Security Strategy
April Fools’ Day Is for Jokes, OFAC Violations Are Not
Independent schools cannot afford an April Fools approach to sanctions screening. Review the OFAC risks hiding in your daily tuition and payment workflows.
Apr 1, 2026
ReadDOJ Enforcement Case Study
March 2026 · 7-minute read
“It Can’t Happen to Us”:
The $170M AI Smuggling Scheme That Proves Why Compliance Exists
Visualization of the $170M AI hardware seizure and the "smoking gun" communications.
Many tech companies view export controls as a tedious checkbox. A recent DOJ indictment involving three conspiritors and $170M in GPUs proves that those "checkboxes" are actually your strongest shield against federal prosecution.
In the fast-moving world of Artificial Intelligence, compliance often feels like a brake on a race car. Leaders think: “We know our partners,” or “We’re just a hardware company.”
But the Department of Justice doesn’t see it that way. The recent charges against Stanley Yi Zheng, Matthew Kelly, and Tommy Shad English for conspiring to smuggle AI technology to China offer a visceral look at how "faking niceties" and ignoring "odd" signs leads to a federal courtroom.
The “Smoking Gun” Communications
According to the indictment, the conspirators were fully aware of the illegal nature of their actions. They didn't just stumble into a violation; they actively engineered a facade to bypass export controls.
SECURE_COMMS_LOG_EXHIBIT_A.TXT
[Kelly]They just need more details about your company, customers, revenue, etc... they have a nice website, company decks, quarterly earning reports, etc that are all public information.
[English]“I’m not breaking my back. I fake these weeks ago.”
[Zheng]“DO NOT MENTION ANYTHING ABOUT CHINA.”
[Zheng]“We just talk about it, no one can hold it as evidence against us.”
*Actual messages obtained through the FBI investigation and cited in the criminal complaint.
Anatomy of the $170M Smuggling Scheme
How three defendants attempted to move 1,250 high-performance servers through a web of shell companies.
The Origin
California-Based Tech
A computer hardware company and chip manufacturer were targeted for millions in GPUs.
The Front
Fake Thailand Entity
The co-conspirators used a Thailand-based shell company as the purported final end-user.
The Lie
False Certifications
Signed "Advanced Computing Certifications" claiming chips wouldn't go to embagoed nations.
The Target
Destination China
The ultimate intended destination for the diverted AI chips, in direct violation of U.S. law.
Why Compliance Won
The scheme didn't fail because the government stopped them at the border. It failed because Internal Compliance worked. The hardware company and chip manufacturer noticed several "odd" signs during their routine reviews:
Geographic Disconnect
A company purportedly based in Thailand was being managed by a contact physically located in China, a heavily restricted and embargoed country.
The CC Missing Link
When communicating about a $170M order, not a single person from the Thailand-based "buyer" was included on the email threads.
Behavioral Anomalies
The urgency and specific requests to add non-company personnel to sensitive compliance discussions raised immediate orange flags.
Verification Failure
Efforts by the chip manufacturer to verify the legitimate end-user in Thailand were met with silence and roadblocks.
The Strategic Lesson
“Compliance isn't about looking for a reason to say 'No.' It's about having the visibility to know when you're being used as a pawn in someone else's federal crime.”
If your screening process relies on manually checking a website or "knowing the guy," you are vulnerable to the $170M "fake corporate nicety." Real protection requires automated, deep-tier visibility that flags these anomalies before you sign the certification.
How to Protect Your Company
Automate Entity Verification
Move beyond "nice websites." Use automated systems that flag geographic and ownership risks in real-time.
Enforce Dual-Point Verification
Ensure that the persons paying and the persons receiving have verified, separate identities and locations.
Maintain Append-Only Logs
SecurePoint USA evidence packs record what was screened, who reviewed it, and when, so you can show the diligence you performed.
Train on "Odd" Signs
Teach your business office that compliance is a behavioral field, not just a technical one.
Visitor Compliance Planning Checklist
- Steps before the visit, at arrival and after the visit
- Approvals, escorts and who reviews possible matches
- Record-specific retention (22 CFR 122.5, 31 CFR 501.601)
Stay ahead of compliance changes
Get occasional notes on sanctions, export controls, and visitor compliance when we publish them.
No spam. Unsubscribe anytime.
Related posts
Keep exploring compliance playbooks
More guidance on sanctions, export controls, and visitor management for regulated facilities.
Compliance
Most Companies Think They Are Compliant. Auditors Disagree.
In regulated industries, compliance confidence often evaporates when auditors arrive. Learn about hidden gaps in sanctions, visitor screening, and audit trails.
Feb 4, 2026
Read
Sanctions
OFAC 50 Percent Rule for Visitor and Entity Screening
A practical guide to OFAC ownership aggregation, blocked entities, visitor screening workflows, and audit evidence for regulated facilities.
Oct 20, 2025
Read