Four regulator signals worth your compliance team’s time this cycle, in plain English, each with one thing to do about it this month.

1. NCUA’s 2026 cybersecurity report puts AI-enabled attacks on the record

NCUA published its 2026 Cybersecurity and Credit Union System Resilience Report, and the emerging-threats section leads with AI. Citing CrowdStrike’s 2026 Global Threat Report, the agency notes attacks involving AI-enabled techniques rose nearly 90 percent, describes generative AI phishing built from combined data sources including social media, and flags agentic AI reducing the human effort attackers need. The report also counts 588 cyber incidents reported by credit unions from May 2025 through April 2026 under the 72-hour rule, with no systemic threats identified. The prescription NCUA attaches: continuous monitoring, third-party risk management, and staff training.

Do this month: add one AI-enabled scenario (a voice-cloned member or a tailored executive phish) to your next incident response tabletop, and confirm your 72-hour reporting workflow has a named owner.

2. The House committee voted to restructure the CFPB

The House Financial Services Committee approved H.R. 10184 on September 16 by a 28 to 21 vote. The bill would move the CFPB to congressional appropriations, add rulemaking review requirements, and revise supervision and enforcement authorities. The credit union angle, covered by Credit Union Daily: the bill would raise the asset threshold for direct CFPB supervision from $10 billion to $30 billion and would let covered institutions elect exams by their prudential regulator, which for credit unions means NCUA. Veteran CU advocates quoted in that coverage doubt it passes this calendar year.

Do this month: nothing structural. Committee passage is not law, and reprioritizing your compliance roadmap on this bill would be premature. If you are within reach of the $10 billion line, have someone track the floor schedule.

3. FinCEN mapped $12.7 billion in scam-center flows and wants specific SAR language

FinCEN published a financial trend analysis and alert on digital asset investment scams run by overseas scam centers: 33,904 BSA reports totaling roughly $12.7 billion, with victims in all 50 states. The alert details how operators buy phishing and money-laundering services through online guarantee marketplaces and move proceeds through money mules and stablecoin transfers. Filers are asked to use the key term FIN-2026-SCAMCENTERS in SAR filings. Your members meet these schemes directly, usually through a friendly stranger with an investment tip, and by the time the money moves it looks like an ordinary external transfer.

Do this month: brief the BSA team on the alert’s red flags, add the key term to SAR procedures, and put scam-center warning content in front of members.

4. Regulators clarified what you can tell members about suspicious activity

The Fed, FDIC, NCUA, OCC, and FinCEN issued a September 2 joint statement on SAR confidentiality, confirming that institutions may discuss the underlying facts of suspected fraud with the affected customer (holds, restrictions, rejected deposits) without violating SAR rules, as long as the SAR itself is never revealed. This matters more as AI fraud detection scales: automated systems flag more transactions, which means more member conversations about why an account action happened. Your front line now has regulatory cover to explain more than most scripts allow. Pair this with the monitoring practices from our model risk piece so flagged-transaction conversations stay consistent.

Do this month: update front-line and contact-center scripts for fraud holds using the statement’s permitted examples, and route the joint statement to whoever owns BSA training.

The full compliance-safe adoption path lives in the NCUA and compliance pillar. For help pressure-testing your AI controls before the next exam, Advisor Labs runs a 45-minute readiness audit: book a conversation.

Get this roundup in your inbox every Thursday: subscribe to the AiForCU newsletter.