 already demands an annual compliance certification signed by the CEO and CISO, it turned four AI risks into evidence those signers must be able to produce.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s Section 1033 rule was sued the day it was issued. Banks could not wait out the litigation or comply blindly. The workable approach was to split the program into no-regret work, rule-specific work and work hinging on the contested terms.
November 2024
Week of 11 November 2024
FinCEN’s deepfake alert was a job-design problem for three groups of staff
FinCEN’s November 2024 alert read like a list of red flags for compliance teams. Its harder implication was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new decision rights, incentives and escalation paths.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The larger-participant rule gave federal examiners access to big payment apps and lasted under six months. With Synapse’s collapse fresh, the more durable exposure sat elsewhere: in the law apps already owed and in the banks holding their customers’ funds.
December 2024
January 2025
February 2025
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The February 2025 stop-work order did not change consumer law. It removed three things the Bureau had supplied to firms almost for free: exam deadlines that forced fixes, published findings about peers, and federal follow-up on complaints. Firms had to replace each themselves.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record defeated multi-signature approval without breaking it, by altering the interface the signers trusted. Banks approving payments through software face the same risk at four points: how the interface is built, what approvers see, how payments are verified, and recovery.
April 2025
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s frankest account of its own weaknesses sits with a regulator it cannot audit or replace. Banks still control what they write, how it travels, and how they respond to a breach.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. For broker-dealers and advisers, what mattered was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and examinations kept running.
Week of 28 April 2025
Iberia’s blackout put payment resilience back at the shop counter
When the Iberian grid failed in April 2025, bank systems largely held and customers still could not pay. Payment resilience is set at the terminal, the network link, the offline rules and the cash fallback, and banks can shape all four.
May 2025
June 2025
Week of 9 June 2025
Google Cloud’s June outage moved bank cloud diligence from uptime to change safety
Google Cloud’s June 2025 outage started with a routine policy update that reached every region at once. Banks learn more from asking how a provider releases code and configuration than from its uptime commitment.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
When a group that works one industry at a time reached U.S. insurers in June 2025, threat intelligence turned into a date. Institutions needed a pre-agreed surge mode: a named trigger, tighter help-desk rules for weeks, and containment planned around compromised identity.
August 2025
September 2025
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
When the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, attention went to picking a replacement framework. The harder loss was the inherent risk profile, the step that told a bank how much security it needed.
Week of 8 September 2025
Why bank change control never saw the npm hijack
Malicious versions of widely used JavaScript packages were live for about two hours in September 2025. Bank change control approves code people write; this attack arrived in code the build pipeline fetched on its own, which nobody approves.
October 2025
Week of 20 October 2025
One region failed, many financial apps stalled: concentration risk sat in the dependencies
The October 2025 us-east-1 outage hit financial apps whose own designs looked resilient. The exposure lay in shared services and recovery backlogs, so the response is dependency mapping and tested degraded modes, not reflexive multi-cloud.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s last amended cybersecurity deadline, November 1, 2025, paired universal MFA with a maintained asset inventory. MFA drew the attention. The inventory was harder, and the executive certification made both personal.
November 2025
Week of 17 November 2025
For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s
The Commission’s proposal to delay high-risk AI obligations looked like relief for credit scoring. For consumer lenders, the binding constraints were the GDPR as the EU’s top court had read it and the Consumer Credit Directive’s November 2026 date.
Week of 24 November 2025
SitusAMC turned a mid-tier mortgage vendor into a top-tier bank exposure
The SitusAMC breach reached some of the largest U.S. banks through a real estate finance services provider. Vendor tiering built on spend and operational criticality missed a firm that held sensitive data for many institutions at once.
December 2025
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
When the amended Regulation S-P took effect for larger firms on December 3, 2025, notice became the default. Whether a firm could notify narrowly depended on evidence it had to keep before any incident.
Week of 15 December 2025
Crypto trust charters and community banks: the binding decision sits in the core
The OCC’s conditional charters made federally supervised digital-asset custodians a realistic option for smaller banks and credit unions. The harder decision was how any of it would reconcile to the general ledger, statements and reports their core platforms produce.
January 2026
March 2026
April 2026
May 2026
Week of 18 May 2026
Searching by balance: how bribed bank insiders choose their targets
Bank insider cases prosecuted in 2026 show bribed employees selling three things: the search that finds valuable customers, the screens that expose them, and the overrides that open doors. Each can be controlled without first catching the insider.
Week of 25 May 2026
Faster settlement, longer nights: what two years of T+1 tell Europe’s operations desks
The US move to one-day settlement held because firms automated trade-date matching and redesigned who works when. Europe and the UK move in October 2027, and the shift pattern and funding model will be harder to build than the software.
June 2026
Week of 1 June 2026
For a small adviser, Regulation S-P compliance is bought before the breach
When amended Regulation S-P reached smaller advisers and broker-dealers on June 3, 2026, most of them had no in-house incident team. For them, compliance is a set of purchases made in advance: response capacity, evidence and the means to notify.
Week of 22 June 2026
Why Europe’s accessibility law turns every bank release into evidence
A year after the European Accessibility Act began to apply, banks serving EU consumers have learned that conformance decays with every release, template change and vendor update. The durable answer is a running body of evidence across four parts of the service.
July 2026
Week of 13 July 2026
Fedwire’s ISO 20022 switch gave banks rich payment data their core systems still truncate
A year after Fedwire moved to ISO 20022, the structured message reached most US banks intact. Its value did not, because data was lost at origination, inside banks’ own systems, or in screening and fraud tools never set up to use it.
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 rulemaking deadline, but the law’s January 2027 backstop date did not move. Banks could not wait for final text to decide which role to play, and the funding question cut across every choice.