EU and G7 Russian diamond sanctions highlight a pattern the compliance community has seen again and again: regulators establishing requirements without prescribing verification methods, leaving technology vendors to define practical standards. CCI contributing writer Gordon Feller examines the benefits and risks of outsourcing compliance infrastructure through the prism of the diamond industry.

When the European Union and the G7 sanctioned Russian diamonds in January 2024, they followed a script that is becoming familiar across regulated industries. 

In this case, importers of qualifying polished diamonds must now file a due diligence statement attesting non-Russian origin. But the rules stop there. No single verification method is mandated, no government agency is empowered to check the claims, and no unified registry exists that could confirm diamond origins.

Into that vacuum has flowed a stream of private technology companies, each proposing itself as the practical answer to what “compliant” actually means.

Compliance officers outside the jewelry trade will recognize the shape of this story even where the specifics are unfamiliar. The same pattern was seen with the growth of the consent-management platforms for GDPR, the reporting software built for the EU’s Corporate Sustainability Reporting Directive and the attestation tools financial firms use to document Sarbanes-Oxley (SOX) controls. 

A regulator writes a rule, leaves the mechanism unspecified and a commercial marketplace — usually backed by venture capital or private equity, competing for customers and answerable to investors rather than to the public — fills the gap. The practical effect, whether intended or not, is that the operative definition of “compliant” becomes delegated to vendors.

“The endgame is a unified digital registry,” Leanne Kemp, founder and CEO of Everledger and former Queensland chief entrepreneur said, predicting the regulatory focus on diamond origins will eventually expand to broader ESG disclosure for luxury goods. If she’s right, today’s vendor competition is really a competition to become tomorrow’s default infrastructure — with everything that implies about who ends up writing the rules.

Competing for what ‘compliant’ means

Regulators have acknowledged the tension between regulation and vendor solutions even as they lean on the private sector to build the plumbing. Patrick Armstrong, a senior official on financial innovation at the European Securities and Markets Authority, warned in a 2017 speech at a London regtech conference that regulatory technology can delegate tasks, not responsibility — the underlying obligation stays with the regulated firm no matter how much of the verification work gets handed to a vendor. That distinction is hard to enforce once dozens of platforms, each with its own methodology, are all calling themselves the solution.

The diamond trade makes the pattern unusually easy to see because the industry is small enough to watch the vendors compete in real time and because the compliance stakes — sanctions evasion, conflict financing — are stated in blunt terms rather than buried in regulatory footnotes.

The Gemological Institute of America, the industry’s dominant certification body, states plainly that the vacuum is not just regulatory but scientific. In a statement to CCI, the GIA said more than 50 years of research on diamonds has produced “no scientific method to determine a diamond’s country of origin with certainty by examining rough or polished diamonds.” Origin confirmation through “audited and verified documentation is at this time the best way to meet the demands of consumers and governments.” That’s another way of saying paper trails, not physics, currently decide the question regulators are asking. The GIA runs two origin services built on document review rather than direct measurement and has begun folding blockchain-sourced origin data from Tracr, a platform for tracing diamond origins, into its own grading reports.

Two camps have formed to fill the gap in diamond origin regulation, Kemp said: “producer-led ecosystems and independent verifiers.” She places Tracr and Sarine, a physical-mapping specialist that recently integrated with Tracr, in the first camp — “Tracr offers massive scale, while Sarine provides physical ‘DNA’ mapping of a diamond’s internal structure” — and positions her own company, alongside providers like iTraceIt, in the second. 

Wesley Tucker, Tracr’s recently retired CEO, argues that self-declaration alone can’t carry the weight regulators are placing on it: any traceability system, he said, “must go beyond self-declaration and toward deeper, technology-driven verification” if it’s going to hold up as “expectations around transparency continue to rise.” Tracr’s approach — matching diamond scans captured at the mine and again at the manufacturer with results logged to a blockchain — has produced more than a million rough-to-rough matches since the process opened to the wider industry in 2023, according to the company. Tracr is also, notably, migrating toward third-party equity ownership, a step it frames as strengthening its neutrality — an acknowledgment, even if unstated, that a for-profit gatekeeper’s credibility depends partly on distance from the industry it grades.

Governance

The Greenwashing Reckoning Isn’t About Marketing

by Sandhya Sabapathy

August 24, 2026

A bold public target and a cautious financial model can contradict each other inside the same annual report

Read moreDetails

Private or public sector answers

Whether that arrangement is good news or bad news is a question CCI’s readers are arguably better positioned to answer than most, since versions of it are showing up in their own vendor selections. There’s a real case for the private-sector answer, including that public agencies in much of the world simply lack the capacity, funding or technical expertise to build and run verification infrastructure themselves, and a competitive vendor market can move faster than any regulator. 

Edward Bankoloh Koroma, acting executive director of Transparency International Sierra Leone, has watched the alternative up close. His organization’s research found that diamond tracing “from the mines is challenged with corruption, transparency and accountability issues,” including mining compliance officers who accept bribes to under-report finds, and a national minerals agency too thinly staffed to monitor its own sites. Weak public capacity is exactly the vacuum private vendors say they can fill.

But there’s a counter-case, too. A regulator that outsources the definition of compliance to a handful of competing, investor-backed platforms has also outsourced the standard itself — and with it, some of the accountability that’s supposed to run back to the public. Angola’s diamond sector shows what can happen when weak state capacity meets a value chain captured by monied interests: decades of documented human-rights abuse tied to profits that, in an earlier era, helped fund a civil war. Of course, traceability technology alone doesn’t fix that; it depends on who controls the technology and who can audit it. A compliance officer evaluating any regtech vendor — in diamonds, in privacy, in ESG reporting — is implicitly making a judgment about whether that vendor’s incentives point toward rigor or toward retaining a paying customer. Which outcome is more likely for any given platform is a  live, unresolved argument, not a settled one, and compliance officers evaluating their vendors are right to keep asking it.

The EU’s own rules illustrate how thin the mandated mechanism actually is. Since March 2025, importers bringing mixed-origin rough diamonds into the EU for the first time have had to present a Kimberley Process certificate listing every country of origin in the shipment — a paper certificate, not a technological check. Diamonds already verified under the G7 scheme are exempt from that. Nothing in the regulation requires the scanning, matching or blockchain logging that companies like Tracr, Sarine and Everledger have built businesses around; the law asks for a documented attestation and leaves it to the market to decide how rigorous that attestation should be.

But no matter the rigor of the attestation to compliance from the market solutions for diamond importers or any other regulated businesses, it’s the companies that must face regulators.

“A firm can outsource the work. It cannot outsource the answer,” Lillian Freiberg, head of North America at Clarity AI, a financial intelligence, risk and regulatory reporting provider, told CCI. “When a regulator asks how a number was produced, ‘our provider calculated it’ has never been sufficient. The firms that hold up under examination are the ones that understood the methodology well enough to defend it as their own. The question in any vendor selection is not whether the tool is compliant. It is whether you can explain what it did.

“The consequences land on the company, not on the vendor. That is why the expertise behind the technology matters as much as the technology.”

That gap between what the rule requires and what the vendors sell is one that compliance professionals find themselves in the middle of, whatever their niche. The pressure in the diamond industry is just the latest example.

The post Who Defines Compliance When Regulators Leave SaaS-Shaped Gaps? appeared first on Corporate Compliance Insights.

A small cash gift at a client’s wedding is expected in some markets but would look suspiciously like bribery in others, while things like fraud are barred everywhere. A reader in compliance, watching global consensus fray, asks how far standards should bend to local custom. Ask an Ethicist columnist Vera Cherepanova answers by way of idealism, relativism and the pluralist ground between.

“I work in compliance for a global company headquartered in Western Europe. Lately, employees across the organization have been asking me why we should follow the same ethical standards everywhere when countries, cultures and expectations are pulling further apart. I guess they just see what we all see — that global consensus is vanishing. Our global policies haven’t always matched local norms in some of the markets where we operate. Gifts and favoritism are the first examples that come to mind. My question is: How far should compliance bend to local expectations now, if at all?”— Name withheld

What a great, perennial question — and one of the oldest in philosophy, by the way. Let me tackle it with a mix of theory, history and practice.

At an individual level, moral judgments are broadly guided by either an idealistic or relativistic orientation, or some combination of the two. Idealistic and relativistic orientations then further guide the specific ethical reasoning approaches that people apply in their ethical-decision-making processes.

Idealism, or monism in its stronger form, is the moral belief that ethics are universally applicable regardless of culture or conditions. In other words, idealists believe that certain conduct is always unethical or immoral regardless of where, when and why it occurs.

Idealism is an attractive philosophy because of its simple application. For the idealist, a particular behavior is either morally or ethically permissible, or it is not. Certain restrictions on women’s rights in Saudi Arabia, for example, are immoral and unethical for the idealist who believes that discrimination based on gender is never permissible.

For many, idealism is unattractive because of its rigidity. It may be, for example, that a significant part of Saudi Arabia’s population supports certain restrictions on women’s rights in order to preserve the country’s ancient religious traditions.

Cultural imperialism is one variant of idealism. It implies that one’s national and cultural code of conduct and moral principles are superior to all others. Nations throughout history — including the ancient Roman Empire and the British Empire — have practiced cultural imperialism. There are more recent examples, too. But, in fact, one culture’s highest ethical principle may mean nothing to another culture, as the example of women in Saudi society shows. What is sometimes justified by benevolent-seeming ideas of education, civilization and modernization may be just one group trying to impose the vision of what is right and good on the other.

That brings us to another important dimension — time. When European explorers went out into the world in the 16th and 17th centuries, they found that, wherever they went, people danced around campfires, had rituals that bonded groups together and played beat-heavy music. Perhaps these practices are simply human nature, but feudal systems were also pretty common at the time. 

Clearly, human societies vary and have evolved following different paths.

Unlike idealists, relativists do not believe that morals and ethics are universally applicable. Instead, they believe morals and ethics vary between cultures. The relativistic point of view says there is no absolute right or wrong. Ethical principles are therefore relative to cultural and social realities people live in.

Relativists may argue that free-market economies should refrain from imposing their model on communist countries, if this is what citizens want. Idealists, on the other hand, may argue that free-market economies are the most productive and should be imposed on all countries regardless.

There is some appeal in relativism: It teaches us to approach other cultures with some humility before assuming that the way we do things is obviously the right one. I see plenty of people attracted to this “progressive” idea, partly because there is so much intolerance masquerading as tolerance or moral clarity these days.

But taken to its logical extreme, relativism becomes untenable as well. If everything can be justified because “that is their culture” or “those were different times,” then eventually anything goes.

There is, of course, a much-needed middle ground between idealism and relativism.

Pluralism posits there may be multiple legitimate moral values and moral orders, emerging both from human nature and from the societies we build. There may therefore be more than one ethical way to approach the same problem. That flexibility seems particularly apt for multinational businesses.

For example, companies generally have global zero-tolerance policies toward fraud or sexual harassment. Such a prohibition is derived from idealism since the ban on these two types of conduct is universal throughout the company.

On the other hand, the policy toward salespeople offering gifts to clients may vary based on geography. For instance, salespeople based in the US may be prohibited from offering cash gifts to potential clients, since this could be construed as bribery. Meanwhile, the same company’s sales team in parts of Asia may be permitted, based on appropriate guidelines and policies, to give small cash gifts when attending the weddings of customers or clients, because such cash gifts are an integral aspect of many Asian cultures. This variation in gift-giving policy is derived from relativism, since the policy is based on the ethical and moral principles of different cultures.

Seng-ts’an, a Chinese Buddhist philosopher, wrote that “the struggle between ‘for’ and ‘against’ is the mind’s worst disease.” Put another way, in my loose interpretation, failure to see nuance is often not a sign of moral clarity but evidence of oversimplification and a lack of thought.

What makes your question particularly worthwhile to ponder is that the old philosophical problem is suddenly of interest outside the E&C geeks’ bubble. Now we want machines to align with human values, although, as we’ve just seen, we have never agreed on what those universal values are, and for good reason.

But we are somehow expected to take thousands of years of disagreement over idealism, relativism, competing moral goods and cultural differences and turn them into something sufficiently precise that a machine can use it as a reference point.

“We need wisdom to figure out how to even think about alignment that, in my view, Silicon Valley does not have,” David Robinson, who recently resigned from OpenAI after working on its safety efforts, said on a recent podcast.

I am not sure if people in Silicon Valley are reading this column, but if they are, here’s what I’d suggest they meditate on: The perennial global vs. local question has no clear-cut answer, but as some countries are racing ahead in AI efforts and others are lagging behind, the risk of yet another wave of cultural imperialism is accelerating. “Global” shouldn’t mean exporting every preference of headquarters — or a frontier lab — and calling it an ethical standard. And “local” can’t mean treating every practice as acceptable only because it is accepted locally.

Someone at some point will ultimately have to do the job of deciding what belongs in the non-negotiables and what can legitimately vary. In the world of potent machines and vanishing global consensus, as you rightly said, knowing what not to relativize and what not to universalize might be the most required ethical skill.

Ethics

Business Ethics Is a Discipline, Not a Disposition

by Vera Cherepanova

September 23, 2026

What does a board director need beyond a moral character? Plenty, writes Ask an Ethicist columnist Vera Cherepanova, who says we should start with understanding the roles business leaders play in society.

Read moreDetails

Readers respond

The previous question came from a board director wondering what can be required of a board when it comes to business ethics, on top of personal integrity and good character. The dilemma revolved around the fact that ethical performance of a leader — a board director or a CEO —  cannot be a function of whether they are kind, nice or morally sincere. With vast amounts of influence and decisions affecting others in disproportionate ways, understanding the ethical obligations created by the power and discretion their roles give them is a must.

In my response, I noted: “Personal integrity is certainly a baseline for directors, as it is for all good human beings, but something tells me it is not sufficient for the governance process. Why?

“Apart from being squarely naïve, the idea that if we get business leaders to be better people or to more sincerely commit to moral values underplays the social, economic, and political influence that businesses have in society and the problems that come from either a cynical or benevolent use of that influence.

“A ‘good person’ CEO can still preside over a harmful business model. A well-intentioned board can still make poor decisions if it lacks the right processes, information, challenge and understanding of its role.” Read the full column here.

“All board members of public companies have a fiduciary duty to the shareholders, the employees, the vendors, and the customers. They have a duty of care. All directors of public companies must pass an FBI background check for any criminal activity. It’s a “given.’ You cannot serve if you are unethical.” — KC

Have a response? Share your feedback on what I got right (or wrong). Send me your comments or questions.

The post When in Rome? The Risks of Ethics & Compliance Bending to Local Norms appeared first on Corporate Compliance Insights.

The people supporting an AI service can gain access, authority or a larger role without a new model release. Vendor monitoring needs to see those changes, too, writes regulatory adviser Maja Kurek.

On Sept. 22, Reuters reported that Meta had been testing a “human concierge” for its Muse AI agent. Contractors were handling some of the phone calls requested through the agent. Employees raised privacy concerns. A Meta vice president acknowledged internally that starting contractor-placed calls without proper disclosure had been “a miss” and said the feature had been rolled back for now. The feature was being tested internally with Meta employees, not enterprise customers. But it raises a question for companies buying AI-enabled services: What can change even when the vendor and model version do not?

For a chief compliance officer, audit executive or third-party risk lead, the practical question is whether today’s service still matches the facts that mattered when it was approved. Most staffing changes at an AI vendor will not change that answer.

For several years, I was responsible for the end-to-end experience of a global network of more than 10,000 external mathematics experts who formed the human layer of an AI-powered learning product. When that network moved to a new provider, data protection, access controls, payment security and operational continuity had to hold through the handoff. The questions concerned who could access which information, where responsibilities had moved and how work and payments would continue. An expert network is not the same as an enterprise AI vendor, but that experience taught me to track the role, not the roster.

A model-change notice does not catch every service change

A contractual right to be told when an AI vendor changes its model is worth having. In a recent CCI article on bank AI governance, Elaine F. Duffus and Aoife May listed it among the vendor terms to consider. A model release, however, is only one way an approved service can change.

Suppose that, when a service was approved, an external reviewer sampled redacted outputs. Six months later, people in that role are resolving customer cases using full records. The vendor and model version are unchanged, but access has expanded and authority may have changed. The organization may need different privacy, security or customer-protection controls.

This does not mean tracking every person who joins or leaves the vendor’s workforce. Staff turnover is normal. Initial vendor diligence establishes whether a service is acceptable to use. After approval, the task is to notice when the facts behind that decision stop being true.

A Gartner survey of third-party relationship owners found that when they observed a change in the scope of a relationship, only 52% reliably shared it with compliance. Relationship owners are often the first people inside an organization to see that something has changed. They may not know which changes matter to the control function.

“Tell us if anything changes” is therefore a weak monitoring instruction. Give the business owner a more concrete trigger.

Put four facts about the role in the approval record

NIST’s AI risk management framework playbook, under MANAGE 3.1, calls for regular monitoring of third-party AI risks. It also notes that documenting the technologies, personnel and other resources used can help manage those risks. It does not say which facts about personnel to keep.

For an external human role that materially supports an AI service, I would record four facts at approval.

• Function and authority: Does the role sample outputs, resolve exceptions, moderate content, complete tasks the AI cannot or communicate with customers? Can the person advise only, or can they approve, send, pay or otherwise act? “Human oversight” is too broad a label to preserve that distinction.
• Access: Record what the role can see. Redacted output and a full customer file are not the same risk simply because both sit behind the same model.
• Delivery: Does the vendor provide the role directly, or does it use another provider? Record any part of that arrangement that matters to data flows, contractual protections or dependence on that provider. There is no need to assess every downstream worker.
• Reliance: How much does delivery of the service depend on this role? Human involvement is not itself a weakness, and occasional help is different from relying on people for a significant share of the work. Frequency alone does not settle it: A role can be critical even if it handles only a few cases. Vendors also have reasons to lean on people. According to Reuters, a Meta executive wrote that some tests suggested having humans place the calls could raise their success rate to 95% to 98%, above AI-only calling.

Ask the vendor to confirm these facts in writing. For higher-risk services, agree what evidence will support later checks, such as updated role descriptions, access-control summaries or relevant assurance reports covering the service you use. If the vendor cannot confirm a material fact, document the gap and send it to the relevant risk owner. Do not treat a missing answer as confirmation that nothing has changed.

For any change, ask: If this had been true on Day One, could it reasonably have changed the approval decision or the controls attached to it?

A change that does not meet that test can remain an operational matter. Otherwise, send it to the team responsible for the affected risk. Broader access belongs with privacy or security. New authority to act for a customer calls for legal review and a look at customer impact. If human support has become essential or moved to another provider, check business continuity and exit plans.

Usually, the organization can revisit the affected part of the approval rather than restart the entire vendor assessment.

Legal and procurement teams should compare the vendor’s notice obligations with these facts. Depending on how they are written, clauses about incidents, model releases or named subprocessors may miss changes in human roles. Agree which material changes need notice, rather than relying only on the vendor’s definition of a model update.

At periodic reviews, the business owner can ask whether any external role has gained materially broader access or authority, moved to a different delivery arrangement in a way that affects risk, or become significantly more important to service delivery. Check the answer against the agreed evidence.

I would keep this in the third-party risk, privacy, procurement or operational-risk process that already owns the decision and would not build a separate AI-governance workflow for it.

Give internal audit a mismatch it can test

The Institute of Internal Auditors’ third-party topical requirement took effect Sept. 15. When an internal audit function provides assurance on third-party risk, the requirement establishes a baseline for assessing third-party governance, risk management and control processes.

For an AI service selected for review, I would give internal audit two questions: Does the service delivered today still match the relevant facts recorded at approval? Where it does not, did the change reach the right owner and result in a documented decision?

Return to the earlier example. The approval record says an external role samples redacted outputs; the current service uses people in that role to resolve customer cases from full records. Internal audit can ask when the change occurred, who reviewed the new access and what the organization decided. It does not need to reverse-engineer the model or obtain the vendor’s workforce roster.

Meta’s employees could see the test from inside the company. An enterprise customer may never have that view. The approval record gives the organization something concrete to test: whether the service it is using today still matches the facts on which it was approved. The model version does not.

The post The Vendor’s AI Model Did Not Change. But Its Risk Did. appeared first on Corporate Compliance Insights.

The UN’s anti-corruption and compliance guide received its first revision since 2013, and it wisely notes that not every employee concern comes with the easy-to-understand label of “wrongdoing,” explains Giuseppe De Palo, a former UN ombuds and president of the Dialogue Through Conflict Foundation. Trust, confidentiality and retaliation protection are the foundation for good employee reporting, and add technology to the list.

Companies have spent years improving the channels through which employees can report wrongdoing. The new United Nations’ guidance suggests that the next challenge may come one step earlier: helping people understand what they are experiencing, what options they have, and where they should turn before they are ready to make a formal report.

The United Nations Office on Drugs and Crime and the UN Global Compact have just published the first full revision since 2013 of “An Anti-Corruption Ethics and Compliance Programme for Business: A Practical Guide.” One statistic explains why speak-up systems matter so much. In 2022, more than 40% of wrongdoing in companies was identified through whistle-blower reports, compared with less than 5% through internal controls.

But the guide does not stop at reporting channels. It emphasizes the conditions that make people willing to use them: trust, confidentiality, protection against retaliation and psychological safety. It notes that fear of retaliation is the main reason potential whistle-blowers, especially women, remain silent.

More interestingly, the guide recognizes that not every workplace concern arrives neatly labeled as “wrongdoing.”

Before the report

Reports involving discrimination or harassment, the guide observes, may be intertwined with conflicts inside teams or between managers and employees. In such cases, it can be difficult to know whether misconduct has occurred or whether communication problems and an underlying conflict contributed to the report. The guide therefore notes that companies with a proactive approach to conflict resolution and support functions such as ombuds, conflict-resolution teams and conflict-management training tend to handle these situations more effectively.

That distinction deserves more attention.

Whistle-blowing systems are, by design, built for the moment after an employee has concluded that something is wrong and is ready to report it. Yet, the harder moment often comes before that decision.

What exactly happened? Is this misconduct, a conflict, poor management or simply a difficult interaction? Is it serious enough to raise? Should I speak with my manager, HR, compliance or an ombuds? What happens if I do?

Organizations tend to build channels around institutional categories. Employees experience problems before they have categories.

For years, the usual answer was an open-door policy: managers, HR, compliance and ombuds offices made themselves available. But an open door is useful only after someone has decided which door to approach. For a remote employee, someone working across time zones, a person worried about retaliation or simply an employee who is unsure whether the issue warrants escalation, that threshold can remain surprisingly high.

Compliance

Marching Orders for DOJ’s Reshuffled Corporate Fraud Enforcers

by Jennifer L. Gaskin

October 7, 2026

Read moreDetails

Speak-up technology

Technology is beginning to change what is possible at this earlier stage.

Confidential digital conflict-management and ombuds tools can give employees a private place to understand an issue, explore possible responses and learn about available channels before deciding whether human intervention is necessary. They are not substitutes for investigators, HR professionals, compliance officers or human ombuds. Their value lies elsewhere: they can lower the threshold for seeking early guidance.

Our own experience developing such a tool illustrates the point. At one multilateral financial institution with an established professional ombuds office, employees interacted with the digital channel roughly 24 times for every direct contact with the human office. From 70 to 80%  of that use occurred outside normal working hours. Those interactions are not formal cases and should not be counted as such. But they suggest that substantial demand for early guidance may remain invisible when access requires an appointment, a telephone call or walking through someone’s door.

This matters particularly for smaller companies, geographically dispersed workforces and supply chains, where a staffed ombuds function may never have been economically realistic.

Will technology lag?

The UN Guide says that effective programs should be rooted in corporate culture, leadership commitment and accountability, not in controls alone. It also expressly places ombuds services among the mechanisms through which wrongdoing may come to light.

That should prompt a practical question for compliance leaders. If employees have a channel for reporting wrongdoing, what do they have before they are ready to use it?

For many companies, particularly smaller ones, the honest answer has long been very little that is confidential, independent and informal, because a staffed ombuds function was difficult to justify. That answer no longer holds. The tools exist, they have been tested in demanding institutions, and they cost a fraction of a staffed office. None of this makes them a legal requirement. But a company that endorses this guide and still offers its people no confidential place to turn before a concern becomes a report is no longer facing a constraint. It is making a choice, and it should be prepared to explain it.

In 1932, Judge Learned Hand held tug owners liable for failing to equip their tugs with radio receivers, even though doing so was not yet the practice of their industry. “A whole calling may have unduly lagged in the adoption of new and available devices,” he wrote. The next generation of speak-up systems may depend less on another reporting mechanism than on better pathways to the ones that already exist. The devices are available. The only question is how long the calling will lag.

The post Before Employees Speak Up: What the UN’s New Anti-Corruption Guide Gets Right appeared first on Corporate Compliance Insights.

A sudden departure from the general counsel’s office can leave compliance leaders exposed, investigations in limbo and regulatory strategy in flux. Chaka M. Patterson, a former corporate GC, explores how CCOs can prepare for the disruption and keep their programs on track when a critical ally exits.

Chief compliance officers (CCOs) often underappreciate the operational risk presented by a sudden vacancy in the general counsel (GC) seat. Safeguarding an enterprise requires a seamless, near-daily alignment between the legal and compliance functions. When the GC unexpectedly leaves, that critical alliance is disrupted, resulting in a vacuum that threatens to stall open investigations, obscure regulatory strategy and introduce friction into daily oversight.

A recent Russell Reynolds Associates analysis shows the scale of this instability. Just under half (43%) of Fortune 500 general counsel who departed in 2025 had served less than five years, up sharply from 17% in 2022. A third left within three years. External hires accounted for 78% of these early exits, and the leading cause was a cultural mismatch with the organization.

While many executive teams analyze these statistics from a board management or legal department stability perspective, there is a substantial negative impact on the compliance function as well. A GC’s short tenure directly threatens a CCO’s ability to execute their oversight mission. A leadership transition can paralyze joint workflows, disrupt established protocols on attorney-client privilege and force compliance executives to expend valuable time realigning a critical peer partnership.

Why the compliance function absorbs transition turbulence

What many executive leadership teams do not realize is that when a GC struggles in the legal leadership role, the compliance function often absorbs the consequences. Compliance programs rely on exactly what a leadership transition disrupts: stable executive sponsorship, predictable escalation pathways and a consistent tone at the top.

The first casualty is often the compliance mandate itself. A new GC may want to revisit previous risk assessments, question budget allocations or reopen whether legal or compliance is responsible for internal investigations. At the same time, the CCO may lose the legal partner needed to support difficult decisions before a matter reaches the board’s audit committee, just when the escalation path matters most.

Institutional memory suffers, too. The critical context behind past investigations, regulatory relationships and settled remediation commitments often leaves with the departing GC, putting the burden of historical continuity entirely on the CCO. Meanwhile, the new GC will quickly form a view of the compliance function. If that view frames compliance as an obstacle rather than a business enabler, the CCO will spend valuable time trying to correct the narrative.

Employees notice leadership instability. When the executives responsible for institutional integrity turn over frequently, workforce trust diminishes, and the reporting of misconduct may suffer. A speak-up culture that took years to build can erode in a matter of months.

Proactive transition management

Compliance leaders can insulate their function from transition shocks by taking four deliberate steps.

The first is to codify operational protocols. Many of the rules of engagement between legal and compliance exist only as informal agreements. CCOs should formalize protocols on investigation intake, board escalation thresholds and dispute resolution and secure written sign-off from both the current GC and the audit committee chair. A new GC should inherit a functioning institutional protocol rather than a series of handshake deals.

The second is to anchor institutional memory. An up-to-date dashboard of open matters, regulatory commitments, remediation deadlines and the rationale behind key program decisions preserves continuity during a transition and positions compliance at the center of the stabilization effort.

The third is to maintain role boundaries during the vacancy. A GC’s departure may create pressure for the CCO to answer questions that call for legal advice, particularly when the CEO needs a quick decision. The CCO should continue to identify compliance risks, coordinate the organization’s response and preserve established escalation paths, while ensuring that legal judgments are made by the interim GC, designated in-house counsel or outside counsel. Filling an operational gap should not quietly turn the CCO into the CEO’s substitute legal adviser.

The fourth is to execute a deliberate onboarding strategy. Within the first 30 days of a new GC’s tenure, the CCO should deliver a concise briefing on top enterprise risks, active investigations, board expectations and cultural indicators. This briefing is a chance to help the new GC understand how decisions are actually made in the organization and why. It can also build trust quickly. An incoming GC, particularly an external hire, may initially view a peer-level CCO with direct access to the CEO as a competing source of influence. The answer is an explicit working agreement that clarifies who leads on legal advice and compliance oversight, how issues will be escalated jointly and how credit for successful outcomes will be shared. The aim is not to diminish the CCO’s independent access but to make the partnership, and its boundaries, clear from the start.

Daily habits of indispensable compliance leaders

CCOs cannot control the GC’s fate. What they can control is how the compliance function is viewed by the C-suite and the board, and a few habits make a CCO invaluable to any executive team, whoever holds the GC seat.

Indispensable CCOs provide solutions, not merely objections. Suppose a CEO asks for immediate compliance sign-off on an aggressive marketing campaign on a Friday afternoon. A weak compliance response is simply to say no. An effective CCO works with the marketing and product teams, cites relevant regulatory enforcement actions and offers compliant alternatives.

They also translate risk into business terms. During a regulatory inquiry, executive leadership often focuses on reputational exposure, while finance evaluates reserves and disclosures. A CCO who frames compliance risk in terms of financial impact, likelihood and disclosure triggers speaks the language of the business, and is far better placed to enable it.

They delineate roles before a crisis rather than during one. In a well-run workplace harassment investigation, the CCO, HR and legal agree on boundaries in advance: how the complainant is protected, who selects an impartial investigator and how privilege is preserved. CCOs and GCs should build the same kind of framework for compliance investigations before an issue arises.

Finally, they practice. Crisis protocols are only effective if they have been tested. Joint tabletop exercises with the GC and legal team, such as a mock data breach or regulatory audit, map notification deadlines and communication flows, refine the operational playbook and strengthen coordination between the two functions.

The bottom line

A CCO cannot control how long the GC stays in the role. They can, however, build a compliance function that remains effective when leadership changes. CCOs who rely entirely on a personal relationship with the GC risk seeing their function reset with every GC change. Conversely, CCOs who proactively document their mandate, protect a direct route to the board, preserve institutional memory and make themselves indispensable will help keep the enterprise steady through any executive transition.

The post Your General Counsel Might Have One Foot Out the Door. Is Compliance Ready? appeared first on Corporate Compliance Insights.

One in three compliance leaders expect to be giving strategic advice

More than a third of compliance professionals see themselves headed toward having a role in company strategy, according to a survey by MCO (MyComplianceOffice).

The survey of 370 director-level or C-suite compliance leaders found that 37% said they expect the CCO role to expand more into strategic advice. About 42% of respondents reported that the CCO role is currently centered on regulator engagement and policy interpretation, and beyond moving into strategic advice, 36% see their role evolving into data-driven compliance and 32% forecast greater use of technology in the process.

Technology is driving compliance budgets, according to the survey. A vast majority of those surveyed (93%) expect compliance budgets to increase with 89% anticipating greater investment in compliance technology. Of the items getting invested in, KYC and AML (44%), AI tools (39%), and data management (35%) lead investment priorities.

The survey also found organizations use an average of 13.8 compliance systems and a mix of vendor technology, in-house systems and manual processes. 

Use of AI jumps nearly 30% among directors

The use of AI by directors increased year over year to more than 90%, a survey by OnBoard found.

In a survey of 531 directors, administrators and enterprise leaders, OnBoard concluded that 92% of directors are using AI for board of director meetings. That’s up from 69% in 2025.

The survey found that the most common uses include summarizing board books, reports or documents (54%) and writing or cleaning up meeting minutes (53%). Nearly half (49%) of respondents use the technology to draft or format meeting agendas, while 40% rely on it to research topics or analyze data. Other applications include creating presentations or executive reports (35%) and anticipating board questions and preparing responses (33%).

While directors are using AI, almost two in five organizations (38%) don’t have a formal AI use policy for directors, according to the survey. Another 25% are developing guidelines while 27% have basic or shared formal rules. Just 6% enforce AI policy on directors.

But with AI use has come a precipitous drop in security confidence, the survey concluded. Confidence in board security dropped by 15 percentage points from 61% in 2025 to 46% in 2026, lower than even 2024’s mark of 54%. Of the negative impacts of AI, 38% named data privacy, confidentiality & data-usage concerns.

The survey also found that 87% said their board has at least one ineffective member.

More than half of mission-driven organizations are worried about money matters

More than 50% of nonprofit and public organizations cite financial outlooks as their top organizational risk, according to a survey by Diligent.

The survey of board members, secretaries, executive directors and others at 230 nonprofits and public sector organizations found that 53% identified an economic or funding downturn as their top organizational risk. More than a third (34%) named legislative and regulatory change as a foremost risk. Large-scale cybersecurity breach (21%), breakdown in culture, ethics or staff voice (18%) and disruption from AI or new technologies as well as misinformation and disinformation affecting stakeholder perception (17%) were also identified as top risks. Just above one in ten (11%) named confidential information being leaked from an unsanctioned AI event as a concerning risk.

Board risk oversight could be improved more by frequent and structured risk discussions at the full-board level 38% of respondents said. Also identified as ways to improve board risk oversight were: clearer linkage between risk and strategy (28%); clearer definition of roles (24%); deeper integration of risk into committee agendas (20%); and improved management reporting (20%).

Boards also want changes in their meetings, according to the survey. Almost half (49%) called for more time for strategic planning, 37% wanted better tools and processes for agendas and board materials, and 31% wanted fewer presentation-heavy meetings.

Cyber threats leads the top five concerns for 2027

Cyber threats are the most concerning risk for organizations as they head towards 2027, a survey by Protiviti and NC State University’s Enterprise Risk Management Initiative found.

The survey of 1,330 global board members and C-suite executives asked them to rate from one (no impact at all) to five (extensive impact) risks they foresee their organizations facing next year. While threats against cybersecurity were at the forefront of respondents’ minds with an average score of 3.58, another digital matter came in just behind. Emergences of new risks from implementing AI was of the second-greatest concern with a score of 3.45. Economic conditions and regulatory concerns ranked third (3.41 score) and fourth (3.37) in the poll, while the rapid speed of disruptive innovations enabled by emerging technologies or other market forces ranked fifth with a 3.36 score.

Those sentiments are reflected in the long-term challenges, respondents reported. More than two in five (41%) said security and privacy was a long-term challenge, with 40% saying AI deployment and 38% reporting markets and economies as challenges they’ll face long-term.

A third of banking professionals are leery about AI in lending

Risk stemming from agentic AI use in lending and underwriting workflows is among the most concerning for one in three financial services professionals, a survey by Wolters Kluwer found.

Of the 230 bank professionals surveyed, 33% cited agentic AI’s use in lending and underwriting as a top risk. About the same proportion (30%) named collections and recovery as an area where agentic AI will cause the most risk.

Shutting down AI or reporting an incident are areas of concern as well, the survey found. Nearly 38% said they are least prepared for regulatory reporting of an AI failure, while 34% reported that model kill-switch protocols aren’t in place.

The survey also found that 34% of respondents said automation bias was the greatest risk to their AI safety framework and 27% said misalignment of incentives was the top risk for AI safety.

The post A Third of Compliance Leaders See Strategic Advising in Their Future appeared first on Corporate Compliance Insights.

New products & platforms

Optro, a GRC intelligence provider, released an expansion of its agentic products through the GRC Intelligence platform that will enhance autonomous testing, agentic stakeholder management, agentic risk assessment scoring, agentic compliance and more.

AlphaSense, a market intelligence and workflow orchestration company, announced an expanded enterprise AI security and governance program for its platform.

DataBee, a cyber risk platform, unveiled expanded capacities for DataBee Continuous Controls Monitoring, DataBee Frontier AI Defense and DataBee User Access Review that will enhance monitoring controls, assessing application exposures and reviewing user access. 

Financial services compliance software provider MCO launched new capabilities that allow financial firms to bring prediction markets under existing employee trading compliance programs and support communications across platforms like Telegram and Slack.

Partnerships & integrations

Assurance and financial reporting system Caseware announced a partnership with PKF O’Connor Davies, an accounting, tax and advisory practice, and its adoptions of Dynamic Assurance Solution Suite powered by Caseware Verity.

The International Compliance Association, a professional body for regulatory and financial crime compliance professionals, announced that selected ICA certificates were approved for funding by the Malaysian agency the Human Resource Development Corporation.

Personnel

Willkie has brought on former assistant US attorney and JPMorganChase & Co. counsel Kruti Trivedi as a partner who will be based in its Chicago office.

The post GRC Business Roundup: Optro, Caseware, MCO, AlphaSense, DataBee & More appeared first on Corporate Compliance Insights.

Earned wage access — letting employees draw compensation they’ve already earned before payday — is among the fastest-growing benefits in the market, and among the most unevenly regulated. Federal guidance has flipped three times in five years and a dozen states have written their own rules. But the harder lesson for compliance teams, as CCI contributing writer Erin Binney digs into, is that bringing in a third-party provider doesn’t move the risk away from the employer.

Regulatory whiplash is the new normal in Washington, and pay-advance programs are the latest popular employee benefit caught in the current.

The Consumer Financial Protection Bureau (CFPB) has changed its position on earned wage access (EWA) three times in five years — a 2020 advisory opinion, a 2023 reversal and another reversal last December. Six states passed EWA-specific laws in 2025 alone, doubling the number regulating the benefit. And a majority of senior organizational leaders have cited regulatory concerns as their top barrier to adopting EWA, according to a report.

Organizations waiting for the landscape to settle before rolling out a program of their own will be waiting a long time. The more useful question at this stage is probably how to build one that can survive the next reversal — because there will be one.

“These are very simple products in terms of how they are offered but very complicated products with respect to the regulatory landscape,” said Joseph Schuster, a partner in Ballard Spahr’s Denver office.

Fuzzy regulatory picture

EWA — which allows employees to receive a portion of their pay as it’s earned, rather than having to wait until the next regularly scheduled payday — has grown in popularity over the past 10 years, with the industry expected to grow from $8.8 billion in 2026 to $52 billion in 2034, according to Fortune Business Insights. At the same time, clear regulatory guidance at the federal level has been hard to come by.

In December, the CFPB issued an advisory opinion stating that certain employer-supported EWA programs do not constitute “credit” under the Truth in Lending Act and Regulation Z. This essentially reversed the position it had taken in 2023, which itself had reversed guidance the bureau provided in a 2020 advisory opinion letter. 

Regulatory reversals have become common at the federal level in recent years as administrations have changed. The Corporate Transparency Act, for example, was upended in August when a final rule rolling back beneficial ownership reporting requirements for US companies and individuals went into effect. In addition, the Department of Labor earlier this year issued a proposed rule that would largely restore the independent contractor test to the one put in place in 2021, which had been replaced by a different test under a 2024 final rule.

And while the Treasury Department has previously called on Congress to amend the Internal Revenue Code so that EWA arrangements would be treated as a weekly payroll period, the legislative branch has yet to act. The House Financial Services Committee did vote on June 30 to advance the Earned Wage Access Consumer Protection Act, but the bill lacks a Senate companion and its prospects are unclear.

In the absence of any meaningful or lasting federal activity, states have stepped in with legislation of their own, much as they have with pay transparency and paid leave laws. To date, about a dozen states have EWA-specific laws on the books.

The patchwork of state laws is adding another layer of confusion to the regulatory environment. 

“In some senses, it provides more clarity on the requirements with respect to EWA products,” Schuster said. “In other respects, it creates more compliance challenges with respect to these products.”

That’s because each state approaches things like licensing requirements, credit classification, fee disclosure and repayment restrictions differently. While these state laws are primarily directed at EWA providers, employers are still considered the employer of record in EWA arrangements, so it behooves them to understand what regulations, if any, are in place in the states where they operate.

HR Compliance

Your Compliance Dashboard Can’t Tell You Everything About Employee Relations

by Deb Muller

May 28, 2026

The first signal that you have a compliance problem is retaliation allegation rates

Read moreDetails

Where concerns arise

The number of states that have EWA-specific laws will only grow, Eric Magnus, a principal and office litigation manager of Jackson Lewis’ Atlanta office, told CCI. So far, he said, it’s a collection of “mostly red states” that have acted, but “it’s only a matter of time before the bluer states get involved in this.”

To his point, among the dozen states with EWA laws, four of them (California, Connecticut, Maryland and Wisconsin) have Democratic governors. 

It’s also worth noting that employers may find themselves in hot water if they enter into EWA agreements with providers that, unwittingly or otherwise, allow them to violate other employment laws, such as those relating to wage payment and deduction, overtime and minimum wage.

“Employers are not going to be relieved of any obligations for wage and hour just because they are now engaging a third party,” said Stephen Kenney, an attorney with Ogletree Deakins in Dallas. “So, if [an EWA program] causes any issues with overtime, if it causes any issues with minimum wage, those are going to be employer liabilities.”

Magnus cautioned that providers will let you make mistakes. 

“Let’s say you’re a restaurant and you contract with an EWA provider so your employees can get their tips ahead of the normal payroll cycle,” he said. “If you as the employer tell the EWA provider, ‘We want part of your fee,’ the EWA provider will do it. That’s unlawful.”

From a tax perspective, Kenney noted that under basic tax law, employees who have the ability to receive wages outside of the regular pay period are considered to be in constructive receipt of those wages. That means employers that aren’t executing withholding requirements on a daily basis are technically late with payroll taxes. 

“So, you’re opening yourself up to potential liabilities in terms of failure-to-deposit penalties and interest risks,” he said.

Employers can also invite risk as a result of the way they communicate an EWA benefit to employees, Schuster said. 

“If it is represented improperly by the employer, it’s possible that the employer could have liability under the contract,” he explained. An example would be if the employer says the EWA offering allows employees to “borrow” wages they’ve already earned.

Minimizing adoption risks

With federal entities paying closer attention to EWA and states adding laws on a regular basis, employers should make sure the programs they put in place today can withstand any potential regulatory changes going forward. 

Here are a few ways employers can minimize risk:

Negotiate vendor contracts

The top thing to look for, Magnus said, is an indemnification provision that releases the employer from liability if the provider is found to be operating unlawfully. 

“I would never let a client of mine willingly contract with an EWA provider that isn’t willing to indemnify,” he said. “If the landscape changes, if you get the right contractual provision, you’re not going to be on the hook if it happens.”

He also encouraged employers to scrutinize privacy and security provisions in EWA contracts. If you don’t want the vendor to market the product to your entire workforce, he said, don’t sign something that requires you to hand over all of your employee data. Similarly, employers should make sure they’re comfortable with how the provider plans to secure employees’ personally identifiable information.

Contracts can also be written to stipulate that the EWA provider must keep the employer apprised of changes in EWA laws, any new licenses they’ve obtained and any issues they’ve run into with states, Schuster added. 

“Spend the appropriate amount of time with respect to the contract with the EWA provider,” he said. “That is going to be important as laws continue to change.”

Run daily payroll

Though he acknowledged that running daily payroll would be administratively burdensome, Kenney noted that this is the only way to guarantee tax compliance with the Internal Revenue Code as it is currently written. 

“It’s something to talk to your payroll vendor about to see if that could be facilitated,” he said.

Limit employee eligibility

One way to limit employee eligibility is to make EWA an opt-in program, Kenney suggested. 

“If you make it broadly available, then you’ve just created constructive receipt for your whole organization,” he said. Making it an opt-in program won’t absolve all your risk, he added, but it will limit your risk to the subset of your employees who sign up.

Some employers also may want to limit where they offer EWA programs. Magnus said some of his multistate clients, for example, choose not to offer EWA products to their employees in California, because of the state’s reputation for having aggressive consumer protection laws and being employee-friendly.

“In California, there are statutory remedies for pay-stub violation,” he said. “So do you have to give a pay stub every time an employee chooses to take an advance from an EWA provider? There’s no law on that. So it is riskier in a place like that.”

Communicate carefully with employees

Schuster suggested adding provisions to contracts that require EWA providers to evaluate any employee communications being disseminated by the employer to avoid misrepresentation of the product. 

“These are nuances that employers may not be attuned to, but the EWA providers very much are,” Schuster said.

Magnus advises employers to stay out of the business of trying to sell EWA products to their workers. 

“I tell my clients, ‘You don’t need to do the EWA provider’s marketing for them.’ Just tell employees it’s available, but don’t try to market it,” he said.

What’s next?

Employers that wait for the regulatory environment to be settled before rolling out EWA offerings are likely to be waiting a long time, observers say, as the landscape is expected to continue to change.

Sitting on the sidelines, however, comes with its own risk, Magnus noted, in that employers that fail to offer EWA could find themselves at a competitive disadvantage from a recruiting and retention standpoint. 

“People who are in their mid to late 30s in the workforce have had this benefit for 10 years,” he said, so they’re going to expect it from their next employer. “It’s going to become more and more entrenched.”

The post Earned Wage Access: A Popular Payroll Perk, an Employer’s Liability appeared first on Corporate Compliance Insights.

47% DIB continuing to enhance cybersecurity despite federal government pause

About 47% of defense contractors are moving forward with third-party cybersecurity verifications even as the Department of War has paused CMMC Phase 2, a survey by Redspin found.

The survey of 131 defense industrial base (DIB) contractors found 47% are continuing DFARS 252.204-7012, NIST SP 800-171 and CMMC efforts toward future third-party certification despite the fact that Secretary of War Pete Hegseth in July halted rollout of CMMC Phase 2, which was scheduled to take effect in November. 

A good chunk of contractors are pressing on, but the pause is causing some to hit the brakes. Almost 22% reported that they’re slowing or halting their CMMC efforts, while 20% said they were pausing their certification spending and another 3% reported decreasing this investment. 

Contractors still see reaching CMMC Level 2 as meaningful, with 75% of respondents saying that even with the pause, achieving Level 2 delivers value to their organization beyond contract eligibility. Of those, almost 69% said the value was independent validation of cybersecurity programs. Other Level 2 values DIB contractors identified were demonstrating commitment to protecting controlled unclassified information (63%), supporting eligibility for future defense contracts (60%) and meeting customer or prime contractor expectations (60%).

Increased job pressure hits 75% of risk leaders

Risk leaders are feeling strained with three in four reporting that pressure has increased on their role in the past year, a survey by Riskonnect found.

The survey of more than 250 risk, compliance and resilience professionals also discovered that 20% said the rise in pressure was significant. More than a third (37%) described their job pressure as “high” or “extreme.”

“That increased pressure is not surprising since risk leaders are shouldering much more than a few years ago,” a summary of the survey said. “They’re expected to cover more ground, see further ahead, and respond faster, all without a corresponding increase in headcount or budget.”

Sometimes other departments are causing headaches for risk teams. About two in five (41%) reported that another department had made a risk-based decision in the past year without consulting the risk team that had a significant, unforeseen disruption on a different area of the organization.

Rising economic and political risks may also be contributing to the squeeze risk leaders are feeling. Economic risks rose to the top of risk leaders’ concerns after a two-year reign by cybersecurity risk. The two categories tied this year with 55% saying economic and cybersecurity risks were the biggest threats their companies face. More than a third (38%) named political risk as a top concern, making it the second most reported threat by risk professionals, followed by geopolitical and talent risks (37% each).

The post Almost Half of Defense Contractors Pressing Ahead With CMMC Despite Phase 2 Pause appeared first on Corporate Compliance Insights.

New products & platforms

Cybersecurity and GRC company Njordium Cyber Group AB launched Inspect360 GRC, a new GRC platform.

Caseware, an assurance and financial reporting platform, launched Risk Suggestion Agent worldwide as part of its Caseware Verity platform, to assist auditors in risk assessment.

CrashPlan, a data resilience and governance provider, announced backup and recovery for Windows and Linux servers and Google Workspace, built for small businesses.

Corporate governance software maker Confide unveiled its agentic GRC platform, bringing case management, policy, risk and audit into one platform.

Partnerships & integrations

SignWell, an eSignature platform, announced a distribution partnership with TD SYNNEX, a technology distributor, to expand access to SignWell’s electronic signature platform through IT resellers across the US.

Personnel

DigiFlight, a provider of aerospace, cybersecurity, engineering and training solutions, announced that Melody Berry has joined the company as manager of cybersecurity and compliance. 

Davies, a services and technology provider for insurance and highly regulated industries, has appointed Gerry Bouwman as CEO of forensic accounting and engineering.

Fintech and financial services consultant FS Vector promoted Max Sherman and Jasper Sneff Nanni to partner and Evey Guo to managing principal. 

Other news

Cybersecurity and IT compliance CPA firm Schellman announced that it is now the only US-based firm accredited to provide certification services under Spain’s Esquema Nacional de Seguridad.

The post GRC Business Roundup: Caseware, Confide, FS Vector, SignWell, Schellman & More appeared first on Corporate Compliance Insights.