Corruption Crime & Compliance

Episoder

• 
  Is Your Third-Party Risk Program Ready for AI? 01.10.2026 1min

  An AI tool isn’t a piece of software. It’s a locked door, and you have no idea how many people have a key.Quick preview ahead of tomorrow’s webinar on AI and third-party risk, because I want you thinking about this before we dive in.Here’s the mental shift every compliance officer needs to make: every AI tool your company adopts is a third-party vendor relationship, often a more complicated one than your typical software vendor.Why? Because a lot of AI products are built on top of someone else’s underlying model.Your data can pass through multiple companies before it’s fully processed, and you may not even know all the hands it touches along the way.That means your vendor due diligence questions need to go further than usual.Does this vendor train on your data?Can that be turned off contractually and technically?Where does the data actually live?What subprocessors and underlying model providers are in that chain?These aren’t nice-to-have questions anymore. They’re the whole ballgame.Tomorrow we get into the specifics, but start here: if your third-party risk program hasn’t been rebuilt around AI-specific questions, it’s already out of date.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 453 -- Rounding Out Sanctions, Tariff and Trade Developments 29.09.2026 5min

  In this episode of Corruption, Crime and Compliance, Michael Volkov rounds up three major economic policy developments happening alongside Operation Economic Outcast: the State Department's rescission of Syria's nearly 47-year State Sponsor of Terrorism designation, opening the door to renewed trade and eased export controls; an escalating tariff war with Canada following the collapse of USMCA renewal talks, including a 50 percent tariff on roughly $20 billion of Canadian goods and matching retaliation; and the newly enacted Lindsey O. Graham Sanctioning Russia and Iran Act, with its novel tariff structure reaching up to 500 percent on Russian goods and up to 100 percent on top importers of Russian energy. Volkov argues these developments, read alongside the Iran crackdown, show an administration deploying economic tools more aggressively and across more simultaneous fronts than at any point in recent memory, and he closes by urging listeners to treat geopolitical risk assessment as a continuous function this quarter rather than a periodic exercise.
• 
  Can DOJ Make an Indictment Disappear? 29.09.2026 1min

  For anyone hoping a friendlier DOJ can make their old charges disappear, a federal judge just reminded us that vanishing requires his or her permission.Big development out of Brooklyn federal court.DOJ tried to drop the remaining bribery and obstruction charges against executives tied to Indian billionaire Gautam Adani.The judge said no.Judge Nicholas Garaufis ruled that Deputy AG Trent McCotter’s justification for dismissal didn’t include the actual facts needed to support it, just conclusions.McCotter argued weak U.S. jurisdictional ties. Garaufis said essentially: show me the facts, not just the argument.He’d already rejected an earlier diplomatic strain argument too, noting some conduct happened right here in the U.S.There’s real context here. Reporting suggests DOJ’s posture shifted after Adani’s team hired a lawyer personally connected to the president.None of that decided the legal question, but it’s exactly why a court might scrutinise DOJ’s reasoning more closely instead of rubber-stamping it.Here’s why this matters beyond one case: a change in DOJ’s political priorities doesn’t automatically make an indictment disappear.Courts still have to sign off.Don’t assume that a friendlier enforcement climate erases charges already on the books.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 452 -- Operation Economic Outcast: A Significant Expansion of Iran Sanctions and Enforcement 27.09.2026 11min

  In this episode of Corruption, Crime and Compliance, Michael Volkov devotes a full deep dive to Operation Economic Outcast, Treasury's aggressive campaign to close off Iran's remaining financial and commercial channels following the collapse of a June 2026 US-Iran memorandum of understanding. He walks through OFAC's expansion of sectoral sanctions into aviation, digital assets, gold, shipping, and technology with no U.S. nexus required, the suspension of general licenses that has disrupted universities, testing organizations, and academic and sports exchanges, a new presumption-of-denial licensing policy, updated Strait of Hormuz guidance establishing sanctions risk even without any payment changing hands, and a coordinated crackdown on banks in the UAE, Turkey, and Russia serving as Iran's financial lifelines. Volkov closes with concrete steps: reassess Iran-connected exposure immediately in the newly covered sectors, treat any activity tied to a suspended general license as ended rather than pending renewal, and build enhanced due diligence for Hormuz transits and newly designated bank counterparties.
• 
  Is Your Compliance Budget Ready for 2027? 24.09.2026 1min

  If you’re planning for 2027 with 2025’s budget in mind, your compliance program is about to fall on its face.KPMG just surveyed 725 chief compliance officers, and the headline is simple: the job has fundamentally expanded, and if your 2027 plan doesn’t reflect that, you’re already behind.75% of CCOs say cybersecurity and data privacy are top investment priorities.77% say the same about data analytics.That’s not a coincidence. You need the analytics to actually use the cybersecurity investment.But here’s the number that struck me most: 81% of CCOs feel confident collaborating with their cybersecurity teams.That’s not an accident. That reflects compliance functions building real structural partnerships with security and resiliency teams, not waiting for an incident to force the relationship into existence.And on AI, 68% describe themselves as mixed, leaning positive. Not hype, not fear. Measured adoption, concentrated in risk assessment, predictive analytics, and training.The bottom line: compliance isn’t just policy and training anymore. It’s operational resilience.If your budget doesn’t reflect that shift, fix it now.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 451 -- Two Executives, Two Sentencings, One Week 23.09.2026 9min

  In this episode of Corruption, Crime and Compliance, Michael Volkov examines two significant executive sentencings handed down within a day of each other: Tomás Niembro Concha, the former CEO of Puerto Rico's now-defunct Nodus International Bank, sentenced to more than nine years for a multiyear fraud scheme that fleeced his own bank of nearly $25 million and a scheme to evade U.S. sanctions on Venezuela by secretly selling a sanctioned individual's foreclosed home back to him through a front company; and Javier Aguilar, a former Vitol oil trader, sentenced to four years, well below the twelve DOJ sought, for bribing officials in Ecuador and Mexico to win Vitol more than $500 million in state oil company business. Volkov draws out the common threads between the two cases, shell entities, sham documentation, and years of concealment from the very oversight functions meant to catch it, and highlights Aguilar's rejected defense that the bribes were merely industry custom as a rationalization compliance programs should treat as a red flag whenever they hear it internally.
• 
  When Does Board Oversight Become Bad Faith? (Part 2) 22.09.2026 1min

  Lo and behold, Boeing gets sued over another safety crisis, and this time Boeing actually won.Want to know why? They kept the receipts.Yesterday I told you about two cases where Delaware let Caremark claims move forward. Today, the case where the board won, and its most important Caremark decision in years.Boeing again. New litigation, this time over the 2024 Alaska Airlines door plug incident. Given Boeing’s history, you’d think this case had real legs.Delaware dismissed it anyway.Why? Because the record showed the board had dedicated safety committees, got regular reports on manufacturing and quality, discussed the issues repeatedly, and got updates on remediation.The court said Caremark doesn’t ask whether oversight succeeded. It asks whether directors consciously looked away.Here, they didn’t.Here’s the takeaway for every board and every compliance officer: a functioning reporting system, real information flow, and genuine engagement is real protection, even when the company faces another crisis.Build that record now, before you need it in litigation, because in Delaware, detailed board minutes showing you are paying attention might be the single best defense you have.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 450 -- Your Vendor Contract Template Was Not Built for AI 20.09.2026 7min

  In this episode of Corruption, Crime and Compliance, Michael Volkov explains why standard software procurement templates fail to protect organizations in AI vendor relationships, and what to do about it. He walks through the structural differences that make AI vendors riskier than traditional software vendors, multi-layered data flows through underlying foundation models, frequent model swaps, and vendors' commercial incentive to train on customer data, and identifies the specific gaps legacy contracts leave open: silent or vague data training rights, indemnification that doesn't reach model outputs or training data provenance, missing audit rights, and liability caps that quietly undercut existing protections. The episode closes with a concrete negotiating playbook, including explicit training restrictions, coordinated indemnification and liability provisions, audit rights, subprocessor disclosure, regulatory compliance representations, and guaranteed exit and data deletion rights, along with practical guidance for organizations facing dominant vendors unwilling to negotiate.
• 
  When Does Board Oversight Become Bad Faith? (Part 1) 17.09.2026 1min

  Hiring someone to investigate misconduct isn’t always going to save your board. The line between bad management and bad faith just got real.Here’s a question every board member should be losing sleep over: when does a board’s failure to catch corporate misconduct cross the line from bad management into an actual breach of fiduciary duty?Delaware just gave us two new answers, and they cut in different directions.First, Teligent, a pharma company, an FDA compliance meltdown, and a court that let claims proceed against directors and two officers because the complaint showed information and mounting regulatory problems never made it to the people who could act on it.Second, Regions Financial case. A whistleblower sent the board a complaint about allegedly illegal overdraft fee practices back in 2019.The board hired an investigator. Good so far, but the company didn’t stop the practices until 2021, and a $191 million CFPB consent order was imposed.Delaware let the claims proceed here too.Here’s the lesson from both: escalation isn’t enough. Investigating isn’t enough. The board has to actually understand what it found and actually fix it.Stay tuned. Tomorrow I’ll tell you about the case that shows the other side of this coin.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 449 -- The EU AI Act Is No Longer Theoretical 16.09.2026 8min

  In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down why the EU AI Act has moved from a future planning exercise to an actively enforced regulatory regime, with the European Commission's AI Office holding full investigative and fining authority since August 2026, having already opened its first formal investigations in June 2026 into hiring tools, credit scoring systems, and student monitoring applications. He walks through the Act's fragmented compliance timeline, prohibited practices enforceable since February 2025, general-purpose AI obligations running since August 2025, and live chatbot transparency requirements, alongside the significant deadline relief the Digital Omnibus gave specifically to high-risk AI systems, pushed to December 2027. The episode closes with a clear warning: companies that read the Digital Omnibus as a blanket delay of the entire AI Act are making a costly mistake, since the tracks carrying real, current enforcement exposure, including fines up to 7 percent of global turnover, remain fully active today.
• 
  Can You Get Off the SDN List? 10.09.2026 1min

  Has OFAC branded your company with the scarlet letter?Getting removed from the SDN list is possible, but it’s not fast, it’s not easy, and it’s not guaranteed.The primary path is a petition for administrative reconsideration filed with OFAC, arguing mistaken identity, changed circumstances, or that the original factual basis was simply wrong.You must prove it with real documented evidence.OFAC is skeptical of cosmetic restructurings designed to look like change while control remains the same.Practically, petitions can take many months to over a year, and you’re often arguing against evidence you’ll never fully see, since designations can rest on classified information.If OFAC denies or ignores your petition, you can challenge it in federal court, but courts defer heavily to the executive on sanctions, so litigation is a last resort, not a strategy.If you’re designated, get experienced OFAC counsel immediately, do a real internal investigation, build your remediation story, and manage expectations. It takes time.The best strategy is never needing this. Build a sanctions program rigorous enough that you never end up on the list at all.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 448: Caremark in 2026 — Where Delaware Draws the Line Between Bad Judgment and Bad Faith 09.09.2026 11min

  In this episode of Corruption, Crime and Compliance, Michael Volkov examines how Delaware's Caremark doctrine has matured through a recent run of decisions involving Teligent, Regions Financial, and Boeing, all centered on the question of when a board's failure to prevent corporate misconduct crosses from ordinary mismanagement into an actual breach of the duty of loyalty. He walks through Teligent's officer-level oversight failures in FDA compliance, Regions Financial's lesson that a whistleblower investigation without genuine follow-through and remediation doesn't satisfy Caremark's good-faith standard, and the pivotal 2026 Boeing dismissal, where extensive board and committee engagement on safety protected directors even after another serious incident. The episode closes with practical guidance for compliance officers on identifying mission-critical risks, building real escalation and follow-up procedures, and documenting board oversight, since Caremark, as these cases confirm, does not demand perfection, only a good-faith effort to oversee the risks that genuinely matter.
• 
  Is Your Sanctions Screening Enough? 08.09.2026 1min

  Are you rubbing elbows with criminals?When OFAC designates someone a specially designated national, or SDN, it’s not a warning label. It’s a legal wall.Every asset that party has anywhere in U.S. jurisdiction, or in the hands of a U.S. person, is frozen. Every U.S. person is barred from transacting with them, directly or indirectly.The trap is OFAC’s 50% rule, which means any entity owned 50% or more in aggregate by blocked persons is automatically blocked too, even if it never appears on the published list.A clean name screen doesn’t mean a clean counterparty if you haven’t traced the ownership behind it.Enforcement is ratcheting up hard right now: Iran-related designations, cartel terrorism, Russia sanctions and evasion networks. The stakes are real - civil penalties in the tens of millions, frozen wires, correspondent banking risk, and secondary sanctions that can cut even non-U.S. companies off from the dollar system entirely.Sanctions screening can’t be a one-time check-the-box exercise.You need ongoing, ownership-aware screening that re-screens existing counterparties as the list evolves and actually traces beneficial ownership, not just the name on the contract.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 447 -- Veloxis Pharmaceuticals' $46 Million Kickback Settlement and What the CEP Really Rewards 06.09.2026 7min

  In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down Veloxis Pharmaceuticals' more than $46 million settlement with DOJ and HHS-OIG over a years-long kickback scheme involving its kidney transplant drug Envarsus XR, a scheme the DPA says was directed in part by the company's own former CEO. He examines why Veloxis avoided prosecution and instead secured a deferred prosecution agreement under DOJ's Corporate Enforcement and Voluntary Self-Disclosure Policy despite executive-level involvement in the misconduct, crediting the company's disclosure, cooperation, and termination of the responsible executives. The episode also unpacks the financial breakdown across civil, criminal, and Sunshine Act penalties, and closes with a detailed look at the structural compliance overhaul required under Veloxis's five-year Corporate Integrity Agreement, including a compliance officer mandated to report independently of legal and finance directly to the CEO and board.
• 
  When You Fail to Fix an Already Flagged Compliance Gap 03.09.2026 1min

  At $125 million, breaking the law can never be a cost of doing business.UBS Bank was hit with a $125 million FinCEN penalty, the largest ever against a broker-dealer under the Bank Secrecy Act.This is UBS’s second Bank Secrecy Act action in less than a decade. In 2018, regulators told UBS: fix your foreign currency wire monitoring. It never did.The same gap stayed open for years, letting more than $10 billion in transactions move through unchecked.Layered on top, UBS failed to properly vet high-risk customers tied to Russia and Latin America, even after one of its own affiliates raised internal concerns about their sources of wealth.That warning went nowhere. UBS admitted it acted willfully and intentionally.Now, what’s the lesson? A prior enforcement action isn’t the end of the story. Regulators check whether you actually fixed what they flagged, and unfixed gaps read as willful the second time.High-risk geography demands ongoing monitoring, not a one-time onboarding check, and no institution’s size or reputation buys protection.UBS is one of the most respected private banks in the world, and that bought it nothing here but headaches.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 446 -- L3Harris's CEO Ouster and the Board Governance Lesson Nobody Learns the First Time 01.09.2026 8min

  In this episode of Corruption, Crime and Compliance, Michael Volkov examines L3Harris Technologies' abrupt ouster of chairman and CEO Christopher Kubasik over a code-of-conduct violation, and why the story is really a board governance cautionary tale rather than a typical enforcement matter. He traces Kubasik's earlier, similar departure from Lockheed Martin in 2012 alongside comparable cases involving Brian Krzanich at Intel and Mark Hurd at Hewlett-Packard, both of whom went on to lead other companies despite prior conduct violations, to explore why boards keep extending second chances to executives with this kind of history. The episode unpacks the distinction boards draw between personal-conduct issues and conduct that creates genuine enterprise risk, and argues that thorough vetting must translate into a documented, ongoing risk-mitigation plan rather than a one-time pass/fail judgment made during the hiring process, since, as L3Harris just learned, history has a way of repeating itself.
• 
  Could Your Routine Customs Payment Actually Be a Bribe? 01.09.2026 1min

  Is your routine payment actually a bribe?Scolar, an Omaha agricultural company, resolved an FCPA case for over $10 million after using customs brokers to bribe Mexican officials, about $2,000 for each train that crossed the border. It was invoiced as reinspection fees paid routinely for six years.Nobody asked what the money actually bought.Stop treating customs brokers, freight forwarders, and logistics providers like ordinary vendors. They interact directly with foreign officials on your behalf, and that makes them high-risk third parties, deserving the same scrutiny as a sales agent or government relations consultant.Test your recurring fees, your routine fees. Any charge that repeats, described in vague language - reinspection, expediting, special handling - should trigger one question every time: can we prove exactly what the payment was for?If not, that’s your red flag, regardless of the dollar amount.Small, consistent, unexplained fees at the border are exactly how bribery hides.Go look at your own customs and logistics payments this week.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Episode 445 -- Why Your Organization Needs an AI Acceptable Use Policy 30.08.2026 9min

  In this episode of Corruption, Crime and Compliance, Michael Volkov makes the case that every organization needs a written AI Acceptable Use Policy now, not eventually, because employees are already using AI tools with or without formal governance. He walks through the three core risk categories driving that urgency: confidentiality exposure when employees submit sensitive data to ungoverned tools, hallucination risk from AI-generated content that can be fabricated yet fully convincing, and vendor risk from the multi-layered data relationships that come with adopting a third-party AI product. He then breaks down what a genuinely effective policy needs to include: clear governance ownership, a real (not rubber-stamp) vendor due diligence process reassessed at least annually, data classification tied directly to tool approval, verification requirements built into actual workflows rather than left as aspirational language, and a no-retaliation incident reporting process that surfaces problems early instead of driving them underground.
• 
  Can Your Biggest FCPA Risk Be a Trusted Insider? 27.08.2026 1min

  Have you heard about the Goldman Sachs banker who bribed his way to a conviction?A federal jury in Brooklyn last week convicted Asante Berko, a former Goldman Sachs executive, on FCPA conspiracy, a substantive FCPA violation, and money laundering conspiracy.Berko managed a deal between a Turkish energy company and the government of Ghana to build a new power plant in Ghana. To win the bid, he and his co-conspirators paid more than a million dollars in bribes to Ghanaian officials, including a planned payment to the Minister of Power using the code word “Holy Reign” in their communications for the payoffs.Berko didn’t need an outside fixer. He lied directly to Goldman’s own compliance team and moved his real conversations to a personal email account.He laundered the money through shell companies, sham invoices, and nominee accounts.The lesson: your biggest FCPA risk isn’t always the outsider, the third party who hasn’t been vetted. Sometimes it’s the trusted insider lying straight to your compliance function.Goldman wasn’t charged and cooperated fully, but this shows why verification, not just trust, has to be built into how you vet high-value cross-border deals.The Ethics and Compliance Q and A show is produced by One Stone Creative.
• 
  Is Trade Fraud the Next Major False Claims Act Risk? 25.08.2026 1min

  If you think your company can smuggle and fly under the radar screen, think again.When your company touches imports, customs, or tariffs, you need to know this.The Justice Department stood up a dedicated trade fraud task force in August of last year. Its first settlement came three months later.This past May, it delivered the largest customs-related False Claims Act recovery ever: $550 million from aluminum companies and their warehouses.A week later, two steel companies paid $19 million for misrepresenting Chinese, Indonesian, Italian, Turkish, and Vietnamese steel as Canadian or American-made.Underpaying customs duties you legitimately owe is a reverse false claim, meaning it’s a False Claims Act case with triple damages and whistleblowers ready to report you.As tariffs climb, so does the incentive to misdeclare country of origin, and DOJ now has a dedicated task force and a whistleblower bar ready and good at spotting those situations.If trade compliance isn’t in your risk assessment right now, fix that immediately.The Ethics and Compliance Q and A show is produced by One Stone Creative.