FCPA crackdown tests antibribery compliance

There is no better time than the present for oil and gas companies to consider the dramatic and aggressive enforcement of antibribery laws globally and the harsh consequences that often ensue. This is especially the case in the US, where the Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) strikingly have ramped up their efforts to investigate American "issuers" and "domestic concerns"—other US companies—both criminally and civilly under the Foreign Corrupt Practices Act (FCPA). Moreover, in early April, the UK enacted even-stricter antibribery legislation that could have significant consequences for companies doing business in the UK or employing UK citizens.

Government prosecutors and regulators are also setting their sights on high-level executives, not just the companies they work for. And government prosecutors can be expected to continue to press for stiff prison terms, not just hefty fines, in arguing that general deterrence requires nothing less.

Under the FCPA, it's a crime for US companies and persons to offer or pay anything directly or indirectly to a foreign official—a very broadly defined term—in order to obtain or retain business or for a commercial advantage. A tax break or a discount on an assessed duty would qualify as a violation. Even if the payment is not made, offering or promising a payment or conspiring with someone else to violate the FCPA by agreeing to the payment could still constitute a crime.

In addition to the antibribery provision, the FCPA also requires "issuers" to make and maintain accurate books and records of their financial transactions, not just of bribe-related deals. The liability to an issuer may well extend to the acts of subsidiaries and affiliates. The SEC will enforce such failures civilly, unless a record entry was willfully false, and it will also look to hold companies and their executives liable if they fail to devise, implement, and supervise adequate controls for their companies and affiliates to deter and detect improper payments.

Merely having a compliance program in itself is scant protection. It will be far more costly and the consequences far more severe if the government determines that a company's FCPA program was ineffective at the time of the purported misconduct, even if remedial measures had since been taken. As a result, energy companies would be wise—for their own legal protection and for sound business reasons as well—to reexamine their FCPA compliance policies to make sure that they are actually working. Moreover, to be credited with having effective policies, the US Sentencing Guidelines require a company to "evaluate periodically the effectiveness of the organization's compliance and ethics program."

Enforcement trends

How is 2010 different from years past?

First, the DOJ recently has trumpeted that FCPA enforcement is one of its top priorities, vowing to pursue the "fight to erase foreign bribery from the corruption playbook." The DOJ reportedly is handling more than 140 active FCPA investigations. And it already has a solid track record of cases prosecuted. More FCPA cases have been brought since 2005 than in the 28 years since the statute was first enacted.

Second, the DOJ has added prosecutors and FBI agents to work exclusively on FCPA cases. In addition, the SEC, which often works in collaboration with the DOJ, has formed a new unit dedicated to FCPA issues.

Recently, the DOJ said it expected to pursue more sector-wide investigations, building on the knowledge it has acquired about the business practices in a particular industry without having to start from scratch. And there has been no shortage of FCPA cases involving energy companies and individuals. Just a few weeks ago, on Apr. 19, the longest prison sentence was imposed in an FCPA case: 87 months. The case involved a guilty plea by a Virginia businessman for making false statements and conspiring to violate the FCPA in connection with paying bribes to obtain maritime contracts along the Panama waterways. The DOJ highlighted the prospect of "substantial prison time for individuals who violate" the FCPA and hailed the sentence as "an important milestone in our effort to deter foreign bribery."

The DOJ is using undercover-operation techniques common in organized crime and narcotics trafficking investigations to make FCPA cases. For example, in January, the FBI arrested 22 individuals, many of whom are company executives, on FCPA crimes, for allegedly scheming to bribe a purported Nigerian minister of defense for lucrative security and arms contracts. In cases when a (real) government official cannot be charged with a violation of the FCPA, the DOJ will consider related charges.

Also in January, the DOJ unsealed an indictment that charged a Thailand tourism official with money-laundering and conspiracy in connection with receiving nearly $2 million in bribes wired from the US and paid by two Americans for more than $14 million in Thai contracts. The bribers, film-management company executives, were convicted after a jury trial of multiple FCPA and money-laundering counts, and they await sentencing (rescheduled for Apr. 29).

Other enforcement trends in the US underscore a grim reality: US parent companies are being held to account for the conduct of their foreign subsidiaries even without any allegations they knew about or authorized improper payments. Companies face costly risks in going to trial. To resist settlement and allow the court to decide liability issues creates a risk of provoking felony charges against the company. Inviting an indictment to vindicate a company's legal arguments can understandably generate devastating risks for the company. The mere filing of an indictment can constitute a death sentence for an otherwise upstanding and vibrant corporation.

However, under the appropriate circumstances, forceful and cogent arguments to the DOJ may gain greater resonance if the company can also demonstrate that it has a vigorous FCPA compliance program and that it is in good faith committed to compliance. To make such a showing requires active engagement and oversight from the company's board of directors and senior executives, including the chief executive officer, chief operating officer, general counsel, chief compliance officer, and other senior managers.

The larger the company and the more expansive and sophisticated its operations, the higher the standard it will be held to for effective compliance and due diligence programs. Inadequate due diligence on business deals (e.g., acquisitions and joint ventures) and non-US sales representatives, distributors, or consultants also can prove an effective method to attract inquiries from the DOJ and SEC.

Although an antibribery violation of the FCPA is not a prerequisite to gaining the SEC's attention, "issuers" in the US are more frequently pursued for violations of books and records and accounting controls provisions. And, increasingly, senior executives and managers, both abroad and at home, are facing criminal and civil exposure on FCPA-related crimes.

Last summer, in a settled enforcement action in SEC v. Nature's Sunshine Products, the SEC asserted claims against the former top executives and held them accountable as "control persons" for their failure to adequately supervise others responsible for implementing adequate antibribery controls.

What is "adequate?" Even if the company decides voluntarily to self-report to the DOJ or SEC—before there's a whiff of an investigation—companies can expect harsher penalties if the programs and controls in place at the time of the alleged misconduct are deemed inadequate. Whether a compliance program is "deemed" adequate is not an assessment that a company's in-house compliance supervisor—or even its board's audit committee—gets to call; the DOJ prosecutors have the final word. So, for example, an FCPA compliance program that looks adequate in print but doesn't stand up in red-flag, hot-to-the-touch regions (with sizzling reputations for corruption) where the company wants to do business, can itself be a red flag. This is also true if the program reveals gaping holes when tested. Companies must periodically evaluate their programs and make modifications where necessary and appropriate.

And under the UK's new bribery bill, companies will be held strictly liable for failing to prevent bribery in the workplace—not just of a foreign official, but commercial bribery as well—unless they affirmatively demonstrate they had "adequate procedures" in place designed to prevent their employees from bribing. The UK government is expected this summer to provide guidance (as the law requires) about implementing effective antibribery programs so that companies can put an adequate program in place and protect themselves against criminal liability.

Industry implications

What's special about FCPA enforcement in the oil and gas industry? Why are the industry's operations an attention-grabber for the DOJ and SEC?

The nature of the industry itself may suggest several reasons for the interest.

First, oil and gas exploration and production operations often take place in "hot-spot" or "high-risk" regions with histories and reputations for corruption. DOJ prosecutors expect companies operating in such places to be well aware of the cultures involved and devise extra safeguards to prevent and detect improper arrangements. According to the Corruption Perceptions Index from Transparency International, China, Mexico, Brazil, Argentina, Nigeria, Kazakhstan, Russia, Central African Republic, Ecuador, Congo Republic, Angola, Sierra Leone, Venezuela, and Somalia register some of the highest corruption scores: that is, the perception that they are among the most corrupt countries to do business in.

Second, the oil and gas industry is on the DOJ radar screen. The Perception Index for Bribery in Industrial Sectors scores oil and gas as tipping toward the wrong end of the scale but doing better than public works contracts, construction, and real estate and property development. Industries perceived as less corrupt are banking and finance and fisheries.

The principal point on the indexes: Government prosecutors are familiar with the Transparency International scores and expect corporations doing business abroad to be as well—and to implement appropriate safeguards to protect against the heightened risk. That the development of energy resources, including oil and gas, necessarily takes place in regions of emerging economies compounds an often risky business venture.

Third, given the nature of the business and the commodities involved, a foreign government or "instrumentality" (i.e., agency) can be counted on, directly or indirectly, to be involved—whether by owning or controlling property rights for oil or gas exploration and development or otherwise authorizing these activities. Some government regulatory approval routinely is required for oil and gas exploration; therefore, practically everyone participating in the process on the side of the host nation may constitute a "foreign official." Offering or providing anything of value in whatever form to a "foreign official," including an employee or agent of an entity owned or controlled by the government or an agency, could violate the FCPA, assuming the other elements have been met.

Fourth, involvement in a joint venture can elevate risks for an oil and gas company, whether or not the affiliate is a major partner. And given the common reliance by oil and gas companies on consultants, distributors, sales representatives, agents, and subcontractors, FCPA risks can escalate absent tight controls. Payments through third countries or third parties, as well as advance payments and overpaying, are all red-flag raisers. Payments in cash are more than a red flag.

Meeting the hazard

For an oil and gas company, elevated visibility makes it especially important to address FCPA issues before they become enforcement problems. Two precautions are essential—but by no means everything a company should do.

A company first should take stock of its business and operations. Goals should be to identify all businesses within the company and to determine how operations are being conducted, what methods of sales or distribution are used, and where the operations are taking place. It's imperative to implement an effective FCPA compliance and ethics program. But any such program can be effective only if it takes into account the nature of the business and the method and location of operations. A code of ethics should articulate the values and principles of the company, as well as examples of prohibited conduct.

Training should be conducted at least for managers and all bonus-eligible employees, including sales staff, of the company and its subsidiaries and affiliates. It should cover all components of the FCPA and other antibribery laws and the relevant laws and regulations of host countries abroad. Written materials and verbal presentations should be provided with translation. Employees should certify their understanding and acceptance of the company's policies.

Company policy should require employees to report misconduct to a supervisor or chief compliance officer or through an anonymous hotline. Employees must know how to report to company officials information about misconduct. They must know that they can do so anonymously without fear of retribution.

A high-level manager should oversee implementation and oversight of the compliance program and should be able to report directly to the board or its audit committee on compliance issues, including reports of misconduct. A mechanism should be established for reporting allegations of a crime, misconduct as to entries in the company books and records, or other serious allegations. Similarly, a structural procedure should guide what allegations are investigated, who investigates them, and who decides those questions. The program should be monitored and regularly audited. Regular evaluations and reassessments are also required.

Knowing third parties

A company also must know its sales representatives, agents, consultants, and distributors and hold them firmly responsible for compliance with its policies.

Any third party offering to act on behalf of the company in contacts with government should submit to a rigorous, detailed, and comprehensive due-diligence process. Background checks by a private investigator should be considered. Searches of the internet and other public searches routinely should be conducted. A Trace International Inc. membership can constitute part of the background check but is by no means enough.

A detailed questionnaire setting forth the personal and professional—and any criminal—history of a candidate is required, and the answers must be followed up. The nature of prior contacts and relationships with government officials also should be fully explored. A review of the candidate's business partners and associates should be carefully undertaken and follow-up interviews should be conducted when it makes sense to do so. The candidate should be required to certify that he has been in compliance with the FCPA and other antibribery laws (including all laws in his country), that his questionnaire answers are truthful and accurate, and that he will abide by company policies.

State and Commerce Department reviews should be conducted, as well as checks with the local US embassy and consulate. Companies should encourage familiarity with the candidate by existing employees. The company should check references and conduct a face-to-face interview; ideally, a company lawyer should review the FCPA and other company policies directly with the candidate.

After the candidate is approved, the contract should be reviewed to ensure that it contains an express statement of the agent's limited authority. A company should consider requiring the agent to give advance notice of a meeting with a foreign official and include a witness at any such meeting.

No engagements or contracting with other third parties should be permitted without the company's written approval. Further certification of ongoing compliance with the FCPA and other laws should also be required.

Payments to the agent should be fully and accurately documented with invoices and receipts and accurately recorded in the company's books and records. The payments should be made in the same country where the agent's services take place. The company should also have the right to terminate an agent where it determines there is credible evidence that an agent committed an FCPA violation. The agent should also be required to indemnify and hold the company harmless for losses that he causes as a result of his purported misconduct.

Detailed, comprehensive, and thorough due diligence should also be conducted on prospective joint-venture partners. Many of the same steps can be taken that are used in evaluating an agent's candidacy.

Regular reassessment

In this era of aggressive, multinational criminal and civil enforcement of the FCPA and other antibribery laws, oil and gas companies would be well advised to regularly reassess their compliance programs as required by the US Sentencing Guidelines.

In doing so they should consider where and how they are conducting business and what safeguards are in place to effectively prevent and detect FCPA violations.

Most importantly, oil and gas companies should keep in mind that a generic program without customized modifications—however well-intentioned—may be "deemed inadequate" and generate costly and damaging risks and consequences.

The authors