Categories
FCPA Compliance Report

FCPA Compliance Report: Judicial Discretion, Sentencing Advocacy, and a Proactive Compliance Model: Joseph De Gregorio – Part 2

In this episode, Tom Fox welcomes former Wall Street trader Joseph De Gregorio, who was federally convicted and now applies a “compliance rebuild” methodology to demonstrate genuine remediation under legal scrutiny. This is Part 2 of a two-part podcast series.

In Part 2, we cover how federal judges exercise broad discretion despite sentencing guidelines and often form views before the court based on the pre-sentence report and sentencing memorandum, with probation officers’ impressions shaped by a detailed defendant letter and authentic allocution; judges emphasize post-offense conduct and may discount lawyer advocacy. Joseph then summarizes patterns from 400+ white-collar cases, arguing that structural failures precede cultural and operational failures, and introducing the “access to scrutiny ratio” as the most predictive risk indicator. He lists five warning signals: unscrutinized top performers, known but unmapped monitoring gaps, unmanaged performance pressure, quietly resolved senior incidents, and compensation rewarding results without method (noting DOJ’s September 2024 ECCP update). He outlines a proactive Compliance Rebuild approach using human failure audits, reverse access audits, directional speak-up analysis, and DOJ-aligned prosecution simulations.

Key highlights:

  • Pre-Sentence Reports Matter
  • Patterns Across 400 Cases
  • Five Compliance Warning Signals
  • Prosecution Simulation Stress Test
  • DOJ Evaluation Questions and Red Flags

Resources:

Joseph De Gregorio – Founder, JN Advisor™ Maximum Sentence Reduction – Minimum Time Served

📋 Initial Consultation: https://forms.gle/2fLczk7bbwM7KSaP6

Bloomberg Law Contributor: “How to Get a Judge to Reduce Your Client’s White-Collar Sentence” – Bloomberg Law 

Bloomberg Tax Contributor: Tax Fraud Sentencing Has a Gap Defense Attorneys Are Missing

Featured Expert: American Bar Association

Featured Sentencing Mitigation Expert: Law360

Featured Expert on Us Weekly with 5x Emmy Award Winning Journalist Kristin Thorne for her “Uncovered” Series Click Link For Full Video

https://www.usmagazine.com/crime-news/news/federal-sentencing-strategist-reveals-why-some-real-housewives-stars-commit-fraud/

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Interested in the intersection of Sherlock Holmes and modern compliance? Check out my latest book, The Game is Afoot in Compliance.

Categories
FCPA Compliance Report

FCPA Compliance Report: From DOJ’s 7 Compliance Pillars to Sentencing Mitigation: Joseph De Gregorio’s Compliance Rebuild Framework – Part 1

In this episode, Tom Fox welcomes former Wall Street trader Joseph De Gregorio, who was federally convicted and now applies a “compliance rebuild” methodology to demonstrate genuine remediation under legal scrutiny. This is Part 1 of a two-part podcast series.

Using the Matthew Bowyer illegal sports betting case, Joseph explains the federal pre-sentence interview and pre-sentence report (PSR) process, emphasizing that the probation officer’s credibility assessment and PSR narrative heavily influence sentencing and downstream treatment across the federal system. He describes submitting a 3,500-word personal narrative before the PSR interview, which was attached in full and cited by the judge as mitigation, resulting in a one-year-and-a-day sentence rather than the government’s four-year request. Joseph maps DOJ’s seven corporate compliance program dimensions to individuals via a personal compliance manual, independent accountability structure, credentialed education, verifiable monitoring, documented transparency, voluntary discipline actions, and a post-sentencing continuous improvement plan centered on victims-first accountability.

Key highlights:

  • Joseph’s Wall Street Past
  • The Boyer Betting Case
  • What is a PSR, and why does it drive sentencing
  • Preparing for the Interview
  • From Corporations to Individuals
  • Seven Pillars Framework

Resources:

Joseph De Gregorio – Founder, JN Advisor™ Maximum Sentence Reduction – Minimum Time Served

📋 Initial Consultation: https://forms.gle/2fLczk7bbwM7KSaP6

Bloomberg Law Contributor: “How to Get a Judge to Reduce Your Client’s White-Collar Sentence” – Bloomberg Law 

Bloomberg Tax Contributor: Tax Fraud Sentencing Has a Gap Defense Attorneys Are Missing

Featured Expert: American Bar Association

Featured Sentencing Mitigation Expert: Law360

Featured Expert on Us Weekly with 5x Emmy Award Winning Journalist Kristin Thorne for her “Uncovered” Series Click Link For Full Video

https://www.usmagazine.com/crime-news/news/federal-sentencing-strategist-reveals-why-some-real-housewives-stars-commit-fraud/

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Interested in the intersection of Sherlock Holmes and modern compliance? Check out my latest book, The Game is Afoot in Compliance.

Categories
GSK in China: 13 Years Later

GSK In China: 13 Years Later – Where Was the Board? Director Oversight and Doing Business in China

Thirteen years after the GSK China scandal exploded onto the global stage, its lessons remain as urgent as ever for compliance professionals and business leaders. In this podcast series, we revisit the case not simply as corporate history, but as a living cautionary tale about culture, incentives, third parties, investigations, and governance. Each episode explores what went wrong, why it went wrong, and how those failures still echo in today’s compliance and ethics landscape. Join me as we unpack the scandal and draw practical lessons for building stronger, more resilient organizations. This episode examines why major bribery scandals occur “under the board’s nose,” using GSK as a launching point to explain directors’ legal and practical compliance responsibilities.

It traces oversight duties under Delaware law, highlighting Caremark’s good-faith duty to ensure information and reporting systems, Stone v. Ritter’s standard for liability for sustained or systematic oversight failure, and the business judgment rule. It contrasts “check-the-box” programs with risk-based oversight via the Piat case, where formal compliance masked illegal conduct embedded in business plans. The discussion ties board expectations to FCPA guidance hallmarks, emphasizing tone at the top, empowered compliance functions with direct board access, DOJ/SEC scrutiny, and SEC Reg. S-K 407 risk-oversight disclosures, and potential disgorgement. It then focuses on China as a high-risk environment, third-party intermediary exposure, and M&A “deal-breaker” dilemmas requiring rigorous pre- and post-acquisition diligence, concluding with the paradox that boards may be incentivized toward plausible deniability. Our hosts are Timothy and Fiona.

Key highlights:

  • Compliance Starts at the Top
  • Caremark Duty Explained
  • FCPA Hallmarks for Boards
  • Passive Board Era Ends
  • Plausible Deniability Paradox

Resources:

GSK in China: A Game Changer for Compliance on Amazon.com

GSK in China: Anti-Bribery Enforcement Goes Global on Amazon.com

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Ed. Note: Notebook LM created the voices of the hosts, Timothy and Fiona, based on text written by Tom Fox

Categories
Blog

Returning to Venezuela: Part 5 – AML Risk and the Final Compliance Test

In this five-part series, I have walked through the core compliance risks US energy companies will face as they consider a return to Venezuela. We began with bribery and corruption and the long shadow of PdVSA (Parts 1 & 2). We moved through export controls (Part 3), security risks (Part 4), and the broader operational and strategic challenges of working in one of the most complex risk environments in the world. But this final post is different. Money laundering risk is not simply another risk category. It is the connective tissue that binds all the others together.

If bribery is how improper value enters the system, money laundering is how it is disguised, moved, and legitimized. If export control violations create pressure to reroute goods or payments, money laundering techniques make that rerouting possible. If security risks require local intermediaries, cash payments, or opaque vendors, those same decisions create AML exposure. For the compliance professional, money laundering risk in Venezuela is the capstone test of whether the program actually works.

The Regulatory Frame: FinCEN, ECCP, and Correspondent Banking Reality

Any AML discussion must start with expectations. US regulators have been explicit. The AML program pillars articulated by the Financial Crimes Enforcement Network (FinCEN) are not optional abstractions. They are operational requirements: risk-based controls, internal policies, independent testing, training, and designated responsibility.

Overlay that with the Department of Justice Evaluation of Corporate Compliance Programs (ECCP), which asks whether controls are designed, implemented, tested, and actually effective. Then add the reality of correspondent banking risk. Even if a US energy company does not directly move funds through US banks, its banking partners will apply US standards. Banks do not absorb Venezuela’s risk on behalf of their customers. They de-risk. Compliance failures upstream become frozen accounts downstream. This is why AML must be treated as an enterprise risk, not a compliance side project.

Operating Under Licenses Does Not Reduce AML Risk

This blog assumes that operations occur under general licenses, specific licenses, or wind-down authorizations issued by the Office of Foreign Assets Control. That matters for sanctions analysis, but it does not reduce AML exposure. Licenses permit activity. They do not cleanse counterparties, validate payment flows, or excuse weak controls. In fact, licensed activity often attracts heightened scrutiny because regulators know companies will push forward aggressively once permission is granted.

In Venezuela, licensed operations still involve high-risk state actors, politically exposed persons, weak financial institutions, and a long history of financial opacity. From an AML perspective, licenses are a starting gun, not a shield.

PdVSA as a Multi-Vector AML Risk

As we have previously noted, PdVSA must be treated not as a single counterparty risk but as multiple overlapping AML risk vectors. First, there is trade-based money laundering. Oil shipments are uniquely vulnerable to pricing manipulation, volume misstatements, phantom cargoes, and circular trading. In Venezuela, these risks are amplified by distressed infrastructure, a history of sanctions, and reliance on intermediaries.

Second, there is an intermediary risk. Shipping companies, charterers, port agents, and customs facilitators often operate through layered ownership structures. The farther one moves from the wellhead, the less transparency exists. Third, there is a risk to the payment structure. Delayed payments, in-kind arrangements, and third-country settlement accounts create fertile ground for laundering illicit proceeds. When oil becomes currency, AML controls must follow the barrel, not the invoice.

Venezuelan, Crypto, and Third-Country Banking Risk

Venezuelan banks operate under severe constraints. Many lack robust AML systems, and even well-intentioned institutions face talent shortages and technology gaps. As a result, payments often move through third-country banks. These arrangements create several red flags: unusual routing, non-USD transactions, inconsistent settlement timelines, and opaque beneficiary information. Each red flag increases the likelihood of SAR filings and banking friction. Compliance professionals must understand that correspondent banks apply their own risk lens. If they are uncomfortable, they will exit. That operational disruption becomes a compliance failure.

Crypto and alternative payment mechanisms are not edge cases in Venezuela. They are practical responses to currency instability, banking limitations, and sanctions pressure. From an AML standpoint, crypto introduces wallet anonymity, cross-border velocity, and limited recourse once funds move. Any use of crypto, whether by the company or its third parties, must be explicitly prohibited or tightly controlled. Silence is not neutrality. Silence is exposure.

Third Parties: Where AML, Bribery, and Security Collide

Local agents, logistics providers, customs brokers, and security vendors represent the highest combined risk in Venezuela. These third parties often operate in cash-intensive environments, maintain close ties to government actors, and perform functions critical to business continuity. Family-owned and politically connected vendors demand enhanced due diligence. That means beneficial ownership verification, source-of-funds analysis, ongoing monitoring, and contractual audit rights. Initial diligence alone is insufficient. Relationships evolve, and risk escalates quickly.

This is where the bribery blog, the security blog, and this AML blog converge. The same third party that creates bribery risk also creates money laundering risk. Controls must be integrated, not siloed.

The Operational Reality: This Is Manageable If You Manage It

Despite these risks, this is not a counsel of despair. US companies have operated in high-risk jurisdictions before. The key is realism. AML programs in Venezuela cannot rely on annual certifications, static risk assessments, or generic policies. They require transaction-level visibility, real-time escalation, and empowered compliance personnel. Friction with the business is inevitable and necessary.

Venezuela-Specific AML Operational Checklist

Below is a practical, compliance-focused checklist for operating in Venezuela:

Risk Assessment

  • Conduct a Venezuela-specific AML risk assessment tied to operations, not geography alone
  • Map payment flows end-to-end, including third-country routing
  • Identify trade-based money laundering scenarios tied to oil shipments

Policies and Controls

  • Prohibit unauthorized crypto usage explicitly
  • Require documented economic justification for all intermediaries
  • Establish clear escalation thresholds for delayed or rerouted payments

Third-Party Due Diligence

  • Perform enhanced due diligence on all local agents, logistics providers, customs brokers, and security vendors
  • Verify beneficial ownership and political exposure
  • Assess the source of funds and expected transaction behavior

Transaction Monitoring

  • Monitor oil pricing, volumes, and delivery discrepancies
  • Flag unusual settlement patterns or changes in banking instructions
  • Integrate AML alerts with sanctions and export control monitoring

Training and Culture

  • Provide targeted AML training for operations, finance, and procurement teams
  • Reinforce speak-up mechanisms tied to payment and logistics concerns

Testing and Auditing

  • Conduct targeted audits focused on high-risk transactions
  • Test controls against realistic laundering typologies
  • Document remediation and program enhancements

AML as the Series Capstone

This series has shown that returning to Venezuela is not a single compliance decision. It is a systems test. Money laundering risk sits at the center of that test because it exposes weaknesses everywhere else. If your AML program can function effectively in Venezuela, it can function anywhere. If it cannot, no license, policy, or assurance letter will save it. This is doable. But only if compliance is brought in early, appropriately resourced, and empowered to say yes, if.

Categories
Blog

Charlie X: Power Without Boundaries – A Compliance Nightmare

Today, we explore the explosive volatility of Charlie X—a story about unchecked power, emotional instability, and the dire consequences of failing to enforce rules and structure. Charlie Evans, a teenage orphan raised by aliens, is taken aboard the Enterprise, possessing extraordinary telekinetic abilities but lacking social training, emotional discipline, and accountability. That combination proves disastrous. We consider how Charlie’s descent into violence mirrors risks faced by compliance professionals when misconduct is ignored, misbehavior is tolerated, and power is given without oversight. In today’s corporate world, “Charlie X” is less about space and more about leadership responsibility, psychological safety, and early intervention.

Key Highlights and Star Trek Case Studies:

1. The Responsibilities of Power—Strength Without Structure

This is illustrated by Charlie turning crew members into nothingness when they anger him.

Charlie is gifted with tremendous abilities but lacks any ethical framework or boundaries. This is a vivid metaphor for what happens when individuals inside an organization gain influence or access without training or accountability. Think of an unmonitored executive with access to financial controls or an engineer with override access but no compliance training—a ticking time bomb.

2. Training and Supervision—It’s Not Optional, It’s Essential

This is illustrated by Kirk’s attempt to guide Charlie and his later regret at not recognizing the full scope of the risk.

Charlie’s guardianship was left to chance, with no proper onboarding and no safety protocols in place. Sound familiar? In corporate compliance, onboarding isn’t just about day one—it’s about culture shaping. Organizations must ensure that individuals with a higher risk potential receive both guidance and oversight from the outset.

3. Unpredictable Behavior and Ethical Culture—From Red Flag to Alarm Bell

This is illustrated by Charlie’s mood swings and escalating aggression, which are repeatedly ignored until it’s too late.

The crew notices early signs, such as jealousy and possessiveness, but tolerates them. This reflects the real-world danger of brushing off early signs of a toxic culture. A strong compliance function identifies behavioral red flags before they escalate into corporate crises.

4. Communication and Escalation Protocols—Say Something, Do Something

This is illustrated by Janice Rand’s discomfort and unease around Charlie, which she initially tries to manage on her own.

Rand’s growing fear underscores the difficulty of speaking up, especially when someone powerful appears to be protected. Her reluctance reminds us that a speak-up culture is not automatic. Companies must establish genuine channels for complaints, empower employees to utilize them, and respond promptly and transparently.

5. Crisis Management—Too Late is Still Too Late

This is illustrated by the crew’s loss of control over the Enterprise, forcing alien intervention to remove Charlie.

The crew fails to contain the situation internally. It takes external, godlike beings to restore order—a cautionary tale for compliance leaders. If a company waits until the crisis has gone public or regulatory bodies step in, internal credibility is lost. Crisis planning and early intervention are crucial in protecting the organization before outside authorities are required to intervene.

Final ComplianceLog Reflections

Charlie X reminds us that power without oversight is perilous, that emotional and psychological health must be part of our compliance focus, and that red flags must not be ignored simply because they come wrapped in charm or vulnerability. Compliance is not simply about policies, procedures, or even rules but rather readiness, responsiveness, and respect for the human element.

Resources:

Excruciatingly Detailed Plot Summary by Eric W. Weisstein

MissionLogPodcast.com

Memory Alpha

Categories
Data Driven Compliance

The Uses of Data Driven Compliance: Part 2 – Profiles of a Corrupt Payment

Welcome to Data Driven Compliance. In this podcast, we discuss how to use data to improve and enhance the effectiveness of your compliance program, creating greater business efficiency and leading to a higher return on investment for your compliance regime. Join host Tom Fox as he explores how data will drive your compliance program to the next level. This podcast is sponsored by Kona AI.

I recently had the opportunity to visit with Vince Walden, founder and CEO of KonaAI, for a podcast series on the uses of data driven compliance. Over these five podcasts, we will discuss generative AI and ChatGPT in compliance, the profiles of corrupt payments, making the business case for data-driven compliance, what to ask for and how to ask for it, and some success stories. In Part 2, we explore the profiles of corrupt payments.

Vince Walden is an expert in identifying high-risk payments and preventing corporate corruption. His belief in the ability of data analysis and collaboration to find patterns and warning signs shapes his viewpoint on these issues. He shares his experience from a research project where companies collaborated anonymously to analyze the profiles of improper payments, using risk-scoring transactions and applying anti-corruption tests to identify high-risk attributes. Vince emphasizes the importance of transparency and access to data to proactively investigate suspicious activities, serving as a guardrail to prevent potential corruption. Join Tom Fox and Vince Walden as they delve deeper into this topic on this Data Driven Compliance podcast episode.

Key Highlights:

  • Attributes of High-Risk Payments Analysis
  • Uncovering Suspicious Sales Spikes in Poland
  • Detecting Improper Payments with Data Analysis

Resources:

Connect with Vince Walden on LinkedIn

Check out Kona AI

Connect with Tom Fox on LinkedIn

Categories
Daily Compliance News

December 17, 2022 – The Lavish Life Style Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you four compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee and listen to the Daily Compliance News. All from the Compliance Podcast Network.

Stories we are following in today’s edition of Daily Compliance News:

  • When does a lavish lifestyle = Red Flags? (NYT)
  • Amazon agrees to business practice changes in the EU. (NYT)
  • DFS issues guidance for banks on crypto. (WSJ)
  • Crypto has made corruption worse. (The Guardian)
Categories
GalloCast

Gallocast – Episode 5

Welcome to the GalloCast. You have heard of the Manningcast in football. Now we have the GalloCast in compliance. The two top brothers in compliance, Nick and Gio Gallo, come together for a free-form exploration of compliance topics. It is a great insight on compliance brought to you by the co-CEOs of Ethico. Fun, witty, and insightful with a dash of the two brothers throughout. It’s like listening to the Brothers Gallo talk compliance at the dinner table. Hosted by Tom Fox, the Voice of Compliance.

Topics in this episode include:

  • FTX
  • Elizabeth Holmes was sentenced. End of an era in tech?
  • Compliance program incentives and clawbacks.
  • Assessing culture.
  • Monaco Memo

Resources

Nick Gallo on LinkedIn

Gio Gallo on LinkedIn

Ethico

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program for 3rd Parties-Evaluation of Due Diligence With Candice Tal

An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective.

For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so.

Three key takeaways:

  1. There is no set formula for clearing of red flags or the evaluation of due diligence.
  2. Know when to say enough has been done.
  3. You must “Document, Document, and Document” your evaluation of any red flags.
Categories
Innovation in Compliance

Gini Dietrich on Spotting Red Flags


 
This week’s guest on Innovation In Compliance is Gini Dietrich, CEO and founder of Spin Sucks. Gini is a writer, blogger, speaker and all-around expert in the PR space. She recently wrote a blog post entitled, How to Spot Red Flags in New Business Relationships, which is the focus of her discussion with Tom Fox in this week’s show.
 

 
Trust Your Instincts
Tom asks Gini what inspired the blog post. She responds that she actually wrote the blog post as a reminder to herself to always look for red flags and always listen to her gut. She says that when you’re contemplating a prospective business relationship, there are a few questions you should always ask yourself. Do you see red flags? Can you get past them because there are other advantages? Should you discontinue the conversation and save yourself time, angst, money and resources in the long run? In the PR space, the most common red flag is unrealistic expectations, Gini explains.
Why? Why? Why?
Gini points out the importance of writing down red flags. For one thing, it makes them more concrete; and for another thing, you can take your questions into your meetings to remind yourself to ask certain questions if red flags arise. You should be constantly evaluating your business relationships. Ask follow up questions. Gini advocates asking why at least three times. Tom comments that the compliance industry uses that exact technique; it’s called root cause analysis.
Learn to Say No
Tom asks, “Why is the ability to say no critical for business owners and compliance professionals?” Gini responds that in business relationships if you can’t find any red flags then it’s usually going to be a good relationship. The inverse is also true: if there are red flags then the relationship is usually going to be difficult. The other reason why being willing to say no is important is that in the PR business as in compliance, you’re selling your time and you can’t scale that. So it’s critical to say no to things that will take your time away from what you should be doing. Tom mentions that part of Gini’s process is to try to disqualify every prospect. She comments that looking for reasons to disqualify a prospect, and finding them, makes it easier to say no to them. She shares tips on what red flags might look like from the employee and client perspective.
Resources
SpinSucks.com
How to Spot Red Flags In New Business Relationships