Explore every episode of the podcast Corruption Crime & Compliance

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why standard software procurement templates fail to protect organizations in AI vendor relationships, and what to do about it. He walks through the structural differences that make AI vendors riskier than traditional software vendors, multi-layered data flows through underlying foundation models, frequent model swaps, and vendors' commercial incentive to train on customer data, and identifies the specific gaps legacy contracts leave open: silent or vague data training rights, indemnification that doesn't reach model outputs or training data provenance, missing audit rights, and liability caps that quietly undercut existing protections. The episode closes with a concrete negotiating playbook, including explicit training restrictions, coordinated indemnification and liability provisions, audit rights, subprocessor disclosure, regulatory compliance representations, and guaranteed exit and data deletion rights, along with practical guidance for organizations facing dominant vendors unwilling to negotiate.

Hiring someone to investigate misconduct isn’t always going to save your board. The line between bad management and bad faith just got real.

Here’s a question every board member should be losing sleep over: when does a board’s failure to catch corporate misconduct cross the line from bad management into an actual breach of fiduciary duty?

Delaware just gave us two new answers, and they cut in different directions.

First, Teligent, a pharma company, an FDA compliance meltdown, and a court that let claims proceed against directors and two officers because the complaint showed information and mounting regulatory problems never made it to the people who could act on it.

Second, Regions Financial case. A whistleblower sent the board a complaint about allegedly illegal overdraft fee practices back in 2019.

The board hired an investigator. Good so far, but the company didn’t stop the practices until 2021, and a $191 million CFPB consent order was imposed.

Delaware let the claims proceed here too.

Here’s the lesson from both: escalation isn’t enough. Investigating isn’t enough. The board has to actually understand what it found and actually fix it.

Stay tuned. Tomorrow I’ll tell you about the case that shows the other side of this coin.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down why the EU AI Act has moved from a future planning exercise to an actively enforced regulatory regime, with the European Commission's AI Office holding full investigative and fining authority since August 2026, having already opened its first formal investigations in June 2026 into hiring tools, credit scoring systems, and student monitoring applications. He walks through the Act's fragmented compliance timeline, prohibited practices enforceable since February 2025, general-purpose AI obligations running since August 2025, and live chatbot transparency requirements, alongside the significant deadline relief the Digital Omnibus gave specifically to high-risk AI systems, pushed to December 2027. The episode closes with a clear warning: companies that read the Digital Omnibus as a blanket delay of the entire AI Act are making a costly mistake, since the tracks carrying real, current enforcement exposure, including fines up to 7 percent of global turnover, remain fully active today.

Has OFAC branded your company with the scarlet letter?

Getting removed from the SDN list is possible, but it’s not fast, it’s not easy, and it’s not guaranteed.

The primary path is a petition for administrative reconsideration filed with OFAC, arguing mistaken identity, changed circumstances, or that the original factual basis was simply wrong.

You must prove it with real documented evidence.

OFAC is skeptical of cosmetic restructurings designed to look like change while control remains the same.

Practically, petitions can take many months to over a year, and you’re often arguing against evidence you’ll never fully see, since designations can rest on classified information.

If OFAC denies or ignores your petition, you can challenge it in federal court, but courts defer heavily to the executive on sanctions, so litigation is a last resort, not a strategy.

If you’re designated, get experienced OFAC counsel immediately, do a real internal investigation, build your remediation story, and manage expectations. It takes time.

The best strategy is never needing this. Build a sanctions program rigorous enough that you never end up on the list at all.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines how Delaware's Caremark doctrine has matured through a recent run of decisions involving Teligent, Regions Financial, and Boeing, all centered on the question of when a board's failure to prevent corporate misconduct crosses from ordinary mismanagement into an actual breach of the duty of loyalty. He walks through Teligent's officer-level oversight failures in FDA compliance, Regions Financial's lesson that a whistleblower investigation without genuine follow-through and remediation doesn't satisfy Caremark's good-faith standard, and the pivotal 2026 Boeing dismissal, where extensive board and committee engagement on safety protected directors even after another serious incident. The episode closes with practical guidance for compliance officers on identifying mission-critical risks, building real escalation and follow-up procedures, and documenting board oversight, since Caremark, as these cases confirm, does not demand perfection, only a good-faith effort to oversee the risks that genuinely matter.

Are you rubbing elbows with criminals?

When OFAC designates someone a specially designated national, or SDN, it’s not a warning label. It’s a legal wall.

Every asset that party has anywhere in U.S. jurisdiction, or in the hands of a U.S. person, is frozen. Every U.S. person is barred from transacting with them, directly or indirectly.

The trap is OFAC’s 50% rule, which means any entity owned 50% or more in aggregate by blocked persons is automatically blocked too, even if it never appears on the published list.

A clean name screen doesn’t mean a clean counterparty if you haven’t traced the ownership behind it.

Enforcement is ratcheting up hard right now: Iran-related designations, cartel terrorism, Russia sanctions and evasion networks. The stakes are real - civil penalties in the tens of millions, frozen wires, correspondent banking risk, and secondary sanctions that can cut even non-U.S. companies off from the dollar system entirely.

Sanctions screening can’t be a one-time check-the-box exercise.

You need ongoing, ownership-aware screening that re-screens existing counterparties as the list evolves and actually traces beneficial ownership, not just the name on the contract.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down Veloxis Pharmaceuticals' more than $46 million settlement with DOJ and HHS-OIG over a years-long kickback scheme involving its kidney transplant drug Envarsus XR, a scheme the DPA says was directed in part by the company's own former CEO. He examines why Veloxis avoided prosecution and instead secured a deferred prosecution agreement under DOJ's Corporate Enforcement and Voluntary Self-Disclosure Policy despite executive-level involvement in the misconduct, crediting the company's disclosure, cooperation, and termination of the responsible executives. The episode also unpacks the financial breakdown across civil, criminal, and Sunshine Act penalties, and closes with a detailed look at the structural compliance overhaul required under Veloxis's five-year Corporate Integrity Agreement, including a compliance officer mandated to report independently of legal and finance directly to the CEO and board.

At $125 million, breaking the law can never be a cost of doing business.

UBS Bank was hit with a $125 million FinCEN penalty, the largest ever against a broker-dealer under the Bank Secrecy Act.

This is UBS’s second Bank Secrecy Act action in less than a decade. In 2018, regulators told UBS: fix your foreign currency wire monitoring. It never did.

The same gap stayed open for years, letting more than $10 billion in transactions move through unchecked.

Layered on top, UBS failed to properly vet high-risk customers tied to Russia and Latin America, even after one of its own affiliates raised internal concerns about their sources of wealth.

That warning went nowhere. UBS admitted it acted willfully and intentionally.

Now, what’s the lesson? A prior enforcement action isn’t the end of the story. Regulators check whether you actually fixed what they flagged, and unfixed gaps read as willful the second time.

High-risk geography demands ongoing monitoring, not a one-time onboarding check, and no institution’s size or reputation buys protection.

UBS is one of the most respected private banks in the world, and that bought it nothing here but headaches.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines L3Harris Technologies' abrupt ouster of chairman and CEO Christopher Kubasik over a code-of-conduct violation, and why the story is really a board governance cautionary tale rather than a typical enforcement matter. He traces Kubasik's earlier, similar departure from Lockheed Martin in 2012 alongside comparable cases involving Brian Krzanich at Intel and Mark Hurd at Hewlett-Packard, both of whom went on to lead other companies despite prior conduct violations, to explore why boards keep extending second chances to executives with this kind of history. The episode unpacks the distinction boards draw between personal-conduct issues and conduct that creates genuine enterprise risk, and argues that thorough vetting must translate into a documented, ongoing risk-mitigation plan rather than a one-time pass/fail judgment made during the hiring process, since, as L3Harris just learned, history has a way of repeating itself.

Is your routine payment actually a bribe?

Scolar, an Omaha agricultural company, resolved an FCPA case for over $10 million after using customs brokers to bribe Mexican officials, about $2,000 for each train that crossed the border. It was invoiced as reinspection fees paid routinely for six years.

Nobody asked what the money actually bought.

Stop treating customs brokers, freight forwarders, and logistics providers like ordinary vendors. They interact directly with foreign officials on your behalf, and that makes them high-risk third parties, deserving the same scrutiny as a sales agent or government relations consultant.

Test your recurring fees, your routine fees. Any charge that repeats, described in vague language - reinspection, expediting, special handling - should trigger one question every time: can we prove exactly what the payment was for?

If not, that’s your red flag, regardless of the dollar amount.

Small, consistent, unexplained fees at the border are exactly how bribery hides.

Go look at your own customs and logistics payments this week.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov makes the case that every organization needs a written AI Acceptable Use Policy now, not eventually, because employees are already using AI tools with or without formal governance. He walks through the three core risk categories driving that urgency: confidentiality exposure when employees submit sensitive data to ungoverned tools, hallucination risk from AI-generated content that can be fabricated yet fully convincing, and vendor risk from the multi-layered data relationships that come with adopting a third-party AI product. He then breaks down what a genuinely effective policy needs to include: clear governance ownership, a real (not rubber-stamp) vendor due diligence process reassessed at least annually, data classification tied directly to tool approval, verification requirements built into actual workflows rather than left as aspirational language, and a no-retaliation incident reporting process that surfaces problems early instead of driving them underground.

Have you heard about the Goldman Sachs banker who bribed his way to a conviction?

A federal jury in Brooklyn last week convicted Asante Berko, a former Goldman Sachs executive, on FCPA conspiracy, a substantive FCPA violation, and money laundering conspiracy.

Berko managed a deal between a Turkish energy company and the government of Ghana to build a new power plant in Ghana. To win the bid, he and his co-conspirators paid more than a million dollars in bribes to Ghanaian officials, including a planned payment to the Minister of Power using the code word “Holy Reign” in their communications for the payoffs.

Berko didn’t need an outside fixer. He lied directly to Goldman’s own compliance team and moved his real conversations to a personal email account.

He laundered the money through shell companies, sham invoices, and nominee accounts.

The lesson: your biggest FCPA risk isn’t always the outsider, the third party who hasn’t been vetted. Sometimes it’s the trusted insider lying straight to your compliance function.

Goldman wasn’t charged and cooperated fully, but this shows why verification, not just trust, has to be built into how you vet high-value cross-border deals.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

If you think your company can smuggle and fly under the radar screen, think again.

When your company touches imports, customs, or tariffs, you need to know this.

The Justice Department stood up a dedicated trade fraud task force in August of last year. Its first settlement came three months later.

This past May, it delivered the largest customs-related False Claims Act recovery ever: $550 million from aluminum companies and their warehouses.

A week later, two steel companies paid $19 million for misrepresenting Chinese, Indonesian, Italian, Turkish, and Vietnamese steel as Canadian or American-made.

Underpaying customs duties you legitimately owe is a reverse false claim, meaning it’s a False Claims Act case with triple damages and whistleblowers ready to report you.

As tariffs climb, so does the incentive to misdeclare country of origin, and DOJ now has a dedicated task force and a whistleblower bar ready and good at spotting those situations.

If trade compliance isn’t in your risk assessment right now, fix that immediately.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down the State Department's $36 million settlement with BAE Systems, Inc. over more than 100 alleged violations of the International Traffic in Arms Regulations and Arms Export Control Act spanning 2019 through March 2025, including unlicensed technical data exports to China, Canada, the U.K., and Germany, unauthorized defense services in Italy, France, and Indonesia, and a shipping mix-up that sent a fully controlled engine component to Switzerland in place of a properly licensed part. Despite BAE self-disclosing the vast majority of violations and cooperating fully with DDTC's investigation, avoiding debarment as a result, Volkov highlights the agency's pointed finding that BAE's compliance program lacked the integration to translate earlier corrective actions into lasting fixes, with violations continuing to recur even after a 2021 internal audit prompted real remediation efforts. The episode walks through specific fact patterns showing how insufficient training, high compliance staff turnover, inadequate export management software, and reliance on junior personnel for high-risk judgment calls combined to produce a sprawling pattern of violations, and closes with practical lessons for any export-controlled company: build control warnings directly into operational systems, treat compliance staff turnover as an enterprise risk, route licensing judgment calls to genuinely experienced personnel, extend verification controls all the way to the shipping dock, and ensure remediation after an audit addresses root causes rather than just visible symptoms.

You think you can cheat the government? The False Claims Act says you’ll pay for it three times.

The 2026 False Claims Act mid-year numbers are out, and the story is clear. DOJ isn’t backing down. It’s leaning in.

DOJ is using the FCA (False Claims Act) to drive administration policy priorities. In the first half of this year alone, it notched first-ever settlements in four distinct areas: gender-related care, the Civil Rights Fraud Initiative targeting DEI practices in federal contracting, a Medicare Advantage settlement from the DOJ-HHS Working Group, and trade and customs fraud.

Four new enforcement lanes, all producing real settlements within a year of being announced. Expect sustained activity in all four.

There’s a data story too. Qui tam filings by whistleblowers are surging - nearly 1,300 in fiscal year 2025 - and by data miners, who are now filing more than 45% of whistleblower actions.

DOJ just launched a new initiative to engage with and vet those data miners’ methodology.

Don’t read a quieter news cycle as a quieter DOJ. The FCA is more active than ever, just pointed at new targets.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the compliance risks lurking in ordinary U.S.-Mexico cross-border trade, explaining how the plaza system allows cartels to function as a de facto taxing authority over certain border corridors, extracting piso payments from legitimate commercial shipments that pass through their territory, often through customs brokers and logistics providers who absorb and disguise the cost as routine fees. Drawing on The Scoular Company's FCPA resolution, in which bribes paid to Mexican officials to clear failed agricultural inspections were later found to have partly benefited a border cartel without the company's knowledge, Volkov explains how the government's designation of major cartels as Foreign Terrorist Organizations has activated material support liability under the Anti-Terrorism Act, exposing companies to cartel-related risk regardless of intent or awareness. He closes with a practical compliance roadmap: reclassifying customs brokers and logistics providers as high-risk third parties, sharpening due diligence beyond standard sanctions screening, testing the substance behind every recurring border-related payment, building and actually enforcing audit rights, giving compliance real visibility into operational payment data, and breaking down the silos between sanctions, anti-money laundering, and anti-corruption teams so that cartel-linked risk doesn't fall through the cracks between them.

When using AI in your internal investigation, make sure you protect the attorney-client privilege.

A lot of investigators are feeding interview notes, documents, even witness statements into AI tools to help organize an investigation.

That’s convenient, for sure, but ask yourself: where does that data go? Is that platform actually covered by your privilege log? Did outside counsel direct that use, or did an investigator just start using a public AI tool because it was faster?

You wouldn’t just hand out your interview notes to third parties who are not under privilege. That’s what AI can do, unbeknownst to you.

If the answer is unclear, you may have just created a discoverable record that sits outside the protection of attorney-client privilege or work product doctrine.

Opposing counsel or a regulator can ask what tools you used, what prompts you entered, and what the AI generated.

If that trail wasn’t properly walled off under privileged attorney-client use, you may have to produce it.

And there’s a second failure mode: shadow AI. Investigators using unapproved tools on their own, without telling anyone, to save time.

You won’t find out until it surfaces in a document request.

My advice: before your next investigation starts, define exactly which AI tools are approved, who directs their use, and how that use is documented and protected.

Get ahead of it, because opposing counsel is already asking the question.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why forced labor compliance has shifted from a sustainability afterthought into a direct financial and operational threat. He walks through the U.S. Trade Representative's new two-tier Section 301 tariff structure targeting 60 trading partner economies over forced labor practices, the rebuttable presumption under the Uyghur Forced Labor Prevention Act that can freeze finished goods at the border over a single noncompliant sub-tier component, illustrated by a real case where thousands of finished luxury vehicles were impounded because of one blacklisted electronic part, and the EU's forthcoming forced labor regulation, which will allow European authorities to block imports, pull products from shelves, and order their disposal starting in late 2027. Volkov argues that these overlapping pressures require companies to abandon simplistic, country-based risk scoring in favor of a residual-risk approach that accounts for how mature and verifiable a supplier's actual labor controls are, and he outlines the specific warning signs of coercion, debt bondage, document confiscation, wage manipulation, forced overtime, and deceptive subcontracting, that a credible due diligence program must be trained to detect. The episode closes with a practical call to action: build an honest baseline of where supply chain risk is concentrated today and use it to prioritize a due diligence program capable of producing real evidence, not just policy documents, before regulators or customs officials come asking.

When you’re conducting an internal investigation and using AI as a tool, you’re risking the use of a shifty informant.

Let’s talk about a risk that I’m seeing firsthand in internal investigations: AI hallucination.

I use AI in my own practice, and I got scared very quickly because it cited cases that don’t exist. It cited them confidently, persuasively, like it was reading straight off a court docket. It wasn’t.

Now imagine that inside an internal investigation. You’re using an AI tool to summarise witness interviews, to search a document universe, to draft findings for audit committees.

If that tool fabricates a fact, misattributes a quote, or invents a document that was never produced and nobody catches it, that error doesn’t stay contained.

It becomes your investigative record. It becomes the basis for a disciplinary decision, a self-disclosure to a regulator, maybe even a certification to the government that your findings are accurate.

Here’s the rule I put in place today: every AI-assisted output in an investigation gets independently verified against the underlying source material.

Not spot-checked. Verified.

Because the day you rely on an AI summary you never checked is the day that your investigation’s credibility, and maybe your own, is on the line.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

On the Corruption, Crime and Compliance podcast, host Mike interviews Severin Wirtz, an in-house compliance lawyer (now at a semiconductor company, formerly at Trace International and a law firm where he cut his teeth on the Bonny Island FCPA case) about his new book, Bribery Beyond Borders, a history of the Foreign Corrupt Practices Act that took him nearly fifteen years to research and write. Wirtz argues the FCPA is usually reduced to a footnote of Watergate, when in fact it emerged from decades of prior anti-bribery legal tradition, Cold War fears that corrupt American multinationals (like ITT in Chile) were undermining democracy and fueling Soviet propaganda, and a narrow, contingent political path through Congress — driven by figures like Senator Frank Church, SEC enforcement chief Stanley Sporkin (who leaked findings to Congress after being blocked by Kissinger's State Department), and later William Proxmire, with Ford and even Carter only lukewarm supporters until the "Watergate babies" swept into Congress. The conversation moves to today's landscape: the Trump administration's 2025 pause on FCPA enforcement, the DOJ's new "national interest" enforcement standard, debate over prosecuting foreign officials who receive bribes (Wirtz is wary of the precedent), the emerging cartel-linked corruption cases like the Mexican Vitol/Scolar-type matter, and Wirtz's view that the statute is at an "inflection point" moving from a post-Cold War globalist rationale toward a new argument centered on fair competition and America's geopolitical brand versus China. Both agree corruption concerns are cyclical and likely to resurface domestically before circling back to FCPA enforcement. The book is available through Corporate Compliance Insights (publisher) and major retailers.

If you’re looking at the Justice Department and only at FCPA cases, you’re looking in the wrong place.

Everyone’s talking about the DOJ going soft on corporate crime. I want to push back on that narrative because I think it’s incomplete and, honestly, a little dangerous if compliance officers believe it.

Yes, traditional FCPA and bribery prosecutions have slowed. But look at where the resources are actually going.

Trade enforcement is exploding. Sanctions enforcement is aggressive and getting more aggressive by the month.

And here’s the one that should really get your attention: the False Claims Act is now being used against companies for tariff circumvention and customs fraud, with qui tam relators and lawyers lining up to bring those cases.

This isn’t a retreat. It’s a reallocation.

DOJ has simply moved its firepower to where the current priorities sit: national security, trade, tariffs, sanctions, and export controls.

If your compliance program is still built around FCPA risk and you haven’t retooled for trade and sanctions exposure, you are exposed right now, today.

Update your risk assessment. This is not the moment to stand down.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov sits down with Christian Focacci, founder of Threat Digital, for their annual check-in on AI's evolving role in due diligence and compliance. Focacci traces how AI adoption has matured from early hype and generic chatbot rollouts to more disciplined, use-case-specific tooling, while cautioning that the underlying models still hallucinate and should never be treated as an authoritative source rather than a reviewer of externally cited, verifiable information. The conversation covers the widespread problem of "shadow AI" use inside organizations without governance, the risks of letting AI creep into discretionary decision-making without human accountability, and emerging third-party risk questions as companies must now vet how vendors themselves are using AI. Volkov and Focacci also discuss the rapid rise of open-weight Chinese models, the regulatory patchwork forming at the state level (particularly around HR uses of AI), and the risk of regulatory capture favoring large AI incumbents over smaller innovators. The episode closes on a balanced note: AI is genuinely valuable for processing large data sets, triaging sanctions alerts, and boosting productivity, but only when paired with rigorous human oversight, clear documentation, and citations traceable back to verifiable source material.

Everyone’s talking about the DOJ going soft on crime.

I want to push back on that narrative because I think it’s incomplete and, honestly, a little dangerous if compliance officers believe it.

Yes, traditional FCPA and bribery prosecutions have slowed, but look at where the resources actually went. Trade enforcement is exploding. Sanctions enforcement is aggressive and getting more aggressive by the month.

And here’s the one that should really get your attention: the False Claims Act is now being used aggressively against companies for tariff circumvention and customs fraud, with qui tam relators lining up to bring those cases.

This isn’t a retreat. It’s a reallocation.

DOJ has simply moved its firepower to where the current priorities sit: trade, tariffs, sanctions, export controls, and national security.

If your compliance program is still built entirely around FCPA risk and you haven’t retooled for trade and sanctions exposure, you are exposed right now, today.

Update your risk assessment. This is not the moment to stand down.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down the Justice Department's $10.2 million foreign bribery resolution with The Scoular Company, an Omaha-based agricultural supply chain company that used customs brokers to pay more than $400,000 in bribes to Mexican officials over six years so that contaminated grain shipments could cross the U.S.-Mexico border despite failed inspections. Volkov walks through the mechanics of the scheme, a strikingly simple pattern of $2,000 per-train payments disguised on invoices as "reinspection fees," and explains why DOJ treated the case as an aggravated national security matter after determining that some of the bribe money ultimately reached individuals tied to a border cartel, even though Scoular itself had no knowledge of that connection. The episode also unpacks how DOJ applied its Corporate Enforcement and Voluntary Self-Disclosure Policy to the resolution, distinguishing between the voluntary disclosure credit Scoular did not earn and the cooperation and remediation credit it did, resulting in a three-year deferred prosecution agreement, a 25 percent reduction off the bottom of the sentencing guidelines, and no independent monitor. Volkov closes with practical takeaways for compliance officers on managing customs brokers as high-risk third parties, testing the substance behind recurring payments, and moving quickly on voluntary disclosure decisions once potential misconduct surfaces internally.

When it comes to DOJ enforcement, the pendulum swings, and it always returns. Don’t let it knock you off your feet.

I’ve been watching the headlines, and so have you. Fewer corporate guilty pleas, non-prosecution agreements for Alibaba and Eagle Bank, charges dropped against Boeing and Halkbank from Turkey.

The word from Main Justice is: hold individuals accountable, go easier on companies. I get why some executives are breathing a sigh of relief.

But here’s my message to every compliance officer out there: do not read this as permission to relax.

Enforcement priorities are cyclical. Administrations change. Statutes of limitations run long. The conduct you tolerate today under a lenient DOJ can absolutely come back across your desk in the future, with a lookback period that reaches right back to right now.

And let’s not forget: non-prosecution agreements still require admissions, still require massive fines, and still require you to fix your program. They’re not a free pass. That’s a warning shot.

Stay vigilant. Keep building your program like the next administration is already watching, because eventually it will be.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this update episode of Corruption, Crime and Compliance, Michael Volkov speaks with Erica Hanichak of the FACT Coalition and Frank Russo of Modern Fortis about the current fight over the Corporate Transparency Act, the 2021 law requiring companies to report their beneficial owners to a secure Treasury Department database in order to close off the U.S.'s longstanding status as an easy jurisdiction for setting up anonymous shell companies used in money laundering, human trafficking, and fraud. Hanichak and Russo describe how the law's implementation has faced litigation and a legislative repeal push that narrowly cleared the House Financial Services Committee despite broad, bipartisan, cross-sector opposition from law enforcement groups, financial institutions, and anti-trafficking organizations, all of whom view beneficial ownership data as a foundational tool for tracing who truly finances and benefits from organized criminal networks. The conversation also flags the administration's forthcoming final rule, which reportedly would exempt more than 99.98% of the entities Congress originally intended to cover, and closes with a direct call for the compliance community to engage with lawmakers to preserve and strengthen, rather than gut, the beneficial ownership reporting framework that due diligence programs increasingly depend on.

Is your compliance program being demoted?

Let’s talk about something that should worry every compliance officer. The stature of the profession is slipping.

For years, the trend line was clear. Compliance officers moved out from under the general counsel, got direct lines of reporting to the CEO, and direct lines to the board.

That mattered. It wasn’t just symbolic. It meant compliance had real influence before decisions got made, not after.

Now look at the data. The latest Compliance Week survey found reporting lines are sliding back toward legal. Fewer CCOs sitting with the board, fewer with a direct line to the CEO, and compliance officers are telling us off the record that they feel pushed to the side.

Here’s my worry. When you add a layer between compliance and leadership, you’re sending a message to your employees, to your regulators, to the market about how much this function actually matters to you.

Don’t let that message be sent on your watch. Fight for your seat. Your organization needs it more than ever.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Michael Volkov examines a troubling backslide in corporate governance: the quiet movement of chief compliance officers back under the general counsel after years of progress toward direct CEO reporting lines. Michael explains why the CCO's reporting structure is the single clearest signal a company sends about the value it places on compliance — shaping whether compliance influences business strategy at the design stage or is reduced to an after-the-fact cleanup function. He makes the case for a direct CCO reporting line to the CEO paired with a formal dotted line to the audit committee, including guaranteed executive sessions and unrestricted escalation authority, and warns that subordinating compliance to legal fosters a "mere compliance" mindset — meeting minimum legal requirements rather than building an ethical culture that drives employee retention, customer trust, and long-term business success. Michael closes with concrete action items for boards and compliance leaders, reminding listeners that regulators scrutinize CCO empowerment and that demoting compliance to save a line item is like canceling insurance to improve quarterly cash flow.

In the compliance world, no news is not good news.

Let me ask you a question every CCO should be asking right now: Are your employees actually reporting and using your hotline to report legitimate concerns?

Too many compliance officers look at a quiet hotline and breathe a sigh of relief. No calls, no complaints. Must mean everything’s fine.

I’m here to tell you that’s backward. A silent speak-up line isn’t good news. It’s a red flag.

Here’s why: misconduct doesn’t disappear just because nobody’s reporting it. What disappears is trust. Trust that raising an issue will be taken seriously. Trust that there’s no retaliation waiting on the other side.

When that trust is gone, people don’t stop seeing problems. They just stop telling you about them, and that’s exactly when whistleblower risk goes up, not down, because the next person who sees something is going straight to the regulator instead of you.

So benchmark your reporting volume against your industry. Look at your trends over time. If your numbers are flat or falling while everyone around you is seeing increases, don’t celebrate. Investigate.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Michael Volkov examines how artificial intelligence is transforming internal investigations — and what the Justice Department now expects from companies navigating this new landscape. Michael breaks down DOJ's updated Evaluation of Corporate Compliance Programs, which directs prosecutors to scrutinize how companies assess AI risks, whether compliance functions have adequate access to data and analytics resources, and what controls prevent the reckless misuse of new technologies. He then walks through the five most dangerous failure modes when AI meets internal investigations — hallucinated witness summaries, missed hot documents, privilege waiver through third-party AI tools, discoverable prompt trails, and investigator overreliance — before turning to the emerging frontier: investigations where AI itself is the subject, including employee AI misuse, deepfake and synthetic evidence, and the growing class of AI whistleblowers protected under SOX and Dodd-Frank. Michael closes with six concrete action items for building an AI-ready investigation protocol that will withstand regulatory scrutiny.

The root of every strong compliance program is a strong culture.

I say this on every episode, and I’m going to keep saying it. Culture is the single most important control that your compliance program builds. It’s at the heart of every compliance program—not the policy binder, not the training module. Culture.

Here’s what the research really shows: companies with strong ethical cultures perform better financially. They’re more sustainable because employees believe in the mission. They don’t cut corners when nobody’s watching. And employee engagement and satisfaction go up—way up—when people trust that their company will do the right thing, even under pressure.

Think about what this means practically: lower turnover, higher productivity, fewer whistleblower complaints turning into full-blown investigations because people raise issues early instead of burying them.

That’s the ethics premium, and it’s real.

So, if you’re a CCO fighting for budget, stop pitching compliance as a cost center. Pitch it as what it really is: the thing that makes your business more successful, more sustainable, and a place people actually want to work.

Culture isn’t a soft metric. It’s your bottom line.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov talks with Aaron Nicodemus, editor-in-chief of Compliance Week, about the state of the compliance profession and the findings of Compliance Week's latest "Inside the Mind of the CCO" survey. They discuss a troubling reversal in reporting lines, with more compliance officers now reporting through general counsel rather than directly to CEOs or boards after several years of progress toward greater independence, and what that structural shift signals about how seriously organizations value the function amid shifting political winds and uneven federal enforcement priorities. The conversation turns to artificial intelligence as both the defining opportunity and risk of the moment: survey data shows AI use across organizations has jumped to roughly 85%, yet a significant share of compliance officers report no governance plan is in place, leaving gaps around data privacy, algorithmic decision-making, hallucinated outputs, and "shadow AI" used by employees and third-party vendors alike. Nicodemus and Volkov agree that compliance is uniquely positioned to build the guardrails that let organizations use AI productively rather than recklessly, and they close by identifying data privacy, third-party risk management, and responsible AI adoption as the three pillars compliance officers should be watching most closely in the years ahead.

Some third parties create real legal risks.

Other third parties create reputational risk.

Not all third parties are the same.

One of the most important concepts in modern third-party risk management is distinguishing between acting vendors and incidental vendors.

An acting vendor performs services on your behalf.

Think customer service providers, recruiters, customs brokers, distributors, and payment processors.

When these vendors use AI or engage in misconduct, liability flows to your company.

Incidental vendors present a different risk profile.

Their primary exposure may be reputational rather than direct legal liability.

This distinction is critical and allows companies to focus their resources where they matter most when it comes to mitigating risk.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov sits down with Dan Greenberg, founder of Greenberg Corporate Intelligence, to unpack how due diligence and corporate investigations have evolved over Dan's fifteen-plus years in the field. They cover the uneven state of corporate transparency worldwide, from the UK's Companies House registry to persistent secrecy havens in the BVI, Cayman Islands, and even certain U.S. states, and discuss how generative AI now lets fraudsters build convincing fake websites, executive bios, and LinkedIn profiles with minimal effort, raising the bar for investigators who must verify rather than trust what they find online. Dan walks through his three-bucket approach to gathering intelligence (traditional public records, advanced open-source and social media analysis, and human sources), and the conversation turns to the unique challenges of investigating counterparties tied to China and Russia, where nuance and thoroughness are essential to avoid overbroad assumptions. The episode closes on a practical note for compliance professionals: as supply chain, sanctions, trade, cybersecurity, and AI-vendor risks pile onto traditional FCPA-driven due diligence, resolving red flags and documenting the process remain the non-negotiable foundations of an effective program.

When it comes to foreign bribery, borders provide no protection.

The European Union just approved one of the most significant anti-corruption initiatives in decades, and multinational companies have to pay attention.

The EU's Anti-Corruption Directive is designed to harmonize anti-corruption enforcement across the member states.

It expands corruption offenses, strengthens enforcement tools, and increases accountability for both individuals and organizations.

Companies operating in Europe can expect greater scrutiny of gifts, hospitality, conflicts of interest, influence peddling, and bribery schemes.

The overall message is clear.

Europe is moving toward a more aggressive and coordinated anti-corruption enforcement system.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

How many red flags is your company missing?

We've seen this pattern repeatedly.

A third-party red flag appears.

No one knows who owns the escalation process.

Business pressure overrides compliance concerns.

Documentation is incomplete. Monitoring never occurs.

When the regulators arrive, the company can't demonstrate effective oversight.

The problem is not simply the underlying misconduct.

The problem is the inability to prove that the company exercised reasonable oversight.

Enforcement agencies punish misconduct, but they often punish weak governance even more.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Government corruption is often viewed as a political problem, but its consequences extend far beyond government institutions. Corruption distorts economies, undermines democratic legitimacy, destroys public trust, and weakens the social fabric upon which civil society depends. In this episode, Michael Volkov explores the full impact of corruption across economic, political, and social dimensions and explains why anti-corruption compliance efforts represent far more than regulatory risk management. They are essential tools in defending the institutions and values that support free markets, democracy, and the rule of law.

If your third-party risk management program uses annual questionnaires and spreadsheets, your program is already obsolete.

The third-party risk environment has fundamentally changed.

It used to focus on financial stability, insurance, and basic due diligence.

Today, your vendors create exposures to AI risks, cybersecurity threats, sanctions violations, privacy failures, supply chain disruptions, and regulatory enforcement.

Regulators are no longer asking whether you have a third-party risk program.

They're asking whether your program actually works.

Annual reviews are no longer enough.

Risks change daily.

Vendors deploy new AI tools. Ownership changes. Sanctions risks emerge overnight.

The future belongs to those companies that embrace continuous monitoring, automated screening, and dynamic risk management.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) and the UK's Office of Financial Sanctions Implementation (OFSI) recently issued joint guidance comparing their respective sanctions regimes. While the document provides a useful overview of similarities and differences, it also sends a much broader message: international sanctions enforcement is becoming increasingly coordinated. In this episode, Michael Volkov examines why multinational companies should move beyond country-by-country compliance programs and build integrated, enterprise-wide sanctions compliance frameworks. He discusses key differences involving ownership and control, reporting obligations, voluntary disclosures, and strict liability standards, while offering practical recommendations for strengthening global sanctions compliance. As always, the discussion emphasizes practical solutions, ethical leadership, and building compliance programs that work in the real world—because effective compliance is more than following rules; it's earning trust and protecting enterprise value.

Many companies carefully review each and every vendor.

Almost none review their vendor's vendor.

This creates one of the biggest blind spots in modern risk management.

Your payroll vendor may use a third-party AI provider.

Your software company may rely on multiple subcontractors.

Your logistics provider may depend on dozens of suppliers across the globe.

Every one of these relationships creates additional risk.

Cybercriminals are exploiting fourth-party relationships to gain access to enterprise systems.

Regulators are paying attention as well.

You need to turn your attention to your vendors' vendors.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Bosch agreed to pay more than $43 million in penalties and disgorgement for illegally exporting products and software to Huawei in violation of U.S. export control laws, while simultaneously receiving the first declination issued under DOJ's revised National Security Division Corporate Enforcement Policy. In this episode, Michael Volkov examines the enforcement action, the compliance failures that led Bosch to misunderstand and misapply the Foreign Direct Product Rule, the warning signs the company failed to recognize, and the lessons organizations can learn about export controls compliance, compliance staffing, escalation procedures, and risk management. The episode also highlights the significant benefits of voluntary self-disclosure, cooperation, and remediation in reducing criminal enforcement risk in today's increasingly aggressive national security enforcement environment.

When it comes to third-party vendors, what you don't know is hurting you.

Third parties rely on AI for customer service, recruiting, compliance screening, marketing, and decision making.

But when a third party uses AI, your organization is on the hook for legal, regulatory, contractual, and reputational risks.

Organizations need to understand which third parties use AI, what tools they use, what data is being shared, what controls exist, and who is responsible when something inevitably goes wrong.

Third-party AI governance is a critical component of vendor management.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

This episode examines OFAC’s new Iran General License X and why it may represent one of the most significant Iran sanctions developments in years. Michael Volkov explains what the license authorizes, why it matters amid ongoing diplomatic negotiations, and why companies should not mistake temporary sanctions relief for a permanent policy shift. The episode highlights practical compliance steps, including careful transaction analysis, documentation, due diligence, screening updates, and close monitoring before the license expires. As always, the focus is on practical, risk-based compliance: helping companies identify legitimate business opportunities while protecting ethics, integrity, and trust.

Not all sanctions violations are willful.

Some companies just don't know any better.

An effective trade compliance program needs three critical elements.

First, in addition to the two we spoke about in the last episode, organizations and companies have to monitor transactions, shipping documents, vessels, payment flows, and escalation of red flags.

Employee training is critical.

OFAC's compliance framework specifically identifies training as a core compliance expectation.

And finally, organizations need to monitor, audit, and test whether their controls are actually working.

A compliance program that is never tested is simply operating on assumptions.

The best trade compliance programs don't just detect violations, they prevent them.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Artificial intelligence has created one of the most significant governance challenges organizations have faced in decades. Business leaders are under intense pressure to deploy AI quickly, while legal and compliance teams are warning about mounting regulatory, legal, operational, and reputational risks. In this episode, Michael Volkov explains why both sides are right, identifies the most dangerous AI governance gaps emerging across organizations today, and outlines a practical roadmap for responsible AI adoption. The message is clear: the companies that will succeed in the AI era will not be those that move fastest—they will be those that build sustainable AI programs grounded in governance, accountability, and trust.

Most companies think they have a handle on AI. Most don't.

Compliance attorney Michael Volkov has sat across the table from Fortune 500 compliance teams, major law firms, and Berkshire Hathaway subsidiaries — and what he keeps finding is "shadow AI": people using AI at work that leadership has no idea about. In this conversation with host Collin McKee, he breaks down where the real legal risk lives, how to protect your business, and why the smart move isn't to slow down — it's to deploy AI the right way.

We get into:

"Shadow AI" — why your team is already using it and what it exposes you to

The vendor due-diligence checklist before you sign with any AI provider

Why AI hallucinations are a liability you can be sued over

HR, hiring bias, and high-risk algorithmic decisions

Writing an AI acceptable-use policy that protects you without slowing you down

The EU AI Act, litigation risk, and AI insurance

Why you won't be replaced by AI — but by people who know how to use it

A practical playbook for any business adopting AI, especially law firms and regulated industries.

Chapters

0:00 Why most companies don't actually have a handle on AI

0:38 The CEO email that shows how NOT to deploy AI

4:09 Shadow AI: a Fortune 100 example

6:42 The real risk — hiring, HR & algorithmic decisions

9:34 Why AI hallucinations are a legal liability

10:03 The vendor due-diligence checklist before you sign

12:50 Why companies still won't write an AI use policy

16:24 The "double-checking wastes my time" trap

18:39 The EU AI Act, litigation & AI insurance

19:27 What small & mid-size businesses actually need

23:39 You won't be replaced by AI — but by people who use it

26:19 AI as a force multiplier, not a headcount cut

28:04 Where to find Michael Volkov

About the guest — Michael Volkov

Compliance attorney and AI governance expert. Founder of The Volkov Law Group.

YouTube:    / @volkovlawtv  

Blog & podcast (Corruption, Crime & Compliance): https://blog.volkovlaw.com/

LinkedIn:   / michael-volkov-9716b45  

About Endeavor's AI

If this episode hit home and your company needs help with implementation, automations, workflows, and the AI infrastructure to do this right — that's what we do.

Website: https://www.endeavorsai.com/

Book a 30-min call: https://calendly.com/collin-endeavors...

Instagram:   / endeavorsai  

LinkedIn:   / endeavors-ai  

Michael Volkov delivers the operational compliance program guidance companies must implement to execute safely within OFAC's new Venezuela general license framework, structured around five program pillars: transaction scoping with mandatory lifecycle revalidation at each critical deal stage; beneficial ownership-based counterparty due diligence that goes beyond standard SDN screening to identify Russia, Iran, Cuba, North Korea, and PRC-connected ownership structures; contract review and modification to incorporate mandatory U.S. governing law provisions, sanctions representations, FGDF payment mechanics clauses, and robust termination rights; pre-built Foreign Government Deposit Fund payment procedures requiring documented legal and compliance approval, a standardized State Department submission package, and advance coordination before payment deadlines arrive; and a transaction-specific reporting compliance program with calendar-tracked deadlines under GL 52, GL 46B, and GL 51B. Michael concludes that the new Venezuela framework creates genuine commercial opportunity but demands purpose-built compliance architecture—companies that proceed without it are not operating within the authorization.

What separates effective trade compliance programs from ineffective ones?

It starts at the top.

Good, bad, or ugly, it all trickles down from the top.

Here are the five keys to an effective trade compliance program.

The first two are building blocks for leadership and due diligence.

First, senior executives and boards must actively support trade compliance.

Without leadership engagement, compliance programs become check-the-box exercises.

Second, organizations need robust screening and due diligence processes.

This includes customers, distributors, suppliers, beneficial owners, intermediaries, and other third parties.

Trade compliance failures often begin with poor due diligence.

Strong leadership and strong due diligence create the foundation for every trade compliance program.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Are your employees whispering corporate secrets into the greedy ears of public-facing AI?

Many organizations have no visibility into how their employees are using AI.

The solution is not to ban AI.

The solution is AI governance.

Organizations need approved AI tools, acceptable use policies, employee training, and ongoing monitoring.

The question is no longer whether your employees are using AI.

The question is whether you know how they are using it.

AI risk is no longer a future issue. It is a governance challenge happening right now.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

Michael Volkov examines OFAC's new Venezuela general license framework—including General License 52, General License 46B, and the newly effective General License 51B covering Venezuelan-origin minerals—analyzing how these authorizations create conditional pathways for otherwise-prohibited energy and minerals transactions while preserving the underlying blocking regime applicable to PdVSA and the Government of Venezuela. Michael explains the established U.S. entity eligibility requirement, the mandatory contractual conditions requiring U.S. governing law and U.S. dispute resolution in agreements with Venezuelan governmental counterparties, and the critical jurisdictional restrictions excluding transactions with Russia, Iran, Cuba, North Korea, and China-connected entities. The episode provides a detailed operational breakdown of the Foreign Government Deposit Fund payment mechanism established under Executive Order 14373—including the DepositorInquiries@state.gov submission process and documentary requirements—and concludes with an analysis of the multi-agency reporting obligations triggered under each applicable authorization.