In this episode of Corruption, Crime and Compliance, Michael Volkov interviews Ryan R. Martin about how third-party risk management has evolved from its early focus on foreign bribery into a discipline now dominated by cybersecurity and artificial intelligence. Martin describes building a vendor risk management system from scratch, draws lessons from the Target data breach about how a vendor’s weakness can become a company’s crisis,...
In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors,...
The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial...
The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is...
On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at...
If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement. OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes. Four of them should be on your list today. One, U.S. nexus now reaches foreign...
The Adani prosecution has become one of the most closely watched corruption cases in the country, and not because of the facts alleged in the indictment. It is now a contest over a narrower and more consequential question: when the Justice Department decides it no longer wants to pursue a criminal case, how much of an explanation does a federal court get to demand? On...
AI is not coming to your company. It is already there. Employees are drafting emails, summarizing contracts, writing code and analyzing data with AI tools today, many on personal accounts the company never approved. If your organization does not have a responsible AI use policy, you do not have an AI strategy. You have an AI exposure. The Risk Is Not Theoretical The warning signs...
For years, a healthcare company that discovered possible wrongdoing faced two questions at once: should we tell the government, and which part of the government should hear it first? On October 15, 2026, the Justice Department’s National Fraud Enforcement Division and the Department of Health and Human Services Office of Inspector General answered the second question with a joint Policy on Coordination of Voluntary Self-Disclosure...
In this episode of Corruption, Crime and Compliance, Michael Volkov examines the more than $1.21 billion in Treasury penalties announced October 13, 2026 against Bank of America, including FinCEN’s $1.2 billion consent order, which credits the OCC’s record $750 million penalty and includes the bank’s admission that it willfully violated the Bank Secrecy Act. Volkov explains how the bank’s homegrown transaction monitoring system, Event Processor,...
