Daily · US Banking Risk and Sanctions Actions · September 15, 2026

Key points

Proposed US Third-Party Risk Guidance

The OCC, Board, FDIC, and NCUA invited comments on proposed third-party risk management guidance for banking organizations. The document does not state a specific deadline for the comment period.

The proposed guidance reflects the agencies' supervisory experience and lessons learned from examining banking organizations' practices. It emphasizes aligning third-party risk management with reasonably assessed risk levels specific to each relationship, assisting organizations in prioritizing based on material financial risks, compliance obligations, and resource allocation.

The approach would help banking organizations tailor practices according to their size, complexity, risk profile, and the nature of their third-party relationships. The agencies plan to rescind and replace existing guidance on third-party risk management to promote consistency and innovation in the banking industry.

OFAC Sanctions Designations

OFAC published three notices on September 15, 2026, placing one or more persons on the Specially Designated Nationals and Blocked Persons List (SDN List). The notices are identified as Federal Register documents 2026-18840, 2026-18909, and 2026-18876.

All property and interests in property subject to U.S. jurisdiction of the designated persons are blocked, and U.S. persons are generally prohibited from engaging in transactions with them. The specific names of the designated persons are not stated in the provided source text; compliance teams must retrieve the details directly from the Federal Register documents to screen counterparty and transaction records.

FCA Bans Former Law Firm Manager

The FCA banned Nurul Miah, also known as Neil Mia and Neil Miah, from working in financial services. The Solicitors Regulation Authority (SRA) found that Mr Miah, a non-legal manager at Kingly Solicitors Limited, dishonestly caused or allowed more than £28m of client money to be taken from client accounts without permission between April 2019 and July 2020. The SRA also found that more than £10m of client money was missing and had been used by Mr Miah for his own benefit.

Mr Miah was approved by the FCA in 2016 to work in senior management roles at Oracle Consultants Ltd, an unconnected firm. Therese Chambers, executive director of enforcement and market oversight, stated that Mr Miah dishonestly used client money for his own benefit and has no place in financial services.

Market Infrastructure Rule Changes

Cboe BZX Exchange, Inc. and Cboe BYX Exchange, Inc. filed rule changes with the SEC for immediate effectiveness to add a new time-in-force designation known as 'Regular `til Post Market'. The amendments affect Exchange Rules 11.1(a), 11.9(b), 11.23, and 11.24 for Cboe BZX, and Rules 11.1(a), 11.9(b), and 11.23 for Cboe BYX. Cboe EDGA Exchange, Inc. filed a similar rule change amending Exchange Rules 11.1, 11.6, 11.7, and 11.8 to add the same designation.

Investors Exchange LLC filed a rule change for immediate effectiveness to extend the implementation timeframe to permit trading of pegged orders during pre-market and post-market sessions. A Joint Industry Plan amendment was filed to add MX2 LLC and Investors Exchange LLC as participants in the Options Order Protection and Locked/Crossed Market Plan.

The US SEC granted exemptive relief from Inline XBRL requirements for portions of Form CA-1, Form 1, Form X-17A-5 Part III, Form 17-H, and the Security-Based Swap Entity's Annual Compliance Report. The SEC also designated a longer period for action on a Fixed Income Clearing Corporation proposed rule change to establish a guaranty fund at the Government Securities Division, and granted petitions for review of a Nasdaq continued listing requirement rule change.

Our read

The joint proposal from US banking regulators signals a shift toward risk-based, size-tailored third-party oversight, requiring banks to restructure frameworks before finalization. The simultaneous OFAC designations demand immediate screening updates, though the lack of named entities in the summary necessitates direct retrieval from Federal Register documents for compliance verification. The FCA's ban on Nurul Miah reinforces strict enforcement against integrity failures in senior management, particularly where client funds are misappropriated.

This digest was produced automatically by a large-language-model system from the regulator publications and official sources listed below; it is AI-generated content and may contain inaccuracies. It is not legal advice — verify wording and deadlines against the original documents.

Sources