The Financial Brief, Issue 1, September 2026.
No amount of money closes a data breach file by itself. A judge just rejected a $2.3 million credit union settlement because the credit union could not produce data breach documentation showing its controls actually improved, or that the payout was fair to the members whose data got out. An examiner asks a simpler version of the same question. Not whether your controls are good, but whether you can show what happened, when, and who approved it. If that takes three days of digging through old email, you already know the answer.
This issue covers three things that happened in the last month, what each one means if you run a firm this size, and the one thing worth doing before anyone asks.
Why does data breach documentation matter more than the settlement check?
In the credit union case, the number on the table was not the problem. The judge called the settlement deficient because there was no record proving the fix actually happened or that members were treated fairly. That is the part people skip: the check does not close the file, the proof does. Skip that step and you get to do it twice, once for the breach and once for the court that sends you back to redo the paperwork. For a firm this size, the lesson is not “settle faster.” It is “keep the record as you go,” because rebuilding it after the fact, under a judge’s deadline, costs more than keeping it in the first place.
What happened with the FinWise Bank data breach settlement?
FinWise Bank agreed to pay $2.8 million to settle a class action after a breach exposed customer data. FinWise is not a household name, and that is the point. Small and mid-size banks and credit unions are not too small to sue, they are just easier targets. For a firm this size, the takeaway is that plaintiffs’ attorneys are already reading breach notices from institutions your size, not just the giants.
What happened with the TradeZero fine, and does size protect you?
Massachusetts fined TradeZero after a breach exposed thousands of customer records. Regulators are not reserving enforcement for the largest firms anymore. They are applying the same standard to mid-size financial firms that they used to reserve for banks with household names. For a firm this size, that means the old assumption, that you are too small to draw a fine, no longer holds.
What other September cases should financial firms watch?
Two more are worth ten minutes of your attention. Federal regulators found the IRS still has cyber weaknesses putting taxpayer data at risk, according to its own watchdog. If the tax agency struggles here, do not assume your firm’s setup is fine by default. Separately, Google was fined 403 million euros over GDPR violations tied to location data, a reminder that you do not need Google’s scale to get data handling wrong, just customer data and a form nobody reviewed lately. Also worth noting: Aeroméxico is under investigation over a leak touching 15 million people. A breach that size follows a company into every contract renewal, not just the headlines, which is exactly the kind of long tail a firm this size cannot absorb quietly.
What’s the one thing that actually matters right now?
An examiner will not ask whether your controls are good. They will ask you to show what happened, when, and who approved it. If that takes three days of digging through old email, you already know the answer. The firms that get through a review quietly are the ones who can produce the record on the spot, and they tend to close their books faster too. That is the whole brief in one sentence, and it applies whether the audience is an examiner, a plaintiff’s attorney, or a judge deciding whether your settlement is real.
What should your firm do this week?
Three things, yourself, no ticket required:
- Pull your current client or member data access list and check who signed off on it, not just who has it.
- Time yourself finding the approval trail for one recent hire and one recent exit. Anything over an hour is your answer.
- Write down, in one sentence, who approves access changes today. If you cannot, that is the gap an examiner or a plaintiff’s attorney will find first.
TC³ can help you build the access record so it is ready before anyone asks for it, from hire to exit. We do not write your settlement agreement or stand in for your attorney, that part stays with the professionals who handle it for a living. For more on how this applies to regulated financial firms, see our financial services page, and browse ongoing coverage at our compliance and regulatory updates hub.
This is issue 1 of The Financial Brief. Catch up on past issues in the series archive.
The only settlement a judge will not reject is the one where nobody had to ask what happened in the first place. If you want this brief in your inbox each month, subscribe here.