Advertise on podcast: Corruption Crime & Compliance

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors, and mishandled business accounts tied to blocked persons. Volkov explains why OFAC gave no penalty reduction for remediation or cooperation, pointing to a narrow initial lookback, piecemeal responses, reckless conduct, and prior cautionary letters, and he outlines what the bank must now do under the FinCEN, OCC, and OFAC resolutions. He closes with eight practical lessons, including prioritizing exact matches, verifying daily watchlist updates, reviewing auto-clear rules, scoping lookbacks to root causes, building a self-disclosure process in advance, and integrating AML and sanctions programs.

If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement. OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes. Four of them should be on your list today. One, U.S. nexus now reaches foreign companies that touch U.S. clearing, U.S. servers, or U.S.-origin components, and parent companies answer for their foreign subsidiaries. Centralize your program. Two, voluntary self-disclosure under BIS rules. Staying silent about a significant violation is now an aggravating factor. Silence is no longer neutral. Three, know your cargo. Watch transshipment through hubs like Hong Kong, Turkey, and the UAE, last-minute shipping changes, and shell companies. And fold export controls into your sanctions risk assessment rather than running them as separate work streams. Four, OFAC’s statute of limitations is now 10 years, not five. If your records retention stops at five, your program has a gap. Don’t replace the 2019 framework. Build on it. The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the more than $1.21 billion in Treasury penalties announced October 13, 2026 against Bank of America, including FinCEN’s $1.2 billion consent order, which credits the OCC’s record $750 million penalty and includes the bank’s admission that it willfully violated the Bank Secrecy Act. Volkov explains how the bank’s homegrown transaction monitoring system, Event Processor, relied on unsupported thresholds, miscalibrated risk weights, and unreviewed suppression rules, and how the bank’s own testing flagged these problems for years while more than $5 billion in suspicious activity went unreported or was reported late. He covers the customer due diligence findings, in which compliance recommended exiting high-risk customers and the business line pushed back, the order’s finding that a senior executive had a test repeated, and the status of DOJ, where no resolution was announced. He closes with seven practical steps for testing thresholds, setting tolerances, governing suppression rules, checking product coverage, and empowering compliance to say no.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC's October 9, 2026 settlement with Pegasus Worldwide Logistics, a small California freight forwarder that agreed to pay $175,015 for apparent violations of counter narcotics sanctions and OFAC reporting obligations. Pegasus arranged the shipment of a $5,950 sugar packet-filling machine from a China-based supplier that had been designated, but had changed its name while keeping the phone number and email address listed on the SDN List, and its late, name-only screening missed the match. Volkov explains how Pegasus then ignored a CBP detention notice naming OFAC and gave an incomplete response to an OFAC subpoena, leading to six separate reporting violations, and he walks through OFAC's aggravating and mitigating factors. He closes with five practical lessons for freight forwarders, brokers, and importers: screen beyond names, screen early, make sure policies are actually executed, treat government notices as escalation events, and take subpoena responses as seriously as the underlying conduct.

Compliance used to count training completions. Today, regulators want proof your program actually works. That shift didn’t happen by accident. Twenty years ago, compliance data meant hotline calls and a training checklist. The numbers were easy to collect and nearly impossible to interpret. A quiet hotline could mean a great culture or a terrified workforce. Then regulators started asking harder questions: Do you track your own data, and do you use it? Privacy laws demanded real-time visibility into how personal data moves. Cyber threats made annual reviews look dangerously slow, so compliance built continuous monitoring, integrated dashboards, and risk indicators that warn you before a problem arrives. Now comes AI, which can spot patterns no human-written rule would catch and compress the time from detection to action from months to hours. And here’s the twist: AI is also the newest risk compliance has to monitor. But AI is only as good as the data discipline underneath it. If you never built integrated systems, clean data, and a habit of using metrics to change behavior, AI will simply automate your blind spots. Build the foundation first. The tools will follow. The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down DOJ Directive 26-12, the October 1, 2026 memorandum in which Assistant Attorney General Colin McDonald sets corporate enforcement policy for the National Fraud Enforcement Division. He explains the Division's four investigative priorities, health care, procurement and government contracts, revenue evasion, and tariff evasion, import and forced labor schemes, and walks through the ten factors prosecutors must weigh heavily in charging decisions, from management knowledge and concealment to duration, number of districts, victim counts, and loss thresholds. Volkov also covers the new central role of the Corporate Enforcement Section, including oversight of compliance with corporate resolutions, and the directive's push to incentivize whistleblowers, even those who participated in the misconduct. He closes with a practical plan: map exposure to the priority areas, test your program against the ten factors, protect records, strengthen internal reporting, and prepare your voluntary self-disclosure process in advance.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the FTC's October 5, 2026 warning letters to 24 of the nation's largest healthcare services companies, which assert that failing to provide timely, accurate, and complete pricing, particularly for scheduled, non-emergency care, can be a deceptive or unfair practice under Section 5 of the FTC Act, and that incomplete disclosures omitting physician or facility fees can mislead patients into believing they have been told the total cost. He highlights the letters' most consequential point, that CMS price transparency rules are only a regulatory floor and provide no safe harbor from FTC liability, and places the action in context alongside tougher CMS enforcement, the No Surprises Act good faith estimate, the FTC's new Healthcare Task Force, and Chairman Ferguson's warning that investigations are already open. Volkov closes with a practical review plan: map every channel where patients receive prices, mystery-shop quotes against final bills, close the professional fee gap, tighten the language of estimates, bring consumer protection into price transparency governance, and document corrective action.

You can buy a company’s assets, its customers, its brand, and guess what? Its sanctions violations. And sometimes the violation doesn’t exist until the day you close. Here’s what I mean. Under a sanctions program like Cuba and Iran, a foreign company owned by a U.S. buyer becomes subject to U.S. sanctions the moment the deal closes. Business that was lawful on Monday can be a violation on Tuesday. That’s what happened at First Bank, whose euro payments to Iranian parties became violations after a U.S. investor bought it. It’s what happened to Key Holding, whose new Colombian subsidiary shipped to Cuba for 19 months because nobody told it the rules had changed. And diligence alone won’t save you. Unicat’s buyer did diligence, missed the problem, disclosed quickly, and earned DOJ’s first declination for an acquirer. Yet the company it bought still paid millions. Stanley Black & Decker found Iran sales in diligence, made them a closing condition to stop, and still got hit because OFAC says no one monitored whether they actually stopped. So before signing and acquiring, ask what becomes illegal the day you own it. On day one, tell the target in writing that U.S. sanctions apply, and after closing, test the transactions yourself. Don’t accept a certification from the people hiding the problem. The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines FinCEN's April 2026 proposal to rebuild the Bank Secrecy Act AML program rule around an effectiveness standard, with a two-prong test requiring that programs be both established (risk-based, built on four core elements, and kept current) and maintained (implemented in all material respects), along with a new enforcement threshold for banks limited to significant or systemic failures and explicit encouragement of AI and advanced analytics. At the same time, FinCEN is retreating from mandatory enhanced due diligence for domestic politically exposed persons, an effectiveness standard arriving amid deregulation and a rollback of beneficial ownership reporting, and AI monitoring tools that silently miss novel risks, make the appearance of compliance easier while making its substance harder to maintain. Volkov closes with practical steps: test programs against the two-prong standard, measure outcomes rather than activity, adopt a risk-based policy for domestic officials, govern and validate AI tools against the institution's own risk profile, and avoid managing to the current enforcement climate.

If a $36 million export violation comes down to whether a loading dock worker grabbed the right box, the problem isn’t the guy on the dock. BAE Systems just paid $36 million to the State Department for more than 100 export control violations. Here’s what makes this case worth your attention. DDTC didn’t find willful evasion. It found something more common and, honestly, scarier: a well-intentioned compliance program that just couldn’t keep up. GPS technical data sent to China because the file transfer system didn’t flag it, explosive mixture data sent to the UK because an employee thought it was already public, a shipment mix-up where dockworkers grabbed the wrong controlled part off the shelf. DDTC’s own words: BAE lacked a compliance program that integrated corrective action across the enterprise. Sounds familiar? BAE had already done one audit, made improvements, and violations kept happening anyway. Here’s my takeaway. Partial fixes after an audit finding don’t close a systematic gap. If your compliance program relies on individual judgment calls at the warehouse dock or the file transfer stage instead of built-in controls, you have the same exposure BAE just paid $36 million to resolve. The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why acquiring a sanctions violation is even riskier than buying an FCPA problem: under programs like Cuba and Iran, U.S. ownership of a foreign target can itself create sanctions jurisdiction on closing day, turning previously lawful foreign business into violations overnight. Drawing on OFAC's 2019 Framework for Compliance Commitments, which calls for compliance involvement in deals and post-closing audit and testing, he walks through enforcement actions including Unicat and White Deer (the first DOJ declination of an acquirer under its M&A policy, even as the target paid millions), Murad and Unilever, Kollmorgen, Stanley Black & Decker, AppliChem and Illinois Tool Works, First Bank and J.C. Flowers, Key Holding, and S&P Global, with Berkshire Hathaway's Iscar Turkey matter as a companion parent-liability case. Volkov closes with a deal playbook: sanctions-specific diligence beyond seller representations, targeted indemnities, day-one written notice to the target, replacing management certifications with real transaction testing, escalating every red flag, and building integration around DOJ's 180-day disclosure and one-year remediation windows.

A pharma CEO just found out the captain doesn’t always go down with the ship. Sometimes the ship stays afloat by handing him to DOJ. Veloxis Pharmaceuticals just paid over $46 million to resolve a kickback scheme involving its kidney transplant drug, lavish meals, resort stays, payments dressed up as consulting fees paid to doctors and pharmacies to drive prescription demand. Here’s the part that should stop you. The deferred prosecution agreement says the company’s own former CEO was directing this. That’s the kind of fact pattern that usually gets a company prosecuted, not offered a deal, but Veloxis got a deferred prosecution agreement anyway under DOJ’s corporate enforcement policy. Why? Because after the conduct came to light, the company disclosed, cooperated, and identified and fired the people responsible, including its own CEO. The lesson is clear. Even executive-level misconduct doesn’t actually doom the corporate entity if your response afterward is real. Disclosure, cooperation, and actually removing the people responsible is exactly the formula DOJ rewards. Don’t assume C-suite involvement means game over. What you do next is what actually decides the outcome. The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why OFAC's 2019 Framework for Compliance Commitments, built on the five pillars of management commitment, risk assessment, internal controls, testing and auditing, and training, remains the essential foundation for any sanctions compliance program, while also walking through the substantial multi-agency guidance that has layered on top of it since 2023 through joint DOJ, BIS, and OFAC "Tri-Seal" compliance notes. He covers four priority updates: the expanding reach of "U.S. nexus" jurisdiction and foreign subsidiary liability, harmonized voluntary self-disclosure expectations under which silence is now treated as an aggravating factor, granular supply chain and "know-your-cargo" evasion detection requirements, and OFAC's extension of its statute of limitations from five to ten years. Volkov closes by mapping these priorities onto concrete program changes, expanding risk assessments to incorporate export control considerations, upgrading internal controls beyond simple name-matching, and rebuilding recordkeeping around the new ten-year lookback window, while cautioning that these updates only work when layered on top of a properly implemented 2019 Framework foundation.

Today’s version of the Trojan horse doesn’t need to sneak past your gate in the dead of night. It’s a software update to something you already let in. Second preview ahead of tomorrow’s webinar, and this one’s about a blind spot I see constantly. Most compliance officers think about shadow AI as employees going out and signing up for some random chatbot. That happens, but the bigger risk right now is AI features quietly embedded inside software you already license and already approved. Your document platform, your video conferencing tool, your CRM, they’re all rolling out built-in AI features, and nobody experiences turning one on as adopting a new AI tool. It just feels like clicking a button in software you already trust. That’s exactly why it slips past your vendor approval process. An approved product does not mean every feature inside it is approved. Each AI feature needs its own review, its own data classification, its own yes or no. Tomorrow’s webinar will walk through exactly how to build a living registry that tracks standalone tools and embedded features separately, so nothing gets a free pass just because it showed up inside something you already trusted. The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov traces the decades-long relationship between compliance and data, from the profession's earliest, checkbox-style attempts to measure program effectiveness through crude proxies like hotline volume and training completion rates, through the rise of continuous monitoring systems, integrated dashboards, and key risk indicators that enabled expedited auditing and near-real-time visibility, and finally to the current AI-driven era, where machine learning and natural language processing can surface subtle risk patterns no human-authored rule would catch and compress the gap between detection and action to hours rather than months. He argues that each phase of this evolution was driven not by strategic foresight but by escalating business, regulatory, and litigation risk, first around proving program effectiveness itself, then data privacy and cybersecurity, and now AI governance, and closes by cautioning that AI monitoring tools will only perform as well as the underlying data infrastructure and discipline a compliance function has already built.