The Answers Your 
Regulator Expects You
to Already Have.

The FCPA's accounting provisions — 15 U.S.C. §§ 78m(b)(2)(A) and (B) — require issuers to maintain books and records that accurately and fairly reflect transactions, and to devise and maintain a system of internal accounting controls. Unlike the anti-bribery provisions, the accounting provisions apply to all issuers regardless of whether a foreign official is involved. Subsidiaries and joint ventures where the issuer holds 50% or more ownership are covered. The SEC has brought standalone books-and-records actions without accompanying bribery charges.

A red flag is a fact or circumstance that, considered in context, warrants further scrutiny. FinCEN guidance across multiple sectors identifies categories of red flags (structuring patterns, unusual geographic connections, inconsistent customer behavior) but is clear that a red flag alone does not automatically trigger a SAR filing obligation. The obligation arises when the institution knows, suspects, or has reason to suspect that the transaction meets the statutory criteria after conducting a reasonable inquiry. Documenting your inquiry — and the conclusion — is essential whether or not a SAR is filed.

Article 4(12) defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. The notification obligation to the supervisory authority applies unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons." The 72-hour window begins from when the controller becomes "aware" — a standard the EDPB has interpreted as when the controller has a reasonable degree of certainty. Notification to data subjects is required only when the breach is "likely to result in a high risk."

OFAC's Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A) treat voluntary self-disclosure as a mitigating factor that can reduce the base civil monetary penalty by up to 50%. A VSD must be made before OFAC initiates an investigation, must be complete and accurate, and must be accompanied by a thorough internal investigation. The mitigating benefit is not guaranteed — it is weighed against aggravating factors including willfulness, management involvement, and harm to sanctions policy objectives. OFAC has resolved cases with no penalty where VSD was combined with strong remediation.

Double materiality under CSRD requires companies to assess both financial materiality (how sustainability matters affect the company's financial performance) and impact materiality (how the company's activities affect people and the environment). This is a fundamental departure from the SEC's investor-focused, single materiality standard, which asks only whether information would be important to a reasonable investor. Under CSRD, a company must report on its environmental impacts even if those impacts have no material effect on its financial condition. The European Sustainability Reporting Standards (ESRS) provide detailed guidance on how to conduct the double materiality assessment.