Key Takeaways | Mastering Multi-Dimensional Risk: Litigation, Compliance & Cross-Border Investigations 2026

The regulatory and enforcement landscape continues to evolve at pace, creating an increasingly complex environment for organisations operating across multiple jurisdictions. While sanctions, anti-money laundering, fraud, ESG and corporate governance have traditionally been managed as separate compliance disciplines, one of the strongest messages emerging from our latest roundtable in Milan was that these risks are now deeply interconnected. Across the UK, France and Italy (and the US), regulators are asking fundamentally the same question: can organisations demonstrate that risk management is embedded in the way that the business is governed and operated? The answer depends not on the existence of policies, but on evidence of effective programme design and implementation, active oversight, integrated governance and informed decision-making.

Read on for insight from our expert panel, comprising Bruno Carbone of ENI, Gervasio Cicoria of Assicurazioni Generali, Daniele Alessandro Luison of UniCredit and Marianna Vintiadis of RSM Italy, joined by McDermott Will & Schulte partners Simon Airey, Fabio Cozzi, Vincenzo Giannantonio and Nicolette Kost De Sèvres.

Compliance is a board-level priority and requires evidence of effectiveness

During the presentations, a consistent theme emerged: compliance has moved well beyond its traditional role as a back-office control function. Whether discussing the UK’s recent Economic Crime & Corporate Transparency Act, developments in French anti-corruption enforcement or Italy’s evolving sanctions, AML and ESG framework, the emphasis was firmly on governance, accountability and demonstrable effectiveness. Regulators and enforcement authorities are no longer interested in merely whether organisations have policies and procedures in place, but in how those policies are implemented, monitored and supported by senior leadership. Boards are therefore expected to play a far more visible role in overseeing compliance programmes, allocating appropriate resources and fostering an organisational culture in which ethical decision-making is embedded throughout the business.

In this context, clear and consistent data analysis and record keeping has become essential: organisations must be able to evidence risk assessments, board oversight, decision-making processes, training programmes and ongoing monitoring, showing not only that appropriate controls exist, but that they have been actively maintained, periodically reviewed, and adapted to a changing risk landscape.

Compliance is shaping commercial decisions

A particularly interesting thread running through the discussion was the extent to which compliance now shapes commercial strategy as much as legal risk. Robust governance frameworks are becoming increasingly important in the context of acquisitions, financing, joint ventures and supply chain management; while weaknesses in compliance can affect valuation, delay transactions and create significant post-completion exposure. At the same time, organisations face growing scrutiny not only from regulators, but also from lenders, investors, insurers, counterparties and other stakeholders, all of whom expect businesses to demonstrate that compliance is integrated into day-to-day decision-making.

On a more positive note, effective compliance has become a source of commercial resilience and competitive advantage, rather than simply a mechanism for avoiding enforcement. A strong compliance programme has a number of other benefits: it signals strong corporate governance and hygiene – in turn, this will enhance relationships with external stakeholders; it supports capital readiness – a well-managed programme will make companies easier to diligence, finance and partner with; it protects transaction speed – where future opportunities involve financings, joint ventures, investments, re-organisations or public-sector engagement, companies need to be ready for relevant filings and verifications; it can help reduce the risk of expensive disputes, regulatory enquiries and settlements; and it enhances reputation and trust – a robust compliance programme allows companies to present this as part of a responsible growth agenda.

The boundaries between different areas of risk are disappearing

Another common thread running through the discussion was the interconnected nature of regulatory risk. Sanctions compliance can no longer be considered independently from anti-money laundering controls; likewise, fraud prevention, ESG obligations, supply chain due diligence and corporate investigations are becoming progressively intertwined. This convergence is mirrored by greater coordination among enforcement authorities across jurisdictions, sharing information more readily and extending the reach of domestic legislation beyond national borders. For multinational organisations, managing risk on a jurisdiction-by-jurisdiction basis has become more difficult; instead, businesses are moving towards more integrated governance models that bring together legal, compliance, investigations, internal audit, finance, technology and other operational teams.

Effective investigations have become an essential component of modern compliance

The panel discussion reinforced the idea that internal investigations should no longer be viewed solely as a reactive response to suspected misconduct. Instead, they are now used to test whether existing controls are operating effectively, identify emerging risks and refine compliance frameworks before issues escalate. Investigations into sensitive issues should be properly scoped and conducted, with the benefit of legal privilege where possible. The conversation also explored the growing role of technology and digital forensics in supporting investigations, while recognising the importance of balancing speed with procedural rigour and ensuring that evidence is collected and handled in a legally defensible manner. As financial crime becomes more sophisticated, investigations are evolving from a post-incident exercise into a continuous source of organisational learning and risk intelligence.

Looking ahead

Although the legal frameworks discussed during the seminar differed across the UK, France and Italy, the direction of travel was remarkably consistent. Enforcement authorities now expect organisations to anticipate risk rather than simply respond to it, embedding compliance into governance, commercial decision-making and day-to-day operations. Businesses that invest in integrated, evidence-based compliance programmes will be better placed not only to withstand regulatory scrutiny, but also to inspire confidence among investors, counterparties and other stakeholders. As the discussion throughout the afternoon demonstrated, compliance is no longer simply a legal obligation; it has become a defining feature of resilient, well-governed organisations operating in an increasingly complex global environment.

From another perspective, compliance is now a litigation asset. A well-designed compliance program does not eliminate risk. But it can shape how regulators, prosecutors, courts, counterparties, investors, and stakeholders view the company when something goes wrong. It can demonstrate that the company did not ignore risk, did not profit from weak controls, and did not treat remediation as a cosmetic exercise.

Managing risk in practice: What are your next steps?

Huge Changes to Corporate Criminal Liability for both UK and Non-UK companies under the UK Economic Crime & Corporate Transparency Act 2023 and the UK Crime & Policing Act 2026, Make sure your group entities and your people are protected

The UK Economic Crime & Corporate Transparency Act 2ct 2023 (“ECCTA”) introduced the most significant changes to corporate criminal liability for over 150 years. The legislation has broad extra-territorial reach and is capable of applying to people, entities and conduct outside the UK. These developments present major new risks – and opportunities – for entities with relevant connections to the UK. The law introduced two fundamental changes:

• A new corporate offence of ‘failing to prevent fraud’ by any of the company’s “associated persons”. This provision came into force on 1 September 2025. A statutory defence of implementing “reasonable fraud prevention procedures” applies to this offence; however, designing and properly implementing “reasonable procedures” must be done in accordance with official guidance issued by the UK government.
• Fundamental reforms to the ‘Identification Principle’ which mean that a specified range of ‘economic’ crimes committed by a “senior manager” can be prosecuted against the company. This provision came into force on 26 December 2023. However, on 29 June 2026, the Crime & Policing Act (“CPA”) expanded this aspect of the law to apply to all crimes committed by a senior manager when acting within the actual or apparent scope of their authority. It should be noted that the defence of reasonable procedures does not apply to crimes committed by senior managers.

Risks & Opportunities

The changes are relevant to organisations in a number of different ways, including how they apply to their wider group and counterparties, and how they may impact their clients, targets and investments. Auditors, bankers, investors, insurers, joint venture partners, litigation funders and regulators will be very interested in how organisations have (or have not) addressed these new risks. Competitors, whistle-blowers, investigative journalists and NGOs are also likely to take a keen interest. The law is complex, and the things that organisations must do to mitigate related risks are not straightforward. Robust and prompt engagement in responding to these changes is therefore vital.

In order to implement “reasonable procedures”, companies should undertake a formal risk assessment and ensure that policies and procedures are upgraded as soon as possible.

The definition of “senior manager” is deliberately broad and can capture individuals across functions such as legal, finance, compliance, HR, sales and marketing, regardless of job title or where they are based. With the regime continuing to expand, organisations should review who may fall within scope, assess whether existing governance structures remain appropriate and ensure that those individuals receive tailored compliance training and support. For multinational businesses with UK operations or exposure, this exercise is likely to require a cross-border assessment rather than a UK-only review.

Properly understood, the changes also present strategic opportunities for companies to use the law to their advantage. In a corporate context (e.g. M&A activity, joint ventures, fund structures and investments, restructuring and insurance), they will be relevant to the nature and extent of due diligence, assessment of risk, pricing, reps, warranties, indemnities, etc; and also pre- or post- transaction remediation, voluntary disclosures, etc.

How we can help: We regularly help organisations identify people and conduct that are in scope, conduct risk assessments, assess governance arrangements and help to design and implement practical compliance programmes aligned with the onerous provisions of ECCTA and the CPA. We can also assist with training staff, in house legal and compliance colleagues, boards and senior management.

Treat sanctions, AML and fraud as a single financial crime framework

A recurring theme throughout the discussion was that regulators increasingly expect organisations to manage sanctions, anti-money laundering and fraud risks together rather than through separate compliance functions. Recent EU and Italian developments reinforce the need for integrated screening, beneficial ownership analysis, transaction monitoring and escalation processes, particularly where businesses operate across multiple jurisdictions or complex supply chains.

The direction is clear: Italian intermediaries are expected to integrate sanctions and AML controls within a single compliance framework. AML, sanctions, proliferation-financing, fraud, cyber-enabled financial crime, crypto/CASP exposure, and beneficial-ownership controls now need to be managed as an integrated financial-crime control framework rather than as separate compliance silos.

The implication for large cross-border banks, bancassurance groups, payment institutions, CASPs, and financial conglomerates is that internal risk data, group perimeter information, customer-risk scoring, adverse findings, sanctions exposure, and transaction-monitoring outputs need to become more comparable and more auditable across jurisdictions. This is also a data challenge. AMLA readiness requires more than updated procedures. Institutions need comparable and auditable information across jurisdictions. They need to map group structure, cross-border activity, high-risk products, customer-risk scoring, sanctions exposure, crypto links, correspondent relationships, adverse findings, transaction-monitoring outputs, and control effectiveness.

The practical inconsistency is that sanctions compliance remains legally distinct from AML/CFT, but EU policy is increasingly treating sanctions evasion as a risk that must be captured through AML-style governance, monitoring, escalation, and reporting.

How we can help: We regularly assist financial institutions operating at global level in updating their sanctions and anti-financial crime programs and procedures, to make sure they are aligned with the evolving regulatory framework.

Don’t wait for an investigation to test your compliance programme

Several speakers emphasised that investigations are increasingly being used as an opportunity to evaluate the effectiveness of compliance frameworks rather than simply establish what went wrong. Organisations should therefore consider whether they could respond effectively if a whistleblower report, regulatory enquiry or internal concern arose tomorrow. This includes reviewing digital evidence protocols, preserving legal privilege where appropriate, ensuring third-party counsels and forensic providers are properly and timely engaged and testing investigation procedures before they are needed. Recent decisions from data protection authorities show how major corporation may easily incur in serious mistakes while performing internal investigations, with inadequate procedures, incomplete or lacking prior privacy notices, disproportionate data acquisitions or inappropriate formalization of forensic advisors’ engagement. For cross-border investigations, these points matter greatly. A global company may be used to broad eDiscovery, forensic imaging, legal holds, and centralized review protocols. In Italy, and more broadly in Europe, those tools must be adapted to privacy, employment, labor, secrecy of correspondence, and proportionality constraints. The right approach is to document the trigger, define the scope, justify each data source, appoint vendors properly, preserve chain of custody, segregate irrelevant private data, and anticipate later admissibility challenges.

How we can help: We can assist in preparing and conducting internal investigation compliant with local laws and regulations, preserving the effectiveness of the investigation, the possibility to rely on the evidence collected in case of dispute, and shielding the company from sanctioning proceedings for breach of privacy or labour laws. Also, conducting a privileged “health check” of investigation readiness can help organisations identify practical weaknesses before they come under regulatory scrutiny.