I can think of a couple different legal metaphors for this:
1. Something similar to banking's Know-Your-Customer could work... maybe call it Know-Your-Suppliers.
2. People are criminally liable for possessing child pornography even if they had no participation in the direct crimes of its creation. In other words: in this case there is no immunity just because the crimes happened somewhere "upstream".
For instance, how likely are your Fly-by-night employee or sub-sub-contractor to rat out the Fly-by-night? They may get a beating, their checks withheld, the Fly-by-night go under.
If it still happens, Big Publicly Listed company pays for it to go away in a settlement.
If it goes to court, they Big Company can say "we work very diligently to avoid this situation in the future and what happened is in no way indicative of our values".
Etc.
You can argue that such agencies are more likely to disregard laws and regulations, but how would you fix that? With laws and regulations?