Categories
Compliance Tip of the Day

Compliance Tip of the Day – Code of Conduct as an Internal Control

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

How does your Code of Conduct act as an internal control?

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Daily Compliance News

Daily Compliance News: June 12, 2025, The Brutal Truth Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, and general interest, all of which are relevant to the compliance professional.

Top stories include:

  • 4 questions to ask employees. (WSJ)
  • The Brutal Truth About Layoffs in 2025. (FT )
  • The CITGO auction date has been extended (yet again). (Reuters)
  • Rubio is pressing the DOJ to investigate Harvard. (NYT)
Categories
Blog

Wells Fargo, Risk Management and Reputational Recovery – Part 1: The Penalty

On June 3, 2025, the Federal Reserve lifted its unprecedented $2 trillion asset cap on Wells Fargo, marking the symbolic end to one of the most consequential compliance enforcement actions in modern U.S. banking history. For the compliance and risk management community, this moment is not a victory lap—it is a case study of how compliance failures cascade, reputational risk becomes operationally tangible, and regulatory patience has its limits.

Over the next two blog posts, I want to explore what happened, why it mattered, and what lessons every compliance professional should carry forward. These blog posts are based on two primary articles. The First Wells Fargo Is Allowed to Grow Again After 7 Years Under Asset-Cap Penalty, by Gina Heeb in the Wall Street Journal. The second is “Wells Fargo Asset Cap Lifted by Fed, Paving Way for Growth” by Yizhu Wang in Bloomberg. The final is an op-ed piece in Bloomberg, entitled “Wells Fargo’s Asset Cap Has Been a Good Punishment,” by Paul Davies.

The Scandal That Shook the System

The Wells Fargo saga began with a simple, albeit stunning, revelation: employees had opened millions of unauthorized deposit and credit card accounts to meet aggressive internal sales goals. Between 2009 and 2016, over 3.5 million accounts were opened without the customer’s consent. Many of these accounts generated fees, tarnishing customer relationships and shaking public trust in one of the most storied names in American banking.

As the crisis deepened, it was not just a case of bad apples. It was a system-wide failure of controls, risk oversight, and a corporate culture that incentivized misconduct. The sales quotas that fueled the behavior were directly tied to compensation and job security, creating a high-pressure environment where fraud became a means of survival.

Regulators acted swiftly. In 2016, Wells Fargo was fined $185 million. In 2018, the Federal Reserve took the rare and dramatic step of capping the bank’s total assets at approximately $2 trillion, essentially freezing its ability to grow until it could demonstrate a wholesale overhaul of its risk management and governance practices.

The Asset Cap: Punishment with Purpose

We need to be clear: this was not just a penalty. It was a structural constraint that directly impacted Wells Fargo’s ability to operate and compete in its core business. The $2 trillion asset cap imposed by the Federal Reserve in 2018 did not simply send a signal; it built a wall. It limited Wells Fargo’s ability to grow its balance sheet, take on new deposits, issue new loans, and expand into revenue-generating business lines, such as investment banking, trading, and wealth management. Unlike traditional enforcement actions, which often result in fines or deferred prosecution agreements, the asset cap attacked the bank’s future potential, not just its past misdeeds.

In short, it was a period of growth stagnation. For a publicly traded institution that relies on growth to attract investors, increase shareholder value, and maintain market position, such a freeze is devastating.

The restriction forced the bank into a defensive crouch. Instead of competing for market share or innovating with new financial products, Wells Fargo was compelled to pour resources into compliance remediation and cultural rehabilitation. According to public filings and internal estimates, the bank spent more than $2.5 billion above its 2018 baseline to maintain the risk, control, and compliance infrastructure needed to satisfy dozens of consent orders. This included the hiring of more than 10,000 employees dedicated to risk and regulatory functions—a remarkable mobilization of resources that most firms would struggle to afford.

As Davies aptly observed, “The asset cap has become a feared punishment for banks in the U.S.; they will want to avoid it at all costs.” And banks should. Because it not only restricts current operations, it sends a clear signal to markets, analysts, and regulators: this institution is not yet trusted to grow.

However, here’s the twist: in the case of Wells Fargo, it did work.

The asset cap’s forced pause compelled the bank to undertake a comprehensive review of its governance and culture. Under the leadership of CEO Charlie Scharf, who joined BNY Mellon in 2019 and previously held senior roles at Visa and JPMorgan, Wells Fargo began the arduous but necessary work of rebuilding. Scharf wasted no time restructuring the risk and compliance functions, streamlining reporting lines, and replacing much of the leadership team that had presided over the bank’s previous failures. Perhaps most importantly, he made compliance the focal point of executive decision-making, beginning every operating committee meeting with a thorough review of regulatory progress.

In effect, the asset cap did not simply punish Wells Fargo; it saved the bank from itself. It forced the kind of systemic, sustainable change that no fine or press release could have achieved. Wells Fargo emerged leaner, more disciplined, and more compliant. In many ways, it became a model for what the Federal Reserve, the Department of Justice (DOJ), and numerous other regulatory agencies now expect. Not simply accountability but a demonstrable and lasting commitment to cultural transformation.

This is remediation before reward. It is tone at the top in action. And for compliance professionals everywhere, it is proof that when structural enforcement is coupled with leadership willing to change, reform is not only possible but, as Theranos might say, “inevitable.”

Why It Worked: Enforcement as a Governance Driver

For corporate compliance professionals, Wells Fargo is more than a cautionary tale. It is proof that regulatory enforcement, when aligned with structural consequences, can drive actual change. The asset cap was not a mere symbolic gesture. It constrained Wells Fargo’s operations at its core, limiting everything from loan issuance to deposit intake to investment banking expansion.

Even more significantly, it reshaped how the bank’s board and senior executives prioritized compliance. For years, every operating committee meeting began with updates on regulatory matters. This became the bank’s daily bread.

The message is clear: when enforcement bites into business, executives listen.

Join us tomorrow as we delve into Part 2, where we examine lessons learned for the compliance professional.

Categories
Blog

The Menagerie, Part 1 – Rules, Mutiny, and the Ethics of Exceptional Compliance

Show Summary

In this episode of Trekking Through Compliance, we beam down into one of the most compelling courtroom dramas in Star Trek canon—The Menagerie, Part 1. This two-part saga is not just a creative reuse of Star Trek’s unaired original pilot (The Cage) but a deep dive into the themes of loyalty, risk, duty, and the tension between rigid compliance and ethical decision-making. When Mr. Spock commandeers the Enterprise in direct violation of Starfleet orders, fabricates communications, and defies his captain, all to bring his former commander, the incapacitated Christopher Pike, to the forbidden planet Talos IV, it sets up one of the most dramatic ethical showdowns in Starfleet history.

In today’s blog post, we examine how this episode provides rich material for compliance professionals, particularly those navigating the delicate balance between adhering to policy and upholding higher principles. We break down five core compliance lessons and link each one to specific incidents in the episode that bring those lessons to life. Along the way, we will also consider how compliance leaders can apply these lessons to build more ethical, resilient, and human-centered organizations.

1. Ethical Mutiny: When Breaking the Rules Is the Right Thing to Do

Illustrated by Spock, hijacks the Enterprise by falsifying voice commands from Captain Kirk, overrides ship controls, and charts a course to Talos IV, a planet placed under the most severe travel prohibition in Starfleet history.

This opening act is one of the most jarring in the history of Star Trek. Spock, the emblem of logic and duty, commits mutiny. And he does not hide it. After allowing Kirk and Commodore Mendez to catch up to the Enterprise, he turns himself in and demands a court-martial.

Compliance Lesson:

Doing the right thing for an individual or stakeholder may technically violate internal policy or even law. While compliance is generally rooted in the enforcement of established rules, the ethical dimension of compliance leadership sometimes calls for courage, the kind Spock displays.

For example, think of the whistleblower who exposes illegal conduct despite violating a non-disclosure agreement. Or the compliance officer who bypasses a sluggish internal protocol to alert regulators of an imminent safety risk. These are modern-day echoes of Spock’s actions.

What matters most in these scenarios is intent, proportionality, and documentation. If you break protocol to serve a higher ethical obligation, make your reasoning transparent, and be prepared to accept scrutiny. Spock did just that, and compliance professionals can learn from his model.

2. Informed Consent and the Rights of the Vulnerable

Illustrated by Captain Pike, now confined to a life-support chair following a catastrophic accident, is capable of communicating only through blinking lights, one blink for “yes,” two for “no.” Despite this profound disability, Spock makes decisions on his behalf, presumably with his blessing, to bring him to Talos IV.

Compliance Lesson:

One of the most overlooked yet essential aspects of modern compliance is ensuring that all individuals, regardless of their ability or role, are given the opportunity to provide informed consent. Too often, we see vulnerable populations—such as individuals with disabilities, language barriers, or economic dependence—marginalized in decision-making processes.

In Spock’s case, we are left to infer that Pike approved of the plan. However, the lack of transparency and documented consent raises important questions. In corporate settings, this would be akin to assuming a disabled or junior employee is on board with a high-risk strategy without fully briefing them or securing a formal agreement.

The key takeaway for compliance professionals is to consistently seek and document informed consent, particularly when an individual’s ability to communicate or resist is compromised. It’s not just about legal risk—it’s about human dignity.

3. Due Process and Transparency in Internal Investigations

Illustrated by Spock’s court-martial, it begins aboard the Enterprise, with Commodore Mendez presiding. Instead of denying the charges, Spock cooperates fully and presents a surprising defense—video footage from a previous classified mission to Talos IV.

Compliance Lesson:

Investigations must be conducted fairly, transparently, and supported by evidence. What makes this incident so interesting is that Spock does not simply confess; he insists on a formal process to air the whole truth. He respects Starfleet’s legal structure and uses it not to avoid punishment but to contextualize his actions.

This approach mirrors what strong compliance programs should look like: not about covering up or avoiding accountability, but about utilizing internal mechanisms, such as hearings, audits, and investigations, to surface the truth, not suppress it. Always remember that compliance is the guardian of institutional justice and institutional fairness.

Moreover, it emphasizes the importance of allowing investigations to run their course. By submitting himself to judgment, Spock reinforces trust in the system, even as he challenges its rigidity. Competent compliance officers will recognize that transparency and integrity go hand in hand—even during a breach.

4. Data Use, Privacy, and Chain of Custody

Illustrated by: The footage Spock presents to the court-martial board is revealed to be an unauthorized transmission from Talos IV, one of the most tightly controlled sources of information in the galaxy. The footage itself is emotionally charged and deeply personal and raises questions about how it was obtained and used.

Compliance Lesson:

This is a prime example of modern data privacy risks. In today’s world, this would be akin to accessing and sharing confidential patient or employee data without formal approval, even if done with good intent. For compliance professionals, the lesson is clear: the ethical use of data requires a secure chain of custody, limited access, and an articulated purpose. Even benevolent motives, such as restoring dignity to a suffering colleague, do not justify breaching established data protections. If the situation is exceptional, escalation to legal or ethics committees is essential.

5. Leadership Accountability and Ethical Stewardship

Illustrated by Kirk being blindsided by Spock’s actions and struggling with the realization that someone he trusts deeply has broken the chain of command. Yet, Kirk doesn’t retaliate in anger. He allows the investigation to proceed, listens to the evidence, and reflects carefully before responding.

Compliance Lesson:

This is a case study in mature leadership. Compliance leaders are often put in the uncomfortable position of adjudicating actions by trusted colleagues. Emotional responses, especially when loyalty is called into question, can cloud judgment. Kirk’s restraint is a model for those faced with internal breaches by high performers or close allies. Accountability does not mean vengeance; it means ensuring the rules apply equally and fairly, even when your friends are involved. Ethical stewardship encompasses empathy, as well as clarity and responsibility.

Final ComplianceLog Reflections

The Menagerie, Part 1 is not just a legal drama in space; rather, it is a parable about leading with principle in the face of policy. Spock’s decision to violate orders in service of a higher ethical goal challenges us to ask, “What do we do when the rules are wrong?” When does policy block compassion? When does protocol punish empathy? Compliance professionals are uniquely positioned at this crossroads every day. And while very few of us will hijack a starship in the name of justice, we will all face situations that test whether we are rule followers or ethical leaders. Let Spock’s courage and Kirk’s humility remind us that compliance is not about blind enforcement. It is about ethical discernment, moral courage, and doing right by people, even when it means breaking the mold.

Categories
Daily Compliance News

Daily Compliance News: June 11, 2025, A Bondi Too Far Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, and general interest, all of which are relevant to the compliance professional.

Top stories include:

Categories
Compliance Into the Weeds

Compliance into the Weeds: Changes in FCPA Enforcement

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject more fully. Are you seeking insightful perspectives on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the recent memorandum from the Deputy Attorney General regarding the investigation and enforcement of the FCPA.

The memo follows President Trump’s executive order pausing FCPA enforcement for six months. The hosts evaluate the potential impacts on compliance programs, with a possible shift to targeting foreign companies that harm US business interests and national security. They also explore the role of the Foreign Extortion Prevention Act and speculate on how the SEC might integrate these changes into its enforcement practices.

Key highlights:

  • Initial Reactions to the FCPA Memo
  • Implications for Anti-Corruption Compliance
  • Focus on Foreign Companies and National Security
  • Skepticism and Potential Bias in Enforcement
  • Strategic National Interests and Enforcement
  • Considerations for Compliance Officers

Resources:

Memo on Guidelines for Investigation and Enforcement of the FCPA

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds, was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Board Oversight on Internal Controls

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

How can your board fulfill its role in oversight of your internal controls

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Blog

5 Key Strategies For Compliance to Avoid Violating the Caremark Doctrine

The Caremark Doctrine remains one of the foundational pillars of corporate compliance, a pivotal standard that every compliance professional must understand and apply. Originating from the landmark Delaware Chancery Court decision in In re Caremark International Inc. Derivative Litigation (1996), this doctrine revolutionized the way corporate boards are viewed in terms of their oversight duties. As compliance professionals, it’s essential to grasp not only the legal intricacies but also the profound practical implications this doctrine carries for board responsibilities and organizational oversight.

At its core, the Caremark Doctrine addresses the fiduciary duty of corporate directors to actively oversee a company’s compliance and risk management practices. Before this case, oversight obligations were seen primarily as passive, reactionary, or even discretionary. Caremark fundamentally shifted this perception, articulating an affirmative duty on directors to establish, maintain, and adequately monitor compliance systems to detect and prevent corporate misconduct.

The significance of the Caremark decision lies in its delineation of two clear pathways where director liability can be triggered: first, when the board utterly fails to implement any reporting or information systems, and second, when, having implemented such systems, the board consciously disregards red flags signaling compliance failures or operational risks. Citing negligence or ignorance as a defense for oversight responsibilities is no longer sufficient. Directors became accountable not only for what they knew but also for what they should have known, emphasizing the importance of proactivity, diligence, and vigilance.

Today, the implications of Caremark resonate strongly within the realm of corporate compliance programs, setting the standards for board engagement expectations. Effective compliance no longer solely involves setting clear policies and robust procedures; instead, it demands ongoing active engagement from the board to ensure these measures are functioning effectively. Boards are expected to scrutinize, test regularly, and challenge management on compliance risks and controls, embedding compliance considerations firmly into the corporate governance structure.

In recent years, corporate compliance officers have faced heightened scrutiny as Delaware courts have increasingly emphasized board accountability through the evolution of the Caremark Doctrine. The evolving jurisprudence surrounding this doctrine, particularly highlighted by cases such as Marchand v. Barnhill and Boeing, underscores the necessity for vigilance, attentiveness, and proactive risk management. Itai Fiegenbaum undertook a thorough examination of the Caremark Doctrine in his 2025 article, “Caremark’s Fractured State.” I use his article as a starting point to outline five essential strategies compliance officers can adopt to ensure their organizations remain firmly compliant with Caremark obligations and avoid potential liability.

1. Establish Robust Monitoring Systems

At the heart of the Caremark Doctrine is the expectation that directors not only establish but also actively oversee effective corporate monitoring systems. Compliance officers must ensure that robust, comprehensive monitoring frameworks are in place, which include clear policies, detailed procedures, and continuous oversight mechanisms. These systems must be designed to identify and escalate potential compliance issues promptly.

Implementing state-of-the-art technology, such as advanced analytics and AI-driven monitoring tools, can significantly enhance the effectiveness of these systems. Such tools enable the real-time analysis of large volumes of data, allowing for the quick identification of anomalies or red flags that indicate potential misconduct. Additionally, compliance officers should regularly review and update these systems to ensure their ongoing effectiveness in response to evolving regulatory requirements and emerging risks.

2. Prioritize Oversight of Mission-Critical Activities

Recent Delaware jurisprudence, particularly the Marchand case, has underscored the need for boards to exercise increased vigilance over “mission-critical” aspects of their operations. Compliance officers must assist directors in identifying these critical functions, which are integral to the organization’s core business operations and profitability, and ensure that enhanced monitoring and reporting practices are implemented.

Regular board-level discussions and reporting on these mission-critical functions must be documented meticulously. Compliance officers should establish routine updates that enable the board to understand the risks, controls, and compliance status related to these critical activities. Such a strategic focus not only aligns with the expectations set by Delaware courts but also significantly mitigates the risk of oversight failures.

3. Ensure Active Board Engagement and Training

Delaware courts have repeatedly emphasized that passive oversight is insufficient; board members must actively engage in compliance monitoring and demonstrate awareness of their fiduciary duties under the Caremark Doctrine. Compliance officers play a crucial role in facilitating active engagement by organizing regular and specialized training sessions for directors, ensuring they fully understand their oversight responsibilities and the specific compliance risks facing the company.

Moreover, compliance officers should encourage directors to challenge management constructively, seek additional information when needed, and demonstrate thoughtful engagement during board meetings. Documenting directors’ active involvement through detailed meeting minutes and clear records of training and discussions can substantially bolster evidence of effective oversight, which is crucial in the event of litigation.

4. Foster a Strong Compliance Culture

An organization’s compliance culture has a significant impact on its ability to effectively uphold Caremark obligations. A strong compliance culture ensures that employees at all levels recognize the importance of compliance, feel empowered to raise concerns without fear of retaliation, and understand that ethical conduct is integral to organizational success.

Compliance officers should proactively foster such a culture through comprehensive ethics training, regular communications reinforcing compliance messages, and visible support from top leadership. Mechanisms such as confidential reporting channels, whistleblower protections, and prompt investigation of reported issues further strengthen this culture, ensuring that potential misconduct is identified and addressed before it escalates into larger problems.

5. Conduct Regular and Thorough Risk Assessments

Proactive risk assessments are essential under the Caremark framework, providing boards with the necessary information to effectively oversee compliance. Compliance officers must ensure that these risk assessments are comprehensive, covering both traditional risks, such as fraud and corruption, as well as emerging threats related to cybersecurity, data privacy, and geopolitical changes.

Regular risk assessments not only inform the board’s oversight activities but also allow compliance officers to adjust monitoring and controls in response to identified vulnerabilities. Documented risk assessment processes, along with clear remediation actions, demonstrate due diligence and provide robust defenses against claims of insufficient oversight.

Conclusion

The Caremark Doctrine continues to evolve, setting increasingly stringent standards for corporate oversight. Compliance officers play a pivotal role in guiding boards to meet these expectations through robust monitoring systems, prioritized oversight, active engagement, a strong culture of compliance, and proactive risk management. By implementing these five strategies, compliance officers can significantly reduce their companies’ risk of violating the Caremark Doctrine, safeguard their organizations, and protect directors from potential liability. Now more than ever, proactive compliance is not only prudent but also imperative.

Categories
FCPA Compliance Report

#Risk New York Speaker Series – The Future of AI Governance in GRC with Matt Kelly

Join Tom Fox and hundreds of other GRC professionals in the city that never sleeps, New York City, on July 9 & 10 for one of the top conferences around, #Risk New York. The current US landscape, shaped by evolving policies, rapid advancements in AI, and shifting global dynamics, demands adaptive strategies and cross-functional collaboration.

At #RISK New York, you will master the New Regulatory Reality by getting ahead of US regulatory shifts and their impact. Conquer AI and Tech Risk by Safeguarding Your Organization in an AI-Driven World and Understanding the Implications of Major Tech Investments. Navigate Financial and Crypto Volatility by Protecting Your Assets and Exploring Solutions in a Dynamic Market. Strengthen Your GRC Framework by Leveraging Governance, Risk, and Compliance for Strategic Advantage. Protect Digital Trust by addressing challenges in cybersecurity and data privacy, and combating misinformation. All while meeting with the country’s top #Risk management professionals.

In this episode, Tom Fox talks with Matt Kelly about his presentation on the importance of understanding how AI can be productively adopted within enterprises, as well as the ethical challenges it presents, including discrimination and data validity. Matt also discusses the importance of AI governance and offers a preview of his upcoming presentation on this topic. Matt expresses his eagerness to engage with other GRC professionals at the forthcoming conference to exchange ideas and discuss emerging risks in third-party and vendor risk management.

Resources:

#Risk Conference Series

#RiskNYC—Tickets and Information

Matt Kelly on LinkedIn

Categories
Great Women in Compliance

Great Women in Compliance – Culture. Data. Ethics with Hui Chen

Hui Chen is a luminary in the world of Ethics and Compliance, and she is our guest on today’s episode of Great Women in Compliance. Today, Hui is one of the co-founders of CDE Advisors, which stands for “Culture. Data. Ethics.”

Most of us know Hui from her work at the Department of Justice (DOJ) and her contributions to the Evaluation of Corporate Compliance for the Fraud Section. However, my career path included being a prosecutor, in-house compliance work, and even being inspired to pursue a Master’s degree in Divinity after the 9/11 attacks.

Hui discusses the origins of the ECCP and her perspective on its current use. She also discusses the opportunity in the “FCPA pause” and how organizations can broaden their ethical considerations beyond foreign bribery to focus on relationships with all stakeholders. She discussed how the focus on regulatory guidance, particularly on bribery outside the United States, is just one of many areas to consider as a compliance professional. 

She also offers practical advice based on her experiences working with global compliance functions and the lessons she has learned.