|
News
SDBA Updates
SDBA Events
Online Education
ABA Banking Journal: OCC finalizes stablecoin rule with narrow payment-of-interest prohibition
October 21, 2026
 The Office of the Comptroller of the Currency today finalized a rule to enforce the Genius Act with a narrower prohibition on payment-of-interest than the agency originally proposed, although it expects to issue future rulemaking on the subject.
The Genius Act passed last year by Congress created a regulatory framework for payment stablecoins, including a prohibition that prevents issuers from offering yield or interest for stablecoins. The banking agencies have proposed regulations to implement the law, with the OCC the primary regulator of nonbank stablecoin issuers.
The American Bankers Association and others have noted that payment stablecoins are distributed through exchanges and intermediaries — not directly by issuers — which would allow those firms to skirt the payment-on-interest prohibition. Earlier this year, they urged OCC to strengthen its proposed language to enforce the prohibition. Instead, the agency did the opposite in its final rule, removing language that would have presumed certain transactions with affiliates and related third parties violated the prohibition.
“Because payment stablecoins are a nascent market, the OCC does not believe that it is appropriate to impose a rebuttable presumption with respect to the yield prohibition at this time,” the agency stated in the final rule.
Still, as the payment stablecoin market develops, “the OCC anticipates that it will gain sufficient experience with identifying prohibited transactions to allow it to propose a rulemaking clarifying the yield prohibition that does not have the disadvantages noted above,” it said.
In addition to the final rule, the OCC finalized a related rule to allow bank subsidiaries and other stablecoin issuers to request waivers from certain Genius Act requirements, and it finalized the reporting forms issuers must submit.
“We are providing a clear, practical framework for payment stablecoin innovation, with strong standards for reserve backing, redemption, and risk management,” Comptroller of the Currency Jonathan Gould said. “The OCC is drawing on its longstanding supervisory expertise to support responsible growth and innovation for this new industry.”
ABA response
While the final rule includes several positive steps, ABA disagrees with the OCC’s decision to move away from its original position on stablecoin yield, ABA President and CEO Rob Nichols said.
“The result is a final rule that will preserve the status quo for crypto platforms despite Congress’s clear intent to protect local lending,” he said.
By removing originally proposed safeguards, payment stablecoin issuers can provide economically equivalent yield while technically avoiding the statutory prohibition, Nichols said. The OCC also declined to adopt a broader presumption against arrangements designed to circumvent the ban.
“Those gaps risk undermining the distinction Congress drew between payment stablecoins and traditional bank deposits, threatening the funds banks use to make the loans that drive the U.S. economy,” he said. “And while we appreciate the OCC’s recognition that additional supervisory experience may inform future action in this area, attempting to address deposit flight and economic harm after it has occurred is the wrong approach. We will continue to work with regulators and policymakers to ensure the Genius Act is implemented in a manner that supports innovation while preserving financial stability, consumer protection and fair competition.”
Original Article
ABA Banking Journal: Studies gauge fraud costs for banks, financial services
October 22, 2026
 Every $1 of fraud now costs U.S. financial services firms $5.47, up from $4 in 2021, according to new research by LexisNexis. At the same time, a separate study by PYMNTS.com found that U.S. financial institutions now spend more than $2 to stop every $1 lost to fraud.
The LexisNexis survey measured fraud losses in impacts to operations, compliance, consumer trust and more. Half of respondents said that in the past year, fraud had a significant impact on their businesses by eroding customer trust, with 44% also citing fraud losses as having a significant impact.
Websites and mobile apps accounted for nearly 70% of fraud losses, and 96% of institutions reported more fraud targeting mobile channels, according to LexusNexus. In addition, financial institutions estimated that AI-generated techniques contributed to 19% of fraud losses in the U.S.
The PYMNTS.com study estimated that losses per financial institution reached $1.92 million in 2026, up 8% from $1.78 million in 2024. Investment in fraud prevention – which includes spending on staff, software and outsourced fraud services – rose from $1.67 million per institution in 2024 to $4.35 million in 2026.
“So, financial institutions now spend $2.27 to stop every $1 that still gets through, more than double the $0.94 they spent in 2024,” according to the study.
The study found that large banks cut their estimated fraud losses by nearly half during the time period studied. Estimated losses for regional and community banks and credit unions increased slightly, from $950,000 per institution to $1.05 million. Nonbank financial technology firms experienced the greatest increase in fraud losses, from $800,000 to $2.84 million per institution.
Original Article
Abrigo: AI and generative AI use cases in banking: 6 real-world examples
 A couple of years ago, many banks and credit unions were still cautious about introducing generative AI into day-to-day workflows. That conversation has changed. Financial institutions are increasingly moving beyond experimentation to identify practical applications for GenAI, establish governance, and determine where the technology can improve productivity, decision-making, and customer or member service.
Original Article
U.S. Treasury Identifies $270 Million in Suspicious Activity Linked to Federal Student Aid Fraud
FinCEN Refers Findings to Federal Investigators to Combat Fraud and Protect Taxpayer Dollars
WASHINGTON – The U.S. Department of the Treasury announced today that its Financial Crimes Enforcement Network (FinCEN) has identified approximately $270 million in suspicious financial activity potentially linked to fraud against federal student aid programs. FinCEN has referred these findings to federal investigators to pursue potential fraud schemes targeting federal student aid programs and help ensure those responsible are held accountable. These referrals underscore the Trump Administration’s commitment to eliminating fraud, protecting taxpayers, and safeguarding the integrity of federal student aid programs.
“Federal student aid is intended to expand educational opportunities, not line the pockets of fraudsters who steal from students pursuing their education and hardworking taxpayers,” said Treasury Secretary Scott Bessent. “The Trump Administration will not tolerate criminals who exploit government programs for personal gain. Treasury is working with financial institutions and law enforcement to identify these fraud schemes, recover stolen funds, and hold those responsible accountable.”
“Federal student aid is meant to support students, not fraudsters. That is exactly why we introduced the new FAFSA fraud detection tool earlier this year, which stops fraud at the start of the federal student aid process,” said Education Secretary Linda McMahon. “We are proud to partner with the White House Task Force to combat fraud, waste, and abuse across these critical programs – already saving American taxpayers more than $2 billion in less than 2 years!”
In a July 2026 Alert, FinCEN warned financial institutions about student aid fraud and asked them to report suspicious activity. That Alert explained that schools or their payment contractors often send aid refunds by electronic bank transfer and that the payment description often includes the word “refund” along with the school’s name or initials. The Alert also noted that fraudsters often move stolen aid through money mules, shell companies, and fake accounts to hide the source of the money. These red flags help financial institutions spot suspicious payments and report them to FinCEN in suspicious activity reports, as required by the Bank Secrecy Act (BSA).
Financial institutions have filed nearly 100 suspicious activity reports since the July Alert. FinCEN’s review of these reports identified more than 20,000 potentially suspicious transactions since February 2026. These reports reflect suspicious activity that has been identified and reported by financial institutions and, therefore, should not be considered a complete representation of the scope of any particular type of suspicious activity. Accordingly, FinCEN has referred this information to law enforcement as tip-and-lead information for further investigation.
Federal student aid fraud schemes often involve fraudulent enrollments designed to divert financial assistance away from legitimate students. In “ghost student” schemes, criminals steal personal information, such as names and Social Security numbers, and use it to enroll fake students in classes under a victim’s identity. Fraudsters may also use super intelligence to produce fake documents that blend stolen information with invented details, which creates what are known as synthetic identities that can pass identity checks. Victims, including minors, often do not know that someone has received student aid in their name.
In “straw student” schemes, fraud rings pay real people for their personal information, enroll those people at a school, and then keep the aid refunds issued to them. Corrupt school employees sometimes help these rings by recruiting straw students and altering their school records. Student aid fraud drains taxpayer funds, and in some cases, keeps real students out of classes that fake enrollees have filled.
Student aid fraud has real consequences for students and American taxpayers. It drains finite grant resources from deserving students, potentially prevents legitimate students from enrolling in classes occupied by fraudulent enrollees, and can leave identity theft victims responsible for debts they never incurred.
As part of the Trump Administration’s efforts to eliminate fraud, waste, and abuse across the federal government, Treasury is working with the White House Task Force to Eliminate Fraud, led by Vice President Vance, and encouraging whistleblowers to report credible information involving fraud, money laundering, sanctions violations, and tax-law violations. Whistleblower tips, combined with financial institutions’ reporting under the Bank Secrecy Act, help Treasury and its law enforcement partners uncover criminal networks, recover taxpayer funds, and hold bad actors accountable.
Treasury will continue to leverage financial intelligence, strengthen coordination across government, and pursue those who seek to profit by defrauding American taxpayers and harming legitimate students.
Original Article
CISA News: CISA urges organizations to immediately patch vulnerabilities found in many websites
October 21, 2026
 The Cybersecurity and Infrastructure Security Agency is urging organizations to immediately patch two critical vulnerabilities found in a programming language used by many websites.
According to a CISA alert, organizations should identify and inventory systems running any version of PHP, then apply a patch immediately, prioritizing internet-facing systems. Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
The PHP vulnerabilities were found using artificial intelligence. CISA said that while it has not observed any exploitation of the vulnerabilities, they pose a risk to organizations if left unpatched.
Original Article
Today's PHP Security Release, and How We're Strengthening PHP Security
October 21, 2026 | The PHP Foundation
Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems.
This post isn't about how to update. It's about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP's security work going.
- CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP's memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.
- CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.
Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.
A first external audit and increased security focus
In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.
To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.
Building a sustainable professional security organization
Over the last months the way PHP security work is organized has changed considerably. In May 2026, the PHP Foundation created the Ecosystem Security Team, which works alongside the PHP security team on triage, coordination, and hardening. Volker Dusch's work as AI Security Engineer in Residence at the PHP Foundation has significantly improved communication and collaboration between the PHP security team and the Foundation. Alexandre Daubois joined the PHP Foundation in July to help the PHP security team triage, handle, and fix security reports and Daniel Scherzer joined in September to take on hardening work.
Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI's Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that match our CI on every platform PHP supports.
The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th. More recently, Trail of Bits has also been auditing PHP. The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation's team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties.
The growth of AI-assisted research also means the PHP security team receives far more reports than before. As Alexandre Daubois described last week in How the PHP Security Team Handles Your Reports, the team has published 15 CVEs since July 1st and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch.
Leak and disrupted disclosure
The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date.
On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC. Distributors were still packaging the fix, so releasing immediately would have left many users without an easy way to update. Moving the release forward by one day was the best compromise between acting quickly, giving people time to prepare, and making sure everyone had a simple update path when the vulnerabilities were disclosed.
As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.
Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing PoCs after the leak but did not identify any functional exploits at the time of release/public disclosure.
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
A cautiously optimistic outlook
Today's release shows the progress we’re making in how PHP security is handled. Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly.
We are confident that a serious vulnerability with a fix stuck on hard trade-offs would now reach the PHP Foundation leadership much sooner, as we’re changing processes so leadership can help steer the situation to a timely resolution. We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future. The PHP Foundation and the PHP security team learned a lot in the last weeks and will work to turn their experiences into lasting repeatable processes.
What we need from you
PHP runs a large share of the web, including government services, online stores, banks, media sites, and much of the software that businesses rely on every day. Yet security work on PHP itself still depends on a small group of foundation-funded developers and a little volunteer help.
Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing. What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch. Making those decisions takes experienced engineers who know the entire PHP codebase, and today there are too few of them.
A core part of the PHP Foundation's mission is to grow the number of engineers with deep knowledge of the PHP codebase and give the security team the resources it needs. We can only achieve this goal with funding from those who depend on PHP:
- Companies that build products and services on PHP: please sponsor the PHP Foundation at a level that reflects how much you rely on it.
- Hosting providers, cloud platforms, and distributions that deliver PHP to millions of users.
- Governments and public institutions whose services run on PHP. The German Sovereign Tech Agency's funding of the 2024 audit shows what public investment can achieve, and we need more of it, on a sustained basis.
Sponsoring the PHP Foundation is the most direct way to ensure structural issues like the OOM vulnerability are addressed sustainably, before they turn into emergencies. Become a sponsor at thephp.foundation/sponsor, and if your organization would like to talk about a larger commitment, get in touch.
Original Article
Order your 2027 South Dakota Bank Directory
 The South Dakota Bank Directory provides detailed information on all South Dakota banks including addresses, telephone numbers, important contact names and additional pertinent information. The directory also contains information on the SDBA, banking associations, regulatory agencies, endorsed vendors, associate members and South Dakota officials.
Place your order for your 2027 SD Bank Directory!
All member banks, associate members, and endorsed vendors receive one complimentary copy.
2026 NEXT STEP: Emerging Leaders Summit
October 28-29, 2026 | The Lodge at Deadwood | Deadwood, SD
NEXT STEP: Emerging Leaders Summit is more than a conference—it's a leadership experience designed to cultivate, connect, engage and empower South Dakota's future bank leaders. Combining thought-provoking presentations, interactive workshops and meaningful networking, the Summit creates space for emerging leaders to step away from their daily responsibilities, invest in their personal and professional growth, and build lasting connections with peers from across the state.
Throughout the day, participants will strengthen their leadership skills, discover new perspectives, exchange ideas and gain practical tools they can immediately apply within their banks and communities. Whether developing greater self-awareness, tackling real-world challenges or expanding their professional network, attendees will leave inspired, better connected and prepared to take the next step in their leadership journey.
Details + Registration
UMACHA: Let's Talk Payments
November 18, 2026 | Zoom
2027 B.I.G Career & Internship Fair
 The 2027 B.I.G. Career & Internship Fair will be held Thursday, February 18, 2027, from 10 a.m. to 2 p.m. at the Ramkota Hotel & Conference Center in Sioux Falls, SD. Sponsored by the South Dakota Association of College Career Centers (SDACCC), this event connects employers with 300–600 job seekers, college students, and prospective interns from across the region.
Employers are encouraged to register early, as booth spots are limited, with discounted booth rates of $350 available through February 1, 2027.
Details + Registration
Enrollment is open for GSBC's 2027 Annual School Session
2027 National School for Experienced Ag Bankers
The National School for Experienced Ag Bankers is a seminar for experienced ag bankers who want to further develop their ag lending skills, learn new skills, confirm existing methodology and meet fellow bankers who share the same career path. Taught by a nationally-recognized faculty of bankers, academics and other real-world ag banking practitioners, this program is focused on ag lending opportunities and challenges that are relevant to ag bankers from across the United States.
The curriculum for this school is built on a foundation of six pillars that are essential to ag bankers:
1. Advanced Ag Credit Making Skills
- Cash to Accrual
- Understanding Advanced Marketing Concepts
- Multi-Entity Lending
2. Problem Loan Servicing and Resolution of Problem Loans
- Analyzing Causes of and Corrective Actions
- Understanding and Avoiding Lender Liability Situations
- Improving Lender-to-Borrower Communications
3. Intermediate and Long-Range Farm Economic Outlook
4. Business Ethics
5. Real World Case Studies
6. Peer Interactions
All sessions will be presented in a relaxed, open format seminar approach that encourages you to interact with fellow students and faculty. For a detailed look at the curriculum, visit www.sdba.com/ag-school.
Details + Registration
Online Education
Participating in learning opportunities outside the bank can be challenging. Take advantage of the SDBA's extensive selection of webinars and on-demand training to enhance your banking expertise directly from your computer.
GSB Online Seminars
OnCourse Learning
SBS Institute
ABA Training
OnCourse Learning: RTP® Self-Audit Made Simple workshop: A Step-by-Step Guide & FedNow®
October 30, 2026 | Webinar
This session explains the requirements of the RTP® self-audit process. We’ll cover the compliance checkpoints, monitoring practices, and reporting expectations so your institution can meet RTP® obligations with confidence.
Details + Registration
Learn how to put compliance management solutions from Compliance Alliance to work for your bank, by contacting (888) 353-3933 or [email protected] and ask for our Membership Team. For timely compliance updates, subscribe to Bankers Alliance’s email newsletters.
SDBA eNews Archive
Advertising OpportunityLearn more about sponsoring the SDBA eNews
Questions/Comments
Contact the SDBA at 605.224.1653 or via email
|
