Categories
Compliance Into the Weeds

Compliance into the Weeds: FCPA Trial Rarity: Charles Hobson Convicted

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly look at the recent conviction of Charles ‘Hunter” Hobson for FCPA violations.

Former Corsa Coal senior sales executive Charles Hunter Hobson was found guilty in Pennsylvania of helping arrange roughly $4.8 million in bribes to officials tied to a state-owned Egyptian coal company, using an intermediary, to secure about $143 million in contracts. Also, Hobson allegedly pocketed about $200,000. Tom and Matt  Hobson’s unsuccessful “dog bite” defenses. They also discuss tensions between corporate and individual accountability, the practical reality that companies may cooperate and “turn on” individuals, and that individuals can also expose companies by cooperating with prosecutors. Finally, they speculate on why DOJ pursued trial amid shifting enforcement signals, referencing other recent FCPA matters (Millicom DPA, Smartmatic indictment) and past DOJ trial losses, and conclude that the best approach is to avoid bribery and avoid being the “last man standing.”

Key highlights:

  • Hobson Case Overview
  • Dog Bite Defense Breakdown
  • Payment Red Flags
  • Declinations and Individual Risk
  • Why Go to Trial?

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 21 – Managing Third Parties

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 21 episode, we dive into the essential strategies for managing third-party relationships in a compliance program.

Key highlights:

  • Strategic Approach to Third-Party Relationships
  • Auditing and Ongoing Management
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Blog

Returning to Venezuela: Part 2 – Bribery, Corruption and the Risks You Must Confront Before You Enter

We continue our review of bribery and corruption issues (ABC) that you must address before you travel to Venezuela.  There is another set of problems that every compliance professional will face if their company decides to go into Venezuela. It is systemic corruption. Not episodic corruption. Not bad actors at the margins. Systemic, embedded, institutionalized corruption that touches government agencies, state-owned enterprises, procurement systems, and the judiciary. This is not a theoretical risk. It is the operating environment.

The Department of Justice (DOJ) has made clear in the Evaluation of Corporate Compliance Programs (ECCP) that high-risk jurisdictions require tailored, well-resourced, and empowered compliance programs. Venezuela is the textbook example of why. Over the next several blog posts, we will explore some of the key issues every company and every CCO will face when considering whether to enter (or re-enter) Venezuela. In Part 2, I will consider the second half of the 10 ABC risks a compliance professional will face. Later in this series, we will then consider AML risk, export control and trade sanctions, security risks, and end with operational risks.

In Part 1, we described the corruption environment. In Part 2, we consider what happens when companies actually try to operate inside it. This is where theory meets pressure. We begin our numbers with 6, picking up where we left off yesterday.

6. Extortion Is Not a Defense

In Venezuela, companies are often told, “You have no choice.” Payments are demanded to release cargo, protect personnel, or continue operations, sometimes thinly veiled as “fees” for expedited treatment. Venezuelan law itself recognizes extortion as a corruption offense, in which a public official abuses their position to demand an undue benefit. Under Venezuelan anti-corruption law, extortion (called concussion) carries criminal penalties and fines.

At the same time, U.S. enforcement views participation in extortion as a compliance red flag. While coercion can be a mitigating factor in narrow circumstances under the Foreign Corrupt Practices Act (FCPA) or the Foreign Extortion Prevention Act (FEPA), repeated payments, disguised invoices, or third-party routing create evidence of complicity. Deciding to pay from the field without escalation essentially decides for the company, and compliance will struggle to justify it under an ECCP review. Compliance professionals must define escalation paths, refusal protocols, and clear exit points before any signs of extortion arise. Waiting to decide “in the moment” is too late.

Compliance Response

1. Assessment Controls

  • Identify operational choke points where officials or intermediaries can halt operations, including ports, customs, checkpoints, utilities, and inspections.
  • Assess historical incidents involving detentions, delays, threats, or asset seizure tied to payment demands.
  • Map scenarios where employee safety or operational continuity could be leveraged for improper payments.

2. Management Controls

  • Establish a zero-tolerance policy for extortion payments, with narrowly defined emergency exceptions tied to imminent health or safety threats.
  • Implement pre-approved emergency response protocols for detentions, threats, or seizures.
  • Prohibit third-party routing, recharacterization, or retroactive approval of payments in the context of extortion scenarios.
  • Require contemporaneous documentation of all extortion-related incidents and decisions.

3. Monitoring

  • Track frequency, location, and duration of detentions or operational stoppages.
  • Review off-cycle, urgent, or cash payment requests for patterns.
  • Audit expense categories are commonly used to disguise extortion payments.

4. Board Oversight

  • Where are we most exposed to extortion pressure?
  • How often are emergency exceptions invoked, and are they increasing?
  • At what point do we pause or exit operations rather than continue under pressure?

7. Third Parties as the Primary Corruption Vector

In Venezuela, third parties are the everyday vectors through which corruption pressure crystallizes. Agents, customs brokers, logistics providers, security vendors, and even local fixers frequently serve as the conduit for improper value transfers. These intermediaries claim to navigate Venezuela’s opaque systems, but they also create liability if their actions result in bribery or improper advantage.

Pressure points are endemic and include:

  • Customs clearance: Goods may be held pending unofficial “service fees” or clearance bribes.
  • Port operations: Terminal operators or officials may demand payments for priority access.
  • Transportation: Toleration at checkpoints is often predicated on unofficial payments.
  • Security arrangements: Local guards or militia may demand fees for access or protection.
  • Licensing follow-up: Expediency “services” are offered at a premium.

Third parties promise solutions. They also create liability when their conduct crosses legal lines. Under the ECCP, regulators will ask whether the company understands and monitors how these third parties operate in practice, not just whether it has a diligence checklist. Paper diligence alone is insufficient where pressure is constant, and corruption vectors hide in plain sight.

Compliance Response

1. Assessment Controls

  • Classify third parties by function (customs, logistics, security, licensing), not by spend alone.
  • Identify third parties that interact directly with government officials.
  • Assess compensation structures for success fees, urgency premiums, or discretionary payments.

2. Management Controls

  • Apply enhanced due diligence to high-pressure third-party functions.
  • Require detailed, verifiable scopes of work tied to legitimate services.
  • Mandate compliance approval before onboarding or paying high-risk third parties.
  • Prohibit subcontracting or pass-through arrangements without prior written approval.

3. Monitoring

  • Conduct invoice analytics to identify duplications, rounding issues, urgency issues, or vague descriptions.
  • Monitor third-party performance against contractual scope and deliverables.
  • Review third parties involved in repeated government interactions or escalations.

4. Board Oversight

  • Which third-party functions create the greatest corruption pressure?
  • How do we verify what third parties do in practice?
  • When do we terminate a third-party relationship rather than attempt remediation?

8. Organized Crime and the Blurred Line of “Business”

In Venezuela, organized crime intersects with commerce, logistics, and even parts of the formal economy. Corruption and criminal networks often coalesce in sectors like mining, fuel distribution, and transport infrastructure, where armed groups and informal power structures exercise influence. Some of these networks are intertwined with state actors, and corruption and illicit activity can reinforce one another.

For compliance professionals, this means recognizing when business relationships drift into criminal entanglement. That drift is not always obvious at contract signing. Contracts negotiated under duress or through intermediaries with opaque ownership may conceal criminal activity. Continuous monitoring matters precisely because initial signals are subtle. The line between a vendor and a syndicate can be ecosystem-specific and may manifest in patterns of behavior, unexplained payments, or associations with known corrupt actors.

This is also where AML risk begins to dominate. When organized crime is part of the value network, it is present through smuggling rings, illicit fuel markets, or bribery conduits.  The controls for bribery, AML, sanctions, and export compliance must interlock to detect and escalate suspicious patterns.

1. Assessment Controls

  • Screen vendors and partners for criminal exposure, unusual affiliations, and opaque ownership.
  • Assess whether services operate in sectors known for illicit activity, including fuel distribution, logistics, or private security.
  • Review beneficial ownership structures and local power dynamics.

2. Management Controls

  • Integrate anti-bribery, AML, and sanctions screening for high-risk vendors.
  • Require certifications regarding lawful sourcing, operations, and subcontractors.
  • Prohibit informal arrangements, undocumented services, or side agreements.

3. Monitoring

  • Monitor for cash-intensive activity without commercial justification.
  • Track changes in ownership, management, or operational behavior.
  • Escalate associations with known illicit markets, actors, or criminal networks.

4. Board Oversight

  • How do we detect drift from legitimate commerce into criminal entanglement?
  • What triggers an immediate suspension or exit?
  • Are our controls sufficient to identify concealed criminal exposure?

9. Currency, Pricing, and Manipulation Pressure

Venezuela’s economic distortions, including exchange controls, multiple currency rates, and the scarcity of hard currency, create fertile ground for corruption. Access to U.S. dollars through official channels is tightly controlled, which historically has led companies and intermediaries to engage in schemes to secure foreign exchange at preferential rates. A notable U.S. enforcement action involved a major telecommunications subsidiary that allegedly bribed officials to gain access to a currency auction and disguised corrupt commissions through inflated equipment purchases.

These distortions become more than operational headaches. They create incentives for side payments and off-book arrangements on pricing and contracts. These practices are not just bribery issues. They implicate accounting integrity, financial reporting, AML vigilance, and sanctions exposure. Once money flows lose transparency, whether through inflated vendor invoices, opaque currency conversions, or third-party routing, compliance loses line-of-sight and control. This intersection reinforces why a compliance program must integrate transactional monitoring and financial controls alongside anti-bribery controls to detect anomalies that traditional gift/entertainment policies won’t reveal.

Compliance Response

1. Assessment Controls

  • Identify exposure to foreign exchange approvals, currency scarcity, and pricing discretion.
  • Review historical pricing anomalies or currency-related workarounds.
  • Map payment flows involving third-country or non-standard accounts.

2. Management Controls

  • Enforce strict controls over pricing adjustments and currency conversions.
  • Require joint Finance–Compliance approval for non-standard payment terms.
  • Prohibit side agreements, rebates, or off-book arrangements.

3. Monitoring

  • Monitor invoices for inconsistencies with market pricing.
  • Flag requests for alternative currencies or complex payment routing.
  • Conduct periodic reviews of foreign exchange transactions and pricing deviations.

4. Board Oversight

  • Where do currency controls create the strongest corruption incentives?
  • How do we maintain transparency in pricing and payments?
  • When does financial complexity cross into unacceptable risk?

10. Weak Rule of Law Raises the Stakes

Venezuela’s judiciary and law enforcement institutions are widely seen as politicized, under-resourced, and inconsistent in enforcing anti-corruption laws. Although the Venezuelan legal framework criminalizes extortion, passive and active bribery, and related offenses, enforcement is weak and selective. In practice, companies cannot rely on local remedies to resolve disputes or push back against corrupt demands.

This elevates the importance of internal compliance controls and pre-defined exit strategies. When there is no neutral referee, no reliable government adjudicator, and prevention becomes the only viable protection. It also means that compliance must internalize enforcement risk rather than outsource it to local authorities. A robust compliance program must include strict refusal protocols, incident documentation, real-time monitoring, and clear decision-making boundaries. Without these, companies are exposed to both local corruption risk and U.S. enforcement risk under the FCPA and allied statutes.

Compliance Response

1. Assessment Controls

  • Assume limited availability of neutral local legal remedies.
  • Identify areas where officials exercise unchecked discretion.
  • Assess reliance on informal dispute resolution mechanisms.

2. Management Controls

  • Strengthen internal documentation, approval, and escalation requirements.
  • Define clear walk-away criteria when disputes cannot be resolved lawfully.
  • Require Legal and Compliance review of all high-risk disputes and resolutions.

3. Monitoring

  • Track disputes resolved outside formal legal or contractual processes.
  • Review patterns of repeated “local solutions” or informal settlements.
  • Assess escalation timelines and resolution outcomes.

4. Board Oversight

  • Where are we relying on influence rather than process?
  • How quickly do disputes escalate to senior leadership?
  • When do we exit rather than attempt resolution?

Parts 1 and 2 of this series make clear that bribery and corruption are not peripheral risks in Venezuela. They are the entry conditions. From systemic corruption and PDVSA exposure to extortion, third-party involvement, currency manipulation, and a weak rule of law, each risk compounds the next. For compliance professionals, the lesson is not that Venezuela is impossible, but that it is unforgiving of informal controls, delayed escalation, and weak governance. Elevated risk can be managed only through disciplined assessment, operational controls, continuous monitoring, and engaged board oversight. When corruption becomes operational, however, another risk inevitably follows.

Next in Part 3 of this series, we turn to anti-money laundering, where improper value moves, hides, and metastasizes beyond corruption alone. Bribery is how improper value enters the system. Money laundering is how it moves and hides. Once corruption becomes operational, AML risk becomes unavoidable. Join us tomorrow for Part 3 in our series.

Categories
Culture Crafters

Culture Crafters – Ethics Culture Divide, Part 2 – Enhancing Corporate Culture: The Vital Role of Ethics in Talent Retention and Acquisition

In this second episode in a 3-part series of podcasts, Tom Fox and Sam Silverstein discuss the critical divide in companies around Ethics and Culture. This series is based on data from a national survey of over a thousand people, highlighting the divide between high and low-performing companies in terms of ethics.

Sam and Tom discuss the critical importance of ethics in both talent acquisition and retention, emphasizing how these elements will serve as key differentiators for companies in the future. We explore why over a third of respondents believe ethics doesn’t help career advancement and how organizations can alter this perception by redesigning advancement criteria to include cultural and ethical values. The conversation highlights how ethical behavior begins in the hiring process and is reinforced through continuous feedback, not just annual reviews. We delve into real-world examples of ethical vs. unethical decisions impacting trust between employees, customers, and vendors, stressing the long-term catastrophic risks of ignoring ethical practices. The episode underscores that fostering an ethical culture is a top-down choice that needs to be modeled consistently at all levels to build trust and ensure long-term success.

Key highlights:

  • The Importance of Ethics in Talent Acquisition and Retention
  • Redesigning Advancement Criteria to Include Ethics
  • Impact of Ethics on Customer Trust
  • Ethical Shortcuts and Their Consequences
  • The Role of Ethics in Vendor Relationships

Resources:

 Sam Silverstein

Sam Silverstein on LinkedIn

Sam Silverstein

The Culture Audit™

Categories
Popcorn and Compliance

Popcorn and Compliance: Episode 2 – Dracula’s Compliance Secrets: What Lurks in the Night

Welcome to a special series of Popcorn and Compliance. In this series, we will be looking at the Classic Universal Monster Movies from the 30s and 40s and mining them for compliance lessons. (Yes, it really is an excuse to rewatch them all.) In this series, we will look at Frankenstein, Dracula, The Wolf Man, The Mummy, and end with The Invisible Man. In this episode, Tom explores critical compliance insights drawn from Bela Lugosi’s portrayal of Dracula.

Tom dives into five key compliance lessons: the dangers of third-party relationships, the subtle power of influence, the risk hidden in shadows, the importance of cultural awareness, and the perils of complacency. By drawing parallels between Dracula’s methods and modern compliance challenges, the episode underscores the need for rigorous due diligence, continuous monitoring, and a proactive mindset in risk management.

Key highlights:

  • Exploring Count Dracula’s Compliance Lessons
  • Third Parties: Your Greatest Risk
  • The Power of Influence
  • Risk Hides in the Shadows
  • Cultural Blindness Increases Vulnerability
  • Complacency Enables Catastrophe

Resources:

Compliance Lessons from Bela Lugosi’s Dracula on the FCPA Compliance and Ethics Blog

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Trekking Through Compliance

Trekking Through Compliance: Episode 70 – Beaming Down Blind: Compliance Lessons on Third-Party Due Diligence from “The Mark of Gideon”

Few pop culture moments capture the risks of blind engagement as vividly as Star Trek: The Original Series’ “The Mark of Gideon.” In this episode, Captain Kirk beams down to what he believes is the planet Gideon for diplomatic talks—only to find himself aboard what appears to be an empty Enterprise. What follows is a masterclass in the dangers of walking into a deal without verifying the facts. For compliance professionals, Gideon’s deception is the perfect allegory for the hazards of onboarding a third party without a thorough vetting process. Let’s break down five key lessons.

Lesson 1: Verify the True Identity of Your Counterparty

Illustrated By: When Kirk believes he is beamed down to Gideon, he is actually inside a replica of the Enterprise. The Gideonites have created this fake environment to isolate him for their purposes.

Compliance Lesson. If you do not confirm the true identity of a third party, you may find yourself dealing with a façade. Shell companies, undisclosed beneficial owners, and entities with misleading corporate registrations are the corporate world’s “empty Enterprise.”

Lesson 2: Understand the Real Motives Behind the Partnership

Illustrated By: The Gideonites present their plan as a noble solution to their problem, but it’s built on deception and exploitation.

Compliance Lesson. Third parties sometimes have agendas that differ sharply from what they present. They may seek access to your brand to legitimize questionable practices, gain entry to restricted markets, or launder illicit funds.

Lesson 3: Never Rely Solely on What the Other Party Tells You

Illustrated By: Kirk repeatedly asks the Gideonites to explain what is happening, but their answers are vague, evasive, and occasionally contradictory. They hope his lack of information will keep him compliant long enough to serve their plan.

Compliance Lesson. Self-reported information from a potential third party should be viewed as one data point, not the whole picture. Misrepresentations are common, whether deliberate or due to internal ignorance.

Lesson 4: Assess the Operating Environment Before Engagement

Illustrated By: The Gideonites hide the actual conditions on their planet. Kirk learns later that Gideon is overcrowded to the point of people standing shoulder-to-shoulder, unable to move freely.

Compliance Lesson. Entering into a business relationship without assessing this environment is akin to beaming down blind.

Lesson 5: Build Exit Strategies Into the Relationship

Illustrated By: Once Kirk understands the Gideonites’ true intentions, he must escape the replica Enterprise to stop their plan.

Compliance Lesson. Some third-party relationships turn sour, and you need a plan to disengage without disrupting your operations. Include termination clauses tied to compliance breaches in your contracts.

Final ComplianceLog Reflections

In The Mark of Gideon, the Enterprise crew’s lack of verified intelligence before Kirk’s “beam down” mirrors what happens when companies rush into a third-party relationship to seize a perceived opportunity. The Gideonites knew how to manipulate the Federation’s diplomatic eagerness. Likewise, unscrupulous partners today exploit companies’ urgency to enter new markets or secure rare supply chains.

The lesson? Due diligence is not a delay; it is a safeguard. The few extra weeks spent vetting a partner can prevent years of litigation, regulatory penalties, and reputational damage.

Resources:

⁠⁠Excruciatingly Detailed Plot Summary by Eric W. Weisstein⁠⁠

⁠⁠MissionLogPodcast.com⁠⁠

⁠⁠Memory Alpha

Categories
Compliance Tip of the Day

Compliance Tip of the Day – AI and 3rd Party Risk Management

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide you with bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, we consider how you can bring predictive analytics into your program to make it proactive rather than reactive.

For more on this topic, check out The Compliance Handbook, a Guide to Operationalizing your Compliance Program, 6th edition, which LexisNexis recently released. It is available here.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Leveraging AI for Real-Time Third-Party Risk Management

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Today, Tom Fox considers the advantages of using AI for third-party risk management.

For more on embedded compliance, check out my new book, Upping Your Game: How Compliance and Risk Management Move to 2030 and Beyond, available from Amazon.com

 

Categories
Blog

Predictive. Proactive. Protected: Leveraging AI for Real-Time Third-Party Risk Management

Even in 2025, third-party risk management remains one of the thorniest challenges for compliance professionals. Whether you oversee distributors in the Middle East, suppliers in Southeast Asia, or data processors in Eastern Europe, the risks, including bribery, sanctions violations, labor abuses, and fraud, remain ever-present. Traditionally, compliance teams fought these battles using static tools: onboarding questionnaires, annual reviews, and spreadsheet trackers. But those blunt instruments are no longer enough in today’s real-time risk environment.

Enter AI, specifically Generative AI (GenAI), predictive analytics, and blockchain, which is revolutionizing third-party oversight and giving compliance professionals the power to act proactively, not reactively. As Jag Lamba, CEO of Certa, astutely notes, GenAI brings three significant value buckets: reduced risk, commercial ROI, and reduced legal costs. Today, I will unpack what that means for compliance and how we can move from the “check-the-box” era to one of integrated, continuous monitoring and risk mitigation.

Compliance in Real Time: The Shift to Predictive Tools

Historically, the compliance approach to third-party risk was episodic. We conducted due diligence at onboarding, maybe revisited it every few years, and crossed our fingers in between. However, the gaps between assessments were dangerous blind spots, exposing companies to risks that regulators like the DOJ and SFO are increasingly unwilling to tolerate.

That’s where predictive analytics steps in. To forecast potential violations, these systems analyze structured and unstructured data, from financial records to adverse media to geopolitical trends. AI flags early risk indicators, such as an unusual payment pattern or a politically exposed person. That allows compliance to intervene before a deal closes, a bribe is paid, and reputational damage is done.

Machine learning (ML) models also allow dynamic anomaly detection. This is especially useful in sifting through transactional data and flagging high-risk behavior patterns like duplicate invoices, mismatched documentation, or sudden changes in third-party ownership.

Blockchain brings an additional layer of trust. Immutable audit trails secure contracts, payments, and due diligence documentation, ensuring the record is tamper-proof and regulator-ready. Smart contracts can enforce compliance obligations automatically, stopping payments, triggering alerts, or suspending activity when a vendor falls out of bounds.

Three Buckets of Value: What GenAI Delivers

Jag Lamba, CEO of Certa, outlined three distinct areas where GenAI delivers:

  1. Risk Reduction Compliance risk, data privacy risk, ESG risk, reputational risk—the list goes on. AI helps companies avoid working with third parties that introduce these risks into the business ecosystem. This is more than good practice; it is a lifeline for organizations operating under Deferred Prosecution Agreements (DPAs) or with heightened scrutiny from regulators.
  2. Commercial Value Faster onboarding of sales agents, vendors, or channel partners means faster revenue. Reducing a six-week onboarding timeline to two days can translate into hundreds of millions in new revenue, especially in fast-moving sectors.
  3. Legal Savings Avoiding regulatory missteps means avoiding costly enforcement actions. In today’s aggressive enforcement climate, those savings are not simply theoretical; they are very real and very substantial.

Compliance should not be a handbrake on business; it should be a business enabler. By embedding GenAI into core operations, organizations create less friction and fewer dual processes, improving business agility without sacrificing oversight.

Five Takeaways for Compliance Professionals

  • Predictive Compliance Is the New Norm

The days of “wait and see” are over. AI lets us anticipate risk, not just react to it. Predictive tools shift compliance from being an internal auditor to a strategic partner in risk mitigation. Companies like Certa use automated third-party master data enrichment to reduce false positives and streamline screening, creating cleaner data for faster, smarter decisions.

  • AI Supercharges Due Diligence

Natural language processing (NLP) and machine learning enable deep due diligence at scale. To flag red flags, AI can scan global watchlists, sanctions databases, court records, and newsfeeds. It can uncover hidden connections, shell entities, familial relationships, and obscure affiliates that human reviewers often miss.

Even better, AI does not sleep. It continually updates third-party risk profiles in real time, offering dynamic monitoring that aligns with today’s fast-changing regulatory landscape.

  • Real-Time Supply Chain Monitoring Is a Must

Supply chains are now under a microscope. From human rights to trade sanctions, regulators demand evidence that companies are proactively managing supply chain risks. AI tools monitor supplier behaviors and flag real-time ESG risks, such as forced labor or environmental non-compliance.

Blockchain ensures that supply chain data remains unaltered and provides traceability across multiple tiers of suppliers. With AI-integrated blockchain systems, compliance professionals can quickly identify issues, trace them to their source, and take corrective action.

  • AI + Blockchain = Fraud and Corruption Prevention

Fraud detection meant following static rules, like transaction thresholds or vendor location mismatches. AI adds nuance. It can detect bribery patterns or fraudulent shell entities by learning from thousands of real-world cases. Meanwhile, blockchain creates an unchangeable record of each transaction, making it harder for corrupt actors to falsify invoices or backdate payments. This two-pronged approach, predictive analytics plus immutable records, offers a potent defense against FCPA and UKBA violations.

  • Third-Party Risk Must Be Continuous, Not Episodic

Third-party due diligence cannot be a one-and-done exercise. Predictive analytics enables a live risk-scoring environment where third parties are constantly evaluated. AI can even detect patterns that suggest “compliance-sensitive” activity, like vendors interacting with government officials or operating in high-risk jurisdictions, flagging them for further review.

One multinational recently implemented a no-code solution that monitors purchase requisitions for signs of regulatory engagement, triggering automated validation questions. This kind of innovation is only possible when compliance works in tandem with IT, legal, and procurement.

Compliance at a Crossroads: Innovate or Fall Behind

After the Trump Administration’s Executive Order suspending FCPA investigation and enforcement, compliance professionals face a fundamental choice: evolve or be eclipsed. But in 2025, manual reviews and siloed spreadsheets. Business leaders expect real-time monitoring, cross-functional integration, and data-backed decision-making to create greater business value. That means compliance must step into a new leadership role that embraces technology, champions cross-department collaboration, and drives value across the enterprise.

It is time for compliance teams to stop seeing AI as a future concept and start seeing it as a present-day imperative. The organizations that embrace this shift will thrive in the next wave of regulatory scrutiny and be best equipped to meet the moment.

As the saying goes, “The best way to predict the future is to invent it.” For compliance professionals, that future is AI-driven, real-time, and risk-resilient.

This article was based on my new book, Upping Your Game. You can purchase a copy of the book on Amazon.com.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 21 – Managing 3rd Parties

Welcome to a special podcast series on the Compliance Podcast Network, 31 Days to a More Effective Compliance Program. Over these 31 days of the series in January 2025, Tom Fox will post a key part of a best practices compliance program daily. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, and will include three key takeaways you can implement at little or no cost to help update your compliance program. I hope you will join us each day in January for this exploration of best practices in compliance.

On Day 21 of our series, we dive into the essential strategies for managing third-party relationships in a compliance program. We consider the significance of a structured and strategic approach in handling third parties to mitigate anti-corruption risks. As companies mature, the operationalization of compliance through third-party management becomes crucial. Key areas explored include the importance of dual and diversified sourcing, monitoring subcontractors, legal protections, and financial stability checks. Additionally, we cover the necessity of integrating performance-based compensation and regular auditing to uphold compliance standards. Join us tomorrow as we explore levels of due diligence on Day 22.

Key highlights:

  • Strategic Approach to Third-Party Relationships
  • Auditing and Ongoing Management
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 5th edition, by clicking here.