The Complete Compliance and Ethics Manual 2024

Facilitating or Expediting Payments

The FCPA’s only exception allows for “facilitating or expediting payment[s]” to foreign officials for the purpose of “expedit[ing] or [. . .] secur[ing] the performance of a routine governmental action.” Courts have characterized expediting and facilitating payments as “‘essentially ministerial’ actions that ‘merely move a particular matter toward an eventual act or decision or which do not involve any discretionary action.’” These payments may include, but are not limited to, payments for the following: Obtaining permits, licenses, or other official documents to do business in a foreign country; processing government papers; providing police protection or mail services or scheduling inspections; and providing utilities services or cargo services or protecting perishable commodities. As a practical matter, the facilitating payments exception is construed extremely narrowly. Even more, it does not exist under the laws of almost any another country, including the United Kingdom. Because the facilitating payment exception is routinely misunderstood by employees (and inherently difficult to prove when a company is the target of an enforcement action), companies would be wise to prohibit facilitation payments altogether and not rely on this exception.

Local Law

The FCPA allows for an affirmative defense for what otherwise would be an anti-bribery violation if the defendant can prove that “the payment, gift, offer, or promise of anything of value that was made, was lawful under the written laws and regulations of the foreign official’s, political party’s, party official’s, or candidate’s country.” The defense is statutorily limited to the written laws and regulations of a country—and very few, if any, local laws permit forms of bribery. As such, it is never a defense to claim that the prohibited payments were made because “this is how business is done” in a particular foreign country.

Bona Fide Business Expenditures

An affirmative defense is also provided if “the payment, gift, offer, or promise of anything of value that was made, was a reasonable and bona fide expenditure … incurred by or on behalf of a foreign official, party, party official, or candidate.” However, the payment or gift must be “directly related to (A) the promotion, demonstration, or explanation of products or services; or (B) the execution or performance of a contract with a foreign government or agency thereof.” This is the exception most likely to be invoked by companies or individuals accused of making “marginal” bribes—that is, engaging in conduct that is close to the line.

Enforcement Trends Signal Continued Emphasis on FCPA

Several factors favor the view that the business community can expect DOJ and SEC’s FCPA enforcement efforts to continue to remain aggressive, including:

• Multijurisdictional cooperation and parallel investigations and prosecutions are becoming more common.

• Whistleblower bounty provisions are being fine-tuned to lure in additional tipsters.

• Increased compliance and promises of leniency are being used to encourage self-disclosure.

• The prosecution of individual defendants increasingly continues to be a top enforcement priority.

• Law enforcement agent specializations have promoted more effective industry-specific enforcement.

• The “demand side” of the enforcement net is being widened to also catch bribe recipients and those middlemen who assist them.

• Congress is considering mandatory debarment of government contractors found to be FCPA violators.

Enforcement actions by DOJ and SEC in recent years have remained consistent in light of these long-term trends, though FCPA enforcement actions dropped significantly during the COVID-19 pandemic. As noted below, however, there are signs FCPA enforcement is picking up again.

More Aggressive Enforcement Policies

Recently, Deputy Attorney General Lisa O. Monaco has indicated that DOJ will be engaged in more aggressive enforcement of corporate crime across the board (articulated in the September 2022 “Monaco Memorandum”).^[8] Specifically, Monaco indicated there would be a step-up in corporate crime enforcement on both the individual and corporate level, including: (1) increased individual accountability; (2) a focus on corporate recidivism; and (3) greater scrutiny of corporate resolutions with DOJ.

One indication of the new enforcement atmosphere—particularly as it relates to the FCPA—is the change in tenor toward compliance monitorships. In the past, compliance monitorships have frequently been included as part of FCPA enforcement resolutions. In 2018, former Assistant Attorney General Brian Benczkowski stated that such monitorships should only be used in limited circumstances where their need and benefit were apparent considering the costs and burden.^[9] These statements coincided with a two-year period in which monitorships were not included in FCPA resolutions.

However, the Monaco Memorandum indicates monitorships are back in play. Retracting Benczkowski’s prior guidance, which effectively resulted in a presumption against monitorships, the Monaco Memorandum states that monitorships should be considered on a case-by-case basis with no presumption. Unsurprisingly, more recent FCPA enforcement actions have once again included monitorships.

Corporate Enforcement & Voluntary Self-Disclosure Policy

In January 2023, Criminal Division Assistant Attorney General Kenneth Polite Jr. issued a new FCPA Criminal Division Corporate Enforcement & Voluntary Self-Disclosure Policy.^[10] Most importantly, the new policy aims to increase self-reporting by companies in part by significantly increasing the maximum credit companies or individuals could receive against any criminal sentence or fine for self-disclosure of violations. Under prior guidance, the maximum credit for voluntary disclosure of misconduct (with subsequent cooperation and remediation) before DOJ was aware of it was a 50% discount below the Sentencing Guideline range and involuntary disclosure was a 25% discount below the Guideline Range. As of January 2023, the new maximum credit is a 75% discount for voluntary disclosure and 50% discount for an involuntary disclosure. That said, this adjustment is primarily to reward “extraordinary” cooperation and remediation efforts, and it should not be considered the new norm.

An Issue of Concern: “Carbon Copy Prosecutions”

One emerging trend is the phenomenon of “carbon copy prosecutions.” On occasion, a company will reach a negotiated resolution with U.S. authorities on international bribery-related charges—whether through a non-prosecution agreement, a deferred prosecution agreement, or a guilty plea. Although in those cases the U.S. authorities may be perfectly satisfied with the resolution, the authorities in other countries where the bribery occurred may not feel vindicated. In those situations, there is a bona fide risk that the other countries will initiate prosecutions based on the same operative facts as, and admissions arising out of, the U.S. investigation and resolution.

The next result is that, if an individual corporate officer is even tangentially involved or implicated in a U.S.-negotiated resolution, that corporate officer—even if not named at all in the resolution—faces potential criminal charges overseas. The officer, therefore, has a strong incentive to ensure that the resolution does not name them and describes the officer’s conduct in the most positive light (or at least neutrally).

The net effect of DOJ and SEC FCPA settlement policies is that when a company enters into a negotiated resolution with U.S. enforcers, it is essentially powerless to defend against—much less deny—the factual basis on which the resolution is based. This all but ensures that a company that settles with DOJ—or both DOJ and SEC in parallel proceedings—will have little or no choice but to settle with foreign authorities, should such authorities choose to exercise jurisdiction and enforce their corollary anti-corruption laws.

A country’s incentive to vindicate its own laws is not insubstantial, especially when a company or individual has already admitted, in another proceeding (say, in the United States), to violating local law. Accordingly, both named parties and nonparties implicated in a resolution in one country ought to give due consideration to the potential impact of that resolution in another territory, especially considering recent trends pointing to coordinated multinational cooperation and successive enforcement proceedings.

The days of one-dimensional government investigations appear to be over. Duplicative, serial enforcement actions are now part and parcel of the enforcement landscape, despite a healthy ongoing debate over the need for, and fairness of, serial enforcements. It is likely that, as globalization makes the world smaller, carbon copy prosecutions will increase in frequency, size, scope, and force.

The U.K. Bribery Act

The United Kingdom Bribery Act of 2010 makes it illegal to pay or receive a bribe, either directly or indirectly.^[16] The Bribery Act applies to U.K. citizens and residents, U.K.-based organizations, and foreign organizations conducting business in the U.K. The Bribery Act has broad applicability. It covers any transaction—public or private—that takes place in the U.K. or abroad. It also penalizes corporations for failing to prevent bribery where a bribe is paid on their behalf by an “associated person,” which includes employees, agents, or any person acting on behalf of the entity.

The primary offenses prohibited in the Bribery Act are:

• bribing another person by offering, promising, or giving financial or other advantage to a person to induce or reward that person to perform a relevant function or activity improperly;

• accepting, receiving, or requesting financial or other advantage as a reward for performing a relevant function or action improperly; and

• bribing a foreign public official to obtain or retain business or a business advantage; and

• a corporate offense for failing to prevent bribery.

There is no limit on the maximum fine under the Bribery Act, and the maximum potential incarceration is 10 years.

With passage of the Bribery Act, the U.K. has placed an emphasis on unimpeded reporting, early detection, and self-reporting. Similar to the U.S. Sentencing Guidelines, the Bribery Act offers a defense for organizations that are able to demonstrate that, at the time of the offense, they had “adequate” compliance procedures in place to prevent the offense being investigated. The U.K. Ministry of Justice has published guidance on what constitutes “adequate” procedures.^[17]

Canadian Corruption of Foreign Public Officials Act

The Canadian Corruption of Foreign Public Officials Act (CFPOA) is largely consistent with the FCPA and U.K. Bribery Act.^[18] The CFPOA prohibits Canadian persons or companies from bribing foreign public officials to obtain or retain a business advantage.

The CFPOA was amended in 2013 to bring it more in-line with other major anti-bribery laws. The amendment included the following:

• the maximum incarceration under the CFPOA was raised to 14 years;

• there is no longer an exception for facilitation payments;

• added a books and records offense; and

• established nationality jurisdiction that applies to all offenses under the CFPOA.

Since the 2013 amendment, Canadian authorities have increased their enforcement activity under the CFPOA. Although Canada has lagged behind peers in enforcement actions and hasn’t been as active as the U.S. or U.K. in enforcing its anti-bribery laws, Canadian enforcement authorities have indicated that they are now more-aggressively pursuing enforcement under the CFPOA.

French Sapin II Law

The French Sapin II law, which was passed by the French Parliament in 2016 and took effect in June 2017, applies to certain private companies and state-owned companies that are incorporated or headquartered in France and their subsidiaries. Like its counterparts in the U.S. and the U.K., Sapin II has extraterritorial reach.^[19]

Sapin II creates a series of anti-bribery policy and procedures requirements for companies that fall within its purview. Most prominently, companies must create a code of conduct that specifically identifies prohibited behaviors associated with bribery and corruption. Other requirements include:

• Creating disciplinary sanctions for violation of the code of conduct;

• Instituting whistleblowing procedures;

• Conducting a corruption risk assessment (that is regularly updated);

• Reviewing procedures addressing the risks identified in the risk assessment;

• Implementing certain internal and external accounting control procedures;

• Developing training programs; and

• Creating internal procedures to monitor and evaluate the aforementioned measures.

The French Anti-Corruption Agency has drafted guidelines to help practitioners comply with Sapin II.^[20]

Brazil’s Clean Company Act

Brazil’s anti-bribery law, the Clean Company Act, became effective in 2014 and creates civil and administrative liability for Brazilian companies who pay (or attempt to pay) bribes domestically or abroad, and foreign companies who pay (or attempt to pay) bribes in Brazil.^[21]

To encourage more effective compliance programs, the Clean Company Act is a strict liability regime. Accordingly, entities can be held liable regardless of their officers’ awareness of the acts. Although liability is strict, authorities will consider the comprehensiveness of the company’s compliance program when determining sanctions. It is critical that companies develop comprehensive programs that include the elements explained in the next section.

Commitment from Senior Management and a Clearly Articulated Policy Against Corruption

Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company. The DOJ and SEC consider the commitment of corporate leaders to a “culture of compliance,” and look to see if this high-level commitment (“tone at the top”) is also reinforced and implemented by middle managers and employees at all levels of the business. A “paper-only” policy will fall short of the enforcers’ expectations. Instead, enforcers are looking for a compliance program with a strong policy that is understood and followed in the real world by actual managers, employers, vendors, and others who obtain permits and licenses, maintain books and records, and are the most likely to be presented with opportunities to commit violations.

Code of Conduct and Compliance Policies and Procedures

A company’s code of conduct is often the foundation on which an effective compliance program is built. DOJ has repeatedly noted in its charging documents that the most effective codes of conduct are clear, concise, and accessible to all employees and to those conducting business on the company’s behalf. Components of such a code of conduct may include due diligence checklists and questionnaires for prospective vendors; periodic employee training and annual compliance certifications from both employees and vendors; hotline reporting and anti-retaliation policies; gift, entertainment, charitable giving, and political giving policies; prior approval tables; and standard anti-corruption contract language for vendors.

Risk Assessment

Assessment of risk is elemental to developing a strong compliance program, and it is another factor that the DOJ and SEC consider when assessing a company’s compliance program. One-size-fits-all compliance programs are generally poorly conceived and ineffective because resources are spread too thin.

Companies should establish systems and processes to identify the key “red flags” of potential bribery and corruption and, relatedly, use these flags to conduct their risk assessments. The key “red flags” indicating bribery or corruption include:

• Conducting business in countries with a reputation for corruption.

• Industries or companies with a reputation for corruption.

• Close personal connections with government officials.

• Requests for payments to unrelated third parties.

• Requests for payments in cash.

• Proof of performance lacking in detail or documentation (e.g., an invoice that does not have attached receipts).

• Payments requested to be made outside of the usual process or accounting structure.

• Incorrect/incomplete information relative to payment request.

• The contracting party does not have offices or staff.

• The contracting party lacks significant experience.

• Unusually high fees or commissions.

• Requests for unusual bonuses, advance payments, or special payments.

• Agents or consultants hired at the strong recommendations of a government official.

• Agents or consultants who are former government officials dealing with their former agencies.

Training and Continuing Advice

Compliance policies cannot work unless effectively communicated throughout a company. Accordingly, the DOJ and SEC evaluate whether the company has taken steps to ensure that the relevant compliance policies and procedures have been communicated throughout the organization, including through periodic training and certification for all directors, officers, relevant employees, and, when appropriate, agents and business partners.

Incentives and Disciplinary Measures

Enforcement of the compliance program is fundamental to its effectiveness. The DOJ and SEC will consider whether, when enforcing its compliance program, the company has appropriate and clear disciplinary procedures; whether those procedures are applied reliably and promptly; and whether they are proportionate to the violation.

In addition, DOJ has recently launched its first-ever Pilot Program Regarding Compensation Incentives and Clawbacks.^[23] The Pilot Program expects companies to develop compliance-promoting compensation and bonus systems. In addition, the DOJ will reduce fines when companies, in good faith, attempt to clawback compensation from employees who engaged in wrongdoing or who both (1) had supervisory authority over the employee(s) or business area engaged in the misconduct and (b) knew of, or were willfully blind to, the misconduct.

Third-Party Due Diligence and Payments

The DOJ’s and SEC’s enforcement actions demonstrate that third parties—including agents, consultants, and distributors—are commonly used to conceal the payment of bribes to foreign officials in international business transactions. Accordingly, an effective compliance program should aim to prevent and detect foreign bribery applicable to third parties. This includes the following elements: Requiring due diligence about the hiring, retention, and oversight of third parties; informing third parties of the company’s commitment to abide by the anti-bribery laws and the company’s compliance program policies against bribery; and seeking a reciprocal commitment from third parties.

Confidential Reporting and Internal Investigation

An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.

Timely, thorough investigations are, in the words of DOJ, a “hallmark” of an effective compliance program. Accordingly, companies should ensure that they have policies and procedures in place to promptly conduct effective internal investigations. This includes record retention policies that will facilitate internal investigations. Notably, record retention policies are increasingly expected to include messaging applications (including ephemeral applications) and personal devices. Per DOJ, these policies should ensure that “to the greatest extent possible, business-related electronic data and communications are accessible and amenable to preservation by the company” and “should be tailored to the corporation’s risk profile and specific business needs.”^[24]

Continuous Improvement: Periodic Testing and Review

Finally, a good compliance program should constantly be evolving. A company’s business changes over time, as do the environment in which it operates, the nature of its customers, the laws that govern its actions, and the standards of its industry. In addition, compliance programs that do not just exist on paper but are also followed in practice will inevitably uncover compliance weaknesses and require enhancements to the compliance program. Consequently, the DOJ and SEC evaluate whether companies regularly review and improve their compliance programs.