Categories
FCPA Compliance Report

Mike Huneke on The General Counsel Role in CCO Certification

In this episode, I visit Mike Huneke, a partner at Hughes Hubbard. We look at the role of the GC in the CCO certification requirement as first announced by Assistant Attorney General Kenneth Polite and confirmed by Deputy Attorney General Lisa Monaco.

Key areas we discuss on this podcast are:

  • What is the new CCO certification policy?
  • Why did the DOJ create the policy?
  • How has the DOJ’s thinking around recidivists evolved?
  • Reasonableness is not a factual basis.
  • Companies with full transparency are unlikely to have conflicts due to the recent changes in CCO certification.
  • What is the role of the monitor going forward?

Resources

Mike Huneke on Hughes Hubbard

What is the General Counsel’s role in CEO and CCO compliance certifications? On the FCPA Blog

Categories
Blog

Oracle: FCPA Recidivist Part 1 – Background

Oracle Corporation now joins the ignominious group of Foreign Corrupt Practices Act (FCPA) recidivists. Last week, in a Press Release, the Securities and Exchange Commission (SEC) announced an enforcement action which required Oracle to pay more than $23 million to resolve charges that it violated the FCPA when “subsidiaries in Turkey, the United Arab Emirates (UAE), and India created and used slush funds to bribe foreign officials in return for business between 2016 and 2019.” The recidivist label comes from the sad fact that the SEC “sanctioned Oracle in connection with the creation of slush funds. In 2012, Oracle resolved charges relating to the creation of millions of dollars of side funds by Oracle India, which created the risk that those funds could be used for illicit purposes.”

 As reported in the FCPA Blog, Oracle is now one of 15 FCPA recidivists out of a total of 246 FCPA enforcement cases. This gives a recidivism rate of 6.1%. Clearly recidivism is also on the mind of the Department of Justice (DOJ) in the announcement of the Monaco Doctrine and release of the Monaco Memo. Given the overall tenor of the Oracle SEC Order, it is not clear if the SEC has the same level of concern as the DOJ on repeat offenders.

According to the Order, from at least 2014 through 2019, “employees of Oracle subsidiaries based in India, Turkey, and the United Arab Emirates (collectively, the “Subsidiaries”) used discount schemes and sham marketing reimbursement payments to finance slush funds held at Oracle’s channel partners in those markets. The slush funds were used both to (i) bribe foreign officials, and/or (ii) provide other benefits such as paying for foreign officials to attend technology conferences around the world in violation of Oracle’s internal policies.” I guess those employees at the subsidiaries, and specifically those in India, did not receive the Memo about Oracle’s 2012 FCPA settlement, where they promised to institute a series of internal controls to clean up the problem.

During the period in question, Oracle used two sales models, direct and indirect. Under the direct model, Oracle transacted directly with customers who paid Oracle directly. Under the indirect method, Oracle transacted through various types of third parties including straight distributor models, value added distributors (VADs) and value added resellers (VARs). While Oracle used the indirect sales model for a variety of legitimate business reasons, such as local law requirements or to satisfy payment terms, it recognized since at least 2012 that the indirect model also presented certain risks of abuse – including the creation of improper slush funds.

Learning one lesson from the 2012 enforcement action, “Oracle utilized a global on-boarding and due diligence process for these channel partners that Oracle implemented at the regional and country levels. Oracle only permitted its subsidiaries to work with VADs or VARs who were accepted to its Oracle Partner Network (“OPN”). Similarly, Oracle prohibited its subsidiaries from conducting business with companies removed from the OPN.”

Distributor Discounts

According to its policies regarding distributors, a valid and  legitimate business reason was required to provide a discount to a distributor. Oracle used a three-tier system for approving discount requests above designated amounts, depending on the product. In the first level, Oracle at times allowed subsidiary employees to obtain approval from an approver in a subsidiary other than that of the employee seeking the discount. At the next level and for higher level of discounts, Oracle required the subsidiary employee to obtain approval from Oracle corporate headquarters. The final level was a committee which had to approve the highest levels of discount.

The weakness in the Oracle distributor discount policy was that “while Oracle policy mandated that all discount requests be supported by accurate information and Oracle reviewers could request documentary support, Oracle policy did not require documentary support for the requested discounts – even at the highest level.” The standard requests for discounts were those previously seen in the Microsoft FCPA enforcement action, including “budgetary caps at end customers or competition from other original equipment manufacturers.” As the Order noted, “Oracle Subsidiary employees were able to implement a scheme whereby larger discounts than required for legitimate business reasons were used in order to create slush funds with complicit VADs or VARs.” Naturally it allowed distributors which “profited from the scheme by keeping a portion of the excess deal margin” to create a pot of money to pay a bribe.

Marketing Reimbursements

Distributor policies also allowed Oracle sales employees at the Subsidiaries to “request purchase orders meant to reimburse VADs and VARs for certain expenses associated with marketing Oracle’s products.” Once again there was a multi-pronged approval process in place. For marketing reimbursements “under $5,000, first-level supervisors at the Subsidiaries could approve the purchase order requests without any corroborating documentation indicating that the marketing activity actually took place.” Above this $5,000 threshold, additional approvals were required with additional requirements for business justification and documentation.

With these clear and glaring internal control gaps, you can see where it all went wrong for Oracle, the Order noted that “Oracle Turkey sales employees opened purchase orders totaling approximately $115,200 to VADs and VARs in 2018 that were ostensibly for marketing purposes and were individually under this $5,000 threshold.” Yet even when the $5,000 threshold was breached and supervisory approval was required in Turkey and the UAE, “The direct supervisors of these sales employees, who were complicit in the scheme, approved the fraudulent requests.” It is not clear if Oracle compliance had visibility into marketing reimbursement protocols. Of course, the “Oracle subsidiary employees in Turkey and the United Arab Emirates requested sham marketing reimbursements to VADs and VARs as a way to increase the amount of money available in the slush funds held at certain channel partners.” These slush funds were then used to pay bribes.

Please join me tomorrow where I look at the bribery schemes in action and how Oracle was able to obtain such an outstanding resolution and their extensive and aggressive remedial actions.

Categories
Corruption, Crime and Compliance

Episode 248 – Deep Dive into the GOL Brazil FCPA Settlement

The Department of Justice and the Securities and Exchange Commission reached a $41 million settlement with GOL Linhas Aéreas Inteligentes S.A. (“GOL”) to resolve criminal and civil foreign bribery charges. GOL entered into a three-year deferred prosecution agreement (“DPA”) with the DOJ in exchange for payment of a $17 million criminal penalty. DOJ credited $1.7 million of that penalty against a $3.4 million fine that GOL agreed to pay law enforcement authorities in Brazil to resolve charges in Brazil. In a separate resolution, GOL agreed to pay the SEC $24.5 million over two years. The SEC’s initial settlement calculation was for $70 million, but it was reduced to $24.5 million based on GOL’s financial condition. Michael Volkov reviews the DOJ and SEC FCPA settlement actions in this episode.

Categories
FCPA Compliance Report

The EC Gang on the Monaco Doctrine

In this special 5 part podcast series, I am deeply diving into the Monaco Memo and analyzing it from various angles. In this episode of the FCPA Compliance Report, we have the Award-Winning Everything Compliance quartet of Jonathan Marks, Jonathan Armstrong, Karen Woody, and Tom Fox on the Monaco Memo.

1. Tom Fox looks at the Monaco Memo through the monitorship language and answers a listener’s questions about compliance programs under the Monaco Memo.

2. Karen Woody reviews the Monaco Memo, the self-disclosure angle, and investigatory considerations and ponders the role of defense counsel going forward.

3. Jonathan Marks also looks at investigatory issues under the Monaco Memo, the role of the Board of Directors, and the role of the forensic auditor under the Monaco Memo.

4. Jonathan Armstrong’s self-disclosure from a UK angle joins Karen Woody in questioning how defense counsel should move forward.

Resources

Tom 5-Part blog post series in the FCPA Compliance and Ethics Blog

1.     A Jolt for Compliance

2.     Timely Self-Disclosure

3.     Corporate Compliance Programs

4.     Monitors

5.     The Heat is On

Monaco Memo

Categories
FCPA Compliance Report

Laura Perkins on the Monaco Memo

In this special 5 part podcast series, I am deeply diving into the Monaco Memo and analyzing it from various angles. In this episode of the FCPA Compliance Report, I am joined by Hughes Hubbard partner Laura Perkins to take a deep dive into the Monaco Memo. Some of the highlights include:

  1. Determination of Monitor Need.
  2. Roadmap to proa-active compliance.
  3. Timely self-disclosure as criteria for monitorship?
  4. Monitor selection criteria.
  5. Monitor review and oversight.

 Resources

Laura Perkins on HughesHubbard.com

Tom 5-Part blog post series in the FCPA Compliance and Ethics Blog

  1. A Jolt for Compliance
  2. Timely Self-Disclosure
  3. Corporate Compliance Programs
  4. Monitors
  5. Polite Speech

Monaco Memo

Categories
Everything Compliance

Episode 105 – the Monaco Memo and Antitrust in the EU

Welcome to the only roundtable podcast in compliance as we celebrate our second century of shows. In 2021, Everything Compliance was honored by W3 as a top talk show in podcasting. In this episode, we have the quartet of Jonathan Marks, Jonathan Armstrong, Karen Woody, and Tom Fox on the Monaco Memo and antitrust enforcement going forward in Europe. We conclude with our fan Shout Outs and Rants section.

  1. Tom Fox looks at the Monaco Memo through the monitorship language and answers a listener’s questions about compliance programs under the Monaco Memo. He shouts out to Aaron Judge, who has a year for the ages.
  2. Karen Woody reviews the Monaco Memo, the self-disclosure angle, and investigatory considerations and ponders the role of defense counsel going forward. She shouts out to the HBO film Elvis and the movie portrayal of Presley.
  3. Jonathan Marks also looks at the Monaco Memo’s investigatory issues, the Board of Directors’ role, and the forensic auditor’s role under the Monaco Memo. He rants about compliance professionals and fraud examiners who have no idea what internal control is.
  4. Jonathan Armstrong looks at the EU communications around Facebook and antitrust enforcement and how things may change dramatically. He shouts out to King Charles III, who had a 70-year apprenticeship as the Heir Apparent to the British throne.

The members of Everything Compliance are:

  • Jay Rosen– Jay is Vice President, Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com
  • Karen Woody – One of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu
  • Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com.
  • Jonathan Armstrong is our UK colleague, an experienced data privacy/data protection lawyer with Cordery in London. Armstrong can be reached at armstrong@corderycompliance.com.
  • Jonathan Marks is Partner, Firm Practice Leader – Global Forensic, Compliance & Integrity Services at Baker Tilly. Marks can be reached at marks@bakertilly.com.

The host and producer, ranter (and sometime panelist) of Everything Compliance is Tom Fox, the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the Compliance Podcast Network.

Categories
FCPA Compliance Report

Matt Kelly on the Monaco Memo

In this special 5 part podcast series, I am deeply diving into the Monaco Memo and analyzing it from various angles. In this episode of the FCPA Compliance Report, I am joined by my Compliance into the Weeds co-host Matt Kelly for a deep dive into the weeds of the Monaco Memo. Some of the highlights include:

  1. Corporate accountability.
  2. Timeliness in turning over evidence of wrongdoing.
  3. Baby Carrots in evaluating the corporate history of misconduct.
  4. Additions to Evaluation of Corporate Compliance Programs.
  5. Tweaks to the Yates Memo formulation.
  6. Monitors and Monitorships.

 Resources

Matt in Radical Compliance

Tom in the FCPA Compliance and Ethics Blog

  1. Introduction
  2. Self-Disclosure
  3. Corporate Compliance Programs
  4. Monitors
  5. What it all means

Monaco Memo

Categories
Daily Compliance News

September 28, 2022 the Do They Even Care Edition

In today’s edition of Daily Compliance News:

  • Forced labor is a top compliance issue. (WSJ)
  • Oracle FCPA is now a recidivist. (FCPA Blog)
  • Kenyans blame corruption for the collapse of a building. (VOA)
  • Twitter calls out Musk for no evidence. (Reuters)
Categories
All Things Investigations

All Things Investigations: Episode 12 – The Monaco Memo with Laura Perkins

 

Welcome to the Hughes Hubbard Anti-Corruption and Internal Investigations Practice Group’s Podcast, All Things Investigations. In this podcast, host Tom Fox and returning guest Laura Perkins of the Hughes Hubbard Anti-Corruption & Internal Investigations Practice Group highlight some of the key legal issues in white-collar investigations, locally and internationally.

 

 

Laura Perkins is a Hughes Hubbard partner whose practice focuses on representing clients in Foreign Corrupt Practices Act and white-collar criminal investigations, including government enforcement actions and compliance counseling. She also advises clients on issues related to the FCPA, the federal securities laws, the False Claims Act, and other federal statutes.

Key areas we explain on this podcast are:

  • How the Monaco Memo instructs prosecutors to evaluate the prosecution of individuals responsible for corporate crime.
  • The Monaco Memo is guiding prosecutors to charge more foreign individuals as opposed to less.
  • Steps a company can take to show timeliness to the DOJ.
  • The Memo underscores the DOJ’s desire for companies to self-report misconduct that they become aware of.
  • Previously, in determining whether a monitorship was appropriate, prosecutors would look at what state your compliance program was in at the time of resolution.
  • The importance of clear communication in understanding the DOJ’s expectations.

Resources

Hughes Hubbard & Reed website 

Laura Perkins on LinkedIn

 

The Hughes Hubbard & Reed website has been updated with the following Anti-Corruption & Internal Investigations advisory:

Cutting Through the Noise: Take‑Aways from the DOJ’s Recent Announcements Regarding Corporate Criminal Enforcement

On September 15, 2022, Deputy Attorney General Lisa Monaco announced a series of policy revisions to the U.S. Department of Justice’s approach to criminal enforcement actions against corporations. At a high level, these new policy revisions show the Department’s desire to take an approach to criminal enforcement that targets the individuals directly responsible for corporate misconduct and encourages companies to assist in preventing misconduct by creating effective compliance programs and cultures. Companies should carefully review these policy changes and identify steps they can take to put themselves in the best position possible should they be subject to a criminal investigation in the future. 

For our discussion about these developments, follow this link to our website.

Practice Co-Chair Laura Perkins will cover this topic in-depth in an All Things Investigations podcast, which will be released on Monday, Sept. 26.

Categories
Blog

Monaco Memo – A Jolt for Compliance: Part 5 – The Heat is On for Compliance

Today, we conclude our exploration of the Monaco Memo by considering what all this may mean for compliance professional going forward. Department of Justice (DOJ) officials have emphasized that the changes laid out in the Monaco Memo and the requirements around Chief Compliance Officer (CCO) Certification are to empower compliance professionals. Deputy Attorney General Lisa Monaco said in the speech (Monaco Speech) announcing the Monaco Doctrine, “Companies should feel empowered to do the right thing—to invest in compliance and culture, and to step up and own up when misconduct occurs. Companies that do so will welcome the announcements today. For those who don’t, however, our Department prosecutors will be empowered, too—to hold accountable those who don’t follow the law.”

This was refined by Assistant Attorney General Kenneth A. Polite, who said in a speech (Polite Speech) after the Monaco Doctrine was announced, “in March 2022, I announced that, for all Criminal Division corporate resolutions (including guilty pleas, deferred prosecution agreements, and non-prosecution agreements), we would consider requiring both the Chief Executive Officer and the Chief Compliance Officer (CCO) to sign a certification at the end of the term of the agreement. This document certifies that the company’s compliance program is reasonably designed, implemented to detect and prevent violations of the law, and is functioning effectively. These certifications are designed to give compliance officers an additional tool that enables them to raise and address compliance issues within a company or directly with the department early and clearly. These certifications underscore our message to corporations: investing in and supporting effective compliance programs and internal controls systems is smart business and the department will take notice.”

Finally, Principal Associate Deputy Attorney General Marshall Miller said in a speech (Miller Speech), also after the announcement of the Monaco Doctrine, “I will focus on the ways those policy changes incentivize corporate responsibility and promote individual accountability – by clarifying, rethinking and standardizing policies on voluntary self-disclosure and corporate cooperation. I’ll also address how Department prosecutors are assessing some of the most challenging corporate compliance issues of the day, such as how incentive compensation systems can promote — rather than inhibit — compliance and how companies should be managing data given the proliferation of personal devices and messaging platforms that can take key communications off-system in the blink of an eye.”

However, I think many of these changes will put additional pressures on compliance programs. The new requirements for self-disclosure move beyond those announced under the FCPA Corporate Enforcement Program. The Monaco Memo stated, “it is imperative that Department prosecutors gain access to all relevant, non­privileged facts about individual misconduct swiftly and without delay.” [emphasis supplied] This in turn, puts even more pressure on internal reporting, whether through a hotline, online reporting portal, or simply an employee speaking up to a manager. That pressure means triaging, efficiently elevating and effectively investigating and evaluating the evidence developed. The clock is ticking, and a compliance professional does not know what the DOJ might already know or if a whistleblower has reported to the Securities and Exchange Commission (SEC) or another federal department or agency.

But the pressure does not end when self-disclosure occurs. The DOJ wants speed above all else in the delivery of evidence which could be used in the prosecution of individuals. Miller stated, “In building cases against culpable individuals, we have heard one consistent message from our line attorneys: delay is the prosecutor’s enemy — it can lead to a lapse of statutes of limitation, dissipation of evidence, and fading of memories. The Department will expect cooperating companies to produce hot documents or evidence in real time. [emphasis supplied] And your clients can expect that their cooperation will be evaluated with timeliness as a principal factor. Undue or intentional delay in production of documents relating to individual culpability will result in reduction or denial of cooperation credit. Where misconduct has occurred, everyone involved — from prosecutors to outside counsel to corporate leadership — should be “on the clock,” operating with a true sense of urgency.”

This requirement changes the dynamics of an investigation. Every CCO and compliance professional in such a situation must now speed up not simply their investigation process and turning over documents but their remediation efforts going forward. Of course, remediation is still an equally important part of your overall way forward to receive credit under the FCPA Corporate Enforcement Policy. A root cause analysis is also still a key component as well.

Another area for heat for the compliance professional is the new requirements for clawbacks. In the Miller Speech, he stated, “What we expect now, in 2022, is that companies will have robust and regularly deployed clawback programs. All too often we see companies scramble to dust off and implement dormant policies once they are in the crosshairs of an investigation.”

Companies should take note: compensation clawback policies matter, and those policies should be deployed regularly. A paper policy not acted upon will not move the needle — it is really no better than having no policy at all.

To up the ante, the Deputy Attorney General has instructed the Criminal Division to examine how to provide incentives for companies to clawback compensation, with particular attention to shifting the burden of corporate financial penalties away from shareholders — who frequently play no role in misconduct — onto those who bear responsibility. In addition to this stick, Miller also noted the carrot the DOJ wants to see, noting, “compensation systems to promote compliance isn’t just about clawbacks. It’s also about rewarding compliance-promoting behavior. For years, companies have designed and fine-tuned sophisticated incentive compensation systems that reward behavior that enhances profits.” She concluded, “We’ll be evaluating whether corporations are making the same types of investments in adopting and calibrating compensation systems that reward employees who promote an ethical corporate culture and mitigate compliance risk.”

The final area where the heat is on is the type of conduct which leads to the FCPA violations. Three of the criteria for determining whether a monitor will be mandated to deal with the length or pervasiveness of the conduct and whether senior management was involved; was the violation caused by the “exploitation of an inadequate compliance program or system of internal controls”; and finally, if “compliance personnel were involved or were basically negligent in failing to “appropriately escalate or respond to red flags.””

Compliance professionals should use the Monaco Doctrine, Memo, and related speeches to explain to senior management to educate C-Suite and Board leadership why and how an investment in compliance can pay off. For compliance professionals your work became much more important.