Compliance Solutions quarterly newsletter — June 2026

General

Stay ahead of change with Compliance Hub Alerts

In today's rapidly evolving regulatory environment, staying current with new and changing laws is more challenging, and more critical, than ever. Financial institutions are expected to keep pace with an overwhelming volume of regulatory updates while ensuring timely and accurate implementation across their operations.

Compliance Hub Alerts, a TruStage® solution, is designed to simplify that process.

From information overload to actionable insight

Rather than relying on manual tracking methods, Compliance Hub Alerts continuously monitors a vast regulatory landscape on your behalf. This includes:

• Approximately 17,000 laws and regulations
• Nearly 900 pending pieces of legislation
• Federal Register notices, case law and industry guidance
• Over 250 targeted keywords and phrases¹

The result? Your compliance team receives timely, relevant updates, without the noise.

With customizable, multi-layer filtering, you can focus only on the states, federal agencies and topics that matter most to your institution, ensuring your team's time is spent where it has the greatest impact.

Clarity that drives action

Each alert is designed to go beyond simply notifying you of change — it helps you understand and act on it.

Compliance Hub Alerts provides:

• Plain-language summaries that make complex regulations easier to understand
• Impact analysis tailored specifically to financial institutions
• Guidance and recommendations to support implementation across business lines
• Sample customer or member communication templates when notifications are required
• Direct access to source materials and legal references for deeper review

This combination of clarity and context enables compliance teams to move quickly and confidently from awareness to action.

Built for collaboration and accountability

Managing regulatory change is a team effort — and Compliance Hub Alerts makes that process seamless. The platform includes built-in tools that allow teams to:

• Assign alerts and responsibilities to specific team members
• Create and track action items with defined due dates
• Document internal analysis and compliance decisions
• Monitor progress with customizable status updates

An intuitive, "at-a-glance" dashboard gives stakeholders across your institution visibility into what's being tracked, what actions are required and what has already been completed.

Audit-ready, always

In addition to streamlining day-to-day compliance activities, Compliance Hub Alerts supports your institution's broader governance and audit needs. Robust reporting capabilities allow you to:

• Generate reports based on specific dates or timeframes
• Maintain a clear record of regulatory alerts and actions taken
• Demonstrate compliance readiness during audits and exams

A proactive approach to compliance

By replacing manual processes with automation, insight and structured workflows, Compliance Hub Alerts empowers your organization to shift from a reactive stance to a proactive compliance strategy.

Instead of scrambling to catch up with regulatory changes, your team can stay ahead by reducing risk, improving efficiency and strengthening overall compliance performance.

Learn more

Ready to transform the way your team manages regulatory changes? Contact our team to learn more or request a demo.

Financial institutions and emerging AI regulation

What are AI regulations?

Artificial intelligence (AI) regulations govern how organizations develop, deploy and use AI systems, particularly those that influence consumer decisions, pricing or access to services. Across the United States, these regulations generally focus on three core areas:

• Transparency, including requirements to inform users when AI is used
• Risk management, especially for systems that impact financial, employment or other significant decisions
• Consumer protection, including preventing discrimination, unfair outcomes and misleading outputs

These requirements are especially relevant for pricing-related use cases where AI is used to:

• Influence loan approvals or pricing
• Personalize offers or rates
• Support customer eligibility or underwriting decisions

Why do AI regulations matter?

AI is increasingly embedded in core business processes. As adoption grows, regulators are placing greater emphasis on how these systems affect consumers, particularly financial services. Key themes currently driving regulation include:

• Preventing algorithmic discrimination
• Supporting fair pricing and lending practices
• Improving transparency into how decisions are made
• Aligning with existing frameworks like fair lending and consumer protection laws

For many financial institutions, AI is no longer just a technological consideration. It is now a core part of compliance and risk management.

How are AI systems regulated?

AI regulation in the United States is primarily driven at the state level with some additional activity at the federal level.

While approaches vary, most laws and proposed legislation fall into four broad categories:

Transparency and disclosure

These laws require businesses to disclose when and how AI is used. This may include notifying consumers when they are interacting with AI, labeling AI-generated content or providing information about how systems are trained and operate. These requirements are often the first layer of regulation and are intended to improve awareness and trust in AI systems.

Key examples include:

High-risk and decision-making

These regulations apply to AI systems that make or significantly influence decisions about individuals. This includes areas such as lending, pricing, eligibility and access to services. They typically require organizations to implement risk management practices, monitor for bias, document system performance, and maintain appropriate oversight.

For most financial institutions, this is the most operationally significant category, as it directly affects underwriting, pricing strategies, and customer outcomes. Notable legislation includes:

General governance

These laws and proposed bills establish broader frameworks for how AI systems are developed and used. They often define key terms, assign responsibilities to developers and deployers and set baseline expectations for governance.

Many of these proposals are still evolving, but they signal where regulation is heading and are likely to influence future requirements:

Specialized and sector-specific

These regulations focus on specific AI technologies or use cases, such as generative AI, chatbots, synthetic content or voice-based systems. Although narrower in scope, they can introduce targeted requirements depending on how these technologies are used within an organization. Examples include:

*Legislation marked with an asterisk denotes that it has been covered in a Compliance Hub Alert. Legislation not covered in a Compliance Hub Alert was either introduced or enacted before Compliance Hub Alerts existed or will be covered in the future if it is sent to the governor for consideration.

Important considerations

The applicability of AI regulations depends heavily on how systems are used.

Financial institutions that develop their own AI systems may be subject to different requirements than those that only deploy third-party solutions. In addition, obligations may vary depending on the use case, the type of data involved and the impact on consumers. Because of this, financial institutions should consider:

• Evaluating how AI is used across business functions
• Monitoring both enacted laws and pending legislation
• Assessing whether existing compliance frameworks already address some requirements

What's next for AI?

AI regulation is expected to expand significantly over the next several years. Key trends to watch include:

• Continued expansion of state-level regulation
• Greater consistency around risk-based frameworks
• Increased focus on lending, pricing and eligibility decisions
• More coordination at the federal level

Financial institutions should begin preparing now by:

• Establishing formal AI governance structures
• Maintaining documentation and audit trails
• Aligning AI use with existing compliance programs

Modernizing financial privacy: What the GUARD Financial Data Act would change

For more than twenty-five years, the Gramm-Leach-Bliley Act (GLBA) has formed the backbone of U.S. financial sector privacy law. While the GLBA establishes baseline safeguards and notice obligations, it was drafted long before mobile banking, data aggregation, artificial intelligence and modern consumer data expectations. The GUARD Financial Data Act ("Act")² serves to expand and modernize the GLBA privacy framework for today's data environment.

The Act, which was introduced in Congress in April 2026, would amend Title V of GLBA by incorporating modern privacy protections. The goal of the proposed legislation is to strengthen consumer control over their financial data and establish a national standard for financial privacy.

How the act strengthens consumer privacy protections

The following is a summary of the key elements of the Act:

• Data minimization — GLBA currently requires that financial institutions explain how a consumer's nonpublic personal information (NPI) is shared and gives consumers limited opt-out rights, but the law imposes few constraints on how much data institutions may collect or disclose. The Act changes that by requiring institutions to limit the collection and disclosure of NPI to what is adequate, relevant and reasonably necessary for each defined purpose, subject to existing regulatory and statutory exceptions
• Requests for access, disclosure or deletion of financial data — The Act allows current or former financial institution customers to request access to their NPI held by that institution and, subject to existing GLBA exceptions, to receive a list of categories of nonaffiliated third parties to whom their NPI has been disclosed. In addition, former customers would have the right to request deletion of NPI held by a financial institution with whom they no longer have a relationship, subject to exceptions for regulatory obligations, fraud prevention, credit reporting and other lawful uses
• Consent for collection and disclosure of sensitive financial data — The proposed legislation strengthens protections on consumers' sensitive NPI. Under the Act, institutions would be required to provide notice and obtain affirmative opt-in consent before collecting or disclosing to nonaffiliated third parties sensitive NPI such as biometric identifiers, precise geolocation data and certain highly personal demographic information. Consumers would be able to revoke their consent at any time
• Limits on use of consumer access credentials — One of the most operationally significant sections of the Act addresses financial data aggregators and credential-based access. Before using a consumer's username or password to access an account, aggregators and nonaffiliated third parties would need to provide detailed notice explaining how credentials would be used, shared and protected, along with the associated risks. Consumers must also be given an opportunity to opt out of use of their access credentials. Financial institutions are prohibited from blocking data access when these notice and opt-out conditions are met
• Additional information in notices to consumers — The Act provides that financial institutions must notify consumers of the following before disclosing their NPI to a nonaffiliated third party:
  • Categories of purposes for collecting and disclosing NPI
  • Categories of practices with respect to retention of NPI
  • Categories of practices with respect to the use of artificial intelligence for collecting, processing and using NPI
  • Whether NPI is processed in, retained in or disclosed to certain countries
  • An explanation of how a consumer can exercise their continuing opt-out right
  • An explanation of how a customer can access copies of a financial institution's privacy disclosures
  • An explanation of how a customer or former customer can request disclosure or deletion of their NPI
• Uniformity through federal preemption — The Act would preempt state financial and nonfinancial data privacy and security laws as applied to GLBA-covered institutions and GLBA-covered data

What does this mean for financial institutions?

If signed into law, the Act would not only impact the information to be included in privacy notices — it would require financial institutions to reassess how they collect, justify, retain, share and delete consumer data. Financial institutions may wish to begin evaluating how the new requirements would impact their privacy and data management policies and practices.

NCUA deregulatory project update

We first highlighted the NCUA's Deregulation Project in our March 2026 newsletter. The NCUA launched the project following the issuance of Executive Order 14192, Unleashing Prosperity Through Deregulation.³ It is an initiative to review all NCUA regulations and policy statements and rescind or propose changes to those that are obsolete, duplicative, overly burdensome or intended to serve as guidance rather than requirements. This long-term project is intended to ensure the agency is focused on fulfilling its mission to enable access to financial services by facilitating safe, sound and resilient credit unions.

In May 2026, the NCUA released its 11th round of proposed regulatory changes. A total of 31 proposed rules have been issued since the project's inception, but none of the rules have yet been finalized. Credit unions are encouraged to:

• Stay informed as additional proposed or final rules are issued
• Assess how changes may affect credit union policies, procedures, governance or compliance responsibilities
• Provide feedback during public comment periods

Visit the NCUA's Deregulation Project webpage for additional background on this initiative, specific details of each rule and a list of frequently asked questions.⁴

Deposit

FDIC rescinds supervisory guidance on multiple re-presentment NSF fees

The Federal Deposit Insurance Corporation (FDIC) has rescinded prior supervisory guidance on the practice of assessing multiple non-sufficient funds (NSF) fees for transactions that are re-presented for payment. Rather than prescribing detailed expectations, the agency will focus on transparency, accuracy and compliance with existing consumer protection laws.

Background

The FDIC has issued a series of Financial Institution Letters ("FIL") pertaining to multiple re-presentment NSF fees. In August 2022, the FDIC issued FIL-40-2022, entitled "Supervisory Guidance on Multiple Re-Presentment NSF Fees" to ensure that financial institutions were aware of consumer compliance risks associated with this practice and the agency's supervisory approach for violations of law and related corrective action.

The following year, the guidance was updated to further clarify the FDIC's supervisory approach for corrective actions. FIL-32-2023, issued in June 2023, rescinded and replaced FIL-40-2022. However, after further review and assessment, the FDIC determined that the updated guidance introduced unintended ambiguity.

Key change

On April 10, 2026, the FDIC issued FIL-14-2026,⁵ immediately rescinding FIL-32-2023 and the agency's supervisory guidance on re-presentment NSF fees in its entirety. The FDIC concluded that the guidance was overly broad in scope and created uncertainty about whether a financial institution's disclosures describing re-presentment practices could trigger "unfairness" concerns under Section 5 of the Federal Trade Commission (FTC) Act.

By withdrawing its guidance, the FDIC is stepping back from a prescriptive supervisory position on this fee assessment practice.

Considerations for financial institutions

While the FDIC has rescinded its supervisory guidance, the agency emphasizes that institutions should still ensure their consumer disclosures accurately reflect their practices and are provided in accordance with applicable laws, regulations and other current legal requirements.

Lending

Emerging divorce-related mortgage assumption laws

Recent legislative activity across several states marks a meaningful shift in how lenders must handle mortgage debt in divorce proceedings. Laws enacted in Maryland, Virginia and California now require mortgage lenders to permit the assumption of a mortgage by one spouse following a divorce under certain conditions. These changes represent a significant departure from the longstanding norm, which often required either refinancing the mortgage into one spouse's name (often at a higher interest rate) or selling the marital home altogether in order to release one party from liability.

At their core, these laws mandate that certain residential mortgage loans include a provision allowing one borrower to assume the existing loan in connection with a divorce. While the statutory details vary, the framework is largely consistent across jurisdictions. Lenders must include a contractual assumption clause permitting one spouse to take over the loan and buy out the other's interest following a divorce decree. The assuming borrower is still required to meet standard underwriting criteria, including creditworthiness, income and debt‑to‑income ratios. Once approved, the departing spouse can be formally released from liability on the loan. Importantly, the assuming borrower is typically allowed to retain the original loan terms, including the interest rate, amortization schedule, and outstanding balance, thereby avoiding the need to refinance at current market rates. These requirements generally apply to conventional (non‑government‑backed) residential mortgages, which historically were not required to be assumable. In addition, the statutes impose consumer disclosure obligations, requiring lenders to inform borrowers at application or origination that the loan includes a divorce‑related assumption provision.

Maryland was among the first states to act, with House Bill 1018 taking effect on October 1, 2025. The law requires most conventional mortgage loans to include an assumption provision tied to divorce and is notable for its asserted retroactive effect, meaning that even certain existing loans may be treated as subject to these requirements if a divorce occurs after the effective date. Virginia followed with House Bill 304, effective July 1, 2026, mandating that new conventional mortgages allow assumption in the event of divorce or annulment, provided the remaining borrower individually qualifies. California has also adopted similar legislation through 2024 Assembly Bill 3100, effective January 1, 2027, requiring lenders to permit assumption of conventional mortgages for divorcing borrowers on loans originated beginning in 2027. California lawmakers have explicitly positioned the statute as a response to rising interest rates and the financial burden associated with refinancing historically low rates at current market rates.

These legislative efforts have been driven by a combination of market conditions and sustained advocacy from financial professionals, family law practitioners, and housing policy groups. During the COVID‑19 pandemic, borrowers secured historically low mortgage rates—often in the 2% to 3% range—which created a significant disparity as interest rates rose sharply in the years that followed. In many cases, refinancing a mortgage during divorce would result in dramatically higher monthly payments, making it financially unfeasible for either spouse to retain the home. This "rate lock‑in" effect has been a central catalyst for reform, as policymakers increasingly recognized that existing mortgage structures were forcing unnecessary home sales and placing additional strain on already difficult divorce proceedings.

Advocacy groups have highlighted the structural challenges divorcing borrowers face when working with mortgage servicers. Testimony supporting these laws has emphasized that, in the absence of clear statutory requirements, servicers have often defaulted to refinancing at higher rates as the primary method to release a divorced borrower. These practices, combined with affordability concerns and the goal of promoting housing stability (particularly for families with children), have helped build bipartisan support for legislative change.

The emergence of divorce‑related mortgage assumption laws signals a broader policy shift at the intersection of housing finance and family law. By embedding divorce-related assumption rights into mortgage contracts, these statutes provide a more flexible for dividing property while preserving access to favorable loan terms. As additional states consider similar measures, these provisions are likely to become an increasingly standard feature of the consumer mortgage landscape, with meaningful implications for borrowers, lenders, and the broader housing market. Lenders and servicers should expect increasing operational and compliance considerations as these provisions become more widely adopted.

Section 1071 final rule

The Consumer Financial Protection Bureau (CFPB) has issued the final Section 1071 Small Business Loan Data Collection Rule or "Section 1071 rule."

The CFPB states that these changes are intended to simplify the rule, reduce complexity, enhance data quality and align with executive directives. It also notes that adopting a more focused approach centered on core lending products, key lenders and essential data collection will help maintain data quality while minimizing disruption for small businesses and preserving their access to credit. The Bureau points to the phased evolution of data collection under the Home Mortgage Disclosure Act (HMDA) and Regulation C as a model for this incremental approach.

Key changes

• The definition of covered credit transaction excludes merchant cash advances (MCAs), agricultural lending, and small dollar loans in an amount of $1,000 or less, to be adjusted for inflation over time
• The definition of covered financial institution excludes Farm Credit System lenders altogether. It also increases the origination threshold of covered transactions from 100 to 1,000 for each of two consecutive years
• The definition of small business changes the gross annual revenue threshold from $5 million to $1 million
• The final rule removes the discretionary data points for application method, application recipient, denial reasons, pricing information, and number of workers
• Inquiries about a principal owner's sex was revised from a free-form text field to a static binary response of male/female
• The LGBTQI+-owned business data point is no longer a collection point under the final rule
• The final rule eliminates collection of disaggregated categories of race and ethnicity
• A revised comment clarifies that financial institutions retain a general expectation to request demographic data before a credit decision, while the final rule allows collection at a time reasonably designed to obtain a response
• The final rule replaces the tiered compliance schedule and moves the compliance date to January 1, 2028, for all covered financial institutions

There is a 12-month grace period for data collected in 2028.

Lawsuits have been a steady part of the 1071 journey. Some may be dismissed as the underlying controversy is no longer applicable with the narrowed scope of the 2026 final rule. However, others will likely challenge the new 2026 final rule as an effort to compel compliance with the broader 2023 rule.

For additional information, please visit the Small Business Lending under the Equal Credit Opportunity Act (Regulation B).⁶

Colorado Artificial Intelligence Act repealed and replaced

Important: The original Colorado Artificial Intelligence Act (SB 24-205) has been repealed and replaced by Colorado Senate Bill 26-189, signed by Governor Polis on May 14, 2026. The new law takes effect January 1, 2027.

Background

In 2024, Colorado Senate Bill 24-205 was signed into law, adding Part 17 to Colorado's Consumer Protection Code (C.R.S.A. § 6-1-1701, et seq.). That law adopted a risk-based approach to regulating artificial intelligence and established consumer disclosure and notice obligations for entities deploying "high-risk artificial intelligence systems" to make "consequential decisions." TruStage Compliance Solutions developed two documents, the Artificial Intelligence Disclosure and the Artificial Intelligence Adverse Decision Notice, to help financial institutions comply with SB 24-205's requirements, which were set to take effect June 30, 2026.

What has changed

On May 12, 2026, the Colorado legislature passed SB 26-189,⁷ which was signed by the Governor on May 14, 2026. SB 26-189 repeals the original Colorado Artificial Intelligence Act (SB 24-205) in its entirety and replaces it with a new regulatory framework. Key changes include:

• Terminology: From "AI Systems" to "Automated Decision-Making Technology"

  The law replaces references to "artificial intelligence systems" with "automated decision-making technology" (ADMT), defined as a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. The law expressly excludes certain technologies from the ADMT definition, including anti-malware, calculators, databases, spell-checking, spreadsheets requiring manual human analysis and tools used solely to summarize, organize or present information for human review.

• Revised Disclosure Framework

  The original law required four categories of disclosures. SB 26-189 streamlines and refocuses the disclosure requirements:

  • Point-of-Interaction Notice: Before using a covered ADMT to materially influence a consequential decision, a deployer (i.e., financial institution) must provide clear and conspicuous notice to the consumer that ADMT is being used and instructions on how to obtain additional information. A deployer may comply by maintaining a prominent public notice reasonably accessible at points of consumer interaction.
  • Post-Adverse Outcome Disclosure: Within 30 days after a consequential decision that results in an adverse outcome, the deployer must provide:
    • A plain language description of the consequential decision and the role the covered ADMT played;
    • Instructions and a simple process to request additional information about the covered ADMT, including the ADMT name, version number, developer (i.e., the vendor or company that created the ADMT), and types, categories, and sources of personal data used;
    • An explanation of the consumer's rights and how to exercise them.
• Consumer Rights

  SB 26-189 grants consumers who experience an adverse outcome from a consequential decision materially influenced by a covered ADMT the right to:

  • Request personal data and correction of factually incorrect or materially inaccurate personal data used in the decision;
  • Request meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable. "Meaningful human review" is defined as review by a designated individual who has authority to approve, modify, or override the decision, considers relevant primary evidence, is trained to conduct the review, and does not default to the system output.
• Developer Obligations

  SB 26-189 introduces new obligations for developers of covered ADMT, requiring them to provide deployers with technical documentation describing the ADMT's intended uses, categories of training data, known limitations, instructions for appropriate use and human review, and notice of material updates. Both developers and deployers must retain compliance records for at least three years.

• Enforcement

  The Colorado Attorney General has exclusive authority to enforce the new law through the Colorado Consumer Protection Act. A violation is deemed a deceptive trade practice. Before initiating enforcement, the Attorney General must provide a 60-day notice and opportunity to cure (unless the violation was knowing or repeated). The law does not create a private right of action. Beginning in January 2028, the Attorney General must report annually on enforcement actions.

Impact to TruStage Compliance Solutions

TruStage® Compliance Solutions is analyzing SB 26-189 to determine what changes need to be made to the lending and deposit solutions for compliance with the new law and any forthcoming rules from the Colorado Attorney General.

Financial institutions should note that the original June 30, 2026, compliance deadline no longer applies. The new effective date is January 1, 2027. No immediate action is required regarding the previously developed AI disclosure documents. TruStage Compliance Solutions will communicate updated documents and guidance once the analysis of SB 26-189 is complete and the Colorado Attorney General's implementing rules are issued.

For questions or assistance, or to learn how TruStage can help navigate the new AI requirements, please contact your TruStage representative.

Thank you for choosing TruStage® Compliance Solutions. Please know that we value your continued partnership with us.