The Justice Department unsealed an indictment on October 2 charging the CEO of a California technology company with orchestrating one of the largest alleged diversions of advanced U.S. computing chips to China to date. According to prosecutors, Greg Lui, who runs Earthmade Computer, arranged the purchase and shipment of more than $300 million worth of export-controlled servers containing advanced Nvidia processors, routing them through Malaysia...

In Part 1, I explained the twist that makes sanctions M&A risk different from FCPA M&A risk: when a U.S. company or U.S.-controlled fund takes ownership of a foreign business, that business can become subject to U.S. sanctions overnight, particularly under the Cuba and Iran programs, without changing a thing about how it operates. Part 2 covered cases involving inherited conduct and diligence misses. Part...

Part 1 of this series drew the analogy between buying an FCPA problem and buying a sanctions problem, explained why sanctions are worse because ownership by a U.S. person can itself create jurisdiction, and reviewed what OFAC’s 2019 Framework for Compliance Commitments says about mergers and acquisitions. Part 2 turns to the enforcement record. The four cases below share a common feature: in each one,...

Anyone who has spent time in the FCPA world knows the basic cautionary tale of M&A: you can buy a company and, with it, you can buy its bribery problem. Compliance professionals have spent two decades building pre-acquisition due diligence protocols around that idea. The same lesson applies to economic sanctions, but with a twist that makes the sanctions version in many ways more dangerous....

Part 1 of this series revisited the 2019 OFAC Framework for Compliance Commitments and made the case that its five pillars, management commitment, risk assessment, internal controls, testing and auditing, and training, remain the right foundation for any sanctions compliance program. But a foundation isn’t a finished structure. Since 2023, DOJ, BIS, and OFAC have been issuing joint “Tri-Seal” compliance notes that build substantial new...

If you built your sanctions compliance program around OFAC’s 2019 Framework for Compliance Commitments and haven’t revisited it since, you’re not alone, and you’re also overdue for an update. The 2019 Framework remains the foundational document for how OFAC evaluates a sanctions compliance program, and every one of its five pillars is still good law today. But federal sanctions enforcement has fundamentally changed shape since...

Part 1 of this series traced compliance’s earliest, clumsiest attempts to measure its own programs through hotline volumes and training completion rates. Part 2 covered the shift toward continuous monitoring, integrated dashboards, and key risk indicators, a real leap forward, but one still fundamentally limited by rules-based systems that could only catch risks someone had already anticipated. Part 3 closes the series by looking at...