Episode 455 -- Updating Your Sanctions Compliance Program

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why OFAC's 2019 Framework for Compliance Commitments, built on the five pillars of management commitment, risk assessment, internal controls, testing and auditing, and training, remains the essential foundation for any sanctions compliance program, while also walking through the substantial multi-agency guidance that has layered on top of it since 2023 through joint DOJ, BIS, and OFAC "Tri-Seal" compliance notes. He covers four priority updates: the expanding reach of "U.S. nexus" jurisdiction and foreign subsidiary liability, harmonized voluntary self-disclosure expectations under which silence is now treated as an aggravating factor, granular supply chain and "know-your-cargo" evasion detection requirements, and OFAC's extension of its statute of limitations from five to ten years. Volkov closes by mapping these priorities onto concrete program changes, expanding risk assessments to incorporate export control considerations, upgrading internal controls beyond simple name-matching, and rebuilding recordkeeping around the new ten-year lookback window, while cautioning that these updates only work when layered on top of a properly implemented 2019 Framework foundation.

Today’s version of the Trojan horse doesn’t need to sneak past your gate in the dead of night. It’s a software update to something you already let in.Second preview ahead of tomorrow’s webinar, and this one’s about a blind spot I see constantly.Most compliance officers think about shadow AI as employees going out and signing up for some random chatbot.That happens, but the bigger risk right now is AI features quietly embedded inside software you already license and already approved.Your document platform, your video conferencing tool, your CRM, they’re all rolling out built-in AI features, and nobody experiences turning one on as adopting a new AI tool.It just feels like clicking a button in software you already trust.That’s exactly why it slips past your vendor approval process.An approved product does not mean every feature inside it is approved.Each AI feature needs its own review, its own data classification, its own yes or no.Tomorrow’s webinar will walk through exactly how to build a living registry that tracks standalone tools and embedded features separately, so nothing gets a free pass just because it showed up inside something you already trusted.The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov traces the decades-long relationship between compliance and data, from the profession's earliest, checkbox-style attempts to measure program effectiveness through crude proxies like hotline volume and training completion rates, through the rise of continuous monitoring systems, integrated dashboards, and key risk indicators that enabled expedited auditing and near-real-time visibility, and finally to the current AI-driven era, where machine learning and natural language processing can surface subtle risk patterns no human-authored rule would catch and compress the gap between detection and action to hours rather than months. He argues that each phase of this evolution was driven not by strategic foresight but by escalating business, regulatory, and litigation risk, first around proving program effectiveness itself, then data privacy and cybersecurity, and now AI governance, and closes by cautioning that AI monitoring tools will only perform as well as the underlying data infrastructure and discipline a compliance function has already built.

An AI tool isn’t a piece of software. It’s a locked door, and you have no idea how many people have a key.Quick preview ahead of tomorrow’s webinar on AI and third-party risk, because I want you thinking about this before we dive in.Here’s the mental shift every compliance officer needs to make: every AI tool your company adopts is a third-party vendor relationship, often a more complicated one than your typical software vendor.Why? Because a lot of AI products are built on top of someone else’s underlying model.Your data can pass through multiple companies before it’s fully processed, and you may not even know all the hands it touches along the way.That means your vendor due diligence questions need to go further than usual.Does this vendor train on your data?Can that be turned off contractually and technically?Where does the data actually live?What subprocessors and underlying model providers are in that chain?These aren’t nice-to-have questions anymore. They’re the whole ballgame.Tomorrow we get into the specifics, but start here: if your third-party risk program hasn’t been rebuilt around AI-specific questions, it’s already out of date.The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov rounds up three major economic policy developments happening alongside Operation Economic Outcast: the State Department's rescission of Syria's nearly 47-year State Sponsor of Terrorism designation, opening the door to renewed trade and eased export controls; an escalating tariff war with Canada following the collapse of USMCA renewal talks, including a 50 percent tariff on roughly $20 billion of Canadian goods and matching retaliation; and the newly enacted Lindsey O. Graham Sanctioning Russia and Iran Act, with its novel tariff structure reaching up to 500 percent on Russian goods and up to 100 percent on top importers of Russian energy. Volkov argues these developments, read alongside the Iran crackdown, show an administration deploying economic tools more aggressively and across more simultaneous fronts than at any point in recent memory, and he closes by urging listeners to treat geopolitical risk assessment as a continuous function this quarter rather than a periodic exercise.

For anyone hoping a friendlier DOJ can make their old charges disappear, a federal judge just reminded us that vanishing requires his or her permission.Big development out of Brooklyn federal court.DOJ tried to drop the remaining bribery and obstruction charges against executives tied to Indian billionaire Gautam Adani.The judge said no.Judge Nicholas Garaufis ruled that Deputy AG Trent McCotter’s justification for dismissal didn’t include the actual facts needed to support it, just conclusions.McCotter argued weak U.S. jurisdictional ties. Garaufis said essentially: show me the facts, not just the argument.He’d already rejected an earlier diplomatic strain argument too, noting some conduct happened right here in the U.S.There’s real context here. Reporting suggests DOJ’s posture shifted after Adani’s team hired a lawyer personally connected to the president.None of that decided the legal question, but it’s exactly why a court might scrutinise DOJ’s reasoning more closely instead of rubber-stamping it.Here’s why this matters beyond one case: a change in DOJ’s political priorities doesn’t automatically make an indictment disappear.Courts still have to sign off.Don’t assume that a friendlier enforcement climate erases charges already on the books.The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov devotes a full deep dive to Operation Economic Outcast, Treasury's aggressive campaign to close off Iran's remaining financial and commercial channels following the collapse of a June 2026 US-Iran memorandum of understanding. He walks through OFAC's expansion of sectoral sanctions into aviation, digital assets, gold, shipping, and technology with no U.S. nexus required, the suspension of general licenses that has disrupted universities, testing organizations, and academic and sports exchanges, a new presumption-of-denial licensing policy, updated Strait of Hormuz guidance establishing sanctions risk even without any payment changing hands, and a coordinated crackdown on banks in the UAE, Turkey, and Russia serving as Iran's financial lifelines. Volkov closes with concrete steps: reassess Iran-connected exposure immediately in the newly covered sectors, treat any activity tied to a suspended general license as ended rather than pending renewal, and build enhanced due diligence for Hormuz transits and newly designated bank counterparties.

If you’re planning for 2027 with 2025’s budget in mind, your compliance program is about to fall on its face.KPMG just surveyed 725 chief compliance officers, and the headline is simple: the job has fundamentally expanded, and if your 2027 plan doesn’t reflect that, you’re already behind.75% of CCOs say cybersecurity and data privacy are top investment priorities.77% say the same about data analytics.That’s not a coincidence. You need the analytics to actually use the cybersecurity investment.But here’s the number that struck me most: 81% of CCOs feel confident collaborating with their cybersecurity teams.That’s not an accident. That reflects compliance functions building real structural partnerships with security and resiliency teams, not waiting for an incident to force the relationship into existence.And on AI, 68% describe themselves as mixed, leaning positive. Not hype, not fear. Measured adoption, concentrated in risk assessment, predictive analytics, and training.The bottom line: compliance isn’t just policy and training anymore. It’s operational resilience.If your budget doesn’t reflect that shift, fix it now.The Ethics and Compliance Q and A show is produced by One Stone Creative.

In this episode of Corruption, Crime and Compliance, Michael Volkov examines two significant executive sentencings handed down within a day of each other: Tomás Niembro Concha, the former CEO of Puerto Rico's now-defunct Nodus International Bank, sentenced to more than nine years for a multiyear fraud scheme that fleeced his own bank of nearly $25 million and a scheme to evade U.S. sanctions on Venezuela by secretly selling a sanctioned individual's foreclosed home back to him through a front company; and Javier Aguilar, a former Vitol oil trader, sentenced to four years, well below the twelve DOJ sought, for bribing officials in Ecuador and Mexico to win Vitol more than $500 million in state oil company business. Volkov draws out the common threads between the two cases, shell entities, sham documentation, and years of concealment from the very oversight functions meant to catch it, and highlights Aguilar's rejected defense that the bribes were merely industry custom as a rationalization compliance programs should treat as a red flag whenever they hear it internally.

Lo and behold, Boeing gets sued over another safety crisis, and this time Boeing actually won.Want to know why? They kept the receipts.Yesterday I told you about two cases where Delaware let Caremark claims move forward. Today, the case where the board won, and its most important Caremark decision in years.Boeing again. New litigation, this time over the 2024 Alaska Airlines door plug incident. Given Boeing’s history, you’d think this case had real legs.Delaware dismissed it anyway.Why? Because the record showed the board had dedicated safety committees, got regular reports on manufacturing and quality, discussed the issues repeatedly, and got updates on remediation.The court said Caremark doesn’t ask whether oversight succeeded. It asks whether directors consciously looked away.Here, they didn’t.Here’s the takeaway for every board and every compliance officer: a functioning reporting system, real information flow, and genuine engagement is real protection, even when the company faces another crisis.Build that record now, before you need it in litigation, because in Delaware, detailed board minutes showing you are paying attention might be the single best defense you have.The Ethics and Compliance Q and A show is produced by One Stone Creative.