This Webcast Will Begin Shortly

1. This Webcast Will Begin Shortly If you have any technical problems with the Webcast or the streaming audio, please contact us via email at: webcast@acc.com Thank You!

2. Managing Internal Investigations While Whistleblowers May Be Whispering in the Government’s EarsMarch 7, 2018Presented By:Stavroula E. LambrakopoulosPartnerK&L Gates LLPModerated By:Ilona KorzhaSenior CounselSprint Corporation

3. AGENDA • Whistleblowersand Selected U.S. Whistleblower Laws • The SEC Whistleblower Program under Dodd-Frank • Hallmarks of Effective Procedures for Responding to Whistleblower Complaints • Managing the Effective Internal Investigation

4. HOW IT ALL BEGINS…… • A tipster leaves an anonymous message on the whistleblower hotline of BG Corporation that the UK accounting manager is “smoothing revenues” again • The Comptroller suddenly resigns and writes a letter to the Chair of the Audit Committee complaining about earnings management by the CFO for Europe • The GC gets a letter from the SEC captioned “In the Matter of BG Corporation” seeking a voluntary production of documents regarding BG’s 10-K including its financial statements and trades in the company’s stock by insiders • A lawyer for a former officer calls you to let you know that her client is being interviewed by the FBI tomorrow about BG’s operations in Manila • A reporter calls your company’s press office about an article she is researching and is seeking comments on a non-public incident at the company

5. A WHISTLE BLOWER MAY BE IN YOUR MIDST…… • Disgruntled current officers and employees • Former employees or officers • An investor unhappy with her investment • A vendor or supplier • An accountant in the company’s internal auditdepartment • Anyone with knowledge….or even a friend of a friend

6. KEY U.S. WHISTLEBLOWER LAWS

7. KEY U.S. WHISTLEBLOWER LAWS • United States False Claims Act • Entitles Whistleblowers (“Relators”) who bring qui tam actions a percentage of money/damages recovered by government • Once filed, DOJ investigates and decides if to intervene • Relator entitled to 15-25% of amount recovered if government intervenes, or 25-30% if it does not, plus attorneys’ fees • The primary enforcement tool to combat federal program fraud — health care; technology/defense contracts; research grants/loans; government loans and mortgage programs; • FY 2017: DOJ paid $392M to Relators from $3.4B recovered by government in qui tam cases ($3.7B total from FCA cases) • Thirtystates and DC have FCAqui tam statutes

8. KEY U.S. WHISTLEBLOWER LAWS • Sarbanes-Oxley Act (2002) • Provides protection to employees who report securities violations to legal authorities, Congress, or supervisors • SEC Whistleblower Program • Enacted: Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203,§748, 124 Stat. 1739 (2010) • Bounties and Anti-retaliation protection for whistleblowers • CFTC Whistleblower Program (Dodd-Frank) • Anti-retaliation enforced by U.S. Department of Labor’s Occupational Safety and Health Administration’s Office of Whistleblower Protection Program

9. SELECTED U.S. WHISTLEBLOWER LAWS • IRS Tax Fraud Program • A whistleblower who reports tax fraud can receive between 15% and 30% of the amount recovered • Other federal and state agencies also have whistleblower reporting and protection statutes ACTIVE PLAINTIFFS’ BAR ON WHISTLEBLOWER CLAIMS (Dodd-Frank, FCA) and revolving door from SEC

10. THE SEC’s WHISTLEBLOWER PROGRAM

11. DODD-FRANK SEC WHISTLEBLOWER PROVISIONS • SEC enforcement action with sanctions over $1 million • SEC must pay 10 to 30 percent of recovery • To any eligible whistleblower • Who has voluntarily provided the SEC with • Original information about a possible violation of the federal securities laws

12. SEC WHISTLEBLOWER ELIGIBILITY • Any individual who (alone or jointly with others) provides information to the SEC relating to a possible violation of securities laws that has occurred, is occurring, or is about to occur. • Companies not eligible for the whistleblower protections and incentives in Dodd-Frank • Wrongdoers are eligible for awards, unless they are criminally convicted, but no amnesty for whistleblowers • Illegally obtained information can lead to award, unless whistleblower convicted of crime for obtaining it

13. WHISTLEBLOWERS WITH QUALIFIED ELIGIBILITY • Attorneys, accountants, officers, directors, trustees, partners, and employees or contractors whose duties involve compliance or internal audits, or those involved in internal review • Compliance and internal audit personnel are precluded from qualifying for an award by providing information that they learn in connection with their responsibilities unless: • Company does not self-report within 120 days, or • “Reasonable basis to believe” that: • Company is engaged in conduct that will impede an investigation of the misconduct; or • Disclosure is necessary to prevent substantial injury to company or shareholders

14. ANTI-RETALIATION PROVISIONS • Broad anti-retaliation protection for whistleblowers under Section 21F(h)(1) of Dodd-Frank • Employer may not discharge, demote, threaten or discriminate against whistleblower • SEC can bring enforcement action against the employer for retaliation within 6 years statute of limitation • Whistleblower also has federal right of action to enforce this provision. Contrast – SOX and exhaustion of administrative remedies

15. SUPREME COURT RULING ON SEC ANTI-RETALIATION PROTECTIONS UNDER DODD-FRANK ACT • Digital Realty Trust v. Somers, 583 U.S. ___ (2018) called a “Game-changer” by Plaintiffs’ bar • Whistleblower must report complaint to the SEC to qualify for anti-retaliation protections under Dodd-Frank • Whistleblower reporting misconduct to employer only will not qualify • Purpose behind bounties and heightened retaliation protections was to improve SEC enforcement • Incentive to whistleblower to FIRST or SOLELY report to SEC. Attorneys or auditors subject to internal reporting may resort to quicker report to SEC.

16. DIGITAL’S IMPACT ON CORPORATE COMPLIANCE EFFORTS AND VOLUNTARY SELF-DISCLOSURE • Incentivizes employees to report to the SEC rather than internally • Employees not obligated to report concerns internally in the first instance – or ever – unless part of their duties • SEC rule intends to “not discourage”initial reporting to company • Race to SEC since only first person to report is eligible for bounty • Changes calculus of the self-reporting decision • Greater chance that violations will come to SEC attention • Greater risk that whistleblower will report violations before the company does • Companies may seek to report first to obtain cooperation credit

17. SEC SANCTIONS ATTEMPTS TO SILENCE WHISTLEBLOWERS • Dodd-Frank Section 21F-17 prohibition against restricting ability of person to make a report to the government or waive right to recovery of a bounty • Provisions in severance or settlement agreements under scrutiny by SEC • In 2016 and 2017, SEC brought several enforcement actions against companies that included such provisions in their agreements with individuals • See HomeStreet Inc.; NeuStar, Inc.; BlackRock, Inc., SandRidge Energy, Inc. • In-house counsel need to scrutinize prior and future agreements for limitations on whistleblower rights

18. WHISTLEBLOWER ANONYMITY PRESERVED • SEC need not disclose that the investigation has been prompted by whistleblower, or whistleblower’s identity • Whistleblower’s “spin” may control the day or affect the investigation’s focus and scope • Whistleblower award is made by SEC without disclosure of whistleblower

19. THE FY2017 SEC WHISTLEBLOWER REPORT • Since inception, SEC has awarded over $162M to 46 Whistleblowers for cases bringing nearly $1B in sanctions, including $670M in disgorgement • $50M in awards in 2017 with highest award over $20M • More than 4,400 whistleblower tips received in FY 2017 – a 50% increase since FY2012 • 62% of award recipients to date were current or former insiders of company at issue with 83% reporting their concerns internally first • Tips from all 50 states, DC, Puerto Rico, Guam, & U.S. Virgin Islands with most tips from CA, NY, TX, FL & NJ • 12 percent of 2017 tips from individuals in countries outside US • E.g., United Kingdom (84), Canada (73), and Australia (48)

20. HALLMARKS OF EFFECTIVE PROCEDURES FOR WHISTLEBLOWER COMPLAINTS

21. KEY STRATEGIES • Tone at the Top: Culture of Compliance and Non-Retaliation • Investment in Compliance Program & Personnel • Follow up of complaints and concerns including hotline reports and exit interviews • Effective Internal Investigations of Complaints • Pro-active self-disclosure where warranted

22. PROCESS MATTERS • Code of ethics available to all employees with ethics officer to ensure proper training • Compliance program with designated compliance officer person or department responsible for implementing program • Accessiblehotline for reporting ethics or compliance concerns with effective system for monitoring and follow through • Describe how reports will be handled • Independent personnel or system to review • Reporting to Audit Committee or General Counsel’s office • Clear Anti-Retaliation policy with process for reporting • Exit interviews or questionnaires for departing employees • Conditioning severance on full reporting

23. MANAGING THE EFFECTIVE INTERNAL INVESTIGATION

24. GETTING TO THE ROOT OF THE PROBLEM, TAKING REMEDIAL MEASURES AND REDUCING CORPORATE RISK • Ethical considerations, company policies and values • Statutory or legal requirements to investigate in addition to whistleblower incentives • They will vary based on the jurisdiction • Sarbanes-Oxley certifications • Responding to Regulatory or Enforcement Inquiries • Setting the tone • Providing comfort to regulators that company is proactively investigating potential wrongdoing and will address it appropriately • “Credit” for cooperation from SEC, DOJ, other US or foreign regulators • Voluntary disclosure programs and deferred prosecution agreements (DPAs) • FCA Cooperation Initiative • Minimizing potential sanctions or enforcement actions • Does the company need to waive privilege?

25. IMPLICATIONS OF AN INVESTIGATION • In a global company, investigations prompted by most of the scenarios above may involve international operations and personnel • Managing cross-border investigations presents challenges often unique to the implicated jurisdictions • Managing multiple regulators, including in various jurisdictions, requires thoughtful approaches consistent with local laws, ethical requirements, and potentially conflicting approaches • This will affect how witnesses are approached, how documents and information are gathered, whether and how the company’s own investigations remain privileged, and how and to whom the results will be reported

26. DEFINING THE CLIENT, SCOPE AND GOALS • Establish identity of the “client” for purposes of the investigation and defining the scope • Audit Committee or a Special Committee of the Board of Directors • General Counsel’s office • Internal Audit • Define the goal of the investigation and establish lines of authority and supervision, but be nimble on needing to adapt • Evaluate who should conduct the investigation? Internal or outside counsel? • “Manage the message” upward & downward within the company, and externally to regulators and to the public — Issue appropriate communications from investigation lead or CEO with local contact

27. SECURE EVIDENCE & PROVIDE NOTICE • Litigation holds — document preservation notices and retention procedures • Identify universe of documents and employees to be covered by holds • Work with IT department to understand retention policies and to set holds so that documents will not be automatically or intentionally destroyed • Secure and collect data and physical evidence • Provide notices internally and be prepared to explain and guide • Consider requirements for public disclosures • Interview employees to identify sources for evidence • Institute tracking system to identify and track sources for collection of documents and information • Obtain electronic documents and communications and image hard drives and, if warranted, personal electronic devices • Translation of documents may be warranted

28. THE YATES MEMO — HOW HAS IT REDEFINED COOPERATION AND DEALING WITH INDIVIDUAL OFFICERS AND DIRECTORS? • What is the Yates Memo? • Implications of Rosenstein Review under Trump Administration • Balancing company interests with interests of individual employees, officers and directors, and members of the board • When are DOJ expectations for “cooperation” at odds with ethical obligations? • What is the role of the General Counsel and other senior counsel as “gatekeepers” • Potential individual liabilities to navigate • When is it time to recommend separate counsel?

29. DEALING WITH INDIVIDUAL EMPLOYEES • Do they need separate counsel? • Model Rules of Professional Responsibility • Assess whether employees should be represented by their individual counsel for your interview • If criminal matter is pending, consider whether laws of the jurisdiction prevent or limit counsel’s ability to conduct interview • When is “shadow” counsel appropriate and how does that work? • Who pays for their lawyers? • Indemnification obligations • Advances & Undertakings • Insurance claims and coverage • Joint Defense Agreements – when should you have one and how do they work? Oral or written? • The delicate balance of collaboration vs. collusion

30. Approaching employee witnesses for interviews and information • Importance of the Upjohn Warnings: • Notify witnesses that: • counsel is retained by the company or its Audit Committee/Board; • communications are confidential subject to privilege; • company, who owns the privilege, may choose to waive the privilege and disclose information provided by the witness; and, • counsel does not represent the witness. • Memorialize in writing that you have provided the Upjohn warning and that it was understood • Consequences of Failure to Provide Upjohn Warnings

31. Approaching employee witnesses for interviews and information • Labor laws in various countries may limit counsel’s ability to approach and interview employees outside of the presence of their counsel or a union representative • Other laws may limit the availability, use and/or subsequent disclosure of witness statements provided to counsel in an internal investigation to governmental authorities • Cultural and language barriers and local customs may affect how witnesses will respond to the investigation. Do you need translators and/or local counsel within each jurisdiction? Practical tip: Engage counsel or interpreters who can communicate to employees in their native languages

32. IMPORTANCE OF PRESERVING CONFIDENTIALITY THROUGH Attorney-Client Privilege and Work-Product DOCTRINE • Failure to maintain privilege may leave company’s most sensitive information exposed to regulators, litigation opponents and competitors • Two layers of analysis • Historical materials • Materials connected to the investigation • Privilege as a double-edged sword • Fosters candor and protects documents but prevents using documents later on • Think ahead: • Is privilege over the investigation itself necessary? • Will privilege limit the defense later, like affirmative defenses? • When waiver is at play: What other documents will be waived? • How will a government agency treat waiver? • Bank examination privilege for prudential regulators • Selective waiver under 12 U.S.C. §1828(x)

33. ATTORNEY-CLIENT PRIVILEGE • US law applies protection of attorney-client privilege to employee communications with counsel if: • Communication was made for the purpose of securing legal advice; • Employee making the communication did so at the direction of his/her corporate superior; • The superior made the request so that the corporation could secure legal advice; • The subject matter of the communication is within the scope of the employee’s corporate duties; and, • The communication is not disseminated beyond those persons who, due to corporate structure, need to know the contents. • Practical tip: Engagement letter with outside counsel conducting the investigation should document the scope; management/board should direct employees to cooperate with counsel

34. ATTORNEY-CLIENT PRIVILEGE outside of us • Not all jurisdictions will recognize attorney-client or work product privilege or apply it to internal investigations • U.S. and UK recognize the attorney-client and work product privileges if investigation is conducted by in-house or outside counsel in anticipation of litigation or regulatory investigations • EU directive applies privilege for communications of outside counsel but not in-house counsel • German law provides for confidentiality for inside and outside counsel’s investigatory materials derived from lawyer’s client but not its employees • Japan recognizes confidentiality but not privilege. Shareholders can access written report provided to Board during a regular Board meeting. • Practical tip: Be familiar with laws of applicable jurisdictions in the beginning of the investigation

35. Privilege & Internal Investigations: Best Practices for In-House Lawyers

36. Privilege & Internal Investigations: Best Practices for In-House Lawyers

37. DATA PRIVACY ISSUES IN Collecting and preserving documents • DATA LOCATION MATTERS -- Privacy and Data protection laws will vary and may limit what can be obtained • Interception and review of electronic or telephonic communications may require employee’s consent or notification, or may be prohibited and/or subject to civil or criminal penalties • Investigator should ensure knowledge of laws that apply in each jurisdiction in which investigation will be conducted • EU Directive 95 has broad reach but Member states may have additional restrictions • Swiss and French laws could trigger criminal sanctions if data privacy laws are violated by the investigator

38. DATA PRIVACY ISSUES • Various U.S. & foreign authorities may have differing expectations as to data privacy issues • Protecting individual employees’ privacy may be viewed as non-cooperative or obstructionist by authorities • Legal landscape is changing – SeeMicrosoft Corp. v. U.S.(2d Cir. 2016) pending before Supreme Court • Review from Second Circuit holding that U.S. service provider may not be compelled to produce data stored on foreign server in response to warrant under Stored Communications Act but that U.S. should use Mutual Legal Assistance Treaty (“MLAT”) process • Foreign laws may require notification and consent from customers before their data may be produced or transferred to the U.S.

39. DATA PRIVACY ISSUES • Global companies should proactively consider internal agreements with foreign affiliates to allow for transmission & sharing of data • Uncertainty of how Cloud data will be treated in the future • Practical tip: Investigating counsel should consider whether the data can and should be brought to the U.S. for review or whether it should be reviewed on-site

40. CORRECTIVE AND REMEDIAL MEASURES • Depending on issues underlying the investigation, consider benefit of making recommendations for adoption of remedial measures and other corrective steps (i.e. employee terminations and demotions) • Counsel should consider whether advisable to provide a written set of recommendations if company has confirmed that it will not be adopting the recommendations or may disagree • Recommendations that are made should be reasonable and appropriate to the client, consistent with applicable law and regulations, and client’s financial circumstances • Proactive and effective remedial measures are persuasive in convincing government authorities that misconduct has been addressed and is unlikely to recur

41. QUESTIONS?

42. Faculty Biography Stavroula E. Lambrakopoulos is a partner in the Washington, DC office of K&L Gates who concentrates her practice in securities enforcement matters, securities and financial services litigation, internal investigations and broker-dealer regulation. She regularly represents corporate and individual clients in enforcement proceedings before the SEC, the United States Department of Justice, FINRA, and state securities regulators. She represents financial institutions, corporations, and their officers in complex financial services cases and securities class action litigation. She leads cross-border internal investigations on behalf of multinational public and private companies on various issues including whistleblower complaints, accounting and financial issues and anti-corruption matters. Ms. Lambrakopoulos started her legal career as a law clerk in the Office of General Counsel at Ernst & Young focusing on appellate litigation. Previously, she served as the head of the Washington office of the Governor of New Jersey, leading New Jersey’s federal lobbying activities, as a Legislative Director in the U.S. House of Representatives, and on the staff of a House Energy and Commerce subcommittee focusing on environmental and energy legislation. For More Information Contact: Stavroula E. Lambrakopoulos, Esq., Partner K&L Gates LLP 1601 K Street, NW Washington, DC 20006-1600 Stavroula.lambrakopoulos@klgates.com O: 202.778.9248 www.klgates.com . 42

43. Questions? Thank you for attending another presentation from ACC’s Webcasts Please be sure to complete the evaluation form for this program as your comments and ideas are helpful in planning future programs. If you have questions about this or future webcasts, please contact ACC at webcast@acc.com This and other ACC webcasts have been recorded and are available, for one year after the presentation date, as archived webcasts at http://www.acc.com/webcasts