Financial Services

Bangladesh makes more of the world's clothing than any country except China, and a third of the banks financing that industry are buried in bad loans.

Radiant World is one of the world's largest iron-ore traders. A major Italian bank financed its trades for years. Then the bank called the company those invoices said it was trading with, and got a very different answer.

LockBit listed U.S. Bancorp on its leak site this week and set a deadline: pay by September 3 or the data goes public. The bank says its own systems were never touched.

For 39 years, ISS had the Justice Department's word it wouldn't come after it. That word is gone.

The companies whose entire business is pricing catastrophe just did something they had never done before. They sold US terrorism risk to investors.

In 2007 the question was whether your bank held mortgage-backed securities. Most companies had no idea, because the risk was bundled and resold under names that hid what was inside. The same structure is forming now, and it is concentrated in one sector.

Last week we wrote about the cyber insurance market and the gap between having a policy and collecting on it. This is a different policy and a different gap.

The price of cyber insurance is falling, and the cheaper it gets, the easier it becomes to mistake a policy for protection. A cyber claim is denied far more often than most buyers expect, and a soft market widens the gap between having coverage and being protected.

A Russia-linked transaction your compliance team clears under US rules can be a violation under European rules the same afternoon. The two largest sanctions regimes are moving in opposite directions, and the gap between them is now your company's problem to manage.

On June 4 and 5, the Supreme Court issued two rulings that changed how federal agencies can come after companies.

Berkshire Hathaway, Chubb, and Travelers began filing AI exclusion endorsements with state insurance regulators in late 2025. Regulators approved more than 80 percent of the applications. In January 2026, ISO (the insurance industry's standards body) issued three new generative AI exclusion forms for commercial general liability policies. The exclusions carve out bodily injury, property damage, defamation, and intellectual property infringement tied to AI-generated outputs.

On May 21, the New York Department of Financial Services (NYDFS, the state regulator overseeing banks, insurers, and crypto firms operating in New York) issued two industry letters to its regulated entities. The first, addressed to CISOs, warns specifically about frontier AI risks. The second provides broader guidance for operating in a heightened threat environment. The letters warn that frontier AI models are accelerating vulnerability discovery, exploit development, and social engineering attacks, citing a CrowdStrike finding of an 89 percent year-over-year increase in AI-enabled attacks.

[Earlier this month](https://stateofthethreat.com/weekly/2026-05-10) we flagged the Financial Stability Board's estimate of $220 billion in bank exposure to private credit across its member jurisdictions. JPMorgan moved first.

The US sanctions architecture works because the dollar is unavoidable. Every cross-border payment that touches a US correspondent bank is subject to US jurisdiction. One system, one set of rules, one compliance framework. Treasury Secretary Scott Bessent has been offering dollar swap lines to allies to reinforce this position. The UAE negotiated one as part of its exit from the oil cartel. The logic: if you stay in dollars, you stay under our security umbrella.

The dot-com crash played out on a ticker. NASDAQ dropped 78 percent. The AI boom is being funded differently. A significant share of the money flowing into AI companies is coming through private credit, loans made by funds outside the traditional banking system that now hold between $1.5 and $2 trillion in assets. The Financial Stability Board (FSB, the international body that coordinates financial regulators across the G20) published its first dedicated report on the sector on May 6 and found opaque valuations, zero stress-test history, and a new wave of wealthy retail investors being invited in through semi-liquid funds.

The United Arab Emirates quit OPEC (the Organization of the Petroleum Exporting Countries, the cartel that coordinates oil production among major exporters) on May 1 after nearly 60 years. The cartel's third-largest producer didn't leave over a quota dispute. It left because a fellow OPEC member's military hit its oil infrastructure, and the cartel couldn't do anything about it.

The United States has sanctioned more than 1,000 Iran-related targets since February 2025. Iran is collecting an estimated $20 million per day in transit tolls through the Strait of Hormuz anyway, in currencies that never touch a dollar. The sanctions weapon has never been swung harder, and it has never mattered less to the revenue it was designed to cut off.

On June 3, the SEC's amended Regulation S-P takes effect for thousands of smaller financial firms. Investment advisers managing under $1.5 billion, smaller broker-dealers, fund companies, and transfer agents must have a written incident response program, notify affected customers within 30 days of a breach, and require their service providers to report breaches within 72 hours. The rule was adopted in May 2024. The first compliance deadline passed in December for larger firms. The majority of SEC-registered investment advisers fall under the $1.5 billion threshold, which means most of the industry hits the deadline in June. This is the first major update to Reg S-P since it was written in 2000.

Global losses from financial fraud hit $442 billion in 2025, according to INTERPOL's March threat assessment. Behind that number is an industrial operation. Criminal syndicates across Southeast Asia, Africa, and Latin America run fraud compounds housing hundreds of thousands of people trafficked from nearly 80 nationalities. Passports confiscated. Fourteen-hour days running pig butchering schemes (long-con investment fraud where victims are groomed over weeks), romance scams, and business email compromise campaigns. The UN Office of the High Commissioner for Human Rights estimates more than 220,000 people are held in scam compounds across Myanmar and Cambodia. INTERPOL found that AI-enhanced fraud is now 4.5 times more profitable than traditional methods.

Last week we reported that more than half of cyber insurance claims were denied. This week, the war that just started may have voided your policy entirely.

Most boards hear "we have cyber insurance" and consider the risk transferred. The claims data says otherwise.