A Distinctive Approach to Ethical Risk Management
Steptoe's Ethics and Compliance practice guides multinational corporations, financial institutions, and early growth-stage companies through complex and evolving regulatory landscapes. Our approach blends legal acumen, technological innovation, and deep familiarity with the expectations of government enforcement agencies, government regulators, self-regulating institutions (SROs) and other quasi-governmental regulators, and other institutions. Our team includes numerous practitioners with government experience—including former DOJ, SEC, FEC, BIS, PSI, national security, and trade officials—as well as former chief compliance officers and senior in-house counsel across a wide range of sectors. We are also deeply attuned to global regulatory trends and can effectively translate and evaluate cross-market risks and challenges for multinational companies in a unique era of geopolitical change.
Our compliance work is comprehensive. We design and evaluate corporate compliance programs; conduct and advise on compliance risk assessments; carry out and provide advice on transactional and third-party due diligence; provide regulatory compliance advice; prepare and advise on effective compliance policies and training; and help General Counsels, Chief Compliance Officers, and Boards think strategically about how to meet global standards in a business-conscious, data-driven, and culturally attuned manner. Our work spans anti-corruption—including the FCPA, the UK Bribery Act and Canada's Corruption of Foreign Public Officials Act—sanctions and export controls, antitrust, healthcare fraud and abuse, anti-money laundering, business and human rights, ESG, political law, cybersecurity, and AI governance, helping clients and address both perennial and emerging risks.
We are at the forefront of employing AI and emerging technology to design and deploy risk management and compliance solutions based on data and advanced analytics that improve insights and drive actionable results. We conduct risk and capability assessments to help clients understand how best to leverage the data and capabilities of the broader organization. Our capabilities include holistic risk management design; compliance framework design and implementation; whistleblower hotline data and trend analysis; behavioral science analysis to maximize impact of ethics and compliance program design; remediation of issues and influencing positive cultural change across the organization; transaction and controls testing on key risk areas such as anti-corruption; and supply-chain/third-party risk management modernization.
We engage with boards and senior legal compliance business executives to design, operationalize, and scale governance frameworks that tackle the challenges and optimize the opportunities of emerging technology and AI. Our AI governance services include conducting AI inventory risk assessments; developing AI policy and internal controls; designing governance programs including stakeholder engagement across legal, IT, ethics, communications, government relations, and executive teams; aligning with global frameworks such as OMB, NIST, OECD, the EU AI Act, the World Bank, and other Multilateral Development Banks (MDBs); designing and deploying training and education for employees and stakeholders on the effective use of AI and emerging technology.
With global experience and multilingual capabilities, we support clients doing business not only in the US and Europe but across Asia-Pacific, Latin America, the Middle East, and Africa. Our sector experience spans energy, infrastructure, mining, financial services, commodities trading, consumer goods, technology and e-commerce, footwear and apparel, life sciences, shipping, logistics, and manufacturing.
Our services include:
- Risk Assessments. Conducting and advising on compliance risk assessments with a focus on helping companies identify their highest areas of risk and potential points of failure, enabling clients to effectively target compliance resources, and designing compliance programs consistent with their risks.
- Compliance Program Design and Reviews. Conducting assessments and advising on the design and implementation of corporate compliance programs for companies at all stages—ranging from those with programs in the early stages of design to those looking to update their programs consistent with enforcement and business risks and best practices.
- Compliance Counseling. Providing transaction or other situation-specific advice to identify and mitigate compliance risk under sanctions, export and trade controls, political law, anti-corruption, anti-money laundering, business and human rights, ESG, privacy, and cybersecurity laws, regulations, and standards. Our focus is on providing tailored advice that achieves compliance while also facilitating the achievement of business goals.
- Policies and Procedures. Drafting and evaluating policies, codes of conduct, investigation governance documents, compliance charters, compliance audit frameworks, board reporting templates, and remediation protocols, among other compliance and internal controls-related policies and procedures.
- Transactional Due Diligence and Post-Transaction Compliance Advice. Advising on compliance due diligence for prospective acquisitions, mergers, joint ventures, strategic investments, and other commercial transactions, and advising on post-transaction compliance program integration and governance.
- Third-Party Due Diligence. Advising on third-party due diligence and red flag mitigation strategies for the full range of potential third-party relationships, including vendors, subcontractors, advisors, agents, distributors, and others.
- Leveraging Technology and AI for Effective Compliance. Assessing compliance and the broader commercial technology stack for actionable insights; evaluating data maturity; and providing for compliance effectiveness. We have a cross-functional team of lawyers, data engineers, and data scientists who work with clients to develop bespoke risk management solutions.
- AI Governance. Developing policies and risk management frameworks for integration of Artificial Intelligence into key corporate workflows to ensure compliance with DOJ, NIST, FTC, EU, and other regulatory frameworks, as well as corporate best practices.
- Training and Communication. Designing and conducting tailored training for boards, C-Suite executives, and legal, compliance, and operational teams to drive engagement and embed ethical practices, including “train the trainer” programs.
- Monitorship Support and Management. Advising on monitor selection; supporting clients under monitorship to effectively manage both relationships with both the monitor and the relevant enforcement or regulatory agency; and serving as monitors or independent compliance consultants.
Representative Matters
Compliance Counseling
- AI Company. Advised a leading AI company on design of AI-native compliance program as well as integration of risk management practices into Agile workflows.
- Mining Company – Third-Party Due Diligence System. Supported a mining company in developing a third-party due diligence system to address corruption and human rights risks in Africa.
- Financial Institution – Multi-Agency Advisory. Provided strategic counsel on sanctions and export control compliance across multiple enforcement agencies.
- Houthi Network Sanctions – Compliance Response. Advised clients on OFAC's largest sanctions action to date against the Iran-backed Houthi network, targeting 32 individuals and entities and four vessels for roles in illicit fundraising; weapons procurement; and smuggling spanning Yemen, China, the UAE, and the Marshall Islands. Provided guidance on blocked property risks, counterparty exposure, and compliance program adjustments in response to the sweeping enforcement measures.
- Cartel del Noreste Sanctions Designations – Compliance Risk Advisory. Provided strategic counsel to clients following OFAC's designation of senior members of the Cartel del Noreste (CDN) as Specially Designated Global Terrorists (SDGTs) and Foreign Terrorist Organizations (FTOs). Advised on compliance risks, enhanced due diligence protocols, and mitigation strategies related to sanctions targeting narcotics trafficking, arms smuggling, and human trafficking along the US–Mexico border.
- DOJ & SEC Investigations – Enforcement Risk Mitigation. We have advised numerous companies' legal and compliance teams during DOJ and SEC investigations, focusing on remediation of compliance program deficiencies, strategic engagement with regulators, and implementation of sustainable improvements to mitigate enforcement risk.
- Multinational Engineering Consulting Company – Compliance with World Bank Integrity Compliance Guidelines. Advised client on revising anti-corruption compliance program to meet applicable World Bank standards.
Compliance Program Design & Risk Assessments
- Fortune 10 Company – Global Compliance Program Design. Designed and implemented a global compliance program for a Fortune 10 company, including tailored training modules and policy frameworks.
- M&A and JV Compliance Integration Manual – Global Application. Developed a comprehensive manual for M&A and JV compliance integration, including streamlined due diligence protocols and stakeholder guidance.
- Internal Investigation Protocols and Remediation Strategies. Advised a company on internal investigation protocols and remediation strategies following whistleblower complaints.
- Hong Kong Airline Lease Finance Company – Global Compliance Program. Designed and implemented a comprehensive compliance program for a major Hong Kong-based airline lease finance company with a Chinese parent, which covered anti-bribery/anti-corruption, AML, and sanctions compliance. Leveraged financial industry and in-house compliance expertise to ensure alignment with global best practices while remaining culturally sensitive and sustainable. The program included KYC, transaction monitoring, and tailored risk management procedures; also provided ongoing advice on counterparty due diligence, sanctions, and transaction-specific risks; and seconded a lawyer on-site as a ‘shadow' compliance officer to guide the client's legal/compliance team in translating policy into actionable steps and recordkeeping.
- Fortune 10 Company – Global Compliance Program Design. Supported a company in delisting proceedings after being added to a sanctions list, including engagement with OFAC and BIS.
- Global Logistics Provider – Sanctions Compliance Program. Assisted in conducting a gap analysis and implementing a sanctions compliance program tailored to transshipment risks.
- Southeast Asia-based Commodity Trading Firm – Commodity Trading Firm Advisory. Provided compliance advisory services on US sanctions and export control laws.
- Financial Institution – Sanctions Risk Assessment. Conducted risk assessments and policy reviews for the institution's operations in jurisdictions with heightened sanctions exposure.
- Consumer Goods Company – Compliance Expansion. Conducted compliance program reviews and training for a consumer goods company expanding into Latin America and Southeast Asia.
- APAC Retail & Tech Companies – Tailored Compliance Training. Delivered tailored compliance training programs for APAC-based retail and technology companies, including Mandarin language modules, covering anti-corruption, data privacy, and sanctions compliance.
- Leadership Training for Non-US Subsidiaries. Developed and advised on ethics and compliance training for senior leadership and mid-level managers of non-US subsidiaries of a Fortune 100 manufacturer.
AI Governance & Emerging Tech Compliance
- Tech Company – Ethical AI Governance for Compliance Integration. Counseled on ethical AI governance and integration of generative AI tools into compliance workflows.
- Fortune 100 Consumer Good Company – Linking 40+ ERP and Compliance Systems. Leveraged data analytics to integrate over 40 company ERP and compliance systems to monitor compliance risk.
- Global Regulator Training on Data Analytics in Compliance. Trained regulators and prosecutors in six different countries on the use and application of data analytics to evaluate compliance programs and conduct investigations.
- Leading Tech Company – Supply Chain Risk Detection Algorithm Development. Advised on the development of algorithms to identify risk, waste, and abuse across supply chains.
- Generative AI vs. Attorney-Assisted Review Pilot. Conducted pilot project to compare findings from an attorney-assisted document review against those of a GenAI-assisted document review in a cross-border internal investigation.
- Leading Forensic Accounting AI-Company – AML and Asset Tracing Algorithm Development. Advised on the development of algorithms to detect money laundering and asset tracing.
- Blockchain-Based Misconduct Reporting Solution. Developed a blockchain-based solution to connect with brand promoters across African markets to report potential allegations of misconduct.
- Algorithmic Detection of False Claims Act Indicators. Launched algorithm-based program which detected indicators of potential violations of the False Claims Act by pulling and analyzing state and federal government procurement data.
Transactional Pre-Acquisition Due Diligence and Post-Transaction Advice
- Private Investment Firm. Advised on anti-corruption due diligence and deep background investigation on behalf of an investment firm for a complex transaction involving the mining industry in a Central African country. The transaction and due diligence were eventually scrutinized by DOJ and SEC in connection with a broader government investigation, and ultimately passed muster.
- Brazilian Mining Company – Contracts. Advised company's risk committee on various sanctions and export control-related risks faced by the client, such as compliance with US and non-US export controls and economic sanctions laws, as well as local blocking and anti-sanctions laws. Assisted with conducting transactional and counterparty due diligence and provided advice in connection with Russian economic sanctions relating to a transaction and contract renewals with a third party.
- Asia Pacific Branch of Major Multinational Bank – IPO. Provided the Hong Kong office of a major investment bank with a high-level assessment of due diligence information gathered by the client on several Chinese companies ranging from manufacturing to technology industries with respect to the US Export Administration Regulations (EAR) and Executive Order 13959. Provided advice on sanctions, export controls, and investment control issues related to its role in an IPO by a major Chinese technology company; and provided neutral and objective advice to ensure that the risks were appropriately considered in highly publicized IPOs and other corporate transactions.
- Major Global Mining Company. Provided advice on anti-corruption risks associated with acquisition of junior mining company in South America, including due diligence of individuals and parties involved, public information searches, a forensic review of potential red flag transactions, and a review of regularity of processes under domestic law.
- Global Diamond Retailer. Conducted human rights due diligence regarding acquisition by diamond retailer, including review of policies and procedures, memberships and affiliations, public information, customs-related information, and other material, and identify integration approaches.*
- Global Conglomerate. Conducted human rights and anti-corruption due diligence in connection with acquisition of pet food company, including identifying relevant potential and identified risks and remediation efforts, and draft acquisition procedure and guidelines for future acquisitions.*
- Global Mining Company. Oversaw international regulatory due diligence in acquisition of mid-tier mining company with operations in Africa and the Middle East, including conducting pre-integration document review, performing public information searches, participating in site visits, and developing and implementing a post-acquisition integration plan.*
Monitorships
- Former DOJ Compliance Counsel. Oversaw the administration of monitorships and engaged in monitorship selection process across healthcare, financial services, defense and aerospace industries.
- SEC and CFTC Recordkeeping Monitorships. Selected to serve as Independent Compliance Consultants in enforcement orders against 11 major financial institutions for failing to maintain and preserve electronic communications in violation of federal recordkeeping rules. Conducted a comprehensive review of policies, training, disciplinary practices, and surveillance systems in one of the largest monitorships in recent financial regulatory history.
- Blackwater/Xe Services/Academi Export Compliance Monitor. Appointed by the US State Department's Directorate of Defense Trade Controls as Special Compliance Officer for three years and separately appointed by DOJ as Export Compliance Monitor pursuant to a Deferred Prosecution Agreement, extending oversight for an additional two years with expanded reporting requirements.
- Energy Company – Annual Compliance Reviews. Retained by the Board of a public energy company to conduct independent annual reviews of the company's political and lobbying activities as required by a settlement stemming from an investigation into domestic bribery conduct.
- Independent Compliance Monitor. Appointed by the World Bank to evaluate the global anti-corruption compliance program of SNC-Lavalin, Inc., a multinational engineering, infrastructure, mining, and energy company, over the course of an eight-year period.*
- US Counsel to Independent Compliance Monitor. Appointed as counsel to the monitor for a European telecommunications company in a DOJ and SEC FCPA monitorship.
- Multinational Mining Company. Appointed as independent monitor regarding human rights grievance and remediation program for multinational mining company following legal settlement.
Emerging Risks – Practice Spotlight: Business & Human Rights
- NSO Group – Global Human Rights Compliance Program. Advised on designing and implementing a global human rights compliance program, including drafting human rights policies, creating global due diligence frameworks, investigating alleged misuse of surveillance technology by government customers, and supporting regulatory proceedings in multiple jurisdictions. The matter addressed the balance between technology-enabled crime prevention and individual rights (such as privacy and freedom of expression) and shaped global policy debates on surveillance technology amid heightened COVID-era scrutiny.
- Global Technology Company – Human Rights Requirements for Surveillance Technology Customers. Advised on establishing human rights requirements for customers, integrating the company's components into surveillance technologies, including supply chain diligence, contractual agreements, certifications, and assurance processes. Guided the company in leading a cross-industry working group to develop model human rights KPIs for publication. Addressed emerging downstream supply chain human rights issues, particularly in second- and third-tier integrations, within a complex geopolitical environment involving China, the US, and Russia.
- Mining Business Association – Supply Chain Human Rights Risk Mapping. Advised on mapping human rights risks in cobalt supply chains, including forced and child labor in the DRC and forced labor risks in China's lithium-ion battery manufacturing sector. Developed a US legislative and regulatory strategy regarding proposed cobalt import bans, assisted with industry messaging, hosted policy events, created human rights frameworks for the automotive and energy sectors, and continue to advise on US cobalt import policy.
- Human Trafficking & Forced Labor Compliance – Multi-Industry Advice. Advised multiple clients on preventing, identifying, and addressing sex and labor trafficking risks, including: (1) a global online travel agency on mitigating US liability under the Trafficking Victims Protection Reauthorization Act (TVPRA) and managing red flags under global privacy laws; (2) a global extractive company in a US labor trafficking investigation involving workplace and alien harboring laws; (3) a global electronics company in resolving a class action under the TVPRA related to forced labor indicators at a Malaysian supplier; and (4) a global confectionery company on addressing forced labor linked to repayment of irregular recruitment fees under ILO standards and Section 307 of the Tariff Act of 1930.
- Multinational Company – Business & Human Rights Compliance Advisory. Advised a multinational company on business and human rights compliance, including creation of bespoke monitoring and remediation tools aligned with EU regulatory expectations.
* matter completed at prior firm