Monday, June 28, 2010
Special Reports
How to Avoid FCPA Violations in Latin America
BY CHRONICLE STAFF
What advice do you give companies just starting operations in Latin America on how to avoid violating the FCPA? What
advice do you give companies that acquire firms that operate in Latin America that may have violated the FCPA? Have U.S.
companies become more aware of the danger of violating the FCPA in Latin America compared to earlier? Has there been an
increase in FCPA cases in Latin America in the past year or past two years?
Latin Business Chronicle asked a group of experts. Our panel:
Marta Alfonso, CPA/CFF, JD,
partner in the Litigation Support
Department of Morrison, Brown,
Argiz & Farra
Sam Danon, Partner, Litigation
& Intellectual Property Practice,
Hunton & Williams
Matthew Feeley, Shareholder,
Buchanan Ingersoll
Simon Strong, Senior Managing
Director, Forensic and Litigation
Consulting, FTI
Latin Business Chronicle: What advice do you give companies just starting operations in Latin America on how to avoid
violating the FCPA?
Alfonso: A company starting operations in Latin America should establish a clear policy that it will fully comply with FCPA
provisions and anti-corruption and anti-money laundering laws both from the United States and in country, including the OAS
Inter-American Convention Against Corruption. To support the policy, it should establish a set of FCPA compliance policies
and procedures for the types of transactions and relationships it undertakes in Latin America (including those with customers, suppliers, employees, and regulatory officials). These FCPA compliance policies and procedures should include finance
and accounting requirements designed to promote a strong system of internal accounting controls and accurate books and
records. An effective and anonymous “hot line” should be established to promote identification of potential FCPA violations
by any individual that works or does business with the company in Latin America. Finally, periodic and annual independent
testing of the FCPA compliance program should be performed by management and an independent compliance function to
ensure that the Latin American operation is appropriately complying with the company’s FCPA program, including the identification and resolution of new compliance risks.
Danon: Any company that is looking into starting operations in Latin America should ensure that their compliance programs
adequately address operations in foreign countries and that training programs are conducted to remind and educate employees on company policy. Importantly, the company must also export a strong culture of compliance to its affiliate, because
ultimately compliance must be implemented by the employees on the ground. If a FCPA issue arises, we advise clients to
promptly get a thorough understanding of the situation through a privileged internal investigation that collects information on
the concerning conduct and the attenuated legal issues. The company should then implement the recommendations made
by counsel to address any specific case and, more importantly, take the preventive measure of addressing the core compliance issues or identified deficiencies that may have led to the FCPA issue.
Feeley: To address FCPA risks, any company starting operations in Latin American would be smart to focus on two efforts:
(1) understanding the local business and social cultures and (2) implementing a rigorous and consistent training and compliance program. In Latin America, many of the grey areas of FCPA violations are tied to business and social culture. For
example, what might be considered an expected business gift by your local employees might be a serious FCPA violation
under U.S. law. A company cannot begin to identify FCPA risks, and protect against them, until it understands the cultural
norms of a particular country. Most of your employees will not intend to violate the FCPA; they will do so because they consider the offending conduct to be a cultural compulsion. A company must take the time and make the effort to understand
the culture in which it is operating. After having a grasp of the culture, a company must implement a consistent training and
compliance program. Any employee, agent, or consultant with any potential to have contact with someone who might be
considered a “government official” must attend periodic FCPA training, and a system of checks and balances must be established to account for all expenses. All of these efforts should be well-documented to show a company’s good faith efforts
should an FCPA issue later come to the attention of the DOJ and/or SEC.
Strong: Design and implement a cast iron FCPA / anti-bribery compliance program. This should include due diligence on
third parties – agents, distributors - procedures to respond promptly to possible violations, and a vigorous corporate culture
stressing compliance. The program should be regularly updated, address local laws and explain risk areas – e.g. gifts, contributions to charities, and T&E. It should also implement appropriate recordkeeping, accounting controls, and documentation requirements. This should be accompanied by training and regular compliance monitoring, including annual compliance
certification and audits of high-risk areas. We also recommend that the program not be designed, executed and monitored
internally or by the company’s own auditors, since if there is later an issue its independence and integrity is liable to be called
into question by government investigators.
INHERITING PROBLEMS
What advice do you give companies that acquire firms that operate in Latin America that may have violated the FCPA?
Feeley: The first thing I would say to such a company is “why didn’t you call me earlier?” In a perfect world, the acquiring
company should have conducted FCPA due diligence before consummating the acquisition. Indeed, the identification of
FCPA violations might be an important negotiation point when haggling over a purchase price. The same evaluation process, however, should be conducted after the acquisition as well. A team of outside lawyers should visit the acquired firm to
conduct an investigation attempting to identify FCPA violations and, more importantly, accessing the firm’s culture and compliance structure. After reaching its conclusions, the team should seek to remediate any FCPA violations it is able to identify
as well as recommending the implementation of a vigorous FCPA training and compliance program. If any FCPA violations
are identified, the company then must make a decision about whether to self-report the violations to the DOJ and SEC. Ten
years ago, self-reporting was an easy decision as the DOJ and SEC were clear that they expected such self-reporting and
would be more lenient with self-reporting companies when deciding on a monetary penalty. Today, with the increase in FCPA
enforcement, the DOJ and SEC have made clear that self-reporting is not always appropriate and will depend on the scope
of the violation and remediation efforts. The key to all of this, however, is documentation. If the DOJ and SEC every become
interested in your Latin American operations, they are going to want to see the documentation that demonstrates that the
company made real effort to address FCPA risk at the time of the acquisition.
Alfonso: Companies that intend to acquire Latin American operations should ensure that their due diligence teams perform
and document a robust set of procedures designed to identify and document any potential FCPA concerns. If potential
FCPA compliance risks are identified during the due diligence or upon acquisition of the Latin American operation, a company’s officers and directors should consider the following actions:
Establishing an independent committee of the Board to investigate FCPA compliance concerns;
Selecting independent professionals (i.e., counsel and accounting/compliance specialists) to confirm and document FCPA
compliance issues;
Through experienced FCPA counsel, determining whether a company should contact the SEC (if a public company) or the
DOJ and self disclose the FCPA findings. The advantage to this self-disclosure may be the ability to mitigate any FCPA and
related regulatory and legal risks to the new owners of a Latin American operation; and
Implementing a robust FCPA compliance program, including strong internal accounting controls, a set of detailed compliance procedures, an anonymous hot line for reporting FCPA concerns, and annual independent FCPA compliance testing in
the company, including its Latin American operation.
Strong: Investigative internal due diligence is key and this is still where many corporations fall short because they can be unwilling to spend the money, particularly in tight economic conditions. Instead, the diligence tends to be conducted internally
or by the company’s auditors as an add-on and is rarely exhaustive. Auditors are not investigators or interviewers. Companies try to get around this by complementing the diligence team with local attorneys, but this can make for a challenging
blend because attorneys and accountants are often like oil and water – they do not mix well! Right now for instance we are
working on an assignment in Brazil where our client hired their own auditors to conduct the FCPA as well as the financial due
diligence, and failed to identify a series of questionable third-party payments which with proper analysis should have been
found. They only surfaced after the acquisition, when the controller volunteered the information to the U.S. purchaser. Asked
why he had not come forward earlier, the controller said he had been instructed not to mention it. Luckily, the US purchaser
was legally and financially ring fenced, since the activity occurred prior to acquisition and because they were able to deduct
the consequent legal and investigative costs from the monies in escrow. But they had to declare to the DOJ and SEC nevertheless, and having ceased the questionable payments are at this time still uncertain as to the commercial implications.
MORE AWARENESS
Have U.S. companies become more aware of the danger of violating the FCPA in Latin America compared to earlier?
Alfonso: U.S. companies have a heightened sense of concern regarding the impact of FCPA enforcement actions as the
DOJ, the SEC and FBI continue to allocate more resources to FCPA investigations. These investigations have resulted in an
increased number of enforcement actions, resulting in higher penalties for Companies and penalties against individuals. International cooperation by the SEC and DOJ with other international organizations and through related treaties facilitates the
identification and investigation of these cases. The SEC’s self-disclosure program has produced the early identification by
international companies of such cases for regulatory scrutiny and law enforcement evaluation. Furthermore, pursuing FCPA
enforcement actions against individuals may encourage cooperation in investigating and resolving open FCPA cases.
Danon: U.S. and other multinational companies operating in Latin America have developed a greater awareness of compliance related issues including training and the creation of a better culture around compliance.
Feeley: Yes, as enforcement has increased, U.S. companies have made FCPA training and compliance a priority, particularly
in high risk industries. You would be hard pressed to find a manager of a U.S. company operating in any global region that
would presently not be well-versed on FCPA issues; including training, compliance, detection and remediation. Latin America is no different. U.S. companies can no longer ignore the FCPA. The price of ignorance is just too high. Fines for FCPA
violations can now easily reach into the billions of dollars. With those kinds of monetary penalties, the FCPA has become a
bottom-line issue as well as an issue of good corporate governance and ethics.
Strong: Absolutely, although again, it is not just Latin America, it is global. When a firm like Halliburton is fined $559 million,
companies pay attention, all the more so when in some cases executives have been sentenced to jail. Siemens settled a
case in the US and Europe for $1.6 billion – after paying another $1 billion in legal and compliance fees during the litigation.
Both cases involved Latin America as well as other regions. Other U.S. corporates of stature expensively penalized under the
FCPA include Dow, Statoil, Baker Hughes and Monsanto. And in recent FCPA violations “exclusive” to Latin America since
2009 there has been Ports Engineering and Consulting Corp in Panama, Nature’s Sunshine Products, Inc in Brazil, Helmerich
& Payne in Argentina and Venezuela, and Latin Node in Honduras and Miami. FTI has been engaged in many of the cases
and it is very clear that this enforcement activity has made FCPA compliance “top of mind” for US companies operating in
Latin America as well of course in other regions where there is also a high risk of corruption.
MORE CASES?
Have you noticed an increase in FCPA cases in Latin America in the past year or past two years?
Alfonso: Through its enforcement actions, the [U.S. Securities and Exchange Commission] SEC and [U.S. Department of
Justice] DOJ have increased their focus over the last two years in Latin America. Today’s impact of FCPA noncompliance
for a company in Latin America and its officers is becoming more expensive and personal. For example, in 2009, the SEC
brought an enforcement action against a US company with a Brazilian subsidiary, its CEO, and CFO based on alleged bribes
made by the Brazilian subsidiary to local customs officials. The company’s CEO and CFO paid $25,000 each in civil penalties to the SEC for failing to maintain accurate books and records (due to failures to adequately supervise) even though they
had not participated in any alleged misconduct. The Company also paid $600,000 in civil penalties to the SEC. Today’s
FCPA enforcement actions can include other areas of illegal conduct, including money laundering claims and violation of local in-country anti-corruption laws.
Danon: We have not seen a marked increase in FCPA cases over the last couple years. Rather, it is been consistent with
other years.
Feeley: I have noticed an increase in FCPA cases in Latin America over the last few years. The increase, however, reflects a
general increase in enforcement efforts by the DOJ and SEC. Both ... have vastly increased the resources they commit to
FCPA investigations and enforcement. As such, it is not that the DOJ and SEC are targeting Latin America as a region. Indeed, the DOJ and SEC seem to focus on industries rather than regions. For instance, the pharmaceutical industry was the
subject of recent focus. Before that, the focus was on the energy sector. So, although FCPA enforcement has increased in
Latin America, it has also increased at the same pace globally.
Strong: Enforcement actions under the FCPA by U.S. government authorities against global corporations have risen steadily
for a number of years, with prosecutions and penalties reaching an all-time high in 2009, when the DOJ brought 26 actions and the SEC another 14. These numbers may seem small but the penalties are steep – jail as well as fines – and have
triggered a deluge of corporate compliance reviews and internal investigations. (...) And the number of actual open FBI
FCPA investigations rose from about 10 in 2004 to more than 100 last year. FCPA investigations are global by nature and an
estimated 50 percent of our cases in Latin America are now FCPA related. We expect this to continue to trend upwards with
the continued and significant staffing up of dedicated FCPA teams at the DOJ and SEC under the Obama administration, the
growing globalization of anti-corruption and anti-bribery legal initiatives and enforcement, and also, following the financial
crisis which has left U.S. growth prospects weak, a spike in investment in Latin America by U.S. corporations that have not
ventured into the region before and need assistance.
© Copyright Latin Business Chronicle