Categories
Compliance Into the Weeds

Compliance into the Weeds: Balt and TradeStation: Lessons for the Compliance Professional

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly look at the Declination awarded to Balt SAS and the OFAC enforcement action involving TradeStation. 

First, they review a Corporate Enforcement Policy declination for French medical-equipment company BAL SAS and the company’s U.S. subsidiary after self-disclosing, cooperating and remediating misconduct involving a U.S. subsidiary executive and a Belgian consultant allegedly funneling about $600,000 in bribes to a French public hospital official using sham consulting agreements, invoices, and poor documentation; BAL disgorged about $1.21 million in profit on roughly $1.68 million in revenue and disclosed while its internal investigation was still ongoing, raising timing and high-margin red-flag issues.

Second, they cover OFAC’s $1.1 million settlement with TradeStation for accidentally disabling sanctions-screening controls for nearly a year, enabling hundreds of transactions from Iran, Syria, and Crimea; despite having layered tools on paper, IT changes and lapsed subscriptions undermined those controls, underscoring the need for ongoing monitoring, testing, and auditing.

 Key highlights:

  • Balt FCPA Case
  • Disclosure Timing
  • Profit Margin Red Flags
  • Controls and France Angle
  • TradeStation Overview
  • How Screening Failed
  • Monitoring and Accountability
  • Costs and OFAC Lessons

Resources:

Matt in Radical Compliance

Tom in the FCPA Compliance Report

Tom  

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Categories
Blog

Balt’s DOJ Declination: A Case Study in Why Speed, Cooperation, and Remediation Still Matter

The Justice Department’s first publicly announced resolution under its new Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) offers corporate compliance officers a practical roadmap: disclose early, cooperate fully, remediate credibly, and be prepared to help prosecutors hold individuals accountable.

Some enforcement actions feel like one-off events. Then others operate like a flare shot into the compliance sky. The DOJ Declination involving French medical device company Balt SAS and its US subsidiary Balt USA (collectively ‘Balt) falls squarely into the second category.

Why? Because this was not simply another FCPA matter. It was the first publicly announced corporate resolution under the DOJ’s new CEP, and DOJ clearly meant it to send a message to the market. As the Wiley alert noted, the Balt matter demonstrates the benefits available to companies that voluntarily self-disclose, fully cooperate, and timely remediate, while also reinforcing DOJ’s emphasis on individual accountability. For compliance officers, that makes Balt important far beyond the four corners of the case itself.

What happened at Balt?

According to the Declination, Balt paid approximately $602,000 in bribes from around 2017 to 2023 to a physician who held a senior role at a state-owned public hospital in France to obtain or retain business. The payments were routed through a third-party consultant in Belgium, with fake invoices and purported bonus payments used to conceal the true nature of the transaction. The scheme generated roughly $1.68 million in revenue and approximately $1.214 million in profits for Balt. As Matt Kelly reported in Radical Compliance, the scheme involved all the old FCPA classics: sham consulting arrangements, fake invoices, and off-channel communications. That alone would have made the matter notable. But the more important point is what happened after Balt discovered the misconduct.

DOJ declined prosecution because Balt self-disclosed while its internal investigation was still ongoing; provided full and proactive cooperation; engaged in timely and appropriate remediation, including disciplinary measures and termination of tainted business relationships; and presented no aggravating circumstances sufficient to disqualify it from a Part I declination. DOJ also required Balt to disgorge approximately $1.2 million and noted that the company had entered into a parallel resolution in France that included compliance requirements. This is the template. And compliance officers should study it carefully.

The real lesson: self-disclosure means before you know everything

One of the most significant points in the Balt matter is timing. Balt disclosed the issue during an ongoing internal investigation, which strongly suggests the company came in before every fact had been nailed down.

That matters because many companies still hesitate, hoping to finish the investigation, validate every fact, and package the matter neatly before approaching the OJ. Balt is a reminder that DOJ wants speed and credibility, not perfection. The new policy framework still prizes timely self-disclosure as the clearest route to a declination. Wiley put it plainly: voluntary disclosure still provides the clearest path to that outcome, and delay can preclude eligibility for the most favorable result.

For the Chief Compliance Officer (CCO), this is where judgment, preparation, and governance structure come together. If your escalation protocols are weak, if privilege decisions are muddled, if your triage process is slow, or if your board and senior leadership do not understand the declination calculus, you can lose the timing advantage before the real work even begins. The Balt case is not simply a win for self-disclosure. It is a win for pre-existing readiness for investigation.

Cooperation means more than being polite

The second lesson is equally important. Under the CEP, cooperation is not a vague aspiration. It is an operational requirement. The Wiley analysis emphasized that full cooperation includes identifying all individuals involved in or responsible for the misconduct and providing facts and evidence concerning their conduct.

This is where compliance officers need to understand a hard truth. DOJ is not offering declinations because it has become sentimental, or even because this administration does not believe in the FCPA. It is offering incentives because it wants something in return. And one of the most important things it wants to do is help build cases against culpable individuals.

That is precisely what happened here. DOJ paired Balt’s declination with indictments of two individuals allegedly involved in the bribery scheme. Wiley correctly described the sequencing as no coincidence, but rather a reinforcement of the DOJ’s continuing focus on individual accountability. Kelly made the same point in even more direct terms: from DOJ’s perspective, if a company voluntarily self-discloses, coughs up illicit proceeds, and helps prosecutors hold wrongdoers accountable, the company can receive a declination.

For compliance professionals, this means internal investigations must be designed from the outset with evidentiary rigor. You need documentation discipline. You need clear interview protocols. You need a defensible record of who knew what, who approved what, and how the misconduct moved through the system. A half-hearted review that avoids hard questions about executives, consultants, or favored business relationships will not get you where Balt got.

Remediation is not a slide deck

The third lesson is on remediation. Too many organizations still treat remediation as presentation theater. They produce a deck, revise a policy, hold a training session, and call it transformation. The DOJ is looking for something more concrete. In the Balt Declination, remediation included disciplinary action against relevant individuals, termination of business relationships that gave rise to the misconduct, tailored compliance training for senior management, and improvements to the compliance program and internal controls. That list is worth lingering over. The DOJ did not only want a promise. It wanted decisions. It wanted changed relationships. It wanted management-specific training. It wanted better controls.

This is a point I have been making for 15 years. A compliance program is not judged by what sits in the binder; it is judged by what the company does when the pressure hits. Balt has shown DOJ that when misconduct surfaced, the company acted. That is the difference between a paper program and a living program.

For CCOs, the action item is straightforward. Build remediation plans that can be demonstrated, measured, and explained. Who was disciplined? Which third party was terminated? What internal control was changed? How was senior management retrained? What monitoring now exists that did not exist before? If you cannot answer those questions in concrete terms, you are not remediating. You are narrating.

The shadow issue: aggravating circumstances

There is another important dimension here. Balt qualified for a Part I declination, in part, because DOJ found no aggravating circumstances. But as Wiley noted, that assessment can be highly fact-dependent and may not be obvious in the early stages of an internal investigation. The line between Part I and Part II can, in practice, be subjective and outcome-determinative.

That is a crucial warning for compliance officers. Balt should not be read as a guarantee. It should be read as an incentive structure. Companies must still assess whether the misconduct is egregious or pervasive, whether senior management is implicated, whether the harm is severe, and whether the organization has a recidivist history. Those factors can dramatically change the result. So the compliance officer’s job is not to assume declination. The job is to gather facts rapidly, surface aggravating factors honestly, and help leadership make a disciplined disclosure decision.

The new DOJ Declination policy offers more clarity than many companies had before. But it does not eliminate judgment. It raises the premium on disciplined judgment.

Five Key Takeaways for Chief Compliance Officers

  1. Build a rapid disclosure protocol now. Balt’s outcome underscores that early self-disclosure, even during an ongoing investigation, can be decisive. Delay can cost you the best available resolution.
  2. Design investigations to identify individuals from day one. The DOJ expects cooperation to include facts about responsible individuals, not just corporate-level summaries.
  3. Make remediation provable. Discipline wrongdoers, terminate tainted relationships, retrain management, and strengthen controls in ways you can document and explain.
  4. Assess aggravating factors early and honestly. The Part I versus Part II distinction may turn on pervasiveness, seriousness, harm, and recidivism. Do not assume a declination path without a hard-eyed assessment of the facts.
  5. Train leadership that declinations are earned, not granted. Balt is a roadmap, not a safe harbor. The organizations that benefit will be the ones prepared to act with speed, rigor, and credibility.

What Balt means for the compliance profession

The Balt Declination is a policy statement in the form of a case. The DOJ is telling companies: we will reward timely self-disclosure, meaningful cooperation, and real remediation. But we will also pursue individuals. That combination is not new in spirit, but it is now being presented with renewed clarity under the new CEP. For corporate compliance officers, the message is not to wait for an issue and hope for good instincts in the moment. The message is to prepare now.

You need escalation protocols that move fast. You need investigation readiness. You need decision trees for voluntary disclosure. You need board education on what DOJ is rewarding and why. And you need remediation mechanisms that produce evidence, not adjectives.

Balt did not receive a Declination because the misconduct was trivial. It received a Declination because, once the misconduct came to light, the company appears to have done the things the DOJ has been asking companies to do for years. That is the real lesson.

In 2026, compliance officers should read the Balt matter not as an outlier, but as a stress test. If your company found a credible FCPA issue tomorrow, could you move quickly enough, investigate thoroughly enough, cooperate meaningfully enough, and remediate credibly enough to make a Balt-style pitch to DOJ?

That is the question. And the answer should shape your compliance program today.

Categories
FCPA Compliance Report

FCPA Compliance Report: SDNY’s New Policy on Declinations

In this episode, Tom Fox welcomes back Hughes Hubbard partner Mike DeBernardis to discuss the Southern District of New York’s new corporate enforcement voluntary self-disclosure program for financial crimes and why SDNY leadership, including Jay Clayton, likely issued it: to encourage self-disclosure that saves enforcement resources and supports DOJ’s focus on individual accountability.

They compare the policy to the (former) DOJ’s Corporate Enforcement Policy, highlighting notable distinctions such as SDNY’s narrower scope (financial/market integrity offenses) and a revised approach to aggravating factors that excludes common CEP considerations like seriousness, pervasiveness, and senior management involvement, while carving out categories including foreign bribery and sanctions evasion, potentially reducing forum shopping. They also examine a “conditional declination” within two to three weeks, its implications for investigation speed and timeliness, and added pressure from whistleblower programs and compressed internal triage timelines.

Key highlights:

  • Why SDNY Issued It
  • SDNY Significance
  • Aggravating Factors Shift
  • Does It Move Needle
  • Conditional Declination Speed
  • Whistleblowers and Pressure

Resources:

 Hughes Hubbard and Reed

Mike DeBernardis on LinkedIn

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

For more information on the use of AI in Compliance programs, my new book, Upping Your Game, is available. You can purchase a copy of the book on Amazon.com

Categories
Daily Compliance News

Daily Compliance News: March 11, 2026, The Takes a Bite Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day, we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Top stories include:

  • What did the FCPA pause do? (Just Security)
  • JFK’s grandson blasts Trump over corruption. (Yahoo!News)
  • Corruption takes bite out of Philippine economy. (SCMP)
  • Huge NATO corruption scandal. (FTM)
Categories
Compliance Into the Weeds

Compliance into the Weeds: Carrots and Sticks in Washington: Antitrust Whistleblowers and an FCPA SOL Extension

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly look at two recent developments sending a common message to compliance teams.

First, DOJ antitrust official Daniel Glad warns that a new Antitrust Whistleblower Awards program and increased pursuit of prison time for individuals compress companies’ timelines to investigate and self-disclose, because insiders may report first and cost those firms potential leniency. Second, Senate Democrats, led by Elizabeth Warren, propose the FCPA Reinforcement Act to extend the FCPA statute of limitations from five to 10 years, creating an eight-year window, with the aim of preserving future enforcement capacity for misconduct occurring now. They connect these “sticks” with “carrots,” such as fast declinations for self-disclosure, emphasizing the need for robust compliance programs, a strong reporting culture, prompt investigations, and clear decisions on disclosure, regardless of who controls Washington.

Key highlights:

  • Two Washington Signals
  • Antitrust Whistleblower Push
  • FCPA Reinforcement Act
  • Carrots, Sticks, and Culture
  • Why Internal Reporting Matters
  • Self Disclosure Through Line

Resources:

Matt in Radical Compliance here and here

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Categories
Compliance Into the Weeds

Compliance into the Weeds: SDNY’s New Declination Policy: Crime Categories, Cooperation, and Compliance Implications

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it more fully. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly look at the recently announced new Southern District of New York standard for Declinations.

They look at SDNY U.S. Attorney Jay Clayton’s newly released self-disclosure/cooperation/declination policy and its implications for corporate compliance. While the core elements, prompt voluntary disclosure, cooperation, remediation, and restitution, mirror existing DOJ expectations, they highlight a significant change: SDNY now treats “aggravated circumstances” as certain categories of crimes that are categorically ineligible for declinations, including foreign corruption/FCPA, sanctions evasion, terrorism, sex trafficking with minors, smuggling, drug cartels, and forced labor, rather than focusing on offense traits such as senior management involvement or recidivism. They note potential inconsistencies with DOJ’s corporate enforcement approach, uncertainty about disclosure timing despite references to promptness and pre-investigation disclosure, broad discretion in enforcement, and the risk of forum shopping.

Key highlights:

  • Why SDNY Declinations Matter
  • Clayton Policy Key Changes
  • Aggravated Circumstances Redefined
  • FCPA Carve Out Confusion
  • Timing and Disclosure Pressure
  • Cooperation Restitution Disgorgement

Resources:

Matt in Radical Compliance

Tom in the FCPA Compliance and Ethics Blog

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred a Davey, a Communicator Award, and a W3 Award, all for podcast excellence.

Categories
Blog

SDNY Just Raised the Stakes on Self-Disclosure: What Compliance Leaders Must Do in the First 14 Days

For years, compliance leaders have worked under a simple reality: if the government learns about a problem from someone else first, you have already lost leverage. The Southern District of New York (SDNY) just sharpened that reality into a clear, public framework. Its Corporate Enforcement and Voluntary Self-Disclosure Program for Financial Crimes, effective February 24, 2026, is not subtle. It is designed to force an earlier decision and reward companies that make it; this means making it fast, transparent, and with meaningful remediation and restitution.

This is not just a fraud prevention or reporting program. It reaches conduct that can show up in any company: accounting games, deceptive disclosures, market-facing misconduct, and the broader universe of financial crime risks that sit adjacent to bribery-and-corruption controls. If you are running a compliance program, you should read this initiative as a warning: even when the underlying misconduct is not charged as “bribery,” the financial-crimes hook is often where prosecutors live. You may think you are managing “corruption risk.” SDNY is telling you it is also “market integrity” and “victim harm” risk.

And SDNY is pairing that message with something rare in enforcement policy: speed. SDNY says qualifying companies “can expect to receive a conditional declination letter within two to three weeks of self-reporting”. That is a flashing sign for CCOs: the window for decision-making just got smaller.

The SDNY is pushing fiduciary duty and stewardship.

Business executives usually talk about self-disclosure as a tactical choice. Compliance professionals have long known better, and now the SDNY frames it as something deeper: governance and duty. The program states that corporate leaders are “fiduciaries” with a “fundamental duty” to ensure integrity and transparency, and it positions voluntary self-disclosure as a core act of good corporate citizenship and stewardship. It will be interesting to see whether this “fundamental duty” to ensure integrity and transparency, and the corporate leaders as ‘fiduciaries’, bring a new level of Caremark scrutiny to Delaware.

That language matters. It is not only prosecutors describing a pathway to leniency. It is prosecutors telling boards and executives what they believe ethical leadership requires when the company discovers misconduct that harms markets, counterparties, customers, or investors. In other words, SDNY is trying to turn self-disclosure into a leadership test.

The Carrot is Real and Designed to Change Behavior

SDNY’s incentives are intentionally strong. If a company meets the program requirements, including timely voluntary self-disclosure, full cooperation, and timely remediation, the SDNY says it will issue a declination and will not prosecute the company. It also states that there will be no criminal fine and that, if the company pays appropriate restitution to victims, SDNY will not require forfeiture. Even more significant for compliance leaders is the following: SDNY says it “generally will not require” an independent compliance monitor for a qualifying company.

Those are meaningful benefits. They are the kind of benefits that can change what a board is willing to authorize in the first two weeks of a crisis. But the benefits only matter if you can move fast enough, gather credible facts, and maintain control of the narrative.

The First 14 Days: what compliance leaders should do now, not later

If SDNY is telling you it can issue a conditional declination letter in “two to three weeks”, then your internal process cannot take three weeks to decide whether you even have a problem. The ethical governance move is to treat the first 14 days as a disciplined sprint, one that protects truth, protects victims, and protects the integrity of your program.

Days 1–2: Triage without spinning

Your first obligation is to stop the bleeding and preserve facts. That means:

  • immediate escalation into a controlled response team (Compliance, Legal, Finance, Internal Audit, IT/security, and, if needed, HR),
  • an evidence preservation hold that includes chat platforms, mobile devices, third-party messaging, deal rooms, and personal email, where permitted, and
  • a decision to ring-fence relevant individuals, accounts, and transactions so you do not create new harm.

Ethically, this is where senior leadership proves it wants the truth, not just a version of it.

Days 3–5: Board notice and decision rights

If you are waiting for “certainty” before you brief the board or a board committee, you are already behind the SDNY clock. The goal is not to accuse. The goal is to establish governance: decision rights, cadence, and oversight. SDNY’s fiduciary framing means this cannot be treated as a management-only event. The board must be positioned to make an informed decision on disclosure, remediation, and restitution as facts develop.

Days 6–10: Outside counsel, scoped investigation, and credibility building

This is when you decide whether to engage outside counsel and forensic support to ensure independence and speed. For SDNY purposes, credibility is currency. The company needs to show it can:

  • Identify the misconduct,
  • identify who was involved,
  • quantify harm, including victims and losses,
  • explain control failures, and
  • demonstrate remediation beyond “we are reviewing policies.”

Remember: SDNY’s program is built around concrete action, self-reporting, cooperation, remediation, and restitution. If your internal processes create delays and ambiguity, you are squandering the very benefits SDNY offers.

Days 11–14: Regulator strategy and the self-disclosure decision

This is the moment of ethical leadership. You will not know everything. You will know enough to determine whether misconduct occurred and whether it falls into a category SDNY will view as market-harming or integrity-compromising. SDNY is offering a structured benefit for early self-reporting, but it is also signaling that waiting for a subpoena is not a strategy.

Five Lessons for the Compliance Professional

Lesson 1: SDNY is reframing self-disclosure as a fiduciary duty rather than optional crisis PR.

The program’s emphasis on leaders as “fiduciaries” with a “fundamental duty” of integrity and transparency is a direct ethical challenge to boards and executives. If your organization treats disclosure solely as a legal risk calculation, SDNY is telling you that you have already missed the governance point.

Lesson 2: Speed is now a moral and operational requirement.

The “two to three weeks” commitment to a conditional declination letter is SDNY saying: “Do not slow-walk the truth.” In compliance terms, timeliness is not merely a matter of efficiency. It is ethical stewardship. Delay increases harm, increases victim loss, and increases the chance that someone else tells your story first.

Lesson 3: Restitution is not a side issue; it is a core ethical outcome.

SDNY’s program explicitly states that paying “appropriate restitution to victims” is central, and it links that to the decision not to pursue forfeiture. Compliance leaders should read this as a directional signal: the government is measuring corporate ethics by whether the company makes harmed parties whole, not merely by whether it updates a policy.

Lesson 4: The benefits are real, but they are earned through cooperation and remediation that changes behavior.

No prosecution, no fine, and generally no monitor are extraordinary incentives. But SDNY is also telling you what it values: companies that step forward, cooperate fully, remediate quickly, and do not play games with facts. Ethically, this is “clean hands” enforcement: if you want mercy, show you deserve it.

Lesson 5: Some conduct is simply disqualifying, and compliance must stop pretending every risk is manageable with process.

SDNY calls out aggravating circumstances that can make a company ineligible for a declination under the program. The list includes conduct tied to terrorism, sanctions evasion, foreign corruption, trafficking, cartels, forced labor, violence, and related financing or laundering. That matters because it draws an ethical boundary: there are categories of wrongdoing so corrosive that the “cooperate and remediate” story is not enough. For CCOs, the lesson is to build escalation protocols that treat these risks as existential and non-negotiable.

A Blunt Wake-up Call: The Cost of Not Self-Reporting is Going Up

SDNY is trying to end the era of corporate hesitation. The program signals that a company’s decision not to self-report will weigh heavily against it when prosecutors later assess resolutions. This is the part compliance leaders must say out loud internally: the old playbook of “let us wait and see” is increasingly incompatible with how prosecutors say they will exercise discretion. If your organization has not pre-built a rapid disclosure decision tree, you are asking to miss the window SDNY is dangling in front of you. You will not get the benefit of a program you were not prepared to use.

Conclusion: Compliance and Ethics that Move at Prosecutorial Speed

The SDNY initiative is not merely a new memo. It is a redefinition of what “responsible corporate conduct” looks like in real time. It asks boards and senior executives to behave like fiduciaries: to choose integrity and transparency early, to protect victims through restitution, and to treat cooperation and remediation as proof that the company is worthy of trust. For the compliance professional, the message is simple and uncomfortable: your program will not be judged by the elegance of your policies. It will be judged by whether your leadership can tell the truth quickly, act with stewardship, and make hard decisions when the facts are incomplete but the duty is clear.

Categories
From the Editor's Desk

From The Editor’s Desk: Episode 37: Season 2 – Reflections from February and Insights into March for Compliance Week

In this episode of ‘From the Editor’s Desk,’ Tom Fox visits with Aaron Nicodemus to discuss highlights from Compliance Week in January and February and take a look at what is coming down the pike in March, including the upcoming “Inside the Mind of the CCO” survey. They also begin to preview the 2026 National Conference in May.

Key highlights:

  • February Story Roundup
  • March AI Coverage Plans
  • CCO Survey Early Findings
  • Long Form Investigations Ahead
  • AI Governance Reality Check
  • TPRM Conference Teaser

Resources:

Aaron Nicodemus on LinkedIn

Compliance Week

Categories
Blog

The Hobson FCPA Trial: Five Operational Lessons for the Compliance Professional

If you want to see how an FCPA case gets built in real time, you could do a lot worse than studying what came out at trial in the Hobson matter. The evidence presented to the jury did not turn on a single suspicious invoice or an isolated payment. It was the aggregation of ordinary commercial mechanics (commissions, pricing pressure, contract awards) with extraordinary risk indicators (coded language, commission splits tied to named initials, informal transfer channels, and documentation gymnastics). That is exactly why the Hobson trial matters to in-house compliance professionals: it shows how day-to-day operational decisions can be reframed as corrupt intent when the surrounding facts align.

Today, we consider five lessons learned for the compliance professional, each grounded in trial evidence and framed as operational indicators you can use in your program tomorrow morning.

Lesson 1: High commissions are not a “commercial issue.” They are an anti-corruption control failure waiting to happen.

One of the most important themes in the testimony was the economics of commissions. One witness described the agent’s commission levels as unusually high in the industry, citing a long-term arrangement in the range of $7 to $7.50 per metric ton, in contrast to what he described as a far lower norm for international sales agents. That is not a mere “sales comp” debate. In a high-risk market, the commission structure becomes the channel through which influence can be purchased.

The operational problem is not simply that the commission is high. It is that the commission becomes hard to explain as legitimate, and easy to justify internally as “what it takes” to win. In the testimony, jurors heard about internal communications implying there were “a few” people the agent had to “take care of,” and the witness described being shocked at how openly the subject was discussed.

Operational indicators to take away

  • A third-party commission materially above benchmark, especially when defended as “market practice” without evidence.
  • Business rationales that drift from services rendered into “this is what it takes to get the deal.”
  • Commission tied to award timing, acceptance, or “sorting things out” with a committee-like body at the counterparty.

Program moves

  • Require commission benchmarking and documented justification for outliers, with Compliance signoff for deviations.
  • Treat commission letters and renewals as high-risk events: refresh due diligence, re-paper services scope, and re-evaluate the payment model.
  • Add a “commission-to-service” test: what services were delivered, how were they evidenced, and how do they map to the payment amount.

Lesson 2: The third party is not the risk. The relationship ownership model is the risk.

The defense narrative emphasized distance: the company hired the agent, the company paid the agent, and once the agent was paid, the payer did not control what happened next. Compliance people have heard this argument in conference rooms for twenty years, usually dressed up as “commercial reality.”

But what the trial evidence highlights is a different issue: relationship ownership. The cooperating witness testified that the defendant took the lead on the relationship because of his contact with the agent. That is a control issue. When a single commercial leader “owns” the third party informally, the organization often loses the ability to enforce discipline: who approves what, who monitors what, and who escalates what.

Operational indicators to take away

  • A relationship that is “owned” by one person, with limited transparency and limited cross-functional involvement.
  • Commission approvals and payment pressure are driven by a single commercial voice rather than by a documented governance process.
  • Escalations framed as “help me pay him so we do not lose the business,” rather than “help me validate services and risks.”

Program moves

  • Assign “relationship ownership” formally: business owner, finance owner, and compliance owner, each with defined decision rights.
  • Require periodic third-party business reviews that are not sales calls: services delivered, invoices, payment routes, red flags, and counterparty risk.
  • Put “single-threaded third-party management” on your audit plan. It is a quiet failure mode.

Lesson 3: Communications are evidence, and code words are a control signal you can detect.

The most operationally actionable evidence from the trial is the communications that Hobson used with Ahmed. Jurors heard about messages that mixed coal pricing negotiations with discussions of who would receive parts of a commission, including initials corresponding to individuals connected to the state-affiliated buyer. This is the classic compliance trap: people treat messaging as informal chatter, while prosecutors and juries treat it as evidence of intent.

Even more pointed, testimony described the use of coded language for money, including references to “Mr. Yen,” and urgency about when the money would be available and in what currency. Whether a company can see those messages at the time is a separate question. The compliance lesson is that coded language almost always sits atop a known risk: someone believes the underlying conduct would not survive daylight.

Operational indicators to take away

  • Pricing plus commission allocation discussed in the same thread, especially where there is talk of who “needs to be paid” to keep contracts.
  • Code words for money, urgency cues, and currency references.
  • Language that treats counterparty actors as extracting “shares” tied to deal economics.

Program moves

  • Train sales and trading teams on “what will read badly to a jury” without being melodramatic. Show examples of risky phrasing and rewrite them.
  • Build a targeted communications surveillance protocol for the highest-risk channels and roles, consistent with local law and internal policy.
  • Add “coded language and euphemisms” to your investigation playbook as an escalation trigger, not an afterthought.

Lesson 4: Money movement patterns are where the story crystallizes.

The government’s evidence leaned heavily on how money moved: informal transfer mechanisms, travel touchpoints, offshore entities, and a money trail that could be explained individually but looked incriminating when sequenced.

For in-house compliance, this is the heart of operational control. The trial coverage covered Western Union transfers, travel to Dubai, cash declarations, and an entity structure involving a Dubai company and a US affiliate sharing the same address. It also described an “invoice construction” episode: drafting an invoice for a substantial payment, struggling to reproduce an official seal, then sending a wire and having the funds transferred.

You do not need to be a prosecutor to see the compliance problem: if you cannot explain who is being paid, why they are being paid, what they did, and where the money went, you do not have controls in place. You have hope.

Operational indicators to take away

  • Use of informal transfer services, cash, or complex routing in connection with third-party compensation.
  • Offshore entities are introduced late in the process, especially where documentation is improvised.
  • Payment routes that create distance between the payer, the payee, and the ultimate beneficiary.

Program moves

  • Tighten payment controls for third parties: no payment without a validated contract scope, documented services evidence, and verified bank account ownership.
  • Require screening for beneficial ownership and “connected parties” among third-party entities, including affiliates and payment intermediaries.
  • Implement a red-flag workflow for travel-linked payments, cash, and informal transfers: automatic review by Compliance and Finance.

Lesson 5: Investigation readiness is not a crisis skill. It is a design choice.

Finally, the verdict and the path to it underscore a point compliance professionals sometimes miss: your program is being built for a future fact-finder. In this case, the prosecution presented an overall theory built from messages, financial records, and a cooperating witness; the jury returned guilty findings across FCPA-related counts and related conspiracy and laundering charges.

The operational compliance lesson is not about litigation tactics. It is about what your systems retain and what your systems can explain. If your third-party file includes evidence of benchmarking, due diligence, contract scope, and monitoring, you have a fighting chance of showing legitimate intent. If your file is thin and the communications are ugly, the story will be told for you, in the immortal words of the Compliance Evangelist-Document Document Document.

Operational indicators to take away

  • Repeated internal discomfort expressed without escalation or remediation; IE., the “we know this is strange, but we need the deal” pattern.
  • Documents created to facilitate payment rather than to evidence legitimate services.
  • Controls that rely on “we did not know” rather than “we can show what we did and why.”

Program moves

  • Update your investigations protocol to integrate commercial data: pricing, commissions, and contract award timing, not just payment logs.
  • Build a rapid response kit for third-party risk: document hold, device preservation process, and review checklist for messaging platforms.
  • Treat high-risk third-party relationships as living files: quarterly updates, not annual check-the-box refreshes.

The Hobson trial is a reminder that compliance does not fail in the abstract. It fails in the seams: a commission justified without evidence, a relationship owned by one person, a payment routed because “it is easier,” and a set of messages that people assumed would never be read out loud in a courtroom. If you want your program to prevent the next case, focus on those seams, because prosecutors, juries, and regulators will, too.

Resources:

Articles by Matthew Santoni in Law360

Coal Exec Knew Egyptian Broker Paid Bribes, Jury Told

Coal Exec’s Co-Worker Says Emails Hinted At Egypt Bribes

Egypt’s ‘Social Law’ Doesn’t Endorse Bribery, Jury Told

Coal Exec Used ‘Mr. Yen’ To Talk Kickbacks, FBI Testifies

Coal Exec ‘Had No Ability’ To OK Paying Bribes, Jury Told

Jury Finds Ex-Coal Exec Guilty Of Authorizing Bribes

 

Categories
Red Flags Rising

Red Flags Rising: S01 E37: Carole Basri on Subsidizing World Peace: The U.S. Experiment, and the Dynamic Relationship between National Security & Corporate Compliance

Back in January 2024, Mike and Brent had the good fortune to meet Carole Basri at an event at NYU Law School. On this episode of Red Flags Rising, they welcome her as a guest to talk about her specialties: national security, geopolitics, and corporate compliance. They specifically discuss Carole’s extensive professional background (00:59), a new treatise on National Security Law that Carole, Mike, and Brent are writing for the Practising Law Institute (PLI) (04:00), an upcoming event co-hosted by the New York State Bar Association’s International Section, Corporate Compliance Committee and Morgan Lewis, to which the new Assistant Secretary for Export Enforcement David Peters is an invited keynote speaker (08:18), why public enforcement officials remarks are relevant under U.S. export controls and other probability-based (i.e., “red flags”-driven) national security laws (09:26), how the U.S. Foreign Corrupt Practices Act (FCPA) was not only an example of that but also was really a child of an era where economic interdependency required a level of transparency and clean commerce to continue (12:00), and the relationship between Bretton Woods, Belt and Road, and Mike’s favorite book, Tales of an Economic Hitman, and what could be viewed with hindsight as effectively a U.S. policy decision to trade its own economic security for decades of (relative) world peace, increased global productivity, and increased living standards (16:52). Brent then closes out the discussion with the latest installment of his “Managing Up” segment (21:57), after which Mike makes some (further) book recommendations based on the discussion for those interested in further exploring some of the idea and concepts covered during the discussion:

More about Carole

Contact Brent: brent@redflagsrising.com

Contact Mike: michael.huneke@morganlewis.com

Interested in learning more about the March 10, 2026, event? Contact Mike & Brent at the email addresses above.