The fight against fraud, bribery and corruption is never ending. Since the global financial crisis, authorities in the US, the UK and elsewhere have attempted to combat corporate malfeasance wherever it is found. Self-reporting has become one important mechanism, which, although risky, allows companies to benefit from deferred prosecution agreements (DPAs) and the reduced penalties they confer.
Enforcement authorities have been seeking to incentivise corporate self-reporting of fraud, bribery and corruption, but deciding whether to do so is a complex issue. Once a disclosure is made it cannot be undone. Even if the reported activity results in no significant action from the authorities, the report itself can have an impact on trading activity and market confidence. Any report, therefore, needs to be made following a detailed internal investigation dealing with a range of factors.
The role of the DPA and increased self-reporting
Measures in the UK, such as the introduction of the Bribery Act 2010 and formal guidance published by the Serious Fraud Office (SFO), have encouraged companies to self-report. "The SFO is responsible for overseas offences but the police can also investigate domestic bribery and corruption," explains Mark Surguy, a partner at Weightmans LLP. "Prosecution is carried through by the Crown Prosecution Service (CPS). There is no equivalent formal guidance for self-reporting beyond the SFO. The SFO has developed its practice by reference to the US system. In the US, the Department of Justice (DOJ) has its own enforcement policy that deals with self-reporting. The importance of self-reporting is underscored by the benefits that can be gained by reporting suspected offences to the authorities."
Self-reporting is necessary if companies wish to gain credit from prosecutors. "The SFO and the courts have repeatedly emphasised the importance they place on self-reporting in considering whether a company has cooperated for the purpose of assessing whether a DPA will be approved or even offered, although whether or not seeking a DPA is the best strategy will very much depend on the facts and the broader commercial and legal context," says Pamela Reddy, a partner at Norton Rose Fulbright.
The DPA regime provides greater certainty on the potential outcome of an investigation, as well as the opportunity to resolve matters without criminal prosecution, thereby avoiding debarment, for example. "The increase of self-reporting also needs to be considered alongside other contextually relevant developments, such as the increase of whistleblowers and investigative journalism, through which conduct may otherwise become known to the enforcement agencies," says Satnam Tumani, a partner at Kirkland & Ellis.
If a company uncovers bribery and corruption, choosing not to report may be harmful to its defence. However, despite the SFO's guidance, the outcomes for corporates engaging with the authority have been unpredictable. "The Rolls Royce DPA was controversial due to the absence of a self-report, although the SFO and judge explained that the exemplary cooperation provided by the company in the DPA process was akin to a self-report," says Louise Hodges, a partner at Kingsley Napley. "The current director of the SFO has made it clear that a self-report and cooperation are prerequisites of a DPA."
"There have been a number of DPAs but some of these, such as Rolls Royce, have been offered despite the company not self-reporting," says Roland Ellis, a partner at Bivonas Law. "Tesco entered into a DPA and then saw the judge in the criminal prosecution direct the acquittals of the individuals charged while Barclays was charged, but the case against them was dismissed."
Seemingly, the key to achieving a DPA is ensuring that cooperative behaviour is genuine and proactive. "While there is not a checklist of what constitutes cooperative behaviour, there are examples contained in the DPA Code of Practice and DPAs which provide some guidance," says Neil Swift, a partner at Peters & Peters Solicitors LLP.
In the US, as well as the UK, the introduction of the Foreign Corrupt Practices Act (FCPA) Pilot Program in the spring of 2016 was also significant. The Pilot Program permitted prosecutors to consider a declination when a company self-reports, cooperates fully and remediates the misconduct. "Prior to 2016, the decision to self-report under the FCPA was based on a cost-benefit analysis cobbled together from the Principles of Federal Prosecution of Business Organisations in the US Attorneys' Manual, Chapter 8 of the US Sentencing Guidelines, a series of memoranda issued by various deputy attorneys general, the DOJ/Securities and Exchange Commission (SEC) FCPA Resource Guide, parsing the language of published resolutions to understand the stakes for similarly situated companies, and relying on experienced counsel to provide the necessary context," explains William D. Semins, a partner at K&L Gates.
Commercial realities of self-reporting
Once a company has discovered potential wrongdoing, there is, ultimately, a judgement to be made about self-reporting. Senior leaders must fully understand the benefits and risks involved before making a decision. "Whether to self-report the violation tends to be a more complicated analysis that turns on a variety of factors, including when the violation occurred, the likelihood that a government agency will discover the violation, and the potential penalties at issue," says Michael Casey, a partner at Kirkland & Ellis.
"Ultimately there is a judgement to be made and there are a number of factors to take into account," notes Ms Hodges. "For instance, companies need to be aware of the scale and frequency of the misconduct, the seniority of the protagonists, any benefit, or otherwise, for the company, and their ability to fix the problem. Companies must also be mindful of the chances of being discovered and in which jurisdictions, the risk posed by a whistleblower or third-party disclosing the conduct, any reporting obligations including under relevant anti-money laundering legislation or regulations, and the risk of a prosecution and conviction if the conduct is discovered."
For firms in the UK, the decision to self-report largely depends on the likelihood of discovery by the SFO. "The SFO tends to be more reactive than proactive, and unless there is either an internal or external whistleblower, there will be a temptation to avoid reputational and financial damage by rectifying the issue internally," says Mr Ellis.
Commercial realities will weigh on the decision of whether to investigate and report. "Internal investigations are not cheap," says Mr Swift. "It takes time to properly investigate an allegation sufficiently to determine whether, when, and to which entity to report to. There is also the impact of negative publicity, if there are public announcements, as well as the risk of inciting interest from other agencies in other jurisdictions to begin investigations, at further financial and other cost to the company. Of course, the risk of ignoring the wrongdoing or fixing the problem and moving on is that if the conduct comes to the enforcement agency's attention through alternative channels the company would likely face a greater risk of prosecution without the chance of avoiding it through the DPA process."
Steps to be taken when reporting
Properly structuring and conducting an internal investigation is vital. "Each case is very fact specific," says Mr Tumani. "The key initial investigation considerations for a company when investigating potential wrongdoing include ensuring that any investigation strategy and response is in line with the expectations of both internal stakeholders and the potential enforcement authorities, ensuring document preservation, ensuring that any electronic materials are collected in a forensically sound manner, and not tipping off potential suspects or unnecessarily contaminating witnesses."
Furthermore, the timing of a self-report is critical. "A premature notification is undesirable but a DPA will only generally be available following a 'genuinely proactive approach' involving self-reporting within a 'reasonable' timeframe, " says Richard Reichman, a partner at BCL Solicitors. "The position in all jurisdictions needs to be considered simultaneously, with self-reports coordinated appropriately."
Companies must also ensure that the relevant regulatory authorities do not become aware of any issue through other channels before the self-report can occur. A balance has to be struck between understanding the issues to be reported and making sure that the company raises the alarm quickly enough. "A company must ensure that the matter is investigated promptly, thoroughly and independently and that appropriate remediation steps are taken," says Ms Reddy. "It is essential that companies think about the broader issues which may arise from allegations, such as civil litigation, and seek to protect the investigation with legal privilege. Deciding to self-report is only the first stage in what is likely to be extensive and lengthy cooperation."
If a company does choose to self-report, the authorities will also want to examine the scope and process of the company's investigation, in order to gain comfort that all similar misconduct has been identified and thoroughly reviewed. "The government wants to be assured that this sort of misconduct is not endemic to a corporation's culture," says Mr Semins. "The compliance function at the company will also be heavily scrutinised."
The future of reporting
Self-reporting in the UK will soon change. The SFO is to issue guidance regarding self-reporting expectations, which will likely be welcomed by many companies given the current uncertainty. Thus far, SFO director Lisa Osofsky has adopted a more measured approach to combating fraud, while making it clear that the SFO will not tolerate companies hiding behind legal privilege in order to avoid proper scrutiny of their wrongdoing. "Recent comments from Ms Osofsky have indicated that while privilege is a fundamental right, waiver in relation to initial investigative material is a strong indicator of cooperation," says Mr Reichman. "Further clarity regarding what amounts to cooperation in the context of DPAs will be welcome."
There is hope that the new guidance will indicate how companies are likely to be treated if they approach the SFO. "The most significant developing issue is whether the incentives created by the US and UK governments are strong enough to get companies to disclose potential violations," says Mr Casey. "Although the benefits provided to self-disclosing parties are meaningful, they may not be significant enough for companies to elect to affirmatively disclose misconduct."
The SFO is not likely to offer a DPA to a company that might reoffend, notes Mr Surguy. This means that senior managers involved in or aware of corrupt conduct will probably have to be removed from the company. The policy of rewarding openness via self-reporting, along with the instigation of compliance programmes with a DPA, has now been firmly established.
Clear guidance on self-reporting from enforcement agencies is needed to refine practices, increase cases and build experience. "The UK may in time move closer to the US model and offer 'guaranteed' non-prosecution in defined circumstances," says Mr Surguy. "The use of DPAs is growing across the globe, although the approach is by no means a standard one. More cooperation, potentially via international treaties, will be seen between prosecuting authorities in different states, and this will contribute to a more homogenous approach to self-reporting."
Previously published in Financier Worldwide Magazine.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
