Categories
Daily Compliance News

Daily Compliance News: May 20, 2025, The What Could Go Wrong Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News—all from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • Drugmaker to buy genetic data company. (WSJ)
  • Defense boom corruption hits NATO. (dw.com)
  • Disparate impact change tees up compliance risk. (Bloomberg Law)
  • State AGs fill the AI regulatory role.  (Reuters)
Categories
Upping Your Game

Upping Your Game: Episode 3 – Embedded Compliance: From Gatekeeper to Business Enabler

In February, the Trump Administration suspended investigations under and enforcement of the FCPA. Many compliance professionals have since wondered what this will mean for corporate compliance programs. Hui Chen challenged compliance professionals with “it’s time to up your game.”

This podcast series, sponsored by Ethico and co-hosted with Ethico co-CEO Nick Gallo, hopes to meet Hui Chen’s challenge for compliance professionals. We will discuss how compliance professionals can ‘Up Their Game’ using currently existing Generative AI (GenAI) tools to dramatically improve compliance programs. As compliance professionals, it is critical to recognize that this moment is not merely about incremental improvements but elevating our profession to a new level of effectiveness, efficiency, and organizational value.

In today’s ‘Upping Your Game’ episode, Nick and Tom discuss the Holy Grail of Compliance. Embedding Compliance. We dive into the concept of embedded compliance, where compliance is integrated into everyday business operations using advanced technologies like AI. They discuss how embedding compliance can drive quality and efficiency, drawing parallels from manufacturing safety norms. The conversation includes a detailed examination of how AI can help compliance professionals by providing real-time insights and streamlining processes, thereby highlighting the importance of viewing compliance not as an isolated task but as an integral part of business operations. Use cases and practical examples, such as those from the private equity sector and companies like Uber, further illustrate the potential of this approach to enhance business performance and ROI. The episode concludes with a compelling argument for positioning compliance as a blueprint for better business, emphasizing the need for constant advocacy and application of innovative technologies.

Key highlights:

  • Strategic and Operational Benefits
  • The Compliance Professional’s Role in Embedded Compliance
  • Lessons Learned
  • Practical Takeaways

Resources:

Upping Your Game- How Compliance and Risk Management Move to 2030 and Beyond on Amazon.com

Nick Gallo on LinkedIn

Ethico

Ethico Workshop on EV Workshop: Calculate, Track & Articulate Return on Integrity (ROI). For registration and Information, click here.

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

DOJ’s White-Collar Enforcement Plan: Galeotti Memo on Focus, Fairness, and Efficiency

Matthew R. Galeotti, Head of the Criminal Division at the U.S. Department of Justice (DOJ), recently delivered a speech at SIFMA’s Anti-Money Laundering and Financial Crimes Conference. Contemporaneously, the DOJ issued a Memo (the Memo) entitled Focus, Fairness, and Efficiency in the Fight Against White-Collar Crime. Today, I want to explore the key insights and crucial issues for compliance professionals in the Memo.

The Memo marks a turning point in the enforcement landscape, emphasizing a trio of principles: focus, fairness, and efficiency. For compliance professionals, these adjustments represent more than mere policy shifts; they outline clear and practical pathways that demand immediate attention and strategic integration into compliance frameworks.

Focus, Fairness, and Efficiency

The Memo states that the DOJ’s core mission is delivering justice, upholding the rule of law, safeguarding the public, and championing victims’ rights. Within the Criminal Division, this mission translates into proactive efforts aimed at dismantling dangerous criminal entities, such as cartels and transnational criminal organizations (TCOs), disrupting human trafficking networks, combating fentanyl and other illicit drug flows, and prosecuting violent offenders and child predators. This is a way of saying that this Administration’s enforcement priorities have changed.

White-collar crime is identified as a critical threat that significantly impacts American citizens and the national economy. Uncontrolled fraud within government programs and markets harms taxpayers, weakens public resources, and undermines national security by facilitating illicit financial activities, including money laundering and sanctions evasion. However, the DOJ believes that overly aggressive enforcement practices can inadvertently damage legitimate businesses, stifle innovation, and punish legitimate risk-taking.

To navigate this complexity, the DOJ’s Criminal Division emphasizes what it characterizes as a balanced enforcement approach grounded in three key principles: focus, fairness, and efficiency. “Focus” entails directing investigative resources towards crimes of greatest national impact, avoiding unnecessary distractions. “Fairness” involves prosecuting individual offenders primarily, ensuring corporate entities are penalized appropriately without excessive burden for isolated misconduct. “Efficiency” calls for streamlined investigations and appropriate, narrowly tailored interventions. Through these guiding tenets, the Criminal Division seeks to effectively tackle serious crimes, protect public interests, and support the vitality and innovation of American enterprise.

Harms Caused by White Collar Crime

White-collar crime presents a significant threat to American society, economy, and national security. Dishonest actors frequently exploit taxpayer-funded government programs through rampant healthcare, procurement, and defense spending fraud, diverting essential resources for vulnerable populations. These abuses weaken government efficacy and impose unjust financial burdens on taxpayers. Additionally, complex investment schemes, including Ponzi operations and elder fraud, target individual investors, stripping them of their financial security and eroding market trust.

Exploiting monetary systems, particularly through digital asset fraud, hampers economic innovation and growth. In contrast, trade and customs fraud, including tariff evasion, negatively impact domestic competitiveness and undermine administration efforts to bolster job creation and investments within the U.S. Financial institutions and shadow banks facilitate serious international crime, including sanctions evasion and money laundering, thus directly supporting transnational criminal enterprises and increasing threats to national security. Specifically, Chinese-affiliated companies (Variable Interest Entities—VIEs) listed on U.S. exchanges have been highlighted for their potential to commit fraud and manipulate markets, putting American investors at significant financial risk.

Sophisticated money laundering schemes further facilitate cross-border crime, allowing criminal organizations to conceal illicit funds and sustain criminal enterprises, including drug trafficking operations that introduce harmful substances like fentanyl to American shores. Furthermore, foreign terrorist groups depend significantly on financial networks and corporate complicity to fund and execute terror activities against U.S. citizens domestically and abroad. Therefore, businesses and financial institutions aiding such organizations severely compromise American lives and national security. Addressing these severe issues, the Criminal Division is intensifying efforts to prosecute these offenses vigorously, prioritizing cases that uphold American economic and national security interests.

Prioritization and Policy Changes

The Criminal Division has updated its enforcement priorities and policies, targeting specific high-impact white-collar crime areas crucial to safeguarding U.S. interests. Priority enforcement categories include fraud against government programs such as healthcare, procurement fraud harming public resources, and trade and customs fraud, like tariff evasion. The Criminal Division will actively prosecute complex financial crimes, including securities fraud, market manipulations, elder fraud, and schemes targeting individual investors and consumers. Additional focus areas encompass activities threatening national security, such as sanctions violations by financial institutions, material support by corporations to foreign terrorist organizations, complex money laundering operations, and violations related to illegal drug manufacturing and distribution.

Furthermore, bribery and associated money laundering activities that harm U.S. competitiveness or security are prioritized, alongside digital asset-related crimes victimizing investors or facilitating significant criminal activities. Prosecutors will prioritize identifying and seizing crime-related assets to reinforce these efforts, emphasizing accountability for senior-level perpetrators or those obstructing justice. Enhancements to the Corporate Whistleblower Awards Pilot Program also underscore this refined approach, adding incentives for reporting violations involving international criminal organizations, terrorism support, immigration breaches, sanctions offenses, and trade fraud. These targeted measures aim to enhance investigative effectiveness, promote fairness, and streamline DOJ’s enforcement efforts.

Fairness in Prosecutions

The Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) has emphasized transparency, cooperation, and remediation, significantly enhancing efforts to hold individual offenders accountable while rewarding responsible corporate citizens. Recognizing that individual actors, whether executives, officers, or employees, often commit white-collar crimes at the expense of investors, employees, and consumers, the Criminal Division focuses intensely on prosecuting these specific wrongdoers. Notably, federal prosecution isn’t always necessary for corporate misconduct; alternative remedies like civil or administrative actions may better address less severe infractions, provided the companies demonstrate sincere cooperation and effective remediation.

Prosecutors evaluate multiple factors when determining corporate charges, including timely self-disclosure, cooperation level, and the comprehensiveness of remedial actions. Recent updates to the CEP further simplify its guidelines, making pathways for potential declinations and fine reductions clearer for corporations. These refinements offer maximal transparency, allowing corporations to make informed decisions about proactively addressing misconduct.

The Criminal Division also reviews existing corporate agreements, potentially shortening their terms based on compliance maturity, reduced risk profiles, and proactive self-reporting. Future corporate resolutions will typically cap terms at three years unless exceptional circumstances dictate otherwise. Regular assessments will determine whether agreements warrant early termination, enhancing fairness and practicality in corporate enforcement.

Efficiency Through Streamlined Investigations

The DOJ’s revised approach emphasizes efficiency and clarity in investigating and prosecuting white-collar crimes, recognizing that lengthy and intrusive federal investigations can unnecessarily burden innocent stakeholders and significantly disrupt normal business operations. Complex white-collar schemes often span borders and involve extensive evidence, causing investigations to stretch for years. However, the DOJ now mandates prosecutors to expedite these investigations, swiftly conclude inquiries, and promptly make charging decisions. This renewed urgency ensures that justice is served quickly, limiting collateral damage to uninvolved entities and reducing reputational harm.

Additionally, the DOJ addresses the use of independent compliance monitors, recognizing that monitorships should only be imposed when necessary, specifically when internal company mechanisms alone are insufficient to prevent misconduct recurrence. To further efficiency, monitorships must be narrowly tailored, carefully scoped to address the specific misconduct risks, and designed to minimize financial costs and operational disruptions for companies.

The Criminal Division has implemented a new monitor selection Memo clarifying the criteria prosecutors must consider when determining the necessity of a monitor and how to limit their mandates appropriately. Furthermore, the DOJ is actively reviewing existing monitorships to individually assess their ongoing necessity, ensuring alignment with the principles of efficiency and minimal interference. Compliance professionals should thus prioritize developing robust internal compliance programs, mitigating the need for external monitors, and preparing for swift, efficient cooperation with any DOJ inquiries.

The Galeotti Memo emphasized a renewed commitment to focus, fairness, and efficiency in white-collar crime enforcement. The Memo underscores the critical need to precisely target high-impact criminal activities, including healthcare fraud, securities manipulation, customs violations, and digital asset crimes. The DOJ aims to protect American interests by clearly defining enforcement priorities while minimizing unnecessary business disruptions.

The DOJ’s revised Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) reflects a balanced approach that prioritizes prosecuting individual wrongdoers over punishing entire corporations for isolated misconduct. Companies are encouraged toward transparency and proactive self-disclosure, incentivized through more straightforward guidelines, reduced penalties, and potentially shorter oversight durations.

Furthermore, the DOJ stresses the importance of streamlined, efficient investigations to conclude cases and promptly limit collateral damage to innocent parties. Independent compliance monitorships are now restricted to essential circumstances, narrowly tailored to specific compliance needs, minimizing cost and operational interference.

The DOJ’s strategic shifts represent a more cooperative and transparent enforcement regime, fostering improved corporate compliance, accountability, and integrity within American enterprises.

Join us tomorrow when we take a deep dive into the Revised CEP.

Categories
Adventures in Compliance

Adventures in Compliance: The Novels – Business Lessons from A Study in Scarlet

In this new season of Adventures in Compliance, host Tom Fox takes a deep dive into the Sherlock Holmes novels. Over this season, Tom will deeply dive into each novel over a four-part series. The four novels he will consider from the ethics and compliance perspective are A Study in Scarlet, The Sign of Four, The Hound of the Baskervilles, and The Valley of Fear. Tom begins with A Study in Scarlet for our new season’s first offering. In Part 4, we deeply dive into the business lessons compliance professionals can learn from the story.

Key takeaways include cultivating diversified skill sets, fostering a trust-based culture, valuing objective feedback, integrating emotional intelligence, and optimizing structured communications. These principles are explored in depth to provide actionable strategies for compliance professionals. The episode concludes a special four-part series on the novel with an invitation to join the next series on ‘The Sign of Four.’

Highlights include:

  • Deep Dive into ‘A Study in Scarlet’
  • Business Lessons from Sherlock Holmes
  • Integrating Holmes’ Wisdom into Compliance

Resources:

The New Annotated Sherlock Holmes

Sherlock Holmes FAQ by Dave Thompson

Connect with Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Design Objectives for Compliance Training

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

What are the design objectives for your compliance training program?

For more on this topic, check out The Compliance Handbook, a Guide to Operationalizing Your Compliance Program, 6th Edition, which was recently released by LexisNexis and is available here.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Terminating Third Parties

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

Why you should plan for 3rd-party termination and how to do so.

For more on this topic, check out The Compliance Handbook, a Guide to Operationalizing Your Compliance Program, 6th Edition, which LexisNexis recently released. It is available here.

Categories
2 Gurus Talk Compliance

2 Gurus Talk Compliance – Episode 52 – The Big Jet Plane Edition

What happens when two top compliance commentators get together? They talk compliance, of course. Join Tom Fox and Kristy Grant-Hart in 2 Gurus Talk Compliance as they discuss the latest compliance issues in this week’s episode!

Stories this week include:

  • Trump closes tariff loophole on cheap online goods from China MSN)
  • If A.I. Systems Become Conscious, Should They Have Rights? (NYT)
  • Sarah Hadden & Corporate Compliance Insights: “Failure was always a possibility. It just wasn’t an option.” (Ideas & Answers)
  • ‘Everybody’s Replaceable’: The New Ways Bosses Talk About Workers (WSJ)
  • Florida man casually offers officer a vodka spritzer during police chase, officials say (Fox 35 Orlando)
  • The Board’s role in ransomware planning. (Harvard Law School Forum on Corporate Governance)
  • DOJ National Security Division issued a Declination. (Crime, Corruption and Compliance)
  • Based on whistleblower tips, UBS will pay $511MM for Credit Suisse’s failure to live up to DPA. (ComplianceWeek)
  • Malaysia wants Tim Leissner. (WSJ)
  • What is risk paralysis? (FT)

Resources:

Kristy Grant-Hart on LinkedIn

Prove Your Worth

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

Preparing for the New Data Security Program, Part 2

Yesterday, I began a two-part blog post on preparing to respond to the Department of Justice’s (DOJ) new Data Security Program (DSP), which was released on April 8, 2025. Today, I want to conclude this series by reviewing additional key actions you can take now to prepare for the full effective date of October 6, 2025.

  • Set up internal processes for training, audit, and reporting.

The DSP does not just ask for policies; it demands proof of implementation. Your organization must build internal compliance muscle around training, auditing, and reporting specific to DSP obligations. Start with training. Who needs to know what? Procurement teams must understand vendor screening protocols. IT and security teams must recognize DSP risk categories. Legal must know the redlines on cross-border data sharing. Executives must understand their certification responsibilities. Everyone must grasp the stakes: violations carry real-world consequences, including civil penalties and criminal charges.

Next comes auditing. You must create audit plans that review DSP compliance across your data lifecycle, collection, storage, access, processing, sharing, and deletion. These audits should be independent, recurring, and specific to your Data Compliance Program. And don’t forget: if you engage in restricted transactions, you must conduct an audit and submit an annual compliance certification. This is not optional, but mandatory compliance activity is baked into the regulation.

Lastly, establish internal reporting mechanisms. That includes hotlines or portals for employees to report suspected violations and internal systems for escalating rejected transactions to compliance or legal. DSP requires you to report known or suspected breaches within 14 days. This is not a theoretical SLA; failing to meet the timeline is a compliance failure. Build templates, designate responsible officers, and track every report. If your whistleblower program is not integrated with your data governance team, you are already behind the proverbial 8-ball.

Think of this as building a new compliance pillar, just like you did for FCPA or anti-money laundering. It’s not about reinventing the wheel but about embedding DSP-specific requirements into the systems, teams, and culture you already rely on.

  • Engage your board and C-suite on DSP requirements. This is national security compliance, not just privacy.

One of the most underappreciated risks in corporate compliance today is the leadership’s assumption that DSP is just an extension of privacy laws. It is decidedly not. This is national security compliance. And that means the board and C-suite must be informed and actively engaged.

Start by educating the board on how the DSP aligns with existing fiduciary duties and oversight obligations. Directors must understand that data exposure to hostile foreign powers could result in enforcement actions, reputational damage, shareholder litigation, and, in some sectors, revocation of government contracts. This could raise the level of a material disclosure risk for public companies.

The C-suite also has new legal responsibilities. Senior officers must sign off on DSP compliance certifications, ensure audits are conducted, and provide adequate resources for risk management. That means CEOs, GCs, and CFOs are personally accountable for implementation, and their failure to act could aggravate an enforcement action. Bring DSP compliance into board audit committee agendas. Create executive-level working groups that include the CISO, Chief Privacy Officer, General Counsel, and Chief Compliance Officer. Produce quarterly dashboards showing compliance metrics, known or suspected violations, audit results, and third-party risk assessments.

Do not make the mistake of treating this like another privacy briefing. Treat it like an FCPA or sanctions discussion, with risk maps, case studies, DOJ priorities, and benchmark expectations, because this is not about theoretical data misuse. It’s about preventing hostile state actors’ strategic exploitation of American data. And that is a matter of national urgency. If your board does not understand this message, it is up to compliance to evangelize the message before regulators do it for you.

  • Start building your Data Compliance Program today—October 6, 2025, is not as far off as it seems.

October 6, 2025, may feel like a future problem, but let me assure you that the future is already knocking at your door. The DOJ has given us a roadmap and a runway. What you do with that time will define your compliance posture for years. Don’t treat the DSP as a regulatory cliff. Treat it as a strategic build.

Begin by appointing a DSP compliance lead with data governance and regulatory experience. Next, map your data flows, classify your datasets, and identify your exposure to restricted or prohibited transactions. Use that information to build a risk profile. That’s your foundation.

Then, develop your Data Compliance Program. Create written policies for due diligence, vendor screening, internal reporting, and audit procedures. Set up governance structures, designate accountable officers, and prepare for annual certifications. Do not wait until Q3 to scramble; start embedding controls into your existing compliance infrastructure now.

Use this runway to build muscle memory: conduct tabletop exercises, test your reporting protocols, and audit your readiness. Engage your business units with training, mock scenarios, and real-life case studies. The goal is not just compliance; it is about cultural adoption. You’ve already failed if your people see this as a box-checking exercise. The organizations that will thrive under DSP are the ones that treat this not as a regulatory burden but as an opportunity to lead. Because let’s face it: national security compliance is the new frontier. And October 6, 2025, won’t end this journey. It’s the beginning.

The DSP marks a seismic shift for compliance professionals in the era of data as a national security asset. This is not just another privacy framework but a national security regulation with teeth. U.S. companies must now treat data governance the way they’ve treated anti-bribery compliance or export controls: with rigor, documentation, and executive oversight. That starts with reviewing and aligning privacy policies to DSP-defined risk categories, especially around government-related and bulk-sensitive personal data.

Vendor agreements must be audited for exposure to covered persons or countries of concern and updated with enforceable clauses to prevent prohibited data transfers. Organizations must also build robust internal training, auditing, and reporting systems, with mandatory 14-day reporting windows for violations. Most critically, boards and C-suites must be actively engaged, and this is national security compliance, not just IT hygiene. The clock is ticking, with full enforcement kicking in on October 6, 2025. Compliance professionals have a unique opportunity to lead from the front, building a proactive, risk-based Data Compliance Program that integrates DSP mandates into business operations before DOJ examiners come knocking. The message is clear: Know your data. Know your risks.

Finally, take action before your inaction becomes your liability.

Categories
Compliance Tip of the Day

Compliance Tip of the Day – Using Supply Chain to Innovate in Compliance

Welcome to “Compliance Tip of the Day,” the podcast where we bring you daily insights and practical advice on navigating the ever-evolving landscape of compliance and regulatory requirements. Whether you’re a seasoned compliance professional or just starting your journey, we aim to provide bite-sized, actionable tips to help you stay on top of your compliance game. Join us as we explore the latest industry trends, share best practices, and demystify complex compliance issues to keep your organization on the right side of the law. Tune in daily for your dose of compliance wisdom, and let’s make compliance a little less daunting, one tip at a time.

How to use your supply chain partners to innovate for your compliance program.

For more on this topic, check out The Compliance Handbook, a Guide to Operationalizing Your Compliance Program, 6th Edition, which LexisNexis recently released. It is available here.

Categories
Blog

Preparing for the New Data Security Program, Part 1

Yesterday, I introduced the Department of Justice’s (DOJ) new Data Security Program (DSP), which was released on April 8, 2025, and implemented under Executive Order 14117. Today, I want to begin reviewing key actions you can take now to prepare for the full effective date of October 6, 2025. We will complete our review of key steps to take tomorrow.

1. Review your current data governance and privacy policies—align them with DSP risk categories.

Data governance is no longer just about classification and access rights; it’s now a frontline national security function. The DSP requires fundamentally rethinking how organizations define, inventory, and control sensitive data. Compliance officers must start with a forensic review of current data governance frameworks: What data are you collecting? Who touches it? Where does it live? Who can access it, and how is it transferred internally and externally? Once mapped, each dataset must be examined through the DSP lens: Is it government-related? Does it contain bulk sensitive personal data? Is it linked to current or former U.S. government personnel? These are not simply IT questions. These are compliance questions with profound legal implications.

Next, organizations must evaluate their privacy policies for blind spots. Many policies were written for GDPR or CCPA, not for adversarial data exfiltration by foreign intelligence services. If your data policies are not risk-aligned to DSP categories, such as data brokered to third parties or aggregated in ways that make re-identification likely, you are flying blind in a regulatory minefield. This isn’t a call for a quick redline but a strategic overhaul of how you structure data controls, policies, and risk frameworks. Collaborate with your CISO, but lead with your compliance hat on. The DOJ is not asking for IT security alone, and they are demanding accountable, auditable compliance with national security-grade rigor. Treat this like an FCPA compliance program: document everything, know your risk vectors, and escalate anomalies. The age of “data policy as an afterthought” is over. In the DSP era, data is not just a privacy concern but a geopolitical flashpoint.

2. Audit your third-party vendor agreements for exposure to covered persons or countries of concern.

Third-party risk just got geopolitical. Under the DSP, vendor due diligence has become a national security obligation. You must now screen for performance and financial viability and whether any foreign vendor, subcontractor, or partner is a “covered person” or tied to a country of concern like China, Russia, Iran, North Korea, Venezuela, or Cuba. Even indirect ownership or residency triggers a compliance obligation. That friendly cloud storage provider with a branch in Shenzhen? Is that IT support firm subcontracting code maintenance to Belarus? They may now be regulatory liabilities under the DSP.

Start with a comprehensive audit of all current vendor agreements, focusing on data-sharing terms, sub-licensing permissions, and geographic exposure. Can the vendor access, process, or host government-related or bulk-sensitive personal data? If so, is there a clause prohibiting onward transfer to covered persons or countries of concern? If not, you’re potentially out of compliance. You may need to renegotiate or terminate contracts that create risks you can’t control. Relying on “we didn’t know” is insufficient, as the DSP holds U.S. persons accountable for failing to implement reasonable and proportionate due diligence.

Also, consider implementing a DSP-specific screening protocol that goes beyond sanctions and AML lists and includes the DOJ’s Covered Persons List. Integrate this into your vendor onboarding, renewal, and periodic review processes. Remember, under the DSP, even inadvertent exposure can constitute a violation. That means it’s no longer enough to run a vendor through OFAC and call it a day. You need a national security screening lens. Compliance must lead this effort, not procurement, legal, or IT. If a vendor relationship enables DSP-prohibited access, the legal liability will land squarely on your doorstep.

3. Draft contractual clauses that prohibit data resale or access by covered entities.

The DSP has thrown a wrench into how we think about contract drafting. Referencing generic data use terms or standard confidentiality clauses is no longer sufficient. You’re exposed if your contracts do not explicitly prohibit the onward sale or transfer of covered data to countries of concern or covered persons. Under the DSP, exposure is not simply reputational but both civil and criminal.

Compliance teams should immediately collaborate with legal and procurement to update all relevant agreements. That includes data-sharing contracts, licensing, cloud service agreements, vendor onboarding templates, and M&A data room protocols. Insert clauses prohibiting foreign counterparties from transferring sensitive personal or government-related data to any covered person or country of concern. Go further: mandate that they notify you of any suspected breach and certify compliance annually.

Do not stop at language insertion. Require enforceability mechanisms, termination clauses, indemnification provisions, and audit rights. The DOJ clarified that including boilerplate language will not shield you from enforcement. You may have committed a prohibited transaction if you knew or should have known that a foreign vendor resold data to a hostile actor. Even the best legalese won’t save you without operational controls to back it up.

Consider maintaining a DSP Clause Library, a set of pre-approved terms for use across contracts by legal and compliance staff. Train your contract managers on red flags. Build escalation protocols when counterparties push back. And do not forget to update your templates as the DOJ issues more guidance. In short, think of DSP compliance clauses the way you would anti-corruption reps and warranties in an FCPA context: a first line of defense, but only effective when part of a broader compliance architecture.

The Department of Justice’s new Data Security Program, effective October 6, 2025, is a game-changer for corporate compliance. It redefines data governance as a national security obligation, requiring companies to align privacy policies with DSP risk categories and scrutinize third-party vendors for ties to covered persons or countries of concern. Compliance professionals must proactively draft enforceable contracts, build auditable training and reporting systems, and educate C-suites and boards that DSP is not “just privacy”; rather, it is national security compliance. With the clock ticking, the time to act is now. Join us tomorrow for Part 2, where we continue the roadmap to DSP readiness.