Evaluation of Corporate Compliance Programs – What It Means

By Steven Pulver
Last Updated
Dec 16, 2025
4 min read
Main image - Evaluation of Corporate Compliance Programs – What It Means

In early March 2023, the US Department of Justice quietly updated its Evaluation of Corporate Compliance Programs (ECCP). The new updates amend previous announcements revealed in the fall of 2022 by Deputy Attorney General Lisa Monaco.

The ECCP guidance outlines how prosecutors evaluate a business entity’s adherence to a corporate compliance program. Corporate counsel representing the interests of large business entities, and their corresponding subsidiaries, can use the ECCP guidance to strengthen the standards of their own corporate compliance policies for their respective organizations.

What are the new ECCP guidelines?

The purpose of the ECCP is to help DOJ prosecutors enforce standardized corporate compliance policies among business entities across the United States. The guidelines help prosecutors determine the effectiveness of an entity’s corporate compliance program, and evaluate how adequately the program is applied.

The most notable updates to the ECCP guidance are in regards to executive compensation and consequence management policies. According to an analysis submitted by Ankura Consulting Group to Lexology, there are four new guidelines related to compensation that prosecutors will consider when evaluating an entity’s corporate compliance policies.

  1. How effectively is an entity tracking disciplinary action data for malfeasance?
  2. Is compensation ever used as an incentive for adherence to corporate compliance?
  3. Are compensation packages recouped as a consequence for compliance violations?
  4. Does compliance influence career planning and promotion evaluations?

Corporate communication compliance for all communication channels

The second biggest change to the ECCP guidance relates to how executives and employees of a business entity issue communications. Most businesses have HR policies that offer broad guidance on what is and is not permissible to communicate, which the DOJ reviews if an entity is ever subjected to audits or criminal investigations.

Under the new ECCP guidance, those reviews will now include evaluating corporate policies on communicating via personal messaging applications. The ECCP emphasizes that any and all communications regarding corporate business must be part of a compliance risk management program, including communications issued outside of official company channels.

Entity management software helps enforce compliance

Compensation and communications are two important aspects of a corporate compliance policy. Enforcing the standards of the policy is an important part of the job of any in-house corporate counselor. The question for in-house counsel becomes: what is the best approach to enforce corporate compliance?

Entity management software is one of the best resources for business entities to adhere to their corporate compliance policies. Entity management software is a modernized approach to minute book management, enabling counsel to add new records to corporate documentation in a matter of seconds.

Suppose a round of bonuses is to be issued to various corporate managers and directors. Using entity management software, counsel can provide detailed accounts of the value of the compensation, when it was distributed, how it was distributed, and even into which account it was administered.

All those records are protected in secure cloud storage backed by biometric and hardware key authentication, ensuring all information remains secure and confidential. If federal or state auditors have questions about the compensation packages, your legal team can simply pull up the records in the account and provide a transparent summary of how compensation was issued. This is one of the many perks of secure cloud storage of business entity information.

Expect stricter enforcement of corporate compliance in 2023

The move by the ECCP to provide more guidance around corporate compliance shouldn’t come as a surprise. In recent months, several high profile businesses have been exposed for failing to uphold proper corporate compliance policies that are resulting in significant personal, financial, and criminal penalties.

In November 2022, the collapse of cryptocurrency exchange FTX highlighted the consequences of companies that lack proper organizational structure. Former FTX CEO Sam Bankman-Fried faces multiple charges related to fraud that could result in years of imprisonment for the 31-year-old former executive.

SBF’s misappropriation of customer funds to finance his trading firm, Alameda Research, lies at the heart of charges brought against him. Regulators have identified a lapse in organizational oversight at FTX, including the fact there was no CFO in place to properly manage the flow of cash in and out of the company.
More recently, the collapse and insolvency of Silicon Valley Bank risks exposing another case of financial mismanagement. In the aftermath of federal regulators seizing control of the company, they determined that SVB lacked a Chief Risk Officer to oversee risk management policies. Authorities believe that a Chief Risk Officer would have objected and prevented questionable moves by the CEO and CFO to sell millions of dollars in stock only weeks before the collapse. Those former executives are now being investigated for violating insider trading policies.

What you should do now

Blog

Related Articles
Discover insights and tips for legal professionals
Oct 17, 2025
5 min read
Judge Rules Corporate Transparency Act Unconstitutional, For Now

The Corporate Transparency Act (CTA) was enacted on January 1, 2024. The authors of the CTA decreed a mandate that requires all qualifying business entities to submit beneficial ownership information (BOI) reports to the Department of Treasury’s Financial Crimes Enforcement Network (FinCEN).

Two months later, on March 1, 2024, a US District Judge in Alabama ruled on a case brought before the court by the National Small Business Association (NSBA), an organization representing over 65,000 small business entities across the United States. The judge ruled that the CTA is “unconstitutional” and that lawmakers overstepped their bounds.

What is the purpose of the Corporate Transparency Act?


The CTA is part of a broader government effort to crack down on white-collar crime. US federal agencies and financial institutions annually identify unlawful transferrences of capital through money laundering or corporate sponsorship of international terrorism — actions that, in the government’s opinion, undermine national security.

As a result, the CTA gives FinCEN greater authority and oversight of suspected culprits of these crimes. Qualifying business entities must provide detailed BOI reports to FinCEN, which will store those records in secure databases and use them to monitor suspicious financial activities.

What were the details of the Alabama case?


The NSBA challenged the legal authority of the CTA and took the government to court seeking a summary judgment. Federal District Judge Liles C. Burke in Alabama issued a 53-page opinion about the case, which a Forbes contributing writer dissects in detail.

At the heart of the lawsuit is the fact that legal entities in the United States register with individual states where they choose to operate. The incorporation of those entities is a matter for the states to decide, along with the ability to prosecute those businesses for suspected financial crimes.

The NSBA argued that the CTA gives the federal government’s national security and foreign affairs matters the right to interfere with how individual states regulate businesses. Additionally, they argued that limited liability corporations (LLCs) may engage in interstate commerce, but not all entities pursue these opportunities.

The CTA requires all entities — even those that never cross state jurisdictions — to abide by the federal government’s mandate. Judge Burke ruled these grounds warranted an unconstitutional ruling of the CTA, though the federal government launched an appeal to the Eleventh Circuit.

Who is a beneficial owner under the CTA?


Within the CTA is specific language that defines a beneficial owner. According to the CTA, a beneficial owner is anyone who — directly or indirectly — maintains a 25% ownership interest in a corporate entity. Additionally, a beneficial owner is anyone who — again, directly or indirectly — maintains substantial control over business operations through voting rights.

Shareholders who fit the profile of a beneficial owner must provide their personal information — name, address, and a government-issued identification number — to the entity management department. That data is then processed and submitted to FinCEN as a BOI report.

Are some entities exempt from BOI reporting requirements?


The CTA allows authorities to gather beneficial ownership information from thousands of legal entities. However, FinCEN has detailed 23 types of legal entities that are exempt from the BOI reporting requirements.

Most exemptions revolve around the financial sector in the form of banks, credit unions, venture capital firms, depository institutions, or money services businesses. Government authorities, public utilities, and securities exchanges are also exempt from reporting BOI data to FinCEN.

What does the Alabama case ruling mean for BOI reporting?


So, what does the NSBA case against the Treasury Department mean for the future of BOI reporting requirements? There are two key takeaways from the case.

Firstly, Judge Burke clearly stated in his ruling that the injunction against the CTA only applies to businesses enrolled in the NSBA before March 1, 2024. Businesses that are registered members of the NSBA have a temporary pause on compliance with the CTA while the case is under appeal at the Eleventh Circuit.

For most businesses, the ruling has no impact whatsoever. FinCEN requires BOI reports from entities registered on or after January 1, 2024, within 90 days of receiving their articles of incorporation. Any entities registered before January 1, 2024, have until January 1, 2025, to submit their BOI reports to FinCEN.

How to prepare your BOI reports for FinCEN


While many entities still have several months to submit their BOI reports to remain in compliance with the CTA, it’s best to start gathering that information now. It’s much more effective for your entity management team to have all the information they need well in advance of the deadline to avoid last-minute scrambles and gaps in required data.

Intuitive entity management software can assist your legal and compliance departments with these tasks. Platforms like MinuteBox include pre-built templates and guided widgets that help your teams build detailed reports. The technology saves valuable working time and makes the process of gathering, filing, and securing entity management data quick and painless.

Additionally, you can use the platform’s Corporate Transparency Register to comply with all obligations under the CTA. Here, you can build detailed shareholder ledgers and create a comprehensive list of all beneficial owners with significant controlling interest in the company.

Once the data is in the platform, you can easily create detailed minute book records of all beneficial owners. Since the information is stored in your platform, filing and submitting the BOI reports to FinCEN is a breeze.

Prepare your legal entity for the next step of beneficial ownership reporting. Join the MinuteBox revolution today, and stay ahead of the game while maintaining compliance.

Oct 17, 2025
4 min read
Nearly 1 in 3 Legal Entities Have No Compliance Calendar

Compliance with the Corporate Transparency Act is a necessary legal obligation so that entities avoid the repercussions of non-compliance. Qualifying beneficial ownership data must be submitted to federal regulators at FinCEN by pre-determined filing deadlines to maintain compliance with the enforced laws.

However, many legal entities risk undermining their compliance only weeks after the enactment of the CTA legislation. According to a joint study by Deloitte and the Association of Corporate Counsel (ACC), nearly one in three legal entities still need a corporate compliance calendar.

What is the use of a compliance calendar?


Most corporate entities have annual filing deadlines for legal, tax, and accounting purposes. A corporate compliance calendar keeps track of all compliance filing deadlines, which can include:

  • Corporate meeting minutes
  • Reporting obligations
  • Industry filings
  • Permits or accreditations
  • Merger or acquisition filings
  • Beneficial ownership reports

A compliance calendar also assists with operational efficiencies, such as standardizing compliance workflows and assigning compliance tasks to key filing dates. Aligning the compliance calendar with an organizational chart also helps expedite approvals and signatories from key organizational stakeholders.

These are among the strategic business benefits that come from maintaining a corporate compliance calendar. Unfortunately, entities with limited legal entity management resources — working time, compliance budgets, corporate counsel staff — fail to reap these benefits.

What are the costs of non-compliance?


A compliance calendar ensures all filings are submitted by the appropriate deadlines. The compliance calendar also increases compliance awareness across the business. Greater awareness leads to fewer data or clerical errors, streamlining the entity management process.

However, what’s the biggest reason why your entity needs a corporate compliance calendar? According to Ponemon Institute LLC — with sponsorship from Globalscape — the average cost of non-compliance is $14.82 million.

In a benchmark study of multinational organizations, the researchers determined that the average annual cost of compliance is $5.47 million. Contrast this cost with the cost of non-compliance, and it results in 63% annual savings by simply submitting reporting data at the appropriate deadlines.

Additionally, the cost of a single non-compliance deadline amounts to revenue losses of $5.87 million for the average legal entity. If one out of three entities still lacks a corporate compliance calendar, this means billions of potential revenue dollars are sacrificed for no justifiable reason.

What information goes on a compliance calendar?


The Corporate Transparency Act was enacted to improve how corporate entities report data on their beneficial owners. The Act is part of a government effort to crack down on money laundering, tax evasion, and other financial crimes nationwide. A corporate compliance calendar tracks all filing deadlines so that ownership data is transparently submitted without penalty.

However, a compliance calendar isn’t just useful for tracking external filing deadlines. You can use your compliance calendar to set operational compliance workflows and assign deadlines to each entity management team member. This ensures that all reporting requirements are tracked using project management strategies so that filings are submitted in detail and on time.

How to create a corporate compliance calendar


If you’re amongst the one in three legal entities without a compliance calendar, it’s time to change that approach. Assess your business needs and evaluate your past compliance processes to proactively make improvements to those workflows.

Once you’ve mapped out your compliance objectives, you can create your compliance calendar. Many modern business entities use legal entity management software like MinuteBox, which has a built-in compliance calendar to automate, streamline, and verify all compliance workflows.

Using the calendar’s guided template, follow these steps to build a compliance workflow.

  • Review current compliance trends, laws, and reporting requirements.
  • Upload the dates into your entity management platform compliance calendar.
  • Create a work-back schedule that contains all internal reporting deadlines.
  • Set up reminders for each team member and schedule them for deployment.
  • Review and modify your compliance calendar as needed.

Are you tired of conducting compliance workflows without a proper compliance calendar? Become a modern compliant business entity by joining the MinuteBox revolution. You’ll effectively maintain compliance with speed and precision while avoiding the steep financial penalties of non-compliance.

Oct 17, 2025
5 min read
SVB Collapse – Another Corporate Compliance Cautionary Tale

On the weekend of March 11, 2023, a sense of deja-vu settled over much of North America. It was an unsettling series of financial setbacks that dangerously paralleled the 2008 financial crisis. What was the trigger of these unnerving reminders from the ‘08 global financial disaster? It was the collapse and insolvency of Silicon Valley Bank.

The SVB collapse triggered a wave of panic as investors rushed to pull their assets out of risky portfolios. The biggest loser in this latest bank run was Signature Bank, a massive entity with deep ties to real estate and legal industries. Seized by US regulators mere hours following the collapse of SVB, the Signature Bank collapse marked the third-largest bank failure in US history.

US Treasury Secretary Janet Yellen announced on March 12, 2023, that all SVB and Signature Bank customers will be “made whole” in an attempt to calm the brewing storm in the financial sector. Her efforts appear to have done the job, as markets rallied on March 13, 2023, a sign that her reassurances injected much-needed positive energy across the country. The worst damage appears to be limited to the US, as Canadian officials assured residents that the SVB fallout on the northern side of the border would be very low.

How did Silicon Valley Bank collapse?

Mark T. Williams, a former examiner for the US Federal Reserve, describes the SVB collapse as “a colossal failure in asset-liability risk management.” Other venture capitalists laid the blame on decisions by the SVB CEO and CFO to liquidate assets that had lost significant value as a result of rising interest rates.

SVB Financial Group, the parent company of SVB, reported selling $21 billion of bonds on March 8, 2023. The bonds had lost significant value against rising interest rates, and the sale resulted in an after-tax loss for the company of $1.8 billion for the quarter.

This reckless decision followed an earlier maneuver by SVB Financial Group CEO Greg Becker to sell off personal SVB stock valued at $3.6 million. SVB Financial Group CFO Dan Beck also made questionable sales of shares prior to the outright collapse of the bank. Collectively, these actions triggered a wave of panic that forced the institution into insolvency.

SVB had no Chief Risk Officer since April 2022

According to the company’s own records, there has been no Chief Risk Officer overseeing risk management issues at SVB since April 2022. Those same records show that the number of meetings chaired by the company’s risk committee more than doubled in the past year.

As the company divested assets from its stock portfolio in a blatant effort to rebuild capital, SVB customers rushed to withdraw $42 billion of cash in less than 48 hours. All these actions: the losses from the sale of stocks, the client loans devalued by higher interest rates, a lack of diversified banking customers (SVB primarily tailored to Silicon Valley tech startup firms)—created a chain reaction that led to the collapse of the bank.

A Chief Risk Officer and a properly functioning risk committee might have relayed the risk management concerns of poor fiscal decisions to the company’s CEO and CFO. Presumably, those stark warnings would have prevented those decisions from being made, which might have avoided the outright bank collapse.

SVB collapse comes on the heels of the FTX collapse

The SVB collapse is another reminder of the pitfalls of overinvesting in nascent industries. The SVB collapse comes only months following the collapse and disgrace of FTX, a cryptocurrency firm that engaged in a series of alleged cases of fraud.

While the end results are identical, there is a key difference between the two cases. The SVB collapse appears to have been the result of poor risk management policies and extremely short-sighted decisions on disbursing assets and liabilities. The FTX case involves criminal charges that have led FTX founder and former CEO Sam Bankman-Fried into criminal indictments that risk significant jail time.

Use entity management software and don’t be like SVB

Since the lack of a Chief Risk Officer in the SVB executive hierarchy played a major role in the bank’s collapse, the case serves as a sharp reminder for other business entities. It’s important that you have proper managers, established organizational charts, and clear corporate compliance policies in place to avoid making these same mistakes.

Entity management software is one of the best resources to help implement corporate compliance policies. You can build a detailed org. chart within the platform, creating an organizational hierarchy and chain of command to manage all important business decisions.

If there are any decisions with potential legal consequences, your team can review the org. chart and use the platform to create diligent minute book records documenting how those issues are managed. Additionally, you can send any documents that require signatory approval – for items such as the sale of company stock – to the appropriate executive. You can include the transfer, signature, and filing of those documents in your minute book. This will help ensure your entity manages all decisions with appropriate, and logical strategies.

You're subscribed!
Stay tuned for updates delivered to your inbox.
We couldn’t

process your request
Please double-check your email and try again.
Subscribe
to our newsletter
Stay updated with the latest news and insights from MinuteBox delivered straight to your inbox.