A dangerous misreading has taken hold in many boardrooms. Because the current administration paused and narrowed Foreign Corrupt Practices Act enforcement, the argument goes, enforcement risk in general has dropped, and compliance spending can drop with it. That reasoning confuses one statute with the whole landscape. The administration has not stopped enforcing the law. It has reassigned enforcement resources toward priorities defined by national security and the protection of the public fisc, and those priorities touch a far wider range of companies than the FCPA ever did.

What Actually Changed With the FCPA

It is true that FCPA enforcement was paused in early 2025 and then recast. The June 2025 guidance from then-Deputy Attorney General Todd Blanche directed prosecutors to focus foreign bribery cases on matters such as payments connected to cartels and transnational criminal organizations, conduct that harms the fair opportunities of American companies, conduct that threatens national security, and serious misconduct. That is a narrower FCPA, with a different emphasis. It is not an abandonment of the statute, and the Adani litigation shows how contested the line between priority and non-priority cases has become.

Even within that narrowed approach, the cartel connection is significant. A company operating in Mexico, the border region, or global supply chains touched by criminal organizations can find itself in the very category the Department says it wants to pursue. A bribery risk that looks ordinary can be reframed as a national security matter when the counterparty is a criminal network.

Where the Resources Went

The better question is where the enforcement energy has gone. The evidence points in several directions at once.

Trade and customs enforcement. The Fraud Division’s October 1 directive to its prosecutors lists tariff evasion, importation schemes, and forced labor among four priority categories for corporate investigations, alongside health care fraud, procurement and government contracts fraud, and revenue evasion. The False Claims Act has become a primary vehicle for customs cases, including a record customs-related recovery earlier this year against aluminum companies and their warehouses over alleged evasion of duties through mislabeling, and a settlement with steel companies over misrepresented origin. Underpaying duties is a reverse false claim carrying treble damages and whistleblower awards.

Sanctions and export controls. OFAC, BIS, and the Justice Department have continued to bring cases, and within days of each other OFAC announced an eleven-million-dollar bank settlement and a small freight forwarder’s penalty that turned on a supplier’s changed name and unchanged phone number. Export control prosecutions tied to advanced chip diversion, discussed elsewhere on this blog, show the same emphasis.

Financial crime and national security. FinCEN’s order against Bank of America was framed around Chinese money laundering networks, fraud, and trade-based money laundering along the southwest border, and it describes more than a billion dollars of unreported activity that implicated those priorities. FinCEN also stated plainly that it gave heavier weight to the harm caused by the failure to report priority threats.

Health care and government programs. Health care fraud and FDCA violations top the Fraud Division’s list, and the Department just coordinated its self-disclosure process with HHS-OIG to push disclosures toward the Health Care Fraud Section, while publicly stating that it uses data analytics, artificial intelligence, and whistleblowers to find cases. The same directive instructs the Division to design incentive programs that reach even insiders who took part in wrongdoing.

Put together, the pattern is not retreat. It is a reallocation toward areas where the political and security rationale is strongest and where the tools, including the False Claims Act, forfeiture, and sanctions authorities, deliver large recoveries.

Bank of America Is Not Finished

The $1.21 billion headline figure is the sum of the regulatory actions: FinCEN’s $1.2 billion, which credits the OCC’s $750 million, plus OFAC’s $11.66 million. That is the Treasury side only. In my review of the announcements, I have seen no resolution from the Justice Department. The FinCEN order itself notes that a bank customer disclosed a DOJ money-laundering investigation, and that a Bank of America affiliate has faced separate SEC actions concerning missed suspicious activity reports. I cannot say whether the Department has any open inquiry into the bank itself. But the pattern of facts, admissions of willful violations, and national security framing is the kind that often attracts further attention, and the bank’s own disclosures warn that regulatory discussions may continue. Companies should not assume that a Treasury package ends the story.

The Lesson: Risk Follows Priorities, and Priorities Move

For compliance leaders, the practical message is that risk assessments must follow the actual enforcement map, not last year’s headlines. A company that cut its FCPA training and third-party diligence because the statute is quiet may be dangerously exposed on customs valuation and origin, sanctions screening, export controls, forced labor, health care billing, or government contracting, all areas the current leadership has named as priorities. It may also be exposed to foreign enforcers, private litigants, and a future administration with different views.

Four steps follow. Refresh your enterprise risk assessment against the current priority list: trade, sanctions, financial crime, national security, health care, and government funds. Re-weight third-party diligence toward customs brokers, freight forwarders, logistics providers, and intermediaries in cartel-affected regions. Test your sanctions and AML screening for the failure modes the Bank of America cases revealed, such as name-only matching, stale watchlists, and auto-clear rules. And preserve the FCPA basics, because statutes of limitations run for years and the political climate will not last as long as the exposure.

The Bottom Line

Lower priority for one statute is not lower risk. It is a shift in where the government is looking, and it has made the question harder, not easier: compliance programs now have to cover a broader set of national security and fraud risks, with less certainty about which agency will arrive and when. A company that reads the FCPA pause as permission to retrench is reading the wrong map.