A federal judge blocked a bank's early exit from a redlining consent order the same month Illinois wrote disparate impact into state law, even as the CFPB, HUD, and FTC all moved to retreat from that theory at the federal level.
Banking regulators followed a similar pattern. The OCC and FDIC narrowed supervisory standards under a proposed revision to the Community Reinvestment Act and a new "unsafe or unsound practices" rule, while 10 states sued the OCC over escrow interest preemption.
Want a deeper dive into the latest headlines? Watch the September Reg Update podcast. For additional resources and regulatory analyses, check Ncomply.
Issues Affecting All Financial Institutions (FIs)
New Jersey Court Blocks Early End to a Redlining Consent Order
A federal judge in New Jersey blocked a bank's bid to exit a 2022 redlining consent order two years early, as roughly $4.2 million of its $12 million loan subsidy fund remains undistributed. The bank, acquired by another institution in 2024, argued alongside the Department of Justice (DOJ) that it had substantially complied with the consent order. On July 31, the judge disagreed, writing that a promise to reach substantial compliance in the future isn't the same as substantial compliance today. Three fair housing groups, including the National Fair Housing Alliance, had opposed the order’s early termination. that it had substantially complied. On July 31, the judge disagreed, writing that a promise to reach substantial compliance in the future isn't the same as substantial compliance today. Three fair housing groups, including the National Fair Housing Alliance, had opposed the early termination.
The order still requires $150,000 in annual spending on advertising, outreach, financial education, and credit counseling in the Newark lending area, plus two branches that must stay open through the order's September 2027 end date. Those obligations run for the full five-year term rather than terminating early, and the court treated that distinction as decisive.
This isn't an isolated result. A Pennsylvania bank hit the same wall last summer, and a federal judge in Massachusetts separately blocked a HUD plan, for the third time, that would have redirected fair housing enforcement funding away from the community groups that field most housing discrimination complaints. The pattern holds across these cases: courts will let federal agencies set their own enforcement priorities going forward but won't unwind compliance commitments already locked into a court order.
Key Takeaways
If your FI is operating under a consent order, spending the required dollars isn't the finish line. Regulators and courts want evidence the remedy worked, not just documentation that you attempted it.
Related: Fair Lending Update 2026: Disparate Impact and Underwriting Risk
Illinois Expands Disparate Impact Liability to Lending
Illinois enacted the Civil Rights Safeguard Act on July 31, amending the state's Human Rights Act to codify disparate impact as a valid theory of discrimination in lending. Banks, credit unions, and mortgage companies are covered under the Human Rights Act's existing definition of "financial institution," even though the new law doesn't define the term itself. The change takes effect on January 1, 2027.
Pricing models, credit scoring, automated underwriting, fraud tools, and even groups of policies working together can all be challenged if they produce a discriminatory effect, regardless of intent. Once that's shown, the burden shifts to the lender to prove the practice serves a legitimate business purpose with no less discriminatory alternative.
The law moves in the opposite direction from federal policy this year. The CFPB removed disparate impact from Regulation B in April, HUD has a proposal open through October to do the same to its fair housing rule, and on August 7 the FTC said it will no longer pursue disparate impact claims under any statute it enforces. Disparate treatment claims under ECOA are unaffected, however.
But federal retreat isn't federal certainty: a lawsuit over the CFPB's Regulation B change is still active, and Illinois isn't alone, with California, New York, and New Jersey all recognizing disparate impact theories.
Lenders in Illinois, or any of those states, should be able to explain right now why a challenged practice is necessary and why no less discriminatory alternative exists.
Related: Massachusetts Hits Lender with $2.5 Million Settlement for Violations
CFPB Stops Publishing Consumer Complaint Narratives
The CFPB stopped publishing consumer complaint narratives and plans to remove the data visualizations built on them as well. Narratives filed through August 11 were still visible as of August 31, though that access is expected to close soon.
The Bureau says the complaint narratives are unverified, one-sided, and not representative of any company's actual compliance record. The underlying database, which the CFPB is required by law to maintain, hasn't changed. Examiners still see full complaint data, response grading completeness, accuracy, and timeliness continues, and that information still flows to prudential regulators, the FTC, and state agencies.
If your team used public narratives to scan competitor institutions, track emerging UDAAP themes, or monitor vendors under contract, start lining up a replacement now, since that free peer-benchmarking tool is going away. Two things still survive: a company's own public response to a complaint stays published after the narrative comes down, and the CFPB's FOIA reading room keeps prior narratives retrievable for anyone who goes looking.
FinCEN Makes Beneficial Ownership Exemption Permanent for Domestic Companies
FinCEN's August final rule permanently ends beneficial ownership reporting under the Corporate Transparency Act for U.S. companies and U.S. persons, converting last year's interim exemption into a permanent one. Only foreign entities registered to do business in the U.S. still have to report, and only for their foreign individual owners.
This shouldn't change much in practice since the interim rule already suspended domestic reporting last year, but it raises the stakes on the Customer Due Diligence (CDD) Rule. FinCEN's justification for exempting domestic companies points directly at the CDD Rule as the compensating control that lets the agency comfortably drop the CTA reporting requirement. That makes your ongoing obligation to collect beneficial ownership information on legal entity customers even more central to your AML program.
Make sure no one at your FI treats "beneficial ownership reporting went away" as applying to CDD, as these are two separate obligations under two different rules. Business customers, CTA-exempt but not CDD-exempt, will ask why you're still collecting beneficial ownership information at account opening, so equip frontline staff to answer questions. Also, review your website and onboarding materials for anything instructing customers to file a BOI report without qualification.
Issues Affecting Depositories
Treasury Proposes Registration Rules for Payment Stablecoin Issuers
The Department of the Treasury proposed regulations implementing Section 3 of the GENIUS Act, setting the rules for who can issue a payment stablecoin in the U.S. and who can offer, sell, or make one available to a U.S. person. The proposal would add a new Part 1523 to Title 12, defining core terms like "issue," "issuer," and "located in the United States," along with reliance safe harbors, exemptions, and participation liability standards.
Under the proposal, nobody can issue a payment stablecoin in the U.S. without qualifying as a permitted payment stablecoin issuer or registering with the OCC as a qualifying foreign issuer. Digital asset service providers can't offer or sell a stablecoin to a U.S. person unless it came from an approved issuer. Any institution that issues, redeems, or deals in stablecoins could be swept in as a digital asset service provider, and so could trust companies acting as custodians, transfer agents, or market makers.
Banks and credit unions with subsidiaries eyeing permitted issuer status should start reviewing the registration pathway now. The proposal also offers a reliance safe harbor for institutions with genuine, actively maintained location-screening controls, but only for those that can show the controls are running, not just written down.
Comments are due October 19. FIs operating near stablecoin custody, redemption, or market-making should use that window to decide whether pursuing issuer status makes sense and to start drafting or updating location-screening policies.
Related: Emerging Risks in Banking: Q3 2026 Update
Issues Affecting Banks
OCC and FDIC Propose Narrower Community Reinvestment Act Rules
The OCC and FDIC proposed changes on July 31 to their Community Reinvestment Act rules, aiming to better target community development grants, reduce burden for community banks, and clarify how banks earn CRA credit. The proposal keeps the 1995 framework in place but narrows it: retail banking services would only cover credit, so deposit services are excluded entirely, and community development grants would only count if the money went directly to a project with community development as its primary purpose, with a large bank's grant recipient capped at 15 percent overhead.
Asset thresholds are moving too. The small bank threshold rises from $412 million to $1 billion, and the large bank threshold rises from $1.65 billion to $10 billion, with everything between now classified as an intermediate bank. That pulls a meaningful number of banks into a lighter supervisory bucket with fewer data collection and reporting requirements.
The 2023 CRA modernization rule was blocked by injunction before taking effect, but never formally rescinded; examiners have applied the 1995 rules as a matter of policy ever since. That means 2023 language can still turn up in regulatory text, which is worth flagging before your next exam prep cycle.
The Federal Reserve isn't part of this proposal. The OCC and FDIC also dropped their appeal of the 2023 injunction on July 1 and are asking the court for a final judgment that would limit how future CRA rules can be written; the Fed didn't join that motion, and its appeal remains active. State member banks under the Fed shouldn't assume they'll see the same relief on the same timeline as OCC- and FDIC-supervised banks.
Comments are due October 13.
Key Takeaways
If you're supervised by the OCC or FDIC and anywhere near the new asset thresholds, start modeling what your CRA program looks like under the new categories now. If you're a state member bank under the Fed, don't assume you're getting the same relief on the same timeline.
OCC and FDIC Finalize Rule Defining "Unsafe or Unsound Practices"
The OCC and FDIC issued a final rule on August 27 defining "unsafe or unsound practice," a term used in enforcement since the late 1960s but never formally defined, leaving courts to fill the gap inconsistently.
The new definition sets a three-part test for an unsafe or unsound practice:
- It runs contrary to generally accepted standards of prudent operation.
- It's likely, not merely possible, to cause harm.
- That harm is material to the bank's financial condition: capital, asset quality, earnings, liquidity, or sensitivity to market risk.
Examiners can only issue a Matter Requiring Attention (MRA) for something that could reasonably be expected to become an unsafe or unsound practice under current or foreseeable conditions, or for a violation of banking law.
Examiners can still raise concerns informally. What they can no longer do:
- Demand a formal action plan for an informal concern
- Track whether the bank adopted it
- Require management to present it to the board
- Criticize a bank for declining
- Escalate a repeated decline into an MRA
The rule also ties a composite CAMELS downgrade below satisfactory to a qualifying MRA or enforcement action, a real constraint since that downgrade can block interstate mergers and de novo branching and cost a bank its financial holding company status. This is as much an M&A eligibility rule as a supervision one.
State-chartered banks examined by both the FDIC and a state banking department should note that only the FDIC side is bound by this rule; the state examiner isn't. The Federal Reserve didn't join the rulemaking either, so Fed-supervised institutions aren't covered.
The rule takes effect on November 2, 2026.
Key Takeaways
Weak model governance or sloppy third-party risk management can still cause material financial harm. What's changed is that examiners now must show that harm is likely and material before issuing an MRA.
Related: June 2026 Regulatory Update: Fair Lending Shifts & a Supervisory Reset
FDIC Proposes Higher Insider Lending Thresholds to Align with Regulation O
The FDIC proposed a rule updating its regulations on extensions of credit to insiders, meaning executive officers, directors, and principal shareholders. The goals: align with the Federal Reserve's Regulation O, cut paperwork for smaller transactions, and index the dollar thresholds automatically.
The threshold for extensions of credit to executive officers not otherwise authorized by statute rises from $100,000 to the lower of 2.5% of unimpaired capital and surplus or $400,000. The bigger change is that the threshold triggering advance board approval, with the insider recused, moves from $500,000 to the lower of 5% of unimpaired capital and surplus or $2 million. Both will reindex every five years based on GDP growth, but only upward; there is no corresponding decrease if the GDP shrinks.
Fewer insider transactions requiring board sign-off means fewer eyes on them, and insider misconduct hasn't gone anywhere. In July, the DOJ sentenced two former bank employees to prison for using their access to enable money laundering and fraud, and banks have failed almost overnight due to CEO fraud and manipulated internal controls, even after passing prior exams.
Use the period before this rule finalizes pressure-test insider-activity monitoring, confirming that reporting requirements can't be sidestepped, and that dual control is enforced on high-risk transactions. Comments are due October 5.
Related: Insider Fraud: What It Is and How to Stay Vigilant in 2026
FDIC Reportedly Considering a Third-Party Standards Body for Bank Vendors
According to a term sheet, the FDIC is in early discussions about creating a Banking Industry Standards Development Organization, or BISDO: an independent body that would set uniform third-party vendor standards covering risk management, cybersecurity, BSA/AML, and consumer compliance. The goal is to let FIs rely on a single certified standard instead of each vetting the same vendors from scratch, which could help community banks without large third-party risk staff.
There's no official FDIC announcement, and meeting a BISDO standard wouldn't create a regulatory safe harbor. Who would run the organization, whether participation would be voluntary, and how it would be funded are all still open.
Related: TPRM 101: The Complete Guide to Vendor Risk Assessments
10 States Sue OCC Over Escrow Interest Preemption
A coalition of 10 states filed suit on August 11 to vacate two OCC rules from May that assert federal preemption over state interest-on-escrow laws for national banks, arguing the OCC used one rule to establish a broad bank power, then a second to knock out state law based on a conflict the agency created. The rules work in two steps: the first confirms banks' discretion over their escrow account terms, including whether to pay interest, and the second preempts any state law restricting that discretion, reaching 14 states and territories, including New York and California.
The stakes reach further than escrow interest. This is really a test of how far federal preemption can extend against state consumer protection laws, and it's part of a broader pattern of the same state coalition challenging federal preemption moves this year.
Issues Affecting Credit Unions
NCUA Finalizes First Batch of Deregulation Project Rules
The NCUA approved 11 final rules on August 5, the first completed batch from its ongoing Deregulation Project. The rules published in the Federal Register on August 6 and take effect on September 8.
Sort these into two piles before you dig in. Most of the 11 are non-substantive cleanup: removing duplicative cross-references and outdated interpretive rulings that don't change your credit union’s daily operations. Seven of the 11 carry real relief and deserve closer attention. If you have Ncomply, you can route each rule to the appropriate business unit using the reg updates area, where they’re already broken out individually.
One rule worth flagging: the final rule removes 12 CFR 701.21(h), which had capped how much a federally insured credit union could hold in indirect vehicle loans serviced by a third party at 50% of net worth, rising to 100% only after 30 months of experience with that servicer. Both limits are gone now.
Key Takeaways
Your indirect auto concentration limit is now whatever your policy says it is, since the agency transferred that judgment to your board. If you inherit the old 50% threshold by default without a documented rationale, get that rationale from the board soon. Examiners will still want to know how you arrived at that number, even with the regulatory ceiling gone.
John Crews Sworn in as NCUA Chairman
John Crews is NCUA's new chairman, replacing Kyle Hauptman, who served for almost six years. He came to the NCUA from the Treasury Department, where he was Deputy Assistant Secretary for Financial Institutions Policy. Crews' term runs through August 2031.
His stated priorities are safeguarding member-owner interests, regulatory efficiency, a strong Share Insurance Fund, and access to affordable financial services, which reads as continuity with the prior chairman's direction.
Crews is also still the only sitting member of a board built for three, as two board members were removed in 2025. For now, one person with a term running to 2031 holds chartering authority, field of membership policy, the exam program, the deregulation agenda, and the Share Insurance Fund. If you're working on a community charter conversion or a field of membership expansion over the next two years, your approval path runs through a single desk, with no second vote and no published dissent to read for signal.
Final Thoughts
Federal agencies spent September narrowing supervisory reach, from a redefined "unsafe or unsound practice" standard to a newly permanent beneficial ownership exemption. States and courts pushed back just as hard, proving that less federal oversight in one place doesn't mean less scrutiny everywhere.
Is your compliance budget keeping pace with new rulemaking and litigation? Our new webinar can help you make the case to your exec team.
