Increased scrutiny of internal investigations
The conduct of internal investigations is coming under more scrutiny by enforcement authorities, employees and other stakeholders.
- Conduct of internal investigations - there is a growing body of rules and expectations about how such investigations should be conducted so that the basis of the investigation is transparent (is it independent?), fair (in relation to the treatment of interviewees or the skills of those investigating) and robust (eg the collection and review of data). For example, in France a new joint guide on anti-corruption internal investigations contains ‘best practices’ for conducting an internal investigation. The Disciplinary Court of the Dutch Bar Association has ruled on specific requirements for when a lawyer is carrying out an ‘independent’ investigation, eg on the independence of the investigator and their interactions with parties involved. Similar calls are being voiced in other jurisdictions. In China there are rules which affect how data/evidence can be collected for an internal investigation. Law reforms in the UK mean that internal interviews of senior managers need to be handled even more carefully.
- Privilege and confidentiality of documents - there have been challenges in many jurisdictions concerning whether privilege attaches to documents created during an internal investigation, and a recent legislative attempt to extend legal professional privilege to in-house lawyers’ legal advice in France has failed. A failure to adhere to these rules or expectations risks legal and/or reputational consequences.
How to respond: Be sensitive to the expectations of authorities (which may become involved only at a later stage) when conducting an internal investigation. The rules are evolving, so seek up-to-date advice. It will often be easier to design the internal investigation to factor those expectations in at the outset, rather than reverse-engineer it afterwards. Take local law advice when investigations concern operations or individuals based overseas. There may be special rules, eg about the treatment of interviewees, how data can be collected, or how the investigation can be structured to take advantage of available privileges.
The new ‘senior manager’ test for corporate attribution in the UK means, that before conducting an interview during an internal investigation, consider whether the individual meets the new ‘senior manager’ test. If so, that person’s conduct can be attributed to the company in respect of economic crimes. Consider how to structure the interview to get considered and reliable evidence rather than a knee-jerk reaction. Achieving that may be easier if the individual receives independent legal advice.
Enhanced whistleblowing laws in more countries
The implementation of the EU Whistleblowing Directive in many Member States during 2023 has accelerated the need for businesses to ensure that their whistleblowing reporting lines and policies conform to the new rules. There is an expanded category of workers who can make a whistleblower report (now including interns, temporary workers and new recruits who have not started work), and new rules on where/how reporters can make a report, how the report is triaged, and protections for the whistleblower. Individuals can claim damages for retaliation and there is a reversed burden of proof on the issue of causation between reporting and retaliation.
How to respond: Implementing the new rules will no doubt give greater confidence for whistleblowers to come forward in those jurisdictions, so businesses should expect more internal investigations to be conducted. They should therefore be ready to receive and triage these reports, train those who may be involved, and ensure that any resulting internal investigation is carried out in accordance with applicable laws and expectations.
Treatment of employees and workers in the value chain
Businesses continue to face legal and reputational risk arising from how those who work for them directly, or for businesses in their value chain, are treated. In Australia modern slavery laws are being strengthened, and a new anti-slavery commissioner is being appointed. The French Civil Court ordered a French company to improve its compliance programme following the use of undocumented workers by subcontractors. In many countries there is a growing prevalence of workplace investigations in response to allegations of misconduct, sexual harassment, discrimination, bullying or retaliation. Non-governmental organizations (NGOs) and other activists are trying novel ways of using existing laws to tackle modern slavery issues, eg money laundering law has been used in the UK to try and force the authorities to take action over cotton imported from regions where modern slavery is alleged to be a risk.
Businesses face increasing pressures and obligations globally in respect of supply chain due diligence and modern slavery disclosures which result from new and proposed legislation in jurisdictions such as Belgium, France, Germany, the U.S. and the Netherlands. The European Parliament and the EU Council said on 14 December that they have reached a provisional agreement on a corporate sustainability due diligence directive that aims to introduce rules for companies to protect human rights and the environment. Businesses therefore cannot afford to consider the enforcement risks in only one jurisdiction.
How to respond: Businesses should already be considering supply chain issues and taking steps to address risks such as modern slavery. Careful thought will need to be given to how these types of investigations are structured, bearing in mind the chance of follow-on civil or regulatory action. These issues often intersect with others in relation to environmental concerns or corruption, particularly where third parties are involved. Take an integrated (not siloed) approach to managing ESG issues across a business’ third party ecosystem.
Corruption risk and third parties/intermediaries
Use of third parties/intermediaries remains a high corruption risk. Almost all FCPA and other corruption cases involve the use of third parties or intermediaries to make corrupt payments to win work or obtain confidential data. Enforcement authorities took action in 2023 on corrupt payments made to third parties, including those concealed as, eg consultancy fees, sponsorship or charitable donations. Australia is implementing reforms to its foreign bribery regime. The U.S. Department of Justice’s (DOJ) Evaluation of Corporate Compliance Programs has been updated and has an increased focus on managing third-party relationships. Looking further ahead, the EU Commission is proposing a new directive on combatting corruption which will contain harmonised definitions of criminal offences and increased criminal sanctions.
How to respond: Policies and procedures around the use of such business partners must be properly implemented and reviewed on a regular basis. Ensure that commercial pressures are not trumping adequate due diligence. Compliance and finance functions need to be properly resourced with staff who have the right level of experience, seniority, and clear accountability. Not only will these measures help prevent misconduct, they will also be a mitigating factor should there be any enforcement action.
Data analytics offer insights to drive compliance programmes, and authorities’ expectations in this regard are increasing. Compliance teams should consider whether they use data effectively to: (i) monitor third parties, using real-time data, throughout the lifecycle of the business relationship; (ii) save time and costs; and (iii) inform the design, implementation and effectiveness of compliance programmes. If using an external data company, evaluate the parameters/limits of what they offer, eg how are they defining a state-owned entity or politically exposed person?
Financial services firms should consult the new Wolfsberg Guidance published in 2023.
Environmental initiatives and financial crime risk
Authorities are under pressure to clamp down on crime associated with the environment and climate change. Money laundering is being used as a proxy offence for environmental crimes, eg a criminal complaint was filed by several NGOs against four major French banks accused of laundering the proceeds of illegal deforestation in Brazil.
There is enforcement action relating to greenwashing. While now most is of a regulatory nature, a knowingly dishonest representation about green credentials could trigger criminal liability for fraud, including for a business. There is likely to be pressure to use criminal enforcement in serious cases.
There are bribery and corruption risks associated with the dash for growth and investment in ‘Net-Zero’ related projects such as carbon offsetting and renewable power projects, many of which involve dealing with overseas public officials to win contracts or manage local community issues.
How to respond: A holistic approach to the ‘E’ in ESG requires the bringing together of expertise from a mixture of compliance skillsets (anti-bribery and corruption, anti-money laundering, tax). Businesses should monitor legal and regulatory obligations globally and map them to existing policies and processes, eg third-party risk management, contracting/procurement, M&A and financial and regulatory reporting. Conduct a risk and control assessment. If there are gaps, create a prioritised plan to plug them.
Increased enforcement of tax evasion and public procurement fraud
Governments in many jurisdictions are keen to recoup losses from tax evasion. A new UK corporate criminal offence of ‘failure to prevent fraud’ catches cheating the public revenue. France has introduced a new criminal offence relating to the facilitation of tax fraud, intensified scrutiny of the banking sector, and has collaborated with German authorities in conducting dawn raids on major French banks. The Dutch tax and criminal authorities announced their focus on combatting dividend stripping, and publicly invited market participants to come forward with information on these practices. Corporate tax evasion enforcement has been active in Germany, and this is expected to continue in 2024. The European Public Prosecutor has been very active, with a specific mandate to tackle fraud on the EU. Its most recent Annual Report reveals that it had conducted 1,117 active investigations by the end of 2022, of which 47% were related to VAT fraud.
Public procurement fraud is also costly for the public purse. The UK’s new ‘failure to prevent fraud’ offence is capable of being deployed to prosecute a UK or non-UK company that has defrauded the UK Government in a public procurement context. The UK Public Sector Fraud Authority, formed after the pandemic, has a specific remit to tackle public sector fraud. There are specific new procurement-related offences, eg in South Africa, Italy and Poland, aimed at ensuring transparency and reducing corruption and other interference with procurement processes.
How to respond: Businesses that contract with public authorities should ensure that those representing the business receive financial crime compliance training. The only defence in the UK to a ‘failure to prevent fraud’ offence, which can bite on UK and non-UK companies, is having reasonable procedures in place to prevent fraud. Businesses should conduct a risk assessment on where the risk of fraud lies in their organizations and implement fraud controls if they have not already done so. This may also be a good time to review whether the business still has ‘reasonable prevention procedures’ in place in relation to the UK’s ‘failure to prevent the facilitation of tax evasion’ offence, introduced in 2017. It is possible that a clamp down on tax evasion in some jurisdictions may cast the spotlight on those that facilitated it.
These are six of the key challenges identified by our white collar crime experts, for seven others please see the 2024 Allen & Overy Annual Cross-border White Collar Crime and Investigations Review.
Our lawyers have a vast amount of strength and depth in many geographical areas and are used to helping our clients navigate all these issues to reach effective and practical solutions. If you would like to discuss any of these issues please contact amy.edwards@allenovery.com or your normal Allen & Overy contact.
