Agentic AI Grows Up

September 18, 2026 Paul E. Paray

On September 12, 2026, the chief executive of the AI lab that brought us Claude published an essay trying to convince an industry currently on fire to slow down. As reported by Axios, Anthropic CEO Dario Amodei wrote that “[w]e must slow the pace at which we improve the capabilities of AI models,” warning that within only six to twelve months a swarm of autonomous agents could establish a persistent botnet across the internet, with damages running into the hundreds of billions of dollars. Not surprisingly, Amodei’s essay showcased his biggest competitor’s HuggingFace incident that allowed OpenAI agents to run similar unauthorized cyberattacks during evaluation. Sam Altman and Elon Musk agreed within hours. Bill Gates made a similar point days later, telling Reuters that “[g]overnments are way behind on this one,” after scaremongering beforehand in a an essay that AI lowers the barrier to cyberattacks on hospitals, power grids and financial systems and complaining that there was “no plan to ease the entry into the AI era”. Those who are creating the biggest AI ecosystems ring hollow when they complain about what they themselves have created and are continuing to create on a daily basis.

More to the point, vendors rarely advertise that their products are outpacing the safeguards around them, and when they do, such disclosures function less as philosophical debate than as notice. These sort of warnings do absolutely zero to arm companies faced with challenges existing today. The obligations attaching to a company deploying agents exist today and a board waiting on a broader framework or some sort of vague consensus advocated by the likes of Bill Gates will be asked what it did about the one already in force.

Simply put, the agentic web may have arrived on schedule but its guardrails did not. The AI Titans are certainly not wrong about the dangers of agentic AI but casually disregard that it is already here. In July 2026, the UK’s AI Security Institute disclosed that agents under evaluation directed sustained activity at real people and organizations, including an attempt to insert malicious code into a publicly used open-source project. The agent researched the project, created multiple fake identities, and used them to socially engineer someone into approving the malicious code. This “sockpuppet campaign” ran against a human reviewer without ever leaving any technical signature.

As recognized by cloud security vendor Sysdig, prompt injections – a cyberattack that will manipulate an AI agent into executing an attacker’s instructions rather that the system’s, is the sort of attack that demands immediate attention. And, as recognized by the security vendor that released “The Complete Guide to AI Agent Security for Enterprises”, prompt injection compromises likely affects roughly a third of deployed agents and ranks first on the OWASP Top 10 for LLM Applications. The pattern behind nearly every significant finding is identical, namely an agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Adaptive attacks bypass essentially every published defense. As stated by that same vendor: “Unlike traditional cybersecurity, AI agent security governs not just what data agents can access, but what actions they can take, what tools they can call, and what happens when they are manipulated mid-task.”

Among enterprises deploying agents, 88% reported at least one related incident, and 61% traced back to over-permissioned credentials. OWASP’s Top 10 for Agentic Applications, released December 9, 2025, is the first peer-reviewed framework aimed at autonomous systems, developed with more than 100 contributors and endorsed by NIST, Microsoft and NVIDIA, each of its categories anchored to a documented incident.

Companies inclined to characterize an agent’s conduct as something other than their own should study how that argument has fared. In a Canadian case, Moffatt v. Air Canada, the airline contended that its chatbot was a separate legal entity responsible for its own actions. The tribunal called that a remarkable submission and held the airline liable for negligent misrepresentation, finding a duty of care arising from the commercial relationship. The damages were trivial — roughly CAD 812 — but the holding is not, and courts are unlikely to entertain “the AI did it” as a defense. They will ask who deployed the system, who configured its authority, and whether reasonable care was exercised — harder to answer when an agent holds standing credentials nobody scoped. FINRA’s 2026 Annual Regulatory Oversight Report draws the same line, instructing firms to develop procedures for AI agents that may act beyond the user’s intended scope. See Id. at 27 (“Firms exploring and developing AI agents may wish to consider whether the autonomous nature of AI agents presents the firm with novel regulatory, supervisory or operational considerations. The rapidly evolving landscape and capabilities of AI agents may call for supervisory processes that are specific to the type and scope of the AI agent being implemented.”).

For SEC regulated companies, an agent incident can also become a securities matter. The SEC’s cybersecurity rules, adopted July 26, 2023 (Release No. 33-11216), require an Item 1.05 Form 8-K within four business days of determining that an incident is material — the clock running from that determination, not detection — plus annual governance disclosure under Item 106 of Regulation S-K. CB Financial Services has already become the first registrant to file an Item 1.05 8-K naming AI as the root cause of an incident exposing names, Social Security numbers and dates of birth.

The board-level exposure is even older. Under In re Caremark Int’l Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), directors face oversight liability for failing to implement a reporting system or for consciously disregarding red flags from one they did. Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), sharpened the inquiry where the risk is mission critical. Courts in Delaware – where many corporations still are domiciled, have since emphasized that cybersecurity qualifies as mission critical for companies holding consumer data. Accordingly, boards should receive regular briefings and the absence of minutes documenting those discussions may support an inference of oversight failure.

No court has yet decided a Caremark claim citing the NIST AI Risk Management Framework, but negligence doctrine has long looked to voluntary frameworks to define reasonable care, and commentators expect NIST to fill that role here. What makes the NIST framework a good legal choice rather than just a technical one is that the NIST IR 8596 released in a preliminary draft on December 16, 2025 maps the Cybersecurity Framework 2.0 to securing AI systems and protecting against AI-enabled attacks that nicely maps onto a reporting system Caremark requires directors to design in good faith.

Eighty-two percent of executives report confidence that existing policy protects against unauthorized agent actions, while only 14.4% of organizations send agents to production with full security or IT approval. Policy documentation and runtime enforcement are not the same thing, a distinction Delaware has drawn for thirty years. To the extent deployment has occurred in any appreciable manner, companies should place agent risk on the board calendar and just keep good minutes. Beforehand, ensure basic hygiene measures that predate all this, because agents inherit whatever weaknesses already exist.

Larger enterprises ready to test the waters will have to choose between deployment of a known risky new technology or wait until a competitor figures it out and risk missing out on massive cost efficiencies. Thankfully, these companies have access to human security specialists with the right skill sets who have not yet been fully diluted with an overuse of AI.

Accounting Firm, Employee Benefits, Financial Reporting, Intellectual Property, Law Firm, Middle Market Business, Small Business

Regulatory Protections in SMB Sales

April 7, 2026 Paul E. Paray

The coming wave of business exits will not just test markets. It will test the people business owners may rely on to get deals done. As increasing numbers of small and mid-sized businesses come to market, the role of intermediaries – whether brokers, advisors, or “finders” – becomes more apparent. At the same time, the legal framework governing those intermediaries may go unnoticed because most business owners simply approach a sale as a commercial process no different than selling an old piece of manufacturing equipment. They expect someone to identify a buyer, negotiate terms, and bring the transaction to closing. In many cases, that expectation is met. What is less often considered is that an intermediary’s role is not purely commercial; it exists within a regulatory regime that can directly affect the enforceability and durability of the transaction itself.

That regime begins with the Securities Exchange Act of 1934, which makes it unlawful for any person to “effect any transactions in, or to induce or attempt to induce the purchase or sale of, any security” unless registered as a broker-dealer. See 15 U.S.C. § 78o(a)(1). The definition of a broker is very broad, encompassing “any person engaged in the business of effecting transactions in securities for the account of others.” See 15 U.S.C. § 78c(a)(4).

Notably, the statute does not distinguish between large and small transactions, or between public and private companies. Instead, it focuses on whether a transaction involves a “security” and whether a person is engaged in the business of effecting transactions in those securities. Courts applying this framework have consistently emphasized conduct over labels, examining what the intermediary actually does rather than how the parties describe the role.
Section 15(a) of the Exchange Act prohibits a broker or dealer from “mak[ing] use of the mails or any means or instrumentality of interstate commerce to effect any transactions in, or to induce or attempt to induce the purchase or sale of, any security … unless such broker or dealer is registered.” 15 U.S.C. § 78o(a)(1); SEC v. Almagarby, 92 F.4th 1306, 1315 (11th Cir. 2024) (“Unregistered dealers are prohibited from buying and selling securities in interstate commerce.”).

Within this framework, certain indicators of broker activity have emerged with consistency across enforcement actions and judicial decisions. These include soliciting or identifying buyers, participating in negotiations, structuring or facilitating the transaction, and receiving compensation contingent on closing. Transaction-based compensation, in particular, has long been viewed by the SEC as a hallmark of broker activity because it ties compensation directly to the success of a securities transaction. See SEC Guide to Broker-Dealer Registration.

For business owners, the relevance of this framework turns on how a transaction is structured. If a business is sold through an asset sale, the transaction typically does not involve securities, and the broker-dealer framework is generally not implicated. Many small and mid-sized service businesses are structured this way for tax and liability reasons. However, that structure is not universal, and transactions frequently evolve during negotiations.

Where a transaction involves the transfer of stock, membership interests, or other forms of equity, it is a securities transaction even if the buyer acquires full control and intends to operate the business. At that point, the intermediary’s conduct must be evaluated under the federal securities laws. What may appear to be a routine business sale from a commercial perspective can, as a matter of law, fall squarely within a regulated activity.

Congress addressed this tension in 2023 by enacting a limited exemption for certain intermediaries involved in private company sales. Consolidated Appropriations Act, 2023, Pub. L. No. 117-328, div. AA, § 501, codified at 15 U.S.C. § 78o(b)(13). The exemption permits qualifying intermediaries to facilitate transactions without registering as broker-dealers, but only under defined conditions.

Among other requirements, the intermediary must reasonably believe that the buyer will acquire control of the company and be active in its management following the transaction. The exemption also applies only to “eligible privately held companies,” generally defined by size thresholds tied to revenue or EBITDA. It further imposes specific limitations, including prohibitions on custody of funds, binding parties to transactions, and participation in public offerings.

Importantly, the exemption provides relief only from federal registration requirements. It contains no express preemption of state securities laws. As a result, state securities laws continue to operate alongside the federal framework. In New York, the Martin Act provides broad authority over securities transactions and enforcement. In New Jersey, the Uniform Securities Law prohibits acting as a broker-dealer without registration. See N.J.S.A. 49:3-56. In Connecticut, similar requirements apply under Conn. Gen. Stat. § 36b-6. These statutory schemes raise there own pitfalls for intermediaries.

All of these requirements represent real risk to those having a business that buys and sells small businesses. In 2025, the Commission charged Paul McCabe and PMAC Consulting with acting as unregistered brokers in transactions involving private-company stock, alleging that they negotiated deals, advised buyers, and received substantial transaction-based compensation without registration. See SEC Press Release No. 2025-19. In an earlier proceeding, the SEC found that True Capital Management engaged in unregistered broker activity over a multi-year period while receiving transaction-based compensation in connection with securities transactions. See Exchange Act Release No. 98354 (Sept. 22, 2023).

These enforcement actions are instructive not because they involve large or complex institutions, but because the underlying conduct mirrors what occurs in many private-company transactions. Soliciting counterparties, participating in negotiations, and being paid upon closing are not unusual activities. They are routine features of the small business aquisition process, and it is precisely those features that trigger regulatory scrutiny when securities are involved.

There is a further layer of risk that applies regardless of registration status. Rule 10b-5 makes it unlawful, in connection with the purchase or sale of any security, to make any untrue statement of a material fact or omit material information necessary to make statements not misleading. See 17 C.F.R. § 240.10b-5. This provision applies broadly to participants in securities transactions, including, in certain circumstances, even sellers involved in small private placements.
In the context of small and mid-sized service businesses, that risk is not theoretical. Many smaller businesses lack audited financial statements or formal internal controls. Intermediaries often assist in presenting financial and operational information to prospective buyers. If such representations are inaccurate or incomplete, the issue does not remain confined to the intermediary; it becomes embedded in the transaction itself.

For business owners, the takeaway is not to avoid intermediaries, but to approach them with informed expectations. A competent intermediary should explain how the transaction is likely to be structured and whether it might involve securities. The intermediary should also be transparent about its regulatory posture, including whether it is registered or relying on an exemption. Finally, the process should reflect a disciplined approach to financial disclosure and diligence.

Moreover, business owners should not expect that potentially unlawful conduct will always lead to the rescission of a commission agreement. For example, the Second Circuit has reasoned that a stock purchase agreement that does not require a broker to engage in an unlawful transaction, i.e., “quintessential dealer activity”, will not lead to the rescission of the underlying transaction. As recognized by the Court, “because the contract can be performed lawfully, and because the contract is silent as to if, when, and how Auctus could sell discounted shares of Xeriant stock on the market (assuming that is, indeed, unlawful), the contract has not been made in violation of the Exchange Act.” See Xeriant, Inc. v. Auctus Fund LLC, 141 F. 4th 405, 413 (2d Cir. 2025).

There are, of course, alternatives to the retention of intermediaries who may skirt regulatory compliance. Owners can pursue a more direct process, working with their existing legal and accounting advisors to identify buyers through industry relationships, competitors, or management peers. Potential acquirers may also be owner operators actively seeking to acquire and run additional small businesses as a natural function of their prior success. A “trusted advisor” path can be very effective, particularly where the likely buyer pool is identifiable.

Regardless of the path chosen, the regulatory framework governing purchase transactions is not informal or discretionary. It is statutory, often enforced, and applies based on structure and conduct rather than terminology. For business owners, the question is not simply who can find a buyer. It is whether the process – and the people involved in it – are aligned with the legal framework that protects the seller and governs how the transaction must be executed and sustained.

Intellectual Property, Middle Market Business, Small Business

Service Business Exits: The Coming Transition

March 31, 2026 Paul E. Paray

While a growing number of business owners continue nearing exit, the market remains unprepared for them. According to the 2026 UBS Global Entrepreneur Report released earlier this month, “[n]early a third (32%) of global entrepreneurs are actively considering exiting their businesses within the next five years.” This number spikes for those aged 65 to over 57% with American entrepreneurs leading this monetization stampede, with a staggering 63% planning an exit, significantly outpacing their peers in Europe (38%) and Asia-Pacific (18%). A few weeks earlier, McKinsey released its own report, The Great Ownership Transfer, also beating that same drum: “By 2035, about six million small and medium-size businesses (SMBs) will face ownership transitions.”

These figures are not just backroom projections from high-brow consultants – they reflect an obvious structural reality driven by demographics. Ownership of small and mid-sized businesses is heavily concentrated among aging founders, and this concentration is now unwinding itself. Taken together, these dynamics point to a fundamental imbalance. A large and increasing supply of businesses will be seeking buyers at the same time, yet the infrastructure required to absorb that supply remains uneven.

It is no surprise that McKinsey observes that closure – not continuity – has become the de facto dominant exit path:

Yet the systems for transferring business ownership in the United States are fragmented and under- developed. Today, most exits end in closure rather than transfer, not because the businesses lack value, but because pathways to succession are limited, opaque, or costly. Moreover, starting a business can be more straightforward than acquiring one. The result is a consequential lost opportunity: Firms shut down, jobs disappear, and hard-won mobility gains dissipate—not through disruption, but through inaction.

The implications are particularly acute in the service sector. As the Federal Reserve Bank of St. Louis explains in its analysis of the services economy, services now account for the majority of both U.S. GDP and employment. More specifically, at the end of 2025, the services sector accounted for 72% of U.S. employment. This includes healthcare providers, contractors, professional services firms, and hospitality businesses – categories where many small and mid-sized enterprises operate. Interestingly, the BizBuySell Insight Report points out that the service sector had the strongest business sales growth in 2025, “with transaction volume up 4% over the past year and the median sale price rising 5% to $340,000 and service business values also held strong, with the average cash flow multiple increasing by 2% to 2.52.”

Despite this upswing, service businesses share structural characteristics that complicate ownership transfer. They are frequently owner-dependent, relationship-driven, and operationally concentrated. As well, they also tend to fall below the thresholds that attract institutional capital. McKinsey describes many of these firms as occupying the “missing middle” – economically viable enterprises that nonetheless struggle to transfer due to fragmented buyer markets and limited financing pathways.

A more pressing issue, however, is not market structure. It is owner preparedness. As starkly revealed by McKinsey, “fewer than one in three small-business owners have a documented exit plan.” At the same time, the BizBuySell Insight Report indicates that a substantial portion of owner wealth – often the majority – is tied up in the business itself. This combination creates a clear asymmetry. Owners are economically dependent on a successful exit, yet many approach that exit without the structural readiness required to complete one.

For service businesses, the consequences become further amplified. When value depends on personal relationships, undocumented processes, or the continued involvement of the owner, the business becomes difficult to transfer. Buyers discount valuations based on that risk. Lenders hesitate to even finance it. As a result, transactions fail – not because the underlying business lacks value, but because it is not configured for continuity.

Proper packaging of an SMB’s intellectual property – whether it is a company’s method of doing business or its proprietary client lists, i.e., trade secrets, or the trademarks registered by lawyers long ago to distinguish it from other companies, becomes an essential requirement for a business sale.

This is where success becomes less about markets and more about owner behavior. An exit is often treated as an event – something that occurs at the end of a business lifecycle. It is, however, a process that should be embedded into the business well in advance of that exit. In addition to protecting and packaging relied-upon intellectual property, this ongoing process should reduce owner dependency, formalize operations, strengthen financial reporting, and identifying realistic buyer opportunities.

Not surprisingly, buyer pathways are also often misunderstood. For many service businesses, the most likely acquirers are not institutional investors but independent operators, key employees, or local strategic buyers. In that context, alternative transition structures – employee ownership plans, phased buyouts, or internal succession – may be more viable than a traditional sales process.

The broader societal implications of correcting these imbalances extend well beyond individual transactions. Effective ownership transitions have the potential to preserve employment, maintain local economic continuity, and retain enterprise value within communities. Conversely, failed transitions result not only in lost business opportunities but in the erosion of economic infrastructure that is difficult to rebuild.

The emerging picture, then, is not just of a weak market, but of a mismatched system. Supply and demand may exist but they are unevenly distributed and often inaccessible. The overall limiting factor becomes not opportunity, but coordination – and, at the level of the individual business, this lack of preparation will continue as an owner’s Achilles Heel until awareness and proper resources supplant this widespread failure.

Blockchain, Digital Assets, DLT, Financial Reporting

Banking’s Unwise Genius Act

August 20, 2025 Paul E. Paray

For years now, stablecoins have quietly led the DeFi assault on the banking industry. Given standard trading markets dwarf the miniscule numbers thrown by stablecoins, the banking industry never openly feared them. Indeed, Big Banks chose to spin stablecoin buzz into PR by launching their own projects. For example, J.P. Morgan launched its inter-bank JPM “stablecoin” in early 2019. Much has changed since 2019. The “JPM” is now officially the “JPMD” – admittedly not a stablecoin but rather a “deposit token that’s designed to serve as a digital representation of commercial bank money”, and in so doing J.P. Morgan officially jumped off the stablecoin train.

Recognizing the dangers to their bottom line, Big Banks lobbied hard to ensure regulated stablecoins could not make interest payments. To that end, on July 18, 2025, the GENIUS Act – or “Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025” was signed into law with such a prohibition in place. Moreover, fully baked with the rigors of regulatory oversight, required identifiable reserves backing the outstanding payment stablecoins, and compliance with the Bank Secrecy Act, bankers were laughing all the way to their banks when it passed, believing they sufficiently quashed the stablecoin threat.

Despite its girth, the banking lobby misplayed the GENIUS Act’s ability to curtail the stablecoin threat. According to an August 12, 2025 letter from the Banking Policy Institute (“BPI”) – “a nonpartisan public policy, research and advocacy group, representing the nation’s leading banks”, the GENIUS Act allows stablecoins to “indirectly” provide holders with interest yield on their assets:

The GENIUS Act contained a prohibition on stablecoin issuers offering interest or yield, as well as other financial and non-financial rewards, to holders of stablecoins. However, without an explicit prohibition applying to exchanges, which act as a distribution channel for stablecoin issuers or business affiliates, the requirements in the GENIUS Act can be easily evaded and undermined by allowing payment of interest indirectly to holders of stablecoins.

These arrangements between stablecoin issuers and affiliates or exchanges, often jointly and explicitly marketed to consumers, will undermine the GENIUS Act’s prohibition regarding payment of interest and yield. The result will be greater deposit flight risk, especially in times of stress, that will undermine credit creation throughout the economy. The corresponding reduction in credit supply means higher interest rates, fewer loans, and increased costs for Main Street businesses and households.

In other words, despite their heavy lobbying, the banking industry now wants another bite at the apple that closes out this “loophole” which potentially allows stablecoin holders to receive interest on their holdings – no different than placing cash in a bank savings account. Indeed, existing stablecoin issuers are now moving full speed with smaller banks to compete with the Leviathan banks that sought their destruction.

On August 18, 2025, the U.S. Office of the Comptroller of the Currency (“OCC”) released a social media post stating: “Community banks can partner with companies developing stablecoins to foster innovation and offer new products. The OCC will review and update as necessary its regulatory and supervisory approach to ensure it supports innovations in banking and the vitality of community banks.”

This fundamental shift emanating from the OCC signifies a policy which better aligns crypto payment systems and the banking sector – just not with the Big Bank banking sector. Recognizing the writing on the wall, even the venerated McKinsey – often relied upon by those very same Big Banks for management consultant gigs, has jumped on the stablecoin bandwagon.

In a piece released on July 21, 2025, McKinsey recognizes that stablecoin transaction volume has risen sharply over the past two years – exceeding $27 trillion per year. More to the point, the mega-consulting firm offers the following observation:

If that rate of growth were to continue, stablecoin transactions could surpass legacy payment volumes in less than a decade—and potentially sooner, based on expanding applications. The ability for tokenized cash to operate continuously, satisfy demand for instant settlement, and offer improved operational risk controls solves real-world pain points and offers a compelling value proposition to end users that could accelerate adoption.

Back to the Big Bank problem. The GENIUS Act prohibits stablecoin issuers from paying “any form of interest or yield (whether in cash, tokens, or other consideration) solely in connection with the holding, use, or retention of such payment stablecoin.” See 12 U.S.C. § 5903(a)(11) (emphasis added).

This section expressly bans interest-yielding stablecoins, but leaves a gaping hole that allows exchanges and issuers to sidestep such prohibition by creating earned yields on the stablecoin based on factors other than the “holding, use, or retention” of the stablecoin. Big Banks obviously have some ideas regarding what that will look like – which is why they want a redo on the law and why the Crypto Council for Innovation (“CCI”) and the Blockchain Association (“BA”) jointly urged the Senate Banking Committee to resist efforts by the BPI to revise the GENIUS Act. Turns out the Big Bank lobby can learn a thing or two from the Crypto lobby, namely when it comes to whether Big Business or Consumers should benefit from new technology, the current Congressional mood swings towards the Consumer.

The CCI/BA Letter sent to the Senate Banking Committee explains why there should be no redo:

Allowing responsible, robustly regulated platforms to share benefits with customers is not a loophole—it is a feature that promotes financial inclusion, fosters innovation, and ensures American leadership in the next generation of payments. This balance, between consumer protection and innovation, has been thoughtfully struck by a shrewd and thoughtful bipartisan coalition of legislators in both the House and Senate. Altering the provisions already enshrined in the GENIUS Act would be unwise and would fundamentally weaken a legislative framework designed to encourage competition and democratize the benefits of technological advancement in digital finance.

Pushing aside whether or not Big Banks eventually lose this major battle, the more-interesting question remains whether the GENIUS Act’s allowance for non-financial institutions to offer “regulated” stablecoins manifests into yet another Congressionally-enacted quiver in Big Tech’s quest to conquer the world. After the implementing regulations arrive on July 18, 2026, we will all learn whether the law’s stringent safeguards – including capital and liquidity requirements, merely switches us from Big Bank mode to Big Tech mode or the law genuinely benefits consumers.

Accounting Firm, Copyright Infringement, Intellectual Property, Network Security, Risk Management, Small Business, Social Media

CHIP Away Risk and Grow Your Business

June 23, 2025 Paul E. Paray

While many business owners recognize the importance of maintaining their Cybersecurity Hygiene and protecting their Intellectual Property (“IP”), they are often too pressed for time and money to implement any serious plans of action. There are ways to improve your cybersecurity and IP postures without breaking the bank or ignoring revenue goals.

Be proactive and not take for granted good cybersecurity hygiene exists in your company. To start this exercise, every business owner should at least have someone review the readily available free resources on the subject. For example, the U.S. Small Business Administration (“SBA”) has online resources dedicated to informing small businesses on how to bolster their cybersecurity. And, the National Institute of Standards and Technology (“NIST”) helps companies who admittedly have modest or no cybersecurity plans in place by offering to “kick-start their cybersecurity risk management strategy” with the NIST Cybersecurity Framework (CSF) 2.0.

Tip #1: Choose WordPress for your website. After reviewing free resources, business owners can determine which direction to turn when it comes to preparing for the worst. For example, you may want to start out by looking at one of your main sources of credibility in the marketplace – your website. A secure site will always score higher on SEO than an insecure site – which makes it crucial for business to focus on reputational integrity and protection of customer data. The WordPress platform is extremely popular with small business owners given its content management system allows owners to easily upload and modify content – without the need for a developer charging for every edit.

Given that a large portion of the Internet is using WordPress, Corporate websites built using WordPress allow for secure custom shops and can securely mesh with your own separate e-commerce shop built using tools such as Shopify.

Some WordPress tips include keeping WordPress on auto-update to ensure all security updates are in place as soon as possible; choosing a mature template with many thousands of downloads that has been security tested over a long period and routinely updated; limiting the use of Plugins to those essential for WordPress security, including WordFence (or a similar firewall/scanning plugin) and WPS Hide Login (or similar plugin that hides the default login URL frequented by hackers) because many incidents are directly tied to insecure plugins – those that may have not been updated in years yet are still active on your site; and making sure you install an SSL (Secure Sockets Layer) Certificate allowing for encrypted HTTPS communications between site and browser.

The last tip is especially important given Google’s Chrome browser and Brave’s browser have long warned users when a website does not use this HTTPS protocol – a warning that likely causes potential visitors to not even visit the site. The Really Simple SSL plugin can help ensure that this is easily done. Many hosting companies provide a free SSL certificate so getting the plugin will make this an easy fix if needed.

Tip #2: Practice good security hygiene by using passwords that include upper case letters, numbers, lower case numbers, and symbols that total no less than 10 characters. Keep the password in a safe place if you cannot memorize it and only use it for your website. As well, deploy two-factor authentication to make it that much more difficult to get in the website using the front door – Authenticator is an excellent app for 2FA purposes but there many to choose from. When it comes to passwords, the strongest chain of defense can only be as strong as its weakest link.

Tip #3: Remind all employees never to click on links in emails – even if they seem legitimately from companies you do business with, including lawyers and accountants. As for the most basic of “basic training”: Don’t open or click on anything that looks suspicious. Again, it is much more difficult for hackers to launch an exploit without walking in the front door and they can’t come in if you don’t open the door. In other words, never click on a link, file or image from an untested source or unknown URL. The extra seconds it takes to confirm the actual sender of an email message or owner of a website is well worth the time.

Tip #4: Safeguard against Ransomware attacks. Given credit card data and account information has long been dirt-cheap to buy on the dark web, hackers now combine social engineering, e.g., well-crafted targeted emails using publicly available information, including emails of licensed professionals, with botnets usually tasked with promulgating spam and searching for vulnerabilities. The result is a ransomware attack that can cripple a business unless Bitcoin is transferred to a specific account.

The FBI has long suggested firms focus on a variety of basic prevention efforts – in terms of awareness training for employees and technical prevention controls, as well as the creation of a solid business continuity plan in the event of a ransomware attack. And, after a ransomware attack is suspected, victims should immediately contact the local FBI field office and report the incident to the Bureau’s Internet Crime Complaint Center.

If a firm wants to immediately enact a more proactive approach, however, there are certainly additional very basic policies and procedures that can be put in place right now to help avoid a ransomware exploit: (i) block executable files (such as “.exe” files) and compressed archives (such as zip files) containing executable files before they reach a user’s inbox; (ii) block the use of thumb drives; (iii) mitigate against social engineering exploits by providing employee online training that is continuous and targeted with services such as KnowBe4; (iv) make sure whoever is providing you with IT support has a software patch management plan in place; (v) regularly back up data with media not connected to the Internet.

Tip #5: Apply for Cyber Insurance. Given the recent massive spike in small business insureds being specifically targeted, price hardening and onerous underwriting requirements have been the norm for cyber insurers. While it is way too soon to turn in the towel on small business cyber insurance, some of those allocated insurance premium dollars might also be spent on bolstering security as well as lower cost/higher deductible coverage.

One key attribute of any cyber insurance should be the technical vendors and legal counsel associated with these carriers. Cyber insurance will also always serve a vital role in helping small business owners deal with ransomware attacks by offering the benefit of an underwriting process so that businesses can better understand their vulnerabilities and potential strengths – all without the need of hiring a consultant or paying any fees. Indeed, an insurer acting as a trusted partner may even assist a potential client obtain compliance with an insurer’s cybersecurity standards before the insurance is even purchased

Protecting your most valuable assets – your intellectual capital, is well worth the effort. Whether it’s how your employees conduct business, which clients you do the most business with, how you service those clients, or how you communicate with clients and employees, intellectual property is wrapped around all of it.

Tip #1: Your know how needs confidential treatment. Your client list and how your clients are serviced constitute your “know how” or more commonly “trade secrets” that must be kept confidential – once they become public any protections you may have had will evaporate. The use of non-disclosure agreements with third parties is essential – as well as ensuring your employees understand this fundamental concept. Using well-written contracts with clients will also help ensure your know how is protected.

Tip #2: Your brand, sales and marketing brochures, and training materials are trademark and copyright protected. Even a small company with no employees can have a robust brand built over many years – and found predominantly on the company’s sales and marketing materials. All that is necessary for local common law protection is that it be in use to identify specific services or products. To obtain nationwide protection and added damages for infringement, the mark should seek federal registration using the USPTO.Gov website. Similarly, the product brochures created from scratch are copyright protected as soon as they were created but have enhanced protection when registered at Copyright.Gov.

As you review the content and systems powering your business — everything from the company names to the use of training materials — you will quickly appreciate how much value goes unguarded. Consulting a legal expert or learning how to protect your trademarks and copyrights may not be quick or glamorous, but it will give you something longstanding: ownership of an intangible asset, leverage, and peace of mind.

Tip #3: Plan for the sale of your business by incorporating these best practices. According to the SBA, more than half of the nation’s small-business owners are over the age of 50, and approximately 21% of the US population were born before 1964. And, according to one study, baby boomers owned about 51% of the privately held businesses in the United States, which is about 3 million businesses valued at $10 trillion dollars. Unfortunately, founders typically defer addressing the fact that they will one day be too old and tired to manage a successful business.

When no one in the family wants to take over your business there are only two options, close shop or sell to a willing buyer. One metric used in valuing businesses is tied to the company’s ability to scale based on its protected intellectual property assets. In other words, sustainable growth is not always about making more — it’s also about being able to protect what you’ve already built. After deploying the right practices, support system, and mindset, a successful entrepreneur can go from vulnerable to vigilant — and nurture a business that’s built for selling.

Artificial Intelligence, Blockchain, Digital Assets, Electronic Health Records, Intellectual Property, Privacy, Risk Management, Technology Law

Birthing the Agentic Web

May 20, 2025 Paul E. Paray

On May 19, 2025, Microsoft blogged the following potentially prophetic words:

We envision a world in which agents operate across individual, organizational, team and end-to-end business contexts. This emerging vision of the internet is an open agentic web, where AI agents make decisions and perform tasks on behalf of users or organizations.

In the current mad rush to advance AI agents – which represent autonomous tools operating in the “real world” picking and choosing what comes after a user’s initial AI prompts, companies are paying little heed to existing guardrails.

Indeed, commerce titans are falling all over themselves to get in front of Agentic AI. MasterCard recently announced its launch of an Agentic Payments Program, Mastercard Agent Pay. According to MasterCard’s April 29, 2025 press release, this “groundbreaking solution integrates with agentic AI to revolutionize commerce.”

A day later Visa released information regarding its own Visa Intelligent Commerce which “enables AI to find and buy.” Not to be left out in the colde, PayPal released its own Agent Toolkit that same day. PayPal’s toolkit enables existing agent frameworks, such as OpenAI’s Agents SDK, Vercel’s AI SDK, Model Context Protocol (MCP), LangChain, and CrewAI, to integrate with PayPal’s APIs.

An agentic web lacking in “privacy by design”, strong cybersecurity hygiene, and proper adherence to regulatory and common law constraints regarding consent, will not likely mainstream agentic AI no matter how many developers are tasked with moving this infrastructure forward.

To fully grasp what needs to be done in this area, all one needs to do is read a description of Stanford Health Care’s implementation of Microsoft’s healthcare agent orchestrator. According to Microsoft, the healthcare agent orchestrator “has helped the Stanford team build and test autonomous AI agents that consult disparate data sources and collaborate on tasks that might otherwise take hours – building a chronological patient timeline, synthesizing current literature, referencing treatment guidelines, sourcing clinical trials and generating reports – using clinically grounded knowledge to deliver accurate and reliable results.”

The compliance landmines referenced in this short blurb read like they are straight from a law school exam.

Blockchain, Digital Assets, DLT, Technology Law

Crypto 2025 is not Internet 1995

January 15, 2025 Paul E. Paray

On January 7, 2025, Fidelity Digital Assets rolled out its 2025 Look Ahead report. The main message of financial behemoth Fidelity Investments is that it is not too late to invest in digital assets because “2025 has the potential to be the year that is looked back on as the pivotal time where the “chasm was crossed” as digital assets begin to take root and embed themselves into multiple fields and industries.” See Report at 3.

Fidelity’s failure to attribute its chasm reference to Geoffrey Moore’s 1991 seminal tech marketing book “Crossing the Chasm” seems reflective of this fluff paper’s entire premise, namely that their predictions for a crypto seismic shift are warranted. Nothing could be further from the truth.

While it is true Fidelity Digital Assets has been singing a bullish song these past five years, Fidelity only really cares about “digital assets” to the extent they require Fidelity’s custodial or brokerage services or moving new BTC ETFs into a 401(k). Fidelity Digital Assets does not care whether there is any underlying value in any of those assets – unlike with shares representative of a company that hires workers, builds products, and generates revenue.

Over the past ten years, blockchain technology has simply merged with crypto coins in the public’s mind with regulators aggressively going after those selling such unregulated coins. Despite Facebook pouring millions into its Libra coin effort – later renamed Diem, it eventually realized there was no future in its privacy-killing product given this regulatory backlash. Indeed, during the past seven years no blockchain effort has risen to mass appeal other than the greater fool driven meme coins lacking any centralized control and a BTC reaching over $100,000. While it is true that DeFi platforms saw increasing growth these past several years, most stock investors would be unable to name any such platform or what even is “DeFi”.

Adding to this lack of true product awareness and regulatory backlash, crypto’s current lack of clothing is easy if one looks in the right places. In an October 2024 scathing diatribe penned by a former SEC lawyer titled “Blockchain Remains, and Will Forever be, a Dire Grift, a Perilous Scam and a Nasty Scourge”, the author does not mince words: “I can’t say it any plainer: blockchain is bunk. Despite its relentless hype and inexorable bluster, blockchain technology itself has extremely limited utility and is a solution to a problem that nobody has.”

The author – John Reed Stark, is the former chief of internet enforcement at the SEC, and was on 60 Minutes on December 8, 2024 to further state his case. He bemoaned on air that “crypto is a scourge. It’s not something that you want in your society. It has no utility. it’s just pure speculation. Remember, there’s no balance sheet to crypto. There’s no financial statements.”

Mr. Stark explains “there’s no audit, inspection, examination, net capital requirements – no licensure of the individuals involved. And there’s no transparency into it. that creates real systemic risk, not just risk for investors. But the other part that people don’t really talk about enough are the dire externalities that are enabled by crypto.”

When asked to explain those externalities, he places a floodlight on the elephant in the room: “Every single crime you can conceive of is easier to do now because of crypto, especially ransomware, human sex trafficking – sanctions evasion, money laundering. North Korea is financing their nuclear weapons program using crypto.” While the volume of illicit transactions may remain high, crypto certainly lost its luster among criminals after better armed law enforcement arrived in 2017.

Nevertheless, not only does crypto not really fuel physical transactions like fiat currencies, it does still fuel criminal activity and can lead to investor loss more readily given it lacks the SEC guard rails afforded to public stock investors. Accordingly, in some ways, Mr. Stark may be right about crypto but wrong about blockchain – or at least the jury remains out on the later.

Not all crypto coins sold to the public are bunk and smart contracts such as those available under Ethereum will very likely eventually allow for the utilization necessary for a blockchain ecosystem to thrive. The true potential of blockchain technologies will never be realized, however, until blockbuster products reach mass appeal – something that just has not yet happened other than in the case of the speculative asset of Bitcoin. Bitcoin will never be the optimum test case for blockchain technology given it is nothing more than a speculative asset albeit one that has many buyers and a growing pricing model.

One wildcard is how the new administration shapes policies going forward – including the possibility of creating a U.S. Bitcoin strategic reserve. It remains to be seen whether the Trump Administration fulfills all the promises that led to significant campaign funding from crypto PAC Fairshake. Such regulatory easing may very well lead to greater innovations. More than likely, however, after Bitcoin is used by the government to pay down some of its debt, it will no longer project that gleam in the incoming President’s eye and regulatory compliance might reenter the picture. Either way, regulators will for the next four years focus primarily on fraud – which can only help legitimate projects going forward.

While it took a two decades for Internet companies to upend the retail establishment, that seismic market penetration was based on millions of consumer transactions . As of today, however, the only deeply penetrated crypto markets are of the asset class type – which is insufficient to create commercialization of an industry. In other words, the only way the 1995 comparisons made by Fidelity Digital Asset in its report come to fruition is by having blockchain begin delivering on its promise of utility on a grand scale. Until the potential of that happening becomes very clear – which was the case for the Internet when broadband began taking over in 2005, crypto 2025 should not be considered Internet 1995.

Despite showing great initial promise in 2018 – what at the time appeared to be the more appropriate year for the 1995 comparison, nothing pre-seismic occurred during these past seven years. In other words, it still remains too early in the game to peg any seismic shift date so Mr. Stark may eventually be proven right.

Behavioral Advertising, Intellectual Property, Media, Privacy, Social Media

The Personal Financial Data Rights Rule

October 25, 2024 Paul E. Paray

On October 22, 2024, the Consumer Financial Protection Bureau (“CFPB”) finalized the Personal Financial Data Rights rule, which moves the United States closer to “an open banking system in which consumers, not dominant firms, control their data.” The CFPB is generally tasked with “promoting fair, transparent, and competitive markets for consumer financial products and services.”

On October 23, 2024, CFPB Director Rohit Chopra spoke at Georgetown University’s DC Fintech Week. As shown below, his prepared remarks do a nice job of describing how the new rule will address data ownership and stewardship problems largely ignored by helpless consumers.

Today, I primarily want to focus on the data protections in the rule, which are essential to ensuring the rule works to advance competition in financial markets. This rule will help to dramatically improve privacy and security, ending the problematic credential sharing and invasive surveillance that we too often see.

First, to obtain data on a consumer’s behalf, a bank, fintech, or other financial company will need to adhere to federal data security requirements. This means they can’t have shoddy security like we saw at companies like Equifax. And if they fail to meet their obligations, they can face enforcement actions and can even get shut down by the licensing or chartering authority.

Second, the rule works towards ending the practice of “screen scraping.” This occurs when a company collects a consumer’s username and password to log in to online banking on the consumer’s behalf to scrape away data. “Screen scraping” is risky, since it can involve unencrypted credential sharing and massive overcollection of data.

Third, the rule requires companies to minimize the data they collect, secure it, and, as a default practice, delete it upon revocation. In addition, the rule forbids companies from seeking to obtain a permanent authorization to continually harvest data. These requirements should lessen the amount of data that would be vulnerable to a data breach.

Fourth, the rule allows banks and fintechs that currently hold the consumer’s data to deny access to companies requesting on the consumer’s behalf when they fail to meet minimum standards. Companies making requests will need to prove they have the authorization from the consumer, disclose their legal entity identifier, and more. The rule allows banks and fintech to engage in legitimate blocking, as long as those practices are applied consistently and fairly.

Fifth, and most importantly, the rule puts into place significant limitations on how companies can use data. Right now, financial companies send consumers an annual privacy notice that tells them any parties they reserve the right to share the data with. In theory, consumers review this and then opt out of sharing they don’t want. In reality, almost no one opts out of anything. Many believe this is just another notice that doesn’t meaningfully limit misuse of personal data.

The rule spells out a simple, but much different approach: you can use a consumer’s data to provide the product or service the consumer asked you for, but you can’t use it for unrelated purposes the consumer doesn’t want. In other words, companies can’t engage in a bait-and-switch, where they lure people in with an offer for a loan or an account, but then sell, exploit, or monetize the data for another purpose.

And there’s a lot more. Taken together, these protections improve the privacy and security of our financial data, compared to the status quo. This will help to stop the lurch toward surveillance pricing.

The CFPB has closely studied how Big Tech companies and other firms can combine your search history, browsing history, geolocation history, your contacts, and more to create a detailed profile about you. We also see how large banks are also seeking to harvest more data from their customers without meaningful limits. When this information includes your sensitive personal financial data, this can create the conditions for surveillance pricing.

For example, if a rideshare giant knows that you worked an extra shift and just got a larger paycheck than usual, it might decide to charge you more for a ride home. If a dominant player in search knows that you just made a payment at a fertility clinic, it might start targeting you with ads for dubious treatments you didn’t ask for.

While the CFPB’s Personal Financial Data Rights that implements new statutory rights will help to jumpstart competition, it is also a major step forward for privacy, security, and data protection.

Director Chopra is correct in his optimistic assessment of the rule given the longtime “data slurping” conducted by so many companies has largely gone unabated and this new rule – which solves some but far from every consumer data transgression, is a great beginning. It only took the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 to establish the CFPB and it then another fourteen years to get the CFBP to promulgate this new rule. When dealing with the “data industrial complex”, these things take time.

Indeed, as shown by this new rule’s compliance schedule, it will be years before the individual parts of the rule take effect with possible judicial and governmental intervention in the interim. See Personal Financial Data Rights Rule (“Data providers must comply with the requirements in subparts B and C beginning April 1, 2026; April 1, 2027; April 1, 2028; April 1, 2029; or April 1, 2030, depending on the criteria set forth in § 1033.121(c)”). At the very least, the new rule discussed by Director Chopra alerts consumers to the dark “data industrial complex”. Even if the rule eventually gets neutered, its underlying wake up call hopefully doesn’t get unanswered on a state level.

Financial Reporting, FinCEN BOI Reporting, Middle Market Business, Risk Management, Small Business

The Need to Comply With the CTA comes Into Focus

October 9, 2024 Paul E. Paray

October 8, 2024 was a bellwether date for those waiting on a court to clarify whether the statutory requirement for filing BOI Reports sits on solid ground. It was on October 8, 2024 when the oral argument in the pending Eleventh Circuit appeal from Small Bus. United d/b/a Nat’l Small Bus. Ass’n v. Janet Yellen, Case No. 5:22-cv-01448, Dkt. No. 52 (N.D. Ala. Mar. 1, 2024) was released to the public.

Given the tempo and questions raised during this September 27, 2024 hearing, reporting companies can now reasonably assume there is likely no longer any reason to delay filing their BOIR Report based on any perceived lack of judicial clarity. Before the end of the year – the deadline for over 30 million reporting companies, subject companies should likely file their BOI Report because there is no Judge that will likely remove that obligation.

While it is never easy to predict which way the judicial winds blow, it seems likely the Eleventh Circuit will at least remand the Alabama decision for further review of the Fourth Amendment argument raised during that hearing – something not touched upon by the court below, if not just rule outright for reversal. The appellee raised the Fourth Amendment argument because federal, state, local and foreign law enforcement can access BOIR data without the need for a Court Order. Overall, the Judges – especially the Honorable Andrew L. Brasher who was appointed in 2020, seemed skeptical of this and all other arguments suggesting that Congress passed in 2021 the Corporate Transparency Act (“CTA”) without proper Constitutional footing.

The Eleventh Circuit hearing is on the heels of a District Court Judge in Oregon denying requested injunctive relief, in part, by ruling the CTA was likely constitutional. See Michael Firestone, et al. v. Janet Yellen, Case No. 3.24-cv-1034, Dkt. No. 18 (D. Or. Sept. 20, 2024). Indeed, in the second of two supplemental filings with the Eleventh Circuit, the appellee tried to distinguish the Oregon case as well as a recent Supreme Court case that may have shifted the burden in this case slightly in favor of the government – a case the Eleventh Circuit requested supplemental briefing on in its August 14, 2024 Order. Not surprisingly, the government filed a contrary reply with the Court.

As it stands, the Eleventh Circuit and the Court of Appeals of the Ninth Circuit – by way of the likely appeal from the Firestone decision, will squarely rule upon the constitutionality of the CTA – setting up the exact sort of case the Supreme Court likes to hear, namely an appeal where more than one Circuit Court rules on the constitutionality of a far-reaching federal statute.

Indeed, there are other Courts of Appeal that could also likely chime in on this issue given pending District Court cases, including the First Circuit (William Boyle v. Janet Yellen, Case No. 2:24-cv-00081 (D. Me. filed Mar. 15, 2024) and Black Econ. Council of Mass., Inc. v. Janet Yellen, Case No. 1:24-cv-11411 (D. Mass. filed May 29, 2024)); the Fifth Circuit (Texas Top Cop Shop, Inc. v. Merrick Garland, Case No. 4:24-cv-00478 (E.D. Tex. filed May 28, 2024)), the Sixth Circuit (Small Bus. Ass’n of Mich. v. Janet Yellen, Case No. 1:24-cv-00314 (W.D. Mich. filed Mar. 26, 2024) and Robert J. Gargasz Co. LPA v. Janet Yellen, Case No. 1:23-cv-02468 (N.D. Ohio filed Dec. 29, 2023)); and the Tenth Circuit (Taylor v. Janet Yellen, Case No. 2:24-cv-00527 (D. Utah filed July 29, 2024)).

This mosaic of potentially conflicting upper court decisions leaves little doubt that in the short term FinCEN holds the upper hand and might use such built-up judicial equity to aggressively enforce its BOIR regulations in 2025. One thing is for sure – the only way this fast-approaching BOIR Train gets derailed is by either the Supreme Court – which is unlikely given the very case the Eleventh Circuit sought briefing on, or by Congress – which is even less likely given the treasure trove of information derived from the CTA may be useful for tracking individuals with large cryptocurrency holdings and eventually bringing in more money into federal coffers as well as potential crime prevention.

Legal and Business Advocacy