Legal & Compliance — November 1, 2026 Monthly

On October 1, 2026, the SEC proposed amendments to custody rules for registered investment advisers and regulated funds covering crypto assets, introducing a new 'self-custody' option when no qualified custodian is available and expanding permitted custodians to include state trust companies meeting specified conditions [4]. Commissioner Peirce confirmed the proposal addresses years of regulatory uncertainty for advisers holding crypto assets.

A purported antitrust class action filed October 2, 2026 characterizes Thomson Reuters' $650 million acquisition of Casetext as a 'killer acquisition' that eliminated a budget-friendly legal research option and forced users into more expensive Westlaw rates — the first major antitrust challenge to legal tech consolidation in the current M&A wave [1a].

The Dutch Data Protection Authority fined Uber €824,990,000 on October 8, 2026 for unlawful automated decision-making and insufficient information on profiling under the GDPR — one of the largest GDPR fines ever imposed and the first major enforcement action applying the EDPB's harmonized fining methodology adopted September 21, 2026 [11].

The UK Law Commission published a major proposal on October 8, 2026 for an overhaul of product liability law for the digital age, continuing the Law Commission's sustained 2026 reform agenda that has also addressed homicide offences, commercial leasehold, and weddings law [13].

The OCC assessed a $350 million civil money penalty against American Express on October 8, 2026 [12], representing one of the largest OCC enforcement actions of the year and the first in a sequence of escalating OCC enforcement actions that culminated in the $750 million Bank of America assessment the following week.

The DOJ Fraud Division's October 1, 2026 Corporate Enforcement Directive provides the most concrete public benchmarks for DOJ Fraud Division charging decisions to date, including specific thresholds: conduct lasting at least three years, effects in three or more federal districts, 25 or more victims, and losses of at least $25 million [5a]. The directive also centralizes post-resolution compliance oversight within the new Corporate Enforcement Section.

The OCC released a report on October 14, 2026 finding that all nine of the largest banks under its supervision had policies between 2020 and September 2025 that presented elevated risk of encouraging denial of financial services based on political or religious beliefs or lawful business activities [12]. The OCC also imposed a $750 million assessment against Bank of America for deficient BSA/AML compliance on October 13, 2026.

The U.S. Department of Justice threatened the ABA Section of Legal Education and Admissions to the Bar council with an antitrust investigation on October 15, 2026 if it does not change by the end of the month standards limiting adjunct professor involvement in law school teaching [1a]. This is the first direct federal antitrust enforcement threat against the primary accreditor of U.S. law schools.

On October 14, 2026, the Council of Europe opened a new treaty strengthening criminal asset recovery for signature, with eight countries and the European Union signing at launch [9]. A Council of Europe conference simultaneously marked 25 years of the Budapest Convention on cybercrime. Montenegro also deposited its instrument of accession to the 2000 Protection of Adults Convention on October 13, bringing the total to 17 Contracting Parties.

The OCC issued a final rule on October 21, 2026 to implement the GENIUS Act, establishing the first comprehensive federal regulatory framework for permitted payment stablecoin issuers, with accompanying bulletins on waivers, application guidance, and revised reporting forms [12]. This creates immediate new compliance obligations for banks and fintech companies seeking to issue or hold stablecoins under federal supervision.

On October 21, 2026, a jury ordered Meta to pay New Mexico $25 billion for violations of state consumer protection law through misleading statements about data privacy, misinformation, hate speech, and oversight of app developers following the Cambridge Analytica matter [2]. This is the largest state-level consumer protection verdict against a technology platform on record.

On October 22, 2026, the CJEU found Hungary and Czech Republic infringed EU law by allowing suspects to be questioned without a lawyer if counsel does not attend within a prescribed period [8]. Combined with the October 15 judgment against Hungary on trafficking penalties, this represents a sustained pattern of CJEU infringement proceedings against Member States on fundamental rights and criminal procedure standards.

The World Justice Project released the 2026 WJP Rule of Law Index on October 21, finding that declines outnumber improvements for the ninth consecutive year, with 62% of countries declining versus 38% improving [16]. The WJP also published analysis linking predictable legal systems to GDP growth, inflation control, and sovereign credit risk.

Glass Lewis proposed replacing its single benchmark voting policy with four distinct proxy voting perspectives beginning with the 2028 U.S. proxy season: Business Fundamentals, Foundational Governance, Global Stewardship, and Sustainability Focused. Pay Governance analysis found approximately 41% of funds align with Foundational Governance and 44% with Global Stewardship per SEC Form N-PX data [5c].

The Delaware Court of Chancery preliminarily enjoined Cloudflare's proposed recapitalization on October 16, 2026, with Vice Chancellor Laster's 142-page opinion affirming Section 144's robust protections while finding the special committee may not have acted in good faith due to unauthorized backchannel communications and deleted Signal messages [5h]. The decision confirms Section 144 safe harbors require genuine independence and documented good faith.

NYU law professors published analysis on October 15 arguing mandatory arbitration of shareholder claims is 'on the horizon,' with SEC Chair Atkins having changed the SEC's long-standing policy against mandatory arbitration and SpaceX going public with mandatory arbitration bylaws [5i]. The analysis argues mandatory arbitration could erode Delaware's competitive advantage and reshape state competition for corporate charters.

The EDPB adopted Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR on September 17, 2026, reported in Week 4 [2]. The UK ICO launched a call for evidence on agentic AI on October 8, 2026, following its October 14 report on AI foundation model developers. Together these signal that EU and UK regulators are actively clarifying how existing privacy frameworks apply to AI systems and autonomous agents.

Nasdaq and NYSE Arca are targeting a December 6, 2026 launch of 23-hour-per-day, five-days-per-week trading following SEC approval of Nasdaq's proposal on April 10, 2026 [5b]. Listed companies must immediately review insider trading policies, trading window procedures, equity plan Fair Market Value definitions, and disclosure timing practices before the launch date.