FTC Safeguards Rule enforcement heats up: $4.85M Nuvei settlement. Regulatory Update Compliance Cyber Security Data Breaches Payment processor accountability under the microscope. The Federal Trade Commission announced a $4.85 million settlement with payment processor Nuvei on September 5, 2026, marking a significant escalation in regulatory enforcement around merchant screening practices and fraud prevention obligations. The settlement alleges that Nuvei and its subsidiaries knowingly processed payments for merchants engaged in fraudulent activity, highlighting the expanding compliance burden on payment intermediaries and the businesses that rely on them. This enforcement action arrives at a moment when the FTC Safeguards Rule and related consumer protection frameworks are receiving renewed attention. For small and mid-sized businesses - particularly those in financial services, e-commerce, and any sector handling payment processing - the Nuvei case offers critical lessons about due diligence, vendor risk management, and the regulatory expectations surrounding fraud prevention. What the Nuvei settlement reveals about compliance expectations. The FTC's complaint centers on Nuvei's alleged failure to implement adequate merchant screening and monitoring practices. According to the agency, the company processed transactions for merchants the firm knew or should have known were engaged in deceptive or fraudulent practices. The $4.85 million penalty is accompanied by requirements for Nuvei to establish robust merchant vetting procedures going forward. This settlement underscores several compliance principles that extend well beyond payment processors: Know your business partners. The FTC is holding intermediaries accountable for the conduct of the merchants they serve. This "know your customer" principle - long established in banking through Bank Secrecy Act and anti-money laundering regulations - is now being enforced more aggressively in the broader payment ecosystem. Businesses that accept payments through third-party processors should understand that their processor's compliance posture directly affects their own risk exposure. Ongoing monitoring, not just onboarding. The allegations suggest Nuvei's failures were not limited to initial merchant screening but extended to ongoing transaction monitoring. Modern compliance frameworks increasingly require continuous risk assessment, not just point-in-time checks. This aligns with evolving requirements under PCI DSS 4.0, SOC 2, and the FTC Safeguards Rule itself, all of which emphasize continuous monitoring and regular risk reassessment. Willful blindness is not a defense. The FTC's language - that Nuvei "knowingly" processed for fraudulent merchants - signals that regulators will not accept claims of ignorance when red flags are present. This principle applies across compliance frameworks: HIPAA, NYDFS Part 500, and the Gramm-Leach-Bliley Act all impose affirmative obligations to investigate and respond to indicators of potential violations. The FTC Safeguards Rule: current State and enforcement trends. The FTC Safeguards Rule, which applies to financial institutions under the agency's jurisdiction, underwent significant amendments that took full effect in June 2023. The updated rule requires covered institutions to: * Designate a qualified individual to oversee the information security program * Conduct periodic risk assessments * Implement multi-factor authentication for any individual accessing customer information * Encrypt customer information at rest and in transit * Maintain an incident response plan * Implement secure software development practices * Conduct annual penetration testing and vulnerability assessments The Nuvei settlement demonstrates that the FTC is moving beyond guidance and into active enforcement. Financial institutions, payment processors, and businesses that handle consumer financial data should expect heightened scrutiny of their security programs. Cross-Framework implications: when one violation triggers multiple exposures. The Nuvei case also illustrates how compliance failures in one area can create cascading liability across multiple frameworks. A payment processor that fails to screen merchants properly may face: * FTC enforcement under Section 5 of the FTC Act and the Safeguards Rule * PCI DSS violations if fraudulent transactions compromise cardholder data * State-level enforcement under consumer protection statutes and data breach notification laws * Civil litigation from affected consumers and business clients * Reputational damage that affects customer trust and market position For businesses subject to multiple frameworks - a healthcare provider that accepts credit cards (HIPAA + PCI DSS), a financial services firm operating in New York (NYDFS Part 500 + FTC Safeguards), or a defense contractor (CMMC + FTC) - the interconnected nature of these requirements means that a single control failure can trigger violations across the board. Practical action steps for small and mid-sized businesses. Whether you're directly subject to the FTC Safeguards Rule or simply want to align with emerging regulatory expectations, here's what to prioritize: Immediate actions (next 30 days). * Review your payment processing agreements. Understand what fraud monitoring and merchant screening your processor performs. If you're a merchant, ensure your processor's compliance program is robust. If you use a processor, verify they're meeting their obligations. * Audit third-party vendor risk management. The Nuvei case is fundamentally about vendor accountability. Review your vendor risk assessment process for all critical service providers, especially those handling customer data or financial transactions. * Document your information security program. If you haven't already designated a qualified individual to oversee information security, do so now. This is a hard requirement under the FTC Safeguards Rule and a best practice under virtually every other framework. Medium-Term priorities (next 90 days). * Conduct or update your risk assessment. Identify where customer financial information flows through your systems, who has access, and what controls protect it. This assessment should inform your security roadmap. * Implement or verify multi-factor authentication. MFA for any system accessing customer information is non-negotiable under the updated Safeguards Rule and is rapidly becoming table stakes across all frameworks. * Schedule penetration testing and vulnerability assessments. Annual testing is required under the Safeguards Rule. Many organizations also need this for SOC 2, PCI DSS, and NYDFS Part 500 compliance. Ongoing compliance practices. * Establish continuous monitoring. Move beyond annual assessments to ongoing log review, security information and event management (SIEM), and regular vulnerability scanning. * Update incident response plans. The FTC expects covered entities to have documented, tested plans for responding to security events. Review and tabletop-test your plan at least annually. * Train your team. Security awareness training should cover fraud indicators, social engineering tactics, and proper handling of customer information. Make it relevant to your staff's actual roles. The broader regulatory landscape in 2026. The Nuvei settlement doesn't exist in isolation. It's part of a broader trend of aggressive regulatory enforcement across cybersecurity and data protection: * SEC cyber rules now require public companies to disclose material cybersecurity incidents within four business days and to provide annual disclosures about cyber risk management * NYDFS Part 500 continues to evolve, with recent amendments strengthening requirements around governance, access controls, and incident response * CMMC 2.0 implementation is proceeding for defense contractors, with certification requirements phasing in throughout 2026 and 2027 * State privacy laws continue to proliferate, with comprehensive frameworks now in effect in more than a dozen states Businesses that take a reactive, compliance-checkbox approach are finding themselves exposed. The organizations that fare best treat security and compliance as integrated business functions, not afterthoughts. Building a resilient compliance posture. The lesson from the Nuvei settlement is clear: regulators expect businesses to take affirmative steps to prevent fraud and protect customer information, and they're willing to impose significant penalties when those steps are inadequate. For small and mid-sized businesses, this means investing in security controls, conducting regular assessments, and maintaining robust vendor management programs. Compliance isn't about checking boxes - it's about building systems that actually reduce risk. When your security program is designed around real threats and genuine controls, regulatory compliance often follows naturally. If your organization needs help navigating the FTC Safeguards Rule, conducting required penetration testing, or building a compliance program that spans multiple frameworks, Vici Tech Solutions can help you develop and implement a security posture that meets regulatory requirements and protects your business. Worried about the threats you just read about? Vici Tech Solutions helps businesses across the US find and fix vulnerabilities before attackers do. Explore its penetration testing services or talk to Vici Tech Solutions LLC about your security posture.

Nuvei and blackline partner to modernize the invoice-to-cash process through embedded payments. Aug 05, 2026, 08:00 ET Enterprises can now accept payments directly inside BlackLine, shortening collection cycles, removing manual reconciliation steps, and improving cash flow visibility MONTREAL and LOS ANGELES, Aug. 5, 2026 /CNW/ - Nuvei, the global fintech building the infrastructure for every payment, everywhere, today announced a partnership with BlackLine, the Agentic Financial Operations Platform(TM) for the Office of the CFO, to embed payment acceptance directly into BlackLine's invoice-to-cash platform. The partnership, already live with enterprise customers, combines BlackLine's invoice presentment and payment capabilities with Nuvei's payments infrastructure, enabling customers to settle an invoice the moment they receive it and have that payment matched and reconciled automatically. The invoice-to-cash process has become increasingly digital. Payment acceptance often has not. While invoicing, accounts receivable, and financial reporting now operate through modern finance platforms, payments frequently remain disconnected from the workflows that manage them, which delays collections, forces manual reconciliation, and limits visibility into cash flow. With payment acceptance embedded directly within BlackLine's invoice presentment and payment workflows, finance teams can manage invoicing, payments, and reconciliation in a single platform. Phil Fayer, Chair and CEO of Nuvei, said: "Payments should feel like a natural extension of the invoice-to-cash process, not a separate workflow. Finance teams expect it to work inside the systems they already use to manage receivables, collections, and cash flow. By partnering with BlackLine, we are embedding Nuvei's global payments infrastructure directly into those workflows to help enterprises accelerate collections, improve visibility, and reduce complexity." Andy Liley, Managing Director, Invoice-to-Cash at BlackLine, added: "Finance leaders are under increasing pressure to improve cash flow while operating more efficiently. Offering flexibility in customer payment receipts plays a critical role in that process, yet it has often remained separate from the systems used to manage invoicing, collections, and receivables. This partnership brings those capabilities together, helping customers streamline invoice-to-cash operations while delivering a better payment experience." The integration enables enterprises to: * Accept cards, bank transfers, and local payment methods directly on the invoice * Match incoming payments to open receivables automatically, without manual keying * Track payment status and cash position in real time * Give payers a single place to view, question, and settle an invoice * Collect funds in 150 currencies across more than 190 markets without leaving existing finance workflows Keeping payment and invoice data connected throughout the workflow helps finance teams improve accuracy, visibility, and control while reducing operational complexity. More broadly, Nuvei continues to embed payment capabilities into the systems businesses rely on to manage critical financial workflows. As enterprises modernize invoice-to-cash operations, payment acceptance is increasingly becoming part of the finance technology stack rather than a separate process. By integrating directly within platforms such as BlackLine, Nuvei is extending its infrastructure into the systems that help businesses manage liquidity, working capital, and cash flow. About BlackLine BlackLine (Nasdaq: BL) is the trust infrastructure for the AI era of finance: a future where finance drives the agentic era with intelligence, integrity, and trust rising together. The BlackLine Agentic Financial Operations Platform(TM), powered by Studio360 and Verity(TM) AI, is where the Office of the CFO scales AI across Record-to-Report, Invoice-to-Cash, and every process where finance owns the controls and guarantees its integrity at every step. By unifying data, embedding AI, and engineering trust into every action, BlackLine moves finance and accounting beyond reporting on the business to orchestrating it in real time. Supported by industry-leading R&D investment and world-class security practices, more than 4,300 customers across multiple industries partner with BlackLine to lead their organizations into the future. For more information, visit blackline.com. About Nuvei Nuvei is the global fintech building the infrastructure for every payment, everywhere. Its modular, flexible, and scalable technology enables leading companies to accept next-generation payments, offer all payout options, and benefit from banking, risk, and fraud management services. Connecting businesses to their customers in more than 190 markets, with local acquiring in 52 markets, 150 currencies, and over 720 alternative payment methods, Nuvei provides the technology and insights for customers and partners to succeed locally and globally through one integration.

Nuvei has partnered with BlackLine to embed payment acceptance directly into BlackLine's invoice-to-cash platform. The integration, already live with enterprise customers, enables businesses to accept payments within BlackLine's system, eliminating manual reconciliation and improving cash flow visibility. The partnership addresses the disconnect between digital invoicing systems and payment processing. Finance teams can now manage invoicing, payments, and reconciliation in a single platform, accepting cards, bank transfers, and local payment methods across 150 currencies in over 190 markets. The integration automatically matches incoming payments to open receivables and provides real-time tracking of payment status. BlackLine serves more than 4,300 customers across multiple industries, whilst Nuvei operates in over 190 markets with local acquiring in 52 markets.