In today’s edition of Daily Compliance News:
- Harvard Prof guilty of lying about China connection. (NYT)
- NatWest pleads guilty, yet again. (WSJ)
- Predicting corrupt politicians. (PhysOrg)
- Nikola fined $125MM for CEO tweets. (SEC Press Release)
Author: admin
We continue our exploration of Santa’s Naughty List this week before Christmas by looking at the compliance failures of Nikola Corporation (Nikola). In a Press Release, the Securities and Exchange Commission (SEC) announced that Nikola, a publicly traded company created through a special purpose acquisition company transaction, has agreed to pay $125 million to settle charges that it defrauded investors by misleading them about its products, technical advancements, and commercial prospects via a Cease and Desist Order (Order). This follows on the heels of an earlier filing against former Nikola founder and Chief Executive Officer (CEO), Trevor R. Milton (Milton), for repeatedly disseminating false and misleading information – typically by speaking directly to investors through social media – about Nikola’s products and technological accomplishments.
Gurbir S. Grewal, Director of the SEC’s Division of Enforcement, said in the Press Release, “As the order finds, Nikola Corporation is responsible both for Milton’s allegedly misleading statements and for other alleged deceptions, all of which falsely portrayed the true state of the company’s business and technology. This misconduct — and the harm it inflicted on retail investors — merits the strong remedies today’s settlement provides.” And boy what misconduct it detailed. This matter should be studied by not only every compliance professional but also every business executive. It also points out one of the basic deficiencies of Special Purpose Acquisition Corporations (SPACs).
Nikola was created via the merger of Legacy Nikola and VectoIQ Acquisition Corp. (VectoIQ), which was formed in 2018 as a SPAC, for the purpose of effecting a business combination with one or more businesses. According to the Order, “VectoIQ and Legacy Nikola entered into a Business Combination Agreement (the “Business Combination Agreement”), as well as certain related agreements, pursuant to which Legacy Nikola would merge with a subsidiary of VectoIQ, with Legacy Nikola remaining as the surviving company and as a wholly-owned subsidiary of VectoIQ. On June 3, 2020, Legacy Nikola and VectoIQ consummated the merger contemplated by the Business Combination Agreement (the “Business Combination”), and VectoIQ changed its name to Nikola Corporation” and on June 4, 2020, Nikola’s common stock and warrants began trading on the Nasdaq Global Select Market.
What got Nikola into such SEC hot water was the mouth or rather modern-day social media postings of Milton. The Order stated, “From approximately March 2020 through September 2020, in his capacity as CEO and later as Executive Chairman of Nikola, Milton made materially false and misleading statements on numerous critical topics related to Nikola’s capabilities, technology, reservations, products, and commercial prospects.” Matt Kelly, writing in Radical Compliance, was a bit more pithy stating, “The problem was that almost every statement Milton made about Nikola’s hydrogen vehicles was, well, hot air.” According to the Order, there were multiple instances where Milton mislead investors and indeed anyone reading social media about the company.
Milton made false and misleading statements about the capabilities of Nikola’s first semi-truck prototype, the Nikola One, saying it was a working model and made a fraudulent video to back it up. He made a series of false and misleading claims about Nikola’s then-current hydrogen production capabilities, its costs to produce hydrogen, and the costs at which it obtained electricity to produce hydrogen profitably. He made false statements claiming that Nikola had engineered and already completed a prototype of an electric pickup truck, the Badger. Milton claimed that a “backlog of interest” in the vehicles were in the form of binding contracts, “the vast majority of the pre-orders were indications of interest that were cancellable at any time,” even going so far as to claim one customer had a binding order for 5,000 vehicles when no such contract existed. Finally, to top off all of Milton’s whoppers, he claimed a partnership with General Motors (GM) would generate over $4 billion in cost saving when there was no such arrangement in place.
I went into some detail in these clearly bogus claims to demonstrate why a Chief Compliance Officer (CCO) needs to have a handle on what their CEO is tweeting and social media-ing out. What steps can a CEO take? Here I will borrow once again from the Coolest Guy in Compliance.
- Take a team approach to reviewing and publishing information about the company, so someone else can put a second set of eyes (The Eyes of Dr. T. J. Eckleburg) on what the CEO says before they hit the send button.
- This approach should be a formal policy and procedure, fully documented so when the SEC comes knocking there will be a record.
- A subject matter expert (SME) review on what statements about the company qualify as material information that should be disclosed in filings to the SEC.
- Your process should also contain a mechanism to correct any misleading or erroneous statements that slip through your fully documented and operating policy and procedure.
If all of this sounds more than vaguely familiar it is because of the imbroglio surrounding Elon Musk and his use of social media. Musk was fined $30 million for his false and misleading tweets and the company was required a legal eagle to vet his tweets. All of this means this a CCO and corporate compliance program should be vigilant for this type of activity. Policies and procedures are mandatory, but they are only the starting point. This is a risk, like all other risks, it must be managed. If you set up policies and procedures but do not follow them, you could find yourself in SEC hot water as both Nikola and Milton have.
Put another way, Nikola got a Christmas present of 125 million lumps of coal. While any decision on Milton may have to wait until 2022, he will most probably be on Santa’s Naughty List for 2022.
The Compliance Life details the journey to and in the role of a Chief Compliance Officer. How does one come to sit in the CCO chair? What are some of the skills a CCO needs to success navigate the compliance waters in any company? What are some of the top challenges CCOs have faced and how did they meet them? These questions and many others will be explored in this new podcast series. Over four episodes each month on The Compliance Life, I visit with one current or former CCO to explore their journey to the CCO chair. This month, we have our first Director of Trade Compliance, Matt Silverman, Director of Trade Compliance at VIAVI. We discuss Matt’s journey to the Director’s chair and look down the road at where trade compliance will be in 2025 and beyond.
His first role as a Trade Compliance Director role was at Solvay. In this role, Silverman learned to balance individual employee management and employee development along with day-to-day compliance issues. Silverman then moved to VIAVI in the role of Global Trade Director & Senior Counsel. In this position he handles a wide variety of trade issues including import, export, sanctions and antiboycott. He also looks for ways to get involved in other areas that may intersect with trade compliance.
Categories
Year End Wrap Up
The Kitchen wraps up its 2021 with a look back at some of its top stories from the past year.
Tom Fox welcomes back Jeffrey Hayzlett to this week’s episode of the Innovation in Compliance Podcast. Jeffrey is the CEO and Chairman of The C-Suite Network. In this episode, Tom and Jeffrey explore where the business world is as the year comes to an end.
The Changing Business Community
Tom asks Jeffrey to reflect on what businesses are responding to now. “That there are no old ways; there are all going to be new ways,” he remarks. The mood of business is shifting, and businesses are simply going to have to adapt. There aren’t going to be offices in the way they used to be because the pandemic has shown that businesses can operate well remotely. The focus is going to be on how to utilize these new environments in the best way, as well as how to effectively and safely monitor them. Companies are changing the ways they do business as well: before the pandemic content was not a priority; now it is. “You have to be able to use content to drive the business,” Jeffrey iterates. Sometimes content will not generate as much money as you did previously, but it will generate engagement and reach more people. “You have to change, adapt, or die,” Jeffrey insists.
Grow, But Mitigate Risk
The C-Suite Network encourages senior management to mitigate risk as much as possible. Companies have to grow while doing this, however. “If you’re not growing, you’re dying,” Jeffrey tells Tom. Risk is always going to exist in business, but it cannot hinder you as a leader, especially a C-Suite one. “Our job is to be the most strategic people in the room,” Jeffrey adds. Asking the right questions, understanding the directions of the CEOs of the companies they counsel, and assessing the processes and tools these companies have, are all part and parcel of how C-Suite leaders think about, and mitigate risk.
Where Do We Go From Here
Tom asks Jeffrey where he sees in-person conference business going in the coming years. “You’re either gonna have really small groups or really big ones…not much in between,” Jeffrey responds. It’s going to be much more difficult in the coming years for speakers to have sustainable careers because of the digital era the world is in, and because audience preferences are changing. “If you’re not a subject matter expert, if you’re not a celebrity, it’s going to be a long road for you as a professional speaker…You’re really gonna have to have credentials,” he adds. Most people are going to be looking for experts to give them advice on how to move from point A to point B, or for celebrities who can draw people in and help fill a room. “Those are the things that are going to be the key driving factors in the future,” Jeffrey concludes.
Resources
Jeffrey Hayzlett | LinkedIn | Twitter
The C-Suite Network
We begin the week before Christmas by looking at one heck of a compliance failure (or perhaps series of compliance failures) which led JPMorgan Chase Bank, NA, J.P. Morgan Securities LLC, and J.P. Morgan Securities plc (JPMorgan) to paying some $200 million in fines and penalties to the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC). It breaks down with $125 million to the SEC and $75 million to the CFTC. While that is probably just a rounding error to JPMorgan, it will purchase many, many lumps of coal that JPMorgan will probably get from Santa this year as they clearly have been very, very naughty. Both the SEC and CFTC settled via Orders, (herein CFTC Order and SEC Order).
Matt Kelly, writing in Radical Compliance, said of the underlying facts they do “not paint a pretty picture for JP Morgan. The misconduct happened from at least January 2018 through November 2020, and even supervisors in the broker-dealer unit — the people who were supposed to enforce compliance with records-retention policies — engaged in the same bad habits.” JPMorgan received numerous subpoenas for documents from the SEC between 2018 and 2020. JPMorgan failed to comply with these subpoenas as “JPMorgan frequently did not search for records contained on the personal devices of JPMorgan employees relevant to those inquiries.” Moreover, these failures “impacted the Commission’s ability to carry out its regulatory functions and investigate potential violations of the federal securities laws across these investigations; the Commission was often deprived of timely access to evidence and potential sources of information for extended periods of time and, in some instances, permanently.”
In ongoing investigations, the SEC was provided What’s App, text messaging and emails from parties who were in contact with JPMorgan. The SEC brought this information to the attention of JPMorgan and the bank “identified other recordkeeping failures that it subsequently” reported to the SEC. The bank’s “Supervisory policies tasked supervisors with ensuring that employees completed training in the firm’s communications policies and adhered to JPMorgan’s books and recordkeeping requirements” were just as guilty of such conduct. The internal function charged with the screening and review of electronic communications, the compliance department’s e-surveillance group, “failed to implement a system of follow-up and review to determine that supervisors’ responsibility to supervise was being reasonably exercised so that the supervisors could prevent and detect employees’ violations of the books and records requirements. Even when employees used approved communications methods, including on personal phones, for business communications, JPMorgan failed to implement sufficient monitoring to assure that its recordkeeping and communications policies were being followed.” The Order concluded, “Even after the firm became aware of significant violations, the widespread recordkeeping failures and supervisory lapses continued with a significant number of JPMorgan employees failing to follow basic recordkeeping requirements.”
As a part of the remediation effort during the investigation, the Board of Director’s Audit Committee hired a consultant to help in the effort. The SEC Order broadened this initiative out further to a “Compliance Consultant” to be retained to lead a variety of remedial efforts. (This sounds suspiciously like a monitor). Some of these efforts will include:
- A comprehensive review of JPMorgan’s supervisory, compliance, and other policies and procedures.
- A comprehensive review of training conducted by JPMorgan to ensure personnel are complying with the requirements.
- An assessment of the surveillance program measures implemented by JPMorgan to ensure compliance.
- An assessment of the technological solutions that JPMorgan implements to meet the record retention requirements.
- An assessment of the measures used by the firm to prevent the use of unauthorized communications methods for business communications by employees.
- A review of JPMorgan’s electronic communications surveillance routines.
- A comprehensive review of the framework to address instances of non-compliance, including (1) how JPMorgan determined which employees failed to comply, (2) the corrective action carried out, (3) an evaluation of who violated policies, (4) why and what penalties were imposed, and (5) whether penalties were handed out consistently across business lines and seniority levels.
There were also additional reporting obligations from the Compliance Consultant in the SEC Order that bear mentioning. In addition to a report at one year of the overall JPMorgan compliance program on record keeping for electronic communications; at two years the Compliance Consultant is to report on any discipline imposed on employees for violations of the record keeping policies. This includes, “written warnings, loss of any pay, bonus, or incentive compensation, or the termination of employment, with respect to any employee found to have violated JPMorgan’s policies and procedures”. JPMorgan’s Internal Audit function is also mandated to conduct an internal audit to determine compliance with the firm’s record keeping policies for electronic communications.
All of these obligations should be studied by compliance professionals for not only best practices but to determine any gaps in your company’s electronic data record keeping regime. This is critical even if you are not under the regulatory regime imposed on financial institutions or other regulated industries. The Department of Justice (DOJ) has long mandated that companies both understand and capture ephemeral communications but if your company gets into a Foreign Corrupt Practices Act (FCPA) or other similar investigation you will need to demonstrate compliance for a FCPA perspective and to then internally investigate any claims. Not much will be worse for your company than if the DOJ or SEC finds out about some FCPA-violative conduct and comes to your company and then you find out your business folks have been communicating through technology you were completely unaware of, you have no record of it and you cannot capture it.
Everyone was aware of the changes in risk when most companies went to WFH. Now are we RTO those risks have changed again. Even if you are aware of and have approved the use of Teams, Slack, Zoom or other technology to collaborate in the RTO environment; these tools are coming out with new features literally weekly that may change your risk profile. Use the JPMorgan SEC and CFTC enforcement actions as benchmarks to guide you through an assessment of your electronic record keeping program as well as key areas to enhance.
Matt Kelly and myself take a deep dive into this matter on this week’s Compliance into the Weeds, which will post Wednesday AM.
Cécilia Fellouse-Guenkel is a well-known compliance practitioner in France. She and Tom Fox have worked together in live as well as virtual conferences. She moved into the compliance industry when she joined a medical device company in the US. Since then, she says, compliance has been her passion. She eventually opened her own compliance consulting business, called Compliance For Good. The name of her company signifies that compliance is not only for the greater good, but for the long term. She and Tom talk about the evolution of ESG and how it has a positive impact on companies as well as the wider community.
Evolution of ESG
Tom asks, “How have you seen ESG evolve in Europe and the EU over the past few years?” Cécilia responds that ESG is a broad notion, many aspects of which have existed for quite some time. “I guess what’s changed now with ESG is on the one hand, how the investment and the financial world have been behaving recently,” she remarks. ESG-oriented investments have increased to the tune of US$30 trillion in recent times. Financial institutions are now willing to put a price tag on companies’ ESG efforts based on KPIs, which is an area compliance professionals are experts in. She discusses the strict ESG regulations in France and the EU – particularly the Duty of Care Act and the SFDR mandates respectively – which she says are catapulting ESG into the limelight as a critical issue for companies and compliance professionals. She and Tom talk about the impact on companies’ supply chain and the disquiet some stakeholders feel about these new regulations because of the presumption of responsibility now placed on businesses.
A Holistic Conversation
What advice are you giving your clients about ESG, Tom asks Cécilia. Companies come to her with questions about the Duty of Care law and other ESG regulations. “What I love the most is to make it a more holistic conversation, a global conversation,” she tells Tom. She shows her clients how they can achieve both an impact analysis and Duty of Care plan at the same time. “What I like about ESG is that it’s a shift for compliance people going from mostly looking at the risks … ESG is also looking at the positive aspects. So it’s really risk, opportunity and positive impact,” Cécilia comments. The conversation immediately becomes more strategic, efficient and helpful when you take this perspective, she adds. Boards also are more willing to listen. She emphasizes that this type of holistic approach is not new to compliance officers: another reason they are in a good position to lead the conversation around ESG.
Value of Compliance in ESG
A recent report by McKinsey explains the impact ESG has on a company’s profitability, including lower risk of sanctions, higher employee retention, and attracting potential talent. Cécilia says that compliance professionals should make sure they’re part of the conversation. She shares practical advice from two books. Tom comments that some compliance professionals don’t feel as comfortable with the E of ESG, as they believe they lack technical skills in that area. He asks Cécilia to share her thoughts on the subject. Even though the environmental aspect is a technical area, she remarks, compliance officers can still offer their expertise, such as in monitoring and standardizing KPIs. Another key area where compliance has valuable expertise is in third-party risk management.
ESG Into the Future
Cécilia wants compliance professionals to jump on the ESG train in the future. “It’s where we belong,” she tells Tom, “in the strategic sphere and the strategic role of ethics and compliance.” She likes Allison Taylor’s idea of the CCO as the Chief Integrity Officer. She is also hoping for more standard KPIs to move the industry forward.
Resources
Cécilia Fellouse-Guenkel on LinkedIn
In this episode of the FCPA Compliance Report, I visit with Brandon Daniels, President of Exiger. Brandon is a long-time favorite on the FCPA Compliance Report, and he always brings a unique perspective to a variety of compliance topics. In this episode, we look at the Theranos case from a very different angle than the criminal fraud trial of Elizabeth Holmes. We consider the due diligence lessons from Theranos. Highlights of this podcast include:
- What is the difference between ongoing due diligence v. point in time due diligence?
- How does Due Diligence on potential investments different (or not) from DD on other types of 3rd parties?
- What areas should you look at in DD of potential business partners/investments?
- How do you perform DD on leaders or senior management of potential business partners/investments?
- What should people or skill sets be on your DD team? For instance, would you suggest being on a DD team to evaluate Theranos?
- How do you evaluate the risk, or are you simply trying to ID red flags?
- Does DD provide insight into the leader of potential business partners/investments continuing after the deal is done?
Resources
Brandon Daniels on Exiger website
Pre-investment, IPO, and Fund-Raising DD
In today’s edition of Daily Compliance News:
- Brain control tech company placed on blacklist. (WaPo)
- OSHA vaccine mandate reinstated. (NYT)
- Corruption at the heart of college sports? (Chronicle of Higher Ed)
- JPMorgan settles record keeping failures suite. (Reuters)