Having a legal requirement for companies to report “suspicious” orders seems destined to fail. You receive an order for $XM in a product you sell. It looks suspicious.

You can fulfil the order and make $XM, or you can report it and get... nothing.

Now as the employee of course you want to do the right thing, so you run it up the chain. And someone says to the board “we should invest millions in better systems and people to detect suspicious orders, so that we can make less money but do the right thing”. Any wonder this didn’t happen?

The blame here seems to be with the design of the regulation/oversight. Where was the FDA/other agency reviewing a random sample of those orders and then smashing the companies for missing the suspicious ones?