Neil Arklie’s Post

𝑪𝒚𝒃𝒆𝒓𝒊𝒏𝒔𝒖𝒓𝒂𝒏𝒄𝒆 𝑪𝒐𝒗𝒆𝒓𝒂𝒈𝒆 𝒇𝒐𝒓 𝑹𝒂𝒏𝒔𝒐𝒎𝒘𝒂𝒓𝒆 𝑷𝒂𝒚𝒎𝒆𝒏𝒕𝒔 𝒗𝒔 𝑼𝑺 𝑺𝒂𝒏𝒄𝒕𝒊𝒐𝒏𝒔 𝑹𝒆𝒈𝒖𝒍𝒂𝒕𝒊𝒐𝒏𝒔 New case comment on an interesting Swiss contract law decision (judgment of the Swiss Federal Supreme Court of 17 August 2023 – ref. 4A_206/2023) concerning the insurer’s refusal to reimburse ransomware payments made by the cyberattacked company due to the potential risk of violating US sanctions regulations authored by Jacques de Werra, Célian Hirsch and Thomas Hua (gbf Attorneys-at-law Ltd - https://lnkd.in/e36FYkNB).   ⇒ Case comment: https://lnkd.in/exmV64zi ⇒ Judgment of the Swiss Federal Supreme Court (in German): https://lnkd.in/eZm9xj6i   Faculté de droit - UNIGE - Université de Genève - Digital Law Center - University of Geneva   #Insuranceagreement #USsanctions #cyberinsurance #sanctionsinterest #ransomware #swisscontractlaw #contractlaw #commercialcontracts #swisslaw

This is a very interesting legal comment on a cyber insurance dispute over a ransomware claim that played out in Swiss courts last year. In short, the insurer contested reimbursing part of a ransom payment that Garmin made to an Evil Corp-linked ransomware strain in 2020, because they argued the payment was being made to a sanctioned entity (Evil Corp). Alexander Martin had a great scoop on this back in 2020: https://lnkd.in/en-StG9U The Swiss supreme court sided with Garmin because: 1. The prospect of being sanctioned by OFAC is very low -- OFAC has never penalised an organisation for paying a ransom to a sanctioned entity 2. The insurer couldn't attribute the ransomware attack to Evil Corp with enough certainty (personally, I would argue that Evil Corp is one of the few sanctioned ransomware threat actors where you *can* prove a stronger link because of the use of custom tooling and malware. It's interesting because: 1. There is a say do gap for ransomware sanctions currently. The US and UK ransomware sanctions regime are currently not being enforced and are designed in a way to make them harder to enforce (e.g. naming individuals rather than ransomware strains). The insurance/incident response/negotiator ecosystem knows this, but I don't think it's seeped out into the wider community. 2. The bar on what minimum sanctions due diligence or ransomware attribution looks like right now is too low, and OFAC and OFSI (the UK authority) should be demanding on-chain analysis and assessments of tradecraft and tooling.

Have you read this article by Irish Independent? 🗞️ According to three Irish universities, most Irish businesses are unprepared for the next big cyber-attack and could risk massive fines for non-compliance with the EU’s latest IT security law. Read the full article here: https://lnkd.in/e3rqnUfv

1. Brutality Claim During Akure Raid False — EFCC Debunks Video Evidence https://ift.tt/gWALoCq Brutality The Economic and Financial Crimes Commission (EFCC) has recently found itself at the center of controversy following a sting operation in Akure, Ondo State. Allegations of brutality surfaced, prompting a swift response from the EFCC to debunk these claims and clarify the events that transpired. This article delves into the details of the operation, the subsequent allegations, and the EFCC’s rebuttal, providing a comprehensive overview of the situation. Background of the Akure Sting Operation The EFCC conducted a carefully planned raid in Akure, Ondo State, targeting individuals suspected of engaging in financial crimes. This operation was part of a broader initiative to crack down on corruption and fraud across Nigeria. The EFCC, known for its rigorous and meticulous approach, ensured that all legal protocols and guidelines were followed to the letter during the operation. Allegations of Brutality Following the raid, a video surfaced online, purportedly showing EFCC officials engaging in acts of brutality against suspects. The video quickly went viral, sparking outrage among the public and drawing criticism from various quarters. The footage depicted scenes that suggested excessive use of force, leading to widespread condemnation and calls for accountability. Details of the Video Evidence The video, allegedly recorded by a bystander, showed EFCC operatives restraining and apprehending individuals in a manner that appeared forceful. The footage was grainy and lacked clear audio, making it difficult to ascertain the exact context and actions of the officers involved. Despite these limitations, the video ignited a firestorm of accusations against the EFCC, with many demanding a thorough investigation. EFCC’s Rebuttal and Official Statement In response to the allegations, the EFCC released an official statement vehemently denying any acts of brutality during the Akure raid. The commission emphasized its commitment to upholding human rights and adhering to the rule of law in all its operations. According to the EFCC, the video was misleading and taken out of context, failing to accurately represent the events that occurred. Clarification of Events The EFCC provided a detailed account of the operation, highlighting the professionalism and restraint exercised by its officers. According to the commission, the individuals apprehended during the raid were suspected of involvement in significant financial crimes, and the operation was executed with precision to avoid any unnecessary harm. The EFCC also noted that the video failed to capture the entire sequence of events, omitting critical moments where suspects resisted arrest and posed a threat to the officers. Investigation into the Video To address the concerns raised by the public, the EFCC launched an internal investigation into the authenticity and origin of the video. Prelim...

The Foreign Extortion Prevention Act (FEPA) and the Foreign Corrupt Practices Act (FCPA) have significant implications for compliance professionals in Taiwan. FEPA, enacted on December 21, 2023, criminalizes the act of foreign officials demanding bribes. It applies to U.S. citizens, companies, and entities, as well as foreign officials who solicit bribes from them. Violations can result in up to 15 years of imprisonment and fines up to $250,000 or three times the monetary equivalent of the bribe demanded. The FCPA, enacted in 1977, prohibits U.S. persons and entities from offering, paying, or promising to pay bribes to foreign officials to obtain or retain business. It also mandates accurate record-keeping and internal controls to prevent corrupt practices. For Taiwanese companies, these U.S. laws are pertinent if they engage in business with U.S. entities or have operations within U.S. jurisdiction. FEPA extends U.S. jurisdiction to foreign officials who demand bribes from U.S. persons or entities, even if the act occurs outside the U.S.. To mitigate legal risks, Taiwanese companies should establish robust anti-corruption policies, conduct thorough due diligence on partners and agents, and implement effective internal controls and training programs. Staying informed about updates to these laws and international anti-corruption standards is also crucial. In summary, FEPA and FCPA significantly impact Taiwanese companies engaged in international business. Adopting comprehensive compliance measures is essential to navigate these legal frameworks effectively. DOJ 2024 in review https://lnkd.in/gsMm7Riu

Yesterday the UK Government released guidance to organisations on the offence of failure to prevent fraud - this a strict liability offence, created in the Economic Crime and Corporate Transparency Act 2023, and requires organisations to prevent fraud by employees or agents aimed at benefiting the organisation or causing loss to another. To avoid liability, organisations must demonstrate "reasonable procedures" to prevent fraud, proportionate to the business's size, nature, and risk profile. Procedures include #risk assessments, effective reporting channels, training and #governance frameworks. Smaller organisations may need fewer formal processes, whereas larger entities may implement comprehensive compliance structures. If convicted, organisations face fines and potential reputational damage.   At iSanctuary we work with a diverse range of businesses assisting them to mitigate against fraudulent activity or unwittingly being used to facilitate money laundering by bad actors. Our #duediligence service, Integrity, provides our clients with timely, high quality information that enables them to make the right decisions in real-time. https://lnkd.in/eRu6qFXw Get in touch with us to find out more.

The guidance is useful, but many companies may overlook it by focusing only on the "250+ employees" criterion. However, meeting just two of the following qualifies you: 250+ employees, £36M+ turnover, £18M+ in total assets. If your company meets the latter two, you likely qualify. This could include many smaller and medium-sized lenders exposed to fraud risks. Stay tuned for our next online event, where we'll discuss how fraudsters target smaller firms and how using the latest technology we prevented £18M in losses with Intelligent Sanctuary Ltd Integrity EDD service. Interested? Contact us. #fraud #compliance #EDD #KYC #fraudprevention

WOULD YOU LIKE TO LEARN MORE ABOUT ... 📝 👇 📜 The Impacts of the 2023 U.K. Economic Crime and Corporate Transparency Act? 📏 Measures and Reforms Introduced by This Act? 🧠 What Fraud Examiners Should Know About Changes to the Identification Doctrine? 📈 How to Demonstrate Sufficient Efforts to Prevent Fraud? If so, check out this great summary of the ‘UK Economic Crime and Corporate Transparency Act’, a panel session moderated by Founding Partner Lloydette Bai-Marrow alongside three industry experts during 2024 ACFE Fraud Conference Europe! ➡ https://lnkd.in/eE4ttk-2 #FinancialCrime #Fraud

The recent publication of the UK Government’s guidance on the failure to prevent fraud offence as set out in the Economic Crime and Corporate Transparency Act (#ECCTA) is a welcome development. As we anticipated, it mirrors the guidance issued to support the UK Bribery Act, outlining a programme of reasonable procedures that businesses will need to have in place to prevent fraudulent behaviour by the company. This alignment is particularly welcome as the six principles it focuses on are already familiar, thus reducing the regulatory burden and avoiding unnecessary duplication. In particular the guidance focuses on culture and tone from the top, making it clear that a business must risk assess carefully to identify how, where and why fraudulent behaviour might occur across its operations. A careful risk assessment will be critical as it will not only ensure that potential exposure to fraudulent practice is identified, but also helps companies take a risk-based, and therefore proportionate, response to prevention. With the countdown to implementation now underway, our framework on Preventing Outward Fraud has been updated and my colleague Sarah Coombes will be leading our clients through these new developments. For more details on the guidance, read my blog on the GoodCorporation website below. The updated framework to help companies prepare is here: https://lnkd.in/e_bpkrkg This is a significant piece of legislation which will be the subject of a debate we are holding next week in the House of Lords debate. I look forward to sharing our summary of the discussion in the coming weeks. #fraudprevention #fraudulentbehaviour

🚨 𝗕𝗿𝗲𝗮𝗸𝗶𝗻𝗴 𝗡𝗲𝘄𝘀: 𝗘𝗣𝗣𝗢 𝗨𝗻𝗰𝗼𝘃𝗲𝗿𝘀 𝗘𝘂𝗿𝗼𝗽𝗲’𝘀 𝗟𝗮𝗿𝗴𝗲𝘀𝘁 𝗩𝗔𝗧 𝗙𝗿𝗮𝘂𝗱 𝗦𝗰𝗵𝗲𝗺𝗲 🚨 The European Public Prosecutor’s Office (EPPO) has launched a major investigation into “𝗔𝗱𝗺𝗶𝗿𝗮𝗹,” 𝗮 𝘀𝗰𝗵𝗲𝗺𝗲 𝗶𝗻𝘃𝗼𝗹𝘃𝗶𝗻𝗴 𝗘𝘂𝗿𝗼𝗽𝗲'𝘀 𝗯𝗶𝗴𝗴𝗲𝘀𝘁 𝗩𝗔𝗧 𝗳𝗿𝗮𝘂𝗱. Spanning across 22 Member States, this complex network allegedly 𝗱𝗲𝗳𝗿𝗮𝘂𝗱𝗲𝗱 𝘁𝗵𝗲 𝗘𝗨 𝗼𝗳 €𝟮.𝟮 𝗯𝗶𝗹𝗹𝗶𝗼𝗻 𝗶𝗻 𝗩𝗔𝗧 𝗿𝗲𝘃𝗲𝗻𝘂𝗲. 🔑 𝗞𝗲𝘆 𝗿𝗲𝘃𝗲𝗹𝗮𝘁𝗶𝗼𝗻𝘀: 🔍 𝗟𝗶𝗻𝗸𝘀 𝘁𝗼 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗲𝗱 𝗰𝗿𝗶𝗺𝗲 across borders. 🌍 Investigations target 𝗼𝘃𝗲𝗿 𝟲𝟬𝟬 𝘀𝘂𝘀𝗽𝗲𝗰𝘁𝘀, showcasing unprecedented international cooperation. 💼 EPPO’s efforts highlight the 𝗴𝗿𝗼𝘄𝗶𝗻𝗴 𝗻𝗲𝗲𝗱 𝗳𝗼𝗿 𝗰𝗿𝗼𝘀𝘀-𝗯𝗼𝗿𝗱𝗲𝗿 𝗹𝗲𝗴𝗮𝗹 𝗳𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀 to combat large-scale financial crime. 𝗧𝗵𝗶𝘀 𝗰𝗮𝘀𝗲 𝘂𝗻𝗱𝗲𝗿𝘀𝗰𝗼𝗿𝗲𝘀 𝘁𝗵𝗲 𝗶𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝗰𝗲 𝗼𝗳 𝗰𝗼𝗹𝗹𝗮𝗯𝗼𝗿𝗮𝘁𝗶𝘃𝗲 𝗲𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗿𝗼𝗹𝗲 𝗼𝗳 𝗩𝗔𝗧 𝗶𝗻 𝘁𝗵𝗲 𝗘𝗨'𝘀 𝗲𝗰𝗼𝗻𝗼𝗺𝗶𝗰 𝗶𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆. It’s a 𝘄𝗮𝗸𝗲-𝘂𝗽 𝗰𝗮𝗹𝗹 for businesses and governments to remain vigilant against fraud. #EPPO #TaxFraud #OrganizedCrime #VAT #FinancialCrime #EUCompliance #GlobalEnforcement #GST #MOF #Enforcement #RBI #FIEO #CII #FICCI #Traders #Importers #Exporters