New products & platforms

Arcus Compliance released MAVRYX Assistant, a SaaS tool allowing small businesses to monitor and adhere to UK and European regulatory requirements.

Njordium Cyber Group AB launched Inspect360 Code, its new platform for software supply chain security and vulnerability management.

Signwell, an electronic signature platform, announced support for 21 CFR Part 11 so it can now provide healthcare and life sciences organizations with compliant electronic signatures, including FDA-regulated records and workflows.

Cybersecurity provider Cloud Range launched a free, 28-question operational technology cyber readiness assessment to help industrial operations identify gaps in detecting, investigating, responding and recovering from cyberattacks. 

Workforce management platform Globalli unveiled Entity Management, a solution that lets businesses establish new legal entities or transfer existing ones for ongoing management across 127 countries.

FormAssembly unveiled its new digital process automation platform, combining its compliant data collection with workflow automation and upgrades to its AI assistant, Fai, which will enhance its capabilities to build forms, workflows and integrations.

Partnerships & integrations

LeapXpert, a governed communication intelligence provider, announced it has achieved FedRAMP Class C certification in partnership with Knox Systems, an AI-managed cloud provider.

Financial crime compliance provider Vivox AI and beSirius, a provider of assurance and certification readiness in metals and minerals, announced a partnership to bring supplier evidence assessments and financial crime checks to metal and mining companies.

The post GRC Business Roundup: Arcus Compliance, Njordium, Cloud Range, Globalli, LeapXpert & More appeared first on Corporate Compliance Insights.

A Democratic sweep of the midterms hands the 120th Congress subpoena power in January, and the incoming chairs have signaled where they mean to use it: crypto ventures, surveillance pricing, government equity deals and AI’s debt-fueled buildout, among others. A team of Baker Donelson attorneys and policy advisers explains why a company need not be accused of anything to receive a letter.

Democrats won control of both the House and the Senate in the Nov. 3 midterm elections. When the 120th Congress convenes in January 2027, the new majority will chair every committee and control subpoena power, investigative budgets and staff for the final two years of President Donald Trump’s second term in the White House. 

Incoming committee leaders, including Rep. Robert Garcia, expected to chair the House Oversight Committee, and Sen. Ron Wyden, have signaled that oversight will be a priority. Congressional oversight of the executive branch is a routine feature of divided government, and both parties have exercised it when in the majority.

In congressional investigations, there is no judge, there are no rules of evidence and there is no guaranteed protection for the attorney-client privilege or work product. Congress recognizes only the Fifth Amendment privilege against self-incrimination as a right. Documents can be made public, quoted selectively at hearings or shared with regulators and plaintiffs’ lawyers.

What may happen

Expect oversight to begin rapidly and to come from several committees at once. Throughout 2026, Democratic ranking members sent minority letters, issued staff reports and made document-preservation demands. The new majority is expected to build on these efforts, and the volume of oversight activity is likely to increase significantly. Subject matter has reportedly been divided among committees in advance. 

Announced priorities include:

• Corporate interactions with the administration and the president’s family, including cryptocurrency ventures, investment vehicles, White House-related donations, political committees and other arrangements involving private-sector organizations and administration officials.
• Federal contracts and government actions, including loans, tariff escalation or relief, merger approvals, government equity or “golden share” arrangements and regulatory exemptions or preferences involving companies that have engaged administration officials.
• Consumer protection, affordability and pricing, including healthcare costs, surveillance pricing and consumer financial services, as well as changes in the Consumer Financial Protection Bureau’s (CFPB) supervisory and enforcement priorities, junk fees, overdraft and credit card costs, medical debt reporting, “buy now, pay later” products and earned wage access products.
• Banking, “de-banking,” cryptocurrency and illicit finance, including congressional scrutiny of financial institutions, digital assets and related regulatory and enforcement policies.
• AI, including concerns about a potential investment “bubble” driven by debt-financed AI spending, the growing role of private credit and off-balance-sheet vehicles in funding that build-out and the resulting exposure of banks, insurers and retirement savers, as well as the rapid expansion of data centers needed to power AI and their effects on electricity rates, grid reliability, water use and local communities.
• Defense and aerospace, including review of the financial stake the US government has taken in critical material suppliers via favorable loan and grant conditions from the Office of Strategic Capital; investigation into defense industry donations and how that may (or may not) have affected contract and procurement decisions and investments; and the level of control companies have over critical weapons systems (space and airborne systems, AI, etc.), which puts the US government at various levels of risk.

Risk

Midterms More Likely to Bring Ramped-Up Investigations Than New Laws

by Jennifer L. Gaskin

October 26, 2026

Party change could put companies, settlements & compensation under a microscope

Read moreDetails

Why private-sector organizations may receive requests

Committee leaders expect the administration to contest document requests, primarily through litigation. They have indicated they may seek the same information from third parties, including companies that communicated with, benefited from or did business with the administration. A company need not be accused of wrongdoing to receive a letter or subpoena. Industries already drawing attention include technology and AI, financial services and private capital, cryptocurrency, pharmaceuticals and health insurance, energy, defense and federal contracting.

Recent court decisions have also clarified the enforceability of congressional subpoenas. Courts have held that willful default on a congressional subpoena is a crime even when the witness relied on counsel’s advice (United States v. Bannon, subsequently vacated after the Justice Department moved to dismiss). They have held that only the president, not a subpoena recipient, can invoke executive privilege (United States v. Navarro, petition for certiorari filed Oct. 8, 2026). And they have held that a witness cannot sue to block a committee subpoena and must appear even if the witness plans to invoke the Fifth Amendment (de la Torre v. Cassidy).

Contempt referrals depend on Justice Department discretion, and committees have other enforcement tools, including civil enforcement, public hearings and referrals to state attorneys general. Some committee members have indicated they may coordinate with state AGs.

How to prepare and respond

These steps are advisable regardless of which party controls Congress and apply to any congressional inquiry. 

• Assess exposure now. Under counsel’s direction, identify all formal and informal communications with the White House and agencies, as well as government contracts, funding, approvals, donations and sponsorships that may attract interest.
• Do not act alone on privilege. If a request reaches communications with the White House, counsel should address any privilege question with the committee and the White House Counsel’s Office. A company cannot assert executive privilege on its own.

Several developments will shape how these investigations unfold: the organization of committees and the use of subpoena authority when the 120th Congress convenes in January 2027; the Supreme Court’s response to the pending petition for certiorari in United States v. Navarro on executive privilege; and the extent to which committee members coordinate with state attorneys general. Organizations should watch for letters from committee members in the coming weeks, which may signal the scope of 2027 inquiries.

The post A Democratic Congress Is Drawing Up Its Corporate Subpoena List appeared first on Corporate Compliance Insights.

AI deployment is near-unanimous, but governance lags

The use of AI to inform at least one financial estimate or judgment reviewed by auditors is almost unanimous, according to a survey by BDO.

The survey of 200 financial leaders at US organizations found that 99% used AI to generate or inform at least one financial estimate or judgment reviewed by its external auditor. A majority (62%) said their companies are using the technology to calculate cash flow or earnings forecasts, while about 55% reported their organizations use AI for tax provisions or deferred tax calculations and fair value measurements or asset valuations.

Despite the ubiquitous deployment of AI, confidence in auditing its output isn’t as high, the survey found. Less than half of respondents (49%) said they had the documentation and processes needed to explain and substantiate all AI-assisted outputs. Another 46% can explain most outputs with some gaps, bringing up the prospect that AI use is outpacing governance, documentation and evidentiary needs.

The survey also found that financial leaders see value in more continuous, year-round auditing, citing potential benefits like earlier risk identification, fewer year-end surprises and quicker insight into financial reporting issues. However, only 6% said their organizations were ready for that change. The issues stopping them: moving to continuous auditing would require better internal data infrastructure (71% of respondents), stronger AI governance (63%), clearer regulatory guidance (62%), greater auditor capability in continuous auditing methods (57%) and lower costs (48%).

70% of compliance & sustainability specialist rely on spreadsheets

A global survey by Assent and Germany’s Pforzheim University of 131 specialists and managers across automotive, electronics and other industries found that 70% manage product compliance in spreadsheets.

Filling out spreadsheets is eating up time, the survey found. Of the respondents, 69% said they spend up to two hours a day on manual, repetitive tasks.

Data problems are also a major hurdle. Almost three in five (57%) named incomplete data and data integrity as their greatest challenge in meeting compliance and sustainability reporting requirements, while 55% said poor data quality and timeliness keep their supply chain carbon data from meeting their own standards.

More than 50% of tax departments are under-resourced

The majority of companies’ tax teams don’t have the resources they need, according to a survey by the Thomson Reuters Institute and the Tax Executives Institute.

A survey of 244 senior decision-makers in corporate tax departments found that 53% said their teams are under-resourced, lacking the employees and money needed to optimize their jobs. It’s the third year in a row that more than half of respondents reported that they lack resources. Among under-resourced departments, the most common reason given was that workload had grown faster than they could recruit (33%), while 19% said they didn’t request a larger budget because they didn’t expect it to be approved.

The scarcity might be affecting perceptions of tax departments, according to the survey. Nearly three-fourths (73%) of tax leaders said their departments are viewed primarily as a cost center, or at best an even split between cost center and value creator, despite them believing they’re building a value narrative for senior leadership. But CFOs might not even be getting that value message: The CFOs surveyed ranked audit/dispute outcomes (50%), tax authority audits opened (44%) and tax penalties incurred (41%) as the metrics most regularly reported to them. All those are downside-avoidance measures. So whether the tax department is a cost center or value creator is being determined by different scorecards by tax teams and CFOs, the survey concluded.

The post AI Ubiquitous in Financial Decision-Making appeared first on Corporate Compliance Insights.

Early on a November morning in 2014, a routine draining job at a DuPont plant in Texas released nearly 24,000 pounds of toxic gas indoors, killing four workers. As industrial risk consultant Jowanza Joseph writes, the task had become daily practice without ever being written into a procedure or run through review. As the DuPont disaster shows, you can have a manual for every task and still not be doing them.

The crew at DuPont’s La Porte plant had been fighting the same problem for days. A plug of methyl mercaptan hydrate had formed in a feed line to an insecticide unit, and until it cleared, the unit stayed down. Around 4 a.m. Nov. 15, 2014, they were working on the restart when pressure began climbing in a vent header. This had happened before. Liquid collected in that header, and the plant’s solution was simple: open the drain valves and let it run out. Two workers opened the valves. They were standing inside the manufacturing building, and what came out of the line that night was not water or solvent. It was toxic methyl mercaptan, close to 24,000 pounds of it, released indoors.

Crystle Wise got a call out for help before she was overcome. Robert Tisnado went in after her. Wade Baker, the shift supervisor, went in too. Then Robert’s brother, Gilbert, went in. Workers later found Gilbert beside Robert. None of the four survived.

The US Chemical Safety and Hazard Investigation Board (CSB) did not issue its final report until June 2019. By then, investigators had traced the release through records that were already at the Texas plant in 2014: a vent header known to collect liquid, daily instructions for draining it and repair paperwork for the building’s rooftop fans.

DuPont sold safety for a living

DuPont started selling its safety know-how in the late 1960s, and that sideline eventually became DuPont Sustainable Solutions, a global consulting business. How could such a catastrophe happen at the very company selling safety worldwide, investigators would come to ask.

When OSHA finished its citations after La Porte, David Michaels, the longest-serving OSHA head in US history, said DuPont “promotes itself as having a ‘world-class safety’ culture and even markets its safety expertise to other employers, but these four preventable workplace deaths and the very serious hazards we uncovered at this facility are evidence of a failed safety program.”

DuPont’s corporate process safety rules were not the problem. By most accounts, they were strong. The problem was La Porte was not running on them. The investigations board found the site had never formally assessed its own process safety culture, and its list of contributing problems is a tour of unglamorous management chores: auditing, corrective actions, management of change, shift communications, toxic gas detection, emergency response. A plant can have manuals covering every one of those tasks and still not be doing them. La Porte is tragic evidence of that.

Whether a program works in practice or just looks good on paper is a central one the government uses in assessing the effectiveness of a compliance program, according to the DOJ’s “Evaluation of Corporate Compliance Programs” publication. So to put this incident into compliance language, the drain valves were an undocumented workaround that had become the real procedure, and the fan work order was an overdue remediation item behind an audit finding.

Risk

Root Cause Analysis: Right-Sized Guidance Before the Crisis Hits

by Jonny Frank, Kaitlyn Cecala and Annie Budra

August 25, 2026

RCA guidance helps a company avoid improvisation, apply consistent criteria and distinguish fixing an incident from fixing its cause

Read moreDetails

Start with the drain valves

Why were workers draining a toxic gas line by hand, indoors, in the first place? Because of a construction project. A $20 million incinerator job wrapped up in 2011 and left the vent system with a flaw: liquid collected in the piping, and there was nothing in the design to remove it. So people got rid of it, manually, every day. The task made it into the daily operating instructions. It never made it into a written procedure, and nobody ever ran it through a management of change review, which is the process chemical plants use to stop and think before a job becomes routine. The instructions mentioned no breathing equipment. They asked for a sample of the drained liquid so the plant could find out what it actually was. Month after month, the sample was never taken, the CSB report said.

Sit with that for a second. An unidentified liquid, drained by hand, on a schedule, at a plant owned by the industry’s most safety-conscious company. The routine became the training. By November 2014, the crew had every reason to believe opening those drains was ordinary work, because it was. They did it all the time.

Workers heated sections of piping during the restart, hoping to melt the hydrate plug. They also realigned valves. DuPont did not put either change through management of change review. Once the plug cleared, methyl mercaptan entered the vent system. The indoor drain valves were open, and the gas escaped there into the manufacturing building.

At La Porte, the draining job appeared in daily instructions, yet no written procedure covered it. The daily instructions also asked for a liquid sample. Nobody collected one. A gap like that is easy to miss during a document review because the job had a schedule and people assigned to it, even though the underlying work had never been reviewed as a procedure.

Both fans were broken

Shorter story, same plant. The manufacturing building had two ventilation fans on the roof. DuPont’s own auditors had raised the ventilation as a concern about five years earlier. On the night of the release, neither fan worked. The repair had a work order, which was marked urgent. And it had sat that way for nearly a month.

The CSB did not claim that repairing the fans would have saved the four workers. It concluded that the quantity released was probably too large for the ventilation system to keep the building safe once methyl mercaptan began escaping indoors. The unresolved repair still belongs in the account because DuPont’s auditors had identified ventilation as a concern years earlier, and the plant went into that night with no working rooftop fans.

At the 2019 release of the report, then-CSB Interim Executive Kristen Kulinowski called La Porte “a long chain of failures” and pointed to the plant’s habit of “deferring much needed process improvements.” 

In 2023, DuPont pleaded guilty to one count of a negligent release of an extremely hazardous substance, and a judge ordered the company to pay $16 million and put them on two years of industrial probation, the Associated Press reported. In a statement at the time, Corteva, a DuPont spinoff, said it “deeply regrets” the gas leak, adding, “We are committed to the highest safety standards, and safety is a core value.”

The fan work order was marked urgent for almost a month. Before that repair date passed, a senior manager could have been required to review the delay and sign a short extension. The extension would have stated when the fans would be repaired and why the building could keep operating in the meantime.

At the company site with the best reputation, when was the last time someone spent a full shift watching the work before opening the procedure binder? At La Porte, the paperwork made the daily draining job look settled; watching liquid come out of that vent line indoors might have raised a question the file did not.

How old is the oldest safety-critical repair in your backlog, and does its file show a dated review of the delay with a name attached? La Porte’s fan work order said “urgent” for nearly a month.

And the drain valve question, which is the one I keep coming back to: what are your crews doing every day that no procedure covers and no review ever approved? Somebody at your company knows. It is probably not the person who writes the compliance report.

Crystle Wise, Robert and Gilbert Tisnado and Wade Baker did what their training told them to do. At La Porte, the training was the undocumented workaround, the file said nothing was wrong, and four people paid for the difference.

The post DuPont Sold Safety to the World While Its Own Plant’s Rules Stayed on Paper appeared first on Corporate Compliance Insights.

No CEO is going to walk into the compliance office and disclose an affair, least of all one with a suspected foreign spy who works at a client. CCI columnist Mary Shirley uses the Nvidia scandal to walk through the CEO risks compliance can’t fully control but shouldn’t ignore.

By now, you’ve likely seen the company-wide apology Nvidia CEO Jensen Huang sent his staff and his family, since made public, for an extramarital affair. A CEO indiscretion like this is almost par for the course, and usually the worst of it is a conflict of interest: the person at the very top involved with a subordinate, or at least someone with less organizational authority. 

Huang’s case goes further. His affair partner is a suspected spy, reportedly sent by China, who works at one of Nvidia’s clients. Now it’s a national security problem.

The spy twist makes Nvidia an outlier, but the questions Huang’s case raises about CEO risk are not, and every compliance practitioner should be able to answer them for their own organization.

The undisclosed conflict of interest

In theory, our conflict of interest policy and disclosure process is supposed to vet personal relationships with customers. The problem is, no CEO is going to proactively sit down at their desk and write to compliance to advise that they’re engaging in a romantic liaison with someone who is not their spouse, regardless of the egregiousness of the conflict. In fact, the more egregious the conflict, the less likely the CEO is going to disclose this information to anyone else, particularly professional contacts. So what are compliance departments to do in this situation? Build your robust conflicts program anyway, just don’t rely on it to detect these types of issues.

Possibly the most likely detection control in your arsenal will be your hotline. We saw this play out in color in the 2013 GlaxoSmithKline case in China when a whistleblower sent surreptitiously recorded adult footage of the head of the China business engaging in extramarital activity, accompanied by corruption allegations. Which leads us t o…

Compliance officer retaliation

Investigating the CEO of your organization is not for the faint of heart. In and of itself, it can be a conflict of interest. This individual may be your boss, or perhaps worse, your skip-level boss. Pav Gill knows this kind of risk first hand. He was working at Wirecard when an anonymous fraud allegation came in from a whistleblower. Gill led the investigation as a member of the compliance department and when he reported the identified fraud, he was pressured to the extent that he felt he had to leave the company for his own safety. 

Gill has made the astute point that non-retaliation policies and stances should not just cover those who speak up. It should also cover those whose job it is to investigate whistleblower allegations. I like to emphasize that non-retaliation is for those who cooperate with compliance processes, so that includes witnesses, compliance staff and original whistleblowers. Essentially anyone who continues, in good faith, to make their voice heard. Compliance officers should get their managers and boards comfortable with that understanding. Chief compliance officers in particular should be bold about asking for a contract during the hiring process. It’s for your own protection should you find yourself in a situation like this. Additionally, shape your relationship and communication funnels with the board so that you have an established avenue to go through in a worst-case scenario in which you must go over the head of the CEO or other leadership with more authority than you.

Another step the savvy compliance professional can take is to enshrine your right to independently go to external counsel at your discretion into your compliance charter. Bringing in outside counsel to assist with a sensitive investigation elevates it and adds a degree of buffering given an objective third party expert agrees that something is wrong in a situation where you have substantiated a report.

Compliance

The Incredible Shrinking Compliance Officer

by Mary Shirley

March 10, 2026

When the mandate grows and the headcount doesn't, we have more options than we think

Read moreDetails

Independence of investigation

Nvidia’s board of directors is conducting an investigation, and Huang has indicated he will cooperate. However, the average Nvidia board member has served for just under 15 years, which is nearly twice as long as the S&P norm. Two of the directors charged with overseeing the investigation have served alongside Huang since the company was founded 33 years ago. 

In this situation, there is a perception challenge regarding directors’ independence. The fix is to build independence into your protocols ahead of time: a disciplinary framework that requires, for certain senior roles, that an independent external counsel or outside body lead any investigation. That may very well be what happens in the Nvidia case; I’m sure we’ll learn more in due course.

Additionally, from a governance standpoint, board members should be reviewed on an annual basis and where evaluations indicate that there are ineffective members, they should be replaced. Succession planning for senior staff is an expected part of the board member role. Which brings us to …

Key individual risk

Huang is the epitome of a key individual. He is thought to be largely responsible for the success of Nvidia, which throws a wrench in the works if he were to be terminated as the result of disciplinary action. That exposure is sharper at Nvidia than at most companies: Huang reportedly has as many as 60 direct reports, an unusually flat setup and no apparent successor, which points to thin succession planning at the very top.

Operational risks don’t always fall under compliance, but it is entirely within the realm of reason for compliance officers to include business continuity prompts in risk assessment exercises to nudge them to surface if the board hasn’t done a good job of working on this.

The Nvidia case is an extreme one in that a future CEO’s misconduct is less likely to have the possible spy component to it, but it does raise questions that every compliance officer should spend time considering, because they could theoretically happen in your organization. Take, for example, a potentially well-intentioned but tone-deaf communication from your CEO, which seems to happen with some regularity across industries. The lessons are broadly applicable: There may be some governance risks that we don’t necessarily own or have a great deal of control over in compliance, but there are some steps we can take to better preserve independence and protect ourselves and our organizations.

The post The Spy Who Loved Me: The Nvidia Scandal’s Lessons on CEO Risk appeared first on Corporate Compliance Insights.

Many boards have read this administration’s FCPA pullback as proof that enforcement risk has eased and compliance spending can ease with it. Michael Volkov, a compliance expert and attorney, calls that a dangerous misread: the Justice Department has reallocated its enforcement energy, not retreated, toward healthcare, procurement, tax and trade fraud — areas that touch far more companies than the FCPA ever did. Cut compliance now, he argues, and you see less just as the government sees more.

Every few years, someone in the C-suite stumbles over the fact that compliance is overhead. I have watched this movie before, and I know how it ends. Right now, the sequel is playing across corporate America. Compliance budgets are being flattened or trimmed, headcount is being “optimized,” chief compliance officers are being moved further from the executive suite, and programs built over a decade are being described as overhead to be right-sized.

The pitch goes like this: Compliance produces no revenue, the enforcement environment has eased, and a leaner team can do the same work with better tools. Some of those points have a grain of truth. Technology can make compliance more efficient. But the underlying premise, that compliance is overhead to be minimized, is wrong. 

Let’s face it: If anyone still needs convincing, the Bank of America penalties announced Oct. 13 should end the conversation, as they show with unusual clarity what happens when compliance is present on the org chart but absent from the decisions that matter.

6 million reasons to overrule compliance

On Oct. 13, three regulators announced coordinated actions against Bank of America. FinCEN assessed a $1.2 billion civil penalty in a consent order in which the bank admitted to willfully violating the Bank Secrecy Act. The order found that the bank failed to maintain an adequate AML program, failed to file suspicious activity reports and failed to address national security risks tied to Chinese money laundering networks and illicit finance along the southwest border. The OCC imposed a $750 million penalty for the same deficient program, credited against FinCEN’s, and OFAC added an $11.6 million settlement for apparent violations of sanctions programs covering Iran, Russia, narcotics trafficking and terrorism. The violations stretched from 2018 into 2025.

This is not a story of a bank with no compliance function. Bank of America had one, and by FinCEN’s account that function did much of its job. In July 2022, compliance personnel identified that a customer relationship, an online auto auction business, carried too much risk and no evident way to control it, and they recommended closing the accounts. Investigators documented well over a hundred cases tied to that single customer. Internal testing repeatedly showed that the bank’s primary monitoring system was missing suspicious activity.

What failed was not the ability of compliance to see but the ability of compliance to act. The relationship team argued that the client was important, citing about $6 million in annual revenue and that a closure would be detrimental. A mitigation plan replaced the closure, and the customer kept processing payments until June 2025. When a test of the monitoring system produced a result senior leadership did not like, the head of financial crimes had the test repeated. The second test declared the system was “working as intended.” FinCEN disagreed.

Now do the arithmetic. FinCEN concluded that the bank had likely saved hundreds of millions of dollars in compliance spending while the problems persisted. Fixing them is expected to require roughly 750 additional staff, plus 800 consultants for a one-time lookback, and that lookback alone turned up nearly 8,900 suspicious activity reports that should have been filed. The bank has announced a $1.2 billion charge for the resulting penalties. That figure does not count the cost of the lookback, the independent reviews, the ongoing regulatory orders, management time, the reputational damage or whatever else may follow. Saving money on compliance in this way was not saving. It was borrowing, at a punishing rate of interest, from the future.

The BoA affair has drawn headlines, understandably, but the same lesson appears at the other end of the scale. A 12-person freight forwarder, Pegasus Worldwide Logistics, paid $175,015 to OFAC over a $5,950 machine because its screening was late and looked only at a name. A better screening process would have cost a fraction of the penalty, the remediation program and the continuing reporting obligations now imposed on the company. The proportions differ, but the logic is identical.

And penalties are only the visible cost. The less-visible costs often exceed them: investigation expense, monitorships, lost business, debarment risk, higher cost of capital, executive turnover, shareholder claims and lost trust.

Opinion

No US Person, No Dollars, Still Sanctioned: Exploring Treasury’s Evolving Approach on Iran

by Michael Volkov

October 2, 2026

Waves of OFAC actions have redrawn Iran-related exposure for aviation, shipping, digital assets, gold & tech

Read moreDetails

What good is a compliance function that can’t say no?

The unique value of compliance is perspective. A compliance function sees across business lines, products, geographies and customers in a way no single business unit can. It sees the pattern in the hotline reports, the correlation between a customer’s alerts and a sales team’s revenue and the same control weakness showing up in three divisions. That line of sight is what lets a company catch a problem while it is still small.

Line of sight, though, depends on access and on authority. Compliance needs access to transactions, data and decision meetings. It needs the ability to ask questions and get answers. And it needs the authority to hold or stop a transaction or relationship when the risk is not controlled. Every one of those capabilities erodes when a company treats compliance as a cost to minimize. Budgets that shrink the monitoring team reduce what the function can see. Reporting lines that bury the CCO several layers down reduce who hears the warning. And a culture in which business leaders can overrule or route around compliance without consequence reduces what the warning is worth.

The most common failure I see is not an absence of compliance but an absence of stature. Look at what FinCEN, the OCC and OFAC actually emphasized. They did not penalize the bank for the absence of policies. They penalized the gap between what the bank knew and what it did. They cited internal reports that identified miscalibration years before any regulator did and employees who raised concerns.

The strongest business leaders have always understood that the opposite is also true. Reputation, trust and the quality of internal controls are intangible assets, and in most modern companies, intangible assets are a large and growing share of enterprise value. Good controls prevent loss and fraud. A reliable speak-up system surfaces issues when they are cheap to fix. Investments that protect those assets are not costs in any meaningful sense.

Don’t read the FCPA pause as a permission slip

Even leaders who accept all of this tend to fall back on one last argument: Fine, but the government has stepped back, so the risk has stepped back too. This dangerous misreading has taken hold in many boardrooms. Because the current administration paused and narrowed FCPA enforcement, the argument goes, enforcement risk in general has dropped, and compliance spending can drop with it. That reasoning confuses one statute with the whole landscape.

The June 2025 guidance from then-Deputy Attorney General Todd Blanche directed prosecutors to focus foreign bribery cases on matters like payments connected to cartels and transnational criminal organizations and conduct that threatens national security. That is a narrower FCPA, not an abandonment of the statute. And the enforcement energy has not disappeared; it has been reassigned.

In April, the Justice Department stood up a new National Fraud Enforcement Division (NFED), and Oct. 1 that division issued a directive naming four priority categories for corporate investigations: healthcare fraud, government procurement and contracts fraud, tax and revenue evasion, and trade fraud, including tariff evasion and forced labor. The False Claims Act has become a primary vehicle for customs cases. OFAC, BIS and the Justice Department continue to bring sanctions and export control cases. And FinCEN framed its Bank of America order around Chinese money laundering networks and illicit finance along the southwest border.

Put together, the pattern is not retreat. It is a reallocation toward areas where the political and security rationale is strongest, and those priorities touch a far wider range of companies than the FCPA traditionally did. 

The tools to find problems have also improved. The NFED directive points to data analytics through a national fraud detection center and instructs prosecutors to build whistleblower incentives that reach even insiders who took part in the conduct. A company that cuts compliance may be reducing its ability to detect problems at precisely the moment the government’s ability to detect them is increasing.

If you are a compliance officer facing pressure to cut, make the argument in the language leadership uses:

• Quantify exposure, not activity. Instead of training completion rates, show what a customs misclassification, a sanctions miss or a monitoring gap would cost at your scale.
• Use the peer record. The Bank of America order is a well-documented case study of what saving on compliance costs, as the government itself characterized it.
• Show the efficiency story. Modernizing, automating and prioritizing by risk is a better answer than across-the-board cuts, as long as it is validated.
• Establish red lines. Be explicit about the functions that cannot be cut without increasing risk beyond tolerance, and ask leadership to accept that risk in writing if they proceed.

Boards, for their part, should ask a blunt question: In the past two years, how many times has compliance recommended against something, and what happened? If the answer is “never,” that is not reassurance; it is a warning that compliance is not being asked or not being heard. If the answer is “often, and the business overrode it,” the board should want to see every instance.

Bank of America’s own people told it what was wrong in writing for years. Any company tempted to trim compliance should first ask whether its compliance officers could stop something if they needed to. And it should remember that rebuilding a program after a failure is always more expensive than maintaining one.

This article was adapted with permission from a three-part series published on the Volkov Law Blog (part I, part II, part III).

The post Stop Calling Compliance a Cost Center appeared first on Corporate Compliance Insights.

The use of AI in the workplace can increase compliance and legal risk for employers, says Gillian McKean Bidgood of Polsinelli. As she writes, prepare now or find out in court later.

Since 2023, polls have reflected a steady increase in the number of people reporting that they use AI at work. Polls also consistently indicate that some of the highest use of AI is among company leaders. 

These trends present employers with a variety of legal risks and litigation difficulties. 

The intellectual property and employment law risks should be considered in deciding what uses to allow and in creating AI governance policies. AI evidence impacts investigation and discovery, but companies can implement steps to prepare.

Intellectual property risks

It is well-recognized that some of the most significant legal risks connected with employee AI use relate to intellectual property rights. Employees can disclose trade secrets and interfere with patent, copyright or trademark efforts by uploading materials into AI tools. 

Disclosure by uploading information into AI that is not sufficiently limited can risk breaches of compliance obligations, violate privacy rights, and violate confidentiality agreements. Moreover, incorporation of AI-generated material into work products can compromise the ability to protect the materials under intellectual property law. 

In recognition of those risks, companies are investing significantly in closed enterprise AI tools. Further, surveys reflect that the vast majority of companies have adopted policies governing which AI will be used and establishing parameters for employee AI use. However, these efforts are potentially countered by the significant number of employees admitting to use of shadow AI, or use cases and tools not sanctioned by the employer.

Compliance

Compliance & Risk Lessons From AI’s Unruly Summer

by Diana Lyn Curtis Shutzer and Nicholas Solosky

November 2, 2026

The past several months have seen Anthropic go dark & OpenAI’s models slip into Hugging Face’s systems, signaling that AI risk is increasingly fluid

Read moreDetails

Employment-law risks

An employee could use AI in a variety of ways that could violate employment laws. For example, a hiring manager could use an AI tool to make hiring decisions in violation of laws prohibiting use of AI in employment decisions or in violation of notice, validation and recordkeeping obligations established by laws against algorithmic discrimination.

Notably, leaders are using AI to role play critical conversations with employees and get advice on how to manage a particular employee. Such uses can happen quickly and without intentional implementation by an employer, increasing the risk of noncompliance with algorithmic discrimination and other employment laws when the chat leads to adverse employment actions or other actions potentially creating liability. Further, even if employment laws are complied with, such uses could create records that could be relevant to internal investigations or employment disputes. Specifically, the prompts and conversations could be sought after as potential evidence of the leader’s intentions or motivations.

Courts have already addressed discovery disputes concerning AI interactions. Those courts have treated AI interactions as subject to discovery just like any other business record. Some employers may not wish for leaders to use AI for such purposes because the materials might be misinterpreted. For example, a supervisor could prompt an AI tool to draft disciplinary talking points and specify that the points must not sound retaliatory. The supervisor may have generated the prompt based on HR training about the risk of retaliation claims from employees. However, opposing counsel might interpret the prompt as evidence that the supervisor was retaliating and was seeking help escaping liability. Resolving those differing interpretations could be difficult and make it difficult to resolve a dispute.

In some cases, leaders may ask AI for legal analysis. Unlike communications with legal counsel, those interactions are unlikely to be protected by attorney-client privilege if sought in discovery. However, the chat and the actions that the leader takes after the chat could reveal underlying motivations and the leader’s understanding.

Additional risks arise from the use of AI notetakers or transcribers in meetings and investigations. Errors in the product generated by these tools could lead to legal claims based on either the contents of the AI work product or decisions made in reliance on the AI-generated materials. Although they are often implemented in order to increase efficiency or in hopes of creating more neutral records of the discussions, the AI-generated materials may create new risks or generate undesirable records.

However, if a company deletes AI generated material because the material is harmful to the employer’s position, the destruction could subject the employer to a request for sanctions for spoliation of evidence. Also important, the recording of the conversation that the AI tool uses to create the material could be stored by the vendor outside of the control of the employer and therefore would survive the deletion of the AI generated material. While many vendors assure users that such recordings are destroyed, an employer’s ability to confirm destruction is limited. This means that even if an AI generated summary does not include content from the conversation that could be problematic for the employer, there is a risk that the recording itself could be obtained and would include the problematic content. Accordingly, a company that wishes to avoid recordings of all or certain conversations must prevent the use of notetakers and summarizers in those conversations.

The use of agentic or autonomous AI in company operations also poses employment risks. For example, AI trained under a particular state’s law to request documentation when a sick leave request is submitted could violate another state’s prohibition on requesting such documentation. Additionally, employers could face employment law risks if agentic AI is used to assign work to employees without human oversight and sufficient information about important matters like employee accommodations for disabilities or workflow changes necessitated by an employee harassment complaint.

Access & discovery

Companies have a variety of strategies available to prepare for AI in investigation and discovery. Many AI tools have features permitting either administrators or users to retrieve prompts and histories. Some tools, however, require that such functions be activated prior to the interactions to be retrieved. In the event that an employer does not activate the function prior to the interactions at issue, the information may not be accessible, at least without assistance from the vendor, either voluntarily or under subpoena.

Similarly, incomplete adherence to AI governance policies and shadow AI can create significant obstacles to companies in ensuring that they are able to access AI interactions for investigation or discovery. That is, an employee could use an unsanctioned AI tool that does not have a retention period that matches company and legal requirements. Further, shadow AI use often involves use of personal accounts. In those cases, the employer would be required to obtain the information from the employee voluntarily or via subpoena. Employers should also be aware that even sanctioned AI tools may permit users to delete histories, exposing companies to the risk of missing records or spoliation accusations.

To address these issues, vendors have created AI monitoring tools that can capture prompts and uploads in AI tools. While these tools increase the likelihood of capturing AI interactions, shadow AI usage that does not occur on a company device still would not be captured.

In addition to technical tools, employers are evaluating revising litigation holds to specifically refer to preservation of AI interactions. Additionally, employers are considering revising employee agreements to prohibit use of non-enterprise AI without permission and confidentiality agreements to prohibit uploading confidential and other sensitive information into non-enterprise AI. Further, employers are evaluating whether AI governance policies adequately establish retention settings and data accessibility requirements that must be retained for authorized tools.

What companies can do

AI use among employees and especially leaders poses intellectual property and employment law risks for companies. Companies can address these risks by clearly delineating which uses are permitted and monitoring for Shadow AI usage, and companies can prepare for the increased importance of accessing AI interactions by ensuring that the tools in use have sufficient retention periods, allow efficient access and only retain the intended materials.

The post AI Is Prompting New Legal Risks in the Workplace appeared first on Corporate Compliance Insights.

New products & platforms

Diligent, a GRC solutions provider, launched its BIS50 dataset in anticipation of the return of the Bureau of Industry and Security (BIS) affiliates rule, often called the 50% rule, which will help search out ownership information through AI search capabilities and human validation.

Protea Consultancy unveiled Scope, a contract risk analysis platform for businesses operating across energy, engineering and construction that will use Protea’s expertise and AI to identify risks, obligations, gaps and commercial exposure.

Partnerships & integrations

Mano Bank has partnered with Lithuanian regtech company AMLYZE for its anti-money laundering and compliance automation solutions.

Consultancy Horváth and GRC platform SANNOS AI announced a partnership combining Horváth’s consulting and transformation expertise with SANNOS AI’s control testing and compliance automation starting with financial controls.

Eventus, a trade surveillance and financial risk solutions provider, and Synova Global, an exchange-as-a-service company, announced that Synova will use the Eventus Validus platform as part of its exchange infrastructure offering for the markets it introduces.

ThirdEye, an AML solution, selected ID-Pal, an identity verification and compliance company, for its Know Your Customer and Know Your Business functions in Australia and New Zealand. 

Personnel

LogicGate appointed Steve Smith as managing director of EMEA and Amanda Meglemre as general counsel.

Governance platform OneTrust announced that Kimberly Paine joined as chief legal officer, Jim Monroe was promoted to chief operating officer and Tim Mullen was promoted to chief information officer.

The post GRC Business Roundup: OneTrust, Diligent, Eventus, LogicGate, AMLYZE & More appeared first on Corporate Compliance Insights.

US drops spending on AML compliance by 10%

The US saw a decline in AML compliance spending of more than 10% between 2024 and 2025 while less money was laundered in the country, a study by Napier AI found.

Analyzing money laundering and GDP data from GlobalData, the United Nations Office on Drugs and Crime and the Organisation for Economic Co-Operation and Development, the study concluded that the US decreased spending on AML compliance from $67 billion in 2024 to $60 billion in 2025, a decline of about 10%. 

Less spending on financial crime compliance didn’t amount to more illegal activity, according to the study. The US got more effective at combating money laundering, the study suggests. Napier reported that about $658 billion was lost to money laundering in the US in 2025, down from about $700 billion in 2024. That $658 billion represented about 2.1% of America’s 2025 GDP, while in 2024 the approximate $700 billion laundered amounted to roughly 2.5% of GDP. 

By way of comparison, in 2025, China saw $689 billion laundered, about 3.5% of its GDP, the report found. Russia had $278 billion laundered, roughly 11% of its GDP, while the UK had $207 billion laundered or 5.2% of its GDP. 

Napier AI estimated that about $5.1 trillion, or 4.3% of global GDP, is laundered annually worldwide, down 3.8% from $5.3 trillion in the previous edition of its index — the first decline it has recorded.

Majority of negotiators are using AI to complete contracts

More than half of negotiators are using AI to come to contract terms, according to a survey by the Commerce & Contract Management Institute.

The survey of 1,344 negotiators found that 56% are using AI to support some aspect of negotiations. More than four in five (82%) said they’re using the technology in contract review, redlining and risk identification, while 74% are drafting contracts or generating clauses with AI. About two-thirds (64%) use the technology for negotiation support like recommendations and reviewing scenarios, and AI assists 55% with pre-negotiation and strategy planning.

The survey found that 39% reported that AI improved efficiency but had limited impact on the outcome of the negotiations. About a quarter (23%) said the technology provided moderate improvements on efficiency and outcomes while 18% reported significant improvements in those areas. 

Where AI hasn’t been helpful, according to the respondents, is identifying the disputes during contract talks. More than three-quarters (78%) said that AI hadn’t helped them identify which terms are most negotiated, while the remaining 22% said the technology had helped them identify these terms.

Organizations rank AI miscalculation as a top risk

Miscalculating AI strategy now ranks as a top risk for organizations, according to Gartner.

A Gartner survey of 308 enterprise risk management leaders, auditors and senior executives asked them to rank emerging risks. AI strategy miscalculation, a risk new to Gartner’s list this quarter, debuted at No. 3.

Organizations are worried that they’ll make major strategic, operational or workforce decisions based on anticipated AI benefits that fail to materialize. Gartner said the risk stems from competitive pressure to keep pace on AI, organizations underestimating the operational, cultural and governance changes needed to realize AI’s benefits and rising, uncertain AI costs.

AI-driven competitive displacement, also new to the list, came in at No. 4. Organizations are concerned that AI may enable new entrants, business models or customer solutions that displace an organization’s traditional value proposition, leading to strategic erosion, attrition or competitive disadvantage.

The top-ranked risk in the survey is AI discovery of cyber vulnerabilities, followed by geopolitical energy supply shocks. AI also bookends the top five, with an AI workforce preparedness gap being a top concern of enterprise risk management leaders. Gartner flagged both AI strategy miscalculation and the workforce preparedness gap as potential blind spots: risks that scored high but are getting relatively little attention from organizations.

The post AML Compliance Spending Dips in US appeared first on Corporate Compliance Insights.

Corruption moves faster than diligence teams. This is a structural challenge for institutions worldwide as financial engineering grows more sophisticated, business professor Marvin Starominski-Uehara writes. The case of Daniel Vorcaro and Banco Master in Brazil is a reminder that defending people with direct ties to allegations of corruption is a tough check to cash.

In November 2025, Brazil’s Federal Police arrested Daniel Vorcaro, founder and one-time president of Banco Master at São Paulo’s Guarulhos airport as he tried to board a private jet to Dubai. He was released and arrested again in March 2026. The investigation that followed claims to have exposed one of Brazil’s largest financial frauds. 

It comprises $8.6 billion in fabricated carbon credits from public Amazon lands and $2.2 billion in diverted funds from Brazil’s State Bank (BRB) through phantom credit portfolios, according to reports. It has also drawn in Brazil’s Central Bank (BC), Supreme Court justices, the prosecutor-general and the leaders of both houses of Congress of the South American country.

For compliance and anti-corruption professionals, the question is less about the political fallout and more about what a proper due diligence review would have turned up. The warning signs were visible, showing why seeing them is not enough and what integrity programs should do differently. Six red flags stood out before the collapse.

Red flags

Returns far above the market

Banco Master promised returns far above the Interbank Deposit Certificate (CDI), in some cases reaching 140%, well beyond what the rest of the market paid, Forbes reported. A return that far above peers implies either outsized risk or an undisclosed source of profit and diligence should have asked which.

Assets don’t withstand basic questions

Through Alliance Participações, a company controlled by Vorcaro’s father and sister, the family acquired rights to carbon credits from Fazenda Floresta Amazônica in Apuí, according to a report by Folha, a São Paulo news organization. The 143,900-hectare territory belonged to the federal government and had been set aside for agrarian reform. The report said that between 2020 and 2024, two shell companies, Global Carbon and Golden Green, inflated their valuations to $8.6 billion based entirely on theoretical carbon stock estimates from a São Paulo State University report using methods “never before applied in the market.” Not a single credit was ever sold, Folha reported.

Due diligence analysts should have asked who held legal title to the land and who was behind the valuation method. Both questions required asking about the asset itself and not about the paperwork around it.

Professional stamps standing for verification

By 2020, Global Carbon and Golden Green existed as shell companies with audited financials showing valuations in the billions of reais, even though they had conducted no legitimate business, Folha reported. When Alliance Participações formally joined the project in 2023, the Vorcaro family positioned itself behind corporate veils and intermediaries. According to the report, the inflated value then flowed into Banco Master’s books through investment funds managed by REAG Investimentos, which BC liquidated in January 2026. The funds created an illusion of solvency that let the bank sell certificates of deposit to investors, as reported by the press and investigators. Meanwhile, BRB bought billions of US dollars in non-existent credit portfolios.

Each calculated layer put more distance between the fraud’s origins and its financial payoff. Each carried a professional stamp, such as an auditor’s signature or a fund manager’s name that made the value look independently confirmed. But an audit opinion in this case was not asset verification, and a fund structure was not transparency into what the fund held.

A fast-moving deal

BRB’s reported transactions of non-existent credit portfolios show what happens when a deal gains speed faster than its red flags can be resolved. BRB’s president, Paulo Henrique Bezerra Costa, made Banco Master portfolio purchases despite relevant inconsistencies, according to reports by UOL and Reuters. Bezerra Costa led BRB from 2019 until November 2025, when he was removed. He was arrested in April 2026, and the federal police allege he received about $25 million in bribes, which he denies, CNN Brazil reported.

Treating this case only as institutional negligence, malfeasance or one allegedly corrupt executive misses a deeper problem. Prosecutors and regulators will read audits with the benefit of hindsight, so a known warning sign not resolved creates a perilous position for an auditor.

Featured

On Theranos & Holmes, We Can See Everything — the Fraud Is Still Clear

by Jennifer L. Gaskin

October 30, 2026

Nathan Fielder’s new documentary wants you to wonder whether Elizabeth Holmes merely thinks differently — too literal a mind to have knowingly lied. CCI editorial director Jennifer L. Gaskin isn’t buying it.

Read moreDetails

Proximity to officials sold as credibility

Through reports and authorities’ allegations, Vorcaro had sophisticated ways of hiding the truth and designed them to win institutional legitimacy. Counterparties outside his inner circle, regulators included, presumably could not see through these defenses in early encounters, and so probably trusted him and acted in good faith.

This is the dynamic compliance teams should expect and look out for — the illicit use of institutional association sometimes called reputation laundering. In Banco Master’s case, a sponsored legal forum in London appears to fit the pattern. Justices Alexandre de Moraes and Dias Toffoli, Prosecutor-General Paulo Gonet and federal police Director-General Andrei Rodrigues were among the participants at the April 2024 forum that coincided with a $640,000 whisky-tasting event organized by Vorcaro, Poder360 reported. 

Trusted intermediaries amplified the effect. Vorcaro gained access to President Luiz Inácio Lula da Silva through former finance minister Guido Mantega, entering the presidential palace for a meeting that included BC president-designate Gabriel Galípolo, according to UOL. Such introductions carry implicit endorsement. Whether Mantega understood Banco Master’s true condition remains unclear, but his involvement illustrates how allegedly corrupt actors can use social capital to get into decision-making circles and manufacture credibility. Messages also show lawyer Ciro Soares, a former Banco Master counsel, relaying contacts between Gonet and Vorcaro, including calls in March 2025, CNN Brazil reported. Gonet denies any friendship with Vorcaro.

For compliance officers, the lesson is that proximity to officials is what a bad actor sells, so it should be taken as a risk indicator, not a credential.

A banking license treated as a safety net

Banco Master was licensed, but holding a license did not shield its investors and counterparties who treated it as a safety net.

Eighteen pension funds had invested roughly $350 million in the Banco Master’s securities not covered by deposit insurance, according to UOL and Estadão. Mastercard, which was enforcing guarantees on debts within the Banco Master conglomerate, unexpectedly ended up holding stakes in BRB and the e-commerce firm Westwing, while Will Bank’s operations were suspended after Mastercard stopped accepting Will Bank cards to curb losses, and BC liquidated the bank, Folha and Tecnoblog reported. While questions had lingered about the central bank’s handling of Banco Master, in March 2026, Brazil’s Federal Court of Accounts concluded that there were no “improprieties, omissions or negligence” by the BC in managing the extrajudicial liquidation of Banco Master, according to TV Globo and G1.

The practical lesson is that regulatory status is an input to diligence, not a substitute for it. Companies that wait for regulators to act risk learning about a problem when everyone else does; that is, after the losses have landed.

Where corporate exposure lives

The federal police report documents a recurring pattern in which Vorcaro cultivated relationships across Brazil’s judiciary, executive and legislature. It reports several meetings between Vorcaro and Moraes and a contract of about $24 million with Moraes’ wife’s law firm, G1 reported. Police are also examining payments to the son of another justice, Nunes Marques, from a consultancy that received almost $1.3 million from Banco Master, according to reports. Justice Toffoli drew criticism and was the subject of a police report for alleged involvement with Vorcaro, reports said.

In the legislature, the Senate president called Vorcaro his “brother for life” on the day of his re-election, and the chamber president asked Vorcaro for guidance on a land purchase and carnival box seats, Poder360 and Globo’s Valor publication reported. Senator and recently defeated Brazilian presidential candidate Flávio Bolsonaro asked Vorcaro for about $25 million for a film about his father, according to Aos Fatos. All those mentioned in these reports deny wrongdoing.

Whatever the courts conclude about these officials, the channels are familiar to anti-corruption professionals: retaining the firms of officials’ relatives, paid travel and hospitality, sponsored events attended by officials and former officials acting as door-openers. Anti-corruption laws target exactly these channels because each can amount to an improper benefit or undue advantage. If a company’s partners or sponsored events show these features, the exposure does not stop at them.

What this means for diligence and compliance

Brazil’s Clean Company Act imposes strict civil and administrative liability on companies for acts against the public administration, so an effective integrity program is among the most important mitigating factors. Under the FCPA, “knowledge” can be established through high probability of obvious red flags.

Each red flag maps to a diligence step. Integrity officers should test whether returns are explainable, verify title and valuation of the underlying asset, look through audits and fund structures to what is actually held. Do not let deal speed outrun open questions, and treat access to officials as a risk indicator while treating regulatory status as an input, not a conclusion.

Vorcaro seems to have needed counterparties to believe his initial presentations. Corrupt actors will always know more about their schemes than diligence teams can discover in early encounters, so integrity programs should be designed around that asymmetry.

The post At Brazil’s Banco Master, the Red Flags Were Hiding in Plain Sight appeared first on Corporate Compliance Insights.