Weekly Regulatory Audit Report — June 8, 2026

Below is the Weekly Regulatory Compliance Monitoring Report for the 90-day look-back period: March 9, 2026 through June 8, 2026. The full auditor-ready Word document report is available on demand, just email RalphBrowning@BrowningRiskConsulting.com for a copy. Please find the key highlights summarized below.

KEY HIGHLIGHTS — JUNE 8, 2026 WEEKLY REGULATORY AUDIT REPORT

ITEMS REQUIRING IMMEDIATE ATTENTION:

CFPB REGULATION B AMENDMENTS [HIGH IMPACT]

Dates: April 20 & May 1, 2026 The CFPB issued two sweeping final rules amending Regulation B: (1) removing the disparate impact "effects test" from ECOA, modifying the discouragement prohibition, and restricting SPCP use of race/sex as characteristics; and (2) refocusing Section 1071 small business lending data collection by excluding merchant cash advances, small dollar transactions, and agricultural loans, and eliminating pricing, denial-reason, and LGBTQIA+-owned status data points. Immediate review of fair lending programs, SPCP frameworks, and data collection systems is required.

NYDFS $2.25M DELTA DENTAL CYBERSECURITY SETTLEMENT [HIGH IMPACT]

Date: April 30, 2026 NYDFS finalized a $2.25 million consent order against Delta Dental for violations of 23 NYCRR Part 500, including failure to maintain NPI disposal policies (§500.13), inadequate incident response planning (§500.16), and failure to timely notify NYDFS of a cybersecurity event (§500.17(a)). All Phase 4 requirements (universal MFA, asset inventory, PAM) are now fully enforceable. The April 15, 2026 annual CEO/CISO certification deadline has passed — confirm filing status immediately.

FinCEN AML/CFT PROGRAM MODERNIZATION PROPOSED RULE [HIGH IMPACT]

Date: April 10, 2026 (91 FR 69) FinCEN published a comprehensive proposed rule to fundamentally reform AML/CFT program requirements for banks, MSBs, broker-dealers, mutual funds, insurance companies, and others. The rule requires risk-based programs with formal risk assessment documentation, updated training, independent testing, and a designated U.S.-located compliance officer. Comment period is open — submit comments and begin gap analysis now.

STATE PRIVACY LAW PROLIFERATION [HIGH IMPACT]

Indiana (INCDPA), Kentucky (KCDPA), and Rhode Island (RIDTPPA) comprehensive privacy laws are in effect as of January 1, 2026. Connecticut CTDPA amendments expanding sensitive data categories (health details, government IDs, biometric-derived data) take effect mid-2026 with no cure period. Privacy program coverage analysis, notices, and processing agreements must be updated.

NAIC AI/ML GOVERNANCE — EXAMINATION PILOT ACTIVE [HIGH IMPACT]

As of March 2026, 25 states have adopted the NAIC Model Bulletin on Use of AI Systems. The AI Systems Evaluation Tool pilot launched January 2026 in 12 states. Documented AIS Programs with governance structure, bias testing, vendor oversight, and consumer notice procedures are urgently required ahead of market conduct examinations.

ADDITIONAL DEVELOPMENTS:

FTC finalized Illuminate Education data security consent order (June 5, 2026) — data security program and minimization obligations reinforced

SEC CETU 2026 examination priorities include cybersecurity governance, Reg S-P compliance, and AI-driven cyber threats

NAIC appointed Market Conduct Regulation Modernization Working Group at Spring National Meeting (March 25, 2026)

FinCEN CTA beneficial ownership: domestic companies remain exempt under March 2025 interim final rule; final rule expected 2026

California AI Transparency Act in effect January 1, 2026 — transparency disclosures required for AI decision systems

Report Period: March 9, 2026 – June 8, 2026 Report Generated: June 8, 2026, 07:12 AM