#regulatory
Federal and state regulatory compliance, rulemaking, and deregulation guidance for businesses
Congress tucked sweeping PBM reforms into the Consolidated Appropriations Act of 2026 — banning spread pricing and rebate retention from 2028, mandating semiannual transparency reports, and creating any-willing-pharmacy and essential retail pharmacy protections from 2029. Here is what changes, when, and how to rebuild your books.
Since January 1, 2023 California treats payroll records as protected personal information under CCPA/CPRA, while Colorado's 2025 biometric amendment and Virginia's 2026 changes narrow the "employee exemption." Here is a 30-day compliance plan covering the workforce privacy notice, retention schedule, security, rights requests, and vendor contracts for small employers.
Starting November 4, 2026, SNAP-authorized small stores must stock 7 varieties in each of 4 staple food categories — 84 units total, up from 36 — with perishables in 3 categories, or risk losing EBT authorization. How to map varieties, track depth, flag perishables, and file invoices in your books before an FNS inspection.
The FDA's Food Traceability Rule (FSMA 204) requires covered businesses to produce lot-level records in a sortable electronic spreadsheet within 24 hours and retain them for two years. The compliance date moved from January 20, 2026 to a proposed July 20, 2028 — here is what CTEs, KDEs, and traceability lot codes require, which 15 commodity categories are covered, and how to build the records now.
A federal court in the Eastern District of Texas vacated FinCEN's Residential Real Estate Reporting Rule nationwide on March 19, 2026, one day before it took effect, and FinCEN's May 18, 2026 FAQs confirm no Real Estate Report is required and no retroactive filing will be demanded if the Fifth Circuit reverses. The Geographic Targeting Orders were untouched and still bind title insurers in covered metros, so this guide covers the rule's three-part test (residential, non-financed, entity or trust buyer), the seven-step reporting-person cascade, and the intake, retention, and reinstatement-kit practices closing professionals should keep dormant rather than delete.
Sending a creator a free product is a material connection under 16 CFR Part 255 even when you require nothing in return, and civil penalties now reach $53,088 per non-compliant post. This guide covers what triggers disclosure, why
New Jersey's A5328 (signed June 30 2026) charges $5,000 to $1.5 million a year to register as a data broker, and extends that regime to first-party 'data collectors' that sell data gathered from their own customers. Selling sensitive data is banned outright with no consent exception at $50,000 per record, effective immediately, while registration and fees are expected to be enforced from June 2027 under a $2,500-per-day penalty.
Effective July 1, 2026, Virginia's SB 637 drops the Virginia Human Rights Act employer threshold from 15 employees to 5 and extends the filing window from 300 days to two years. Any business with five or more employees for each working day in 20 or more calendar weeks is now covered for every prohibited practice — not just discharge. Here is the 20-week counting rule, a seven-step compliance checklist, and the payroll and retention records an investigator asks for first.
EO 14267 directed FTC and DOJ to identify anticompetitive regulations — they returned 125+ rules for review. What it changes and what it doesn't for compliance.
