Crowell was pleased to host and sponsor Opus Connect’s second NYC Private Debt Roundtable on October 15, 2026. The event brought together private debt leaders to share insights on the key challenges private debt firms are facing today. The conversation covered a range of timely topics including middle market trends, borrower health, the shifting private debt fundraising landscape, and the growing role of technology and AI across the industry.

Continue Reading Crowell Hosts NYC Private Debt Roundtable With Opus Connect

Key Takeaways:

  • Key Takeaway #1: The U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”) published a final rule (the “Rule”), effective September 25, 2026, creating the “Sanctions Penalties Regulations” under 31 CFR Part 505: the agency’s first-ever single, unified codification of civil and criminal penalty rules applicable across multiple sanctions programs.
  • Key Takeaway #2: While OFAC describes the rule as reproducing existing requirements without substantive change, a close reading reveals a few new developments that matter in practice. Among the changes that compliance professionals should be alert to:
    • A binding disclosure requirement for enforcement resolutions;
    • An explicit statement of the mens rea for criminal violations of IEEPA, required by Executive Order 14294;
    • A change in submission routing for enforcement responses, and an important carve-out for narcotics-related proceedings.
Continue Reading OFAC Creates Unified Sanctions Penalties Regulations

In our client alert of September 30, 2026,1 we provided an executive summary of federal banking regulators’ Proposed Third-Party Risk Management Guidance (the “Proposal”), a related joint statement on community banks’ engagement with core service providers, and a proposed Federal Reserve guide for traditional community banks (the “Community Bank Guide”).2 This blog post covers what these agency pronouncements mean for fintechs and the banks that sponsor their programs.

The Proposal’s effect on a fintech turns on the model it uses. In a vendor model, the fintech supplies software or services the bank uses for its own customers, whereas in a partnership model, the fintech markets and distributes the bank’s products directly to consumers. The Community Bank Guide explicitly excludes “complex bank-fintech partnerships,” or relationships where “the fintech company, rather than the bank, markets, distributes, or otherwise provides access to the products or services.”3 The result is two tracks: greater flexibility for vendors, and a set of risks that may limit how much relief partnership programs actually gain.

Continue Reading Proposed Third-Party Guidance: What It Means for Sponsor Banks and Fintechs

On September 11, 2026, the OCC, FDIC, Federal Reserve, and NCUA proposed to replace the 2023 Interagency Guidance on Third-Party Relationships with a shorter, principles-based document.1 Two companion releases complete the package: a final interagency statement on the supervision of the use of core service providers by community banks, effective on issuance,2 and a proposed Federal Reserve guide for traditional community banks (the Community Bank Guide).3 Comments are due November 16, 2026.4

Continue Reading From Process to Principles: Federal Regulators Propose a New Third-Party Risk Management Framework

Key Takeaway

On September 2, 2026, the Federal Reserve, FDIC, NCUA, OCC, and FinCEN confirmed that a bank may tell a customer that an account restriction or closure, or a rejected deposit, may be related to suspected fraud or other suspicious activity, so long as the communication does not reveal that a SAR was or will be filed.

What Happened

On September 2, 2026, the Federal Reserve, the FDIC, the NCUA, the OCC, and FinCEN issued a joint statement on the application of SAR confidentiality to banks’ communications with their customers (Joint Statement). The Bank Secrecy Act prohibits a bank from disclosing a suspicious activity report or any information that would reveal that one exists, and in particular from notifying any person involved in a transaction that the transaction has been reported. In practice, those prohibitions have led many banks to say nothing at all when a payment is held, a deposit is rejected, or an account is closed and the customer asks why. The Joint Statement confirms that the SAR confidentiality prohibitions are narrower than that practice: the regulators confirmed that a bank may communicate with a customer about potentially fraudulent transactions, other suspicious activity, or account closures, provided the communication does not reveal the existence of a SAR. The Joint Statement responds to comments on the agencies’ payments fraud initiative and invokes Executive Order 14331 on fair banking.

Continue Reading You Can Say More Than You Think: Regulators Clarify SAR Confidentiality for Customer Communications

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) jointly issued a final rule that, for the first time, gives the term “unsafe or unsound practice” a binding regulatory definition.1 With it came a uniform standard for Matters Requiring Attention (MRAs) and revised OCC examination manuals.2 The Federal Reserve did not join the rulemaking, but has adopted comparable standards through guidance. What that means for holding companies and state-chartered institutions is addressed below.3 The regulation takes effect November 2, 2026, and the revised OCC examination manuals took effect upon their issuance on August 27.

For boards, general counsel, and risk and compliance leaders, the headlines suggest clarity and potential relief. However, while the rule changes what federal bank examiners may require to bring enforcement, it does not change the standards of prudent risk management a bank is held to, the discretion examiners keep over ratings, or the exposure that sits with state supervisors, the holding company, and individual officers and directors. This client alert explains what changed and how to consider responding.

Continue Reading OCC and FDIC Redefine “Unsafe or Unsound Practices”: The New Supervisory Framework for Banks

Paul Muscutt was recently quoted in Car Dealer Magazine UK in an article covering the collapse of car finance litigation funder Woodville Consultants in a £330 million bankruptcy.

Paul and Crowell’s London Restructuring and Insolvency team have been appointed by Kroll Advisory in the administration of Woodville. The team first acted for a group of investors in successfully securing a contested administration order from the High Court and has since been retained by Kroll to assist in the wider administration process.

Click here to learn more and read Paul’s comments.

Cristina Diaz was recently featured in an in-depth Corporate Counsel Q&A that covers her return to private practice after more than a decade in-house at UBS.

In the interview, Cristina discusses what her years in-house taught her about turning regulatory requirements into practical business solutions, why she returned to private practice, and how she approaches leadership in an evolving financial services landscape.

Click here to read the article.

Key Takeaway: Domestic reporting companies—meaning entities formed under the laws of any U.S. state or Tribal jurisdiction—have no beneficial ownership information reporting obligations to FinCEN under the final rule.

What happened: On August 14, 2026, the Financial Crimes Enforcement Network (“FinCEN”) published a final rule revising its previous rules implementing the Beneficial Ownership Information (“BOI”) reporting requirements of the Corporate Transparency Act (“CTA”). The final rule is effective immediately. The final rule makes permanent, and modestly expands, the relief first introduced by FinCEN in its March 26, 2025 interim final rule, which exempted domestic reporting companies (i.e., U.S.-formed entities) from any obligation to report BOI to FinCEN, and exempted foreign reporting companies from any obligation to report BOI with respect to U.S.-person beneficial owners. FinCEN also has said that it will delete the identifying information that companies reported to it about U.S.-person beneficial owners and company applicants, as well as persons who requested a “FinCEN ID” to aid BOI filings. In addition to the rule itself, FinCEN issued related FAQs. FinCEN cited issues of privacy, burden, and the ability to obtain information on the beneficial owners of U.S. companies as reasons for the final rule.

Continue Reading FinCEN Finalizes BOI Reporting Rule: What U.S. Companies Need to Know

What You Need to Know

Key takeaway #1: On August 13, 2026, FinCEN issued a Financial Trend Analysis showing 67,540 Bank Secrecy Act (BSA) reports filed between 2023 and 2025 involved more than $4.9 billion in reported suspicious activity potentially related to human smuggling.

Key takeaway #2: Money services businesses (MSBs) filed approximately 97% of the reports, while depository institutions filed approximately only 3% but accounted for nearly 61% of the total reported suspicious activity.

Key takeaway #3: Financial institutions should consider whether the red flags and typologies highlighted in the FTA are appropriately incorporated into their automated transaction-monitoring scenarios for detecting potentially suspicious human smuggling-related activity.

Continue Reading Following the Money: FinCEN Maps the Financial Footprint of Human Smuggling