FCPA, VAT & Sunshine Act — Regulatory Coverage of the Eight VeraStream Detectors
VeraStream runs the same eight production detectors against every transaction your business posts — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment and detectGhostEmployee. This page maps each detector to the FCPA, VAT and Open Payments exposure it surfaces — and names, plainly, what the detectors do not cover.
Why the coverage is asymmetric
Not every detector covers every regime — and that is the honest framing
VeraStream is a spend-side detection layer. Two of the eight detectors are FCPA-heavy by design — detectVendorRisk and detectGhostEmployee read master-data and payroll signals that map directly to third-party-payment red flags. Two more — findDuplicateInvoices and detectDuplicatePayment — carry the VAT weight: duplicate invoices posted to two tax codes, and VAT-bearing disbursements posted twice. And two — detectExpenseAnomalies and detectThresholdGaming — carry Open Payments (Sunshine Act) weight: physician / teaching-hospital anomaly patterns, and structuring below the $11.24 reportable threshold. The remaining three detective pairs bridge the regimes rather than covering all three. The Coverage Gaps section below names what the eight detectors do not cover.
FCPA exposure
Foreign Corrupt Practices Act — which detectors address it
VeraStream’s coverage is FCPA-weighted. 8 of the eight detectors carry non-empty FCPA exposure — the broadest of the three regimes. Two are FCPA-heavy by design: detectVendorRisk and detectGhostEmployee read master-data and payroll signals that tee up third-party-payment red flags. The table below pairs each FCPA-teeing detector with the exposure it surfaces and the residual gap that remains under upstream controls.
| Detector | FCPA exposure surfaced | Residual gap |
|---|---|---|
evaluatePolicy | Due-diligence policy exception — sponsorship or charitable donation paid outside the approval matrix. | Captures policy-class deviation only; partner vetting, beneficial-ownership (UBO) and OFAC sanctions screening remain upstream vendor-master controls. |
findDuplicateInvoices | Same vendor paid twice under near-miss invoice IDs — siphoning pattern. | Flags near-miss duplicate invoice IDs; does not screen for re-issued vendor aliases or restructured master-data IDs — pair with vendor-master diligence. |
detectExpenseAnomalies | One cardholder / two closenames — split-conduit indicator for off-book facilitation. | Flags split-conduit patterns; does not screen for new-cardholder issuance, weekend-only cards, or closename-vs-payroll-rbac divergence — pair with HR / payroll controls. |
detectVendorRisk | Shell-vendor heuristic — typosquatted master-data lookalike, shared bank account, single-transaction vendor with no W-9 / beneficial-owner. | Heuristic on master-data only; OFAC / sanctions screening and beneficial-ownership (UBO) verification operate upstream of the spend stream. |
detectThresholdGaming | Structuring below approval limits — sub-policy-tier sets of transfers to a single counterparty. | Detects sub-tier structuring; CTR aggregation and SAR decisioning remain your BSA officer’s responsibility (FinCEN guidance, 31 CFR 1010 / 1020). |
detectRoundDollar | Round-dollar disbursements to a near-new vendor (script pattern) — facilitation-payment indicator. | Pattern-matches round-dollar disbursements; does not catch variable-amount facilitation scripts — combine with evaluatePolicy for broader facilitation coverage. |
detectDuplicatePayment | Same third party paid twice under a near-miss vendor ID — three-party-payment red flag. | Catches two postings under near-miss vendor IDs; does not flag re-routed payments to sub-entities — combine with vendor-master diligence. |
detectGhostEmployee | Ghost payroll / shell-employee roster — common FCPA conduit for off-ledger facilitation spend. | Surfaces rooftop-payroll / shell-employee rosters; pre-hire background checks and work-authorization verification remain HR / HRIS controls. |
VAT exposure
Value-Added Tax — which detectors address it
VAT coverage is narrower — targeted at duplicate and split invoicing. 3 of the eight detectors carry meaningful VAT weight: findDuplicateInvoices, detectRoundDollar, and detectDuplicatePayment. The remaining five are FCPA- or Sunshine-Act-weighted; they do not, on their own, provide VAT line-level assurance. Use your VAT engine / ERP tax module for tax-code coverage; VeraStream surfaces the duplicate or split invoice once it lands.
| Detector | VAT exposure surfaced | Residual gap |
|---|---|---|
findDuplicateInvoices | Duplicate VAT recovery — same invoice posted to two tax codes. | Surfaces the same invoice posted to two tax codes; the underlying tax-code assignment itself is owned by your VAT engine / ERP tax module. |
detectRoundDollar | Round-dollar split invoicing to evade VAT line-level review. | Surfaces round-dollar split invoicing; does not validate partial-exemption rules or underlying VAT codes — your VAT engine owns code-level assurance. |
detectDuplicatePayment | Duplicate VAT-bearing disbursement posted twice. | Catches the same VAT-bearing disbursement posted twice; underlying VAT-code assignment is owned by your VAT engine / ERP tax module. |
Open Payments (Sunshine Act)
Open Payments — which detectors address it
Open Payments (Sunshine Act) coverage sits with 4 of the eight detectors: evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, and detectThresholdGaming. VeraStream surfaces the trigger — a transfer that crosses the reportable threshold, a structured cluster below it, or a policy-class deviation to the same covered recipient — and the CMS Open Payments submission itself remains the customer’s regulatory responsibility.
| Detector | Open Payments exposure surfaced | Residual gap |
|---|---|---|
evaluatePolicy | Transfer outside the reportable-spend policy class routed to the same covered recipient. | Captures policy-class deviation only; fair-market-value (FMV) adjudication against a physician rate card and the CMS Open Payments filing itself are downstream controls. |
findDuplicateInvoices | Duplicate reportable transfer between the same covered recipient. | Flags duplicate transfers between the same covered recipient; aggregation across HCP-year and CMS Open Payments submission are downstream reporting responsibilities. |
detectExpenseAnomalies | Anomalous physician / teaching-hospital spend — same HCP, weekend booking frequency, two cards, identical MCC. | Flags incidental HCP-spend patterns; fair-market-value (FMV) adjudication and covered-recipient roster sourcing remain upstream clinical-engagement controls. |
detectThresholdGaming | Structuring below the Open Payments $11.24 reportable threshold — clustered sub-threshold transfers to an HCP. | Detects below-threshold clustering; the CMS Open Payments $11.24 aggregation and the report submission itself are the customer’s regulatory responsibility. |
Detector → regulator (one-shot reference)
Full detector-to-regulator matrix in one glance
The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run on every transaction. An em-dash (—) in a column means the detector does not address that regime on its own. The three sections above drill into each regime; this recap rows every detector against every regime for cross-reference. Verify any non-covered regime in its native control layer. Test the detectors on your own ledger at /audit or browse /pricing to see what continuous coverage costs at your spend level.
| Detector | FCPA exposure | VAT exposure | Sunshine Act (Open Payments) |
|---|---|---|---|
evaluatePolicy | Due-diligence policy exception — sponsorship or charitable donation paid outside the approval matrix. | — | Transfer outside the reportable-spend policy class routed to the same covered recipient. |
findDuplicateInvoices | Same vendor paid twice under near-miss invoice IDs — siphoning pattern. | Duplicate VAT recovery — same invoice posted to two tax codes. | Duplicate reportable transfer between the same covered recipient. |
detectExpenseAnomalies | One cardholder / two closenames — split-conduit indicator for off-book facilitation. | — | Anomalous physician / teaching-hospital spend — same HCP, weekend booking frequency, two cards, identical MCC. |
detectVendorRisk | Shell-vendor heuristic — typosquatted master-data lookalike, shared bank account, single-transaction vendor with no W-9 / beneficial-owner. | — | — |
detectThresholdGaming | Structuring below approval limits — sub-policy-tier sets of transfers to a single counterparty. | — | Structuring below the Open Payments $11.24 reportable threshold — clustered sub-threshold transfers to an HCP. |
detectRoundDollar | Round-dollar disbursements to a near-new vendor (script pattern) — facilitation-payment indicator. | Round-dollar split invoicing to evade VAT line-level review. | — |
detectDuplicatePayment | Same third party paid twice under a near-miss vendor ID — three-party-payment red flag. | Duplicate VAT-bearing disbursement posted twice. | — |
detectGhostEmployee | Ghost payroll / shell-employee roster — common FCPA conduit for off-ledger facilitation spend. | — | — |
Where the coverage stops
Coverage Gaps — what VeraStream's eight detectors do not cover
The detectors do not replace upstream controls, attestations, or regulator-filed submissions. They are a spend-side detection layer that fires on every transaction. The following items are out of scope — operate them in their native system, and run VeraStream alongside.
Anti-bribery training / FCPA annual certification attestation
The detectors surface a control failure once a transaction posts, but they do not track who has completed annual FCPA training or who has signed the attestation. Operate your anti-bribery training attestation in your LMS (or your HRIS) — VeraStream does not generate per-employee compliance evidence.
OFAC / sanctions-list screening
Sanctions screening at master-data write time is an upstream control — VeraStream verifies downstream behavior. Run OFAC / SDN / EU sanctions lookups in your vendor master or sanctions-screening tool before a vendor reaches the spend stream.
Beneficial-owner / UBO registry verification
No detector reads a UBO registry. Confirm beneficial-ownership disclosure (FinCEN BOI, MRRT, equivalent foreign regimes) at the master-data record layer, then let the detectors surface the spend anomaly if the vendor later behaves off-policy.
Bank Secrecy Act — automatic CTR / SAR filing
VeraStream is an internal-audit intelligence layer, not a BSA filing engine. Threshold-structuring detections are signal only; your BSA officer remains responsible for CTR aggregation and SAR decisioning (FinCEN guidance, 31 CFR 1010 / 1020).
Transfer-pricing / intercompany agreement review
Cost-allocation and intercompany invoicing need arm's-length documentation; the detectors do not opine on whether an intercompany price is defensible. Use a transfer-pricing workpaper (or your tax provider) alongside any intercompany anomaly the detectors flag.
CMS Open Payments general-transfer reporting submission
VeraStream surfaces the trigger — a transfer that crosses the Open Payments $11.24 reportable threshold, or a structured cluster below it. Filing the report to CMS Open Payments remains your regulatory responsibility. The detector is the early-warning system; the submission is yours.
Clinical-trial FMV adjudication / spend-cap logic
The detectors flag spend anomalies, not fair-market-value adjudication against a pre-baked physician rate card. Use your FMV database (or your clinical engagement tool) to adjudicate whether an HCP payment sits inside the agreed rate band; rely on VeraStream to surface the anomaly once it does not.
Frequently asked
Common questions from compliance, internal-audit and finance teams
What the eight detectors address across the three regulatory regimes — plain HTML answers, no JavaScript required to read.
What FCPA exposure do the eight VeraStream detectors address?
The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run on every transaction. For FCPA, the teeing detectors are evaluatePolicy (due-diligence exception — a sponsorship / charitable donation routed outside the approval matrix), findDuplicateInvoices (same vendor paid twice under near-miss invoice IDs — a siphoning pattern), detectExpenseAnomalies (one cardholder / two closenames — a split-conduit indicator), detectVendorRisk (shell-vendor heuristic — typosquatted master-data, shared bank account, single-transaction vendor with no W-9 / beneficial-owner), detectThresholdGaming (structuring below approval limits — sub-policy-tier sets of transfers to a single counterparty), detectRoundDollar (round-dollar disbursements to a near-new vendor — facilitation-payment script), detectDuplicatePayment (same third party paid twice under a near-miss vendor ID) and detectGhostEmployee (ghost payroll / shell-employee roster — off-ledger facilitation conduit).
What VAT exposure do the eight detectors address?
Three VeraStream detectors carry meaningful VAT weight: findDuplicateInvoices (duplicate VAT recovery — the same invoice posted to two tax codes), detectRoundDollar (round-dollar split invoicing designed to evade VAT line-level review) and detectDuplicatePayment (duplicate VAT-bearing disbursement posted twice). The remaining five detectors are FCPA- or Sunshine-Act-weighted; they do not, on their own, provide VAT line-level assurance. Use your VAT engine / ERP tax module for tax-code coverage; VeraStream surfaces duplicate or split invoicing once it lands.
What Open Payments (Sunshine Act) exposure do the eight detectors address?
For Open Payments, the teeing detectors are findDuplicateInvoices (duplicate reportable transfer between the same covered recipient), detectExpenseAnomalies (anomalous physician / teaching-hospital spend — same HCP, weekend booking frequency, two cards, identical MCC), detectThresholdGaming (structuring below the Open Payments $11.24 reportable threshold — clustered sub-threshold transfers to an HCP) and evaluatePolicy (a transfer routed outside the reportable-spend policy class to the same covered recipient). VeraStream surfaces the trigger; the CMS Open Payments reporting submission is the customer's regulatory responsibility.
Where are the coverage gaps — what the detectors do not cover?
The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run on every transaction., but they do not replace upstream controls. VeraStream does not perform anti-bribery training verification or annual FCPA attestation, OFAC / sanctions-list screening, FinCEN beneficial-ownership (UBO) verification, automatic CTR / SAR filing workflows, transfer-pricing / intercompany agreement review, the actual CMS Open Payments submission (it surfaces the trigger — you file), or clinical-trial fair-market-value (FMV) adjudication against a physician rate card. Operate those controls in their native system and let VeraStream surface spend-side behavior that drifts.
Test it on your own ledger
See what the eight detectors surface on your FCPA, VAT and Open Payments exposure
Drop a CSV in the in-browser audit, or book a walkthrough and run VeraStream against your actual spend — every detector fires on the same population, every finding ships with its workpaper, and the coverage gaps above are surfaced plainly rather than papered over.