David Pass

The FedNow Service network transaction limit will increase from $1 million to $10 million in response to growing commercial demand, effective November 2025. The increased limit will enable financial institutions and businesses to support higher-value use cases and reflects an increasing need for speed and certainty in the modern payments ecosystem. #PaymentsInnovationAlliance #FedWire #ISO20022 #PaymentsModernization #SWIFT #LYNX #CHAPS #NACHA #ACH #SameDayACH #FedACH #ACHNetwork #RTR #FedNow #UPI #NEFT #RTGS #RBI #FintechInnovation #DigitalAssets #NPCI #Interoperability #APIs #Ubiquity #CHIPS #RTP #Payments #InstantPayments #RealTimePayments #Zelle #ChinnapaReddy #Banking #Innovation #Fintech #BillPay #B2B #FasterPayments #B2BPayments #SWIFTGPI #FPS #NPP

46

ATTENTION BANK AND CREDIT UNION COMPLIANCE OFFICERS: AI is showing up everywhere in banking conversations. But when it comes to compliance, there is an important difference between answers that sound right and answers that are actually defensible under regulation. Many general AI tools were never designed for regulated decision-making. They can provide helpful responses, but they may miss key regulatory nuances, rely on outdated guidance, or fail to cite the authority that examiners expect. In a regulated industry, that gap matters. This article explains why general AI often falls short for banking compliance—and why purpose-built compliance platforms are designed differently. Read the full article: https://lnkd.in/gWcHzW-9 Russell Taylor Darryl Brasfield Peter J. Van Sistine Chuck Diulus Todd Winship Brian Hoffman Starr Largin Ron Suhr Coy Ogle Juby Joseph Karly Field Eric Howard Kris Bishop Ben Bressler Gary Foster Kate-lyn Sullivan-Longo Rayce Rossum

24

1 Comment

FFIEC just retired the CAT. Banks and credit unions are scrambling. Most are doing this wrong. They're treating the NIST CSF 2.0 migration like a checkbox exercise. Download a mapping spreadsheet. Check the boxes. Call it done. That approach worked when compliance was about surviving audits. It won't work when regulators expect you to actually understand your risk posture. We've helped dozens of financial institutions make this transition. Not by handing them a crosswalk document. By rebuilding their cybersecurity foundation the right way. Three things separate institutions that thrive from those that struggle: First: Risk Assessment Before Mapping Most consultants start with the framework. We start with your actual risk. What threats target your specific asset size? What vulnerabilities exist in your current environment? What's your examiner actually going to focus on? The CAT gave you maturity levels. NIST CSF 2.0 demands you understand why you're at each level. Different conversation entirely. Second: Peer-Based Scoring That Actually Means Something Your $500M credit union shouldn't benchmark against a $50B regional bank. But generic assessments treat you the same. We score against institutions your size, your complexity, your risk profile. When your board asks "how do we compare?" you'll have an answer that matters. Not theoretical benchmarks. Real peer data from similar institutions. Third: Implementation That Survives Examination Mapping documents don't impress examiners. Evidence of risk-based decision making does. We build the documentation trail that proves you understand your controls, not just that you have them. Community bank CEO told me last week: "Our previous consultant gave us a 200-page mapping. Our examiner asked one question about risk appetite and we couldn't answer it." The CAT retirement isn't a compliance headache. It's an opportunity to build cybersecurity that actually protects your institution instead of just checking boxes. Your institution still treating this like a mapping exercise? Or building real risk-based security?

9

7 Comments

The compliance dashboard will be green the morning of the incident. It always is. I’ve been thinking about why the systems we build to prevent failure become the systems that guarantee it. I wrote about it this week. The short version: NIST 800-53 has 1,196 controls across 20 families. Not one measures whether your organization can change at the speed your threat environment demands. ITIL’s change advisory board, SOC 2’s CC8.1, COBIT’s BAI06 — every major governance framework structurally rewards slowing down. Then we’re surprised when teams can’t respond to the next Log4j in time. DORA’s research showed that elite performers deploy 973x more frequently than the lowest performers — with lower failure rates and faster recovery. Speed and stability aren’t tradeoffs. They never were. Deming said this in 1986. We’re still designing governance systems that assume the opposite. The piece traces the pattern from a SaaS onboarding problem I lived through to Log4j to the structural design flaw in how we govern technology organizations. The organizations that can move have the fewest failures. Link below in thread

16

5 Comments

COOP Objectives Ensure the safety of employees Ensure continuous performance of mission‑essential functions Protect essential equipment, vital records, and assets Reduce disruptions to operations Minimize damage and losses Achieve an orderly recovery from emergency operations Identify and prepare alternate facilities for continuity BCP Objectives Identify risks and threats to business operations (Risk Assessment) Identify and prioritize critical business functions (Business Impact Analysis) Implement preventive and mitigation controls to reduce likelihood/impact of disruptions Develop response strategies (communication, manual workarounds, alternate workflows) Establish recovery procedures for restoring operations post‑incident Test and train personnel to validate readiness and continuity capability Continuously update and maintain the plan based on changes and lessons learned #bcp #coop #education #cybersecurity #informationsecurity https://lnkd.in/dMn5R3Sh

4

When IT is viewed as a strategic partner rather than just a cost center, it unlocks powerful opportunities for member service and operational growth. In my work leading IT and digital transformation for credit unions, I’ve seen how targeted investments in infrastructure, automation, and experience-focused tools can deliver results across the organization. • Migrated from on-prem to Azure • Deployed Microsoft Defender and Sentinel with a managed SOC • Ported over 150 reports to Power BI for modern analytics • Integrated fraud detection tools like Jack Henry Financial Crimes Defender These are not just tech upgrades. They are enablers of growth, efficiency, and trust. As IT leaders, we should be helping our organizations move faster, protect better, and serve smarter. I am always interested in connecting with others who are modernizing infrastructure and driving transformation, especially in the credit union space. What’s one change you’ve made that had a major impact? #CreditUnions #ITLeadership #DigitalTransformation #Azure #Cybersecurity #PowerBI #FinancialServices #CIO

46

3 Comments

The new GSE guidance elevates #AI from a technology project to a board level risk. It requires formal executive ownership, continuous model validation, and end to end transparency—not just policies on paper, but evidence that controls work in production. Across the mortgage ecosystem, the mandate is clear: • Seller/servicers: demonstrate compliant controls—or carry the financial exposure • Capital markets: tighten counterparty due diligence to avoid inherited AI risk • Technology vendors: prove governance to win—and keep—enterprise trust A new KPMG report, GSE Guidance on AI: The New Rules of Accountability, details the path to readiness. #Mortgage #AI #GSE #AIGovernance #RiskManagement #ModelRisk #ResponsibleAI 🔗 Read the report: https://bit.ly/45iWYOG

14