Compliance and Investigations: the highlights that marked september 2026.

National Highlights

Networked risks call for a new approach to compliance and governance

The increasing sophistication of corporate risks shows that threats involving fraud, corruption, money laundering, and infiltration by criminal organizations rarely arise in isolation. Red flags are often scattered across different parts of the organization, and identifying and addressing them effectively requires coordinated action among compliance, risk management, internal audit, procurement, information security, and corporate investigations.

Against this backdrop, the effectiveness of governance should be measured not merely by the existence of individual controls or policies, but by the organization’s ability to connect information, recognize risk patterns, and respond in an integrated manner. Fragmented processes and responsibilities can create significant blind spots, particularly in matters involving third parties, supply chains, financial flows, and complex business relationships.

For internal audit, this marks an important shift in perspective: it is not enough to assess whether each control exists or whether each function performs its role in isolation. Auditors must verify whether the governance framework as a whole can identify relevant signals, share critical information, and respond appropriately to risks. This systemic view is likely to become increasingly important for public and private organizations alike.

In this context, special attention should be paid to the construction of a robust risk map, capable of identifying potential exposures related to organized crime, third-party integrity, final beneficiaries, production chains, and financial flows. In addition to supporting the prioritization of resources, this mapping serves as a central element to direct coordination actions between the different areas responsible for risk prevention, detection, and response.

For companies, the moment represents an opportunity to review their governance models and strengthen the integration between lines of defense. Independent risk assessments, reviews of compliance programs, third-party due diligence, and tests of the effectiveness of control mechanisms can significantly contribute to increasing the organization’s ability to anticipate and respond to increasingly complex and interconnected threats.

Internal investigations: the new maturity test for compliance programs

A recent survey conducted by Proviti on the maturity of corporate investigation processes in Brazil paints a mixed picture: although the vast majority of organizations already have codes of conduct, reporting channels, and formal fraud prevention mechanisms, many still struggle to conduct internal investigations with the expected level of depth, independence, and quality. Key challenges include insufficient investigation budgets and the lack of structured training programs for the professionals who conduct them.

The study highlights a concern that increasingly features in compliance assessments, audits, and due diligence reviews: the effectiveness of an integrity program is measured not only by the existence of policies and reporting channels, but also by the ability to respond appropriately to the reports received. Investigations conducted without a sound methodology or adequate resources can heighten exposure to regulatory, employment, reputational, and litigation risks, while also eroding employees’ trust in the organization’s integrity mechanisms.

In this context, periodic reviews of investigation governance are gaining importance, including the adoption of investigation protocols, safeguards for the independence of those in charge, team training, risk assessments, and stronger whistleblower protection mechanisms.

For organizations, this is an opportunity to turn formal compliance structures into systems that can effectively identify, investigate, and remediate misconduct, reducing risk and strengthening a culture of integrity.

Source

Hidden risks in the supply chain: the role of enhanced due diligence

A recent operation by Brazilian authorities investigating alleged links between public transportation companies holding public contracts and criminal organizations has reignited the debate over corporate exposure to integrity risks associated with organized crime. The investigations, which involve suspected criminal infiltration of legitimate economic activities and of contracts of significant public interest, highlight challenges that go beyond traditional concerns about fraud and corruption.

The case reflects a global trend: authorities, regulators, and financial institutions are stepping up scrutiny of possible direct or indirect links between companies, suppliers, intermediaries, and criminal organizations. As a result, exposure to organized crime is no longer seen merely as a public security issue, but as a material compliance risk, with potential regulatory, reputational, contractual, and financial consequences.

For companies, a key takeaway is that third-party assessments cannot be limited to identifying corruption risks or conflicts of interest. Organizations are increasingly expected to adopt procedures capable of uncovering complex corporate structures, concealed beneficial owners, suspicious relationships, and indications of links to illicit activities. This is particularly important in extensive supply chains, regulated sectors, public contracts, and operations that rely on third parties to perform critical activities.

The issue gains further relevance amid the growing international debate on restrictive measures to combat transnational organized crime. In certain scenarios, companies and individuals associated with criminal organizations may become targets of economic sanctions, trade restrictions, and asset freezes, significantly increasing the risks for business partners, investors, and other counterparties that deal with them.

Against this backdrop, integrity programs are increasingly expected to incorporate enhanced due diligence, ongoing third-party monitoring, periodic risk assessments, and investigation procedures capable of detecting red flags related not only to corruption, but also to money laundering, organized crime, and other illicit activities. The evolution of this debate shows that third-party risk management has become central to organizations’ compliance and reputation protection strategies.

Anti-Corruption Law and public contracts: integrity as a prerequisite for contracting

The recent imposition of sanctions under the Anti-Corruption Law by Transpetro’s Integrity Committee, a state-owned company, shows how integrity and accountability mechanisms are increasingly embedded in the contract management of public entities and mixed-capital companies. Although proceedings conducted by oversight bodies and government authorities remain central to enforcing anti-corruption legislation, the case shows that internal integrity structures are also taking a leading role in identifying and responding to misconduct involving suppliers and contractors.

The episode confirms a trend seen in recent years: the strengthening of integrity systems at state-owned companies and the growing use of sanctioning tools to safeguard the fairness of contractual relationships. In practice, companies doing business with the public sector are subject not only to scrutiny by regulators and oversight bodies, but also to increasingly rigorous compliance assessments by the contracting entities themselves.

From a compliance perspective, the decision serves as a reminder that risks arising under Brazil’s Anti-Corruption Law are not limited to the imposition of administrative fines. Law No. 12,846/2013 provides for administrative sanctions, including monetary penalties and the mandatory publication of the sanctioning decision.

Any restrictions on participation in public tenders or on contracting with government entities, however, generally arise from the sanctioning regimes established under Law No. 13,303/2016, which applies to state-owned enterprises, or Law No. 14,133/2021, depending on the contracting authority and the applicable legal framework.

For organizations that participate in public procurement procedures or maintain significant public-sector contracts, this development underscores the need for ongoing monitoring of integrity requirements imposed by contracting authorities and regulators, as well as periodic compliance assessments capable of identifying vulnerabilities before they result in sanctions or commercial restrictions.

International Highlights

Sanctions, Human Rights and Compliance: investigations raise expectations on global risk management

Norwegian authorities have opened investigations into possible violations of economic sanctions and potential corporate involvement in crimes against humanity in connection with operations in a jurisdiction marked by political instability and serious allegations of human rights abuses. The investigations are examining allegations that user data was shared with local authorities and that assets potentially subject to regulatory restrictions were transferred when the company wound down its activities in the country.

The case illustrates a global trend toward heightened regulatory scrutiny of companies operating in high-risk markets, particularly on issues that go beyond traditional sanctions compliance. Authorities in various jurisdictions have shown a growing willingness to take an integrated view of risks related to human rights, data governance, third-party management, divestments, and decisions made in crisis scenarios or under intense regulatory and political pressure.

The episode underscores the need for programs that incorporate ongoing assessments of geographic, sanctions, and human rights risks, together with robust third-party due diligence, data governance, monitoring of operations in sensitive jurisdictions, and proper documentation of strategic decisions made by management.

From a compliance perspective, the progress of investigations of this kind shows that failures to identify and mitigate these risks may lead not only to regulatory sanctions, but also to questions about corporate responsibility for the impacts of a company’s operations. It also underscores the importance of coordination among the compliance, legal, risk, and audit functions to strengthen preventive controls and mitigate regulatory, reputational, and criminal exposure in an increasingly complex geopolitical environment.

Whistleblowing channels under the spotlight: lessons for compliance programs

The expansion of whistleblower incentive programs run by U.S. authorities has significantly increased the risks for companies that identify potential misconduct internally. According to experts, the growth of financial reward programs administered by regulators and prosecutors has encouraged individuals to report potential violations directly to the authorities, increasing pressure on companies to assess relevant facts quickly and decide whether to self-disclose before third parties bring the matter to the authorities.

This trend reflects a significant shift in the compliance and corporate investigations landscape, in which whistleblowing channels are no longer merely internal governance mechanisms but potential sources of information for regulators. In this context, the speed with which reports are investigated, the quality of internal investigations, and the organization’s ability to respond become critical to managing regulatory and reputational risks effectively.

From a compliance perspective, this development highlights the need for effective, widely publicized reporting channels that inspire trust among employees and third parties, as well as structured protocols for triaging, investigating, and remediating allegations. Beyond receiving reports, organizations must be prepared to respond quickly, consistently, and with proper documentation, demonstrating to the authorities that their integrity programs are effective.

This scenario also highlights the growing importance of periodic reviews of whistleblowing mechanisms, independent internal investigations, and decision-making processes on self-disclosure and cooperation with regulators, issues that are likely to take an increasingly strategic place on companies’ compliance agendas.

FCPA in focus: signs of renewed and intensified enforcement

Following a period of uncertainty resulting from the U.S. government’s 2025 review of enforcement priorities, recent statements by the U.S. Department of Justice (DOJ) indicating an intensification of efforts to combat transnational bribery suggest a renewed focus on FCPA enforcement. The DOJ’s position signals that investigations and enforcement actions are expected to remain concentrated on conduct involving international corruption, particularly in sectors and regions traditionally exposed to interactions with public officials.

This comes at a time when cases involving improper payments to public officials remain a priority for the authorities responsible for prosecuting corporate wrongdoing. Of particular relevance to Brazilian companies is the recurrence of cases involving Latin American countries. According to a recent analysis by international experts, the region continues to feature prominently in FCPA-related investigations and enforcement actions. This recurrence confirms that operations involving frequent interaction with public officials or extensive use of commercial intermediaries, consultants, representatives, or local partners remain exposed to significant anti-corruption risks.

The trend is also a reminder that the FCPA has global reach and continues to have significant impact even when the conduct under investigation occurs outside the United States.

In practice, companies with an international footprint, access to the U.S. market, foreign investors, or activities involving cross-border financial flows may face regulatory scrutiny and investigations by multiple authorities across different jurisdictions.

In this context, preventive measures that can demonstrate the effectiveness of integrity programs become even more important. Periodic risk assessments, robust third-party due diligence processes, payment monitoring, controls over interactions with public officials, and prompt investigation of suspected misconduct remain among the main risk mitigation tools.

For companies that operate or do business in Latin America, the message is clear: amid potentially stronger enforcement, the ability to identify, prevent, and respond appropriately to corruption risks remains essential. This capability matters not only for regulatory purposes, but also for protecting corporate reputation and business sustainability.

CGU Observatory

In September 2026, the CGU opened administrative liability proceedings (PARs) involving the following agencies and sectors:

Agencies involved:

_ Office of the Comptroller General of the Union (CGU)

_ Ministry of Communications

_ Ministry of Health

_ Ministry of Integration and Regional Development

Object of the Facts:

_ Fraud in an administrative contracts entered into with the national public administration;

_ Irregularities or fraud in bids or contracts;

_ Improper conduct and irregularities or fraud in public tenders or contracts;

_ Payment or offer, directly or indirectly, of an undue advantage to a domestic public official or a related third party;

_ Financing, funding, sponsoring, or subsidizing an unlawful act under the Anti-Corruption Law (Law No. 12,846/2013).

Want to understand how these matters impact your business? Our Compliance and Investigations team is ready to help you navigate them.