Categories
Regulatory Ramblings

Regulatory Ramblings: Episode 70 – Lessons for Compliance from a Law Enforcement Career + Regional Geopolitical Risks in 2025 with Mark Nuttall and Steve Vickers

The common theme of today’s episode is our guests—we will be speaking with two distinguished law enforcement veterans about different matters. More specifically, in our initial Spotlight segment, we’ll be having a chat with risk management specialist and former Royal Hong Kong Police Force alumnus Steve Vickers about political risk across the Asia-Pacific region.

Following that, we have a discussion with Dubai-based Mark Nuttall on how his career in law enforcement has worthwhile lessons for the compliance profession.

Steve Vickers

Steve Vickers is the founder and CEO of Steve Vickers & Associates—a specialist risk and security consultancy with a presence in Hong Kong, Singapore, Kuala Lumpur, and London.

As an expert in resolving kidnapping and product extortion cases, he also draws upon an unrivaled network of contacts and information sources to spearhead a wide range of business risk mitigation services.

Steve was previously the president and CEO of International Risk, which is now part of FTI Consulting. Before establishing SVA, Steve set up and ran International Risk Limited, with seven offices across Asia. He sold the company to FTI Consulting Inc., a New York Stock Exchange-listed company, in 2006. He remained with the company as CEO and subsequently as chairman through a four-and-a-half-year earn-out period.

Much earlier, he spent 18 years with the Royal Hong Kong Police Force, where he commanded its criminal intelligence bureau. His duties included operational command of the Intelligence Bureau and its covert resources, tactical and strategic operations against triad and organized crime groups, risk assessments, and operational control of “declared” kidnapping incidents and product contamination issues. He achieved the rank of senior superintendent before opting to leave the service to join the private sector in the early 1990s.

Mark Nuttall

Mark Nuttall is an executive and geopolitical advisor, as well as a strategic deal facilitator, with over 25 years of experience in strategic leadership, risk management, and business development. He has held roles at London’s famed Metropolitan Police Service, Thomson Reuters, INTERPOL, and Hill and Associates. He founded the Faustus Consultancy and The Iron Club.

Mark offers his executive advisory services, working across the Asia Pacific, the Middle East and North Africa (MENA), and Europe to drive growth, optimize operations, facilitate deals, and enhance governance. Especially when it comes to risk management and governance, he has implemented plans focused on risk mitigation, resilience, and improving governance standards. He has also managed complex investigations and multi-agency operations.
In terms of subject matter expertise, Mark has delivered advisory services on governance, compliance, risk reduction, finance, leadership, geopolitics, anti-money laundering (AML), resilience, security, and environmental, social, and governance (ESG) issues. Furthermore, he has delivered keynote speeches and provided mentorship to C-suite and geopolitical audiences.

Discussion:

Today’s podcast begins with a spotlight conversation between Steve and Regulatory Ramblings host Ajay Shamdasani, discussing regional threats to expect in 2025. The uncertainty in the ongoing trade war between the US and China looms large across the Asia-Pacific region and the world more broadly. The planet is watching with bated breath to see how the proverbial running gun battle of heated American rhetoric and increased tariffs will impact the global macroeconomic picture.

Similarly, the specter of whether Beijing will attempt to reunify with Taiwan by force. With the current US administration’s inclination to not get bogged down in the wars of others, as exemplified by President Donald J. Trump’s lackluster attitude towards Russia’s ongoing invasion of Ukraine, the likelihood of a conflict in the South China Sea is likely greater than it has been in years.

Steve shares his thoughts on the emerging geopolitical risks looming for the Asia-Pacific region for the remainder of 2025, as well as how such threats might affect the corporate and financial sectors in regional hubs like Hong Kong and Singapore. He also comments on what can be done to safeguard against such dangers, emphasizing the importance of maintaining perpetual vigilance and making informed, real-time decisions based on the most current available information.

We then shift to a discussion with Mark. Following his first appearance on Regulatory Ramblings (episode #68), Mark elaborates on his rough-and-tumble background growing up in Northern England before sharing with us the lessons he learned during his law enforcement career with the London Police and how some of these lessons also apply to the world of compliance.

Mark discusses the desire to protect others, which drove him to become a police officer, especially after having been on the wrong side of the law in his youth. He also comments on how being with the London Metropolitan Police—the police force that many around the world have modeled themselves after since the 19th century—was crucial to helping him become the success he is today in serving his clients, as what he learned on the force raised his level of professionalism.

Mark is pragmatic about his service and traditional in his approach to lived experience; hence, he will deal with his encounters on his deathbed.

Still, he believes that even within law enforcement, there is room for grace and forgiveness because too many people end up in dire circumstances and need a second chance to get their lives together. In that vein, he believes there is room for leniency in law enforcement.

Regulatory Ramblings podcasts is brought to you by The University of Hong Kong—Reg/Tech Lab, HKU-SCF Fintech Academy, Asia Global Institute, and HKU-edX Professional Certificate in Fintech, with support from the HKU Faculty of Law.

Useful links in this episode:

You might also be interested in:

Connect with RR Podcast at:

LinkedIn: https://hk.linkedin.com/company/hkufintech 
Facebook: https://www.facebook.com/hkufintech.fb/
Instagram: https://www.instagram.com/hkufintech/ 
Twitter: https://twitter.com/HKUFinTech 
Threads: https://www.threads.net/@hkufintech
Website: https://www.hkufintech.com/regulatoryramblings 

Connect with the Compliance Podcast Network at:

LinkedIn: https://www.linkedin.com/company/compliance-podcast-network/
Facebook: https://www.facebook.com/compliancepodcastnetwork/
YouTube: https://www.youtube.com/@CompliancePodcastNetwork
Twitter: https://twitter.com/tfoxlaw
Instagram: https://www.instagram.com/voiceofcompliance/
Website: https://compliancepodcastnetwork.net

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Top 4 Compliance Internal Controls

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with concise, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we outline the top four internal compliance controls. They are:

i. DOA

ii. Vendor Master File

iii. Contracts with 3rd parties

iv. Distribution of Funds and Movements of Currency

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available ⁠here⁠

Categories
Daily Compliance News

Daily Compliance News: May 29, 2025, The 0 – 3 Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News—all from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, and general interest, all of which are relevant to the compliance professional.

Top stories include:

  • Former analyst sues Freeport Commodities for retaliation. (Reuters)
  • Will the US sanction the leading Brazilian justice? (FT)
  • How North Korea is infiltrating the US job market. (WSJ)
  • Third Law Firm Wins Against Trump Administration. (NYT)
Categories
Blog

When Accountability Vanishes: Lessons from the Boeing Settlement Saga

This week on Compliance into the Weeds, Matt Kelly and I broke down the recent announcement of the Department of Justice (DOJ) settlement agreement with Boeing. What we observed is nothing short of astonishing: the DOJ has effectively waved the white flag, replacing a stringent enforcement posture with a non-prosecution agreement (NPA) for Boeing. This was coupled with no requirement for a DOJ- or court-approved monitor. The implications of this decision for compliance practitioners are profound and concerning, to say the least.

Understanding the Boeing NPA: A Quick Recap

To refresh, the Boeing saga stems from two catastrophic crashes of the Boeing 737 MAX, tragically killing 346 individuals. Initially, Boeing faced severe repercussions under a Deferred Prosecution Agreement (DPA) in 2021. This original settlement involved a guilty plea, $1.1 billion in penalties, significant enhancements to the compliance program, and a three-year compliance monitor. However, an unexpected twist soon emerged: a mid-flight door blowout on an Alaska Airlines flight raised renewed concerns about safety. Initially, it looked like Boeing might face even tougher accountability. Instead, the current DOJ under the Trump administration drastically altered course, opting for an NPA that I termed “no-calorie” enforcement: no guilty plea, a two-year independent compliance consultant (not monitor), and maintaining financial penalties without additional teeth.

Compliance Consultant: Monitor-Lite or Something Else?

One of the biggest puzzles in this whole affair is the emergence of an “independent compliance consultant.” This seemingly diluted alternative to a compliance monitor raises vital questions about the future of DOJ enforcement. It is unclear what exactly this consultant’s role entails. Unlike compliance monitors, who possess considerable authority and independence, consultants hold diminished responsibilities.

The recent DOJ memo on compliance monitors indicated a desire to manage costs and clarify expectations around monitoring appointments. Is the introduction of this consultant simply a workaround to avoid the stringent requirements for monitors? Possibly. If this consultant has fewer powers and less independence, then Boeing may have effectively dodged significant accountability yet again.

Transparency and Accountability: Unanswered Questions

Transparency and accountability are cornerstones of compliance and ethics programs. But this Boeing settlement sorely lacks both. The consultant’s operating procedures, reporting methods, and enforcement of recommendations remain unclear. Will Boeing have the authority to reject or disregard the consultant’s advice? If so, does this consultant role even fulfill the function of meaningful oversight?

Furthermore, transparency matters profoundly to the victims’ families and the public. Given Boeing’s track record of missteps, you would think transparency would be a top priority. Unfortunately, we currently have only an eight-page proposal outlining the deal and scant details for an agreement of this magnitude and gravity. Unless we see comprehensive follow-up documents delineating the consultant’s powers, independence, and transparency, it’s tough to label this a meaningful compliance win.

What Does This Mean for the Future of Compliance Monitors?

Perhaps the most troubling aspect of this settlement is its broader message: if a company as large, influential, and consequential as Boeing can evade genuine oversight after catastrophic failures, what company will ever truly face a compliance monitor again?

The DOJ’s memo lists key criteria for determining monitor appointments, including a company’s recidivism risk, the public interest, and the effectiveness of existing regulatory oversight. Suppose these criteria do not merit a monitor appointment in Boeing’s circumstances, with multiple fatalities and systemic compliance and safety failures. In that case, it is nearly impossible to imagine a scenario severe enough to warrant a monitor in the future. In short, the Boeing NPA could signal the practical end of corporate compliance monitorships. That’s a troubling development for all compliance professionals committed to accountability and ethical business practices.

Whistleblower Program: Is Boeing Serious?

Interestingly, Boeing has highlighted recent enhancements to its whistleblower program, emphasizing structural changes designed to prevent conflicts of interest in investigations. While this appears positive, the compliance community rightly questions Boeing’s commitment to cultural transformation.

The enhanced program includes assigning an independent investigative body separate from the employee’s direct manager to handle the investigation of any report. This improvement, while commendable, feels insufficient given Boeing’s historic failures in culture, ethics, and safety management. The true test will be implementation effectiveness: will Boeing genuinely embed these changes, or is this merely compliance window dressing?

Stakeholders Left Out in the Cold

The victims’ families and the general flying public represent crucial stakeholders who deserve answers, accountability, and assurances of safety. Disturbingly, the DOJ’s actions appear dismissive of these stakeholders. This lack of consideration significantly undermines public confidence in Boeing and the effectiveness of regulatory enforcement.

The victims’ families, in particular, have sought genuine accountability, including criminal liability for responsible executives, robust compliance oversight, and transparency regarding changes to prevent future disasters. Instead, they have received a diminished settlement and an opaque independent consultant, leaving them rightly skeptical and outraged, all of course, with no meaningful consultation with this Administration’s Department of Justice.

With victims’ families openly protesting this agreement, the trial judge’s next moves will be closely watched. He holds unique leverage to either restore some semblance of meaningful oversight or further diminish accountability in corporate misconduct.

The Compliance Community’s Next Steps

Given this unsettling outcome, compliance professionals must recalibrate expectations regarding DOJ enforcement. Organizations may anticipate far lighter regulatory oversight in similar high-profile cases. As professionals, we must advocate for stringent compliance practices and robust cultures of integrity internally even more strongly, irrespective of regulatory pressure or its absence. Compliance officers cannot rely solely on government enforcement to ensure corporate integrity. It is clearer than ever that compliance must stem fundamentally from internal conviction rather than external compulsion.

Final Thoughts: A Troubling Precedent

Ultimately, this settlement is underwhelming but not surprising for this administration. The implications ripple far beyond Boeing, potentially affecting enforcement expectations and corporate behaviors across industries. The compliance community must remain vigilant, committed, and proactive in its efforts to ensure effective compliance. Genuine compliance effectiveness relies on internal ethical commitment, leadership accountability, and transparency, not merely regulatory pressure. While the DOJ’s Boeing decision represents a low-water mark for compliance enforcement, it also underscores a vital truth about compliance: effective compliance begins and ends with internal integrity and ethical leadership.

As Boeing demonstrates, sometimes compliance enforcement may fail us, but our commitment to integrity and ethics never should.

Categories
Blog

From Compliance to Strategic Risk Management: A Conversation with John Byrne

I recently had an opportunity to sit down with John Byrne, CEO of Corlytics, for a podcast recording. The episode is posted here in my Compliance and AI podcast. Corlytics sponsored the podcast. We had a fascinating conversation about the next steps forward for compliance professionals, exploring tools, insights, and strategies that help us not just react to regulatory changes but proactively embed compliance into the heart of business operations.

Corlytics has recently achieved ISO 42001 certification, a milestone that marks it as a true pioneer in the RegTech space. For those unfamiliar, ISO 42001 establishes rigorous standards for AI model testing, validation, and robust processes that protect against misuse and data vulnerabilities. Byrne emphasized that this certification demonstrates the company’s dedication to applying meticulous, methodical processes typically reserved for cloud computing security to the burgeoning field of AI. Given the increasing centrality of AI to operational infrastructure, John argued convincingly that managing AI risks should be as rigorous and robust as managing any critical business software.

We dove deeper into AI’s role in compliance, highlighting a shift from reactive detective strategies to proactive, predictive capabilities. Compliance, historically viewed as the “business prevention unit,” has undergone significant evolution. AI-driven solutions enable the considerable acceleration of compliance operations, leading to improved outcomes and enhanced traceability. This means compliance professionals can now focus their expertise on strategic issues rather than mundane, repetitive tasks.

Byrne also linked compliance with fundamental banking principles, reminding us that compliance is not a new concept, but rather, it is rooted in maintaining trust. Banking, at its core, is about trust, and the robustness of compliance directly affects this trust. This echoes the historical narrative that compliance is not merely about following rules but also about ensuring long-term business viability and customer satisfaction. Compliance, at its best, is good business.

One of the critical compliance risks in AI highlighted during our conversation was data poisoning, a growing and increasingly significant threat. Bad actors deliberately corrupt AI training data to manipulate model outputs, creating misleading results. John pointed out that managing this risk involves rigorous data provenance checks and cleansing techniques. The objective is not only to secure data but also to validate its accuracy and integrity continuously.

We also explored the distinction between large language models (LLMs) and small language models (SLMs). While LLMs like ChatGPT excel with vast datasets, SLMs are invaluable when privacy, specificity, and accuracy are paramount, such as in proprietary compliance controls within financial institutions. John’s insights into this nuanced approach are particularly critical for compliance professionals managing highly confidential or regulated information.

Moreover, our discussion touched on traceability and auditability, key concerns for compliance practitioners. AI solutions now facilitate real-time audit trails, enabling the immediate tracing of every compliance decision, control update, and policy shift back to their origins. The emphasis is clear that automation and digitization are not optional; they should be viewed as necessary to meet current regulatory expectations effectively.

Byrne provided a powerful case study example regarding dynamic traceability, from risk identification to response, highlighting how AI can dramatically compress timeframes. Traditionally, significant regulatory changes, such as those stemming from MiFID II, would take organizations months or even years to fully operationalize. Today, AI-driven systems can manage this lifecycle in seconds. Such rapid responsiveness not only ensures compliance but also provides strategic flexibility, which is crucial in our ever-changing regulatory landscape.

Recent geopolitical developments underscored the strategic potential of compliance as a proactive risk management function. The Trump Administration’s suspension of FCPA investigation and enforcement raises questions about the role of compliance in the absence of strict regulatory frameworks. A key compliance response is embedding compliance within core business operations, as this integration is a powerful enabler rather than a mere defensive posture. Once again, we see that effective compliance drives more efficient business operations, leading to greater profitability.

Finally, we discussed the future of RegTech, which Byrne believes will democratize compliance technology. Historically restricted to larger financial institutions, advanced compliance tech is now becoming accessible to smaller entities, leveling the competitive field. This democratization ensures that sophisticated compliance is no longer the privilege of only the largest, most resource-rich banks.

In wrapping up our conversation, it became clear that AI and compliance together represent not just a shift but a leap forward, transforming compliance from a cost center into a strategic business partner capable of driving significant organizational value. It’s an exciting time to be a compliance professional as we witness firsthand how AI innovation is reshaping our roles and the very nature of compliance itself.

Stay smart, stay ethical, and, as always, stay compliant. The future is here, and AI is powering it.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Discipline and Rigor in GTE Internal Controls

Welcome to “Compliance Tip of the Day,” the podcast that brings you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, our goal is to provide you with bite-sized, actionable tips to help you stay ahead in your compliance efforts. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we will consider why discipline and rigor are essential in your GTE internal controls.

For more information on this topic, refer to The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, 6th edition, recently released by LexisNexis. It is available here.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Boeing, a NPA and the End of Monitors

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject more fully and seeking insightful perspectives on compliance. Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly take a deep dive into the Department of Justice’s recent proposal to grant Boeing a non-prosecution agreement.

This decision stems from the 737 MAX crashes in the late 2010s that killed 346 people. They cover the history of Boeing’s settlements, the details and leniency of the new agreement, the role and scope of the independent compliance consultant, and the implications for corporate compliance and the victims’ families. The discussion highlights the potential end of compliance monitors and the broader impacts on corporate accountability.

Key highlights:

  • DOJ’s Non-Prosecution Agreement with Boeing
  • Changes in the Settlement Agreement
  • Role and Scope of the Independent Compliance Consultant
  • Implications for Compliance Monitorships
  • Boeing’s Whistleblower Program and Compliance Efforts
  • Judicial and Victims’ Family Reactions

Resources:

Radical Compliance

 Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds, was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast.

Categories
Daily Compliance News

Daily Compliance News: May 28, 2025, The Moron Premium Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News—all from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • Ghana closes US Embassy over corruption allegations. (Africa News)
  • Don’t tell the truth on your employee satisfaction survey. (Business Insider)
  • The US and the Moron Premium. (FT)
  • Trump pardons VA. Sheriff convicted of bribery. (Bloomberg)
Categories
Great Women in Compliance

Great Women in Compliance – Board Bond: Why Ethics & Compliance Professionals Should Be on Boards and How to Get on One

👉 New #GWIC Episode – Board Bond: Why Ethics & Compliance Professionals Should Be on Boards and How to Get on One

Our expert guests:

• Teri Quimby, who is a Board Director, a coach and advisor, and a former state regulator, and

• Vera Cherepanova, Executive Director of Boards of the Future and an in-demand author and speaker.

Teri Quimby and Vera Cherepanova talked with Sarah Hadden and Ellen Hunt about how #Ethics and #Compliance professionals struggle with being seen as a back-office function rather than strategic risk management and how we bring expertise, experience, and insights that #Boards of Directors can’t afford to overlook. We drilled down into:

✅ Why Boards should diversify their rosters by appointing Ethics and Compliance professionals.

✅ Why it’s a hard sell to get Boards to cast a wider net when looking for new Board members, and what Ethics and Compliance professionals can do to leap over these barriers.

✅ What unique skills do Ethics and Compliance professionals have that are most in demand by Boards?

✅ What successful candidates do to land a Board seat.

👉 Tune in now: Great Women in Compliance

Categories
Blog

The Compliance Handbook, 6th Edition

As the Compliance Evangelist, I am pleased to announce the release of the Compliance Handbook, Sixth Edition. LexisNexis publishes it.

This edition is an update of the Compliance Handbook. The 6th edition is a must-read for all ethics and compliance professionals. The Sixth Edition provides practical and helpful solutions to important ethics and compliance issues. It is comprehensive, accessible, and a must-have for every ethics and compliance professional.

Once again, I have teamed up with the country’s top legal publisher, LexisNexis Legal & Professional, for its series of compliance offerings. The Compliance Handbook, 6th edition, is designed to provide seasoned compliance professionals and those new to the profession with practical, actionable guidance and tools needed to design, create, implement, and continually enhance a best practices compliance program.

The Compliance Handbook, 6th edition, provides an in-depth look at the latest thinking and trends for the full range of critical compliance topics, including:

  • Compliance and business ventures
  • Third-party risk management
  • The Board’s Role in Compliance
  • Continuous improvement
  • Compliance innovation
  • And much more

The Compliance Handbook, 6th edition, also provides a comprehensive examination of the roles of all professionals with compliance responsibilities, including Compliance Officers, Boards of Directors, Human Resources, Internal Audit, Internal Controls, Communications, and Training professionals. Understanding compliance responsibility across the organization remains a key theme for both the Department of Justice (DOJ) and the Securities and Exchange Commission (SEC). With this 6th edition, I expand on the concepts articulated in previous editions to operationalize your compliance program.

What’s new for the 6th edition?

  • Key FCPA enforcement actions from 2024
  • The use of AI in a best practices compliance program
  • The use of data analytics
  • The 2024 Update to the Evaluation of Corporate Compliance Programs
  • Looking forward to compliance in 2030 and beyond.

The Compliance Handbook, 6th edition, incorporates the most current government pronouncements governing best practices in compliance programs, including the 2024 Evaluation of Corporate Compliance Programs, the new DOJ whistleblower initiative, innovative ideas for compliance training, the use of data in improving and maintaining corporate culture, and more.

The Compliance Handbook, 6th edition, is available in both print and eBook editions. You can purchase it here.