Categories
Red Flags Rising

Red Flags Rising: S01 E33: Back to Basics

As the geopolitical and national political winds continue to swirl, Mike & Brent go back to basics to level-set and provide some foundational first principles of export controls compliance. They discuss the roller-coaster of the Affiliates Rule suspension (01:44); why the real risks from a compliance and enforcement perspective lay just outside of the Rule (02:37); how General Prohibition 10, the full definition of “knowledge” to include “an awareness of a high probability,” and the various inchoate provisions (i.e., causing, aiding and abetting, solicitation and attempt, conspiracy, acting with knowledge, misrepresentation and concealment, intent to evade, and failure to comply with recordkeeping requirements) are the foundational anti-diversion provisions under the U.S. Export Administration Regulations (EAR) (03:02); great listener feedback about how the Affiliates Rule shaped the in-house discussion of diversion risk (05:23); developing and implementing a high probability protocol as the only way to stay grounded in dynamic and challenging times (08:33); recent legislative proposals and hearings, including a recent hearing by a subcommittee of the House Foreign Affairs Committee focused on export control loopholes, and the dangers of a dissatisfied U.S. Congress (09:42); why the definition of “knowledge” under the EAR is not mere legalese to be lost in the 1,467 pages (as of January 1, 2025) of the EAR but is instead the path forward for both government and industry (14:18); the details and implications of General Prohibition 10 (17:11); the details of the full definition of “knowledge,” including what we can learn from its history in the U.S. Foreign Corrupt Practices Act and, before then, the Model Penal Code (18:48); and recent enforcement activity by DOJ and BIS, and what the activity signals about the government’s next enforcement moves (22:30).

They then conclude with the latest installment of Brent’s increasingly popular “Managing Up” segment (27:14).

Resources:

Brent’s latest NYU Law School Program on Corporate Compliance & Enforcement post, from October 31, 2025

Brent’s email: brent@redflagsrising.com

Mike’s email: michael.huneke@morganlewis.com

Categories
Blog

Why AI Demands a New Breed of Leaders: A Compliance Perspective

Artificial intelligence is no longer a distant future state for compliance teams. It is here, operating inside financial crime platforms, powering third-party due diligence tools, driving monitoring engines, and influencing the everyday judgments that regulators scrutinize. Yet too many companies still approach AI as if it were simply another IT project. In a recent Sloan Management Review article, Why AI Demands a New Breed of Leader,” the authors, Faisal Hoque, Thomas H. Davenport, and Erik Nelson, argue that successful AI transformation is far more about people, culture, and leadership than about code.

For compliance professionals, that should sound familiar. Every major enforcement action of the last decade has shown that failure rarely begins with a faulty system. Failure begins with leadership that misunderstands risk, a culture that resists change, and governance frameworks that cannot keep pace with new technologies.

The authors argue that modern organizations require a new category of leader to guide AI adoption, a role that blends technical capability with cultural stewardship, ethical understanding, and organizational change management. They call this the Chief Innovation and Transformation Officer (CITO) or an equivalent title. Whether companies formally adopt the title or not, the message is unmistakable: AI changes the leadership equation, and compliance has a front-row seat.

Why Traditional Technology Leadership Is No Longer Enough

While CIOs are increasingly viewed as changemakers, they often lack the time and mandate to address the organizational disruption AI brings. Compliance officers understand this problem intuitively. You can have the most sophisticated tools in the world, but if the culture is not ready for them, the result will be chaos or even misconduct. The authors cite survey data showing that 91 percent of large-company data leaders believe cultural issues, not technical ones, are blocking progress. That finding mirrors what compliance sees in every DOJ corporate enforcement action. Misconduct thrives not because technology fails, but because people and processes fail.

The article also includes examples of organizations that stumbled by treating AI as a purely technical deployment. The Zillow pricing model collapsed. The swift employee backlash at California State University. The Air Canada chatbot that mishandled bereavement fare guidance. Each case reveals the same lesson: AI without governance becomes a liability. For compliance professionals evaluating AI adoption, these examples should resonate. AI raises questions about transparency, fairness, documentation, accountability, and the human impact of automation. Those are governance issues, not engineering puzzles.

The New Leadership Model AI Demands

The authors describe several competencies required for effective AI leadership, all of which map directly into compliance priorities:

Navigating ethical considerations.

AI introduces bias, harm, and fairness risks, all of which are central concerns for regulators. Leaders must weigh efficiency gains against ethical boundaries.

Driving cultural transformation.

AI adoption changes workflows, reporting lines, incentives, and human-machine collaboration. Leadership must prepare the workforce for new models of decision-making.

Managing human-AI partnerships.

The near-future compliance program will rely on co-decision systems that combine algorithmic outputs with human judgment. Leaders must understand how to balance the two.

Breaking down silos.

AI implementation touches HR, legal, IT, operations, procurement, and compliance. Leadership must connect these functions rather than allow fragmented approaches.

Overseeing citizen development.

Employees across the business can now build AI models without IT involvement. That democratization requires governance and guardrails.

These competencies go far beyond traditional CIO responsibilities. They lean toward behavior, judgment, and organizational change, the same strengths compliance brings to the table.

Emerging Executive Roles Around AI

The article documents the rapid rise of AI-focused executive roles such as Chief Innovation Officer, Chief AI Officer, and Chief Transformation Officer. Compensation is rising, hiring is accelerating, and responsibilities increasingly blend technology, ethics, culture, and strategy.

The authors highlight examples:

  • PepsiCo’s Chief Strategy and Transformation Officer is overseeing enterprise-wide digitization.
  • Standard Chartered’s Chief Transformation, Technology, and Operations Officer.
  • JPMorgan Chase’s governance model for IndexGPT and AI-driven investment analysis.

These roles share a common trait: they embed ethics, cultural change, and strategic alignment directly into AI governance. This direction should reassure compliance officers. Regulators have signaled that they expect AI oversight to be integrated, accountable, and verifiable. A dedicated AI leadership role can help unify these obligations.

AI Persona Management: The Next Frontier of Governance

One of the most intriguing sections of the article describes “AI persona management,” the oversight of digital agents with defined personalities, roles, and decision-making authority. As AI becomes more autonomous, these personas may behave like digital employees. That raises profound governance questions.

Compliance professionals should begin considering:

  • What decision rights will AI personas have?
  • How will we document their logic?
  • How will we audit their behavior?
  • How will we ensure ethical consistency across different personas?

The authors note that Salesforce already uses AI personas internally to guide product decisions. That should serve as a signal: AI agents are not a theoretical concept; they are entering the enterprise now. A compliance professional will need to treat AI personas with the same seriousness as human employees, subject to monitoring, training, policies, escalation channels, and accountability structures.

What This Means for Corporate Compliance Leaders

The article argues that companies must rethink how they manage technology change. AI’s impact is too broad to remain confined to the IT organization. Talent, culture, ethics, governance, and risk management all intersect. The authors present the CITO role as the logical solution for a leader who integrates technical fluency with organizational psychology and ethical judgment.

From a compliance standpoint, this represents both an opportunity and a responsibility. The opportunity is clear: compliance brings exactly the kind of cross-functional, ethics-driven perspective AI leadership requires. The compliance function knows how to document decisions, manage cultural change, develop defensible processes, and build controls around complex risks.

The responsibility is equally clear: AI will soon permeate every corner of the enterprise. If compliance does not assert its role in governance, the organization will drift toward risk. This article provides a roadmap for what strong governance must look like. It tells companies that AI success demands a leader capable of bridging technical, ethical, and cultural domains, the very domains compliance has long mastered.

Now is the moment for compliance to claim its seat at the AI leadership table, helping shape the systems that will define operational and ethical performance for years to come.

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – Doing Business (and Compliance) in India with Joseph Azam

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, Joseph Azam discusses the panel at the event. Their presentation is entitled “On the Ground in India: Special Considerations for Compliance, Risk Management, and Third-Party Oversight—Practical Takeaways from Real-World Experiences.

Some of the issues the panel will discuss are:

  • Corruption risk specific to India.
  • Long-term strategies for effective due diligence in India and
  • Aligning global expectations with local realities.

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots-on-the-ground experience encountering the high risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.

Categories
Blog

The SFO’s New Compliance Program Guidance: Compliance is a Verb

The Serious Fraud Office’s 2025 Guidance on Evaluating a Corporate Compliance Program is more than another regulatory document. It is a bright line in the sand. It says, with unmistakable clarity, that compliance must move beyond paper, policies, and PowerPoints. The era of check-the-box compliance is over. The SFO wants to know whether your program works, whether it is embedded, and whether it actually shapes employee behavior at the moment of risk.

For corporate compliance professionals, this should be welcome news. For years, I have advocated that compliance is effective only when it is operationalized, when it is woven into business processes, incentives, controls, communications, and culture. Indeed, it is the subtitle of my seminal work, The Compliance Handbook: A Guide to Operationalizing Your Compliance Program. The SFO has now said the quiet part out loud: if your program does not function in practice, it will not be credited, and it will not protect the organization in the moments that matter most.

The SFO Is Not Evaluating Paper. It Is Evaluating Performance.

The SFO identifies six scenarios in which it evaluates a company’s compliance program, including charging decisions, DPAs, monitorships, and statutory defenses under the Bribery Act and the ECCTA failure-to-prevent fraud offence. In each scenario, the question is the same: did the program work at the time of the misconduct, and does it work today?

The guidance explicitly flags that a company with an ineffective program at the time of the offence faces a public-interest factor in favor of prosecution. Conversely, proactive remediation and an already-effective program weigh against prosecution. This is a radical shift in emphasis. A policy framework will not suffice. A training slide deck will not suffice. A risk assessment performed once every three years will not suffice.

The SFO wants evidence of operational behavior:

  • Were approvals actually checked, or were they just required?
  • Were red flags escalated in practice, not just in policy?
  • Were third-party risks managed through real due diligence, not just questionnaires?
  • Did employees feel empowered to speak up?
  • Did managers respond appropriately when they did?

The guidance says it plainly: “A key feature of any compliance program is that it needs to be effective and not simply a ‘paper exercise.’” That sentence should be printed above every compliance officer’s door.

Adequate vs. Reasonable vs. Effective: The SFO’s Focus Is on Reality

The legal standards differ across regimes: “adequate procedures” for the Bribery Act and “reasonable procedures” for ECCTA failure to prevent fraud, but the SFO’s approach is consistent across all of them. The prosecutor will examine whether the program operated as designed. A beautifully written policy that sits untouched in a shared drive does nothing for your defense. Under both frameworks, the principles are clear:

  • Top-level commitment must be visible and sustained.
  • Tone-from-the-top is no longer a slogan. Executives must demonstrate operational ownership through resources, messaging, and decisions.
  • Risk assessments must be dynamic and documented.
  • Periodic reviews are insufficient. Companies must revisit risks as business models, markets, and products evolve.
  • Due diligence must be risk-based and enforced.
  • The SFO will look for evidence of follow-through: actual reviews, remediation steps, and periodic refreshes, not just questionnaires.
  • Training must reach the right people, at the right depth, at the right time.
  • If frontline staff cannot articulate how policies apply to real situations, the program is not embedded.
  • Monitoring and review must capture failures and lead to improvements.
  • The SFO expects companies to learn from investigations, whistleblowing incidents, and near misses.

These principles have one common trait: they require action, not intention. Indeed, it is clear that “compliance” is a verb.

How the SFO Looks Behind the Curtain

The SFO’s FAQs section is an important reality check. The agency describes its evaluation process as holistic, evidence-based, and focused on operational activity (pages 10–12). It will use every investigative tool at its disposal.

This includes:

  • voluntary disclosures
  • compelled document production under section 2
  • witness interviews
  • suspect interviews
  • direct questions to the organization

Why is this important? Because the SFO is not taking the company’s word for anything. Assertions are not evidence. The agency will “dig behind generalities and challenge high-level assertions” to determine whether policies translate into conduct. In other words, if the program only exists in policy language, the SFO will know and quickly.

DPAs and Monitorships: Operationalized Compliance Determines Outcomes

When considering whether a DPA is appropriate, the SFO again focuses on whether the program works in practice. A DPA is less likely if the program was ineffective at the time of the offence and has not substantially improved since. If the program failed but is now demonstrably effective, a DPA becomes more viable. If a monitorship is imposed, the SFO expects the monitor to advise on “necessary compliance improvements” that reduce future risk. This language reinforces a core message: compliance must be operational, measurable, and continuously improving.

For companies negotiating a DPA, this means a surge of paper policy updates is not persuasive. What prosecutors want to see is changed behavior, improved controls, and evidence that new measures are taking hold across the organization.

The Shift from Compliance as Documentation to Compliance as a Business System

The guidance mirrors a shift seen globally from the DOJ’s “three questions” to the French AFA’s operational guidance and places the United Kingdom in alignment with international enforcement trends.

Across regimes, regulators are converging on the same model:

  1. A well-designed program.
  2. Adequate resources and authority to operate.
  3. Proof that the program works in practice.

The SFO’s guidance aligns directly with this structure. For compliance officers, that means your influence must go beyond policy drafting. Compliance must embed itself into:

  • procurement workflows
  • HR processes
  • incentives and compensation frameworks
  • approval systems
  • financial controls
  • business-development oversight
  • investigation protocols
  • continuous monitoring and data analytics
  • leadership behavior
  • cultural reinforcement mechanisms

This is what it means to operationalize compliance. A check-the-box program may look good in a binder. But it will not protect the company from enforcement, reputational harm, or sentencing penalties. A program that works in practice. This means real controls, real accountability, real culture, and a real will to do so.

The Message for Compliance Leaders

The SFO is telling companies something essential: The risk is not that you have a compliance failure. The risk is that your compliance program cannot prevent one. Your company can withstand a failure. It cannot withstand a failure in a system that does not exist.

The guidance signals a new enforcement reality: companies that invest in operationalized compliance, which is truly embedded into how people work, will be treated differently, prosecuted differently, and negotiated with differently. For compliance leaders, the priority is clear. This is the moment to shift your program from aspirational to operational. Because when regulators ask whether your program works, the only answer that matters now is evidence.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – M&A-Pre-Acquisition Phase: Understanding the Nature of the Problem

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice for navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide you with bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

This week, we look at the role of compliance in the pre-acquisition phase of a merger and acquisition. We begin by considering the nature of the issue and the role of pre-acquisition due diligence.

For more on this topic, check out The Compliance Handbook: A Guide to Operationalizing your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Daily Compliance News

Daily Compliance News: December 1, 2025, The Fraud at Chelsea Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • New York State could be a battleground for AI regulation. (NYT)
  • Chelsea employee admits to fraud. (BBC)
  • More protests on Philippine corruption. (Bloomberg)
  • Insurer pulling back from the cyber market. (FT)

The Daily Compliance News has been honored as No. 2 in the Best Regulatory Compliance Podcasts category.

Categories
FCPA Compliance Report

FCPA Compliance Report – Navigating Uncertainty: Leading with Courage and Clarity with Jim Massey

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast in compliance. In this episode, Tom welcomes Jim Massey, who has recently released a new book, Risk in Action.

Jim Massey, an accomplished author and behaviorist practitioner, delves into the intricate dynamics of trust within leadership through his book “Risk in Action.” Drawing from his extensive experience in high-stakes boardrooms and executive sessions, Massey emphasizes the crucial role of trust as a foundation for effective action. He explores the interconnected nature of trust, risk, and fear, urging individuals to redefine risk as a prioritization tool that enables progress and bold decision-making. By addressing these themes, Massey aims to spark vital conversations and empower leaders to embrace uncertainty, ultimately encouraging them to take courageous actions that drive growth and innovation.

Key highlights:

  • Navigating Trust, Risk, and Fear in Leadership
  • Enhancing Business Outcomes through Proactive Risk Management
  • Cultivating Innovation Through Compliance Transformation
  • Embracing Fear for Innovative Growth
  • Dynamic Risk Assessment for Compliance Agility
  • Navigating Uncertainty: Leading with Courage and Clarity

Resources:

Risk in Action on Amazon

Jim Massey Website

Jim Massey on LinkedIn

Eastward.ai Website

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
AI Today in 5

AI Today in 5: December 1, 2025, The Transforming Due Diligence Edition

Welcome to AI Today in 5, the newest edition of the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. 3 keys to AI in banking. (Financial Brand)
  2. New York State could be a battleground for AI regulation. (NYT)
  3. Agentic AI for hackers. (FT)
  4. Shadow AI to digital disruption. (Digital Journal)
  5. How AI is transforming due diligence. (FinTechGlobal)

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – DOJ and FCPA Enforcement Update with David Last

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, David Last discusses his fireside chat at the event with David Fuhr, current head of the FCPA Unit at the DOJ. Their presentation is titled “Year in Review with DOJ: The Big Picture of Enforcement for 2026.

Some of the issues the panel will discuss are:

  • Changes in FCPA enforcement in 2026;
  • End of monitorships? and
  • Where will enforcement be headed for 2026 and beyond?

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots on the ground, encountering the very risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – Matthew R. Galeotti to Keynote the ACI-FCPA and Global Anti-Corruption Conference

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, Nicole Pitti discusses the Keynote speech by Acting Assistant Attorney General Matthew R. Galeotti.

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots on the ground, encountering the very risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.