October was the month the agencies stopped waiting for Congress. The Senate's market-structure bill sat stalled after September's failed vote, so the CFTC announced it would write crypto market rules itself, the OCC finished the first GENIUS Act rulebook, and FinCEN quietly withdrew two of the broadest crypto reporting proposals ever written — while state courts, state legislatures, and state attorneys general did some of the heaviest lifting of the year: two appellate decisions on social-media age laws in two days, a New York chatbot statute, and nine states suing the same AI company in a single month.
This is a back issue, compiled in November 2026 from the primary record and labeled as such. It reports October as October knew it: deadlines that fell during the month are recorded as reached, and nothing that happened after October 31, 2026 is reported in the body.
In this issue: the CFTC writes its own crypto rules · the first final GENIUS rule lands · FinCEN withdraws the mixer and unhosted-wallet proposals · Florida's and Georgia's social-media laws survive in the Eleventh Circuit · New York signs a chatbot law · nine states sue OpenAI · the IRS gives staking trusts a safe harbor · and everything still on the docket, carried forward and accounted for.
October's story is a handoff. For two years the center of gravity in digital-asset law was a bill — CLARITY — and in September the Senate declined to move it. October is what happened next: regulators reached for the tools they already had. An advance notice from the CFTC, a final rule from the OCC, withdrawals from FinCEN, compulsory process from the FTC. None of it needed a floor vote.
The states, meanwhile, had their biggest month of the year. Two federal appeals decisions in two days kept Florida's and Georgia's social-media age laws alive. New York wrote the most specific chatbot statute yet. Connecticut switched on a privacy package with real teeth. And the attorneys general — eight states in one day, Texas nine days later — made state consumer-protection law the main courtroom front on chatbot safety.
Two honest notes on shape. Congress is thin this month — one bill introduction on this beat verified to our standard, and we say so rather than pad it. And this issue introduces a standing element, Still on the Docket: every open item from earlier issues is re-mentioned with its status as of October 31 and its next date, so nothing we put on your radar ever silently disappears. Items that finished — including two FinCEN rules that died in October — are reported as finished, in the open.
Everything in this issue is drawn from the primary document — the release, rule, opinion, filing, or statute itself — and where a fact could not be verified to that standard, it is either labeled as such in the open or left out. That rule has no exceptions, including for us.
— The Editor
An honest note: October was a quiet month on Capitol Hill for this beat. One introduction verified to our standard; the month's real legislative news was the continued stillness around the bill that stalled in September, which is tracked in Still on the Docket.
Tags: AI · Cybersecurity · Congress
What happened: On October 22, Reps. Pat Harrigan (R-NC) and George Whitesides (D-CA) introduced the AI Cyber Defense Act (H.R. 10873), referred to the House Science, Space, and Technology Committee. The bill would direct the National Institute of Standards and Technology to work with private AI companies to define "distillation attacks" — the technique of extracting a model's capabilities by training on its outputs — and to develop voluntary standards and best practices for detecting and preventing them, aimed at foreign entities of concern. It would also stand up an AI Cybersecurity Roundtable on using AI defensively to protect critical infrastructure. The work would begin within 180 days of enactment.
Status: Introduced and in committee. It is a proposal, not law.
What it means for you: If you build or buy AI, watch the definitions: how NIST eventually separates hostile distillation from ordinary model training and open-source collaboration will shape contracts, terms of service, and export arguments for years — even in voluntary form.
Tags: Digital Assets · CFTC · Market Structure
What changed: On October 5, the Commodity Futures Trading Commission issued an advance notice of proposed rulemaking toward two new rulebooks — Regulation Crypto Asset Transactions (Reg CTX) and Regulation Crypto Asset Markets (Reg CAM). Chairman Selig's statement was blunt about why: the step follows "the Senate's failure to advance the Clarity Act this month." The contemplated framework would create a purpose-fit federal option for exchanges under a single scheme; it would not require trading to happen on CFTC-registered platforms.
Status: This is an advance notice — the step before a proposal. Published in the Federal Register October 13, comments run 60 days from publication, into mid-December 2026.
What it means for you: Market structure is now moving on two tracks, and the agency track is the one with momentum. If you operate or use an exchange, the comment file on this notice is where the next several years of U.S. crypto market rules will be argued out.
Tags: Stablecoins · Banking · OCC
What changed: On October 21, the OCC issued the first federal final rule implementing the GENIUS Act: a new 12 CFR Part 15 covering permitted and foreign payment stablecoin issuers under OCC jurisdiction and certain custody activities. Money-laundering and sanctions requirements are reserved for a separate rulemaking with Treasury — they are not in this rule. The OCC will open issuer applications once the White House budget office approves the application forms, and it said so plainly: an issuer with a substantially complete application pending on the effective date can ask for a waiver of up to 12 months while its application is reviewed.
When it takes effect: January 18, 2027 — the rule and the GENIUS Act itself switch on the same day.
What it means for you: If you hold or issue dollar stablecoins, the licensing era now has a rulebook, an application process, and a date. The Comptroller had promised this rule "by November" back in August; it arrived October 21. Treasury's separate piece is still unfinished — see Still on the Docket.
Tags: Digital Assets · Treasury · Financial Crimes
What changed: On October 6, FinCEN withdrew its 2023 finding and proposal that would have treated international crypto mixing as a class of transactions of "primary money laundering concern" and imposed enhanced recordkeeping and reporting on financial institutions that touched it.
Status: Withdrawn, effective on publication. This rule is dead, and we report it as dead — it will not be carried forward.
What it means for you: The broadest proposed reporting net over privacy tools is gone. Note the boundary, though: withdrawing a reporting proposal changes compliance paperwork, not criminal law — prosecutions of mixer operators continue on other theories.
Tags: Digital Assets · Treasury · Wallets
What changed: The same day, FinCEN withdrew its December 2020 proposal to require banks and money services businesses to report and verify identity for transactions over $10,000 involving self-hosted ("unhosted") wallets. FinCEN stated it "will not take any further action" on the proposal, framing both withdrawals as making digital-asset regulation "fit-for-purpose."
Status: Withdrawn, effective October 6, 2026. Dead, and reported as dead.
What it means for you: A six-year-old proposal that shaped how exchanges built their compliance stacks is formally over. Self-custody's reporting status returns to the ordinary rules — which still exist, and still apply.
Tags: Sanctions · Treasury · Financial Crimes
What happened: FinCEN proposed prohibiting certain fund transmittals involving sub-agents of the A7 Network, a Russia-tied sanctions-evasion and money-laundering service, after OFAC sanctioned the network on October 1.
Status: Proposed rule, open for comment as of late October.
What it means for you: Read alongside the two withdrawals above, this is the pattern of the month: blanket measures out, named-network measures in. If your business touches cross-border payment intermediaries, the A7 designations and this proposal are the compliance items, not the withdrawn ones.
Tags: Digital Assets · SEC · Markets
What changed: On October 2, the SEC approved Cboe BZX's rule change to list six triple-leveraged VS Trust products — including the 3x Bitcoin ETF and 3x Ether ETF (the others track gold, silver, crude oil, and natural gas). These are futures-based products that aim for three times the daily move, structured as commodity-based trust shares, not ordinary mutual-fund-style ETFs. The approval order records that the Commission received no comments on the proposal. This item was in our August pipeline; it resolved in October.
Status: Approved to list. That is not the same as available to buy: the shares cannot be offered until the trust's separate registration statement is declared effective, and the order sets no date for that.
What it means for you: Triple leverage on a daily-reset product compounds in ways that surprise people — a flat week can still be a losing week. The listing is real news; the launch is a separate event we will report when it happens.
Tags: Privacy · Platforms · FTC · AI
What changed: On October 28, the FTC launched a personalized pricing and compensation inquiry, sending compulsory §6(b) orders to nine companies: Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target, and Walmart. The study asks whether what you pay — or, on gig platforms, what you earn — varies with loyalty-program participation or with algorithmic analysis of your personal data, and which data points (the release names factors like phone usage and acceptance history for drivers) do the moving. Companies have 45 days from service to respond. This follows the FTC's August proposal for a personalized-pricing disclosure policy statement, tracked in Still on the Docket.
Status: Inquiry open; responses due mid-December 2026. A §6(b) study is not an enforcement action, but its findings historically become reports, and reports become cases and rules.
What it means for you: If a price has ever felt like it was set for you specifically, this inquiry is the federal government asking that question with subpoena-grade paperwork. Sellers using algorithmic pricing should expect disclosure expectations to harden.
Tags: Sanctions · Cybersecurity · Treasury
What happened: On October 28, OFAC designated 10 individuals and one entity (the First Financial and Technical Development Center) behind the North Korean IT-worker fraud scheme — operatives who get hired remotely by U.S. businesses under false identities and funnel the proceeds home. The designees include two Russian nationals, one of whom allegedly converted roughly $3.5 million in cryptocurrency for the network.
Status: Designations in effect; U.S.-nexus property of the listed persons is blocked.
What it means for you: If you hire remote technical workers, this scheme is the reason identity verification at hiring has become a sanctions issue, not just an HR one.
Tags: Cybercrime · DOJ · Digital Assets
What happened: The Justice Department's Scam Center Strike Force announced charges against six Africa-based defendants for an alleged NFT and romance investment scam run from compounds in Madagascar — about 800 victims and 74 cryptocurrency wallets identified, with the FBI assisting Madagascar's takedown of 13 compounds and seizure of some 3,200 devices in August. The same announcement covered arrests of three alleged operators of a phishing-kit business, made with Nigerian cybercrime police on a referral from Microsoft's Digital Crimes Unit. The Strike Force reports more than $1 billion in cryptocurrency restrained since it stood up.
Status: Charges unsealed. These are allegations, not findings; the defendants are not in U.S. custody.
What it means for you: The scam-compound model is migrating — Southeast Asia to Africa — and enforcement is now organized to follow it across continents. The wallet-draining pattern described in the affidavit (romance contact, a "connected wallet," silent withdrawals) is the one to teach your family.
Tags: Cybercrime · Digital Identity · DOJ
What happened: The Justice Department announced indictments of five defendants in three districts in a "ghost student" scheme — stolen identities used to open federal student-aid accounts and draw funds. Investigators identified over 830,000 potentially fraudulent aid IDs tied to roughly $130 million in September–October 2026 alone, and more than $750,000 in cryptocurrency was seized with Kenyan partners, a first for the Fraud Division.
Status: Indictments announced October 29. Allegations, not findings.
What it means for you: Identity fraud at this scale runs on the same rails as account-opening everywhere else. The crypto seizure matters for a different reason: proceeds that move on-chain are traceable, and international seizure cooperation is catching up.
Tags: SEC · Digital Assets · Fraud · AI
What happened: On October 28, the SEC sued the promoters behind the DEBT Box matter in Utah federal court, alleging at least $200 million was raised from more than 100,000 retail investors on license agreements tied to royalty projects that, the complaint says, generated no revenue at all — with over $101 million of investor money allegedly used to buy and burn the project's own tokens. On October 29, the SEC charged BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd with allegedly raising over $130 million from tens of thousands of investors on "AI-generated signals" for crypto trading, plus false claims — world's largest hedge fund, SEC-registered adviser — allegedly backed by fake SEC filings that have since been removed from the SEC's website.
Status: Both cases filed in late October. Allegations, not findings (separate consents were filed for some DEBT Box defendants).
What it means for you: The pitches change costumes — royalty streams in 2021, AI signals in 2026 — and the check never does: a regulator's name on a document is not approval, and "the SEC has our filing" is a sentence scammers say. Verify registrations on the regulator's own site, every time.
Tags: Platforms · Speech · Courts · Minors
What happened: On October 14, the Eleventh Circuit held that Florida's HB 3 — which bars accounts for children under 14, requires parental consent at 14–15, and regulates platforms with addictive features — is likely constitutional. The panel treated the law as content-neutral and upheld it under intermediate scrutiny, reversing the preliminary injunction that had blocked it (the law had in fact been enforceable since a stay last November).
Status: This is a likelihood-of-success ruling at the injunction stage, not the final word; the case continues in the district court.
What it means for you: Platforms operating in Florida should plan on the age rules staying in force while litigation continues. Nationally, the decision deepens a split among the appeals courts over how the First Amendment treats age-gating — the kind of split that ends at the Supreme Court.
Tags: Platforms · Speech · Courts · Minors
What happened: One day later, the same court vacated the injunction against Georgia's SB 351 and sent the case back. The trade group challenging the law has standing to sue, the court said, but it failed the burden the Supreme Court's Moody v. NetChoice decision sets for striking down a law in its entirety, and the lower court's vagueness and Section 230 rulings were reversed. The court was careful to say what it was not deciding: it did not hold Georgia's law constitutional.
Status: Injunction vacated; the law can be enforced as the case proceeds on remand, once the court's mandate issues.
What it means for you: Two Eleventh Circuit wins for the states in two days, on two different theories — Florida's law looks substantively strong; Georgia's survives procedurally. If you build products used by minors, "which circuit are we in" is now a compliance question, not a trivia question.
Tags: Platforms · Speech · Supreme Court
What happened: On October 19, NetChoice asked Justice Kavanaugh for 30 more days — to December 3 — to file its petition asking the Supreme Court to review the Sixth Circuit's decision on Ohio's Parental Notification by Social Media Operators Act, which requires parental consent mechanics for minors' social-media accounts. The petition was otherwise due November 3.
Status: The extension request was filed in October; whether the Court takes the case was still an open question on October 31.
What it means for you: This is the queue forming. Florida, Georgia, Ohio, Tennessee — the state age-verification wave has produced conflicting appellate answers, and Ohio's case is one of the vehicles that could give the country one rule.
Tags: Stablecoins · States · Florida
What changed: On October 1, the main provisions of Florida's payment stablecoin law took effect: a state licensing regime run by the Office of Financial Regulation, prudential requirements modeled on the federal GENIUS Act, and a transition path for the largest issuers to the federal system. Background (June 2026): the law was signed in June with this October start date.
What it means for you: Issuers now work two calendars — Florida's, already running, and the federal one, which starts January 18, 2027. Florida is the test case for how state and federal stablecoin regimes mesh.
Tags: Privacy · States · Connecticut · AI
What changed: On October 1, key provisions of Connecticut's Act Concerning Consumer Privacy and Protection took effect: registration for data brokers, a state-run accessible deletion mechanism, disclosure duties for personalized algorithmic pricing, and amendments to the Connecticut Data Privacy Act — a ban on selling precise geolocation data, new facial-recognition requirements, added profiling rights, and limits on license-plate-reader data sharing. Broker registration itself begins January 1, 2027.
What it means for you: Connecticut is building the East Coast counterpart to California's deletion system (below). If you sell data or buy it, two states now run deletion infrastructure you have to honor.
Tags: Digital Assets · States · California
What changed: SB 1208, sponsored by Attorney General Bonta, was signed on September 27, 2026 (Chapter 483) and announced by the Attorney General on October 2. It creates a court-supervised process to return seized digital assets to the fraud victims they were stolen from — including when the thieves are outside U.S. jurisdiction. Owners get a process to prove a claim; assets nobody claims go to the State Restitution Fund. The law also brings digital-asset transactions inside the state's money-laundering statute and sets warrant rules for seizing wallets. This item sat in our August pipeline and became law in late September; the Attorney General's announcement of what it does landed in October.
What it means for you: Forfeiture law usually ends with the state keeping the money. This is the first statute we have covered built around the opposite ending — and a template other states with scam epidemics will look at.
Tags: Privacy · States · California
What happened: The California Privacy Protection Agency reported that over 550,000 Californians had signed up for DROP, the state's one-stop deletion request system, and that in the first three months of broker processing, 99% of users had their information deleted by at least one data broker. Brokers that ignore requests face penalties of $200 per day per consumer, plus agency costs.
What it means for you: Deletion rights are usually theoretical. California published numbers, which makes DROP the benchmark: if you are a California resident, the system works measurably better than writing to brokers yourself; if you are a broker, the per-day, per-person math is the story.
Tags: AI · States · Colorado
What happened: Colorado's Attorney General released an interim draft of the rules implementing the state's Automated Decision-Making Technology Act and Chatbot Safety Act on October 6, held the formal rulemaking hearing on October 26, and closed written comments that night. Background (May 2026): both laws were signed in May — the ADMT Act replaced Colorado's earlier AI Act framework — and both take effect January 1, 2027.
Status: The Attorney General must adopt final rules before that January 1 date. Tracked in Still on the Docket.
What it means for you: If your systems make or shape consequential decisions about Colorado consumers — hiring, housing, lending, education — the rules being finalized this fall are your compliance text. The statute is the headline; the rulebook is the job.
Tags: AI · States · New York · Minors
What changed: On October 28, Governor Hochul signed a law barring companies from offering AI chatbot features — pretending to be human or alive, claiming a personal, romantic, or authority relationship with a child, unprompted emotional questioning, using a child's private health or personal information, or promoting suicide, self-harm, eating disorders, or substance use — to anyone under 18. Because a company cannot know who is under 18 without checking, the ban applies to every user unless the company first confirms the user is not a minor. Companies must offer more than one age-verification method, at least one not solely dependent on government ID, and must delete age information after use.
When it takes effect: June 1, 2027 — the Governor signed a chaptered version moving the date from January 1, 2027 to give companies time to comply.
What it means for you: This is a feature list, not a vague duty of care — if you ship a companion-style chatbot, a lawyer can check your product against it line by line. The age-check design (multiple methods, no ID-only gate, delete after use) is a privacy-conscious template other states will copy or litigate.
Tags: AI · States · Consumer Protection · Minors
What happened: On October 14, eight states — Iowa, Kansas, Nebraska, and West Virginia announcing jointly, plus Arizona, Arkansas, Idaho, and Montana — filed suit against OpenAI in their own state courts under their consumer-protection laws. The shared allegation: ChatGPT was marketed as safe for young people while the company knew of risks, including the gravest claims, involving self-harm coaching and dangerous advice. On October 23, Texas filed its own suit in Collin County under the Deceptive Trade Practices Act and the SCOPE Act, naming the company and CEO Sam Altman personally. Background (June 2026): Florida's attorney general had sued OpenAI on similar theories in June.
Status: Filed. These are allegations, not findings; OpenAI disputes the cases.
What it means for you: No new AI statute was needed for any of this — century-old consumer-protection law, applied to safety marketing, is the weapon. For parents, the filings are a map of what regulators currently believe the risks are; for builders, they are a warning that safety claims are legal statements.
Tags: Digital Identity · States · Oklahoma · Georgia
What happened: On October 7, Oklahoma's driver license and state ID launched in Google Wallet, built on the ISO 18013-5 mobile license standard (Apple Wallet support came earlier). On October 30, Georgia's Department of Public Safety announced that state troopers now accept digital ID at traffic stops and crash investigations: the motorist holds their phone near the officer's reader — the guidance is explicit that you should not hand over your device — and a physical card always remains an option. Every Georgia law-enforcement agency must have verification equipment by July 1, 2027.
What it means for you: Digital ID is becoming ordinary infrastructure, one state and one wallet at a time. The detail that matters most is Georgia's: a digital license that requires surrendering your phone would be a privacy downgrade; a tap-to-verify one is not.
Tags: Tax · Digital Assets · IRS
What changed: On October 6, the IRS issued Revenue Procedure 2026-20, restoring and refining the safe harbor that lets an investment trust holding digital assets stake them without losing its tax classification as an investment trust and grantor trust. The conditions are specific: only assets on permissionless proof-of-stake networks, with rules on custodians, reward distribution timelines, slashing protection, and liquidity. Existing trusts get a six-month window from October 6 to amend their documents to fit.
When it takes effect: Tax years ending on or after October 6, 2026. Background (August 2026): the prior safe harbor (Rev. Proc. 2025-31) expired in August, leaving a gap this procedure fills.
What it means for you: If you hold a crypto trust or ETP product, staking yield is now a documented option rather than a tax gamble — and if you run such a trust, the amendment window is a real deadline, not a formality.
Tags: Tax · IRS · Funds
What happened: Comments closed October 28 on IRS Notice 2026-62, which asked how funds use in-kind redemption rules (§852(b)(6)) with commodities and digital assets without tripping the regulated investment company income test. Background (September 28, 2026): the notice itself is a September document; the October event is the deadline arriving.
What it means for you: Plumbing, but expensive plumbing — the answer will shape how crypto funds and ETFs handle redemptions and the tax bills that follow.
Tags: Tax · Congress
What happened: The fall's two big digital-asset tax bills ended October where September left them: in committee. Background (September 30, 2026): Sen. Daines's ADAPT Act (S. 5616) — introduced September 30 and publicly unveiled October 22 — would let people spend GENIUS-regulated stablecoins on goods and services without a taxable event, extend wash-sale and constructive-sale rules to digital assets, and set staking and mark-to-market rules. Its flashing point: a proposed $10 de minimis exemption that covers network and gas fees only, not purchases — the Blockchain Association publicly declined to endorse either bill on October 22 and asked for a rewrite. Background (September 14–16, 2026): the House's Digital Asset Tax Certainty Act (H.R. 10357) was reported out of Ways & Means 38–5, with a wash-sale extension and a novel two-year voluntary disclosure program for past crypto tax violations; it had no floor action in October.
Status: Both bills pending; most ADAPT provisions would apply to tax years after December 31, 2026 if enacted.
What it means for you: Nothing to file differently yet — but the wash-sale extension appears in both parties' drafts in both chambers' bills. Whatever your politics, plan as if year-end tax-loss harvesting in crypto has an expiration date.
Forward-looking items that opened or moved in October and will land in later months.
Every open item from earlier issues, re-mentioned with its status as of October 31, 2026, the month it was first covered, and its next date. Items that resolved in October graduated into the sections above; items that died are reported as dead. Nothing here is silently dropped — that is the point of this page.
As the calendar stood on October 31, 2026.
Doug's Digital Docket Digest is an educational publication. It summarizes public legal developments in plain language for general information. This is education, not legal advice — it is not a substitute for a lawyer about your specific situation, and reading it creates no attorney–client relationship.
Sources: every item in this issue is drawn from the primary document behind it — the agency release or rule, the court opinion or filing, the statute or bill record — checked against that document during compilation. Items that could not be confirmed on a primary source were left out, and the places where this issue reports something short of that standard (a news-reported comment deadline, a deadline whose public status could not be confirmed, and one carried item whose October status was not re-verified) are labeled in the open, in Still on the Docket. Background items are labeled with their original dates wherever they appear.
This digest is an educational publication. It summarizes public legal developments in plain language for general information. This is education, not legal advice.