Part 1 of this series drew the analogy between buying an FCPA problem and buying a sanctions problem, explained why sanctions are worse because ownership by a U.S. person can itself create jurisdiction, and reviewed what OFAC’s 2019 Framework for Compliance Commitments says about mergers and acquisitions. Part 2 turns to the enforcement record. The four cases below share a common feature: in each one,...

Anyone who has spent time in the FCPA world knows the basic cautionary tale of M&A: you can buy a company and, with it, you can buy its bribery problem. Compliance professionals have spent two decades building pre-acquisition due diligence protocols around that idea. The same lesson applies to economic sanctions, but with a twist that makes the sanctions version in many ways more dangerous....

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why acquiring a sanctions violation is even riskier than buying an FCPA problem: under programs like Cuba and Iran, U.S. ownership of a foreign target can itself create sanctions jurisdiction on closing day, turning previously lawful foreign business into violations overnight. Drawing on OFAC’s 2019 Framework for Compliance Commitments, which calls for compliance involvement...

A pharma CEO just found out the captain doesn’t always go down with the ship. Sometimes the ship stays afloat by handing him to DOJ. Veloxis Pharmaceuticals just paid over $46 million to resolve a kickback scheme involving its kidney transplant drug, lavish meals, resort stays, payments dressed up as consulting fees paid to doctors and pharmacies to drive prescription demand. Here’s the part that...

Part 1 of this series revisited the 2019 OFAC Framework for Compliance Commitments and made the case that its five pillars, management commitment, risk assessment, internal controls, testing and auditing, and training, remain the right foundation for any sanctions compliance program. But a foundation isn’t a finished structure. Since 2023, DOJ, BIS, and OFAC have been issuing joint “Tri-Seal” compliance notes that build substantial new...

If you built your sanctions compliance program around OFAC’s 2019 Framework for Compliance Commitments and haven’t revisited it since, you’re not alone, and you’re also overdue for an update. The 2019 Framework remains the foundational document for how OFAC evaluates a sanctions compliance program, and every one of its five pillars is still good law today. But federal sanctions enforcement has fundamentally changed shape since...

Part 1 of this series traced compliance’s earliest, clumsiest attempts to measure its own programs through hotline volumes and training completion rates. Part 2 covered the shift toward continuous monitoring, integrated dashboards, and key risk indicators, a real leap forward, but one still fundamentally limited by rules-based systems that could only catch risks someone had already anticipated. Part 3 closes the series by looking at...

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why OFAC’s 2019 Framework for Compliance Commitments, built on the five pillars of management commitment, risk assessment, internal controls, testing and auditing, and training, remains the essential foundation for any sanctions compliance program, while also walking through the substantial multi-agency guidance that has layered on top of it since 2023 through joint DOJ, BIS,...

Today’s version of the Trojan horse doesn’t need to sneak past your gate in the dead of night. It’s a software update to something you already let in. Second preview ahead of tomorrow’s webinar, and this one’s about a blind spot I see constantly. Most compliance officers think about shadow AI as employees going out and signing up for some random chatbot. That happens, but...

In this episode of Corruption, Crime and Compliance, Michael Volkov traces the decades-long relationship between compliance and data, from the profession’s earliest, checkbox-style attempts to measure program effectiveness through crude proxies like hotline volume and training completion rates, through the rise of continuous monitoring systems, integrated dashboards, and key risk indicators that enabled expedited auditing and near-real-time visibility, and finally to the current AI-driven era,...