KPMG just released its 2026 Global Chief Ethics and Compliance Officer Survey, drawing on responses from 725 CCOs, and the framing KPMG chose for the report tells you most of what you need to know before you even get to the data: “Feeling the pressure: A new reality for compliance leaders.” That’s not marketing language. It reflects a genuine shift in what the compliance function...

The UK’s Office of Financial Sanctions Implementation fined Citibank’s London branch roughly 4.7 million pounds, about $6.4 million, for violating Russia sanctions, and this case deserves close attention from every financial institution compliance team, not because the violations were exotic or novel, but because they weren’t. This is a case study in ordinary operational failure at scale: screening systems that missed a name variant, alert...

U.S. District Judge Nicholas Garaufis has rejected the Justice Department’s request to drop the remaining bribery and obstruction of justice charges against executives connected to Indian billionaire Gautam Adani’s conglomerate, and this ruling deserves attention well beyond the Adani matter itself. It’s a rare and pointed example of a federal court refusing to simply accept a prosecutor’s word that dismissal is warranted, and it raises...

Part 1 of this series walked through the settlement terms and the sheer range of violations DDTC documented against BAE Systems, spanning unlicensed technical data exports, unauthorized defense services, agreement mismanagement, and documentation failures. In Part 2, we focus on what actually caused all of this, because DDTC’s charging letter is unusually candid about root causes, and those root causes are far more instructive than...

Part 1 of this series laid out why the risk landscape around generative AI, confidentiality exposure, hallucination risk, and vendor risk, makes a written AI Acceptable Use Policy an urgent priority rather than a nice-to-have. In Part 2, I want to walk through what actually needs to be in that policy for it to function as a real governance tool rather than a document nobody...

Reuters reported this week that the Federal Trade Commission has opened an antitrust investigation into Epic Systems, the dominant electronic health records vendor based in Verona, Wisconsin. The report, citing two sources familiar with the matter, says the FTC has already sent investigative demands to other companies in the health technology industry, seeking information about how Epic controls access to patient data. The agency has...

The Bureau of Industry and Security’s Fiscal Year 2025 Annual Report to Congress is not a routine bureaucratic filing. It reads more like a mission statement, and the numbers inside it back up the rhetoric. Export control enforcement has escalated dramatically over the past year, and companies operating in semiconductors, aerospace, defense, dual-use technology, and cross-border trade more broadly need to understand exactly how much...

The State Department’s Directorate of Defense Trade Controls just handed down a $36 million penalty against BAE Systems, Inc., resolving more than 100 alleged violations of the International Traffic in Arms Regulations and the Arms Export Control Act stretching from 2019 through as recently as March 2025. This is Part 1 of a two-part series on the case. Here, we walk through the settlement structure...

OFAC’s settlement with Rice Lake Weighing Systems is a small-dollar case, just $60,764, but it is an unusually instructive one, because it captures almost every classic failure mode in how U.S. companies manage sanctions compliance at their foreign subsidiaries: a license that got revoked, an instruction that didn’t translate into real understanding, and a subsidiary that kept dealing with a sanctioned country indirectly after being...