Tag: compliance

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 27 – The Compliance Function in an Organization

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 27 episode, we explore the growing importance and responsibilities of the compliance function within corporations, emphasizing the need for adequate staffing, resources, and independence.

Key highlights:

  • DOJ’s Expectations for Compliance Programs
  • Funding and Resources for Compliance
  • Compliance Program Structure and Authority

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Blog

How Compliance Should Show Up Before the Crisis

Recently, my colleague Matt Kelly wrote a blog post about retaliation against Chief Compliance Officers (CCOs). Matt and I explored it in an episode of the podcast Compliance into the Weeds. Matt’s post and our discussion crystallized one of the frustrations of the CCO role: compliance is often experienced solely by senior management as a late-arriving messenger of bad news. When compliance walks into the room, something has already gone wrong. The tone changes. Defenses go up. Trust narrows.

Yet the most consequential moments for a CCO are precisely those situations where the stakes are highest. A potential regulatory disclosure. A decision about whether to notify a government agency. A moment where delay, missteps, or poor coordination can turn a manageable issue into an enterprise-level crisis. If compliance is only visible in those moments, the relationship with the CEO and executive leadership team is already at a disadvantage.

Interestingly, in our podcast, we explored a technique which might be termed “coaching management ahead of time”. Matt picked up the strategy of using a training borrowed from the cyber world of incident training for a cyber-attack. I see this as a very powerful way not only to communicate compliance but also to train on the specific issues senior management will face if a reportable compliance incident occurs. You could train on such hypotheticals by walking the executive leadership team through them so they understand the process, while also providing training on the specific issues.

I think this approach offers practical, repeatable ways to build trust with senior management before a crisis, so that when compliance raises a serious issue, the function is seen as a stabilizing force, not a source of panic.

The Core Problem: Compliance as the Bearer of Bad News

Many compliance officers do excellent technical work but still struggle to earn executive trust. The reason is not competence. It is timing and framing. Senior leaders often experience compliance in three narrow contexts:

  • An investigation has begun.
  • A whistleblower allegation has escalated; and/or
  • A regulator may need to be notified.

In those moments, compliance is necessarily directive. The CCO must slow decisions down, insist on process, and sometimes recommend outcomes executives would prefer to avoid. Without a foundation of trust, those recommendations can feel punitive or overly conservative. The solution is not softer messaging during crises. The solution is familiarity with the compliance process long before the crisis arrives.

Process Transparency as a Trust-Building Strategy

Trust is built through predictability. Senior executives are far more comfortable with difficult outcomes when they understand the process that leads there. This is where scenario-based training becomes one of the most underused tools in the compliance arsenal. Instead of waiting for a live issue, the CCO can walk the executive leadership team through realistic hypotheticals:

  • A fact pattern that suggests regulatory notification may be required
  • How compliance evaluates credibility and materiality
  • Who is involved at each stage and why
  • What decisions will management be asked to make
  • What actions help, and what actions make things worse

These sessions are not about assigning blame or rehearsing fear. They are about demystifying how compliance operates when the stakes are high.

Why Scenario-Based Training Works With Executives

Scenario-based discussions resonate with executive teams for several reasons. First, they are practical. Executives do not need another policy overview. They want to know what actually happens when something goes wrong. Second, they are respectful of executive time and intelligence. A well-designed hypothetical treats leadership as decision-makers, not students. Third, they normalize compliance involvement.

When executives have already walked through a compliance-led process in a low-pressure setting, that process feels familiar rather than threatening during a real event. Most importantly, scenario-based training reframes compliance from a reactive function to a preparedness function.

The Strategic Role of Informal Engagement

These conversations do not need to occur only in formal training sessions. In fact, some of the most effective trust-building happens outside structured settings.

  • A short walkthrough during an executive offsite.
  • A tabletop discussion over lunch.
  • A casual conversation that begins with, “Let me show you how we would handle this if it ever happened.”

These informal touchpoints matter because they remove fear from the equation. They allow executives to ask questions they might not ask during a live issue. They also allow compliance to show judgment, nuance, and business awareness. This is not a charm offensive. It is a deliberate relationship strategy.

Training on What Not to Do

One of the most valuable elements of scenario-based transparency is the ability to explain mistakes before they occur. Executives often want to help in a crisis. That instinct, while well-intentioned, can create problems. Premature document reviews. Side conversations. Incomplete recollections. Overconfident assurances.

Scenario training allows the CCO to say, in advance, “Here is what helps us protect the company,” and just as importantly, “Here is what can unintentionally make things worse.” When executives understand these boundaries ahead of time, compliance interventions during a real issue feel protective rather than restrictive.

From Messenger of Doom to Stabilizing Force

When compliance has invested in transparency and education, something important shifts. When the CCO later says, “We believe this may require regulatory notification,” that recommendation is no longer heard in isolation. It is understood as part of a known, previously discussed process.

Executives may not like the conclusion, but they trust the path that led there. That trust allows compliance to do its job effectively. It reduces friction. It shortens response time. It improves decision quality. Most importantly, it positions compliance as an advisor whose presence brings structure and clarity to uncertainty.

What Compliance Officers Should Take Away

For compliance officers, the lesson is not about presentation skills or tone management. It is about timing and familiarity. If senior management only experiences compliance during moments of stress, compliance will always feel adversarial. If senior management understands the compliance process before the stress arrives, compliance becomes a stabilizing influence.

Scenario-based training, informal engagement, and process transparency are not “nice to have” activities. They are strategic tools for relationship-building at the highest levels of the organization. The most trusted CCOs are not those who avoid bringing bad news. They are the ones who ensure that when bad news arrives, it is delivered within a framework everyone already understands. That is how compliance earns trust before the crisis and credibility during it.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 26 – Elevating the Role and Independence of the Chief Compliance Officer

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 26 episode, we ponder the evolving stature and authority of the CCO within organizations, as highlighted by recent guidelines and regulations.

Key highlights:

  • Key Inquiries Around the CCO and Compliance Function
  • Importance of CCO Certification and Court Decisions
  • Critical Takeaways for Compliance Professionals

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Blog

Board KPIs for AI Governance: Guidance from the ECCP

Corporate Boards are no longer asking whether their organizations will use artificial intelligence. The business has already answered that question. The only question that matters now is whether AI is being governed well enough to support growth without creating unmanaged risk.

For the corporate compliance officer, this reality creates both pressure and opportunity. Pressure, because Boards with minimal AI literacy still carry full fiduciary responsibility. Opportunity, because compliance is uniquely positioned to translate complex AI activity into oversight-ready information. The bridge between those two worlds is the right set of Board-level  Key Performance Indicators (KPIs) for AI governance. Moreover, I believe the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) can serve as a framework for developing appropriate KPIs for your Board.

In this blog post, we detail a set of Board-level KPIs for compliance professionals tasked with educating growth-oriented Boards on AI governance using a blended, ECCP-centric framework. It assumes that AI is already deployed across the enterprise, including generative AI, and that governance must enable innovation while enforcing guardrails.

Why Boards Need AI KPIs Now

The ECCP makes one point repeatedly and without ambiguity: regulators care less about written policies and far more about whether controls work in practice. Boards are expected to exercise oversight over risk, including emerging and technology-driven risks. AI is now firmly in that category.

AI governance KPIs are not about teaching directors how models work. They are about answering three questions every Board must be able to answer:

  1. Do we know where AI is being used?
  2. Do we control how AI changes over time?
  3. Can we detect, respond to, and remediate AI-related harm quickly?

If a Board cannot answer those questions with evidence, not narrative reassurance, the organization is exposed. The role of compliance is to ensure those answers are delivered in a form that directors can understand and act upon.

The KPI Philosophy: Enablement With Guardrails

Because this is a growth-oriented Board, the goal is not to slow AI adoption. The goal is to make AI scalable, defensible, and sustainable. KPIs must therefore do three things simultaneously:

  • Demonstrate coverage and control without micromanagement
  • Surface risk early, before incidents become enforcement events
  • Support informed decision-making, not technical debate

This means Boards should receive KPIs, escalation triggers, and narrative context. Numbers alone are insufficient. Context without metrics is worse.

Six Board-Level KPIs for AI Governance

The following six KPIs apply to all AI systems, including generative AI, within a unified governance framework. They are evidence-based, auditable, and aligned with the ECCP expectations for testing, monitoring, and continuous improvement.

1. Risk Inventory Coverage

This KPI measures the percentage of in-scope AI systems with a current, signed risk record documenting use case, data sources, impacts, potential harms, and safeguards. If AI is operating outside the risk inventory, it is operating outside governance. This KPI answers the most basic oversight question: do we know what we have? Any material AI system without a documented risk assessment or with an expired review date should be escalated for review.

The ECCP begins with risk assessment for a reason. Under the ECCP, they are directed to consider whether a company has identified and prioritized its risks, including emerging risks. AI, particularly GenAI, now squarely fits within that expectation. Risk Inventory Coverage directly answers the ECCP question: “What methodology has the company used to identify, analyze, and address the particular risks it faces? ” If AI systems are operating without a documented risk record, the program fails at step one. From an ECCP perspective, undocumented AI use is indistinguishable from unmanaged risk.

2. Model Change Control Adherence

This measures the percentage of AI model changes, including code, data, prompts, parameters, or vendors, that followed the approved change management process. Uncontrolled change is the fastest way for compliant AI to become noncompliant. This KPI assures directors that innovation is disciplined, not chaotic. Any production AI change implemented without pre-deployment testing, approval, or rollback capability should be escalated for review.

ECCP Alignment:

The ECCP explicitly evaluates whether policies are followed in practice, not merely written. Adherence to change control shows whether AI governance has real authority over business and technology decisions. Unapproved model changes undermine every safeguard the company believes it has in place. From the DOJ’s perspective, a control that can be bypassed without consequence is not a control. For your Board, this KPI demonstrates that AI innovation is disciplined and governed, not uncontrolled experimentation that creates hidden compliance exposure.

3. Model Lineage and Provenance Completeness

This KPI measures the percentage of AI systems with end-to-end traceability, enabling the reconstruction of how outputs were generated and decisions were approved. When something goes wrong, regulators and plaintiffs will ask how the AI reached its decision. This KPI determines whether the company can answer. Any high-impact AI system lacking sufficient documentation to support root cause analysis should be escalated for review.

This KPI is derived from the ECCP sections on Continuous Improvement, Periodic Testing, and Review, as well as Investigation, Analysis, and Remediation of Misconduct. The ECCP asks whether a company can understand why something went wrong and conduct effective root cause analysis. Without lineage and provenance, AI decisions cannot be reconstructed, tested, or explained. This KPI directly supports DOJ’s expectation that companies can investigate incidents, identify systemic weaknesses, and remediate effectively. For your Board, this KPI determines whether the organization can defend its AI decisions after the fact or whether it will be forced into speculation and guesswork.

4. Third-Party Model Assurance Coverage

This KPI measures the percentage of third-party AI tools and services that have completed due diligence, contractual controls, and periodic reassessment. Most AI risk now enters organizations through vendors. Boards must know whether those risks are being actively managed. Any use of third-party AI without completion of onboarding or with unresolved high-risk findings should be escalated for review.

This ties to the ECCP section around Third-Party Management. The ECCP is unambiguous on third parties. Companies are expected to conduct risk-based due diligence, impose contractual controls, and monitor third-party performance over time. Most AI risk now enters through vendors, platforms, APIs, and embedded models. Treating third-party AI differently from other third-party risks would be inconsistent with DOJ guidance. For your Board, this KPI shows that AI vendor risk is governed with the same rigor as bribery, sanctions, or data security risks.

5. AI Incident Mean Time to Resolution (MTTR)

This KPI measures the median time from detection of an AI incident to containment and recovery. Incidents are inevitable. What matters is how fast the organization responds. This KPI demonstrates operational resilience. Repeated incidents with increasing resolution times or incomplete remediation should be escalated.

This ties to the ECCP sections on Investigation, Analysis, and Remediation of Misconduct. The ECCP focuses heavily on how quickly and effectively companies respond to detected issues. Speed matters. Delayed containment signals weak controls and inadequate monitoring. AI Incident MTTR translates this expectation into a measurable operational outcome. It demonstrates whether the company can detect, contain, and remediate AI-related harm before it escalates into regulatory or reputational damage. For your Board, the key takeaway is that this KPI demonstrates operational resilience and governance maturity, not merely technical incident response.

6. Fairness and Robustness Pass Rate

This KPI measures the percentage of AI systems passing predefined fairness, bias, and robustness tests across relevant segments and use cases. It connects AI governance to ethical outcomes and reputational risk. Any material AI system deployed with known fairness or robustness failures should be escalated for review.

This ties to the ECCP sections on Continuous Improvement, Periodic Testing, and Review. The ECCP repeatedly asks whether companies test their controls and whether those controls work in practice. Fairness and robustness testing is the AI equivalent of transaction testing in anti-corruption or sanctions compliance. This KPI shows that AI systems are not only reviewed at launch but are continuously validated against defined risk thresholds. For your Board, the key takeaway is that this KPI demonstrates that ethical and legal AI commitments are enforced through testing, not slogans.

Board Oversight Questions Tied to AI KPIs

To close, here are Board-level questions compliance officers should encourage directors to ask:

  1. Which AI systems fall outside our current risk inventory, and why?
  2. Where have we accepted AI risk, and what safeguards justify that decision?
  3. Are AI changes happening faster than our governance can keep up with?
  4. How quickly can we detect and contain AI-related harm?
  5. Which third-party AI risks would cause us to pause or exit a deployment?
  6. How do these KPIs support growth rather than restrict it?

AI governance KPIs are not about slowing innovation. They are about making growth durable. For compliance professionals, delivering these metrics in a clear, disciplined, and Board-ready way is how AI governance becomes a strategic asset rather than a regulatory afterthought.

If you would like specific KPIs based on this blog, go over and subscribe to my Substack. At this point, it is free. Check it out here.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 25 – Investigative Findings

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 25 episode, we consider the critical importance of addressing investigative findings within a corporate compliance framework.

Key highlights:

  • The Impact of Investigations on Compliance
  • Communicating Costs and Risks
  • Ensuring Effective Communication

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
Sunday Book Review

Sunday Book Review: January 25, 2026, The Book on Leadership for ‘26 Edition

In the Sunday Book Review, Tom Fox considers books that would interest compliance professionals, business executives, or anyone curious. It could be books about business, compliance, history, leadership, current events, or anything else that might interest Tom. In this episode, we look at 4 recent books on leadership you should read in 2026.

  1. The AI Centered Enterprise by Ram Bala, Natarajan Balasubramanian, and Amit Joshi
  2. Twin Transformation by Michael Wade and Konstantinos Trantopoulos
  3. Gain by Michael Wade and Amit Joshi
  4. Leading a Sustained Business Transformation by Julia Binder and Knut Haanaes

Resources:

12 leadership books you should read in 2026 by the IMD Blog

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 24 – Internal Reporting and Triage

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 24 episode, we look into the critical process of internal reporting and triaging of FCPA claims.

Key highlights:

  • Guidelines for Effective Compliance Programs
  • Jonathan Marks’ Five-Step Process for Early Assessment
  • Key Takeaways

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
31 Days to More Effective Compliance Programs

31 Days to a More Effective Compliance Program: Day 23 – Investigative Protocols

Welcome to 31 Days to a More Effective Compliance Program. Over this 31-day series in January 2026, Tom Fox will post a key component of a best-practice compliance program each day. By the end of January, you will have enough information to create, design, or enhance a compliance program. Each podcast will be short, at 6-8 minutes, with three key takeaways that you can implement at little or no cost to help update your compliance program. I hope you will join each day in January for this exploration of best practices in compliance. In today’s Day 23 episode, we delve into the essential steps for conducting a thorough and effective internal investigation following an internal report.

Key highlights:

  • Key Questions for Internal Investigations
  • Detailed Procedures for Handling Complaints
  • Steps in the Investigative Process
  • Importance of Consistency in Investigations

Resources:

Listeners to this podcast can receive a 20% discount on The Compliance Handbook, 6th edition, by clicking here.

Categories
AI Today in 5

AI Today in 5: January 23, 2026, The Greatest AI Challenge Edition

Welcome to AI Today in 5, the newest addition to the Compliance Podcast Network. Each day, Tom Fox will bring you 5 stories about AI to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the AI Today In 5. All, from the Compliance Podcast Network. Each day, we consider five stories from the business world, compliance, ethics, risk management, leadership, or general interest about AI.

Top AI stories include:

  • South Korea adds new AI regulations. (Reuters)
  • Vietnam updates IP & AI law. (Rouse)
  • AI’s greatest challenge is managerial, not technical. (Bloomberg)
  • With AI, compliance data is more valuable than ever. (FinTechGlobal)
  • AI assists retailers in stopping return fraud. (CBS News)

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com.

Categories
Blog

Returning to Venezuela: Part 5 – AML Risk and the Final Compliance Test

In this five-part series, I have walked through the core compliance risks US energy companies will face as they consider a return to Venezuela. We began with bribery and corruption and the long shadow of PdVSA (Parts 1 & 2). We moved through export controls (Part 3), security risks (Part 4), and the broader operational and strategic challenges of working in one of the most complex risk environments in the world. But this final post is different. Money laundering risk is not simply another risk category. It is the connective tissue that binds all the others together.

If bribery is how improper value enters the system, money laundering is how it is disguised, moved, and legitimized. If export control violations create pressure to reroute goods or payments, money laundering techniques make that rerouting possible. If security risks require local intermediaries, cash payments, or opaque vendors, those same decisions create AML exposure. For the compliance professional, money laundering risk in Venezuela is the capstone test of whether the program actually works.

The Regulatory Frame: FinCEN, ECCP, and Correspondent Banking Reality

Any AML discussion must start with expectations. US regulators have been explicit. The AML program pillars articulated by the Financial Crimes Enforcement Network (FinCEN) are not optional abstractions. They are operational requirements: risk-based controls, internal policies, independent testing, training, and designated responsibility.

Overlay that with the Department of Justice Evaluation of Corporate Compliance Programs (ECCP), which asks whether controls are designed, implemented, tested, and actually effective. Then add the reality of correspondent banking risk. Even if a US energy company does not directly move funds through US banks, its banking partners will apply US standards. Banks do not absorb Venezuela’s risk on behalf of their customers. They de-risk. Compliance failures upstream become frozen accounts downstream. This is why AML must be treated as an enterprise risk, not a compliance side project.

Operating Under Licenses Does Not Reduce AML Risk

This blog assumes that operations occur under general licenses, specific licenses, or wind-down authorizations issued by the Office of Foreign Assets Control. That matters for sanctions analysis, but it does not reduce AML exposure. Licenses permit activity. They do not cleanse counterparties, validate payment flows, or excuse weak controls. In fact, licensed activity often attracts heightened scrutiny because regulators know companies will push forward aggressively once permission is granted.

In Venezuela, licensed operations still involve high-risk state actors, politically exposed persons, weak financial institutions, and a long history of financial opacity. From an AML perspective, licenses are a starting gun, not a shield.

PdVSA as a Multi-Vector AML Risk

As we have previously noted, PdVSA must be treated not as a single counterparty risk but as multiple overlapping AML risk vectors. First, there is trade-based money laundering. Oil shipments are uniquely vulnerable to pricing manipulation, volume misstatements, phantom cargoes, and circular trading. In Venezuela, these risks are amplified by distressed infrastructure, a history of sanctions, and reliance on intermediaries.

Second, there is an intermediary risk. Shipping companies, charterers, port agents, and customs facilitators often operate through layered ownership structures. The farther one moves from the wellhead, the less transparency exists. Third, there is a risk to the payment structure. Delayed payments, in-kind arrangements, and third-country settlement accounts create fertile ground for laundering illicit proceeds. When oil becomes currency, AML controls must follow the barrel, not the invoice.

Venezuelan, Crypto, and Third-Country Banking Risk

Venezuelan banks operate under severe constraints. Many lack robust AML systems, and even well-intentioned institutions face talent shortages and technology gaps. As a result, payments often move through third-country banks. These arrangements create several red flags: unusual routing, non-USD transactions, inconsistent settlement timelines, and opaque beneficiary information. Each red flag increases the likelihood of SAR filings and banking friction. Compliance professionals must understand that correspondent banks apply their own risk lens. If they are uncomfortable, they will exit. That operational disruption becomes a compliance failure.

Crypto and alternative payment mechanisms are not edge cases in Venezuela. They are practical responses to currency instability, banking limitations, and sanctions pressure. From an AML standpoint, crypto introduces wallet anonymity, cross-border velocity, and limited recourse once funds move. Any use of crypto, whether by the company or its third parties, must be explicitly prohibited or tightly controlled. Silence is not neutrality. Silence is exposure.

Third Parties: Where AML, Bribery, and Security Collide

Local agents, logistics providers, customs brokers, and security vendors represent the highest combined risk in Venezuela. These third parties often operate in cash-intensive environments, maintain close ties to government actors, and perform functions critical to business continuity. Family-owned and politically connected vendors demand enhanced due diligence. That means beneficial ownership verification, source-of-funds analysis, ongoing monitoring, and contractual audit rights. Initial diligence alone is insufficient. Relationships evolve, and risk escalates quickly.

This is where the bribery blog, the security blog, and this AML blog converge. The same third party that creates bribery risk also creates money laundering risk. Controls must be integrated, not siloed.

The Operational Reality: This Is Manageable If You Manage It

Despite these risks, this is not a counsel of despair. US companies have operated in high-risk jurisdictions before. The key is realism. AML programs in Venezuela cannot rely on annual certifications, static risk assessments, or generic policies. They require transaction-level visibility, real-time escalation, and empowered compliance personnel. Friction with the business is inevitable and necessary.

Venezuela-Specific AML Operational Checklist

Below is a practical, compliance-focused checklist for operating in Venezuela:

Risk Assessment

  • Conduct a Venezuela-specific AML risk assessment tied to operations, not geography alone
  • Map payment flows end-to-end, including third-country routing
  • Identify trade-based money laundering scenarios tied to oil shipments

Policies and Controls

  • Prohibit unauthorized crypto usage explicitly
  • Require documented economic justification for all intermediaries
  • Establish clear escalation thresholds for delayed or rerouted payments

Third-Party Due Diligence

  • Perform enhanced due diligence on all local agents, logistics providers, customs brokers, and security vendors
  • Verify beneficial ownership and political exposure
  • Assess the source of funds and expected transaction behavior

Transaction Monitoring

  • Monitor oil pricing, volumes, and delivery discrepancies
  • Flag unusual settlement patterns or changes in banking instructions
  • Integrate AML alerts with sanctions and export control monitoring

Training and Culture

  • Provide targeted AML training for operations, finance, and procurement teams
  • Reinforce speak-up mechanisms tied to payment and logistics concerns

Testing and Auditing

  • Conduct targeted audits focused on high-risk transactions
  • Test controls against realistic laundering typologies
  • Document remediation and program enhancements

AML as the Series Capstone

This series has shown that returning to Venezuela is not a single compliance decision. It is a systems test. Money laundering risk sits at the center of that test because it exposes weaknesses everywhere else. If your AML program can function effectively in Venezuela, it can function anywhere. If it cannot, no license, policy, or assurance letter will save it. This is doable. But only if compliance is brought in early, appropriately resourced, and empowered to say yes, if.