If a $36 million export violation comes down to whether a loading dock worker grabbed the right box, the problem isn’t the guy on the dock. BAE Systems just paid $36 million to the State Department for more than 100 export control violations. Here’s what makes this case worth your attention. DDTC didn’t find willful evasion. It found something more common and, honestly, scarier: a...
The Justice Department unsealed an indictment on October 2 charging the CEO of a California technology company with orchestrating one of the largest alleged diversions of advanced U.S. computing chips to China to date. According to prosecutors, Greg Lui, who runs Earthmade Computer, arranged the purchase and shipment of more than $300 million worth of export-controlled servers containing advanced Nvidia processors, routing them through Malaysia...
In Part 1, I explained the twist that makes sanctions M&A risk different from FCPA M&A risk: when a U.S. company or U.S.-controlled fund takes ownership of a foreign business, that business can become subject to U.S. sanctions overnight, particularly under the Cuba and Iran programs, without changing a thing about how it operates. Part 2 covered cases involving inherited conduct and diligence misses. Part...
Part 1 of this series drew the analogy between buying an FCPA problem and buying a sanctions problem, explained why sanctions are worse because ownership by a U.S. person can itself create jurisdiction, and reviewed what OFAC’s 2019 Framework for Compliance Commitments says about mergers and acquisitions. Part 2 turns to the enforcement record. The four cases below share a common feature: in each one,...
Anyone who has spent time in the FCPA world knows the basic cautionary tale of M&A: you can buy a company and, with it, you can buy its bribery problem. Compliance professionals have spent two decades building pre-acquisition due diligence protocols around that idea. The same lesson applies to economic sanctions, but with a twist that makes the sanctions version in many ways more dangerous....
If a $36 million export violation comes down to whether a loading dock worker grabbed the right box, the problem isn’t the guy on the dock. BAE Systems just paid $36 million to the State Department for more than 100 export control violations. Here’s what makes this case worth your attention. DDTC didn’t find willful evasion. It found something more common and, honestly, scarier: a...
The Justice Department unsealed an indictment on October 2 charging the CEO of a California technology company with orchestrating one of the largest alleged diversions of advanced U.S. computing chips to China to date. According to prosecutors, Greg Lui, who runs Earthmade Computer, arranged the purchase and shipment of more than $300 million worth of export-controlled servers containing advanced Nvidia processors, routing them through Malaysia...
In Part 1, I explained the twist that makes sanctions M&A risk different from FCPA M&A risk: when a U.S. company or U.S.-controlled fund takes ownership of a foreign business, that business can become subject to U.S. sanctions overnight, particularly under the Cuba and Iran programs, without changing a thing about how it operates. Part 2 covered cases involving inherited conduct and diligence misses. Part...
Part 1 of this series drew the analogy between buying an FCPA problem and buying a sanctions problem, explained why sanctions are worse because ownership by a U.S. person can itself create jurisdiction, and reviewed what OFAC’s 2019 Framework for Compliance Commitments says about mergers and acquisitions. Part 2 turns to the enforcement record. The four cases below share a common feature: in each one,...
Anyone who has spent time in the FCPA world knows the basic cautionary tale of M&A: you can buy a company and, with it, you can buy its bribery problem. Compliance professionals have spent two decades building pre-acquisition due diligence protocols around that idea. The same lesson applies to economic sanctions, but with a twist that makes the sanctions version in many ways more dangerous....
In this episode of Corruption, Crime and Compliance, Michael Volkov explains why acquiring a sanctions violation is even riskier than buying an FCPA problem: under programs like Cuba and Iran, U.S. ownership of a foreign target can itself create sanctions jurisdiction on closing day, turning previously lawful foreign business into violations overnight. Drawing on OFAC’s 2019 Framework for Compliance Commitments, which calls for compliance involvement...
A pharma CEO just found out the captain doesn’t always go down with the ship. Sometimes the ship stays afloat by handing him to DOJ. Veloxis Pharmaceuticals just paid over $46 million to resolve a kickback scheme involving its kidney transplant drug, lavish meals, resort stays, payments dressed up as consulting fees paid to doctors and pharmacies to drive prescription demand. Here’s the part that...
Part 1 of this series revisited the 2019 OFAC Framework for Compliance Commitments and made the case that its five pillars, management commitment, risk assessment, internal controls, testing and auditing, and training, remain the right foundation for any sanctions compliance program. But a foundation isn’t a finished structure. Since 2023, DOJ, BIS, and OFAC have been issuing joint “Tri-Seal” compliance notes that build substantial new...
If you built your sanctions compliance program around OFAC’s 2019 Framework for Compliance Commitments and haven’t revisited it since, you’re not alone, and you’re also overdue for an update. The 2019 Framework remains the foundational document for how OFAC evaluates a sanctions compliance program, and every one of its five pillars is still good law today. But federal sanctions enforcement has fundamentally changed shape since...
Part 1 of this series traced compliance’s earliest, clumsiest attempts to measure its own programs through hotline volumes and training completion rates. Part 2 covered the shift toward continuous monitoring, integrated dashboards, and key risk indicators, a real leap forward, but one still fundamentally limited by rules-based systems that could only catch risks someone had already anticipated. Part 3 closes the series by looking at...
