Corruption Crime & Compliance

Hosted by Michael Volkov

Business News

Website RSS feed

Episodes

503

Latest episode

Oct 2026

Language

About the show

Michael Volkov tackles the current and hot topics in the legal realms of corruption, crime, and compliance.

Listen to episodes

60 recent

October 16, 20267 min

Episode 458 -- The FTC Warns 24 Major Hospital Systems

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the FTC's October 5, 2026 warning letters to 24 of the nation's largest healthcare services companies, which assert that failing to provide timely, accurate, and complete pricing, particularly for scheduled, non-emergency care, can be a deceptive or unfair practice under Section 5 of the FTC Act, and that incomplete disclosures omitting physician or facility fees can mislead patients into believing they have been told the total cost. He highlights the letters' most consequential point, that CMS price transparency rules are only a regulatory floor and provide no safe harbor from FTC liability, and places the action in context alongside tougher CMS enforcement, the No Surprises Act good faith estimate, the FTC's new Healthcare Task Force, and Chairman Ferguson's warning that investigations are already open. Volkov closes with a practical review plan: map every channel where patients receive prices, mystery-shop quotes against final bills, close the professional fee gap, tighten the language of estimates, bring consumer protection into price transparency governance, and document corrective action.

October 15, 20261 min

Can an Acquisition Create New Sanctions Risk?

You can buy a company’s assets, its customers, its brand, and guess what? Its sanctions violations. And sometimes the violation doesn’t exist until the day you close. Here’s what I mean. Under a sanctions program like Cuba and Iran, a foreign company owned by a U.S. buyer becomes subject to U.S. sanctions the moment the deal closes. Business that was lawful on Monday can be a violation on Tuesday. That’s what happened at First Bank, whose euro payments to Iranian parties became violations after a U.S. investor bought it. It’s what happened to Key Holding, whose new Colombian subsidiary shipped to Cuba for 19 months because nobody told it the rules had changed. And diligence alone won’t save you. Unicat’s buyer did diligence, missed the problem, disclosed quickly, and earned DOJ’s first declination for an acquirer. Yet the company it bought still paid millions. Stanley Black & Decker found Iran sales in diligence, made them a closing condition to stop, and still got hit because OFAC says no one monitored whether they actually stopped. So before signing and acquiring, ask what becomes illegal the day you own it. On day one, tell the target in writing that U.S. sanctions apply, and after closing, test the transactions yourself. Don’t accept a certification from the people hiding the problem. The Ethics and Compliance Q and A show is produced by One Stone Creative.

October 14, 20266 min

Episode 457 -- AML Compliance Shift to Effectiveness

In this episode of Corruption, Crime and Compliance, Michael Volkov examines FinCEN's April 2026 proposal to rebuild the Bank Secrecy Act AML program rule around an effectiveness standard, with a two-prong test requiring that programs be both established (risk-based, built on four core elements, and kept current) and maintained (implemented in all material respects), along with a new enforcement threshold for banks limited to significant or systemic failures and explicit encouragement of AI and advanced analytics. At the same time, FinCEN is retreating from mandatory enhanced due diligence for domestic politically exposed persons, an effectiveness standard arriving amid deregulation and a rollback of beneficial ownership reporting, and AI monitoring tools that silently miss novel risks, make the appearance of compliance easier while making its substance harder to maintain. Volkov closes with practical steps: test programs against the two-prong standard, measure outcomes rather than activity, adopt a risk-based policy for domestic officials, govern and validate AI tools against the institution's own risk profile, and avoid managing to the current enforcement climate.

October 13, 20261 min

Are Your Export Controls Built Into the System?

If a $36 million export violation comes down to whether a loading dock worker grabbed the right box, the problem isn’t the guy on the dock. BAE Systems just paid $36 million to the State Department for more than 100 export control violations. Here’s what makes this case worth your attention. DDTC didn’t find willful evasion. It found something more common and, honestly, scarier: a well-intentioned compliance program that just couldn’t keep up. GPS technical data sent to China because the file transfer system didn’t flag it, explosive mixture data sent to the UK because an employee thought it was already public, a shipment mix-up where dockworkers grabbed the wrong controlled part off the shelf. DDTC’s own words: BAE lacked a compliance program that integrated corrective action across the enterprise. Sounds familiar? BAE had already done one audit, made improvements, and violations kept happening anyway. Here’s my takeaway. Partial fixes after an audit finding don’t close a systematic gap. If your compliance program relies on individual judgment calls at the warehouse dock or the file transfer stage instead of built-in controls, you have the same exposure BAE just paid $36 million to resolve. The Ethics and Compliance Q and A show is produced by One Stone Creative.

October 11, 20266 min

Episode 456 -- Buying a Sanctions Violation

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why acquiring a sanctions violation is even riskier than buying an FCPA problem: under programs like Cuba and Iran, U.S. ownership of a foreign target can itself create sanctions jurisdiction on closing day, turning previously lawful foreign business into violations overnight. Drawing on OFAC's 2019 Framework for Compliance Commitments, which calls for compliance involvement in deals and post-closing audit and testing, he walks through enforcement actions including Unicat and White Deer (the first DOJ declination of an acquirer under its M&A policy, even as the target paid millions), Murad and Unilever, Kollmorgen, Stanley Black & Decker, AppliChem and Illinois Tool Works, First Bank and J.C. Flowers, Key Holding, and S&P Global, with Berkshire Hathaway's Iscar Turkey matter as a companion parent-liability case. Volkov closes with a deal playbook: sanctions-specific diligence beyond seller representations, targeted indemnities, day-one written notice to the target, replacing management certifications with real transaction testing, escalating every red flag, and building integration around DOJ's 180-day disclosure and one-year remediation windows.

October 8, 20261 min

Can a Company Survive C-Suite Misconduct?

A pharma CEO just found out the captain doesn’t always go down with the ship. Sometimes the ship stays afloat by handing him to DOJ. Veloxis Pharmaceuticals just paid over $46 million to resolve a kickback scheme involving its kidney transplant drug, lavish meals, resort stays, payments dressed up as consulting fees paid to doctors and pharmacies to drive prescription demand. Here’s the part that should stop you. The deferred prosecution agreement says the company’s own former CEO was directing this. That’s the kind of fact pattern that usually gets a company prosecuted, not offered a deal, but Veloxis got a deferred prosecution agreement anyway under DOJ’s corporate enforcement policy. Why? Because after the conduct came to light, the company disclosed, cooperated, and identified and fired the people responsible, including its own CEO. The lesson is clear. Even executive-level misconduct doesn’t actually doom the corporate entity if your response afterward is real. Disclosure, cooperation, and actually removing the people responsible is exactly the formula DOJ rewards. Don’t assume C-suite involvement means game over. What you do next is what actually decides the outcome. The Ethics and Compliance Q and A show is produced by One Stone Creative.

October 6, 20268 min

Episode 455 -- Updating Your Sanctions Compliance Program

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why OFAC's 2019 Framework for Compliance Commitments, built on the five pillars of management commitment, risk assessment, internal controls, testing and auditing, and training, remains the essential foundation for any sanctions compliance program, while also walking through the substantial multi-agency guidance that has layered on top of it since 2023 through joint DOJ, BIS, and OFAC "Tri-Seal" compliance notes. He covers four priority updates: the expanding reach of "U.S. nexus" jurisdiction and foreign subsidiary liability, harmonized voluntary self-disclosure expectations under which silence is now treated as an aggravating factor, granular supply chain and "know-your-cargo" evasion detection requirements, and OFAC's extension of its statute of limitations from five to ten years. Volkov closes by mapping these priorities onto concrete program changes, expanding risk assessments to incorporate export control considerations, upgrading internal controls beyond simple name-matching, and rebuilding recordkeeping around the new ten-year lookback window, while cautioning that these updates only work when layered on top of a properly implemented 2019 Framework foundation.

October 6, 20261 min

Is Embedded AI Slipping Past Your Controls?

Today’s version of the Trojan horse doesn’t need to sneak past your gate in the dead of night. It’s a software update to something you already let in. Second preview ahead of tomorrow’s webinar, and this one’s about a blind spot I see constantly. Most compliance officers think about shadow AI as employees going out and signing up for some random chatbot. That happens, but the bigger risk right now is AI features quietly embedded inside software you already license and already approved. Your document platform, your video conferencing tool, your CRM, they’re all rolling out built-in AI features, and nobody experiences turning one on as adopting a new AI tool. It just feels like clicking a button in software you already trust. That’s exactly why it slips past your vendor approval process. An approved product does not mean every feature inside it is approved. Each AI feature needs its own review, its own data classification, its own yes or no. Tomorrow’s webinar will walk through exactly how to build a living registry that tracks standalone tools and embedded features separately, so nothing gets a free pass just because it showed up inside something you already trusted. The Ethics and Compliance Q and A show is produced by One Stone Creative.

October 4, 20268 min

Episode 454 -- The Marriage of Compliance and Data

In this episode of Corruption, Crime and Compliance, Michael Volkov traces the decades-long relationship between compliance and data, from the profession's earliest, checkbox-style attempts to measure program effectiveness through crude proxies like hotline volume and training completion rates, through the rise of continuous monitoring systems, integrated dashboards, and key risk indicators that enabled expedited auditing and near-real-time visibility, and finally to the current AI-driven era, where machine learning and natural language processing can surface subtle risk patterns no human-authored rule would catch and compress the gap between detection and action to hours rather than months. He argues that each phase of this evolution was driven not by strategic foresight but by escalating business, regulatory, and litigation risk, first around proving program effectiveness itself, then data privacy and cybersecurity, and now AI governance, and closes by cautioning that AI monitoring tools will only perform as well as the underlying data infrastructure and discipline a compliance function has already built.

October 1, 20261 min

Is Your Third-Party Risk Program Ready for AI?

An AI tool isn’t a piece of software. It’s a locked door, and you have no idea how many people have a key. Quick preview ahead of tomorrow’s webinar on AI and third-party risk, because I want you thinking about this before we dive in. Here’s the mental shift every compliance officer needs to make: every AI tool your company adopts is a third-party vendor relationship, often a more complicated one than your typical software vendor. Why? Because a lot of AI products are built on top of someone else’s underlying model. Your data can pass through multiple companies before it’s fully processed, and you may not even know all the hands it touches along the way. That means your vendor due diligence questions need to go further than usual. Does this vendor train on your data? Can that be turned off contractually and technically? Where does the data actually live? What subprocessors and underlying model providers are in that chain? These aren’t nice-to-have questions anymore. They’re the whole ballgame. Tomorrow we get into the specifics, but start here: if your third-party risk program hasn’t been rebuilt around AI-specific questions, it’s already out of date. The Ethics and Compliance Q and A show is produced by One Stone Creative.