Categories
Word of the Week

Word of the Week with Kenneth O’Neal – Exploring Identity: Gumption, Grit, Guts, and Grace

Each week, Kenneth O’Neal discusses a word that describes a principle or value of the Qualities of Success. We suggest you use the Word of the Week in your thoughts, deeds, and actions. You might currently possess the qualities and the desire to further develop them.  You could replace a bad habit with a good habit. Write an action step and use it daily to develop the Quality in your Life. In this episode, Kenneth discusses the word ‘Identity’.

Kenneth delves into the concept of identity, encouraging listeners to write down the word of the week, ‘identity,’ and use it in their conversations and actions. The discussion highlights the meaning of identity and its importance in distinguishing individuals. It explores two main pathways: creating identity through external influences or receiving it based on personal beliefs and values. O’Neal outlines key principles from their work, including gumption, grit, guts, and grace, as well as leadership and legacy. He emphasizes the importance of discovering one’s identity and being intentional, purpose-driven, and resilient, while highlighting leadership as a form of influence shaped by identity and integrity.

Highlights:

  • Word of the Week: Identity
  • Understanding Identity
  • Two Paths of Identity
  • Leadership and Legacy

Resources:

KRONEAL Consulting

Categories
Compliance Tip of the Day

Compliance Tip of the Day – M&A-Pre-Acquisition: Conducting a Corruption Risk Assessment

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice for navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide you with bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

We continue our look at the role of compliance in the pre-acquisition phase of a merger and acquisition. Today, we consider the need for a corruption risk assessment.

For more on this topic, check out The Compliance Handbook: A Guide to Operationalizing your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Everything Compliance - Shout Outs and Rants

Everything Compliance – Shout Outs & Rants: Episode 162, Numbers, Numbers, Numbers

Welcome to the fan fav of Everything Compliance—Shout-Outs and Rants. In this episode, we have the quartet of Matt Kelly, Jonathan Marks, and special guests Lisa Fine and Dr. Hemma Lomax with Tom Fox, the Compliance Evangelist, as host.

  1. Matt Kelly shouts out to the ChatGPT em-dash and rants about the federal government’s attempts to ban all state regulation of AI.
  2. Jonathan Marks shouts out to MacKenzie Scott for her $70 million donation to Historically Black Colleges and Universities (HBCUs) in 2025, continuing her support after a $560 million donation to 27 HBCUs in 2020.
  3. Special Guest Panelist Dr. Hemma Lomax rants about ChatGPT em dashes and shouts out recent legal tech conferences.
  4. Special Guest Panelist Lisa Fine shouts out to the Compliance Week survey, Inside the Mind of the CCO, and encourages all listeners to participate.
  5. Tom Fox shouts out to Gen Z and traces their play with the numbers 6 and 7, and the use of numerology in texts back to the Book of Genesis and the ancient text of Gilgamesh.

The members of Everything Compliance are:

The host, producer, and sometimes panelist of Everything Compliance is Tom Fox, the Voice of Compliance. He can be reached at tfox@tfoxlaw.com.  The award-winning Everything Compliance is a part of the Compliance Podcast Network.

Categories
Innovation in Compliance

Innovation in Compliance – Steph Holmes on Blending AI and Human Oversight for Effective Compliance

Innovation spans many areas, and compliance professionals need not only to be ready for it but also to embrace it. Join Tom Fox, the Voice of Compliance, as he visits with top innovative minds, thinkers, and creators in the award-winning Innovation in Compliance podcast. In this episode, host Tom welcomes Steph Holmes, long-time friend and Director of Ethics and Compliance Strategy at the EQS Group, who looks at the current Intersection of AI and compliance.

Steph Holmes and EQS are both at the forefront of integrating artificial intelligence (AI) into compliance programs to enhance their efficiency and effectiveness. With a focus on practical applications, Holmes views AI as a crucial tool for expanding resources, especially as organizations face increasing regulatory changes and economic pressures. She advocates for the responsible, sustainable, and explainable adoption of AI, emphasizing that compliance professionals should embrace it rather than fear it. Holmes discusses the importance of blending AI capabilities with human oversight to ensure compliance tasks are managed accurately and risks are mitigated effectively.

Key highlights:

  • Digitizing Compliance: AI Tools and Programs
  • Navigating Compliance Challenges with Human Judgment
  • Enhancing AI Reliability Through Human Oversight
  • Enhancing Compliance through Responsible AI Implementation
  • Implementing AI Pilot Programs in Compliance Workflows

Resources:

Steph Holmes on LinkedIn

EQS Group LinkedIn

Where in the Loop: Corporate Compliance Insights

EQS Website

EQS Benchmark Report: AI Performance in Compliance & Ethics

Innovation in Compliance was recently ranked 4th among Risk Management podcasts by 1,000,000 Podcasts.

Categories
AI Today in 5

AI Today in 5: December 2, 2025, The AI as Threat to EU Banks Edition

Welcome to AI Today in 5, the newest edition of the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  1. Is AI a threat to EU banking? (Bloomberg)
  2. FDA expands use of Agentic AI. (FDA Press Release)
  3. Federal exemption is a financial windfall for Big Tech. (CFO Dive)
  4. Agentic AI for remediation. (PR Newswire)
  5. FreemarketFX launches new AI tools. (FinTechGlobal)

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com.

Categories
Daily Compliance News

Daily Compliance News: December 2, 2025, The Tuna Bond Fraud Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • Massive fraud in aircraft parts uncovered in the UK. (The Times)
  • Switzerland charges Credit Suisse over Tuna Bond fraud. (ACAMS)
  • Corruption scandals impact the Chinese Army. (Reuters)
  • Former Labour MP convicted of corruption in Bangladesh. (Independent)

The Daily Compliance News has been honored as No. 2 in the Best Regulatory Compliance Podcasts category.

Categories
Red Flags Rising

Red Flags Rising: S01 E33: Back to Basics

As the geopolitical and national political winds continue to swirl, Mike & Brent go back to basics to level-set and provide some foundational first principles of export controls compliance. They discuss the roller-coaster of the Affiliates Rule suspension (01:44); why the real risks from a compliance and enforcement perspective lay just outside of the Rule (02:37); how General Prohibition 10, the full definition of “knowledge” to include “an awareness of a high probability,” and the various inchoate provisions (i.e., causing, aiding and abetting, solicitation and attempt, conspiracy, acting with knowledge, misrepresentation and concealment, intent to evade, and failure to comply with recordkeeping requirements) are the foundational anti-diversion provisions under the U.S. Export Administration Regulations (EAR) (03:02); great listener feedback about how the Affiliates Rule shaped the in-house discussion of diversion risk (05:23); developing and implementing a high probability protocol as the only way to stay grounded in dynamic and challenging times (08:33); recent legislative proposals and hearings, including a recent hearing by a subcommittee of the House Foreign Affairs Committee focused on export control loopholes, and the dangers of a dissatisfied U.S. Congress (09:42); why the definition of “knowledge” under the EAR is not mere legalese to be lost in the 1,467 pages (as of January 1, 2025) of the EAR but is instead the path forward for both government and industry (14:18); the details and implications of General Prohibition 10 (17:11); the details of the full definition of “knowledge,” including what we can learn from its history in the U.S. Foreign Corrupt Practices Act and, before then, the Model Penal Code (18:48); and recent enforcement activity by DOJ and BIS, and what the activity signals about the government’s next enforcement moves (22:30).

They then conclude with the latest installment of Brent’s increasingly popular “Managing Up” segment (27:14).

Resources:

Brent’s latest NYU Law School Program on Corporate Compliance & Enforcement post, from October 31, 2025

Brent’s email: brent@redflagsrising.com

Mike’s email: michael.huneke@morganlewis.com

Categories
Blog

Why AI Demands a New Breed of Leaders: A Compliance Perspective

Artificial intelligence is no longer a distant future state for compliance teams. It is here, operating inside financial crime platforms, powering third-party due diligence tools, driving monitoring engines, and influencing the everyday judgments that regulators scrutinize. Yet too many companies still approach AI as if it were simply another IT project. In a recent Sloan Management Review article, Why AI Demands a New Breed of Leader,” the authors, Faisal Hoque, Thomas H. Davenport, and Erik Nelson, argue that successful AI transformation is far more about people, culture, and leadership than about code.

For compliance professionals, that should sound familiar. Every major enforcement action of the last decade has shown that failure rarely begins with a faulty system. Failure begins with leadership that misunderstands risk, a culture that resists change, and governance frameworks that cannot keep pace with new technologies.

The authors argue that modern organizations require a new category of leader to guide AI adoption, a role that blends technical capability with cultural stewardship, ethical understanding, and organizational change management. They call this the Chief Innovation and Transformation Officer (CITO) or an equivalent title. Whether companies formally adopt the title or not, the message is unmistakable: AI changes the leadership equation, and compliance has a front-row seat.

Why Traditional Technology Leadership Is No Longer Enough

While CIOs are increasingly viewed as changemakers, they often lack the time and mandate to address the organizational disruption AI brings. Compliance officers understand this problem intuitively. You can have the most sophisticated tools in the world, but if the culture is not ready for them, the result will be chaos or even misconduct. The authors cite survey data showing that 91 percent of large-company data leaders believe cultural issues, not technical ones, are blocking progress. That finding mirrors what compliance sees in every DOJ corporate enforcement action. Misconduct thrives not because technology fails, but because people and processes fail.

The article also includes examples of organizations that stumbled by treating AI as a purely technical deployment. The Zillow pricing model collapsed. The swift employee backlash at California State University. The Air Canada chatbot that mishandled bereavement fare guidance. Each case reveals the same lesson: AI without governance becomes a liability. For compliance professionals evaluating AI adoption, these examples should resonate. AI raises questions about transparency, fairness, documentation, accountability, and the human impact of automation. Those are governance issues, not engineering puzzles.

The New Leadership Model AI Demands

The authors describe several competencies required for effective AI leadership, all of which map directly into compliance priorities:

Navigating ethical considerations.

AI introduces bias, harm, and fairness risks, all of which are central concerns for regulators. Leaders must weigh efficiency gains against ethical boundaries.

Driving cultural transformation.

AI adoption changes workflows, reporting lines, incentives, and human-machine collaboration. Leadership must prepare the workforce for new models of decision-making.

Managing human-AI partnerships.

The near-future compliance program will rely on co-decision systems that combine algorithmic outputs with human judgment. Leaders must understand how to balance the two.

Breaking down silos.

AI implementation touches HR, legal, IT, operations, procurement, and compliance. Leadership must connect these functions rather than allow fragmented approaches.

Overseeing citizen development.

Employees across the business can now build AI models without IT involvement. That democratization requires governance and guardrails.

These competencies go far beyond traditional CIO responsibilities. They lean toward behavior, judgment, and organizational change, the same strengths compliance brings to the table.

Emerging Executive Roles Around AI

The article documents the rapid rise of AI-focused executive roles such as Chief Innovation Officer, Chief AI Officer, and Chief Transformation Officer. Compensation is rising, hiring is accelerating, and responsibilities increasingly blend technology, ethics, culture, and strategy.

The authors highlight examples:

  • PepsiCo’s Chief Strategy and Transformation Officer is overseeing enterprise-wide digitization.
  • Standard Chartered’s Chief Transformation, Technology, and Operations Officer.
  • JPMorgan Chase’s governance model for IndexGPT and AI-driven investment analysis.

These roles share a common trait: they embed ethics, cultural change, and strategic alignment directly into AI governance. This direction should reassure compliance officers. Regulators have signaled that they expect AI oversight to be integrated, accountable, and verifiable. A dedicated AI leadership role can help unify these obligations.

AI Persona Management: The Next Frontier of Governance

One of the most intriguing sections of the article describes “AI persona management,” the oversight of digital agents with defined personalities, roles, and decision-making authority. As AI becomes more autonomous, these personas may behave like digital employees. That raises profound governance questions.

Compliance professionals should begin considering:

  • What decision rights will AI personas have?
  • How will we document their logic?
  • How will we audit their behavior?
  • How will we ensure ethical consistency across different personas?

The authors note that Salesforce already uses AI personas internally to guide product decisions. That should serve as a signal: AI agents are not a theoretical concept; they are entering the enterprise now. A compliance professional will need to treat AI personas with the same seriousness as human employees, subject to monitoring, training, policies, escalation channels, and accountability structures.

What This Means for Corporate Compliance Leaders

The article argues that companies must rethink how they manage technology change. AI’s impact is too broad to remain confined to the IT organization. Talent, culture, ethics, governance, and risk management all intersect. The authors present the CITO role as the logical solution for a leader who integrates technical fluency with organizational psychology and ethical judgment.

From a compliance standpoint, this represents both an opportunity and a responsibility. The opportunity is clear: compliance brings exactly the kind of cross-functional, ethics-driven perspective AI leadership requires. The compliance function knows how to document decisions, manage cultural change, develop defensible processes, and build controls around complex risks.

The responsibility is equally clear: AI will soon permeate every corner of the enterprise. If compliance does not assert its role in governance, the organization will drift toward risk. This article provides a roadmap for what strong governance must look like. It tells companies that AI success demands a leader capable of bridging technical, ethical, and cultural domains, the very domains compliance has long mastered.

Now is the moment for compliance to claim its seat at the AI leadership table, helping shape the systems that will define operational and ethical performance for years to come.

Categories
ACI FCPA Conference 2025

ACI-FCPA Conference Speaker Preview Series – Doing Business (and Compliance) in India with Joseph Azam

In this episode of the ACI-FCPA and Global Anti-Corruption Conference Speaker Podcasts series, Joseph Azam discusses the panel at the event. Their presentation is entitled “On the Ground in India: Special Considerations for Compliance, Risk Management, and Third-Party Oversight—Practical Takeaways from Real-World Experiences.

Some of the issues the panel will discuss are:

  • Corruption risk specific to India.
  • Long-term strategies for effective due diligence in India and
  • Aligning global expectations with local realities.

I hope you can join me at the ACI–FCPA Conference. This year’s event will take place on December 3-4 at the Gaylord National Resort & Convention Center in National Harbor, Maryland, near Washington, D.C. The lineup of this year’s event is simply first-rate, featuring some of the top FCPA professionals, white-collar attorneys, and compliance practitioners in the field.

The 2025 program is being completely redesigned to help your organization stay agile, responsive, and ahead of the curve. Expect a dynamic agenda shaped by real-world priorities, practical takeaways, and the most cutting-edge thinking in compliance—led by a faculty of global practitioners with boots-on-the-ground experience encountering the high risks that come across your desk.

Please join me at the event. For information on the event, click here. Listeners of this podcast will receive a discount by using the code D10-999-CPN26.

Categories
Blog

The SFO’s New Compliance Program Guidance: Compliance is a Verb

The Serious Fraud Office’s 2025 Guidance on Evaluating a Corporate Compliance Program is more than another regulatory document. It is a bright line in the sand. It says, with unmistakable clarity, that compliance must move beyond paper, policies, and PowerPoints. The era of check-the-box compliance is over. The SFO wants to know whether your program works, whether it is embedded, and whether it actually shapes employee behavior at the moment of risk.

For corporate compliance professionals, this should be welcome news. For years, I have advocated that compliance is effective only when it is operationalized, when it is woven into business processes, incentives, controls, communications, and culture. Indeed, it is the subtitle of my seminal work, The Compliance Handbook: A Guide to Operationalizing Your Compliance Program. The SFO has now said the quiet part out loud: if your program does not function in practice, it will not be credited, and it will not protect the organization in the moments that matter most.

The SFO Is Not Evaluating Paper. It Is Evaluating Performance.

The SFO identifies six scenarios in which it evaluates a company’s compliance program, including charging decisions, DPAs, monitorships, and statutory defenses under the Bribery Act and the ECCTA failure-to-prevent fraud offence. In each scenario, the question is the same: did the program work at the time of the misconduct, and does it work today?

The guidance explicitly flags that a company with an ineffective program at the time of the offence faces a public-interest factor in favor of prosecution. Conversely, proactive remediation and an already-effective program weigh against prosecution. This is a radical shift in emphasis. A policy framework will not suffice. A training slide deck will not suffice. A risk assessment performed once every three years will not suffice.

The SFO wants evidence of operational behavior:

  • Were approvals actually checked, or were they just required?
  • Were red flags escalated in practice, not just in policy?
  • Were third-party risks managed through real due diligence, not just questionnaires?
  • Did employees feel empowered to speak up?
  • Did managers respond appropriately when they did?

The guidance says it plainly: “A key feature of any compliance program is that it needs to be effective and not simply a ‘paper exercise.’” That sentence should be printed above every compliance officer’s door.

Adequate vs. Reasonable vs. Effective: The SFO’s Focus Is on Reality

The legal standards differ across regimes: “adequate procedures” for the Bribery Act and “reasonable procedures” for ECCTA failure to prevent fraud, but the SFO’s approach is consistent across all of them. The prosecutor will examine whether the program operated as designed. A beautifully written policy that sits untouched in a shared drive does nothing for your defense. Under both frameworks, the principles are clear:

  • Top-level commitment must be visible and sustained.
  • Tone-from-the-top is no longer a slogan. Executives must demonstrate operational ownership through resources, messaging, and decisions.
  • Risk assessments must be dynamic and documented.
  • Periodic reviews are insufficient. Companies must revisit risks as business models, markets, and products evolve.
  • Due diligence must be risk-based and enforced.
  • The SFO will look for evidence of follow-through: actual reviews, remediation steps, and periodic refreshes, not just questionnaires.
  • Training must reach the right people, at the right depth, at the right time.
  • If frontline staff cannot articulate how policies apply to real situations, the program is not embedded.
  • Monitoring and review must capture failures and lead to improvements.
  • The SFO expects companies to learn from investigations, whistleblowing incidents, and near misses.

These principles have one common trait: they require action, not intention. Indeed, it is clear that “compliance” is a verb.

How the SFO Looks Behind the Curtain

The SFO’s FAQs section is an important reality check. The agency describes its evaluation process as holistic, evidence-based, and focused on operational activity (pages 10–12). It will use every investigative tool at its disposal.

This includes:

  • voluntary disclosures
  • compelled document production under section 2
  • witness interviews
  • suspect interviews
  • direct questions to the organization

Why is this important? Because the SFO is not taking the company’s word for anything. Assertions are not evidence. The agency will “dig behind generalities and challenge high-level assertions” to determine whether policies translate into conduct. In other words, if the program only exists in policy language, the SFO will know and quickly.

DPAs and Monitorships: Operationalized Compliance Determines Outcomes

When considering whether a DPA is appropriate, the SFO again focuses on whether the program works in practice. A DPA is less likely if the program was ineffective at the time of the offence and has not substantially improved since. If the program failed but is now demonstrably effective, a DPA becomes more viable. If a monitorship is imposed, the SFO expects the monitor to advise on “necessary compliance improvements” that reduce future risk. This language reinforces a core message: compliance must be operational, measurable, and continuously improving.

For companies negotiating a DPA, this means a surge of paper policy updates is not persuasive. What prosecutors want to see is changed behavior, improved controls, and evidence that new measures are taking hold across the organization.

The Shift from Compliance as Documentation to Compliance as a Business System

The guidance mirrors a shift seen globally from the DOJ’s “three questions” to the French AFA’s operational guidance and places the United Kingdom in alignment with international enforcement trends.

Across regimes, regulators are converging on the same model:

  1. A well-designed program.
  2. Adequate resources and authority to operate.
  3. Proof that the program works in practice.

The SFO’s guidance aligns directly with this structure. For compliance officers, that means your influence must go beyond policy drafting. Compliance must embed itself into:

  • procurement workflows
  • HR processes
  • incentives and compensation frameworks
  • approval systems
  • financial controls
  • business-development oversight
  • investigation protocols
  • continuous monitoring and data analytics
  • leadership behavior
  • cultural reinforcement mechanisms

This is what it means to operationalize compliance. A check-the-box program may look good in a binder. But it will not protect the company from enforcement, reputational harm, or sentencing penalties. A program that works in practice. This means real controls, real accountability, real culture, and a real will to do so.

The Message for Compliance Leaders

The SFO is telling companies something essential: The risk is not that you have a compliance failure. The risk is that your compliance program cannot prevent one. Your company can withstand a failure. It cannot withstand a failure in a system that does not exist.

The guidance signals a new enforcement reality: companies that invest in operationalized compliance, which is truly embedded into how people work, will be treated differently, prosecuted differently, and negotiated with differently. For compliance leaders, the priority is clear. This is the moment to shift your program from aspirational to operational. Because when regulators ask whether your program works, the only answer that matters now is evidence.