US Compliance Enforcement – Securities

The aggressive US enforcement landscape has encouraged an
increasing focus on corporate compliance programmes. Companies
under US jurisdiction can face significant consequences in
white-collar matters, from long and intrusive government probes and
reputational damage to headline-catching penalties. US authorities
have been effective both in messaging the importance of compliance
programmes and in providing concrete incentives for companies to
invest in compliance, to self-police and – in the event an
issue arises – to consider disclosing the misconduct and
cooperating with authorities.² In this chapter, we
explain how compliance factors into US white-collar enforcement and
describe key considerations in that regard for companies facing
potential enforcement actions and embarking on the reporting and
settlement process with the US authorities.

US compliance enforcement landscape

The US Department of Justice (DOJ) and the US Securities and
Exchange Commission (SEC) have each set clear expectations with
respect to compliance programmes through their enforcement actions,
enforcement policies and public statements from their leadership.
Generally, the DOJ has criminal and civil enforcement authority
over misconduct with US touchpoints, whether through jurisdiction
over US nationals, residents and businesses, including their
agents, or over entities and individuals who engaged in misconduct
while in the territory of the United States. The SEC, in turn, has
civil jurisdiction over US issuers, including with regard to
violations of statutory provisions that require maintenance of
adequate internal controls and accurate books and records.
Companies subject to SEC jurisdiction, in particular, tend to
invest in more robust compliance programmes.

Both agencies expect pre-incident, proactive efforts by
companies to implement tailored compliance programmes that address
key operational risks and prevent the types of misconduct most
likely to occur in a company’s line of business. The agencies
view compliance programmes as the front line in combatting
corporate misconduct by preventing it in the first place and expect
that companies will not only maintain effective compliance
programmes but also empower their compliance functions with the
support of senior management and the company’s board of
directors. Without sufficient investment in compliance, the
government warns, companies face the risk of significant penalties
down the line.³

Both agencies also closely evaluate the maturity of a compliance
programme as they consider their charging decisions and structure
of settlements. For instance, as is addressed in more detail below
in ‘Compliance considerations in government reporting and
settlement discussions’, assessment of a compliance programme
can affect the type and duration of a non-trial resolution
agreement and whether there is a need to impose an external
compliance monitor.⁴

Companies and their compliance personnel are not in the dark
with respect to the DOJ’s and the SEC’s expectations. As
explained in Chapter 3, although there are ‘no formulaic
requirements’,⁵ the guidelines set forth in the
DOJ’s ‘Evaluation of Corporate Compliance Programs’
(ECCP) in particular set the stage for the assessment of corporate
compliance efforts.⁶ The ECCP, which was issued in
February 2017 and most recently updated in June 2020, contains the
most comprehensive discussion of the government’s expectations
with respect to compliance and is intended to assist prosecutors in
evaluating compliance programmes as part of their enforcement
decisions. The ECCP is structured around three fundamental
questions: whether a compliance programme (1) is ‘well
designed’, (2) ‘adequately resourced and empowered to
function effectively’ and (3) works in practice.⁷ In
short, the government is looking for more than a ‘paper
programme’. This position was well illustrated in a recent
statement by Assistant Attorney General (AAG) Kenneth A Polite Jr,
who noted that the government wants ‘to know more than dollars,
headcount, and reporting lines’; will review the
‘qualifications and expertise of key compliance personnel and
other gatekeeper roles’; and wants to see that ‘compliance
officers have adequate access to and engagement with the business,
management, and the board of directors’.⁸

Enforcement actions arising from compliance deficiencies

Lack of robust policies and internal controls, inadequate
enforcement of adequate policies or controls, or other compliance
failures can give rise to civil and criminal liability for
companies. In the anti-corruption space in particular, enforcement
actions often arise from companies’ inability to design and
implement anti-corruption compliance measures to adequately address
their operational risks. The DOJ’s and the SEC’s
‘Resource Guide to the Foreign Corrupt Practices Act’ (the
FCPA Resource Guide) highlights that an ‘assessment of a
company’s compliance program, including its design and good
faith implementation and enforcement, is an important part of the
government’s assessment of whether a violation occurred, and if
so, what action should be taken’.⁹

The examples below from recent FCPA enforcement actions
highlight some key considerations for companies looking to better
implement and scale their compliance programmes. These enforcement
actions serve as a helpful illustration of the DOJ’s and the
SEC’s standards with respect to compliance, as well as a
warning of the severity of consequences that can follow when the
government’s expectations are not met.

The need to fully implement compliance policies

From an enforcement perspective, establishing a compliance
programme is a necessary step, but certainly not a sufficient one.
Although companies can place a lot of emphasis on designing robust
policies, it is essential to implement and test equally robust
processes to support those policies, because companies may face
exposure for failing to follow their own compliance policies. In
2018, the SEC charged medical devices company Stryker with
violations of the FCPA’s books and records and internal
accounting controls provisions in connection with its business in
India, China and Kuwait. This was the second time in five years
that the company had been charged with FCPA
violations.¹⁰ Although Stryker had anti-corruption
policies and internal controls in place, the SEC found that the
company ‘failed to sufficiently implement its
policies’.¹¹ Of particular note, the SEC found that
Stryker failed to follow its own policies that required due
diligence and training of sub-distributors in China, and, in
Kuwait, failed to test whether its distributor would allow the
company to exercise its audit rights or otherwise assure that it
was complying with Stryker’s anti-bribery policy. Stryker
agreed as part of the resolution to retain a compliance consultant
to review and evaluate its internal controls, policies and
procedures.¹²

The importance of adequate accounting controls

Internal accounting controls are an important consideration for
US issuers in particular. In 2022, Korean telecommunications
company KT Corporation paid US$6.3 million to settle charges that
it used slush funds to give gifts and illegal political
contributions in Korea, as well as using an intermediary to
generate funds to pay bribes to government officials in
Vietnam.¹³ The SEC highlighted deficiencies in KT
Corporation’s internal accounting controls, noting that the
company ‘lacked sufficient internal accounting controls over
charitable donations, third-party payments, executive bonuses, and
gift card purchases’.¹⁴

Ensure senior support

Both the DOJ and the SEC have repeatedly noted the importance of
ensuring that a company’s compliance function has the strong
support of senior executives and the board of directors. This
includes ‘tone at the top’. In 2020, US-based consumer loan
company WAC resolved FCPA charges relating to its Mexican
subsidiary. The SEC called out WAC’s management for having a
tone at the top that ‘did not support robust internal audit and
compliance functions, and undermined the effectiveness of those
functions’.¹⁵ In fact, WAC terminated the internal
audit vice president after he raised compliance concerns, combined
internal audit and compliance functions and imposed staffing
pressure, and allowed a general counsel with no prior audit or
accounting experience to be in charge of the combined
function.¹⁶ The company paid US$21.7 million to resolve
the SEC’s charges.

Ensure sufficient compliance resources

Successful implementation of compliance policies and procedures
is contingent on sufficient resource allocation into compliance.
Companies that have established policies without adequate resources
can still run into trouble. In 2019, the SEC charged the global oil
and gas services company TechnipFMC plc with violations of the
FCPA’s provisions on anti-bribery, books and records, and
internal accounting controls in connection with payments made to a
consultant who in turn paid bribes to Iraqi government
officials.¹⁷ The company agreed to pay US$5 million to
settle with the SEC. Notably, the SEC’s order highlighted that
TechnipFMC ‘devoted insufficient resources to compliance
concerning its Iraq business’.¹⁸

Proper scaling of compliance programmes in international
expansion

Aggressive international expansion, including through
acquisition of foreign entities, can significantly heighten
companies’ compliance risks. Several large FCPA actions in
recent years arose from situations in which companies did not
adequately scale their compliance programmes as they expanded their
foreign operations into high-risk jurisdictions. For instance, in
2019, US-based Walmart Inc settled the DOJ’s and the SEC’s
FCPA investigations that alleged the company was ‘valu[ing] international growth and cost-cutting over
compliance’.¹⁹ Walmart paid US$282 million to settle
charges that it violated the FCPA’s provisions on books and
records and internal controls relating to its subsidiaries in
Mexico, Brazil, India and China.²⁰

Similarly, in 2021, London-based WPP plc, the world’s
largest advertising company, settled FCPA charges regarding the
advertising agency’s subsidiaries in India, China, Brazil and
Peru.²¹ WPP had aggressively grown to employ
approximately 100,000 people at more than 3,000 locations in 112
countries,²² but despite the ‘known corruption and
fraud risks inherent’ in its acquisitions (where founders and
chief executive officers (CEOs) of the acquired entities retained
significant control over local operations), WPP did not have a
compliance department or proper coordination between its legal,
internal audit and other units responsible for managing local
subsidiaries.²³

Finally, in 2022, the waste management company Stericycle
settled parallel civil and criminal charges brought by US and
Brazilian authorities in respect of bribery of foreign officials in
Argentina, Brazil and Mexico.²⁴ According to
Stericycle’s settlement papers, while expanding through
acquisitions of local and regional businesses in Latin America, the
company maintained a mostly decentralised compliance department and
accounting processes.²⁵ The SEC announced its settlement
order with a warning for rapidly expanding companies:
‘Companies in pursuit of global expansion cannot disregard the
need for appropriate controls.’²⁶

Compliance considerations in government reporting and
settlement discussions

In active enforcement actions, compliance programmes are
evaluated at several stages of a company’s dialogue with the
government, and are an important factor in the government’s
decisions about the scale and structure of resolutions for
companies seeking a settlement. First, compliance considerations
are specifically cited among the factors that prosecutors must
consider when making charging decisions (i.e., The Principles of
Federal Prosecution of Business Organizations,²⁷ known
as the Filip Factors). Second, the strength of a compliance
programme and a company’s remediation and enhancements are
considered when awarding discounts on penalties. And third,
compliance is, of course, the key consideration when authorities
decide whether to impose an external monitor.

In light of this approach, companies engaged in a reporting
relationship with the US authorities tend to place significant
emphasis on proactively approaching compliance enhancements during
the course of an investigation and in anticipation of settlement
discussions, including to maximise available discounts and to
mitigate the burden and costs of a monitorship. As the DOJ’s
and the SEC’s expectations have become clearer through
enforcement actions and formal policies, companies have become more
sophisticated in their approach to remediation. In the past,
compliance presentations to the authorities may have focused almost
entirely on the contents of the company’s code of conduct and
other policies; nowadays, companies are advised to provide more
practical information to the government on their compliance
programmes and explain exactly how they are implemented, tested and
monitored over time.

Filip Factors

The maturity of a compliance programme is one of the factors
that prosecutors consider in determining whether and what charges
to bring in the first place. The DOJ’s Filip Factors list 11
considerations that companies should expect to discuss when seeking
to convince the government not to bring charges or when negotiating
a settlement, including two that specifically relate to a
company’s compliance programme.²⁸ With respect to
compliance, prosecutors are instructed to consider (1) the adequacy
and effectiveness of the compliance programme at the time of the
alleged misconduct and at the time of a charging decision, and (2)
remedial actions, including any efforts to implement an adequate
and effective corporate compliance programme or to improve an
existing one.²⁹

Of course, compliance programmes, even those that specifically
prohibit the misconduct at issue, are not themselves sufficient to
justify not charging a corporation,³⁰ but the existence
of a robustly enforced and risk-tailored programme ‘may be
considered in determining whether the employee in fact acted to
benefit the corporation’, which then enables a prosecutor to
determine ‘whether the corporation has adopted and implemented
a truly effective compliance program that, when consistent with
other federal law enforcement policies, may result in a decision to
charge only the corporation’s employees and agents or to
mitigate charges or sanctions against the
corporation’.³¹

Enforcement authorities consider ‘reform’ as a factor in
evaluating a corporation’s remedial efforts. Accordingly, the
government recognises that although the inadequacy of a compliance
programme may be to the corporation’s disadvantage, ‘quick
recognition of the flaws in the program and [the corporation’s] efforts to improve the program are also factors to consider as to
the appropriate disposition of a case’.³² The Filip
Factors demonstrate that compliance efforts do not have to be
perfect to earn credit in a resolution, but there has to be
proactive participation by the corporation at every stage.

The Filip Factors’ expectations for compliance programmes
are very similar to the ECCP factors discussed above. Consistent
with this practical approach, in applying the Filip Factors, the
government will consider, among other elements:

• • the company’s culture of compliance;

• • resources dedicated to compliance;

• • the quality, experience, compensation, promotion and reporting
    structure of personnel involved in compliance;

• • the compliance function’s level of authority and
    independence and the availability of compliance expertise to the
    board;

• • the effectiveness of risk assessments and their use in
    tailoring the programme; and

• • auditing of the compliance programme.³³

The key takeaway is that an effective compliance programme is
not derived through a one-size-fits-all approach, but rather
adapted to the company’s specific circumstances and evaluated,
in part, based on a company’s size and
resources.³⁴

The government’s standards are again reflected in
enforcement actions that cite to compliance enhancements. For
instance, in 2020, the DOJ announced the landmark US$3.9 billion
global settlement with Airbus, involving FCPA charges, which was
coordinated with enforcement authorities in France and the United
Kingdom. The DOJ’s deferred prosecution agreement (DPA) with
Airbus referenced a number of compliance enhancements undertaken by
Airbus.³⁵ The company was recognised for, among other
initiatives, its hiring of new legal and compliance leadership,
application of enhanced due diligence procedures, provision of
additional compliance training to employees, enhancements relating
to management of third-party relationships, and ongoing reviews of
its compliance programme³⁶ Partly because of its
remediation efforts and the state of its compliance programme at
the time of the resolution, Airbus was not required to retain an
independent compliance monitor.

Similarly, in announcing Stericycle’s resolution in 2022,
the SEC explained that the company did not have sufficient controls
or a compliance department in place at the time of alleged
misconduct to ‘prevent or even detect the
misconduct’.³⁷ The DOJ and the SEC noted the
company’s remediation in that regard:

• • divestment of problematic subsidiaries in Argentina and
    Mexico;

• • termination of relationships with problematic employees and
    third parties;

• • strengthening of its corporate governance by appointing new
    senior management and directors;

• • enhancement of its compliance infrastructure by hiring more
    local compliance personnel and an experienced chief ethics and
    compliance officer (who reports directly to the CEO and chair of
    the board’s audit committee);

• • updates to relevant policies and procedures; and

• • enhancement of internal reporting and risk assessment processes
    and anti-corruption compliance training.³⁸

Remediation incentives

The best illustration of monetary incentives the authorities
provide to incentivise compliance enhancements is the DOJ’s
‘Corporate Enforcement Policy’, which provides –
initially in the FCPA space but now also more broadly – that
voluntary self-disclosure, full cooperation, and timely and
appropriate remediation can yield a 50 per cent reduction off the
low end of the US Sentencing Guidelines³⁹ fine range (or
25 per cent absent self-disclosure).⁴⁰

In practice, the remediation prong is satisfied by companies
taking disciplinary action against wrongdoers, terminating
problematic third-party relationships and payment streams, and
enhancing their compliance programmes to better discourage, detect
and prevent future violations. The DOJ has made it clear that
‘[i]mplementation of an effective compliance and ethics
program’ is required to receive full remediation
credit.⁴¹

By way of example, in June 2021, Amec Foster Wheeler Energy
Limited, a subsidiary of a UK-based global engineering company,
concluded a DPA with the DOJ to settle charges in respect of a
bribery scheme in Brazil.⁴² The company received the
full 25 per cent cooperation and remediation discount because,
among other factors, it engaged in significant remedial measures,
such as ‘implementation of enhanced policies, procedures and
internal controls relating to . . . anti-corruption compliance,
including retention and management of commercial agents’, as
well as enhancements to its training and internal reporting
programmes, and dismissal of certain employees.⁴³
Similarly, when Deutsche Bank AG settled FCPA and market
manipulation charges with the DOJ in January 2021, it received a 25
per cent discount off the middle of the Sentencing Guidelines
range.⁴⁴ Its DPA noted that Deutsche Bank engaged in
remedial measures, including ‘significantly’ enhancing its
internal controls and anti-corruption programme, and its
third-party intermediary programme on a global basis.⁴⁵
The Deutsche Bank DPA imposed requirements that all third-party
arrangements be approved and be reviewed annually by the
company’s anti-corruption function, and enhanced due diligence
procedures and practices in respect of
intermediaries.⁴⁶

Compliance monitors

One of the most tangible incentives for compliance enhancements
is the potential avoidance of an external monitor. The government
views monitors as ‘effective tools for strengthening corporate
compliance programs’⁴⁷ and as ‘allies’ to
compliance personnel in creating ‘lasting, sustainable change
in corporate culture’.⁴⁸ From a company’s
perspective, however, the imposition of a multi-year monitorship is
not only costly, but burdensome and potentially even disruptive to
its operations.

The DOJ Office of the Deputy Attorney General’s memorandum
of October 2021 (the Monaco Memorandum) outlines the
government’s updated considerations regarding the imposition of
monitors in corporate resolutions. The Monaco Memorandum recognises
that independent corporate monitors can be an ‘effective
resource in assessing a corporation’s compliance’ with the
terms of a resolution and an ‘effective means of reducing the
risk of repeat misconduct and compliance lapses identified during a
corporate criminal investigation’.⁴⁹ Prosecutors are
instructed to consider when determining whether an external monitor
is appropriate: ‘(1) the potential benefits that employing a
monitor may have for the corporation and the public, and (2) the
cost of a monitor and its impact on the operations of a
corporation.’⁸⁰ In civil cases, the government can
also require that a company retain an independent compliance
consultant or monitor to ‘provide an independent, third-party
review of the company’s internal
controls’.⁵¹

Although the DOJ and the SEC each can impose corporate monitors,
their approach to monitorships has varied over the years. For
instance, between 2015 and 2019, the government imposed monitors in
approximately 20 per cent of FCPA resolutions, but then no monitors
in 2020 and 2021. In 2021, the DOJ reversed Trump-era guidance that
corporate monitors should be imposed as the exception rather than
the rule, noting that prosecutors will consider a monitor where a
compliance programme is ‘untested, ineffective, inadequately
resourced, or not fully implemented at the time of a
resolution’.⁵² The DOJ invoked that language when
imposing monitors on Stericycle and Glencore in 2022. Stericycle
received a two-year monitorship as the company had ‘enhanced
and has committed to continuing to enhance its compliance
program’,⁵³ while Glencore received a three-year
monitorship (the standard term) because the DOJ found that its
compliance enhancements were new and ‘have not been fully
implemented or tested to demonstrate that they would prevent and
detect similar misconduct in the future’.⁵⁴ These
recent decisions indicate that partial but incomplete remediation
may nevertheless result in an undesirable monitorship.

Reporting on compliance to enforcement authorities

In light of the above-mentioned incentives for compliance
remediation, companies often consider a more proactive approach to
compliance enhancements in preparation and during a dialogue with
enforcement authorities. For instance, a company dealing with an
issue that arose from third-party relationships may not only
terminate problematic relationships but also undertake a broader
audit or risk-based review of third-party relationships. Similarly,
issues relating to inter­national operations may prompt a
company to undertake broader risk-based assessments in any
high-risk jurisdictions in which they operate. These strategies are
all intended to better position a company to maximise the
cooperation and remediation credit and stave off the imposition of
a monitor.

In a typical reporting relationship, companies will deliver a
presentation to the government on their compliance programme and
related enhancements and then respond to any enquiries and requests
from the government for further information relating to their
compliance efforts. The presentation can be a standalone
remediation presentation or, especially in DOJ actions, included in
the Filip Factors presentation, where company representatives meet
with enforcement officials to present the company’s position on
factors the agencies are known to consider in their charging and
settlement decisions.

Importantly, during those presentations, companies will often
face experienced compliance specialists at the other side of the
table because the agencies have continued to invest in their
internal compliance expertise. For instance, in 2015, the DOJ
retained a full-time compliance expert, Hui Chen, to assist
prosecutors when evaluating corporate compliance programmes as part
of enforcement actions. Chen was highly regarded in her role but
left the post in 2017, citing differences with the Trump
administration.⁵⁵ After several years without clear
direction about the role, the DOJ hired Lauren Kootman in March
2021 as a trial attorney and compliance specialist.⁵⁶
Kootman’s appointment coincided with the DOJ’s move towards
building a team of dedicated compliance specialists. In March 2022,
AAG Polite announced that the DOJ had ‘revamped’ the
Criminal Division Fraud Section’s former Strategy, Policy, and
Training Unit into the Corporate Enforcement, Compliance, and
Policy Unit (CECP) with new management comprised of
‘prosecutors and former compliance and defense lawyers with
deep experience in compliance, monitorships, and corporate
enforcement matters’ and plans to continue building up the
group.⁵⁷ CECP attorneys assess reports submitted by
companies and evaluate progress by reviewing and testing compliance
programmes and making enhancements, where necessary, to ensure that
companies have ‘effective and sustainable’ compliance
programmes.⁵⁸

With this additional expertise on the government side, companies
would be well advised to make their compliance presentations
concrete and practical and ensure they are supported by metrics and
data. Enforcement officials pay particular attention to answers
provided by companies during Filip Factors presentations, which can
be a real sign of the effectiveness of compliance
programmes.⁵⁹ According to recent guidance provided by
AAG Polite,⁶⁰ companies preparing for compliance
presentations should keep in mind some important points:

• • Companies making presentations ‘will face tough and
    probing’ questions. The government expects companies to
    ‘demonstrate how a compliance program has been upgraded to
    address the root cause of the misconduct, and how it is being
    tested and updated to ensure that it is sustainable and adaptable
    to changing risk’.⁶¹

• • The government expects active and meaningful participation from
    the company’s chief compliance officer (CCO) (or equivalent
    position), who should be ‘leading the compliance presentation
    and demonstrating knowledge and ownership of the compliance
    program’.⁶² In fact, Polite noted that the general
    counsel’s answering of a question that the DOJ posed to the CCO
    during a recent Filip Factors presentation demonstrated to Polite
    ‘literally and figuratively’ that the CCO had ‘no voice
    in that organization’.⁶³

• • In addition to the CCO, other senior management is encouraged
    to participate in discussions, take ownership of their role in
    compliance, and demonstrate ‘commitment to
    compliance’.⁶⁴

In summary, enforcement authorities focus on evaluating
compliance programmes throughout the enforcement life cycle. The
government takes into consideration a company’s compliance
structure and efforts in (1) assessing any potential remediation
credits, (2) making charging decisions, and (3) determining
continuing reporting obligations or the need for an external
monitor. Companies and their key personnel are expected to
demonstrate thoughtful and active engagement throughout the entire
process.

Post-settlement compliance enforcement

US authorities’ compliance enforcement does not stop with a
negotiated resolution. A standard negotiated agreement, whether a
DPA or a non-prosecution agreement (NPA), even in the absence of an
external monitor, sets out continuing obligations with respect to
maintenance of an effective compliance programme.⁶⁵
There are two recent trends that point to the government’s
increasing focus on enforcement of those commitments.

First, the DOJ now requires a certification from
corporations’ CEOs and CCOs at the end of a DPA or NPA that the
company’s compliance programme is ‘reasonably designed and
implemented to detect and prevent violations of the law . . . and
is functioning effectively’.⁶⁶ When this new
certification requirement was announced by AAG Polite in March
2022, he insisted that this step, rather than punitive, is intended
to ’empower’ CCOs by ensuring that they have data and
access to ‘all relevant compliance-related information and can
voice any concerns they may have prior to
certification’.⁶⁷ It remains to be seen whether the
DOJ will require this certification in every case or just in those
that it views as egregious.

Second, the DOJ’s recently increased scrutiny of non-trial
resolutions, and allegations of DPA breaches, further emphasise the
importance of maintaining robust compliance programmes even after a
settlement is reached. In October 2021, and again in March 2022,
Ericsson announced that the DOJ had determined that the company had
breached its 2019 DPA arising from FCPA violations.⁶⁸
Ericsson’s DPA, as is standard in FCPA settlements, included an
ongoing commitment to cooperate with continued investigations and
to truthfully disclose information in response to DOJ enquiries, as
well as to proactively report any newly uncovered evidence or
allegations of FCPA violations during the DPA’s three-year
term.⁶⁹ The agreement provided that if the DOJ
determined that Ericsson had breached the agreement by failing to
uphold its obligations, the company could be subject to prosecution
if its explanation was not satisfactory. The first breach involved
the DOJ’s determination that Ericsson had failed to provide
certain disclosures of relevant documents and factual
information.⁷⁰ The second breach concerned insufficient
disclosures made by Ericsson to the DOJ about its internal
investigation into misconduct in Iraq.⁷¹

The first Ericsson breach announcement came at a time when US
enforcement authorities had emphasised their commitment to holding
companies accountable to their agreements with the government. In
an October 2021 speech, the DOJ’s principal Associate Deputy
Attorney General John Carlin warned companies with DPAs and other
negotiated agreements that the agency would ‘make sure that
those who get the benefit of such an arrangement comply with their
responsibility[] [a]nd if not, [companies] should expect to see
serious repercussions’. Carlin specified that violations of
DPAs ‘may result in punishment greater than the original
sentence’.⁷²

Following Ericsson’s second breach, DOJ prosecutors found in
March 2022 that Deutsche Bank had also violated its 2021 DPA
arising from FCPA and market manipulation charges.⁷³ DOJ
prosecutors determined that Deutsche Bank had violated its DPA by
failing to timely disclose a whistleblower complaint regarding the
bank’s investments in environmental, social and governance
initiatives, which was discovered by the DOJ from media
reports.⁷⁴ As a result of the breach, Deutsche
Bank’s monitorship was extended for another year (i.e., until
February 2023).⁷⁵

Overall, these examples demonstrate unequivocally that
successful compliance and remedial efforts must continue past the
point of a resolution of a white-collar matter. As Deputy Attorney
General Lisa Monaco announced in October 2021, DPAs and NPAs are
not a ‘free pass’, and violation of their obligations carry
significant risk of harsher enforcement.⁷⁶

Conclusion

Enforcement history, government guidance and recent trends all
point in the same direction: compliance is a critical aspect of
corporate enforcement in the United States. Companies subject to US
jurisdiction are advised to make a concerted and continuous effort
towards building and maintaining an effective compliance programme
to prevent wrongdoing or, should an issue arise, position
themselves favourably during interactions with enforcement
authorities and maximise the prospect of securing a successful
resolution. The government is clear in expecting a carefully
planned, well-resourced and flexible compliance programme that can
be adapted to changes in the circumstances and size of a
business.

As described above, compliance programmes affect every part of a
company’s interactions with US enforcement authorities.
Authorities expect proactive efforts by companies to implement
tailored compliance programmes to address their main risks and
prevent the types of misconduct most likely to occur in their
businesses. For companies that find themselves subject to
government inquiries, authorities closely evaluate compliance
programme maturity during the course of their investigations and
account for compliance enhancements when considering charging
decisions, and – if deciding to proceed – the nature
and structure of resolutions, the amount of penalties and the need
for an external monitor. And because resolutions impose continuing
obligations regarding maintenance and enhancement of compliance
programmes, the emphasis on compliance does not stop with a
negotiated resolution. In short, as the government continues to
warn, it pays to invest in compliance early.

Footnotes

1. Kara Brockmeyer is a partner, Ivona Josipovic is a
counsel and Andreas A Glimenakis and Berk Guler are associates at
Debevoise & Plimpton LLP.

2. See, e.g., Justice Manual (JM) § 9-28.800, at https://www.justice.gov/jm/jm-9-28000

-principles-federal-prosecution-business-organizations (last
accessed 6 July 2022) (‘The Department encourages such
corporate self-policing, including voluntary disclosures to the
government of any problems that a corporation discovers on its
own.’).

3. U.S. Dep’t of Justice (DOJ), ‘Assistant
Attorney General Kenneth A. Polite Jr. Delivers Remarks at NYU
Law’s Program on Corporate Compliance and Enforcement
(PCCE)’ (25 March 2022) (Polite Speech), https://www.justice.gov/opa/speech/assistant-attorney

-general-kenneth-polite-jr-delivers-remarks-nyu-law-s-program-corporate
(last accessed 6 July 2022).

4. See DOJ, Criminal Division, ‘Evaluation of
Corporate Compliance Programs’ (updated June 2020) (ECCP), https://www.justice.gov/criminal-fraud/page/file/937501/download
(last accessed 6 July 2022); DOJ, Criminal Division and U.S. Sec.
& Exch. Comm’n (SEC), Enforcement Division, ‘A Resource
Guide to the U.S. Foreign Corrupt Practices Act’, Second
Edition (July 2020) (FCPA Resource Guide), https://www.justice.gov/criminal-fraud/file/1292051/download
(last accessed 6 July 2022) (noting that ‘DOJ and SEC also
consider the adequacy of a company’s compliance program at the
time of the misconduct and at the time of the resolution when
deciding what, if any action, to take’).

5. JM, § 9-28.800, cmt.

6. See ECCP (op. cit. note 4).

7. ibid., at 2. See Chapter 3 for additional
discussion.

8. Polite Speech (op. cit. note 3, above).

9. FCPA Resource Guide (op. cit. note 4), at
56–57.

10. SEC, Press Release No. 2018-222, ‘SEC Charges
Stryker a Second Time for FCPA Violations’ (28 September 2018),
https://www.sec.gov/news/press-release/2018-222
(last accessed 6 July 2022).

11. In re Stryker Corporation, Securities
Exchange Act of 1934 Rel. No. 84308, Accounting and Auditing
Enforcement Rel. No. 3990, Admin. Proc. File No. 3-18853,
¶¶ 5–7 (28 September 2018), https://www.sec.gov/litigation/admin/2018/34-84308.pdf
(last accessed 6 July 2022).

12. ibid., at ¶ V(D)(6).

13. In re KT Corporation, Securities Exchange
Act of 1934 Rel. No. 94279, Admin. Proc. File No. 3-20780 (17
February 2022), https://www.sec.gov/litigation/admin/2022/34-94279.pdf
(last accessed 6 July 2022).

14. SEC, Press Release No. 2022-30, ‘Largest South
Korean Telecommunications Co. Agrees to Pay the SEC to Settle FCPA
Charges’ (17 February 2022), https://www.sec.gov/news/

press-release/2022-30 (last accessed 6 July 2022).

15. In re World Acceptance Corporation,
Securities Exchange Act of 1934 Rel. No. 89489, Accounting and
Auditing Enforcement Rel. No. 4158, Admin. Proc. File No. 3-19905
(6 August 2020), https://www.sec.gov/litigation/admin/2020/34-89489.pdf
(last accessed 6 July 2022).

16. ibid., at ¶ 14.

17. In re TechnipFMC plc., Securities Exchange
Act of 1934 Rel. No. 87055, Accounting and Auditing Enforcement
Rel. No. 4087, Admin. Proc. File No. 3-19493 (23 September 2019),
https://www.sec.gov/litigation/admin/2019/34-87055.pdf
(last accessed 6 July 2022). TechnipFMC also entered into a
parallel resolution with the DOJ in relation to bribery schemes in
Brazil and Iraq. See DOJ, Press Release No. 19-714, ‘TechnipFMC
Plc and U.S.-Based Subsidiary Agree to Pay Over $296 Million in
Global Penalties to Resolve Foreign Bribery Case’ (25 June
2019), https://www.justice.gov/opa/pr/technipfmc-plc

-and-us-based-subsidiary-agree-pay-over-296-million-global-penalties-resolve
(last accessed 6 July 2022).

18. ibid., at ¶ 8.

19. SEC, Press Release No. 2019-102, ‘Walmart Charged
With FCPA Violations’ (20 June 2019), https://www.sec.gov/news/press-release/2019-102
(last accessed 6 July 2022).

20. In re Walmart Inc., Securities Exchange Act
of 1934 Rel. No. 86159, Accounting and Auditing Enforcement Rel.
No. 4054, Admin. Proc. File No. 3-19207 (20 June 2019), https://www.sec.gov/litigation/admin/2019/34-86159.pdf
(last accessed 6 July 2022).

21. In re WPP plc, Securities Exchange Act of
1934 Rel. No. 93117, Accounting and Auditing Enforcement Rel. No.
4257, Admin. Proc. File No. 3-20595 (24 September 2021), https://www.sec.gov/litigation/admin/2021/34-93117.pdf
(last accessed 6 July 2022).

22. ibid., at ¶ 6.

23.ibid., at ¶ 7.

24. See Deferred Prosecution Agreement, United States
of America v. Stericycle, Inc., Case No. 22-cr-20156-KMM (S.D.
Fla. 18 April 2022) (Stericycle DPA), https://www.justice.gov/opa/press-release/file/1496416/download
(last accessed 6 July 2022); In re Stericycle, Inc.,
Securities Exchange Act Release No. 94760 (20 April 2022)
(Stericycle Order), https://www.sec.gov/litigation/admin/2022/34-94760.pdf
(last accessed 6 July 2022).

25. Stericycle Order (op. cit. note 24), at ¶¶
4–7.

26. SEC, Press Release No. 2022-65, ‘SEC Charges
Stericycle with Bribery Schemes in Latin America’ (20 April
2022) (Stericycle Press Release), https://www.sec.gov/news/ press-release/2022-65
(last accessed 6 July 2022).

27. JM § 9-28.300 (Filip Factors).

28. Filip Factors (op. cit. note 27).

29. The DOJ clarifies that the Filip Factors do not
constitute an exhaustive list, and some factors may not apply to
individual cases. ibid., at cmt.

30. JM § 9-28.800 at cmt. (‘The existence of a
corporate compliance program, even one that specifically prohibited
the very conduct in question, does not absolve the corporation from
criminal liability under the doctrine of respondeat
superior.’).

31. id. (citing United States v. Beusch, 596
F.2d 871, 878 (9th Cir. 1979)).

32. JM § 9-28.1000.

33. JM § 9-47.120(3)(c).

34. id.

35. Deferred Prosecution Agreement, United States of
America v. Airbus SE, Case No. 1:20-cr-00021-TFH (D.D.C. 31
January 2020), https://www.justice.gov/criminal-fraud/file/1242051/download
(last accessed 6 July 2022).

36. ibid., at ¶ 4, paras. (d) and (e).

37. Stericycle Press Release (op. cit. note
26).

38. Stericycle DPA (op. cit. note 24), at ¶ 4(d);
Stericycle Order (op. cit. note 24), at ¶¶
27–28.

39. United States Sentencing Commission, ‘Guidelines
Manual 2021’.

40. JM § 9-47.120.

41. JM § 9-47.120(3).

42. See Deferred Prosecution Agreement, United States
of America v. Amec Foster Wheeler Energy Limited, Case No.
21-cr-298 (KAM) (E.D.N.Y. 25 June 2021) (Amec Foster DPA), https://www.justice.gov/opa/press-release/file/1411296/download
(last accessed 6 July 2022).

43. ibid., at ¶ 4.

44. See Deferred Prosecution Agreement, United States
of America v. Deutsche Bank Aktiengesellschaft, Case No.
20-00584 (RPK) (RML) (E.D.N.Y. 8 January 2021) (Deutsche Bank DPA),
https://www.justice.gov/opa/press-release/file/1360741/download
(last accessed 6 July 2022).

45. ibid., at ¶ 4.

46. id.

47. Polite Speech (op. cit. note 3, above).

48. Id.

49. DOJ, Memorandum from the Deputy Attorney General
(Lisa O. Monaco), ‘Corporate Crime Advisory Group and Initial
Revisions to Corporate Criminal Enforcement Policies’ (28
October 2021) (Monaco Memorandum), https://www.justice.gov/dag/page/file/1445106/download
(last accessed 6 July 2022).

50. ibid., at 4.

51. FCPA Resource Guide (op. cit. note 4), at
74.

52. Monaco Memorandum (op. cit. note 49), at
4.

53. Stericycle DPA (op. cit. note 24), at ¶
4.

54. DOJ, Press Release No. 22-176, ‘Glencore Entered
Guilty Pleas To Foreign Bribery And Market Manipulation
Conspiracies’ (24 May 2022), https://www.justice.gov/usao-sdny/pr/glencore-entered-guilty-pleas-foreign-bribery-and-market-manipulation-conspiracies
(last accessed 6 July 2022).

55. Clara Hudson, ‘DOJ makes good on compliance
hiring pledge’, Global Investigations Review (2 March
2021), https://globalinvestigationsreview.com/just-anti-corruption/doj-makes
-good-compliance-hiring-pledge (last accessed 6 July 2022). It
was also recognised at the time by former AAG Brian Benczkowski
that the consolidation of compliance expertise in a single person
created ‘inherent limitations’.

56. Dylan Tokar, ‘Justice Department’s Foreign
Bribery Unit Adds Prosecutors, Compliance Expertise’, The
Wall Street Journal (8 March 2021) https://www.wsj.com/articles/justice
-departments-foreign-bribery-unit-adds-prosecutors-compliance-expertise-11615199402
(last accessed 6 July 2022).

57. Polite Speech (op. cit. note 3, above).

58. id.

59. Adam Dobrik, ‘Andrew Wiessman: A key question in
the Filip factors presentation’, Global
Investigations Review (23 May 2016), https://globalinvestigationsreview.com/
just-anti-corruption/andrew-weissmann-key-question-in-the-filip-factors-presentation
(last accessed 6 July 2022).

60. Polite Speech (op. cit. note 3, above).

61. id.

62. id.

63. Kyle Brasseur, ‘DOJ’s Kenneth Polite to CCOs:
Tell me your compliance success stories’, Compliance
Week (17 May 2022), https://www.complianceweek.com/regulatory-enforcement/dojs-kenneth-polite-to-ccos-tell-me-your-compliance-success
-stories/31692.article (last accessed 6 July 2022).

64. id.

65. See, e.g., Deferred Prosecution Agreement, United
States v. Herbalife Nutrition Ltd., Document 4-1, Letter to
Patrick F. Stokes, et al., Case 1:20-cr-00443-GHW, Attachment C (1
September 2020), https://www.justice.gov/criminal/fraud/fcpa/cases/herbalife
-nutrition-ltd (last accessed 6 July 2022). Through Attachment
C of a DPA, the company makes representations regarding its efforts
to enhance and enforce its compliance policies and procedures.
Attachment C also sets out the parameters of the required
compliance programme, and the company’s reporting obligations
to the government.

66. Polite Speech (op. cit. note 3, above). See Plea
Agreement, United States v. Glencore International A.G.,
¶ 9 (S.D.N.Y. 24 May 2022), https://www.justice.gov/usao-sdny/press-release/file/1508166/download
(last accessed 6 July 2022).

67. Polite Speech (op. cit. note 3, above).

68. Deferred Prosecution Agreeement, United States v.
Telefonaktiebolaget LM Ericsson, Letter to Cheryl J. Scarboro,
et al. (26 November 2019), https://www.justice.gov/usao-sdny/press-release/file/1224261/download
(last accessed 6 July 2022).

69. ibid., at ¶ 5.

70. Telefonaktiebolaget LM Ericsson, Press Release,
‘Update on Deferred Prosecution Agreement’ (21 October
2021), https://www.ericsson.com/en/press-releases/2021/10/update-on-deferred-prosecution-agreement
(last accessed 6 July 2022).

71. Telefonaktiebolaget LM Ericsson, Press Release,
‘Update on Deferred Prosecution Agreement’ (2 March 2022),
https://www.ericsson.com/en/press-releases/2022/3/
update-on-deferred-prosecution-agreement (last accessed 6 July
2022).

72. ‘John Carlin on stepping up DOJ corporate
enforcement’, Global Investigations Review (11 October
2021), https://globalinvestigationsreview.com/news-and-features/in-house/
2020/article/john-carlin-stepping-doj-corporate-enforcement
(last accessed 6 July 2022).

73. See Deutsche Bank DPA (op. cit. note 44).

74. Patricia Kowsmann, ‘Deutsche Bank Violates DOJ
Settlement, Agrees to Extend Outside Monitor’, The Wall
Street Journal (11 March 2022), https://www.wsj.com/articles/
deutsche-bank-violates-doj-settlement-agrees-to-extend-outside-monitor-11647016959
(last accessed 6 July 2022).

75. id.

76. DOJ, ‘Deputy Attorney General Lisa O. Monaco
Gives Keynote Address at ABA’s 36th National Institute on White
Collar Crime’ (28 October 2021), https://www.justice.gov/opa/
speech/deputy-attorney-general-lisa-o-monaco-gives-keynote-address-abas-36th
-national-institute (last accessed 6 July 2022).

Previously Published by Global Investigations
Review

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.