Resolving Securities Enforcement Investigations

At every stage of an investigation, companies should focus on positioning themselves to secure a timely and advantageous resolution. This is particularly true in cross-border investigations, where the failure to ensure that different regulators are coordinated and progressing through their investigations at similar paces can delay a resolution and result in materially worse outcomes. This section discusses three components of securing a favourable resolution in cross-border securities matters: (1) coordinating with interested regulators, both foreign and domestic; (2) vehicles for structuring a resolution; and (3) practical considerations attendant to these different structures, including remedial obligations.

Coordinating global resolutions

Negotiating a favourable resolution with a single regulator is oftentimes difficult; doing so with multiple international regulators, however, adds far greater complexity and nuance – and the stakes for the company under investigation are correspondingly higher. Failing to coordinate with foreign regulators in the early stages of an investigation may significantly delay a resolution as different regulators catch up to each other, and may result in the company being forced to enter into piecemeal resolutions. If foreign regulators with jurisdiction over the conduct at issue are not involved in the resolution, on the other hand, those regulators may nonetheless seek duplicative penalties after learning of the US resolution, potentially resulting in significantly higher overall expenditures. For these reasons, companies need to consider carefully the likelihood of foreign regulatory interest in US investigations involving cross-border conduct and proactively manage those regulators where appropriate.

The ultimate goal of coordinating with foreign regulators is to secure a global resolution that offers full closure for the relevant conduct. Global resolutions are nearly always preferable to piecemeal settlements, as they can speed up the overall timing of a resolution, reduce the defence costs associated with responding to overlapping investigations and, most importantly, help avoid duplicative sanctions. Indeed, regulators will often ‘credit’ payments made to other regulators when they are part of a global resolution. The US Department of Justice (DOJ) policy, for example, states that prosecutors should ‘consider the amount of fines, penalties, and/or forfeiture paid to other . . . foreign enforcement authorities’ when crafting a resolution of their investigation.^[2] Many companies have received significant credit for penalties paid to foreign enforcement authorities pursuant to this policy.^[3] Further, if the resolutions are approved at the same time, companies may be able to limit bad press to one day or a limited number of days, thus reducing the reputational risks of the individual investigations. If a company determines that a global settlement is in its best interest, it should accordingly assist authorities in coordinating their investigations and the resolution of those investigations.

US and foreign enforcement authorities will oftentimes coordinate without prompting. Indeed, they are oftentimes required by policy to do so. For example, DOJ policy dictates that US prosecutors should ‘coordinate with . . . foreign enforcement authorities that are seeking to resolve a case with a company for the same misconduct’.^[4] The UK Serious Fraud Office (SFO) guidance similarly requires that the SFO take into account ‘where there is a parallel investigation by an overseas . . . agency’.^[5]

Where regulators fail to coordinate on their own, companies should taking proactive steps to ensure that each interested regulator is in a position to resolve at an appropriate time. One way to do this is to share relevant information with different regulators – including, for example, sharing the findings of internal investigations or updating regulators on their peers’ progress. Under the right circumstances, sharing information in this manner can facilitate more efficient investigations, resolutions and outcomes. Companies should be aware, however, that different jurisdictions value cooperation differently. For example, a company need not waive its attorney–client or work-product privileges to receive cooperation credit from US regulators,^[6] but it may be required to do so to receive cooperation credit from the SFO, at least with respect to witness accounts, notes and transcripts obtained during the course of a company’s internal investigation.^[7] Communicating with the enforcement authorities in different jurisdictions is key to understanding and resolving the intricacies of potentially conflicting requirements.

The full extent of the resolution’s benefits, however, will depend upon the form that the resolution takes, as discussed below.

Resolution mechanisms

Global resolutions can take different forms, some of which are more favourable than others. Negotiated resolutions of civil investigations may include civil injunctions or cease-and-desist orders; termination notices (which are essentially declinations), non-prosecution agreements (NPAs) and deferred prosecution agreements (DPAs) are also available but less common. Negotiated resolutions of criminal investigations generally involve declinations, NPAs, DPAs or, in some instances, guilty pleas.^[8] Understanding the implications of each of these resolution vehicles is key to developing a successful strategy to resolve cross-border investigations.

Civil resolution vehicles

The majority of cases in which the US Securities and Exchange Commission (SEC) determines to initiate an enforcement action settle prior to trial. The SEC often settles enforcement actions through one of the two following avenues.

The SEC may institute a civil administrative cease-and-desist proceeding based upon an offer of settlement submitted by the company. In that offer, the company consents to the SEC’s entry of an order finding that the company violated certain provisions of the federal securities laws, requiring it to cease and desist from violating the particular provisions of the federal securities laws at issue in the investigation and imposing other remedial sanctions. The SEC then issues an administrative order imposing the cease-and-desist order and other remedial sanctions.^[9]

Alternatively, the SEC may file a complaint in federal district court.^[10] If so, the company consents to the court issuing a final judgment imposing a civil injunction that prohibits the company from violating the particular provisions of the federal securities laws at issue in the investigation, imposes financial sanctions (e.g., disgorgement, a civil monetary penalty) and, at times, orders the company to comply with certain remedial undertakings.^[11] A company that violates the civil injunction may be held in contempt.

Notably, under either procedure, the company is typically not required to admit the SEC’s allegations or findings.^[12] On occasion, the SEC has resolved investigations through the use of NPAs or DPAs.^[13]

Criminal resolution vehicles

Prosecutors consider a variety of factors when deciding whether to file criminal charges against a company. US prosecutors are required to consider a well-publicised set of factors colloquially called the ‘Filip Factors’ that include the nature of the underlying offence, the pervasiveness of wrongdoing within the company, the company’s cooperation in the investigation and a series of other related factors.^[14] Prosecutors may decline to file criminal charges altogether based upon their assessment of those factors, and may similarly decline prosecution even if a company agrees to a negotiated criminal resolution with another jurisdiction.^[15]

Where prosecutors refuse a declination, they may instead seek an NPA or a DPA with a company. In the United States, prosecutors traditionally offer DPAs where ‘the collateral consequences of a corporate conviction for innocent third parties would be significant.’^[16]

In an NPA, prosecutors agree to refrain from bringing criminal charges against the company so long as the company satisfies enumerated obligations in the agreement, which generally include payment of a fine, cooperation in future governmental investigations and remedial undertakings. Criminal charges are never lodged in any manner. In a DPA, by contrast, prosecutors actually file a charging document but agree to defer prosecution under that document for a specified period of time (typically three years) in exchange for similar enumerated obligations. If prosecutors determine that the company complied with its obligations under the DPA, they will move to dismiss the filed charges, without the company ever being subject to trial or a criminal conviction. If prosecutors determine that the company breached its obligations under the DPA, however, they may commence prosecution. Unlike an NPA, which does not require judicial intervention, a DPA requires court approval.

Other countries around the world, notably the United Kingdom and France, have implemented DPAs or DPA-like regimes.^[17] Key differences exist between the United States and international regimes, however, especially regarding the amount of judicial oversight^[18] and the types of investigations that may be resolved through DPAs.^[19] Companies negotiating global resolutions should pay special attention to these differences.

Practical considerations

Numerous considerations come into play when negotiating the resolution of a cross-border matter. Below are some practical considerations that a company may wish to consider as it seeks a negotiated resolution.

Covered entities

There are different outcomes depending upon the entity or entities covered by the resolution; a resolution covering a parent-level entity, for example, may be more harmful than one covering only a subsidiary. For that reason, it may be advantageous for the parent entity to enter into one type of resolution (e.g., a civil cease-and-desist proceeding) while a subsidiary enters into another (e.g., an NPA or a DPA). Further, the entities that are covered by the resolution often impact the collateral consequences or continuing obligations that flow from the resolution. For example, a parent entity may be able to reduce the collateral consequences or continuing obligations of a resolution if the resolution covers only the subsidiary. A company should consider what collateral consequences and continuing obligations could result from the resolution and seek to limit those consequences and obligations as best it can.

Covered violations

A company should also consider what collateral consequences and continuing obligations could result from the resolution in determining which violations will be covered by the resolution. Certain violations may directly lead to particular collateral consequences or continuing obligations that may be quite onerous for the company. For example, charges premised upon intentional fraud often lead to more onerous collateral consequences and remedial obligations than negligence-based fraud charges. If a company is able to settle for a lesser charge, it may be able to reduce – or even eliminate – certain collateral consequences or continuing obligations that may flow from the resolution.

Admissions

Factual admissions of misconduct carry significant risk, especially when the admitted misconduct relates to intentional misconduct. Negotiated resolutions with the SEC are often, although not always, on a neither-admit-nor-deny basis.^[20] Nevertheless, the SEC’s findings could still result in reputational harm, so a company may wish to scrutinise the SEC’s proposed findings to ensure the accuracy and completeness of those findings. Criminal NPAs and DPAs, on the other hand, often require a company to admit that the facts set forth in the agreement are true and accurate, or at the very least admit its responsibility for the acts of its officers, directors, employees and agents as set forth in the agreement.^[21] A company should take great care in reviewing and negotiating the specific language in these agreements to reduce the reputational risk caused by required admissions as much as possible.

Collateral litigation

Factual admissions of misconduct also create significant collateral litigation risks. Plaintiffs may seek to use admissions against the company in future civil litigation, and generally have the right to do so.^[22] The risk that admissions will be used against a company in collateral litigation is significantly reduced if a company is able to enter into an agreement without any admissions, although in some matters that may not be possible.

Non-denial and non-contradiction clauses

Settled negotiations often lead to publicity, especially when the investigation relates to conduct that may grab the public’s attention. As part of a negotiated settlement, a company is frequently prohibited from denying the SEC’s allegations contained in a complaint or findings contained in a cease-and-desist order, or from contradicting in any public statement the facts and the company’s acceptance of responsibility laid out in an NPA or a DPA. Without the ability to deny the SEC’s allegations or findings, or the facts contained in an NPA or a DPA, companies often face collateral estoppel issues in related subsequent litigation. Not only that but violations of these clauses could provide a basis for a determination that the company breached the settlement agreement. For that reason, a company should ensure that the agreement contains a provision allowing it to cure any potential breach. In any event, a company should carefully review all public statements that in any way touch on the resolution (e.g., press releases, client communications, statements to investors, even witness testimony in collateral litigation) to ensure that those statements in no way inadvertently deny or contradict the allegations, findings or facts contained in the agreement.

Breach

It goes without saying that a company should not breach a negotiated resolution. That said, a company may wish to consider the following when negotiating the resolution. First, what conduct on the company’s part constitutes a breach of the agreement? Second, who has the authority to determine whether the company breached the agreement? Often, in the United States, either the DOJ or the SEC has sole authority to determine whether the company breached the agreement. In the United Kingdom, however, prosecutors must request a finding from the court that the company breached the agreement.^[23] Finally, what are the consequences of the breach? In some instances, the enforcement authority may extend the company’s obligations under the agreement.^[24] In other instances, however, the enforcement authority may terminate the agreement and prosecute the company.^[25]

Continuing cooperation and disclosure

Negotiated settlements typically have continuing obligations. NPAs and DPAs typically last three years, during which the company is often subject to extensive continuing obligations. Some obligations may relate to enhancing the company’s compliance programme, as discussed in the following section. Other obligations likely relate to cooperation, including, but not limited to: fully cooperating with the enforcement authority (including foreign law enforcement and regulatory entities) in any and all matters relating to the conduct described in the agreement at any point during the term of the agreement; fully cooperating with the enforcement authority in any and all matters relating to other conduct under investigation by the enforcement authority at any point during the term of the agreement; and fully disclosing all factual information about which the company has knowledge or about which the enforcement authority may inquire. Further, a company is typically required to report evidence or allegations of conduct that may constitute a violation of law, although agreements differ with respect to the breadth of this disclosure obligation. Companies should be aware of these provisions during the settlement discussions and consider the need to self-report potential misconduct.

In arriving at a negotiated resolution, regulators will also often require companies to review their existing internal controls and, where necessary, adopt new compliance programmes or enhance existing programmes. Evaluating a compliance programme is difficult, as standards differ by industry and have changed rapidly in the past several years. In June 2020, however, the DOJ issued updated guidance regarding how it evaluates compliance programmes.^[26] That guidance highlighted three ‘fundamental questions’ it considers when conducting such an evaluation:

• Is the corporation’s compliance programme well designed?
• Is the programme being applied earnestly and in good faith? In other words, is the programme adequately resourced and empowered to function effectively?
• Does the corporation’s compliance programme work in practice?^[27]

This guidance accords with guidance from other enforcement authorities, including the SFO. In January 2020, the SFO issued its own internal guidance regarding how it assesses the effectiveness of an organisation’s compliance programme.^[28] The guidance highlights the following six principles that the SFO believes ‘represent a good general framework for assessing compliance programmes’: proportionate procedures, top-level commitment, risk assessments, due diligence, communication (including training), and monitoring and review.

Because the strength of a company’s compliance programme is relevant to charging decisions, companies should consider improving their compliance programme, or at least working to identify any gaps or shortcomings that led to the conduct at issue, during the course of the investigation. Specifically, a company should consider implementing a code of conduct and other appropriate policies and procedures, periodically training its employees on those policies and procedures, implementing a reporting structure to enable the anonymous or confidential reporting of misconduct and conducting due diligence of its third-party vendor relationships and any acquisition targets, if applicable.^[29] Additionally, a company should consider ensuring that its senior and middle management set an ethical ‘tone at the top’ and implement a culture of compliance throughout the company and clear disciplinary procedures to address non-compliance with laws, rules and regulations, or the company’s policies and procedures.^[30] With respect to the resourcing of its compliance programme, a company should consider the seniority, stature, experience, qualifications, resources and autonomy of its compliance personnel to ensure that the compliance programme functions effectively. With respect to whether its compliance programme works in practice, a company may wish to continuously review and improve the programme through (1) periodic testing and risk assessments, (2) investigating allegations of misconduct in a timely and thorough manner, (3) documenting the company’s findings and response, and (4) conducting root cause analyses of identified misconduct and remediating those root causes in a timely manner.^[31]

Another reason why companies may wish to take to heart the aforementioned guidance is that enforcement authorities sometimes require, as part of a negotiated resolution, that a company engage a monitor to assess the company’s compliance programme and detect any ongoing misconduct. Monitors are independent third parties tasked with independently evaluating ‘whether a corporation has both adopted and effectively implemented ethics and compliance programs to address and reduce the risk of recurrence of the corporation’s misconduct’.^[32] The company is generally required to retain the monitor and pays its fees and expenses.

Not every negotiated resolution requires a company to engage a monitor.^[33] In determining whether to impose one, US prosecutors weigh ‘the potential benefits that employing a monitor may have for the corporation and the public’ and ‘the cost of a monitor and its impact on the operations of a corporation’.^[34] These costs can be significant, in terms of both the expenses of the monitorship (which can be in the tens of millions of dollars) and disruption to the business. For these reasons, companies often seek to avoid the imposition of a monitor, if possible. To be in the best position to do so, a company should seek to significantly improve its compliance programme as soon as possible upon discovering the underlying misconduct.

Some companies have been successful in negotiating self-monitoring and reporting arrangements in lieu of monitorships.^[35] These arrangements allow the enforcement authority to receive periodic updates regarding the company’s remediation and implementation of its compliance programme and internal controls, policies and procedures, without imposing on the company the full costs of an external monitorship.

A company should fully cooperate with a monitor, should one be imposed. This cooperation typically includes, but is not limited to, providing the monitor access to information, documents, records, facilities and employees, and using best efforts to provide the monitor with access to former employees and its third-party vendors, agents and consultants. Because an attorney–client relationship does not exist between the monitor and the company, companies may withhold information or access to employees on the basis of the attorney–client privilege or attorney work-product doctrine, provided that the company works cooperatively with the monitor to resolve the matter to the monitor’s satisfaction.

A company should take the monitor’s recommendations seriously and follow them if possible, but companies are not required to follow recommendations that are unduly burdensome, inconsistent with applicable law or regulation, impractical, excessively expensive or otherwise inadvisable.^[36] If such a situation occurs, the company should propose an alternative recommendation designed to achieve the same objective or purpose and attempt to reach an agreement with the monitor. The enforcement authority may consider the monitor’s recommendation and the company’s reasons for not adopting it in determining whether the company breached the settlement agreement.

Conclusion

A company facing potential criminal or civil exposure due to cross-border investigations may be able to negotiate a resolution of those investigations in a way that mitigates reputational harm, business interruption and financial expense. Achieving these goals requires the company to fully understand the facts of the matter but also to identify various resolution vehicles that may be available, consider the implications and consequences of those resolution vehicles, and develop a plan to implement potential remedial measures that they may impose.

Footnotes