Many companies carefully review each and every vendor. Almost none review their vendor’s vendor. This creates one of the biggest blind spots in modern risk management. Your payroll vendor may use a third-party AI provider. Your software company may rely on multiple subcontractors. Your logistics provider may depend on dozens of suppliers across the globe. Every one of these relationships creates additional risk. Cybercriminals are...

Bosch agreed to pay more than $43 million in penalties and disgorgement for illegally exporting products and software to Huawei in violation of U.S. export control laws, while simultaneously receiving the first declination issued under DOJ’s revised National Security Division Corporate Enforcement Policy. In this episode, Michael Volkov examines the enforcement action, the compliance failures that led Bosch to misunderstand and misapply the Foreign Direct...

When it comes to third-party vendors, what you don’t know is hurting you. Third parties rely on AI for customer service, recruiting, compliance screening, marketing, and decision-making. But when a third party uses AI, your organization is on the hook for legal, regulatory, contractual, and reputational risks. Organizations need to understand which third parties use AI, what tools they use, what data is being shared,...

This episode examines OFAC’s new Iran General License X and why it may represent one of the most significant Iran sanctions developments in years. Michael Volkov explains what the license authorizes, why it matters amid ongoing diplomatic negotiations, and why companies should not mistake temporary sanctions relief for a permanent policy shift. The episode highlights practical compliance steps, including careful transaction analysis, documentation, due diligence,...

Not all sanctions violations are willful. Some companies just don’t know any better. An effective trade compliance program needs three critical elements. First, in addition to the two we spoke about in the last episode, organizations and companies have to monitor transactions, shipping documents, vessels, payment flows, and escalation of red flags. Employee training is critical. OFAC’s compliance framework specifically identifies training as a core...

In this three-part series brought together in a single episode, Michael Volkov examines the AI governance and compliance crisis unfolding across corporate America — arguing with urgency that organizations are failing to respond at the speed and depth the risk environment demands. Drawing on the FCPA enforcement parallel, Michael first addresses the organizational AI governance gap, where surveys show 83% of companies use AI but...

Most companies think they have a handle on AI. Most don’t. Compliance attorney Michael Volkov has sat across the table from Fortune 500 compliance teams, major law firms, and Berkshire Hathaway subsidiaries — and what he keeps finding is “shadow AI”: people using AI at work that leadership has no idea about. In this conversation with host Collin McKee, he breaks down where the real...

Michael Volkov delivers the operational compliance program guidance companies must implement to execute safely within OFAC’s new Venezuela general license framework, structured around five program pillars: transaction scoping with mandatory lifecycle revalidation at each critical deal stage; beneficial ownership-based counterparty due diligence that goes beyond standard SDN screening to identify Russia, Iran, Cuba, North Korea, and PRC-connected ownership structures; contract review and modification to incorporate...

What separates effective trade compliance programs from ineffective ones? It starts at the top. Good, bad, or ugly, it all trickles down from the top. Here are the five keys to an effective trade compliance program. The first two are building blocks for leadership and due diligence. First, senior executives and boards must actively support trade compliance. Without leadership engagement, compliance programs become check-the-box exercises....

Are your employees whispering corporate secrets into the greedy ears of public-facing AI? Many organizations have no visibility into how their employees are using AI. The solution is not to ban AI. The solution is AI governance. Organizations need approved AI tools, acceptable use policies, employee training, and ongoing monitoring. Organizations need approved AI tools, acceptable use policies, employee training, and ongoing monitoring. The question...