To keep receiving your weekly insights, all you need to do is subscribe to our new Consumer Financial Services Weekly Newsletter — it’s quick and easy.
We’ll see you there!
To keep you informed of recent activities, below are several of the most significant federal events that have influenced the Consumer Financial Services industry over the past week.
Federal Activities:
On October 26, the Federal Communications Commission (FCC) published its revised Telephone Consumer Protection Act (TCPA) consent-revocation rules in the Federal Register, setting a firm implementation date of November 25, 2026, the day before Thanksgiving. That date replaces the January 31, 2027, effective date that had applied to portions of the FCC’s earlier revocation requirements. The order significantly revises the consent-revocation framework by allowing category-specific revocation for informational calls and texts, permitting callers to designate certain exclusive methods for revoking consent, and expanding the sources from which financial institutions may obtain telephone numbers for certain exempt informational communications, including fraud alerts. The FCC’s companion Further Notice of Proposed Rulemaking leaves additional changes on the table, including whether callers that use category-specific revocation should be required to offer consumers a one-step method to revoke consent to all future robocalls. Companies should prepare for the November 25 effective date while continuing to monitor that proceeding. For more information, click here.
On October 23, the U.S. Securities and Exchange Commission’s (SEC) Division of Examinations released its fiscal year 2027 Examination Priorities, which focus on emerging technology, cybersecurity, retail investor protection, and anti-money laundering (AML) compliance. The Division will scrutinize registrants’ use of “super intelligence” (SI) in areas such as investment analysis, trading, and compliance, assessing whether firms’ representations are accurate and whether their controls and algorithms are consistent with investor disclosures and investor profiles. On cybersecurity, examiners will review governance, access controls, incident response, and third-party service provider exposure, with attention to SI-generated phishing and deepfake threats and to compliance with Regulation S-P and Regulation S-ID. Broker-dealer examinations will continue to assess Regulation Best Interest compliance, particularly for complex and higher-risk products and for recommendations to older and vulnerable investors and those saving for retirement or college, and will evaluate whether AML programs are tailored, independently tested, and effective in meeting Suspicious Activity Report obligations, including risks tied to foreign omnibus accounts and Office of Foreign Assets Control sanctions. Because the priorities are not exhaustive and may shift in response to emerging risks, financial services firms should confirm that their compliance, cybersecurity, and supervisory controls have kept pace with new technologies, rather than treating the priorities as an examination checklist. For more information, click here.
On October 22, the U.S. Department of the Treasury issued proposed regulations implementing § 1001 of the 21st Century ROAD to Housing Act (ROAD to Housing Act), which restricts large institutional investors from purchasing single-family homes and codifies key requirements of Executive Order 14376. Beginning January 7, 2027, a large institutional investor, generally an entity engaged in the business of investing in, owning, renting, managing, or holding single-family homes with direct or indirect investment control over at least 350 such homes, may not purchase or contract to purchase a single-family home unless the purchase qualifies as an “excepted purchase.” The notice of proposed rulemaking (NPRM) would establish standards for build-to-rent programs and provide safe harbors for renovate-to-rent programs and for homeownership programs that give renters meaningful financial support toward buying a home. It would also clarify what it means to be engaged “in the business of” holding single-family homes, define when an entity may qualify as a passive investor, address purchases involving previously contracted debts, loss mitigation, and transfers between large institutional investors, and clarify how the maximum civil penalty is calculated when a single prohibited purchase involves more than one large institutional investor. Treasury states that the proposed approach is intended to provide clarity without unnecessary disruption to housing supply, homebuilding, rehabilitation activity, or capital formation. Comments are due within 30 days after publication in the Federal Register. For more information, click here.
On October 20, the National Credit Union Administration (NCUA) announced the 13th round of proposed regulatory changes under its Deregulation Project, an ongoing review intended to keep NCUA’s regulations focused on credit unions’ safety, soundness, and resilience. The three NPRMs would eliminate obsolete, unduly burdensome, or duplicative requirements. First, the NCUA Board proposes to remove the requirement in 12 CFR 741.3(a) that federally insured, state-chartered credit unions maintain a special reserve for certain nonconforming investments, along with related references in NCUA’s capital, investment, and insurance regulations. Second, the Board proposes to remove 12 CFR 741.7, which addresses maintaining federal share insurance after a federal credit union converts to a state charter, because the provision is outdated and duplicated by NCUA’s Chartering and Field of Membership Manual. Third, the Board proposes to revise 12 CFR 745.13 to give federally insured credit unions greater flexibility in how they notify members about share insurance coverage, replacing the current requirement to make certain materials available in hard copy. The Board states that the proposals would reduce burden and simplify compliance while maintaining safety and soundness. Comments may be submitted through the Federal Rulemaking Portal using the docket numbers for each proposal. For more information, click here.
On October 15, as part of Operation Economic Outcast, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued an alert asking financial institutions to report potential Iranian regime abuse of religious charity networks, including the diversion of religious tithes known as khums. Secretary of the Treasury Scott Bessent said the effort is meant to stop the regime from using religious institutions to enrich its elites and fund terrorism. The release states that the regime has abused ostensibly religious organizations in Iran and neighboring countries and co-opts khums payments from the global Shi’a community, sometimes through organizations collecting on behalf of ayatollahs with regime ties, and that these groups may use informal channels such as hawalas and cash couriers to move funds to Iran or Iran-linked actors. The alert lists red flag indicators, including charities or nonprofits that solicit donations but appear to provide no charitable services or openly support the regime or its terrorist proxies, large donations from unknown sources followed by significant transfers to other charities or nonprofits, behavior suggesting efforts to evade reporting or recordkeeping requirements, and customers who receive transfers from charities with no clear business relationship and then withdraw the funds in cash or send them onward. FinCEN also acknowledged that legitimate charities should have access to financial services and reminded banks to apply a risk-based approach to customer due diligence for charities and other nonprofit customers, as described in the Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-Profit Organizations. For more information, click here.
On September 23, Greg Ruppert, Chief Regulatory Operations Officer of the Financial Industry Regulatory Authority (FINRA), published an update on the consolidation of FINRA’s member supervision, market oversight, and enforcement functions into a unified Regulatory Operations department. The consolidation began at the end of 2025 and was completed this summer. The new department has five core functions: Risk and Intelligence, Examinations, Surveillance, Investigations, and Enforcement. Shared support services now serve all five. Ruppert says the structure is meant to reduce complexity, eliminate duplicative or uncoordinated oversight and requests to member firms, and let information flow across teams so FINRA can spot trends and intervene earlier. He describes a multiyear effort to update business processes and technology, including GenAI capabilities. He also says the new structure positions FINRA to address many recommendations in a July report on its enforcement function by outside experts Professor Paul R. Eckert and former SEC Commissioner Troy A. Paredes. For member firms, FINRA highlights tools such as the annual Regulatory Oversight Report, peer-comparison data, an expanded Rapid Remediation program, Threat Intelligence Products, the Cyber & Operational Resilience program, the Financial Intelligence Fusion Center, and free access to its Financial Crimes and Cybersecurity Conference. FINRA also reports efficiency gains. In 2025 compared with 2024, policy-driven trade blotter requests fell 64%, 8210 requests fell 30%, and total external data requests fell 12%. Bluesheet requests are down 70% since 2022. FINRA is also piloting a centralized internal library of firms’ Written Supervisory Procedures to limit repeat requests. For more information, click here.
State Activities:
On October 20, the New York City Department of Consumer and Worker Protection (DCWP) released proposed rules to prohibit deceptive and unconscionable trade practices prevalent in automated customer service. The proposal would also clarify that no person can avoid liability under local law by claiming a particular technology made the representations, omitted information, committed the violative act, or assisted in it. Under the proposed rules, merchants that use automated customer service systems must clearly disclose at the start of an interaction that the consumer is not dealing with a human. Merchants would also be barred from representing that customer service is available through a given channel when it is not, or from promising customer service and then repeatedly and unreasonably directing consumers to unhelpful menus or unresponsive, irrelevant, or erroneous information. The rules would create a rebuttable presumption of a deceptive and unconscionable practice when a merchant uses an automated system without giving consumers a single-step transfer to a human representative or one of several specified alternative means of reaching one. Merchants would also have to keep records demonstrating compliance for at least three years, and the proposal includes a penalty schedule with first-violation penalties of $525, rising to $1,050 for a second violation and $3,500 for a third or subsequent violation. DCWP will hold a public hearing at 11 a.m. on November 19, 2026, and comments must be submitted on or before that date. For more information, click here.
On October 19, the Michigan Department of Insurance and Financial Services (DIFS) entered a consent order with West Michigan Private Capital Fund I, LLC, doing business as Benchmark Capital Finance, resolving alleged violations of Regulation X, the Federal Trade Commission’s (FTC) Safeguards Rule, and Michigan’s Mortgage Brokers, Lenders, and Servicers Licensing Act. The company accepted the allegations and agreed to cease and desist from violations of Regulation X and the Michigan statute, pay a $15,000 civil fine, complete implementation of its servicing software platform, The Mortgage Office, by October 31, and provide DIFS with specified servicing records by November 15. The order also requires the company, for two years, to retain an independent third party to conduct compliance audits every six months covering Regulation X escrow requirements, Regulation Z servicing requirements, FTC Safeguards Rule requirements, and NMLS filing requirements, with audit-related records retained for five years and made available to DIFS upon request. For more information, click here.
On October 15, California’s Business and Consumer Services Agency (BCSA) and Department of Financial Protection and Innovation (DFPI) ordered financial institutions to report on how they are handling insurance payouts for survivors of the Eaton and Palisades fires. The agencies are investigating whether lenders have delayed payments, failed to provide a timely appeal process for decisions about releasing funds, or held insurance money after a loan was fully paid. Firms that fail to comply may face enforcement under state and federal consumer protection laws. The action follows survivor reports of delays in the release of insurance funds that mortgage lenders hold in escrow during construction. In July, Governor Gavin Newsom wrote to associations representing banks, credit unions, and mortgage lenders about those concerns and directed BCSA and DFPI to collect complaints. The mandatory report requires licensees to disclose the size and distribution of insurance proceeds they received for property loss or damage, including personal property and living expenses. They must also explain in writing whether all funds were disbursed, how long disbursement took, and why any funds were delayed or withheld, as of September 30, 2026. Since January 2025, DFPI has received more than 160 confidential consumer complaints about delays or other problems with insurance disbursements, and it has resolved many of them. Separately, AB 493, signed in August 2025, requires lenders to pay homeowners the interest earned on escrowed post-loss insurance proceeds, in the same way they do for other escrowed property expenses. For more information, click here.
On October 15, Brad Robinson, senior director for cybersecurity policy and supervision at the Conference of State Bank Supervisors (CSBS), the nationwide organization of state banking and financial regulators, published a piece warning that financial institutions must sharpen their cybersecurity focus as adversaries adopt AI. CSBS identifies three main areas of concern. First, AI-driven vulnerability discovery, including zero-days, proof-of-concept exploits, and vulnerability chaining, will increase patch volume and strain smaller institutions and their service providers, and faster patching alone will not be enough. Second, AI makes social engineering, phishing, vishing, and deepfakes more efficient and effective, partly by automating victim reconnaissance at a speed and scale no human can match. Third, AI is automating the design, development, and deployment of malware, including new malware families that adapt to the environments they enter and ransomware-as-a-service platforms that reportedly use AI, which lowers the barrier for less sophisticated actors. In response, CSBS outlined nine recommendations drawn from FS-ISAC, the European Central Bank, and other sources. They focus on strengthening the security perimeter, shortening patching timelines, validating asset inventories, replacing end-of-life technology, enforcing strong access controls, governing open-source software, using AI for defense, verifying third-party risk management, and building and testing incident response capabilities. CSBS urges all institutions to review its December 2025 Cyber Hygiene Fundamentals for Financial Institutions and its Ransomware Self-Assessment Tool now to prepare for the evolving threat environment. For more information, click here.