151 Enforcement Filings in Four Weeks. Your Compliance Function Was Built for the Drafting Era.

TLDR: Enforcement now lands in fiscal-year surges across several regulators at once, so a compliance operating model sized for consultation calendars needs surge capacity and evidence it can produce within days.

Four US registers logged 151 enforcement filings between 14 September and 11 October 2026

In the four weeks from Monday 14 September to Sunday 11 October 2026, four public US enforcement registers recorded 151 filings. The Securities and Exchange Commission (SEC) opened 54 new administrative proceedings¹ and published 35 litigation releases². The Food and Drug Administration (FDA) posted 59 warning letters³, and the Commodity Futures Trading Commission (CFTC) announced three enforcement outcomes⁴. Kainjoo counted each figure entry by entry from the regulator’s own register.

The weekly totals matter more than the sum. The busiest week carried 51 filings and the quietest 27. Inside the SEC column the swing is sharper: 21 new proceedings in the week of 21 September, then one in the week of 5 October.

Exhibit 1. Enforcement filings by register and week, 14 September to 11 October 2026: the peak sits at fiscal year-end

Week of	SEC new cases	SEC lit. releases	FDA letters	CFTC	Total
14 Sep	19	5	2	1	27
21 Sep	21	6	17	1	45
28 Sep	13	16	21	1	51
5 Oct	1	8	19	0	28
Total	54	35	59	3	151

Source: Kainjoo count of the SEC administrative-proceedings and litigation-release registers, the FDA warning-letter register (by posted date) and CFTC press releases, read on 14 October 2026. Weeks run Monday to Sunday. Full links in References.

The count separates new cases from paperwork in old ones

Each SEC proceeding carries a file number, and the 54 new cases hold every number from 3-22717 to 3-22770 in sequence. Fourteen further entries in the same weeks were orders in older matters, such as fund distributions and modified sanctions, and sit outside the count. Reading the 54 orders themselves gives the mix:

• 26 are proceedings under Section 12(j) of the Securities Exchange Act to revoke the registration of listed companies that stopped filing periodic reports.
• 24 are cease-and-desist proceedings, among them orders against J.P. Morgan’s broker-dealer and bank over security-based swap dealer obligations, and against Jefferies over incomplete trading data supplied to SEC staff.
• Three bar individuals from the securities industry following court injunctions.
• One proceeds against an accountant under Rule 102(e) of the SEC’s Rules of Practice.

Set the 26 delinquent-filer revocations aside and 28 substantive new SEC cases remain, each one a matter some firm had to answer. Litigation releases cover court actions at every stage, including final judgments in older cases, so each release counts as a filing rather than a new case. FDA letters are counted when posted: 22 of the 59 were also issued inside the window, and the oldest issue date in the set is November 2025. The Swiss Financial Market Supervisory Authority (FINMA) September actions are unconfirmed and sit outside the exhibit, for reasons set out below.

The September peak follows the SEC’s fiscal calendar

The SEC’s fiscal year runs from 1 October to 30 September, which is how the economics consultancy Brattle dates the first half of fiscal 2026 in its review of SEC enforcement activity⁵. Eight new proceedings were opened on 30 September alone, and the following full week produced one. The same review notes that enforcement activity has historically peaked in September. The October lull is a fiscal-year effect: Brattle records a federal shutdown from 1 October to 12 November 2025, and the SEC registers show filings continuing through early October 2026.

Peak weeks arrive as clusters of related cases

The surge also has a shape. In the week of 28 September, 8 of the 13 new SEC cases concerned security-based swaps. Seven individuals who, acting as unregistered brokers, solicited US retail investors to trade them through platforms they owned or ran settled cease-and-desist orders on 30 September, and on 2 October J.P. Morgan’s broker-dealer and bank settled an order over obligations that followed their registration as security-based swap dealers. Insider-trading cases grouped the same way: three traders in Y-mAbs Therapeutics shares ahead of the same acquisition announcement on 25 September, and a former and a serving Okta employee on 15 September.

All seven swap-solicitation orders record an accepted offer of settlement. For the firms and people named, the work sat in the months before the order: document production, interviews, negotiation. The filing date is the last step, and a fiscal year-end bunches those last steps together. A group active in one swept product line can therefore see several counterparties, a business line and its own desk drawn into related matters at the same moment.

Annual totals fall while the peaks stay sharp and the venues multiply

The SEC disclosed 92 enforcement actions in the first half of fiscal 2026⁵, 59 per cent below the fiscal 2018 to 2025 first-half average of 225 and the lowest first half in that dataset. A smaller annual total still concentrates into the same calendar spike, so the peak week stays the planning problem even in a quieter year.

Other regulators move on their own clocks. FDA posting climbed from two letters a week in mid-September to between 17 and 21 a week through early October, and 25 of the 59 letters came from its Center for Drug Evaluation and Research. The rest came from six other FDA centres and offices, covering inspections, human foods, veterinary medicine, medical devices, tobacco and biologics, so a group with a food, device or animal-health arm meets several FDA reviewers in the same weeks. Three registers peaking in overlapping weeks give a multi-sector group, such as a pharmaceutical company with a listed parent, several live matters in the same fortnight.

In Switzerland the count rose within a year, largely out of public view. FINMA concluded 38 enforcement proceedings in 2024⁶ and 55 in 2025⁷. For the 2025 cases, the supervisor states that the very strict statutory requirements for active communication were unmet or a court order prevented it from communicating. The same release reports that in around 90 per cent of enforcement investigations FINMA restores compliance within roughly three months. A Swiss firm therefore learns about its peers’ proceedings late, and about its own on a short clock.

The European Union adds a new venue. From 2 August 2026, the European AI Office and Member State authorities implement the Artificial Intelligence Act (AI Act)⁸, and the AI Office can request technical documentation, evaluate general-purpose models, require corrective measures and fine providers. The same Commission page records that obligations for Annex III high-risk systems move to 2 December 2027. Enforcement capacity is live while part of the rulebook is still settling, the sequence covered in earlier affairs analysis of the August 2026 application date and the Annex III deferral.

Drafting-era and enforcement-era compliance run on different operating models

Most compliance functions in regulated groups grew up around consultation cycles: read the draft, model the impact, file a response, update the policy library. That work follows a published timetable and rewards careful interpretation. A live matter follows the regulator’s timetable and rewards speed of evidence. The two demand different staff, tools and reporting lines, and Exhibit 2 sets the differences out. The same structural logic applies when compliance joins a programme late, as the Kainjoo analysis of why digital transformation in regulated industries fails at scale shows.

A compliance operating model is the set of roles, decision rights, processes, data and tools that turns regulatory obligations into repeatable work, including the split between what a central team owns and what each business line owns. Most published versions of that model describe how obligations become controls. The enforcement era adds a second question the model has to answer in advance: when a request or an order lands, who decides the response, who holds the evidence, and how fast each of them must act. In a drafting-era function the central policy team drafts and signs off, and business lines receive guidance. In an enforcement-era function a named matter owner decides within a set time, and each business line owns and can produce the records for its own activities.

Exhibit 2. The drafting-era and enforcement-era compliance operating models compared

Dimension	Drafting era	Enforcement era
Unit of work	Consultation response, policy memo	Live matter with a regulator’s deadline
Decision rights	Central policy team drafts and signs off	Named matter owner decides within a set time; business lines own their evidence
Rhythm	Rule-making calendar	Surge and lull, set by each regulator’s fiscal year
Core staff	Policy interpreters	Investigators, evidence leads, remediation owners
Evidence	Policy library	Records retrievable within days, mapped to likely requests
Metrics	Memos filed, trainings delivered	Time to evidence, remediation cycle time
Board line	Annual compliance report	Matter-level reporting with owners and dates

Source: Kainjoo operating-model framework, built on the register patterns in Exhibit 1.

Evidence is where the mismatch costs most. A consultation response can draw on weeks of analysis; a supervisory request for documents arrives with a date the regulator chooses. A function whose records sit across shared drives, ticketing tools and former employees’ mailboxes spends the first days of a matter locating material, which leaves less time to assess it before it goes out.

Two orders from the window show the cost when the evidence itself is wrong. Jefferies settled an order over its failure to submit complete and accurate trading data⁹ in response to the SEC staff’s electronic blue sheet requests. The violation was the response itself. CBIZ settled an order after its employee stock purchase plan sold 481,049 shares in excess of the number registered¹⁰ between October 2023 and April 2026, a gap between a plan record and a registration record that ran for two and a half years. In both cases the matter turned on whether internal records matched what had been filed or promised to a regulator, which is the capability an enforcement-era function has to test before a request arrives.

Size the compliance function for the peak week

Plan capacity against each regulator’s fiscal calendar

Average weekly workload hides the problem: across the four weeks the registers averaged 38 filings a week, while the peak week carried 51. Map every regulator that supervises the group, record its fiscal year-end and its historical peak months, and staff the second half of September to absorb the SEC surge in a US-listed group. A flexible bench covers the gap: a standing external panel engaged before the peak, plus internal staff cross-trained from advisory work into matter response.

Keep an evidence inventory mapped to the requests regulators actually send

The cease-and-desist orders in the window turn on records a firm already holds: trading data supplied to the SEC, adviser disclosures of conflicts and fees in five separate matters, revenue recognition at a listed manufacturer and share issuance under an employee stock purchase plan. For each such subject, name the system of record, the owner and the time it takes to export a clean, dated set. A timed dry run on one subject per quarter turns that inventory into a measured capability.

Run one intake desk across Switzerland, the EU and the US

Separate teams per jurisdiction see their own regulator and miss the overlap in Exhibit 1. A single intake desk logs every inbound request, letter and order across FINMA, EU authorities and US agencies, assigns an owner within a day and reports open matters to the executive committee weekly during peak months. The desk also catches the quieter signal from Switzerland, where a peer’s proceeding may surface only through the market.

The clusters in Exhibit 1 give the desk its second job. When one order lands in a product line the group trades, such as security-based swaps in late September, the desk opens a review of that line across every entity the same week, before a related request arrives. FINMA’s own figure sets the Swiss clock: if most investigations close with compliance restored within about three months, a remediation plan has to be owned, resourced and reporting progress inside the first few weeks.

What to do on Monday

• General counsel: list every regulator that supervises the group with its fiscal year-end, and book external panel capacity for the four weeks before the earliest one.
• Chief compliance officer: run a timed retrieval for one likely request, such as two years of client complaints with responses, and record the hours it took.
• Chief compliance officer: replace one consultation-tracking metric in the monthly dashboard with time to evidence.
• Chief operating officer: name a single intake owner for regulatory correspondence across all entities, with a one-day assignment rule.
• All three: move board reporting from an annual narrative to a matter list with owners, deadlines and status.

Kainjoo’s services team runs compliance operating-model reviews that test a function against this surge pattern: regulator calendar, evidence retrieval times and intake design. Book a compliance operating-model review.

This article has been reviewed by Haider Alleg, Managing Partner at Kainjoo SA.

References

1. US Securities and Exchange Commission. Administrative Proceedings (register, entries 14 September to 11 October 2026). https://www.sec.gov/enforcement-litigation/administrative-proceedings
2. US Securities and Exchange Commission. Litigation Releases (register, entries 14 September to 11 October 2026). https://www.sec.gov/enforcement-litigation/litigation-releases
3. US Food and Drug Administration. Warning Letters (register, posted 14 September to 11 October 2026). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/compliance-actions-and-activities/warning-letters
4. US Commodity Futures Trading Commission. Press Releases, releases 9299-26, 9304-26 and 9305-26. https://www.cftc.gov/PressRoom/PressReleases
5. Huffman, A. and Jindra, J. First Half of FY26 SEC Enforcement Activity: New Evidence of a Continued Slowdown. Brattle, April 2026. https://www.brattle.com/wp-content/uploads/2026/04/First-Half-of-FY26-SEC-Enforcement-Activity-New-Evidence-of-a-Continued-Slowdown.pdf
6. FINMA. FINMA Annual Media Conference 2025, 8 April 2025. https://www.finma.ch/en/news/2025/04/20250408-mm-jmk-25/
7. FINMA. FINMA annual media conference 2026, 21 April 2026. https://www.finma.ch/en/news/2026/04/20260421-mm-jmk-2026/
8. European Commission. AI Act: regulatory framework for AI. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
9. US Securities and Exchange Commission. In the Matter of Jefferies LLC, Release No. 34-106641, 9 October 2026. https://www.sec.gov/files/litigation/admin/2026/34-106641.pdf
10. US Securities and Exchange Commission. In the Matter of CBIZ, Inc., Release No. 33-11441, 28 September 2026. https://www.sec.gov/files/litigation/admin/2026/33-11441.pdf