In this episode, Michael Volkov examines OFAC’s October 27, 2026 settlement with Extreme Networks, which agreed to pay $1,529,685 for nine apparent violations involving exports to MMZA, a Russian defense manufacturer blocked under the 50 percent rule through its ownership by Almaz-Antey. The company had a policy to review every Russia-related dealing, yet OFAC says it ignored red flags that included MMZA email addresses and...

You cannot govern AI you cannot see. That’s why the first step is not a policy. It’s an inventory. Once you’ve found every AI tool in your company, including the shadow ones, sort them into tiers. High-risk tools that make decisions about people or money, with human review of every output. Moderate risk, customer-facing tools with sampling and disclosure. Low-risk internal productivity tools on approved...

Your supply chain doesn’t end at your supplier. Neither does your liability. Three risks are converging on the same shipments. Sanctions. Evasion networks use transshipment hubs, shell companies, and last-minute routing changes, and regulators now expect you to screen your cargo, not just your counterparties. Forced labor. U.S. law presumes goods linked to restricted regions or entities were made with forced labor unless you prove...

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the growing retrenchment of compliance and why companies that cut or sideline their programs are taking on more risk, not less. Using the Bank of America penalties as a case study, he shows how a compliance function can identify the problem, recommend an exit, and still be overruled or bypassed by the business, which...

Michael Volkov examines why every organization needs a responsible AI use policy now, as employees adopt AI tools faster than companies can govern them. Drawing on court sanctions against lawyers for AI-fabricated citations, SEC “AI washing” enforcement actions, and data leaks into public chatbots, Michael explains that these failures stem from weak governance rather than weak technology. He highlights DOJ’s Evaluation of Corporate Compliance Programs,...

Lying about where your goods come from is now one of the most expensive mistakes in trade compliance. DOJ stood up a dedicated trade fraud task force in August of last year, and it moved fast. Its first settlement came three months later. This May, it announced the largest customs-related False Claims Act recovery ever, roughly $550 million from aluminum companies and affiliated warehouses accused...

You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true. Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information....

In this episode of Corruption, Crime and Compliance, Michael Volkov interviews Ryan R. Martin about how third-party risk management has evolved from its early focus on foreign bribery into a discipline now dominated by cybersecurity and artificial intelligence. Martin describes building a vendor risk management system from scratch, draws lessons from the Target data breach about how a vendor’s weakness can become a company’s crisis,...