EEOC Reverses Course, Stay or Pay Crackdown & Unclaimed Crypto Grab (07/11/2026)

Three of this week’s changes touch the two things every operator budgets around: who you can hire and how you keep them. The EEOC pulled guidance that employers relied on for their affirmative action plans, California and New York are limiting the contracts that recoup training costs, and state treasurers are starting to treat idle crypto as property they can claim. Each one shifts a cost or a liability onto the business, and the ones who reprice for it early will not be the ones caught flat.

Top 5 Critical Compliance Alerts

1. EEOC Withdraws Longstanding Affirmative Action Guidance

On June 30, the Equal Employment Opportunity Commission (EEOC) formally withdrew longstanding guidance documents on the permissible scope of voluntary affirmative action plans (JD Supra). Employers built hiring and promotion programs on that guidance, and pulling it removes the safe harbor they were relying on, which means every plan written against the old rules needs a fresh legal read.

Operator Note: If your hiring or promotion program cites the withdrawn EEOC guidance, it needs review now. The document you built the policy on no longer backs it up.

2. California and New York Target ‘Stay or Pay’ Contracts

New laws in California and New York take aim at “stay or pay” provisions, the clauses that require employees to repay training, licensing, or sign-on costs if they leave before a set date (JD Supra). Businesses use these clauses to protect real investment in their people, so the practical move is to rebuild retention around agreements that hold up under the new rules rather than the ones now being challenged.

3. States Move to Seize Dormant Cryptocurrency

State treasury regulators are accelerating efforts to apply unclaimed property laws to inactive cryptocurrency accounts and other digital assets, with more than two dozen states now involved (JD Supra). Any business holding customer digital assets now has an escheatment obligation to track, and getting the dormancy timelines and reporting wrong turns an accounting gap into a state enforcement problem.

4. Study Finds Healthcare Websites Leaking Data Through Tracking Tools

A study found that the majority of healthcare websites use marketing and analytics tools that can disclose sensitive visitor information to third parties (HIPAA Journal). A tracking pixel on a patient-facing page is a HIPAA exposure hiding in the marketing stack, and the fix starts with an honest inventory of what your own website is sending and to whom.

Operator Note: Audit the trackers on your patient-facing pages before a regulator or plaintiff does. The compliance risk lives in the analytics tags the marketing team added, not the clinical systems IT watches.

5. Aspen Dental Settlement Resets Dental Service Organization Standards

California’s settlement with Aspen Dental Management sets a significant new corporate practice of dentistry standard for dental service organizations and the practices they support (JD Supra). Any management services organization operating in a regulated clinical field should read this as a signal that the arrangement between the business and the licensed practice will get scrutinized.

Additional Compliance Alerts

Regulatory Updates

• Colorado AG Settles Over Home Equity Agreements: Colorado’s attorney general entered an assurance of discontinuance with a home equity agreement provider, requiring it to comply with the state’s Uniform Consumer Credit Code. JD Supra
• China Proposes Penalties on Cross-Border Brokerages: The China Securities Regulatory Commission announced proposed penalties against several overseas online brokerage firms for cross-border business activities, a warning shot for institutions serving Chinese clients. JD Supra

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.