Latest Compliance News

Federal Reserve Board requests public input on “payment account,” which eligible financial institutions could use for the limited purpose of clearing and settling their payments

The company also appointed an alum of SoFi, Green Dot and Goldman Sachs to serve as CEO of the proposed bank. The move comes after the OCC approved five crypto firms for a different type of charter.

The party-line vote puts permanent leaders atop the two financial regulatory agencies.

This notice informs the public of the National Credit Union Administration's (NCUA's) proposal to modify system of records notice NCUA-19. This system of records serves as the core financial and acquisition system and integrates NCUA's program, financial, and budgetary information.

The Rules of Practice for Adjudication Proceedings govern adjudication proceedings conducted by the Consumer Financial Protection Bureau (CFPB). This final rule rescinds certain amendments it adopted to the Rules of Practice on February 22, 2022, and March 29, 2023 (2022 and 2023 amendments).

Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites that foist scams and malware. A lookalike domain to the FBI Internet Crime Complaint Center website, returned a non-threatening parking page (left) whereas a mobile user was instantly directed to deceptive content in October 2025 (right). Image: Infoblox. When Internet users try to visit expired domain names or accidentally navigate to a lookalike “typosquatting” domain, they are typically brought to a placeholder page at a domain parking company that tries to monetize the wayward traffic by displaying links to a number of third-party websites that have paid to have their links shown. A decade ago, ending up at one of these parked domains came with a relatively small chance of being redirected to a malicious destination: In 2014, researchers found (PDF) that parked domains redirected users to malicious sites less than five percent of the time — regardless of whether the visitor clicked on any links at the parked page. But in a series of experiments over the past few months, researchers at the security firm Infoblox say they discovered the situation is now reversed, and that malicious content is by far the norm now for parked websites. “In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the ‘click’ was sold from the parking company to advertisers, who often resold that traffic to yet another party,” Infoblox researchers wrote in a paper published today . Infoblox found parked websites are benign if the visitor arrives at the site using a virtual private network (VPN), or else via a non-residential Internet address. For example, Scotiabank.com customers who accidentally mistype the domain as scotaibank[.]com will see a normal parking page if they’re using a VPN, but will be redirected to a site that tries to foist scams, malware or other unwanted content if coming from a residential IP address. Again, this redirect happens just by visiting the misspelled domain with a mobile device or desktop computer that is using a residential IP address. According to Infoblox, the person or entity that owns scotaibank[.]com has a portfolio of nearly 3,000 lookalike domains, including gmai[.]com , which demonstrably has been configured with its own mail server for accepting incoming email messages. Meaning, if you send an email to a Gmail user and accidentally omit the “l” from “gmail.com,” that missive doesn’t just disappear into the ether or produce a bounce reply: It goes straight to these scammers. The report notices this domain also has been leveraged in multiple recent business email compromise campaigns, using a lure indicating a failed payment with trojan malware attached. Infoblox found this particular domain holder (betrayed by a common DNS server — torresdns[.]com) has set up typosquatting domains targeting dozens of top Internet destinations, including Craigslist , YouTube , Google , Wikipedia , Netflix , TripAdvisor , Yahoo , eBay , and Microsoft . A defanged list of these typosquatting domains is available here (the dots in the listed domains have been replaced with commas). David Brunsdon , a threat researcher at Infoblox, said the parked pages send visitors through a chain of redirects, all while profiling the visitor’s system using IP geolocation, device fingerprinting, and cookies to determine where to redirect domain visitors. “It was often a chain of redirects — one or two domains outside the parking company — before threat arrives,” Brunsdon said. “Each time in the handoff the device is profiled again and again, before being passed off to a malicious domain or else a decoy page like Amazon.com or Alibaba.com if they decide it’s not worth targeting.” Brunsdon said domain parking services claim the search results they return on parked pages are designed to be relevant to their parked domains, but that almost none of this displayed content was related to the lookalike domain names they tested. Samples of redirection paths when visiting scotaibank dot com. Each branch includes a series of domains observed, including the color-coded landing page. Image: Infoblox. Infoblox said a different threat actor who owns domaincntrol[.]com — a domain that differs from GoDaddy’s name servers by a single character — has long taken advantage of typos in DNS configurations to drive users to malicious websites. In recent months, however, Infoblox discovered the malicious redirect only happens when the query for the misconfigured domain comes from a visitor who is using Cloudflare’s DNS resolvers (1.1.1.1), and that all other visitors will get a page that refuses to load. The researchers found that even variations on well-known government domains are being targeted by malicious ad networks. “When one of our researchers tried to report a crime to the FBI’s Internet Crime Complaint Center (IC3), they accidentally visited ic3[.]org instead of ic3[.]gov,” the report notes. “Their phone was quickly redirected to a false ‘Drive Subscription Expired’ page. They were lucky to receive a scam; based on what we’ve learnt, they could just as easily receive an information stealer or trojan malware.” The Infoblox report emphasizes that the malicious activity they tracked is not attributed to any known party, noting that the domain parking or advertising platforms named in the study were not implicated in the malvertising they documented. However, the report concludes that while the parking companies claim to only work with top advertisers, the traffic to these domains was frequently sold to affiliate networks, who often resold the traffic to the point where the final advertiser had no business relationship with the parking companies. Infoblox also pointed out that recent policy changes by Google may have inadvertently increased the risk to users from direct search abuse. Brunsdon said Google Adsense previously defaulted to allowing their ads to be placed on parked pages, but that in early 2025 Google implemented a default setting that had their customers opt-out by default on presenting ads on parked domains — requiring the person running the ad to voluntarily go into their settings and turn on parking as a location.

PRESS RELEASE | DECEMBER 16, 2025 FDIC Approves the Deposit Insurance Application for Erebor Bank, N.A., Columbus, Ohio WASHINGTON – The Board of Directors of the Federal Deposit Insurance Corporation (FDIC) today approved a deposit insurance application to establish Erebor Bank, N.A. (Erebor Bank), a newly chartered national bank to be headquartered in Columbus, Ohio. The organizers of Erebor Bank applied to the Office of the Comptroller of the Currency for a national bank charter and received preliminary conditional approval on October 15, 2025. Erebor Bank’s proposed business model will focus on providing deposit and lending products to businesses and individuals in the technology, payment systems, investment, and defense industries, including virtual currency market participants. Applications for deposit insurance are evaluated under a statutory framework of seven factors that include: the financial history and condition of the institution; the adequacy of the institution's capital structure; the future earnings prospects of the institution; the general character and fitness of the management of the institution; the risk presented by the institution to the Deposit Insurance Fund; the convenience and needs of the community to be served by the institution; and whether the institution's corporate powers are consistent with the purposes of the Federal Deposit Insurance Act. FDIC staff found that Erebor Bank satisfied the statutory factors for approval, subject to certain conditions. Among other conditions, Erebor Bank will be required to implement protocols to comply with the FDIC’s regulations regarding processing of deposit accounts in the event of a bank failure, to maintain a minimum 12 percent tier 1 leverage ratio during its first three years of operation, and, in the event it ceases to be considered “well capitalized” or falls below the minimum capital levels required by its primary Federal regulator, to exercise its rights under its Capital Call Agreement to obtain at minimum the amount of capital necessary to be considered “well capitalized.” The FDIC Board’s approval order expires if Erebor Bank is not established within 12 months, unless extended by the FDIC. ATTACHMENTS: Deposit Insurance Approval Order # # # MEDIA CONTACT: [email protected] The FDIC does not send unsolicited email. If this publication has reached you in error, or if you no longer wish to receive this service, please unsubscribe . CONNECT WITH US

BOARD MEETING | DECEMBER 16, 2025 FDIC Board of Director's Meeting Today, the Federal Deposit Insurance Corporation's Board of Directors met in open and closed sessions. Materials and information relative to the open Board actions are available on the  Board Matters webpage . Items Addressed in Open Session: 2026 Operating Budget Press Release Interim Final Rule: Amendment to Special Assessment Collection Press Release Financial Institution Letter Notice of Proposed Rulemaking: Approval Requirements for Issuance of Payment Stablecoins by Subsidiaries of FDIC-Supervised Insured Depository Institutions Press Release Financial Institution Letter Final Rule: Establishment and Relocation of Branches and Offices Press Release Financial Institution Letter Approval of the 2026-2030 FDIC Strategic Plan, as a Successor to the 2022-2026 FDIC Strategic Plan A recording of the full webcast of the open session  is available. Board Materials The FDIC does not send unsolicited email. If this publication has reached you in error, or if you no longer wish to receive this service, please unsubscribe . CONNECT WITH US

Agencies announce dollar thresholds for smaller loan exemption from appraisal requirements for higher-priced mortgage loans

Agencies announce dollar thresholds for applicability of truth in lending and consumer leasing rules for consumer credit and lease transactions

The OCC, the Board, and the Bureau are finalizing amendments to the official interpretations for their regulations that implement section 129H of the Truth in Lending Act (TILA) based on the CPI-W in effect as of June 1, 2025.

Based on the annual percentage increase in the CPI-W as of June 1, 2025, the exemption threshold for consumer credit transactions in Regulation Z will increase from $71,900 to $73,400 effective, January 1, 2026.

Based on the annual percentage increase in the CPI-W as of June 1, 2025, the exemption threshold for consumer leases in Regulation M will increase from $71,900 to $73,400 effective January 1, 2026.

The Consumer Financial Protection Bureau is required to calculate annually the dollar amount of the maximum allowable charge for disclosures by a consumer reporting agency to a consumer pursuant to section 609 of the FCRA; this final rule establishes the maximum allowable charge for the 2026 calendar year.

The Bureau is required to calculate annually the dollar amounts for several provisions in Regulation Z; this final rule revises dollar amounts for certain provisions implementing TILA and amendments to TILA.

The CFPB and the FRB are announcing the dollar thresholds used to determine whether certain consumer credit and lease transactions in 2026 are subject to certain protections under Regulation Z (Truth in Lending) and Regulation M (Consumer Leasing).

The CFPB, FRB, and OCC are announcing that the 2026 threshold for higher-priced mortgage loans that are subject to special appraisal requirements will increase from $33,500 to $34,200.

SUNSHINE ACT MEETING NOTICE The FDIC Board of Directors will meet in an open session: Date and Time: Tuesday, December 16, 2025, at 10:00 a.m. ET Place:  The Board meeting will be open to public observation by webcast . Members of the media should contact the Office of Communications by Monday, December 15, at [email protected] to attend in person from FDIC Headquarters, 550 17th Street, NW, Washington, DC. Read Notice & Agenda The FDIC does not send unsolicited email. If this publication has reached you in error, or if you no longer wish to receive this service, please unsubscribe . CONNECT WITH US

The National Credit Union Administration (NCUA) will submit the following information collection requests to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act of 1995, on or after the date of publication of this notice.

STATEMENT | DECEMBER 11, 2025 Statement by FDIC Acting Chairman Travis Hill at the December 2025 Meeting of the Financial Stability Oversight Council The FDIC remains hard at work to improve its supervisory and regulatory approach across an array of issues, while still continuing to fulfill our core mission of insuring deposits, promoting the safety and soundness of banks, and resolving failed institutions. At the last FSOC meeting in September, I detailed a number of actions we had taken earlier this year, or were planning to take in the coming months, to execute on these goals.[1] Since September, our progress has continued, including: Issuing a notice of proposed rulemaking (NPR), jointly with the OCC, that would define “unsafe or unsound practice” for purposes of Section 8 of the Federal Deposit Insurance Act and “matters requiring attention” (MRAs), and set up a new framework for issuing nonbinding supervisory observations;[2] Issuing an NPR, jointly with the OCC, that would prohibit examiners from (1) criticizing or taking adverse action against banks on the basis of reputational risk or (2) requiring, instructing, or encouraging an institution to close accounts or take certain other actions on the basis of a customer’s political, social, cultural, or religious views or beliefs, among other reasons;[3] Rescinding Biden-era guidance on climate-related financial risks;[4] Issuing a final rule raising and indexing 37 asset-based thresholds, most of which apply to audit, internal control, and related reporting requirements, providing meaningful relief for community banks;[5] Issuing an NPR, jointly with the OCC and Federal Reserve, that would amend the Community Bank Leverage Ratio (CBLR) to expand the universe of eligible institutions and encourage broader adoption;[6] Issuing a final rule, jointly with the OCC and Federal Reserve, to modify the enhanced supplementary leverage ratio, to ensure it more frequently serves as a backstop to risk-based capital standards;[7] Launching a number of initiatives to improve our resolution capabilities, including a pilot program for expanded nonbank participation in the failed bank bidding process;[8] Implementing a revised examination cycle that reduces the frequency of compliance examinations for most small banks;[9] Conducting reviews of potential debanking in response to the President’s Executive Order on politicized or unlawful debanking;[10] and Withdrawing from the 2013 interagency leveraged lending guidance, replacing it with general principles for safe and sound lending, to promote more bank lending to businesses that drive economic growth.[11] We continue to have a busy agenda for the upcoming months, which includes additional steps to reform supervision, such as CAMELS reform and updates to our examination manuals; implementation of the GENIUS Act; a reproposal of the 2017 Basel agreement; and an interagency proposal to reform the BSA Program Rule, among many other items. I thank my fellow Council members for their continued collaboration on these and other issues, and Secretary Bessent for his leadership. [1] See Travis Hill, Statement, Meeting of the Financial Stability Oversight Council (Sept. 10, 2025). [2] Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Unsafe or Unsound Practices, Matters Requiring Attention , 90 Fed. Reg. 48,835 (Oct. 30, 2025). [3] Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Prohibition on Use of Reputation Risk by Regulators , 90 Fed. Reg. 48,825 (Oct. 30, 2025). [4] Press Release, Federal Deposit Insurance Corporation, Agencies Announce Withdrawal of Principles for Climate-Related Financial Risk Management (Oct. 16, 2025). [5] Federal Deposit Insurance Corporation, Adjusting and Indexing Certain Regulatory Thresholds , 90 Fed. Reg. 55,789 (Dec. 4, 2025). [6] Office of the Comptroller of the Currency, Federal Reserve System, Federal Deposit Insurance Corporation, Regulatory Capital Rule: Revisions to the Community Bank Leverage Ratio Framework , 90 Fed. Reg. 55,048 (Dec. 1, 2025). [7] Office of the Comptroller of the Currency, Federal Reserve System, Federal Deposit Insurance Corporation, Regulatory Capital Rule: Modifications to the Enhanced Supplementary Leverage Ratio Standards for U.S. Global Systemically Important Bank Holding Companies and Their Subsidiary Depository Institutions; Total Loss Absorbing Capacity and Long-Term Debt Requirements for U.S. Global Systemically Important Bank Holding Companies , 90 Fed. Reg. 55,248 (Dec. 1, 2025). [8] See Travis Hill, Resolution Readiness and Lessons Learned from Recent Large Bank Failures (Oct. 15, 2025) (“On a go-forward basis, we have developed a pre-qualification process for nonbank bidders, with the intent of qualifying nonbank bidders in advance of any offering. The FDIC plans to pilot this qualification process with bidders who participated in the bidding process for the April 2024 failure of Republic First Bank and the 2023 asset sales following the failure of Signature Bank, as well as with other nonbank firms that have expressed interest in pre-failure loan sales. This pilot process will start in January 2026 and will be revised based on feedback. The FDIC expects to publicly release the pre-failure qualification process and application after receiving feedback from the pilot program.”). [9] Federal Deposit Insurance Corporation, FDIC Updates its Consumer Compliance Examination Schedule , FIL-52-2025 (Nov. 7, 2025).  Most banks with between $350 million and $3 billion in assets now have a compliance exam approximately once every five years with a midcycle review, and most banks with less than $350 million in assets now have a compliance exam approximately once every six years with a midcycle review. [10] Executive Order 14331, Guaranteeing Fair Banking for All Americans , 90 Fed. Reg. 38,925 (Aug. 12, 2025) . [11] Press Release, Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Interagency Statement on OCC and FDIC Withdrawal from the Interagency Leveraged Lending Guidance Issuances (Dec. 5, 2025). The FDIC does not send unsolicited email. If this publication has reached you in error, or if you no longer wish to receive this service, please unsubscribe . CONNECT WITH US

The NCUA Board (Board) is proposing to remove Appendix B to part 748, Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice. Appendix B was issued in June 2005. Its purpose was to provide federally insured credit unions (FICUs) with guidance for creating programs to address and respond to instances of unauthorized access to member information. The Board now believes that the placement of Appendix B in the Code of Federal Regulations (CFR) may be confusing because Appendix B itself is guidance to assist FICUs in developing the response programs required pursuant to regulation. The Board instead would publish the content of Appendix B as guidance. This will be a better vehicle for conveying and updating this information and will help to streamline NCUA's regulations.