US Regulatory Overview
Hub map of US regulators, rules and network/industry rulebooks that shape transaction fraud programs, organized by money path and entity type, with 2024-2026 changes to watch.
Core components
Who's who
| Body | Type | Fraud-relevant remit |
|---|---|---|
| FinCEN (Treasury) | Federal regulator | BSA/AML rules: SARs, CIP, CDD, 314(a)/(b), advisories and alerts with SAR key terms |
| CFPB | Federal regulator | EFTA/Reg E (unauthorized transfers, error resolution), Reg Z, Reg P (GLBA privacy), UDAAP; supervision of larger nonbanks |
| Federal Reserve, OCC, FDIC, NCUA | Prudential regulators | Bank supervision: BSA exams, model risk (SR 26-2), third-party risk, authentication guidance, SAR rules for banks, elder exploitation statements |
| SEC | Federal securities regulator | Reg S-P (privacy, safeguards, incident response), Reg S-ID (identity theft red flags), broker-dealer books and records, market manipulation |
| FINRA | SRO for broker-dealers | Rules 2165, 4512, 11870, 3310 (AML); regulatory notices; annual oversight reports |
| FTC | Federal consumer protection | Safeguards Rule for non-bank FIs, impersonation and scam enforcement, Consumer Sentinel data |
| State regulators and AGs | State | Money transmitter licensing, state privacy laws, elder abuse reporting, consumer protection suits (e.g., NY AG v. Early Warning Services, 2025) |
| Nacha | Rule-making association | ACH Operating Rules: returns, return rates, WEB debit validation, 2026 fraud monitoring |
| Visa, Mastercard (and others) | Card networks | Dispute rules, compelling evidence, monitoring programs (VAMP; Mastercard ECP/EFM) |
| FBI / IC3, Secret Service, DOJ | Law enforcement | Complaint intake, investigations, prosecutions, asset recovery |
Rules by money path
| Money path | Primary rules | Note |
|---|---|---|
| Onboarding / identity | CIP (31 CFR 1020.220, 1023.220), CDD/beneficial ownership, Reg S-ID (SEC registrants), FTC/agency Red Flags rules for others | KYC and Customer Identification Program (CIP) |
| Card funding / purchases | Visa/Mastercard rules; Reg Z (credit) or Reg E (debit, consumer) for issuers | Card Network Dispute Rules |
| ACH funding / payouts | Nacha Operating Rules; Reg E for consumer accounts; UCC 4A for some credit transfers | Nacha Rules and ACH Risk |
| P2P / instant payments | Reg E (consumer accounts); network/operator rules (RTP, FedNow, P2P networks); state actions on scams | Regulation E and Unauthorized Transfers, Real-Time Payment Rail Fraud |
| Checks / RDC | UCC Articles 3/4, Reg CC (funds availability and holds) | Check and Mobile Deposit Fraud, Funds Availability Holds |
| Securities / ACATS / trading | FINRA 11870, 2165, 4512; SEC Reg S-P and S-ID; securities fraud and manipulation laws | Broker-Dealer Obligations (FINRA and SEC) |
| Rewards / promotions | UDAAP/UDAP (clear terms, no deceptive revocation), state sweepstakes and gift card laws, CFPB credit card rewards circular | Promotion Design Guardrails, Reward Vesting and Clawback |
| Reporting and sharing | BSA SARs, 314(a)/(b), Senior Safe Act, GLBA exceptions | BSA-AML and SAR Filing, Privacy and Data Use in Fraud Prevention |
| Models and vendors | SR 26-2 model risk guidance (banks), interagency third-party risk guidance | Model Risk Management, Vendor Selection and Evaluation |
Rules by entity type (simplified)
| Entity | Usually directly subject to | Often inherits via contract |
|---|---|---|
| Bank / credit union | BSA/AML, Reg E, Reg CC, GLBA, prudential guidance, network and Nacha rules as participant | n/a |
| Fintech on a sponsor bank | State money transmission (if licensed), FTC Safeguards, state privacy, UDAP; CFPB (larger participants) | Bank's BSA/AML, Reg E error resolution, Nacha and network obligations via program agreements |
| Broker-dealer | BSA/AML (CIP, SAR), SEC Reg S-P/S-ID, FINRA rules | Clearing firm requirements; bank partner obligations for cash features |
| Money services business | BSA/AML for MSBs, state licensing | Network/processor rules |
| Marketplace / retailer / rewards app | FTC Act, state UDAP and privacy laws, INFORM Consumers Act (marketplaces), card network merchant rules | Acquirer/processor terms, retailer/affiliate contracts |
2023–2026 changes fraud teams should know
| Date | Change | Detail |
|---|---|---|
| Apr 15, 2023 | Visa Compelling Evidence 3.0 | Prior-history evidence for 10.4 disputes → Card Network Dispute Rules |
| Oct 1, 2024 | Nacha risk management package | R17 for false pretenses, expanded R06, funds availability exception, WSUD timing → Nacha Rules and ACH Risk |
| Oct 2024 | Mastercard First-Party Trust (US) | Covers 4837 disputes |
| Dec 2024 | Interagency elder exploitation statement | Holds, trusted contacts, SAR and reporting practices |
| Dec 2024 → Mar 2025 | CFPB v. Early Warning Services and banks (Zelle) | Filed Dec 2024; voluntarily dismissed Mar 2025 → Case Study - Zelle Scam Liability Disputes (2024-2025) |
| Apr 1, 2025 | Visa VAMP launches | Consolidated acquirer monitoring; enforcement from Oct 2025; merchant threshold tightened Apr 2026 |
| May 2025 | CFPB withdraws 67 guidance documents | Check whether guidance you rely on is still in effect |
| Jun 2025 | Fed/FDIC/OCC Request for Information on payments fraud | Prompted FinCEN's 2026 314(b) clarification |
| Aug 2025 | NY AG sues Early Warning Services | State-level P2P scam action |
| Oct 9, 2025 | FinCEN/agency SAR FAQs | Continuing activity, no-SAR documentation, structuring |
| Dec 3, 2025 / Jun 3, 2026 | Reg S-P amendments compliance (larger/smaller) | Incident response, 30-day notice → Broker-Dealer Obligations (FINRA and SEC) |
| Jan 8, 2026 | FINRA Reg Notice 26-02 (proposal) | Longer 2165 holds; proposed Rule 2166 fraud speed bump for all adults |
| Mar 20, 2026 | Nacha fraud monitoring Phase 1; PAYROLL/PURCHASE descriptions | All ODFIs; large originators/third parties (≥6M); large RDFIs (≥10M) |
| Apr 17, 2026 | SR 26-2 revised model risk guidance | Supersedes SR 11-7 and SR 21-8 → Model Risk Management |
| Jun 12, 2026 | FinCEN 314(b) fact sheet | Fraud explicitly shareable; suspicion of fraud sufficient; indicators needn't relate to a specific customer at the receiver; real-time sharing; SARs stay confidential. Registration (BSA-covered FIs and their associations only) renews annually |
| Jun 22, 2026 | Nacha fraud monitoring Phase 2 | All remaining non-consumer originators, TPSPs, TPSs and RDFIs |
| Jul 9, 2026 | Fed SR 26-3 | Circulates 314(b) fraud guidance to supervised institutions |
| Aug 13, 2026 | FINRA files SR-FINRA-2026-018 with the SEC | Proposed Rule 2166 fraud delay of up to 10 business days; 145-business-day 2165 maximum; awaiting SEC action as of October 2026 → Broker-Dealer Obligations (FINRA and SEC) |
| Sep 18, 2026 | Nacha funds availability for non-same-day credits | Available by 9:00 a.m. RDFI local time on settlement date |
| Sep 17, 2027 (upcoming) | Same Day ACH limit to $10M | Larger same-day exposure |
| Mar 17, 2028 (upcoming) | Nacha R90 sanctions return code | n/a |
Scam liability, still unresolved
US law draws a sharp line between unauthorized transfers (Reg E protection) and authorized transfers induced by deception (generally not covered). Reported scam losses keep climbing: the FTC's 2024 data showed $12.5 billion reported lost (investment scams $5.7 billion), and FBI IC3's 2025 report showed about $20.9 billion in complaint losses. So pressure is coming from state AGs, litigation, network operator rules, voluntary reimbursement programs and interagency fact-finding (the June 2025 RFI) rather than a single federal rule. Contrast the UK's mandatory reimbursement regime (Case Study - UK APP Scam Reimbursement Rules (2024)). Practically, label scam vs unauthorized separately, and invest in in-flow scam intervention (Playbook - Scam Intervention Members, Payee Confirmation and Payment Friction).
How to build it
- Regulatory inventory per product and money path, built with compliance: which rules, which clocks, which reports, which permissions. Put it in the New Product and Promo Launch Review checklist.
- Obligation-to-control mapping: each obligation names the control, the owner, the evidence and the monitoring (see Three Lines of Defense).
- Clock management in case tooling: Reg E, SAR, 2165 holds, network dispute windows.
- Horizon scanning: subscribe to FinCEN, CFPB, FINRA, SEC, Nacha and network updates. Log changes and assess impact quarterly (see Threat Intelligence and Horizon Scanning, Regulatory and Government Sources).
- Partner alignment: for fintechs, map which obligations the sponsor bank, processor or clearing firm owns, which you own, and how evidence flows.
Artifacts and templates
Regulatory inventory row (template)
| Field | Example |
|---|---|
| Product / money path | Instant ACH-funded buying power |
| Rail | ach |
| Rules | Nacha (returns, 2026 monitoring), Reg E at partner bank (customer's bank account), CIP |
| Obligations | Monitor for unauthorized/false-pretenses entries; manage return rates; WEB debit account validation |
| Clocks | Extended return window for unauthorized consumer debits |
| Permissions | Funds availability limits per agreement |
| Owner | Funding strategy lead; compliance partner |
| Evidence | Monitoring procedure; return-rate dashboard; annual review |
Metrics
- Coverage: products with a complete regulatory inventory
- Clock compliance across regimes (Reg E, SAR, holds, disputes)
- Regulatory change backlog: changes assessed vs open
- Exam/audit findings related to fraud controls, and time to remediate
Pitfalls
- Assuming you're not regulated because you're not a bank. Obligations flow through partner contracts and state laws.
- Treating network and Nacha rules as optional. They're contractual and enforced with fines and offboarding.
- Copying another company's posture. Charter and product differences change which rules apply.
- Not tracking guidance withdrawals. 2025 saw significant CFPB guidance rollbacks. Re-check what you cite.
- Leaving scam policy to support. Reimbursement decisions need a documented, consistent policy.
Related
- BSA-AML and SAR Filing · Regulation E and Unauthorized Transfers · Regulation CC and Funds Availability · Nacha Rules and ACH Risk · Card Network Dispute Rules
- Broker-Dealer Obligations (FINRA and SEC) · Privacy and Data Use in Fraud Prevention
- Three Lines of Defense · Model Risk Management · Fraud Risk Assessment · New Product and Promo Launch Review
- Payment Rails Map · Regulatory and Government Sources · Fraud Program Overview · Program Index
Sources and further reading
- FinCEN, Section 314(b) Fact Sheet (Jun 12, 2026): fraud-related information sharing clarified
- Federal Reserve SR 26-3 (Jul 9, 2026): 314(b) guidance distribution; reference to the June 2025 payments fraud RFI
- FinCEN et al., SAR FAQs (Oct 2025): continuing activity and documentation clarifications
- Federal Reserve SR 26-2 (Apr 17, 2026): revised model risk management guidance superseding SR 11-7
- CFPB, Regulation E §1005.6 and §1005.11: liability and error resolution
- Nacha, New rules: 2026–2028 rule calendar
- Nacha, Fraud Monitoring Phase 1: March 2026 obligations and thresholds
- FINRA Regulatory Notice 26-02 (Jan 2026): proposed senior investor and fraud hold changes
- FINRA weekly update, Aug 19, 2026: SR-FINRA-2026-018 filed with the SEC; Rule 2166 delay of up to 10 business days
- FINRA 2026 Oversight Report: Cybersecurity and Cyber-Enabled Fraud: Reg S-P compliance dates
- Solidgate, Visa monitoring programs: VAMP timeline
- CFPB, Early Warning Services et al.: Dec 2024 filing and Mar 2025 dismissal
- Banking Dive, NY AG sues Early Warning Services (Aug 2025): state action on P2P scams
- Morgan Lewis, CFPB revokes guidance (Jun 2025): May 2025 withdrawal of 67 guidance documents
- Interagency statement on elder financial exploitation (Dec 2024): example practices (no new supervisory expectations or requirements) and Senior Safe Act
- FTC, $12.5B reported fraud losses in 2024 (Mar 2025): scam loss context
- SOCRadar, FBI IC3 2025 report takeaways (Apr 2026): ~$20.9B in 2025 complaint losses (secondary summary of IC3 data)