Regulations & Policy
At Money20/20, Wells Fargo executive Faraz Shafiq detailed the bank's strategy to fundamentally transform operations with AI, centered on four core components: a hub-and-spoke operating model, prioritizing highest-impact use cases, moving fast with discipline, and upskilling its 197,000 employees. Shafiq highlighted tangible results, including a 40% boost in product sales rates from banker intelligence capabilities and a custom small language model for fraud detection, as the bank aims to differentiate through proprietary data and insights.
The Federal Deposit Insurance Corp. has amended its directive against Old Glory Bank, noting that the Elmore City, Oklahoma-based lender is now 'adequately capitalized.' The regulator had labeled the bank 'significantly undercapitalized' in August and ordered a capital restoration plan. The amended directive, issued last Tuesday and published Friday, allows Old Glory to boost Tier 1 capital through stock sales or contributions but requires FDIC review of securities offerings. The bank must also obtain FDIC approval for material transactions and is restricted from certain capital distributions and brokered deposits. The order remains effective until Old Glory has been adequately capitalized for four consecutive quarters after Sept. 30.
Sen. Elizabeth Warren sent a letter to Attorney General Todd Blanche urging the Justice Department to conduct a full criminal investigation and potentially prosecute Bank of America and its executives for willful violations of the Bank Secrecy Act and sanctions laws. Warren criticized $1.21 billion in recent penalties from FinCEN, OCC, and OFAC as inadequate, noting the bank admitted to failing to report over $5 billion in suspicious activity from 2019 to 2023 and processed millions of dollars that violated sanctions and funded global terrorism. She highlighted the bank's prior cease-and-desist order and asked whether DOJ will investigate and coordinate with FinCEN, seeking a response by Nov. 12.
Ripple has obtained unconditional approval from the Office of the Comptroller of the Currency to launch a national trust bank, nearly a year after conditional approval. The charter allows Ripple to provide fiduciary digital-asset custody, manage reserves for its stablecoin RLUSD, and act as collateral trustee, though it cannot take deposits or lend commercially. Ripple also announced expanded collaboration with BNY to broaden institutional digital-asset custody and explore tokenized trade finance, and a strategic partnership with Robinhood to make RLUSD available across its digital-asset ecosystem. The news follows Ripple's lengthy legal battle with the SEC, which sued in 2020 alleging XRP was a security; a 2023 ruling imposed a $125 million penalty, and the SEC later sought to drop the case. Ripple has been on an acquisition spree in 2025, buying Hidden Road, Rail, and GTreasury.
In an interview at Money20/20, Piermont Bank CEO Wendy Cai-Lee discussed the challenges newly chartered fintechs face in achieving good CAMELS ratings and the need for disciplined risk management in bank-fintech partnerships. She highlighted Piermont's focus on deepening existing client relationships, its consent order with the FDIC, and the bank's recent fintech partnerships with BlxckPay and MassPay. Cai-Lee also noted the potential impact of AI on fintechs' value propositions.
Sen. Elizabeth Warren, D-MA, has called on the Federal Reserve, OCC, and FDIC to rescind recent policy changes that she contends restrict bank examiners' ability to address supervisory threats. In letters to Fed Vice Chair for Supervision Michelle Bowman, Comptroller of the Currency Jonathan Gould, and FDIC Chair Travis Hill, Warren argued that the September Fed update and August OCC/FDIC definition change narrow the circumstances under which examiners can act, potentially undermining cybersecurity standards. She cited a Texas Bankers Association survey showing increased cyberattacks and rising investments in cybersecurity, warning that limiting examiners' powers could leave the financial system more vulnerable to AI-enabled threats.
The OCC issued its final rule to implement the GENIUS Act, effective Jan. 18, providing long-awaited guidance for banks and OCC-regulated entities that hold, issue, and move stablecoins. The rule bans direct yield payments from stablecoin issuers but allows case-by-case evaluation of third-party reward arrangements. It does not address Bank Secrecy Act, anti-money laundering, or OFAC sanctions, which will be covered in a separate rulemaking with the Treasury. The OCC will later announce when it will accept applications and waiver requests. Treasury Secretary Scott Bessent called the rule a 'watershed moment,' while the ICBA raised concerns about risks to community bank lending.
At an Axios event in Las Vegas, FDIC Chair Travis Hill said AI agents moving deposits on behalf of customers is a major concern for banks and regulators, with questions about how many depositors will delegate decision-making and the impact on the deposit landscape. He noted that big banks like Citi, Bank of America, and JPMorgan Chase have blocked external AI agents, and that accountability questions remain. Hill also said revised model risk management guidance doesn't work well for agentic and generative AI, and the FDIC is considering seeking public input. The agency is using AI for efficiency in supervision and failed bank resolutions but wants to move faster.
Speaking at the Money20/20 conference in Las Vegas, Carole House, founder and CEO of Penumbra Strategies and a former Treasury Department official, said regulators can be slow to respond to innovation but industry often doesn't acknowledge its role in driving understanding. She stressed that collaboration is crucial to combat threats to the financial system, especially amid burgeoning technologies including blockchain and agentic commerce. House advocated for more timely enforcement, clarity of regulatory frameworks, and information sharing, drawing lessons from cyber to share information instantaneously. She also highlighted the need for investments in digital identity to address fraud and the authenticity crisis fueled by AI deepfakes.
Banks increasingly rely on interconnected systems like building controllers, surveillance cameras, and vendor-managed appliances, creating ownership gaps that complicate cybersecurity. A vulnerability in a branch controller may be known but not resolvable because security, facilities, IT, and external contractors each own only part of the problem. Regulations like NYDFS 23 NYCRR Part 500 require asset inventory policies that address ownership, location, and support expiration, highlighting the need to connect asset visibility with accountability. Continuous, intelligence-driven assessment and passive discovery can identify specialized equipment and provide context for prioritization. However, findings must reach the teams responsible for remediation. The combination of Armis Centrix™ and ServiceNow workflows helps route findings, coordinate remediation, and maintain records of decisions. A case study shows a global financial services organization discovered three to four times as many assets as its CMDB reflected, improving vulnerability prioritization. Closing the gap between knowing and doing requires connecting exposures to accountable teams, enabling defensible risk-reduction decisions.