The New Italian Compliance Law Paris, 26 May 2008

The New Italian Compliance LawParis, 26 May 2008 Francesca Petronio Partner, Paul Hastings

Legislative Decree No. 231 of 8 June 2001 (Law 231) • Legal entities may be “criminally” liable when… • …individuals… (i) who hold representative, administrative or executive positions in the entity or any of its units or who de facto operate and control it; or (ii) who are subordinated to, or under the supervision of, one of the persons under (i) • …commit one or more crimes listed in Law 231… • …in the interest or to the benefit of the entity… • …unless the entity has adopted and implemented suitable compliance programmes before the crime was committed.

Legal entities may be liable … • The legal entities subject to Law 231 include any juridical person with the exception of: • government and governmental entities • local administrations • constitutional entities

…when individuals… • Different burden of proof for the entity if the crime is committed by • Top Individuals: individuals who hold representative, administrative or executive positions in the entity or any of its units such as: • legal representatives (Chairman) • directors • general managers • any person who de facto exercises managing or controlling powers (statutory auditors are not included) • Subordinated Individuals: individuals who are subordinated to, or under the supervision of, one of the aforementioned persons: • any other executives and employees of the entity

…commit one or more offences listed in Law 231…(I/III) • Crimes against the Public Administration including: undue receipt of funds to the detriment of the State or the European Union, fraud to the detriment of the State, other public bodies or the European Union, aggravated fraud for the purposes of obtaining public funds, electronic fraud to the detriment of the State or other public bodies, corruption aimed at obtaining an official act or preventing such act from being executed, corruption in judicial proceedings, instigation of corruption, extortion by public official and embezzlement of State or other public body funds. • Corporate crimes, including: false disclosures in corporate notices, false disclosures in corporate notices to the detriment of the shareholders or creditors, false disclosures in prospectuses, false information in auditors’ reports, impeding controls, undue return of contributions, unlawful division of profits or reserves, unlawful transactions relating to shares or quotas of the company or of its parent company, transactions causing detriment to creditors, failure to make complaints, communications or filings, failure to call shareholders’ meetings, false formation of corporate capital, undue division of corporate assets by liquidators, financial disloyalty, disloyalty following transfer of or promise of utilities, undue influence on shareholders’ meetings, market rigging, preventing regulatory authorities from carrying out their functions and failure by members of the board of directors to declare the existence of a conflict of interest. • Crimes aimed at terrorism and reversal of democratic system as provided for by the Italian Criminal Code and by special laws, introduced upon the ratification and implementation of the New York International Convention for the Suppression of the Financing of Terrorism of 9 December 1999.

…commit one or more offences listed in Law 231…(II/III) • Crimes against individual freedoms including slave-trading and related crimes and exploitation of juvenile prostitution. • Market abuse and other related offences, which include insider trading and market manipulation. • Crimes against the public interest: e.g., inter alia, counterfeiting of coins, spending and introduction into the State of counterfeit money, alteration of coins, spending and introduction into the State of counterfeit coins, spending counterfeit coins received in good faith, counterfeiting stamps, introduction into the State, purchase, detention or circulation of counterfeit stamps, counterfeiting watermarked paper for use of public credit cards or stamps, manufacture or detention of watermarks or instruments for use in counterfeiting coins, stamps of watermarked paper and use of counterfeit or altered stamps. • Cross border crimes under Law No. 146 of 2006: among which, drug-trafficking, smuggling, money laundering, clandestine immigration, and aiding crimes if committed as cross border crimes: pursuant to Law 146, cross borders crimes are (a) crimes committed by a criminal organization, (b) punishable by not less than 4 years imprisonment and (c) crimes that have been committed either in (i) more than one Country, or (ii) one Country but prepared or organized in another, or (iii) one Country but involving a criminal organization operating in more than one Country, or (iv) one Country but its effects have been produced in another Country .

…commit one or more offences listed in Law 231…(III/III) • Crimes against the safety of the workers: murder and serious physical injury as a consequence of the breach of laws regulating the workplace health and safety. • Money - laundering and other related crimes: among which money-laundering, receipt of stolen goods; receipt of money deriving from illegal activities. • Cybercrimes: among which, illegal access to a computer system without right; illegal interception of data transmission; setting up of computer systems aimed to illegal interception; damages to computer systems; data interference; alteration or deletion of computer data; false in electronic documents; false committed by means of alteration of the electronic signature; alteration committed by certification service providers of electronic signature; computer related fraud. • Illicit garbage dumping and disposal

…in the interests or to the benefit of the entity… • No liability if the offence was committed in the exclusive interest and economic benefit of the individuals or any third party

…unless the entity adopted and implemented a compliance programme before the offence was committed (I/II) • In case of crimes committed by Top Individuals, the entity is not liable if: • before the crime was committed, the entity adopted and effectively implemented an adequate compliance programme tailored to the characteristics of the company • has charged an independent internal body (“Supervisory Body”) with the task of supervising the implementation and fulfilment of the compliance programme and its being kept up-to-date • the individual(s) who committed the crime acted fraudulently by evading the compliance programme • the Supervisory Body did not fail to supervise and did supervise properly

…unless the entity adopted and implemented a compliance programme before the offence was committed (II/II) • In case of crimes committed by Subordinate Individuals, the entity is liable if: • the crime was committed as a consequence of deficiencies in the supervising and management system • The liability of the entity is excluded if: • before the crime was committed, an adequate compliance programme tailored to the characteristics of the company was adopted and effectively implemented

Definitive Sanctions • Fines from € 25,823 to € 1,549,371 (proportional to the seriousness of the offence and the economic conditions of the entity) are always imposed • Disqualification sanctions (so-called, backlisting) from 3 monthsto 2 years are imposed if specified and if (i) the entity realized a significant profit from the crime committed or (ii) the crime has been repeated: The blacklisting may consist of: • debarment from carrying out business • suspension or revocation of permits, licenses or concessions • ban on making contracts with the PA • exclusion from benefits, loans, contributions or subsidies • ban on advertising goods or services • Seizure of the profit resulting from the crime is always imposed • Publication of the sentence

Precautionary Sanctions • One or more disqualifying sanctions may be inflicted before the final conviction as precautionary measures where there are grounds to believe: • that the corporation has committed an offence punishable under Law 231 • that further similar offences could be committed

Contents of the compliance programme • The compliance programme shall: • Identify the “risk areas” in a specific and precise manner • provide the Supervisory Body with specific and effective inspection powers • establish appropriate control procedures in the risk areas • provide reporting duties to the Supervisory Body • introduce adequate disciplinary measures • establish appropriate internal procedures • provide special procedures for the training of the personnel operating in the “risk areas”

Characteristics of the compliance programme • According to the case law, the compliance programme shall be: • Effective: it is not sufficient thatthe compliance programme is formally adopted, it is necessary that it is effectively and entirely put in place • Specific: the compliance programme shall be tailored to the characteristic of the company in relation to its dimension and the activities carried out • Updated: the compliance programme shall befrom time to time updated in order to reflect any change occurred in the company, or in the laws • Assobiomedica Guidelines (November 2004) • Farmindustria Guidelines (March 2007) • Confindustria Guidelines (March 2008)

Why to adopt a compliance programme • The entity is not liable: • where a compliance program was adopted and implemented before the offence was committed. • Disqualification sanctions may not be applied, neither as definitive nor as precautionary: • where the entity adopted a compliance program after the offence was committed

Some case law: the Siemens AG case (I/II) • At the end of 2002, Italian authorities commenced an investigation and three top manager of Siemens AG were charged with having bribed two officers of Enelpower to secure the award of supply subcontracts for gas turbines • On 27 April 2004 – 25 July 2006 the Court of Milan issued a decision that is considered a milestone in Law 231 issues of extraterritorial jurisdiction: • Italian judges have jurisdiction over crimes committed in Italy by individuals of foreign entities • also external consultants could be considered as subordinates to the entity’s management • Siemens AG was liable for crimes committed by individuals because the company did not adopt an adequate, specific and effective compliance program (the Code of Ethics adopted by Siemens as a US Foreign Issuer was considered generic and not effective)

Some case law: the Siemens AG case (II/II) • Under the plea agreement of 25 July 2006, Siemens AG: • was banned from selling gas turbines to the Italian Public Administration for one year (this penalty had already been inflicted on Siemens AG as a precautionary measure) • was condemned to pay a fine of € 500,000 • had the profits deriving from the crimes committed (€ 6 million) confiscated • paid damages to the damaged parties (€ 160-180 million to Enelpower)

Some case law: Parmalat case • In the proceeding pending before the Court of Milan against foreign banks involved in the Parmalat case the Judge for the Preliminary Hearing (decree of 13 June 2007) reaffirmed that: • Italian judges have jurisdiction over crimes committed in Italy by individuals of foreign entities • Law 231 is applicable vis-à-vis foreign companies which carry out their activity in or into the territory of Italy, having or not a subsidiary or a branch in Italy

Some case law: The IVRI / Cogefi Case • Court of Milan, ordinance of 20 September 2004, confirmed, with reference to the principals applying to groups, on 14 December 2004, (IVRI and Cogefi Case): • the controlling entity may be held liable for crimes committed by individuals of the controlling entity in the interest or to the benefit of the controlled companies

Some case law: Sirchia case • On 16 April 2008 the Court of Milan condemned Girolamo Sirchia (former Ministry of Healthcare and former director of an hospital in Milan) for having received bribes from 1998 to 2004 in connection with the supply of medical devices to the hospital he manged • 7 managers of well-known biomedical corporations condemned as well • Law 231 applied to the corporations for some of the crimes committed by their top managers

Points to watch • Compliance programmes: • Group compliance programmes must be adapted to Italian requirements, otherwise may not be used as a defense • Formal approval by the BoD is required • Appointment of a supervisory body required • Foreign companies operating "into" Italy also need Italian law-compliant programs • Internal investigations can be hindered by data protection rules and employment law • Prosecutors' attitude: • Aggressive use of Italian jurisdiction (Siemens, Parmalat) • Precautionary freezing of assets common (Oil-for-Food) • Precautionary blacklisting (Siemens)

Points to watch • Legal points: • Corruption crimes trigger tax consequences • Heavy non-monetary penalties (blacklisting, revocation of licenses) • The promise of a bribe is a crime • Private to private corruption is a crime (but does not yet involve the criminal liability of the company, only of the individual) • Ne bis in idem • Competitors/damaged parties' attitude: • Significant damages paid to victims of wrongdoing • Competitors suing for unfair competition

Our Offices

The New Italian Compliance Law Paris, 26 May 2008