Corruption Crime & Compliance

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors, and mishandled business accounts tied to blocked persons. Volkov explains why OFAC gave no penalty reduction for remediation or cooperation, pointing to a narrow initial lookback, piecemeal responses, reckless conduct, and prior cautionary letters, and he outlines what the bank must now do under the FinCEN, OCC, and OFAC resolutions. He closes with eight practical lessons, including prioritizing exact matches, verifying daily watchlist updates, reviewing auto-clear rules, scoping lookbacks to root causes, building a self-disclosure process in advance, and integrating AML and sanctions programs.

If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement.

OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes.

Four of them should be on your list today.

One, U.S. nexus now reaches foreign companies that touch U.S. clearing, U.S. servers, or U.S.-origin components, and parent companies answer for their foreign subsidiaries. Centralize your program.

Two, voluntary self-disclosure under BIS rules. Staying silent about a significant violation is now an aggravating factor. Silence is no longer neutral.

Three, know your cargo. Watch transshipment through hubs like Hong Kong, Turkey, and the UAE, last-minute shipping changes, and shell companies.

And fold export controls into your sanctions risk assessment rather than running them as separate work streams.

Four, OFAC’s statute of limitations is now 10 years, not five. If your records retention stops at five, your program has a gap.

Don’t replace the 2019 framework. Build on it.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the more than $1.21 billion in Treasury penalties announced October 13, 2026 against Bank of America, including FinCEN’s $1.2 billion consent order, which credits the OCC’s record $750 million penalty and includes the bank’s admission that it willfully violated the Bank Secrecy Act. Volkov explains how the bank’s homegrown transaction monitoring system, Event Processor, relied on unsupported thresholds, miscalibrated risk weights, and unreviewed suppression rules, and how the bank’s own testing flagged these problems for years while more than $5 billion in suspicious activity went unreported or was reported late. He covers the customer due diligence findings, in which compliance recommended exiting high-risk customers and the business line pushed back, the order’s finding that a senior executive had a test repeated, and the status of DOJ, where no resolution was announced. He closes with seven practical steps for testing thresholds, setting tolerances, governing suppression rules, checking product coverage, and empowering compliance to say no.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC's October 9, 2026 settlement with Pegasus Worldwide Logistics, a small California freight forwarder that agreed to pay $175,015 for apparent violations of counter narcotics sanctions and OFAC reporting obligations. Pegasus arranged the shipment of a $5,950 sugar packet-filling machine from a China-based supplier that had been designated, but had changed its name while keeping the phone number and email address listed on the SDN List, and its late, name-only screening missed the match. Volkov explains how Pegasus then ignored a CBP detention notice naming OFAC and gave an incomplete response to an OFAC subpoena, leading to six separate reporting violations, and he walks through OFAC's aggravating and mitigating factors. He closes with five practical lessons for freight forwarders, brokers, and importers: screen beyond names, screen early, make sure policies are actually executed, treat government notices as escalation events, and take subpoena responses as seriously as the underlying conduct.

Compliance used to count training completions. Today, regulators want proof your program actually works.

That shift didn’t happen by accident.

Twenty years ago, compliance data meant hotline calls and a training checklist. The numbers were easy to collect and nearly impossible to interpret.

A quiet hotline could mean a great culture or a terrified workforce.

Then regulators started asking harder questions: Do you track your own data, and do you use it?

Privacy laws demanded real-time visibility into how personal data moves. Cyber threats made annual reviews look dangerously slow, so compliance built continuous monitoring, integrated dashboards, and risk indicators that warn you before a problem arrives.

Now comes AI, which can spot patterns no human-written rule would catch and compress the time from detection to action from months to hours.

And here’s the twist: AI is also the newest risk compliance has to monitor.

But AI is only as good as the data discipline underneath it.

If you never built integrated systems, clean data, and a habit of using metrics to change behavior, AI will simply automate your blind spots.

Build the foundation first. The tools will follow.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down DOJ Directive 26-12, the October 1, 2026 memorandum in which Assistant Attorney General Colin McDonald sets corporate enforcement policy for the National Fraud Enforcement Division. He explains the Division's four investigative priorities, health care, procurement and government contracts, revenue evasion, and tariff evasion, import and forced labor schemes, and walks through the ten factors prosecutors must weigh heavily in charging decisions, from management knowledge and concealment to duration, number of districts, victim counts, and loss thresholds. Volkov also covers the new central role of the Corporate Enforcement Section, including oversight of compliance with corporate resolutions, and the directive's push to incentivize whistleblowers, even those who participated in the misconduct. He closes with a practical plan: map exposure to the priority areas, test your program against the ten factors, protect records, strengthen internal reporting, and prepare your voluntary self-disclosure process in advance.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the FTC's October 5, 2026 warning letters to 24 of the nation's largest healthcare services companies, which assert that failing to provide timely, accurate, and complete pricing, particularly for scheduled, non-emergency care, can be a deceptive or unfair practice under Section 5 of the FTC Act, and that incomplete disclosures omitting physician or facility fees can mislead patients into believing they have been told the total cost. He highlights the letters' most consequential point, that CMS price transparency rules are only a regulatory floor and provide no safe harbor from FTC liability, and places the action in context alongside tougher CMS enforcement, the No Surprises Act good faith estimate, the FTC's new Healthcare Task Force, and Chairman Ferguson's warning that investigations are already open. Volkov closes with a practical review plan: map every channel where patients receive prices, mystery-shop quotes against final bills, close the professional fee gap, tighten the language of estimates, bring consumer protection into price transparency governance, and document corrective action.

You can buy a company’s assets, its customers, its brand, and guess what? Its sanctions violations. And sometimes the violation doesn’t exist until the day you close.

Here’s what I mean.

Under a sanctions program like Cuba and Iran, a foreign company owned by a U.S. buyer becomes subject to U.S. sanctions the moment the deal closes.

Business that was lawful on Monday can be a violation on Tuesday.

That’s what happened at First Bank, whose euro payments to Iranian parties became violations after a U.S. investor bought it.

It’s what happened to Key Holding, whose new Colombian subsidiary shipped to Cuba for 19 months because nobody told it the rules had changed.

And diligence alone won’t save you.

Unicat’s buyer did diligence, missed the problem, disclosed quickly, and earned DOJ’s first declination for an acquirer. Yet the company it bought still paid millions.

Stanley Black & Decker found Iran sales in diligence, made them a closing condition to stop, and still got hit because OFAC says no one monitored whether they actually stopped.

So before signing and acquiring, ask what becomes illegal the day you own it.

On day one, tell the target in writing that U.S. sanctions apply, and after closing, test the transactions yourself.

Don’t accept a certification from the people hiding the problem.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines FinCEN's April 2026 proposal to rebuild the Bank Secrecy Act AML program rule around an effectiveness standard, with a two-prong test requiring that programs be both established (risk-based, built on four core elements, and kept current) and maintained (implemented in all material respects), along with a new enforcement threshold for banks limited to significant or systemic failures and explicit encouragement of AI and advanced analytics. At the same time, FinCEN is retreating from mandatory enhanced due diligence for domestic politically exposed persons, an effectiveness standard arriving amid deregulation and a rollback of beneficial ownership reporting, and AI monitoring tools that silently miss novel risks, make the appearance of compliance easier while making its substance harder to maintain. Volkov closes with practical steps: test programs against the two-prong standard, measure outcomes rather than activity, adopt a risk-based policy for domestic officials, govern and validate AI tools against the institution's own risk profile, and avoid managing to the current enforcement climate.

If a $36 million export violation comes down to whether a loading dock worker grabbed the right box, the problem isn’t the guy on the dock.

BAE Systems just paid $36 million to the State Department for more than 100 export control violations.

Here’s what makes this case worth your attention.

DDTC didn’t find willful evasion. It found something more common and, honestly, scarier: a well-intentioned compliance program that just couldn’t keep up.

GPS technical data sent to China because the file transfer system didn’t flag it, explosive mixture data sent to the UK because an employee thought it was already public, a shipment mix-up where dockworkers grabbed the wrong controlled part off the shelf.

DDTC’s own words: BAE lacked a compliance program that integrated corrective action across the enterprise.

Sounds familiar?

BAE had already done one audit, made improvements, and violations kept happening anyway.

Here’s my takeaway.

Partial fixes after an audit finding don’t close a systematic gap.

If your compliance program relies on individual judgment calls at the warehouse dock or the file transfer stage instead of built-in controls, you have the same exposure BAE just paid $36 million to resolve.

The Ethics and Compliance Q and A show is produced by One Stone Creative.