Recent legal developments in the compliance and ethics field

1. Recent legal developments in the compliance and ethics field Joe Murphy and Jeff Kaplan PLI Advanced C&E Workshop October 7, 2014

2. What is C&E law? • No official version, but centers on • The “why” of C&E – sticks and carrots • The “how” of C&E – program elements • Includes legal impediments to effective C&E programs • Sources • Litigated cases (rarely) • Settlement agreements, sometimes monitor reports • Guidance documents • Speeches by enforcement officials Joe Murphy/Jeff Kaplan

3. Our scope and approach • We believe that C&E legal history and public policy are relevant to the work of C&E professionals • History can help one understand the trajectory and velocity of the C&E law • Public policy can help make that law more C&E-friendly • Our book: Compliance Programs and the Corporate Sentencing Guidelines (Thomson Reuters) • Make sure to read Rebecca Walker’s history of C&E law in course materials (a free mini treatise) Joe Murphy/Jeff Kaplan

4. This session • Focus on legal developments of general relevance to C&E programs than substantive-law related ones • E.g., case on what is a foreign official under FCPA • Some of the cases we’ll mention will also be discussed in other sessions • We want your questions and ideas on how to best use law-related C&E information to make programs stronger Joe Murphy/Jeff Kaplan

5. The stick: the size of fines and other costs continues to grow Massive fines have become routine in the US: • Bank of America - $16 billion (bank fraud) (2014) • BNP Paribas - $8.9 billion (violations of sanctions laws) (2014) • BP - $4.5 billion (environmental offenses) (2013) • Credit Suisse - $2.6 billion (aiding and assisting tax fraud) (2014) • JP Morgan Chase - $1.7 billion (BSA) (2014) • Countrywide/B of A - $1.3 billion (bank fraud) (2014) • Toyota - $1.2 billion (fraud) (2014) (Thanks to Rebecca Walker for this list) Joe Murphy/Jeff Kaplan

6. Very large fines (cont.) • It is not only the very biggest fines that are relevant, but records set for given type of violation, e.g., • Three of four largest antitrust fines in US history have been imposed in 2012-2014 • Record punishment in immigration case: $34 million fine against Infosys in 2013 • Other nations are joining the party. E.g., in just the past two month China has imposed: • A $492 million fine against GSK for bribery – largest corporate fine ever there • Record competition law fines Joe Murphy/Jeff Kaplan

7. Why this will likely continue • Governments increasingly need revenue: • The “demand side” of law enforcement strategies • Not likely to change any time soon • Individual prosecutors may have their own interests in securing large fines • Lemos and Minzer, “For-Profit Public Enforcement,” Jan. 2014 Harvard L Rev • A non-fixable form of “moral hazard”? Joe Murphy/Jeff Kaplan

8. How to use this information • In general awareness training/communications • Particularly for board members • Senior managers may be more responsive to the prospect of individual punishment • A different form of moral hazard • Is it fixable? • In connection with budget/resource discussions • Increasingly important in an era of “economic headwinds” Joe Murphy/Jeff Kaplan

9. Other C&E program impacts on liability • Poor compliance program as a basis for organizational liability: • SAC Capital Advisors indictment in 2013 • The Medco FCA precedent • Lawsuits against S&P and Goldman Sachs for false claims of having strong conflict of interest policies Joe Murphy/Jeff Kaplan

10. Other legal impacts (cont.) • False statement liability for internal controls certification without allegation of accounting fraud – In re Marc Sherman, SEC, July 30, 2014 • Significance discussed in Ropes & Gray post in the Harvard corporate governance blog http://blogs.law.harvard.edu/corpgov/2014/08/17/sec-charges-corporate-officers-with-fraud/#more-65167 • What does this all mean? As programs become more important, program-related misconduct/deficiencies will themselves likely become a greater source of direct liability Joe Murphy/Jeff Kaplan

11. Punishment for too much compliance? • An unfortunate recent twist: compliance program supervision of subsidiary by parent company has become a basis for piercing the corporate veil in FCPA case • http://www.fcpablog.com/blog/2014/2/27/parental-controls-anti-corruption-compliance-programs-for-jo.html • Experience in EU • A difficult balancing act, but our view is that risk of doing too little with subsidiaries and JVs is generally greater than the risk of doing too much Joe Murphy/Jeff Kaplan

12. Other impacts - Caremark • Not much activity in the past year • One 2013 decision is somewhat typical of this line of cases: while certain “red flags may tend to establish that [the company’s] employees were marketing [the product] illegally and that [the company’s] officers likely knew the details of [this] marketing and sales, [the purported red flags] are insufficient, in the absence of more direct evidence, to support an inference that the outside directors’ actually knew these details.“ • Kococinskiv. Collins, 935 F.Supp. 909 (D. Minn. 2013 ) Joe Murphy/Jeff Kaplan

13. Caremark – a different approach to briefing/motivating directors • Less about liability – which is a hard sell given the case law • More about best practices • In 2006 Disney decision Delaware Supreme Court encourages directors to follow best practices and reduce potential litigation costs • Not a C&E case, but logic definitely applicable to the C&E context Joe Murphy/Jeff Kaplan

14. The carrot • Not much criminally – in terms of pre-existing programs • Several FCPA cases in 2010-2012 – culminating with MorganStanley case • We’ll hear from DOJ today • The strange case of antitrust – the one exception in DOJ’s policy: programs not considered • There are many cases of after-the-fact C&E programs being rewarded • SEC – First Solar Reg FD case Joe Murphy/Jeff Kaplan

15. The carrot – changes in antitrust? • Speech by Brent Snyder • Speech by Bill Baer • Response to criticism about difference from DOJ policy • Will Antitrust Division consider compliance programs? Joe Murphy/Jeff Kaplan

16. Developments outside the US • Anti-corruption • UKBA • Adequate procedures defense still untested • To watch: proposal to create a failure to prevent economic crime offence • Brazil Clean Companies Act went into effect in January • Some recent enforcement activity • Gov’t has not yet issued guidance on compliance programs Joe Murphy/Jeff Kaplan

17. Developments outside of US (cont.) • Antitrust/competition law • EU issued a guide, but no recognition • Canadian Competition Bureau – new draft guide & new policy to recognize programs • CADE is Brazil considering how to approach compliance programs Joe Murphy/Jeff Kaplan

18. Dodd-Frank • Is reporting to a regulatory authority necessary for a Dodd-Frank claim for retaliation? • Asadi v. G.EEnergy, (5th Cir. 2013) holds it does. • Various other cases say otherwise. E.g., Yang v Navigators Group (SDNY 2014) • Geographic considerations. Liu Meng-Lin v. Siemens, Second Circuit holds in 2014 that noncitizens working for a foreign company are not afforded protection by the anti-retaliation provision of the Act Joe Murphy/Jeff Kaplan

19. Whistleblower law (cont.) • Lawyers as whistleblower • NY County Bar Opinion 746 (2013): prohibits lawyers from disclosing confidential info in support of bounty claim under Dodd-Frank • Lawson v FMR (Supreme Court 2014) – private contractors of public company can sue under S-Ox • Includes lawyers • But opinion doesn’t address use of privileged information Joe Murphy/Jeff Kaplan

20. Privilege • In re Kellogg Brown & Root, Inc. (DC Cir 2014) • Reversed much-derided district court opinion which threatened privileged status of in-house investigations conducted by C&E office • A very broad approach to crime fraud exception: • A lawyer was consulted about whether a contemplated payment would violate the Foreign Corrupt Practices Act, told the client that it would, but the client disregarded the advice and made the payment. While noting that this was a “close case,” the court held that the exception applied. In re Grand Jury Subpoena, ___ F 3rd__, No. 13-1237 2014 WL 541216 (3d Cir 2014) Joe Murphy/Jeff Kaplan

21. Requirements from recent settlements: incentives • MoneyGram: Restructure executive review and bonus system so that each executive is evaluated on what they have done to ensure their business or department adheres to compliance policies and procedures. Failing score will make the executive ineligible for any bonus that year. Implement a “clawback” system for bonuses paid to executives later determined to have contributed to compliance failures • HSBC: Extent to which a senior executive meets compliance standards and values has a significant impact on his/her bonus, and failure to meet those compliance standards and values could result in the voiding of his/her entire year-end bonus. • GSK: Company shall make adherence to the Code an element in evaluating the performance of all relevant employees. Joe Murphy/Jeff Kaplan

22. Lessons from settlements: Apple e-book monitorship • If senior people involved in violation, need to be involved in the cure • “Reporting” to the board needs real substance • Risk assessment focused on antitrust • Monitors in antitrust cases – a sign of things to come? Joe Murphy/Jeff Kaplan

23. Defamation – an impediment to C&E • Writt v. Shell Oil, 409 S.W.3rd 59, Tex App (Ist Dist) 2013, statements to DOJ as concerning possible FCPA violations as part of a disclosure held not absolutely immune to a defamation suit • Because these were made prior to the initiation of criminal proceedings, such statements were actionable if made recklessly or with malice • While good faith reports to government investigators may ultimately be found protected, companies can be forced to litigate this issue • Decision is being appealed Joe Murphy/Jeff Kaplan

24. Background checks • Restrictions on doing them • Development of “ban the box” Joe Murphy/Jeff Kaplan

25. The importance of culture • Speech to 2013 SCCE C&E Institute by Stephen A. Cohen of SEC: • “Where we find fraud, there are often early warning signs that may have suggested a corporate compliance culture that is not meeting appropriate standards….. Risk-taking in the area of legal and ethical obligations invariably leads to bad outcomes. Any company or person prepared to come close to the line when it comes to legal and ethical standards is already on dangerous ground. Tolerating close-to-the-line behavior sends a terrible message throughout an organization that pushing the envelope is acceptable. “ Joe Murphy/Jeff Kaplan

26. Culture (cont.) • “Be on the lookout for people who are overly technical in their approach to issues of ethics and professional responsibility. Pay particular attention to those who may disparage or diminish the importance of respect for the law and protecting the organization from reputational harm.” • “A strong ethical culture flows from good governance and requires leaders to promote integrity and ethical values in decision-making across the organization. This entails asking not just ‘can we do this,’ but ‘should we do this?’ A culture of compliance and ethics can and should be measured from interaction with leadership across the organization as well as from front line employees who are often a revealing barometer of what the culture and expectations really are.” Joe Murphy/Jeff Kaplan