Souzan Esmaili

The OCC and FDIC have issued a joint notice of proposed rulemaking to remove ‘reputational risk’ as a standalone supervisory category and align supervision more closely with material safety and soundness risks. The agencies stated that the proposal is intended to focus supervision on measurable prudential risk. Highlights: Proposed Rule 1)-The proposed rule would prohibit the agencies from criticizing, formally or informally, or taking adverse action against an institution or any employee of an institution on the basis of reputation risk. 2)-The proposed rule would also prohibit the agencies from requiring, instructing, or encouraging an institution to close customer accounts or take other actions on the basis of a person or entity’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of politically disfavored but lawful business activities perceived to present reputation risk. 3)-The proposed rule would not impose requirements or obligations on supervised institutions. 4)-Comments on the proposed rule are due 60 days after the date of publication in the Federal Register.

1

Financial institutions are facing more pressure than ever to manage risk responsibly. With OSFI’s new Guideline E-23 on Model Risk Management, financial institutions are entering a new era of accountability and transparency requirements. The guideline expands model governance into an enterprise-wide framework that requires institutions to inventory, validate, and monitor all material models – including those driven by AI and machine learning – throughout their lifecycle. It underscores the importance of strong oversight and reliable data management as AI becomes central to everyday decision-making. At ISA Cybersecurity, we help financial organizations prepare for what’s next. From enhancing governance frameworks and risk controls to building resilient cyber and data protection programs, we make it easier for institutions to stay compliant while maintaining customer trust. Our team brings the expertise, technology, and strategic insight needed to simplify regulatory change and strengthen every layer of your digital infrastructure. Model risk is no longer just a compliance issue; it is a business one. Speak to one of our cyber experts to learn how we help financial institutions stay ahead of evolving regulations and cyber threats. #ISACybersecurity #FinancialServices #OSFI #E23 #RiskManagement #Compliance #Governance #AI

9

RegTech Analyst news you can't afford to miss from yesterday - Six steps to achieve AML data excellence - How Comply Exchange Ltd simplifies tax compliance - AI transforms tax compliance for financial institutions - moneypool taps Flagright to boost transaction safety - What Canada’s FATF evaluation means for compliance teams Alessa Ashley Hunter Joseph Ibitola Madhu G Nadig Napier AI Mariya Pattara Evelyn Wright TAINA Technology Limited Lé-Anne Voges

9

1 Comment

The Canadian Financial Crime Academy (CFCA) is pleased to announce the launch of two new professional certifications designed to address the evolving demands of the global financial crime landscape: the Financial Crime Compliance Specialist (FCCS) and the Financial Crime Investigation Specialist (FCIS). While the FCCS and FCIS certifications are complementary, they are intentionally distinct in purpose, focus, and professional application. The FCCS is a compliance and governance credential. It is designed for professionals responsible for preventing financial crime by building, managing, and overseeing compliance frameworks. The emphasis is on risk-based controls, regulatory obligations, ethics, accountability, and governance structures. FCCS supports professionals who must demonstrate that their organization’s compliance program is effective, proportionate, and defensible. The FCIS, by contrast, is an investigation and analysis credential. It is designed for professionals who need to understand how financial crime occurs, how it is detected, and how it is investigated once suspected. The emphasis is on investigative techniques, financial analysis, intelligence development, evidence handling, and reporting. In practical terms, FCCS aligns most closely with second-line compliance and oversight roles, while FCIS aligns with investigative, analytical, and enforcement-focused roles. Together, they reflect the full financial crime lifecycle - from prevention and control to detection, investigation, and response. #aml #fraud #bribery #corruption #edd #kyc #financialcrime #financialcrimes #fcis #fccs #CFCP #cfca #casinogaming #arts #sanctions #tbml https://lnkd.in/eX_KZkzD

9

🇨🇦 FINTRAC 2025 Wrapped: What Changed and How We Keep It Simple for You As 2025 comes to a close, FINTRAC’s latest updates have made Canada’s AML framework clearer and more structured. Key themes this year: - Clearer guidance for risk-based controls - More structured expectations around ownership transparency - More streamlined approaches to reporting and record-keeping - Continued emphasis on well-documented, operational processes Regulation keeps evolving - but for Connectro clients, the experience stays straightforward. As a licensed Canadian MSB, we balance both sides: ✨ strict where regulators need us to be, simple where clients expect us to be. We build compliance directly into our flows, so complexity stays on our side, not yours. 2025 brought more clarity. We’re ready to turn 2026 into more opportunity🌟🎇 #FINTRAC #MSB #Canada #AML #Fintech

16

📌 From AML Policy to Practice: Three Lessons from Recent FINTRAC Enforcement 📌 Could your business demonstrate how it handles a suspicious attempted transaction even when no money changes hands? A recent FINTRAC enforcement action gives Canadian compliance teams a useful reason to examine that question. On September 3, FINTRAC announced a C$231,826 administrative monetary penalty against Nova Scotia Gaming Corporation, imposed on July 23, 2026. The findings concerned suspicious attempted-transaction reporting, written compliance policies and documented money laundering and terrorist financing risk assessments. The corporation paid the penalty in full, and the case is closed. Read FINTRAC’s announcement. For Canadian reporting entities, the case offers three practical review points. 1. ❗ Include attempted transactions in your review An interrupted or declined transaction can still contain information that warrants escalation. Staff should understand how to record the circumstances and refer concerns for a reporting assessment. Practical step: Walk through a recent declined transaction. Can you trace the concern, escalation and documented decision? 2. ❗ Make policies usable in everyday work A useful compliance procedure helps staff decide what to do next: what information to collect, whom to contact and how to document the outcome. Practical step: Ask a frontline employee to explain the escalation process using the current policy. Identify unclear instructions and confirm the document’s approval and review history. 3. ❗ Connect risk assessments to controls A risk assessment should help explain why a business applies particular controls to its customers, services and activities. Practical step: Select one material risk in your assessment. Trace it to a control, an accountable owner and evidence that the control operates. ✅ Today’s takeaway These are suggested internal review steps, not additional requirements announced by this enforcement action. A focused file review can help teams see whether their procedures produce clear decisions and reliable records. Start with one transaction and follow the evidence from the first concern through to the final outcome. Which part of that process is hardest to demonstrate in your organization: escalation, decision-making or documentation? Fortis Compliance Shield Partners Trustable and affordable support #AML #FINTRAC #Compliance #FinancialCrime #Canada

2

Operational resilience is more than “checking the box.” A new joint report from RMA’s Toronto Chapter and OSFI distills how banks can turn regulatory expectations into practical advantage: Start with a strong operational risk foundation; map truly critical services (and their third parties); define and test disruption tolerances; and make resilience a cross-functional habit, not a project. If you’re aiming for readiness that goes beyond compliance, this quick read offers playbook-level takeaways you can use now: https://lnkd.in/gZZVh-Pv

3