Securities Regulatory Roundup | August-September 2026

FINRA proposed amendments to Rules 2165 and 4512 and proposed new Rule 2166, which would expand the tools available to member firms when they reasonably believe a customer is being targeted by fraud. The proposal would modernize trusted-contact practices, expand the potential duration of holds in certain suspected financial-exploitation matters, and establish a framework for temporarily delaying transactions or disbursements when any adult customer may be the target of fraud.

Current Rule 2165 focuses on temporary holds involving specified adults, including seniors and other vulnerable adults. The proposed framework would broaden the circumstances in which a firm could intervene, reflecting the growth and increasing sophistication of scams targeting customers across age groups.

FINRA released guidance highlighting effective cybersecurity practices built around principles that can be scaled to firms of different sizes and business models. The guidance reinforces the importance of risk-based governance, access controls, incident preparedness, employee awareness, third-party oversight, and documentation. Cybersecurity continues to be both a technology and supervisory concern — firms must not only implement appropriate safeguards but also demonstrate how risks are identified, assigned, monitored, escalated, and remediated.

FINRA warned firms that improperly configured Microsoft Power Pages portals could expose information stored in Microsoft Dynamics 365 environments, including customer and employee personally identifiable information. The alert demonstrates how a technical configuration issue can develop into a regulatory, privacy, and supervisory risk: internet-facing portals may create unintended exposure when access controls, permissions, or data connections are not configured and tested appropriately.

FINRA imposed a $20 million fine involving failures to establish and implement an AML program reasonably designed to detect and cause the reporting of suspicious transactions involving foreign-currency wires. The matter also involved customer due diligence failures and the untimely detection and reporting of suspicious customer activity, reinforcing the expectation that AML programs account for the specific customers, products, transactions, and geographic risks present in a firm’s business.

FinCEN separately imposed a $125 million penalty for willful Bank Secrecy Act violations, described as its largest penalty against a broker-dealer to date. Together with the FINRA matter, the action demonstrates continued regulatory scrutiny of whether broker-dealer AML programs operate effectively in practice — deficiencies involving customer due diligence, monitoring, escalation, written procedures, and supervisory oversight can become interconnected rather than remaining isolated compliance issues.

Firms should use recent enforcement activity to evaluate whether their AML risk assessments, monitoring systems, investigation processes, staffing, training, and governance structures remain appropriate for their current business.

The SEC released its 2026 rulemaking agenda, identifying regulatory initiatives that could materially affect broker-dealers, investment advisers, investment companies, issuers, and market-infrastructure participants. Areas identified for potential action include:

• Digital assets and crypto-asset regulation
• Broker-dealer and market-structure modernization
• The Consolidated Audit Trail
• Investment-adviser custody and recordkeeping
• Form PF
• Transfer Agent regulation
• Corporate disclosure and capital formation
• Executive compensation and shareholder proposals

The agenda includes both pre-rule and proposed rulemaking activity. It therefore identifies areas in which future change may occur, rather than establishing immediate compliance obligations.

The SEC proposed a tailored offering framework for certain crypto-asset investment contracts and continued considering broader regulatory questions involving digital-asset custody, disclosures, trading activity, intermediary obligations, and investor protection. The proposal reflects the SEC’s continuing effort to determine how existing securities-law principles should apply to digital assets while considering whether more tailored registration and disclosure requirements are appropriate for certain offerings.

Firms engaged in digital-asset activity should continue monitoring developments that may affect product governance, disclosures, supervision, custody, recordkeeping, communications, and registration.

The SEC proposed comprehensive modernization of transfer-agent requirements, addressing registration, reporting, books and records, account servicing, and operational requirements. Transfer-agent regulation has remained largely unchanged despite substantial changes in technology, market structure, and account-administration practices; the proposal signals an effort to establish a more current framework for recordkeeping, safeguarding assets, processing transactions, and supporting issuer and investor accounts.

Transfer agents and firms that rely on their services should evaluate the proposal’s potential impact on systems, data, operational controls, vendor relationships, reporting, and books and records.

The SEC proposed rescinding Rule 206(4)-5 under the Investment Advisers Act and its associated recordkeeping requirements. The rule generally prohibits an investment adviser from receiving compensation for providing advisory services to certain government clients for two years after certain political contributions are made. The SEC currently seeks public comment on this proposal.

The CFTC continued developing policy involving digital assets, prediction markets, event contracts, AI-related compute derivatives, affiliate conflicts, and registration exemptions. It also exercised emergency authority in connection with KalshiEX, LLC following litigation involving event contracts and prediction markets — a matter that reflects continued disagreement between federal and state authorities concerning the oversight of these products.

Although much of this activity remains developmental, firms should monitor how future rulemaking or litigation could affect product governance, conflicts management, disclosures, supervision, intermediary registration, and training.

The NFA amended its business-continuity requirements to permit cloud-based applications to serve as primary or backup recovery sites. The amendment recognizes the expanded role of cloud services in business-continuity and disaster-recovery programs and gives firms an occasion to review whether written plans accurately reflect their current technology infrastructure, vendors, data dependencies, and recovery arrangements.

The SEC and CFTC moved the compliance date for amendments to Form PF to July 1, 2027. The additional implementation period gives affected private fund advisers more time to assess data requirements, reporting processes, controls, systems, and governance. Firms should use the extended timeline to evaluate data availability, assign implementation responsibility, conduct testing, and address reporting dependencies.

FINRA’s expanded TRACE affiliate-principal indicator becomes mandatory on August 2, 2027. Amendments to MSRB Rule G-12 become effective one day earlier, on August 1, 2027. Firms affected by both developments should incorporate the dates into a consolidated implementation calendar and identify the systems, procedures, testing, and training required for each change.

FINRA published its 2027 Annual Renewal Program timeline. FINRA systems are scheduled to shut down for renewal processing at 6:00 p.m. on December 27, 2026. Filings submitted during the shutdown will not be processed until the system resumes operations on January 2, 2027. Broker-dealers and investment advisers should coordinate registration filings, terminations, amendments, continuing education and internal approval processes around the shutdown period and ensure licensing and registration teams understand year-end deadlines and dependencies.

NASAA announced that the waiting period following a third or subsequent failure of NASAA qualification examinations will decrease from 180 days to 60 days. NASAA has not reduced the waiting period following first and second failures to 15 days, as contemplated by FINRA’s separate proposal. The different approaches mean firms may need to account for examination-specific waiting periods when managing candidate eligibility and testing schedules. The MSRB had not issued a comparable proposal as of the August update.