Corruption Crime & Compliance

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the growing retrenchment of compliance and why companies that cut or sideline their programs are taking on more risk, not less. Using the Bank of America penalties as a case study, he shows how a compliance function can identify the problem, recommend an exit, and still be overruled or bypassed by the business, which is a failure of stature rather than a lack of staff. He explains why the lower priority given to FCPA enforcement does not signal lower risk overall, since the administration has reallocated resources toward trade and customs enforcement, sanctions, the False Claims Act, financial crime, health care, and national security cases, including cartel-related bribery, and he notes that the $1.21 billion in Treasury penalties does not include any announced Justice Department action. Volkov closes by arguing that ethics and compliance are not cost centers but foundations of reputation, intangible asset value, and financial performance, and he offers practical steps for compliance officers and boards to restore stature, authority, and funding.

Your supply chain doesn’t end at your supplier. Neither does your liability.

Three risks are converging on the same shipments.

Sanctions. Evasion networks use transshipment hubs, shell companies, and last-minute routing changes, and regulators now expect you to screen your cargo, not just your counterparties.

Forced labor. U.S. law presumes goods linked to restricted regions or entities were made with forced labor unless you prove otherwise.

And one blacklisted component several tiers down got thousands of luxury vehicles stopped at U.S. ports in 2024.

Add country-level forced labor tariffs in the U.S. and an outright EU product ban fully applicable at the end of 2027.

Then there’s human trafficking, which rarely announces itself.

Look for workers in debt from recruitment fees, employers holding passports, delayed wages or inflated deductions, and overtime enforced by threats.

The fix is the same for all three.

See below the first tier.

Assess residual risk based on a supplier’s tested controls rather than its ZIP code.

Write enforceable contract terms, verify with audits and worker channels, and fix root causes instead of simply dropping a supplier.

Build evidence, not a policy binder, before a customs officer asks a question you can’t answer.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Michael Volkov examines why every organization needs a responsible AI use policy now, as employees adopt AI tools faster than companies can govern them. Drawing on court sanctions against lawyers for AI-fabricated citations, SEC "AI washing" enforcement actions, and data leaks into public chatbots, Michael explains that these failures stem from weak governance rather than weak technology. He highlights DOJ's Evaluation of Corporate Compliance Programs, which now asks how companies manage emerging-technology risks, along with the EU AI Act and new U.S. state rules. Michael then outlines eight essentials of an effective policy: controlling approved tools, classifying permitted, high-risk and prohibited uses, protecting data, keeping humans accountable, verifying outputs, ensuring transparency, governing third-party AI, and building a cross-functional governance structure. He closes by urging CCOs to lead the effort, embed AI in the enterprise risk assessment, and back the policy with training, monitoring and a speak-up channel.

Lying about where your goods come from is now one of the most expensive mistakes in trade compliance.

DOJ stood up a dedicated trade fraud task force in August of last year, and it moved fast.

Its first settlement came three months later.

This May, it announced the largest customs-related False Claims Act recovery ever, roughly $550 million from aluminum companies and affiliated warehouses accused of evading anti-dumping and countervailing duties by disguising Chinese aluminum extrusions as unregulated pallets.

A week later, two steel companies paid $19 million for allegedly passing off steel from several countries as Canadian or American.

Here’s the legal engine.

Underpaying duties you owe the government is a reverse false claim, which means treble damages and whistleblower awards, and data miners are now behind more than 45% of new qui tam filings.

So patterns in your public import data are visible to people who profit from finding them.

As tariffs climb, so does the temptation to misdeclare country of origin, tariff classification, or value.

Put customs and origin compliance inside your enterprise risk assessment, audit your broker’s entries, and verify origin documentation yourself.

Don’t assume your broker did.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov interviews Ryan R. Martin about how third-party risk management has evolved from its early focus on foreign bribery into a discipline now dominated by cybersecurity and artificial intelligence. Martin describes building a vendor risk management system from scratch, draws lessons from the Target data breach about how a vendor's weakness can become a company's crisis, and explains why continuous monitoring and strong oversight are essential as AI and cyber threats change. He discusses the risks AI creates, including bias and hallucinations, why companies should ask vendors pointed questions about how they use AI and consider closed network systems, and why human verification of AI-driven outputs remains necessary. Martin also offers practical advice on winning business buy-in by showing that third-party risk management protects revenue and reputation, and he addresses supply chain vulnerabilities, offshoring, and business continuity, along with using AI to monitor vendors on an ongoing basis.

Ryan Martin is a JD‑trained Vendor Risk and Third‑Party Governance Leader with experience overseeing more than $2.1B in contracts across Fortune 100 banking, fintech, insurance, and aerospace organizations. He specializes in building and maturing TPRM programs, integrating cybersecurity and compliance rigor, and designing scalable vendor governance frameworks. With advanced certifications (CRVPM I–IV, C3PRMP) and deep experience in SOC 2/ISO assessments, contract negotiation, and critical vendor oversight, Ryan blends legal, technical, and operational expertise to strengthen enterprise resilience.

You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true.

Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information.

Those are allegations only. There was no finding of liability.

But notice what’s missing from the story: a breach.

DOJ’s theory is simpler. If you certify compliance to get paid and it is inaccurate, every payment claim can be a false claim.

And notice who started this case: a whistleblower, a former employee who received more than $370,000 of the recovery.

Cyber fraud cases are often brought by the insiders who see the gap between what the company tells the government and what its network actually looks like.

If you hold defense contracts, don’t rely on point-in-time attestation.

Independently verify your controls. Take internal security concerns seriously, and remember this exposure can run quietly for years across many billing cycles.

The risk is rising, not falling.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors, and mishandled business accounts tied to blocked persons. Volkov explains why OFAC gave no penalty reduction for remediation or cooperation, pointing to a narrow initial lookback, piecemeal responses, reckless conduct, and prior cautionary letters, and he outlines what the bank must now do under the FinCEN, OCC, and OFAC resolutions. He closes with eight practical lessons, including prioritizing exact matches, verifying daily watchlist updates, reviewing auto-clear rules, scoping lookbacks to root causes, building a self-disclosure process in advance, and integrating AML and sanctions programs.

If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement.

OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes.

Four of them should be on your list today.

One, U.S. nexus now reaches foreign companies that touch U.S. clearing, U.S. servers, or U.S.-origin components, and parent companies answer for their foreign subsidiaries. Centralize your program.

Two, voluntary self-disclosure under BIS rules. Staying silent about a significant violation is now an aggravating factor. Silence is no longer neutral.

Three, know your cargo. Watch transshipment through hubs like Hong Kong, Turkey, and the UAE, last-minute shipping changes, and shell companies.

And fold export controls into your sanctions risk assessment rather than running them as separate work streams.

Four, OFAC’s statute of limitations is now 10 years, not five. If your records retention stops at five, your program has a gap.

Don’t replace the 2019 framework. Build on it.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the more than $1.21 billion in Treasury penalties announced October 13, 2026 against Bank of America, including FinCEN’s $1.2 billion consent order, which credits the OCC’s record $750 million penalty and includes the bank’s admission that it willfully violated the Bank Secrecy Act. Volkov explains how the bank’s homegrown transaction monitoring system, Event Processor, relied on unsupported thresholds, miscalibrated risk weights, and unreviewed suppression rules, and how the bank’s own testing flagged these problems for years while more than $5 billion in suspicious activity went unreported or was reported late. He covers the customer due diligence findings, in which compliance recommended exiting high-risk customers and the business line pushed back, the order’s finding that a senior executive had a test repeated, and the status of DOJ, where no resolution was announced. He closes with seven practical steps for testing thresholds, setting tolerances, governing suppression rules, checking product coverage, and empowering compliance to say no.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC's October 9, 2026 settlement with Pegasus Worldwide Logistics, a small California freight forwarder that agreed to pay $175,015 for apparent violations of counter narcotics sanctions and OFAC reporting obligations. Pegasus arranged the shipment of a $5,950 sugar packet-filling machine from a China-based supplier that had been designated, but had changed its name while keeping the phone number and email address listed on the SDN List, and its late, name-only screening missed the match. Volkov explains how Pegasus then ignored a CBP detention notice naming OFAC and gave an incomplete response to an OFAC subpoena, leading to six separate reporting violations, and he walks through OFAC's aggravating and mitigating factors. He closes with five practical lessons for freight forwarders, brokers, and importers: screen beyond names, screen early, make sure policies are actually executed, treat government notices as escalation events, and take subpoena responses as seriously as the underlying conduct.

Compliance used to count training completions. Today, regulators want proof your program actually works.

That shift didn’t happen by accident.

Twenty years ago, compliance data meant hotline calls and a training checklist. The numbers were easy to collect and nearly impossible to interpret.

A quiet hotline could mean a great culture or a terrified workforce.

Then regulators started asking harder questions: Do you track your own data, and do you use it?

Privacy laws demanded real-time visibility into how personal data moves. Cyber threats made annual reviews look dangerously slow, so compliance built continuous monitoring, integrated dashboards, and risk indicators that warn you before a problem arrives.

Now comes AI, which can spot patterns no human-written rule would catch and compress the time from detection to action from months to hours.

And here’s the twist: AI is also the newest risk compliance has to monitor.

But AI is only as good as the data discipline underneath it.

If you never built integrated systems, clean data, and a habit of using metrics to change behavior, AI will simply automate your blind spots.

Build the foundation first. The tools will follow.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down DOJ Directive 26-12, the October 1, 2026 memorandum in which Assistant Attorney General Colin McDonald sets corporate enforcement policy for the National Fraud Enforcement Division. He explains the Division's four investigative priorities, health care, procurement and government contracts, revenue evasion, and tariff evasion, import and forced labor schemes, and walks through the ten factors prosecutors must weigh heavily in charging decisions, from management knowledge and concealment to duration, number of districts, victim counts, and loss thresholds. Volkov also covers the new central role of the Corporate Enforcement Section, including oversight of compliance with corporate resolutions, and the directive's push to incentivize whistleblowers, even those who participated in the misconduct. He closes with a practical plan: map exposure to the priority areas, test your program against the ten factors, protect records, strengthen internal reporting, and prepare your voluntary self-disclosure process in advance.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the FTC's October 5, 2026 warning letters to 24 of the nation's largest healthcare services companies, which assert that failing to provide timely, accurate, and complete pricing, particularly for scheduled, non-emergency care, can be a deceptive or unfair practice under Section 5 of the FTC Act, and that incomplete disclosures omitting physician or facility fees can mislead patients into believing they have been told the total cost. He highlights the letters' most consequential point, that CMS price transparency rules are only a regulatory floor and provide no safe harbor from FTC liability, and places the action in context alongside tougher CMS enforcement, the No Surprises Act good faith estimate, the FTC's new Healthcare Task Force, and Chairman Ferguson's warning that investigations are already open. Volkov closes with a practical review plan: map every channel where patients receive prices, mystery-shop quotes against final bills, close the professional fee gap, tighten the language of estimates, bring consumer protection into price transparency governance, and document corrective action.

You can buy a company’s assets, its customers, its brand, and guess what? Its sanctions violations. And sometimes the violation doesn’t exist until the day you close.

Here’s what I mean.

Under a sanctions program like Cuba and Iran, a foreign company owned by a U.S. buyer becomes subject to U.S. sanctions the moment the deal closes.

Business that was lawful on Monday can be a violation on Tuesday.

That’s what happened at First Bank, whose euro payments to Iranian parties became violations after a U.S. investor bought it.

It’s what happened to Key Holding, whose new Colombian subsidiary shipped to Cuba for 19 months because nobody told it the rules had changed.

And diligence alone won’t save you.

Unicat’s buyer did diligence, missed the problem, disclosed quickly, and earned DOJ’s first declination for an acquirer. Yet the company it bought still paid millions.

Stanley Black & Decker found Iran sales in diligence, made them a closing condition to stop, and still got hit because OFAC says no one monitored whether they actually stopped.

So before signing and acquiring, ask what becomes illegal the day you own it.

On day one, tell the target in writing that U.S. sanctions apply, and after closing, test the transactions yourself.

Don’t accept a certification from the people hiding the problem.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines FinCEN's April 2026 proposal to rebuild the Bank Secrecy Act AML program rule around an effectiveness standard, with a two-prong test requiring that programs be both established (risk-based, built on four core elements, and kept current) and maintained (implemented in all material respects), along with a new enforcement threshold for banks limited to significant or systemic failures and explicit encouragement of AI and advanced analytics. At the same time, FinCEN is retreating from mandatory enhanced due diligence for domestic politically exposed persons, an effectiveness standard arriving amid deregulation and a rollback of beneficial ownership reporting, and AI monitoring tools that silently miss novel risks, make the appearance of compliance easier while making its substance harder to maintain. Volkov closes with practical steps: test programs against the two-prong standard, measure outcomes rather than activity, adopt a risk-based policy for domestic officials, govern and validate AI tools against the institution's own risk profile, and avoid managing to the current enforcement climate.

If a $36 million export violation comes down to whether a loading dock worker grabbed the right box, the problem isn’t the guy on the dock.

BAE Systems just paid $36 million to the State Department for more than 100 export control violations.

Here’s what makes this case worth your attention.

DDTC didn’t find willful evasion. It found something more common and, honestly, scarier: a well-intentioned compliance program that just couldn’t keep up.

GPS technical data sent to China because the file transfer system didn’t flag it, explosive mixture data sent to the UK because an employee thought it was already public, a shipment mix-up where dockworkers grabbed the wrong controlled part off the shelf.

DDTC’s own words: BAE lacked a compliance program that integrated corrective action across the enterprise.

Sounds familiar?

BAE had already done one audit, made improvements, and violations kept happening anyway.

Here’s my takeaway.

Partial fixes after an audit finding don’t close a systematic gap.

If your compliance program relies on individual judgment calls at the warehouse dock or the file transfer stage instead of built-in controls, you have the same exposure BAE just paid $36 million to resolve.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why acquiring a sanctions violation is even riskier than buying an FCPA problem: under programs like Cuba and Iran, U.S. ownership of a foreign target can itself create sanctions jurisdiction on closing day, turning previously lawful foreign business into violations overnight. Drawing on OFAC's 2019 Framework for Compliance Commitments, which calls for compliance involvement in deals and post-closing audit and testing, he walks through enforcement actions including Unicat and White Deer (the first DOJ declination of an acquirer under its M&A policy, even as the target paid millions), Murad and Unilever, Kollmorgen, Stanley Black & Decker, AppliChem and Illinois Tool Works, First Bank and J.C. Flowers, Key Holding, and S&P Global, with Berkshire Hathaway's Iscar Turkey matter as a companion parent-liability case. Volkov closes with a deal playbook: sanctions-specific diligence beyond seller representations, targeted indemnities, day-one written notice to the target, replacing management certifications with real transaction testing, escalating every red flag, and building integration around DOJ's 180-day disclosure and one-year remediation windows.

A pharma CEO just found out the captain doesn’t always go down with the ship. Sometimes the ship stays afloat by handing him to DOJ.

Veloxis Pharmaceuticals just paid over $46 million to resolve a kickback scheme involving its kidney transplant drug, lavish meals, resort stays, payments dressed up as consulting fees paid to doctors and pharmacies to drive prescription demand.

Here’s the part that should stop you.

The deferred prosecution agreement says the company’s own former CEO was directing this.

That’s the kind of fact pattern that usually gets a company prosecuted, not offered a deal, but Veloxis got a deferred prosecution agreement anyway under DOJ’s corporate enforcement policy.

Why?

Because after the conduct came to light, the company disclosed, cooperated, and identified and fired the people responsible, including its own CEO.

The lesson is clear.

Even executive-level misconduct doesn’t actually doom the corporate entity if your response afterward is real.

Disclosure, cooperation, and actually removing the people responsible is exactly the formula DOJ rewards.

Don’t assume C-suite involvement means game over. What you do next is what actually decides the outcome.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why OFAC's 2019 Framework for Compliance Commitments, built on the five pillars of management commitment, risk assessment, internal controls, testing and auditing, and training, remains the essential foundation for any sanctions compliance program, while also walking through the substantial multi-agency guidance that has layered on top of it since 2023 through joint DOJ, BIS, and OFAC "Tri-Seal" compliance notes. He covers four priority updates: the expanding reach of "U.S. nexus" jurisdiction and foreign subsidiary liability, harmonized voluntary self-disclosure expectations under which silence is now treated as an aggravating factor, granular supply chain and "know-your-cargo" evasion detection requirements, and OFAC's extension of its statute of limitations from five to ten years. Volkov closes by mapping these priorities onto concrete program changes, expanding risk assessments to incorporate export control considerations, upgrading internal controls beyond simple name-matching, and rebuilding recordkeeping around the new ten-year lookback window, while cautioning that these updates only work when layered on top of a properly implemented 2019 Framework foundation.

Today’s version of the Trojan horse doesn’t need to sneak past your gate in the dead of night. It’s a software update to something you already let in.

Second preview ahead of tomorrow’s webinar, and this one’s about a blind spot I see constantly.

Most compliance officers think about shadow AI as employees going out and signing up for some random chatbot.

That happens, but the bigger risk right now is AI features quietly embedded inside software you already license and already approved.

Your document platform, your video conferencing tool, your CRM, they’re all rolling out built-in AI features, and nobody experiences turning one on as adopting a new AI tool.

It just feels like clicking a button in software you already trust.

That’s exactly why it slips past your vendor approval process.

An approved product does not mean every feature inside it is approved.

Each AI feature needs its own review, its own data classification, its own yes or no.

Tomorrow’s webinar will walk through exactly how to build a living registry that tracks standalone tools and embedded features separately, so nothing gets a free pass just because it showed up inside something you already trusted.

The Ethics and Compliance Q and A show is produced by One Stone Creative.