With a new US presidential administration has come a modest recalibration of enforcement priorities and policies, but there has been little evidence of a significant shift in the sustained trend over the past decade of aggressive US criminal and regulatory enforcement activity against corporations and their directors, officers and employees. Eight-, nine- and even 10-figure monetary penalties continue to be the norm on a number of enforcement fronts, and aggressive investigations and prosecutions of individuals engaged in corporate misconduct are launched weekly, it seems. In the environmental law and consumer fraud arena, Volkswagen reached an agreement with regulators in 2017 requiring it to pay more than US$4 billion in criminal and civil penalties in connection with allegations that it sold cars with 'defeat devices' intended to circumvent emissions testing and environmental regulations. Several former Volkswagen executives and employees, including the former chief executive officer (CEO), were criminally charged for their role in the conspiracy, one of whom was sentenced in December 2017 to seven years in prison; this is in keeping with the more aggressive stance by the Department of Justice (DOJ) in recent years in pursuing and obtaining guilty pleas from individuals implicated in corporate misconduct. In 2019, the DOJ and Attorney General of California reached a US$500 million civil settlement with Fiat Chrysler for similar conduct, and reports indicate that criminal and civil authorities in the United States and abroad are continuing to investigate Fiat Chrysler and other automakers for potential violations of vehicle emissions rules.
In the financial sector, regulators continue actively to investigate currency and interest rate manipulation. In addition to obtaining guilty pleas and substantial monetary penalties from financial institutions, the DOJ has continued to pursue charges against individuals; for example, in June 2018, Société Générale entered into a deferred prosecution agreement with the DOJ and paid a US$275 million fine for manipulation of LIBOR. In October 2018, the DOJ secured a guilty verdict against two former Deutsche Bank derivatives traders on charges of conspiring to manipulate LIBOR, although in that same month, a federal jury acquitted three former foreign exchange traders from Barclays, Citigroup and JPMorgan of charges of conspiring to fix daily benchmark rates on foreign exchange spot markets. Additionally, Wells Fargo was fined US$1 billion in April 2018 by the Bureau of Consumer Protection and the Office of the Comptroller of Currency for violations relating to the bank's auto loan and mortgage practices, and in December 2018, Wells Fargo agreed to pay $575 million to resolve investigations by all 50 US states and the District of Columbia for a range of sales and other practices.
On the foreign bribery front, after a pause in the announcement of new settlements following the presidential transition, enforcement resumed at a rapid pace with the DOJ and Securities and Exchange Commission (SEC) imposing approximately US$2.9 billion in penalties during 2018 for violations of the FCPA,2 with major settlements announced in early 2019 as well. Significantly, US regulators continued to target non-US companies and individuals suspected of anti-corruption violations, often with the cooperation of foreign governments and regulators. For example, last year's record-setting Petrobas anti-corruption settlement, which resulted in the imposition of more than US$1.78 billion in criminal fines, penalties and forfeiture, was the result of an investigation conducted jointly by authorities in the United States and Brazil. Similarly, the recent US$585 million corruption settlement with Société Générale to resolve bribery allegations relating to improper payments in Libya was coordinated among US and French authorities, and the DOJ credited the bank with over US$292 million for payments made to French prosecutors to resolve the investigation. Likewise, in the US$850 million corruption settlement with Mobile Telesystems and its Uzbekistan-based subsidiary in March 2019, the DOJ acknowledged the assistance of law enforcement authorities in more than a dozen countries.3 While the DOJ and SEC have been responsible for the largest FCPA-related settlements to date, in 2019, the US Commodity Futures Trading Commission (CFTC) announced its intention to bring enforcement actions in foreign corruption cases where the underlying conduct related to CFTC-regulated activities, such as commodities contracts. The CFTC advised, however, that it would not 'pile onto' penalties imposed by other agencies and would, when imposing penalties for commodities-related violations of the FCPA, provide 'dollar-for-dollar credit' for disgorgement or restitution paid to other agencies. Shortly after the CFTC's announcement, the mining and natural resources company Glencore disclosed that the CFTC and DOJ were investigating it for potential bribery in Nigeria, the Democratic Republic of Congo and Venezuela.
The statutes authorising these prosecutions represent just a sliver of the interlocking regulatory and legal regimes in the United States, in which companies must comply with numerous regulations and statutes or face criminal or civil sanctions. There is no shortage of regulatory agencies empowered to take action in the event of a compliance lapse. The most prominent of these include the DOJ, the SEC, the Internal Revenue Service (IRS), the Environmental Protection Agency (EPA), the CFTC, the US Departments of Commerce, Labor and the Treasury, the Federal Energy Regulatory Commission, the Occupational Safety and Health Administration, and banking regulators such as the Federal Reserve and the New York State Department of Financial Services (DFS). Many of these agencies are empowered to commence formal investigations and enforcement proceedings on their own initiative and impose monetary sanctions or other penalties.
Still, the DOJ, which is charged with prosecuting corporate crimes such as money laundering, bribery and tax fraud, is uniquely formidable among the agencies because of its power to indict and prosecute criminally, the threat of which has remained an important method of ensuring corporate compliance during the past decade. This is demonstrated not only by the passage of the 2002 Sarbanes-Oxley Act and the expansion of corporate criminal statutes, but also by the contemporaneous revision of the United States Sentencing Commission's (USSC) Organizational Guidelines to impose harsher penalties for corporate malfeasance.
For large-scale corporate investigations and prosecutions, however, the DOJ frequently coordinates with other federal agencies, as well as state and local authorities. For example, the 2017 Volkswagen settlement resulted from an investigation that was closely coordinated between the DOJ and the EPA, and, in recent years, the DOJ has worked closely with the IRS's Criminal Investigative Division to investigate and charge Swiss banks with facilitating tax fraud by US taxpayers, including obtaining a guilty plea and a US$2.6 billion fine from Credit Suisse for charges of criminal tax evasion. The DOJ has also partnered with the Department of Health and Human Services to combat financial fraud in federal and state healthcare programmes, and announced in September 2018 a US$260 million settlement with Health Management Associates for criminal and civil charges concerning overbilling government healthcare programmes and alleged kickbacks to physicians.
The DOJ has also pursued enforcement actions against a number of international financial institutions in recent years for the failure of anti-money laundering controls and for processing transactions on behalf of parties subject to US economic sanctions administered by the Office of Foreign Assets Control (OFAC) of the US Treasury Department.4 In 2012, Standard Chartered paid US$340 million to the New York State DFS and US$227 million to the DOJ, the New York County District Attorney's Office and other federal regulators to resolve charges stemming from payments and trade business with sanctioned parties. HSBC paid a then-record US$1.9 billion in late 2012 for failures in its anti-money laundering programme and its own business with sanctioned parties; BNP Paribas paid a US$8.9 billion fine for similar conduct in 2014; and Commerzbank AG paid a total of US$1.45 billion in March 2015. In 2018, US Bancorp agreed to pay US$613 million in penalties to authorities for deficiencies in its anti-money laundering programme, which resulted in suspicious activity going unreported. And in April 2019, Standard Chartered paid US$1.1 billion to US and UK authorities, and UniCredit paid US$1.3 billion to US authorities, to resolve investigations into their compliance with US sanctions laws. The DOJ investigations in this regard have been conducted in conjunction with the New York County District Attorney's Office, OFAC and the US bank regulatory agencies, in addition to global regulators such as the UK Financial Conduct Authority. Cooperation between federal agencies and state and local authorities has become more common, with various 'task forces' created to coordinate the agencies' efforts; this includes the financial fraud enforcement task force, which was set up by the Obama administration and brings together representatives from various agencies and state and local authorities to take action against financial fraud, with a recent special focus on corporate entities engaged in mortgage-related fraud.
A corporation facing a criminal investigation by the DOJ or other agencies typically feels great pressure to avoid an indictment, which carries the risk of severe reputational, legal and regulatory consequences (even apart from the potential criminal penalties such as fines, forfeiture, disgorgement of unlawful profits and restitution). For many companies, particularly highly regulated ones, a mere indictment – even before conviction – can have severe reputational effects, and disastrous consequences for a company's stock price and its ability to seek funding in the capital markets. Moreover, corporations in certain industries, such as companies that serve as government contractors for the Department of Defense or participate in the federal government's Medicaid and Medicare programmes, can face crippling suspension upon the filing of charges and mandatory exclusion from the programmes if ultimately convicted. The collateral consequences of a corporate criminal investigation and prosecution may not be reversible even if the company is vindicated on appeal. For example, Arthur Andersen, an 89-year-old firm with 85,000 employees, implicated in the Enron accounting fraud, suffered severe damage to its reputation after being indicted by the DOJ and lost its licence to audit public companies after being convicted of felony obstruction of justice. Although that conviction was overturned by the Supreme Court, the firm had already suffered irreparable harm and had by that time ceased to function as a viable business. It is therefore not surprising that most companies facing regulatory investigations cooperate as fully as possible in the hope of avoiding formal charges and frequently self-report potential wrongdoing in which the company or its employees may be implicated.
Most federal enforcement agencies5 have published official policies emphasising the importance of voluntary disclosure and full cooperation in an investigation, and pledging to take into account any disclosure or cooperation (or lack thereof) in determining whether to bring an enforcement action and what kind of penalties to seek. The USSC Organizational Guidelines also explicitly provide for reduced sentences for companies that provide 'timely and thorough cooperation', where 'timely' is defined as 'begin[ning] essentially at the same time as the organization is officially notified of a criminal investigation'.
In some cases, the benefits of self-reporting and cooperation are unambiguous. The Department of Defense, for instance, will not pursue suspension or debarment sanctions against companies that self-report and cooperate, and the Antitrust Division of the DOJ offers full amnesty to the first company involved in an antitrust cartel that comes forward to voluntarily disclose its participation, makes restitution to victims of the cartel, and cooperates in the investigation and prosecution of other culpable companies. The cooperating company's directors, officers and employees will also receive amnesty if they are willing to cooperate in the investigation.
In most other settings, however, voluntary disclosure and cooperation are just two of many factors that regulators and prosecutors promise to 'take into account' in their charging calculus, without specific guidance as to how much weight each will be accorded in relation to other factors affecting the charging decision. For example, both the DOJ and the SEC have explicitly included voluntary disclosure and cooperation in their respective official enforcement policies, and in the DOJ and SEC's 2012 FCPA resource guide, as factors to be weighed. High-ranking representatives from these agencies have made various other public pronouncements regarding the importance of voluntary disclosure and are quick to cite examples of companies that were purportedly spared severe sanctions after disclosing and cooperating fully. In spite of these assurances, however, it is difficult to isolate any quantifiable benefit that can be attributed to voluntary reporting as opposed to other factors because of the lack of visibility in the regulators' decision-making process and the multitude of factors that affect both the decision to charge and the severity of the ultimate penalty imposed. Given the regulators' clear interest in having companies come forward on their own initiative to disclose wrongdoing, thereby avoiding the burden of independently detecting illicit activity, companies may have good reason for some degree of scepticism of the professed benefits of self-disclosure.
In apparent response to criticism regarding the uncertain benefits of self-reporting and cooperation in the FCPA context, the DOJ implemented a pilot programme in April 2016 with the aim of providing additional guidance for prosecutors investigating FCPA violations and motivating companies to disclose potential FCPA violations. The pilot programme expanded upon prior DOJ guidance by articulating the specific requirements that companies must satisfy to be eligible for reductions in penalties as a result of voluntary disclosure, cooperation with the DOJ and remediation (i.e., the implementation of effective FCPA compliance controls), and quantifies the potential reduction in fines for which a qualifying company may be eligible: up to 50 per cent off the minimum USSC Organizational Guidelines range if the target company fully complies with the criteria set out in the announcement. In November 2017, the DOJ announced a new corporate enforcement policy intended to expand and replace the pilot programme. This includes a new presumption that the DOJ will decline to prosecute if a company satisfies the policy's requirements for voluntary self-reporting, cooperation and timely remediation (though the company will still be required to disgorge any ill-gotten gains), and in March 2019, the DOJ clarified that a company could still obtain the benefits of this policy even if 'aggravating factors', such as the involvement of senior management in the underlying misconduct, were present if the company's actions were 'otherwise exemplary'. In 2018, the DOJ announced that it was informally expanding this policy outside the FCPA context.
Even with this additional guidance from the DOJ, however, it is not completely clear that voluntary reporting should be the default action of every company that discovers potentially unlawful conduct within its organisation; at the very least, the company should assess the probability of independent discovery of the potential misconduct by government authorities. It is important to note, however, that the likelihood that a government agency will independently become aware of an impropriety has increased significantly in recent years as a result of the general upturn in regulatory enforcement activity, the expansion of international cooperation and the proliferation of new laws and regulations favourable to whistle-blowers.
A corporation must, of course, first determine whether it has a mandatory legal obligation to disclose potential wrongdoing that it discovers. For example, financial institutions may be obliged to report suspicious activity. Sarbanes-Oxley also imposes numerous compulsory reporting requirements on companies should they discover certain types of fraud and other misconduct. Because many of the regulators have information-sharing agreements or otherwise coordinate their actions, if a company decides to self-report, it is also prudent to make the disclosures to all potentially related agencies. This is to ensure that the company receives credit for self-reporting from each regulator that could potentially bring an enforcement action.
In determining whether to self-report, and to what extent to cooperate with a regulatory investigation, corporations and their employees also must bear in mind that should they be deemed to be impeding or obstructing the investigation, in addition to charges relating to the conduct under investigation, they may potentially face charges of obstruction of justice or conspiracy to commit obstruction of justice. These charges are typically much easier to prove than charges stemming from the underlying conduct being investigated and can carry penalties that are equally, or more, severe. Under Sarbanes-Oxley, for example, an individual can face up to 20 years in prison for altering or falsifying documents with the intention of obstructing a federal investigation and a company can face substantial fines for this conduct. In recent years, the DOJ has not hesitated to seek such penalties against companies and employees that are perceived to be uncooperative or evasive, and the SEC and other agencies have been known to refer reports of obstructive conduct during civil enforcement actions to the DOJ for criminal prosecution. For instance, in February 2018, Rabobank agreed to forfeit US$369 million and pleaded guilty to obstructing an investigation into deficiencies in the bank's anti-money laundering compliance programme conducted by Rabobank's primary regulator, the Office of the Comptroller of the Currency of the US Treasury Department.
ii Internal investigations
In conjunction with disclosing potentially improper conduct to the government, a corporation will typically undertake an internal investigation, either on its own initiative or with the encouragement of the relevant government agency, to determine whether unlawful activity has in fact occurred and, if so, which employees are responsible. There are several important reasons for conducting such an investigation. First, a full understanding of the facts can be crucial to mounting a defence in any adversarial proceedings that might arise with government authorities or in any private civil suits that might be filed. Second, by conducting an internal investigation and disclosing important information gleaned from a review of documents and employee witness interviews to federal agencies, a corporation may be more likely to receive credit for cooperation and thereby decrease its risk of indictment and the imposition of severe penalties. Finally, simply as a matter of good corporate governance, it is important for the corporation to be confident that it has accurately determined which employees were responsible for the unlawful activity and to ensure that it has implemented adequate controls to prevent any recurrence of the wrongdoing.
Even if a company has not yet made the decision to report potentially unlawful conduct to a regulator, it still might have cause to conduct an internal investigation after, for example, (1) receiving a tip about fraudulent activity on a dedicated company hotline, (2) receiving information from an internal or external auditor about a potential compliance issue, or (3) being named in a civil suit by a former employee containing allegations of improper conduct on the part of the company. Further, because Sarbanes-Oxley requires companies to implement systems for the reporting of complaints by employees relating to accounting or auditing matters, and to conduct investigations in response to a wide range of concerns, companies are more likely than ever before to encounter situations in which the prudent course of action is to initiate an internal investigation.
It is generally advisable to have counsel supervise such investigations because of the likelihood that legal questions and issues will arise, although whether it is necessary to retain an outside law firm will depend on the company's assessment of various considerations. In-house counsel may have the advantage of a more intimate understanding of the company's operations and culture, while external counsel may have more experience conducting internal investigations and dealing with government agencies. In-house counsel's familiarity with the company can also be a weakness if it is perceived by the government to undermine its objectivity, in which case the company may have more credibility in interacting with the government if it retains reputable external counsel. This is especially likely to be the case, of course, if any members of the company's legal department are implicated in the conduct under investigation.
With respect to the conduct of these investigations, typically there are two primary components: review and analysis of relevant documents, and interviews with company employees who have knowledge of the relevant facts. Generally, documents are gathered and reviewed prior to conducting interviews, which allows the interviewer to focus on key issues or questions discovered during the course of the document review, or to seek clarification on potentially inculpatory or troubling statements contained in those documents. At the outset of each interview, the standard practice is to notify the employee that the attorney conducting the interview is counsel to the company and not the interviewee's personal attorney, and that while the conversation is protected by attorney–client privilege, that privilege belongs to the company, which it may waive at its sole discretion. The interviewee should also be informed that any information imparted during the interview may be shared with government authorities.
Unless it has not previously made any disclosures to the government and uncovers nothing to merit any disclosure during the course of the internal investigation, a company will typically present its findings to the government after completing the document review and interviewing process, or – for a particularly complex investigation – at the conclusion of some segment of that process. Those presentations can be made orally or in written form, in response to which the government may identify additional areas of concern that require follow-up work. The government and counsel may then engage in dialogue regarding whether criminal or civil charges are warranted – and what kind – and how much credit to give to the company for its cooperation. In making its case for leniency, it may be effective for a company to argue not only that the facts uncovered do not amount to actionable misconduct, but also, from a policy perspective, that the relevant agency's objectives would not be advanced by pursuing an enforcement action against the company. A company should also consider reviewing the agency's published charging guidelines (such as the DOJ's guidelines for the prosecution of business organisations) to support an argument that an enforcement action is not warranted or that the situation calls for reduced charges; for example, by emphasising (1) that senior management was not implicated in the wrongdoing and, therefore, the misconduct was not pervasive, (2) that the company has no history of related misconduct or (3) that the collateral consequences of enforcement would be unjustifiably severe.
Whether conducted by in-house or outside counsel, a significant amount of attorney–client privileged information and attorney work-product material will be generated during the course of an internal investigation. Until recently, the DOJ expected that a corporation would waive attorney–client privilege and provide all requested materials and information if the company wished to be given credit for cooperation. There was significant criticism of this policy from the corporate sector, the defence bar and various members of Congress. In response, the DOJ has revised its policy and now categorically directs prosecutors not to seek a waiver of privilege and prohibits prosecutors from taking waiver into account when making a cooperation determination. The current policy does, however, allow prosecutors to consider the extent to which the company has disclosed all 'relevant facts'. Therefore, despite the government's assurances that waiver is not necessary to obtain credit for cooperation, a company may find that it is not possible to make a full disclosure of the 'relevant facts' without turning over privileged materials. Other agencies, such as the SEC, have published similar policies, and in recent years, some courts have held that oral summaries of witness interviews offered by companies to regulators as part of their cooperation constituted a waiver of the attorney–client privilege and attorney work-product protections over interview notes and memoranda prepared by company counsel.
The probability of a US company facing a whistle-blower complaint increased significantly with the implementation of the whistle-blower provisions of the Dodd–Frank Wall Street Reform and Consumer Protection Act, which came into effect in 2011 and authorises the payment of rewards of between 10 and 30 per cent of judgments over US$1 million by the SEC to whistle-blowers who alert the SEC to certain types of wrongdoing and that result in successful enforcement actions. The new whistle-blower rules expand the already far-reaching protections for whistle-blowers created by Sarbanes-Oxley and the False Claims Act, including extending Sarbanes-Oxley whistle-blower coverage to employees of non-public subsidiaries of publicly traded companies. According to its annual report to Congress on the programme at the end of 2017, the SEC has received more than 22,000 tips since it was introduced in 2011, and has paid several substantial bounties to whistle-blowers who have given information leading to successful prosecutions. For example, in 2018, the SEC paid more than US$50 million to two whistle-blowers who jointly provided information leading to a successful enforcement action – the largest award to date – and has issued awards totalling more than US$300 million since the inception of the agency's whistle-blower programme, including several multimillion-dollar awards.
Given this new regulatory regime, a company must now proceed with even greater caution when confronted with allegations of misconduct by a whistle-blower. Any credible tips describing potential illegal acts should be investigated promptly and thoroughly, with the assistance of outside counsel if necessary. If the company determines that the allegations have merit, it should take swift remedial action and consider self-reporting its findings to interested regulators. By no means should a company take any action that might be perceived as retaliation against the whistle-blower, as such behaviour could potentially expose the company to substantial civil or criminal liability. In 2017, the CFTC amended its whistle-blower programme rules to strengthen protection for corporate whistle-blowers. The SEC continues to take aggressive action against companies perceived to be taking adverse action against whistle-blowers or attempting to frustrate or interfere with their protection and rights. For example, in 2017, the SEC fined the financial services company HomeStreet, Inc US$500,000 for attempting to uncover the identity of a whistle-blower after being contacted by the SEC in connection with an investigation and for including provisions in severance agreements with former employees, causing those employees to waive severance payments if they receive a whistle-blower award.
i Corporate liability
Because of the way in which the doctrines of corporate criminal and civil liability have evolved in the United States, prosecutory and regulatory agencies have considerable leverage over business organisations. Generally speaking, companies are liable for the actions of employees if the employees' conduct is 'within the scope of their employment' and they act at least in part with 'the motive of benefiting the company'. These two qualifiers have been interpreted to place little meaningful limit on a company's potential exposure. For example, corporations have been held liable where the wrongdoing at issue benefited only the employee and was perpetrated in violation of the company's explicit instructions. Moreover, it is irrelevant where the culpable employee falls on the corporate ladder; legally speaking, the conduct of a post room clerk is imputed to the company to the same extent as the company's CEO. Further, under the collective liability or collective scienter doctrine, a company may be liable – particularly in the civil context – if its employees, when considered in the aggregate, possessed sufficient knowledge and intent to violate the law, even if no single employee had the requisite mental state or corrupt intent. While some courts have limited the application of this doctrine in recent years, it can still be an attractive option for a regulator bringing, for example, a complex securities fraud case against a huge, decentralised company.
Regulators have a vast arsenal of potential sanctions to impose on corporations convicted of a statutory violation. Among other potential penalties and sanctions, various regulatory statutes authorise criminal or civil fines (or both), restitution, disgorgement, criminal forfeiture, probation and community service.6 Further, as mentioned above, the collateral consequences of a conviction can be just as damaging, potentially resulting in suspension or debarment from eligibility for government contracts, reputational harm and a drop in the company stock price. Moreover, corporate investigations often involve multiple regulators with overlapping jurisdiction, raising the possibility that the corporation will face substantial penalties imposed by numerous authorities for the same underlying misconduct. Responding to concerns about 'unfair duplicative penalties', informally referred to as 'piling on', in May 2018, the DOJ announced a new policy encouraging coordination by the DOJ with other US and international law enforcement agencies conducting investigations of the same conduct to avoid 'disproportionate enforcement of laws by multiple authorities'. Although the full impact of this policy has yet to be seen, there have been encouraging signs in recent settlements that the DOJ is taking steps to reduce 'piling on', such as the June 2018 Société Générale settlement described above and the April 2019 Standard Chartered settlement in which the DOJ agreed to credit US$240 million for payments made to various US and UK authorities.
In the past, most corporate criminal investigations have ended with the two sides entering into a deferred prosecution agreement (DPA) or non-prosecution agreement (NPA), though there has been a marked increase in guilty pleas to resolve DOJ actions in more recent years, as noted above. The typical DPA provides that the agency will file formal charges, which will be stayed for a period of time (usually between one and three years), after which the charges will be dismissed if the company has complied with certain obligations. These obligations typically require the company to: cooperate fully with the agency's investigation and in any other investigation that may be ongoing; accept responsibility for the wrongdoing at issue; and undertake remedial action, including terminating or disciplining culpable employees, implementing revised internal controls and procedures and, in some cases, appointing an independent compliance monitor. The company also normally agrees to a monetary penalty, including a criminal or civil fine, forfeiture, restitution or disgorgement of unlawful profits. NPAs require similar types of performance on the part of the company but do not involve the formal filing of charges with a court. In both types of agreement, because the company has admitted to the conduct at issue (which is typically set forth in an agreed 'statement of facts' attached to the agreement), if a company is indicted upon breach of the agreement, conviction is almost certain. Previously, DPAs and NPAs were the exclusive domain of the DOJ, but the SEC has also recently adopted their use.
iii Compliance programmes
Not only do DPAs typically require the implementation of an effective compliance programme or the improvement of an existing one, the existence of an effective compliance programme is also a factor that the DOJ and other regulators take into account in making their charging decisions and may lead to a reduced sentence under the USSC Organizational Guidelines. The Guidelines provide guidance on the characteristics of a compliance programme that will be looked upon favourably by the government, which include:
- management that is knowledgeable about and able to oversee the programme competently;
- adequate staffing of the programme;
- training for all employees in compliance standards and procedures;
- procedures for monitoring and periodic auditing of the programme's effectiveness;
- a system for the anonymous or confidential reporting of compliance breaches;
- consistent enforcement of the programme; and
- procedures for taking 'reasonable steps' to prevent further wrongful conduct if any is detected.
In 2010, the USSC revised its commentary to note that as part of the 'reasonable steps' to prevent the recurrence of wrongful conduct, a company should pay restitution to any victims that can be identified. The USSC further stated that the hiring of an 'outside professional adviser' to oversee the implementation of the compliance programme could also be considered a 'reasonable step'. This has led to speculation that the hiring of an outside consultant by the company may vitiate the need to impose an independent compliance monitor on a company as part of a regulatory settlement, which until very recently was a common requirement of a DPA or NPA, but was also a practice that had come under criticism for being unduly disruptive to the company and excessively remunerative to the monitors themselves.
In recent years, there has been a trend towards self-monitoring and reporting rather than the imposition of an independent monitor as a standard feature of a settlement agreement. However, there was a resurgence of the imposition of outside monitors in 2016, with regulators imposing eight independent compliance monitors in connection with FCPA settlements, although no compliance monitors were imposed by the DOJ in FCPA corporate enforcement actions settled in 2017.
In October 2018, the DOJ announced new guidance setting forth factors the DOJ will evaluate in determining whether to impose a compliance monitor as part of a settlement with a corporation. These factors focus on the nature of the misconduct, the extent and effectiveness of the corporation's remediation, and the potential monetary costs and burdens on the corporation's operations. The effect of this guidance remains to be seen, but in early 2019, the DOJ imposed compliance monitors as part of its FCPA settlements with Mobile Telesystems Pjsc and Fresenius Medical Care AG, demonstrating that compliance monitors are likely to remain a component of corporate resolutions going forward. Finally, in May 2019, the DOJ published extensive guidance on the factors it will consider in evaluating a corporate compliance programme in connection with determining the appropriate charging decision or form of resolution, the amount of monetary penalty and whether to impose a compliance monitor or other compliance obligations on a company. The guidance sets forth numerous examples of questions that prosecutors could ask a company in order to understand three 'fundamental' issues: whether the company's compliance programme is well-designed, whether it is being implemented 'earnestly and in good faith' and whether it works 'in practice'.
iv Prosecution of individuals
The question often arises during the course of a regulatory investigation of whether it is appropriate for a corporation to enter into a joint defence agreement with employees who are also under investigation. The DOJ's official position is that the government may not consider such an arrangement in determining whether a corporation has cooperated with the investigation. However, as with the issue of waiver of privilege, the DOJ has qualified this position by noting that to the extent that such an agreement limits the company's ability to disclose 'relevant facts', it may adversely affect the ability of the company to obtain credit for cooperation. Moreover, because various agency policies, and the USSC Organizational Guidelines, encourage corporations to cooperate fully in the prosecution of employees accused of wrongdoing, in many situations the risk of a conflict of interest between the company and its employees may preclude the possibility of entering into a joint defence agreement. Conflicts of interest are more likely than ever to arise as, in recent years, the government has been increasingly aggressive in pursuing individuals suspected of corporate malfeasance, and the DOJ has publicly announced that it favours prosecution of individuals over entities where feasible. For example, in October 2015, the DOJ issued the 'Yates Memo', which calls for more focus on individual defendants by prosecutors, states that credit for cooperation by companies will henceforth be contingent on disclosing 'all relevant facts' regarding individuals in the misconduct and prohibits the resolution of any corporate action without a 'clear plan to resolve related individual actions'. In 2018, the DOJ, under the new administration, relaxed the requirements of the Yates Memo to some extent, clarifying that a company may be eligible for at least partial cooperation credit if it makes good faith efforts to identify individuals 'substantially involved' in misconduct, even if the corporation is unable to identify 'all relevant facts' about individual misconduct. Notwithstanding this change, the DOJ is unlikely to reduce its focus on individual prosecution, especially given numerous public comments by DOJ officials emphasising individual accountability for corporate crimes.
A discrete but related issue is the advancement or payment by a company under investigation of fees for attorneys for employees implicated in the wrongdoing at issue. While the DOJ's stance until recent years, as with waiver of privilege, was that advancing such fees would weigh against a corporation in the DOJ's cooperation determination, the government has now reversed that position, in part because of the ruling by the United States Court of Appeals for the Second Circuit in United States v. Stein.7 In that case, the court upheld a trial court ruling that the DOJ had violated the Fifth and Sixth Amendment rights of certain KPMG employees when it communicated to KPMG that it would not look favourably upon the advancement of fees to employees incriminated in the accounting scandal for which KPMG was under investigation, despite KPMG's historical practice of paying for its employees' fees in such situations. At the same time as this decision, the DOJ announced that it would no longer consider advancement of fees as a factor influencing its cooperation determination, though it noted that the failure to terminate or adequately discipline employees would still be a consideration when making its indictment decision. Other agencies, such as the SEC, have not taken a clear stance with respect to this issue.
i Extraterritorial jurisdiction
Now more than ever, federal agencies are taking an expansive view of their statutory jurisdiction and aggressively pursuing foreign companies for violations of domestic law. This trend is evident in a variety of contexts. For example, in recent years the SEC has pursued a number of China-based issuers of US securities (as well as their auditors and accountants) for alleged financial fraud. Also, in the FCPA context, a significant number of enforcement actions during the past three years – including many of the higher-value settlements – targeted foreign companies and individuals. While the FCPA applied only to issuers of stock on a US exchange when originally enacted, the statute now proscribes corrupt payments by any person, natural or otherwise, where relevant acts occur 'in the territory of the United States'. Regulators have at times pushed the boundaries of this language, asserting jurisdiction, for example, based on the fact that a transaction at issue was cleared through a US bank, even though no employee of the target entity took any action while physically present in the United States. Moreover, even where that minimum territorial connection is not met, the government has not hesitated to stretch traditional legal doctrines to assert jurisdiction, for example by charging a foreign subsidiary with 'aiding and abetting' a violation by its US parent or for making an improper payment as the 'agent' of a US company. While a small number of court decisions have pushed back on the regulators' most aggressive attempts to extend jurisdiction, the significant expense and risk associated with litigating an FCPA action has resulted in few FCPA cases reaching the courtroom and therefore few legal or practical constraints on the extraterritorial reach of the FCPA.
Other countries have begun to look beyond their shores to target illegal conduct by corporations. For example, while previously criticised for its inaction in the foreign corruption arena, the United Kingdom enacted enhanced anti-bribery laws that came into effect in 2011. The law has an expansive jurisdictional scope that may exceed even that of the FCPA, theoretically allowing the UK government to assert jurisdiction over any company that does business in the United Kingdom, even if the conduct at issue occurred elsewhere. In 2012, UK authorities reaffirmed their commitment to aggressively pursuing criminal charges against suspected violators of UK anti-bribery laws, revising previously issued guidance on the laws that called for leniency or the imposition of civil fines only in certain situations.
ii International cooperation
Because a successful international prosecution depends on effective cross-border cooperation and access to witnesses and evidence located abroad, the government frequently enlists the assistance of foreign governments and agencies in investigations. The DOJ, for instance, has many formal and informal relationships with foreign agencies to facilitate cross-border enforcement. Other agencies have not shied away from international investigation either; the SEC, for example, maintains an Office of International Affairs, through which it coordinates with foreign governments and provides training to foreign agencies in financial fraud enforcement. In 2017, the DOJ announced that it intended to continue its anti-corruption cooperation efforts with the United Kingdom's Financial Conduct Authority and Serious Fraud Office by assigning a US prosecutor to those offices for a two-year term, after which the prosecutor will return to the United States to provide training and propose new policies based on his or her experience. Indeed, many of the highest-profile settlements have been the result of cooperative efforts between US and foreign regulators. For example, eight recent nine- and 10-figure FCPA settlements were the result of cooperative investigations between US and foreign authorities.8
iii Local law considerations
Not all countries, however, have been as amenable to the expanding extraterritoriality of US law enforcement and enhanced cooperation among foreign authorities. Certain countries, including Mexico, Canada and some members of the European Union, have enacted 'blocking statutes' that prohibit, or place limits on, the production of information for use in a legal proceeding in a foreign country. This puts companies operating in the international arena in a difficult position, as compliance with one law may necessarily mean running afoul of another. A multinational company under investigation by multiple regulators in other countries also faces innumerable complexities in dealing with varying and potentially inconsistent laws relating to the discovery of evidence and examination of witnesses. For example, data privacy laws in one country may prohibit the company from complying with a subpoena from a regulator in another, and the rights to counsel and against self-incrimination may be limited or absent under other regimes. This issue came to a head in 2017 in the form of a showdown between Microsoft Corp and the DOJ. The latter sought customer emails stored on a Microsoft server in Dublin pursuant to a warrant, and the former sought to quash the warrant on the basis, among others, that Microsoft would run afoul of foreign data privacy rules by complying. The case reached the Supreme Court before it was dismissed in light of new legislation passed by Congress affecting the extraterritorial reach of US law enforcement requests, but the issue is likely to arise again in the near future.
V CONCLUSIONS AND OUTLOOK
For at least the past decade, corporate and civil liability in the United States has moved inexorably towards more regulation and enforcement, harsher penalties and expanding jurisdiction. More than halfway into the new presidential administration, there is no obvious indicator of a reversal or suspension of this trend, at least in the short term, even in areas of enforcement considered by observers to be potential candidates for diminished activity, such as the anti-corruption front. The significant number of ongoing investigations, coupled with public comments by the DOJ and the SEC, also provide support for the proposition that a near-term softening of corporate enforcement is not on the cards, despite recent policy adjustments by the DOJ that are intended to clarify or rationalise the process of resolving corporate investigations but that are unlikely to change underlying trends. And while traditional areas of enforcement, such as anti-corruption, financial fraud, healthcare fraud and environmental protection, are likely to remain the mainstays of regulatory action, a number of other areas have emerged during the past year and are likely to receive substantially increased focus going forward. Most prominent among these is cybersecurity, which encompasses issues relating to data security, privacy, hacking and cryptocurrencies and related technologies, all of which present significant regulatory challenges. The SEC, for example, formed a 'cyber unit' that has pursued a number of enforcement actions targeting the unregistered offering of cryptocurrencies, misconduct relating to abuse of financial markets through hacking, and the failure of public companies to timely disclose data breaches, and the SEC has also begun to announce policies and guidance designed to protect cryptocurrency investors. While the ramifications of these new enforcement fronts remain unclear and will play out over the next several years, they will undoubtedly present compliance challenges for corporate actors. What remains as clear as ever is the necessity of maintaining a robust compliance structure to promptly detect potential wrongdoing. While total prevention is unlikely, given the innumerable ways in which a company can run afoul of the law and the sheer complexity of the various regulatory regimes, prompt detection, thorough investigation and meaningful remedial action will limit the company's exposure and maximise its chance of avoiding criminal or civil charges, or – failing that – negotiating a favourable settlement with government authorities.
1 Nicolas Bourtin is a partner and Kevin Levenberg is an associate at Sullivan & Cromwell LLP.
2 The Foreign Corrupt Practices Act of 1977.
3 Austria, Belgium, Cyprus, France, Ireland, Isle of Man, Latvia, Luxembourg, Norway, the Netherlands, Switzerland, Sweden and the United Kingdom.
4 Financial institutions resolving DOJ sanctions investigations have included: ABN AMRO, HSBC, ING Bank NV, Barclays, Credit Suisse, Lloyds TSB Bank, Standard Chartered (2012), BNP Paribas, Crédit Agricole, Commerzbank AG, Société Générale, Standard Chartered (2019) and UniCredit.
5 Including the DOJ, the SEC, the EPA, the enforcement arms of the Treasury Department, Departments of Defense and Health and Human Services and the CFTC.
6 In 2017, the SEC's ability to obtain disgorgement suffered a setback when the US Supreme Court held that a five-year statute of limitations applies to the imposition of disgorgement in SEC proceedings. The SEC has calculated that the decision led the SEC to forego seeking approximately US$800 million in potential disgorgement in filed and settled cases, with that amount expected to rise over time.
7 541 F.3d 130 (2nd Circuit 2008).
8 These were the Keppel Offshore & Marine Ltd settlement, the Telia Company AB settlement,
the Rolls-Royce plc settlement, the Société Générale settlement, the Mobile Telesystems PJSC settlement,
the Petrobras settlement, the Walmart Inc settlement and the TechnipFMC plc settlement.