August 2026 Regulatory Update: The End of CTA Reporting, Iran Sanctions Pressure, and AI Rules With Teeth

An Ethicast Reacts feature

Federal agencies spent August withdrawing obligations while enforcement narrowed onto what compliance programs produce themselves: the records they hand regulators and the commitments they make to fix problems. Deregulation did not reduce the workload. It moved it.

Case in point: On Aug. 14, FinCEN’s final rule permanently removed the requirement for U.S. companies and U.S. persons to report beneficial ownership information, and the agency began deleting data already submitted — retiring a control set that thousands of programs spent two years building.

In the same month, DOJ imposed a record $250 million premerger penalty and FinCEN assessed the largest Bank Secrecy Act fine ever levied on a broker-dealer. Obligations are being pulled back and enforced harder at once. Below is what August asks your program to do, and where our data says programs actually stand.

Regulatory Change Management Gets Harder When Rules Are Repealed, Not Added

August provided an extended example of addition through subtraction as six different regulatory developments removed an obligation while leaving controls in place with no owner and no rationale.

The Corporate Transparency Act rollback ends U.S. beneficial ownership reporting but leaves foreign reporting companies in scope and customer due diligence untouched. On Aug. 7 the FTC abandoned disparate-impact and “unfair discrimination” theories while continuing disparate-treatment claims under ECOA; state attorneys general and private plaintiffs are unaffected. On Aug. 28 the OCC and FDIC narrowed the definition of “unsafe or unsound practice”, raising the threshold for a Matter Requiring Attention and reclassifying lesser concerns as supervisory observations that carry no board-reporting expectation. And on Aug. 31 the Department of Labor rescinded 29 CFR Part 42, which coordinated enforcement across its wage-and-hour, safety, and employment components, effective Sept. 30.

Why this matters: 96% of World’s Most Ethical Companies® Honorees document a review of current policies, procedures, systems, and controls as part of the ethics and compliance risk assessment. That step is the mechanism that catches a repealed rule, and in most cases, it runs annually It is also the step most likely to be scheduled annually — slower than August moved.

What to do this month: For each August rescission, name the controls, calendars, vendor spend, and board reporting built on the old requirement, and determine which are retired, retained voluntarily, or still required by a different regime.

Sanctions Activity Remains High, Especially Around Iran

August’s sanctions actions underscored the need for due diligence that reaches past the direct counterparty.

On Aug. 24, OFAC indefinitely stayed five Iran authorizations covering educational activities, personal remittances, conference services, and academic and sports exchanges, with no wind-down period. Those activities sit with global mobility, corporate foundations, and events teams rather than trade compliance.

On Aug. 28, OFAC designated a Dubai-based Iranian national and a Hong Kong-registered trading company under Operation Economic Outcast, targeting Gulf banking intermediaries. Two days earlier, it designated UK-based Palestine Action, Italian hosting provider Autistici Inventati under counter-terrorism authority — a designated hosting provider surfaces in IT procurement, not the usual sanctions chokepoints.

The enforcement action shows how far liability travels. On Aug. 12, Wisconsin-based Rice Lake Weighing Systems settled eight apparent Iran sanctions violations arising from its Italian subsidiary’s sales to a UAE distributor, with knowledge the goods were bound for Iran. Exposure ran to the U.S. parent through a European subsidiary and a Gulf intermediary. The penalty was $60,764; the fact pattern is the story, not the number.

Why this matters: 99% of Honorees consider sanctions to be the most commone third-party due diligence risk, and 93% use an online screening tool to track third-party risk changes. The gap August exposed is not whether organizations are screening but what their screening is tuned to catch.

What to do this month: Confirm that your screening vendor ingested these August updates, then run a retrospective pass across vendor, payment, and IT procurement records rather than relying on forward-looking screening alone. Separately, check whether global mobility, events, and corporate giving sit inside your sanctions control perimeter.

The Records You Hand a Regulator Better Be Clean

Several August matters turned on document integrity rather than the underlying conduct. The charged behavior was concealment, falsification, or lying to someone conducting an inquiry.

On Aug. 26, KKR agreed to a $250 million Hart-Scott-Rodino penalty over allegations it altered documents in premerger filings for at least eight transactions and omitted required documents in at least 10. On Aug. 28, MSC Shipmanagement and vessel owner Hong Kong Spirit Shipping pleaded guilty and paid a combined $1.75 million under the Act to Prevent Pollution from Ships, a statute that turns on falsified record books rather than the discharge itself.

The internal-facing version carries the same exposure. On Aug. 6, a federal jury convicted a former Goldman Sachs Executive Director of FCPA and money laundering conspiracy, on evidence he lied to the compliance team vetting the deal and moved the conversation to personal email. On Aug. 14, the FCA banned and fined two former Blue Horizon executives over falsified ownership documents, noting specifically that one denied the misconduct when interviewed during the firm’s own internal investigation.

Why this matters: Honoree programs are well equipped on the inbound side of an inquiry; 99% give investigators guidance on interviews, confidentiality, and case closeout, and 96% have a documented workflow for investigation assignment and escalation. Far fewer have an equivalent control over what the organization certifies and submits externally.

What to do this month: Map every category of document that goes to a regulator, auditor, or internal investigator, and identify who certifies each one and whether anyone can alter it before submission. Then confirm your Code of Conduct names misleading an internal investigation as independent misconduct rather than an aggravating factor.

AI Compliance Stopped Being a Roadmap Item

On August 2, Article 50 of the EU AI Act became applicable: chatbots must disclose they are not human, deepfakes must be labeled, and AI-generated or altered content must carry machine-readable marks. The same date activated the AI Office’s enforcement powers over general-purpose AI model providers, including documentation requests, model evaluations, and fines. Note the offsetting change — the AI Omnibus moved most high-risk obligations to December 2027 and August 2028, so any internal assumption that the whole regime slipped is wrong on the transparency piece.

That same week, Connecticut’s profiling impact assessment obligation took effect under Public Act 25-113, requiring a dedicated assessment separate from the existing data protection assessment. It maps closely onto EU AI Act high-risk documentation, which argues for one template rather than two processes. Then on Aug. 27, the FTC finalized consent orders totaling $930,000 against Cox Media Group and two other firms over claims they offered an AI service targeting ads using conversations captured from smart devices. The service did not use voice data, but the FTC noted that had it worked as advertised, the collection would itself have violated the FTC Act.

Why this matters: Of the 117 practitioners in Ethisphere’s The State of AI Adoption in Ethics & Compliance report, 85% have a written AI use policy or guidance, but only 21% require AI-generated content to be identified or labeled. Labeling and provenance are precisely what Article 50 now requires externally. Meanwhile, only 11% describe themselves as very prepared for an audit or regulator inquiry into their AI use.

What to do this month: Inventory customer-facing AI and synthetic content workflows and verify that disclosures and machine-readable marks are in production, not scheduled. Then extend that labeling standard to AI-assisted work produced inside the compliance function, because the documentation question a regulator asks about your program will look like the one the AI Act asks about your products.

Everything Else from August 2026

Below is a list of 64 other regulatory developments worth noting:

What to Watch in September and October

• September 21: The FCA’s new inside information declaration form becomes mandatory for all new UK equity cases
• September 30: DOL’s rescission of its coordinated enforcement framework takes effect
• End of September: First public SEC Rule 605 execution-quality reports covering August data are due
• October 7: Comments close on USTR’s 2026 Notorious Markets Review
• October 19: Comments close on the FDA’s generative AI-enabled medical device docket
• October 26: CBP’s electronic export manifest requirement for rail cargo takes effect

Frequently Asked Questions

Is the Corporate Transparency Act still in effect?
The statute remains law, but as of Aug. 14, 2026, U.S. companies and U.S. persons no longer report beneficial ownership information to FinCEN. Foreign entities registered to do business in the United States are still reporting companies and must report information for foreign individuals.

Does the end of beneficial ownership reporting change customer due diligence obligations?
No. Financial institutions’ customer due diligence requirements, including beneficial ownership collection at account opening, are unaffected. The two obligations are separate, and conflating them is the most common misreading of this change.

Are companies still exposed to disparate-impact discrimination claims?
Yes. The FTC’s August policy statement addresses only what the FTC will pursue. State attorneys general, private plaintiffs, and other federal agencies are unaffected, and federal contractors face separate False Claims Act exposure where certifications are involved.

Keep Up With Regulatory Change

Knowing what changed is the easier half. Knowing whether your program’s response matches what comparable organizations do is the harder one. The benchmarking behind this piece comes from the Business Ethics Leadership Alliance (BELA).

This roundup covers developments published August 1–31, 2026. It is not legal advice — verify against the linked source before acting. Last updated September 1, 2026.

Author Bio

Erica Salmon Byrne, J.D.  |  Chief Strategy Officer and Executive Chair, Ethisphere

As Chief Strategy Officer and Executive Chair, Erica Salmon Byrne is responsible for ensuring continuous and strong growth for the company while maintaining Ethisphere’s founding ethos that good businesses do better.

Bill Coffin  |  Editor-in-Chief, Ethisphere Magazine, Ethisphere

Bill Coffin is an internationally recognized writer and editorial leader in the fields of ethics, compliance, insurance and risk management. His work has appeared in The Wall Street Journal, BusinessWeek, Forbes and Fortune, as well as Compliance Week, National Underwriter, Risk Management, Best’s Review and other B2B media. Previously, Bill served as Director, Senior Editor at AIG, leading content strategy for one of the world’s largest insurance companies.