Corruption Crime & Compliance

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down why the EU AI Act has moved from a future planning exercise to an actively enforced regulatory regime, with the European Commission's AI Office holding full investigative and fining authority since August 2026, having already opened its first formal investigations in June 2026 into hiring tools, credit scoring systems, and student monitoring applications. He walks through the Act's fragmented compliance timeline, prohibited practices enforceable since February 2025, general-purpose AI obligations running since August 2025, and live chatbot transparency requirements, alongside the significant deadline relief the Digital Omnibus gave specifically to high-risk AI systems, pushed to December 2027. The episode closes with a clear warning: companies that read the Digital Omnibus as a blanket delay of the entire AI Act are making a costly mistake, since the tracks carrying real, current enforcement exposure, including fines up to 7 percent of global turnover, remain fully active today.

Has OFAC branded your company with the scarlet letter?

Getting removed from the SDN list is possible, but it’s not fast, it’s not easy, and it’s not guaranteed.

The primary path is a petition for administrative reconsideration filed with OFAC, arguing mistaken identity, changed circumstances, or that the original factual basis was simply wrong.

You must prove it with real documented evidence.

OFAC is skeptical of cosmetic restructurings designed to look like change while control remains the same.

Practically, petitions can take many months to over a year, and you’re often arguing against evidence you’ll never fully see, since designations can rest on classified information.

If OFAC denies or ignores your petition, you can challenge it in federal court, but courts defer heavily to the executive on sanctions, so litigation is a last resort, not a strategy.

If you’re designated, get experienced OFAC counsel immediately, do a real internal investigation, build your remediation story, and manage expectations. It takes time.

The best strategy is never needing this. Build a sanctions program rigorous enough that you never end up on the list at all.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines how Delaware's Caremark doctrine has matured through a recent run of decisions involving Teligent, Regions Financial, and Boeing, all centered on the question of when a board's failure to prevent corporate misconduct crosses from ordinary mismanagement into an actual breach of the duty of loyalty. He walks through Teligent's officer-level oversight failures in FDA compliance, Regions Financial's lesson that a whistleblower investigation without genuine follow-through and remediation doesn't satisfy Caremark's good-faith standard, and the pivotal 2026 Boeing dismissal, where extensive board and committee engagement on safety protected directors even after another serious incident. The episode closes with practical guidance for compliance officers on identifying mission-critical risks, building real escalation and follow-up procedures, and documenting board oversight, since Caremark, as these cases confirm, does not demand perfection, only a good-faith effort to oversee the risks that genuinely matter.

Are you rubbing elbows with criminals?

When OFAC designates someone a specially designated national, or SDN, it’s not a warning label. It’s a legal wall.

Every asset that party has anywhere in U.S. jurisdiction, or in the hands of a U.S. person, is frozen. Every U.S. person is barred from transacting with them, directly or indirectly.

The trap is OFAC’s 50% rule, which means any entity owned 50% or more in aggregate by blocked persons is automatically blocked too, even if it never appears on the published list.

A clean name screen doesn’t mean a clean counterparty if you haven’t traced the ownership behind it.

Enforcement is ratcheting up hard right now: Iran-related designations, cartel terrorism, Russia sanctions and evasion networks. The stakes are real - civil penalties in the tens of millions, frozen wires, correspondent banking risk, and secondary sanctions that can cut even non-U.S. companies off from the dollar system entirely.

Sanctions screening can’t be a one-time check-the-box exercise.

You need ongoing, ownership-aware screening that re-screens existing counterparties as the list evolves and actually traces beneficial ownership, not just the name on the contract.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down Veloxis Pharmaceuticals' more than $46 million settlement with DOJ and HHS-OIG over a years-long kickback scheme involving its kidney transplant drug Envarsus XR, a scheme the DPA says was directed in part by the company's own former CEO. He examines why Veloxis avoided prosecution and instead secured a deferred prosecution agreement under DOJ's Corporate Enforcement and Voluntary Self-Disclosure Policy despite executive-level involvement in the misconduct, crediting the company's disclosure, cooperation, and termination of the responsible executives. The episode also unpacks the financial breakdown across civil, criminal, and Sunshine Act penalties, and closes with a detailed look at the structural compliance overhaul required under Veloxis's five-year Corporate Integrity Agreement, including a compliance officer mandated to report independently of legal and finance directly to the CEO and board.

At $125 million, breaking the law can never be a cost of doing business.

UBS Bank was hit with a $125 million FinCEN penalty, the largest ever against a broker-dealer under the Bank Secrecy Act.

This is UBS’s second Bank Secrecy Act action in less than a decade. In 2018, regulators told UBS: fix your foreign currency wire monitoring. It never did.

The same gap stayed open for years, letting more than $10 billion in transactions move through unchecked.

Layered on top, UBS failed to properly vet high-risk customers tied to Russia and Latin America, even after one of its own affiliates raised internal concerns about their sources of wealth.

That warning went nowhere. UBS admitted it acted willfully and intentionally.

Now, what’s the lesson? A prior enforcement action isn’t the end of the story. Regulators check whether you actually fixed what they flagged, and unfixed gaps read as willful the second time.

High-risk geography demands ongoing monitoring, not a one-time onboarding check, and no institution’s size or reputation buys protection.

UBS is one of the most respected private banks in the world, and that bought it nothing here but headaches.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines L3Harris Technologies' abrupt ouster of chairman and CEO Christopher Kubasik over a code-of-conduct violation, and why the story is really a board governance cautionary tale rather than a typical enforcement matter. He traces Kubasik's earlier, similar departure from Lockheed Martin in 2012 alongside comparable cases involving Brian Krzanich at Intel and Mark Hurd at Hewlett-Packard, both of whom went on to lead other companies despite prior conduct violations, to explore why boards keep extending second chances to executives with this kind of history. The episode unpacks the distinction boards draw between personal-conduct issues and conduct that creates genuine enterprise risk, and argues that thorough vetting must translate into a documented, ongoing risk-mitigation plan rather than a one-time pass/fail judgment made during the hiring process, since, as L3Harris just learned, history has a way of repeating itself.

Is your routine payment actually a bribe?

Scolar, an Omaha agricultural company, resolved an FCPA case for over $10 million after using customs brokers to bribe Mexican officials, about $2,000 for each train that crossed the border. It was invoiced as reinspection fees paid routinely for six years.

Nobody asked what the money actually bought.

Stop treating customs brokers, freight forwarders, and logistics providers like ordinary vendors. They interact directly with foreign officials on your behalf, and that makes them high-risk third parties, deserving the same scrutiny as a sales agent or government relations consultant.

Test your recurring fees, your routine fees. Any charge that repeats, described in vague language - reinspection, expediting, special handling - should trigger one question every time: can we prove exactly what the payment was for?

If not, that’s your red flag, regardless of the dollar amount.

Small, consistent, unexplained fees at the border are exactly how bribery hides.

Go look at your own customs and logistics payments this week.

The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov makes the case that every organization needs a written AI Acceptable Use Policy now, not eventually, because employees are already using AI tools with or without formal governance. He walks through the three core risk categories driving that urgency: confidentiality exposure when employees submit sensitive data to ungoverned tools, hallucination risk from AI-generated content that can be fabricated yet fully convincing, and vendor risk from the multi-layered data relationships that come with adopting a third-party AI product. He then breaks down what a genuinely effective policy needs to include: clear governance ownership, a real (not rubber-stamp) vendor due diligence process reassessed at least annually, data classification tied directly to tool approval, verification requirements built into actual workflows rather than left as aspirational language, and a no-retaliation incident reporting process that surfaces problems early instead of driving them underground.

Have you heard about the Goldman Sachs banker who bribed his way to a conviction?

A federal jury in Brooklyn last week convicted Asante Berko, a former Goldman Sachs executive, on FCPA conspiracy, a substantive FCPA violation, and money laundering conspiracy.

Berko managed a deal between a Turkish energy company and the government of Ghana to build a new power plant in Ghana. To win the bid, he and his co-conspirators paid more than a million dollars in bribes to Ghanaian officials, including a planned payment to the Minister of Power using the code word “Holy Reign” in their communications for the payoffs.

Berko didn’t need an outside fixer. He lied directly to Goldman’s own compliance team and moved his real conversations to a personal email account.

He laundered the money through shell companies, sham invoices, and nominee accounts.

The lesson: your biggest FCPA risk isn’t always the outsider, the third party who hasn’t been vetted. Sometimes it’s the trusted insider lying straight to your compliance function.

Goldman wasn’t charged and cooperated fully, but this shows why verification, not just trust, has to be built into how you vet high-value cross-border deals.

The Ethics and Compliance Q and A show is produced by One Stone Creative.