Privilege and Confidentiality
Privileges are generally conceived as the principle-based reason for information to remain available only to those possessing the privilege and, conversely, immune from outsiders to the relationships recognised by the applicable privilege. It is well established that there is no attorney–client privilege between a monitor and a monitoree. Virtually every recently documented resolution that has resulted in a monitorship confirms the parties’ agreement to that principle. Further, the legal area of privilege as it bears on monitorships is relatively underdeveloped and it is uncommon for a circumstance to arise where it could be developed, such as where an outsider to the monitorship seeks to obtain a report written by a monitor. From the broader perspective of confidentiality, however, there is quite a bit to consider.
Knowing that no attorney–client relationship exists between the monitor and monitoree, parties invested in a successful monitorship typically seek to preserve confidentiality to the greatest extent possible. Confidentiality concerns are at the forefront of every monitorship. For example, the monitor will want to investigate the compliance programme of a financial institution robustly, with an eye towards its improvement. To do so, it needs the freedom to communicate with the financial institution, its employees and its regulator without fearing that information about newly discovered compliance problems, let alone information about their solutions, will be made available to those who could exploit that information. Further, the prosecutor or regulator that installed the monitor may have an institutional interest in ensuring the confidentiality of reports generated by the monitor, such as a newly discovered activity that requires follow-up investigation or enforcement.
However, it is not always clear from whom information should remain confidential and when recognised interests in confidentiality should be overridden by other interests. For example:
- Under what circumstances does the public have a First Amendment right to obtain the reports of a monitor that are the result of a judicially supervised resolution?
- When should the monitor’s discovery of new or ongoing criminal activity be brought to the attention of the prosecutor or regulator that installed the monitorship, but kept confidential from the monitoree?
- When should a private litigant be able to obtain by subpoena otherwise non-privileged information developed by the monitor and summarised in a written report to the prosecutor or regulator that installed the monitorship?
- If the confidentiality of a monitor’s report cannot be guaranteed under US law, how might foreign regulators be persuaded to allow a monitor access to an entity under a US monitorship that is also subject to the jurisdiction of a foreign regulator?
This chapter seeks to explore these questions, the nature of privilege and the broader issue of confidentiality in connection with monitorships.
No privilege between monitor and monitoree
The common theme underlying monitorships arising from deferred prosecution agreements (DPAs), non-prosecution agreements (NPAs) and other similar types of resolutions (for example, resolutions with the Securities and Exchange Commission (SEC) that require retention of a consultant as a result of a resolution of a civil suit or administrative proceeding) is that the monitor or consultant must be independent of both the government and the corporation it is tasked with monitoring.
The requirement of independence assures, among other things, that the monitor will act neutrally in pursuit of the facts and in otherwise satisfying the mandate of the monitorship to which the monitoree and the government have agreed. Independence is typically ensured as part of the monitor selection process and in the frequent requirement that the monitor not enter into any employment, consulting or attorney–client relationships for a specified period after completion of the monitorship or consulting arrangement.
This independence predominantly drives the answer to the question of whether the information that the monitor obtains, and the work-product that it generates in carrying out its responsibilities, can be deemed privileged or otherwise protected from disclosure.
In guidance issued by the US Department of Justice (US DOJ) in 2008 concerning the use of monitors in DPAs and NPAs with corporations, the then Acting Deputy Attorney General Craig Morford stressed the principle that a monitor ‘is an independent third-party, not an employee or agent of the corporation or of the Government’. Because ‘[t]he monitor is not the corporation’s attorney . . . the corporation may not seek to obtain or obtain legal advice from the monitor. Conversely, a monitor also is not an agent or employee of the Government’.
The need to ensure that monitors act as independent and neutral arbiters was reinforced in the civil context on 16 April 2021, when Attorney General Merrick B Garland rescinded a 2018 order from the then Attorney General Jeff Sessions substantially limiting the use of consent decrees pertaining to misconduct by local police departments. In his memorandum, Attorney General Garland emphasised that the US DOJ ‘has a significant interest in ensuring that the monitor selected is independent, highly qualified, and free of conflicts of interest’. He also emphasised that, in future monitorships of state and local governments, the monitors should be accountable to the court, the parties and the public. In September 2021, Attorney General Garland announced the outcome of a resulting US DOJ review of the use of monitors, characterising as one of the ‘important aims’ of the review to ensure that monitors are independent. The American Bar Association (ABA) agrees.
Consistent with this policy view, virtually every resolution providing for a monitorship explicitly indicates that ‘[t]he parties agree that no attorney-client relationship shall be formed between the Company and the Monitor’. Non-DOJ resolutions, such as one with the Department of Commerce, are similar:
No attorney–client relationship shall be formed between [the entity] and the [special compliance coordinator]. No documents or information created, generated, or produced by the [special compliance coordinator] will be considered privileged from disclosure to [the US Department of Commerce, Bureau of Industry and Security] or other US federal government agencies, nor shall [the entity] assert such a claim of privilege.
The ABA’s Standards for Criminal Justice: Monitors and Monitoring (the ABA Standards) note, however: ‘It is clear under these Standards that the Monitor should not treat the [corporation] as its client, and therefore, for example, the Monitor does not have a duty of zealous representation or a duty to maintain most confidences.’ Moreover, to carry out his or her responsibilities, the monitor must have the discretion and, where authorised by the settlement agreement, the obligation to report to the court, the government (or both) concerning the corporation’s conduct.
Resolutions with the SEC that require the installation of an independent compliance consultant also do not create an attorney–client relationship between the compliance consultant and the entity agreeing to the resolution.
Typically, resolutions with the SEC require the entity to retain a consultant to review the entity’s policies and procedures in a particular area, make recommendations for changes and improvements, and conduct periodic reviews. To ensure the independence of the consultant, the entity is frequently precluded from dismissing the consultant without the approval of the SEC.
These resolutions foreclose, at the outset, invocation of the attorney–client privilege or even the attorney work-product protection: ‘Respondent shall not invoke the attorney–client privilege or any other doctrine or privilege to prevent the Consultant from transmitting any information, reports, or documents to the Commission staff.’
It is important to distinguish monitors and independent consultants retained as part of a resolution from those who are pre-emptively retained by an entity or an entity’s counsel during an investigation. Frequently, entities under investigation hire external subject-matter experts, often through counsel, to implement an effective compliance programme in an effort to pre-empt the need for a monitor. The US DOJ has noted that, under some circumstances, a monitor may not be required as part of a resolution ‘if a company has, at the time of resolution, implemented an effective compliance program’. Similarly, the SEC has cited early remedial actions undertaken by an entity as reasons for a particular resolution. On the other hand, regulators have noted in some instances that institutions had failed, prior to the resolution, to effectively remediate problems after an external consultant was retained to assist. These pre-resolution arrangements, and arrangements by which an entity is permitted to monitor itself, may be protected by attorney–client and attorney work-product privilege.
Despite the lack of a recognised attorney–client privilege between the monitor and monitoree, there is a high level of interest of all concerned in maintaining confidentiality. For example, the monitoree wants to ensure that its trade secrets remain as tightly protected as can reasonably be accomplished. The monitor has a great interest in ensuring that employees have a mechanism to be candid and self-critical so as to allow real improvements in the entity’s culture of compliance. Finally, the prosecutor or regulator has institutional concerns about ensuring that compliance programmes are assessed, and improvements identified and implemented, out of the view of those who might exploit compliance blind spots.
There are mechanisms for improving the chances that documents generated by the monitor, including its reports to the monitoree and the government, and communications with the monitor, remain confidential.
One mechanism is purely contractual, with typical language of a DPA being as follows:
The reports [generated by the monitor] will likely include proprietary, financial, confidential, and competitive business information. Moreover, public disclosure of the reports could discourage cooperation, or impede pending or potential government investigations and thus undermine the objectives of the monitorship. For these reasons, among others, the reports and the contents thereof are intended to remain and shall remain non-public, except as otherwise agreed to by the parties in writing, or except to the extent that the Department determines in its sole discretion that disclosure would be in furtherance of the Department’s discharge of its duties and responsibilities or is otherwise required by law.
In instances where an entity is permitted, in essence, to self-monitor by retaining a consultant pursuant to a DPA or NPA, even a component of the government that did not specifically require the self-monitoring is included within those to whom monitor-generated documents may be provided. Typical language provides that:
For the duration of this Agreement, the Office, as it deems necessary and upon request to [the entity], shall: (a) be provided by [the entity] with access to any and all non-privileged books, records, accounts, correspondence, files, and any and all other documents or other electronic records, including e-mails, of [the entity] and its representatives, agents, affiliates that it controls, and employees, relating to any matters described or identified in the [reports generated pursuant to related settlements with other governmental authorities] and (b) have the right to interview any officer, employee, agent, consultant, or representative of [the entity] concerning any non-privileged matter described or identified in the [reports generated pursuant to related settlements with other governmental authorities].
Limited confidentiality in selected cases and increasing transparency
There is some precedent for the enforcement of these types of confidentiality provisions in the context of consent decrees when the material comes into existence because the consent decree requires it to be generated.
In United States v. Bleznak, the defendants were required to implement a compliance programme that included recording and monitoring the telephone conversations of its stock traders pursuant to a consent decree. The Second Circuit shielded the material from disclosure to third-party intervenors on the strength of a confidentiality provision stating that tapes made pursuant to the agreement would not be subject to civil process, except for a request by the government and certain regulatory agencies and self-regulatory organisations. However, the court introduced a cautionary note, stating that it did not ‘quarrel with the principle asserted by [the requesting third-party plaintiffs] that parties may not use a consent decree to limit non-party rights that would otherwise prevail’.
Similarly, when a defendant created training materials and policies required by its consent decree, the court shielded that material from disclosure to the plaintiffs, who were not parties to the consent decree, but held that the defendant was required to produce any similar materials that predated the consent decree, notwithstanding the broad terms of a confidentiality provision. Moreover, because the consent decree merely allowed, but did not require, the defendant to conduct an internal investigation into complaints similar to those that originally gave rise to the consent decree, the court ordered the defendant to produce documents that it sent to the government concerning the results of that investigation.
In contrast to these nuanced approaches, in the context of a civil consent decree, the District Court for the Southern District of Mississippi has held that ‘[t]he plain language of the consent decree controls’, in rejecting the request of the municipal county for production of the monitor’s communications with county employees. Reasoning that the requests were contrary to the consent decree’s requirement that the monitor maintain the confidentiality of all information, and that disclosure would ‘seriously undermine’ the monitor’s ability to do the job well, the district court denied that request, as well as the county’s request for any communications between the United States and the monitor.
The ABA Standards envision a monitor’s ability to allow individuals to speak confidentially or anonymously to increase the flow of information to the monitor: ‘If the flow of information includes proprietary or confidential information, the Monitor is under a duty to safeguard that information.’ However, it is not certain that even an explicit expression of the parties’ intent to keep the information confidential will be honoured by the courts.
There is also precedent for the release of a non-confidential version of the report of an independent compliance monitor in civil antitrust cases to which the government is a party and in police misconduct monitorships. A number of recent monitorships have required some limited information arising out of the monitorship to be made public, and the US DOJ has started to publicise the identity of compliance monitors in selected matters.
Judicial action in monitorships created by DPAs
The judiciary has been active in scrutinising confidentiality provisions and one additional avenue to buttress the confidentiality of monitor-related materials is to enlist the aid of the judiciary itself. Accordingly, when a corporation enters into a DPA, which is filed with the court, the parties can request that the court issue a protective order directing that those materials are protected from discovery.
In United States v. Computer Associates International, Inc, where the court appointed an independent examiner pursuant to a DPA, the parties did just that. In their joint application, the government, the defendant and the independent examiner cited the need to ‘encourage a free flow of information to and from the Independent Examiner, without threat that such information will be discoverable’.
The application argued as a basis for the proposed order the ‘quasi-judicial immunity frequently accorded court-appointed examiners for the protection of testimony, documents and other information obtained by examiners through their court-ordered powers’, relying on cases concerning bankruptcy examiners. The court then entered a sweeping protective order providing not only that information and material provided to, and generated by, the independent examiner would be protected from disclosure, but also that the independent examiner and his agents were not subject to deposition or other discovery requests.
As an outgrowth of the protective order permitted in Computer Associates, an additional, albeit untested, mechanism that may protect from disclosure information provided to a monitor appointed pursuant to the judicially supervised DPA is Rule 502, Paragraphs (d) and (e) of the Federal Rules of Evidence, a provision added in 2008. In general, under Rule 502(d), the court may issue an order providing that a party’s disclosure of documents protected by the attorney–client privilege or work-product protection does not waive the privilege. Under Rule 502(e), if an agreement between the parties to that effect is embodied in a court order, it can bind persons other than the litigants that entered into the order (unless there was an intent to waive the privilege).
Without the benefit of a prospective court order, the parties are left to argue the issue of confidentiality before the court, with high stakes and uncertain results. The courts have struggled with how to evaluate the work of persons acting in a monitor-like capacity in the context of traditional privileges designed to protect information from public access. Some courts have refused to find that existing protections extend to the work of the monitor, adhering to the traditional contours of the cited privilege. Other courts have had to finesse the issue of where precisely the authority to protect these materials from disclosure derives.
In In re LTV Securities Litigation, the court recognised a ‘special officer privilege’ where such an official had been appointed pursuant to a corporation’s consent decree with the SEC. The special officer was required to report to the SEC as well as to the corporation’s audit committee. The court reasoned that his function was a ‘hybrid of two roles, those of government investigator and privately retained counsel’; as such, because attorney–client and work-product privilege are ‘reasonably flexible’, and because the court must ‘construe claims of privilege in their true factual context to ensure that the underlying policy justifications are served’, the court refused to compel discovery of the special officer’s work to shareholders in a class action brought against the corporation. The court specifically commented on the ‘immediate adverse impact on the ongoing investigation’ of the corporation, and focused on the concern that corporations would be less willing to engage in self-investigation were the special officer’s reports to be disclosed. The court concluded that ‘changing circumstances require courts constantly to review the need for and extent of existing privileges’.
United States v. HSBC Bank USA, NA (HSBC) represents a stark example of the high stakes involved when it comes to protecting the work of the monitor and the tenuous nature of those protections in the hands of an independent judiciary. In HSBC, the district court employed what it termed a ‘novel’ approach to its supervisory power, holding that it was authorised to monitor the execution and implementation of HSBC’s DPA with the government and directing the parties to file quarterly reports with the court. Subsequently, the court received a letter from a pro se complainant, stating that the monitor’s report had a ‘bearing’ on a complaint he had filed against HSBC with the Consumer Financial Protection Bureau and that the report would validate his claims that HSBC was in violation of ‘multiple sections of multiple Consent Decrees’.
The district court reasoned that the report was a judicial document subject to a presumptive First Amendment right of access by the public, and that the pro se letter was a motion to unseal. The court directed the government to file the monitor’s report itself, over the objection of both the government and HSBC, and despite the government’s assurances that HSBC was acting in good faith to comply with the agreement. The government argued that criminals could exploit the information and HSBC argued separately that it was legally obliged to protect the confidential information provided to the monitor. Because HSBC had a global footprint and the monitorship’s activities implicated various non-US jurisdictions, multiple interested parties advanced their views, including the Board of Governors of the Federal Reserve, the United Kingdom’s Financial Conduct Authority, the Hong Kong Monetary Authority and a Malaysian banking regulator.
On appeal, the Second Circuit reversed. The court held that ‘a federal court has no roving commission to monitor prosecutors’ out-of-court activities just in case prosecutors might be engaging in misconduct’ and had no ‘freestanding supervisory power to monitor the implementation of a [deferred prosecution agreement]’. Accordingly, the Second Circuit held that the monitor’s report was not relevant to the performance of the judicial function and, therefore, the district court abused its discretion in ordering it unsealed pursuant to the First Amendment objection.
Notwithstanding that the Second Circuit restrained the district court, the case remains an example of the significance of confidentiality concerns in monitorships and the challenges in maintaining confidentiality in the face of legal uncertainty. Indeed, HSBC remains beleaguered to this day, a circumstance presaged by a footnote in the Second Circuit’s decision. The court noted that even though the monitor’s report was not a judicial document, ‘[t]he appropriate device for obtaining executive records’ is a request to the ‘relevant agency’ under the federal Freedom of Information Act (FOIA), even as it cautioned that it was offering no view on whether any of that statute’s exemptions would apply. As we discuss below, BuzzFeed, a digital media company, accepted the Second Circuit’s invitation in October 2019 by filing a concise, three-page complaint against the US DOJ seeking access to the HSBC monitor’s report under the FOIA.
Limited success of the FOIA
Given the government’s repeated emphasis on ensuring that a monitor be considered independent rather than an agent or employee of the government, it is perhaps incongruous that third parties have had some limited success in citing the FOIA as a basis to procure monitor reports. In Leopold v. United States DOJ, the named plaintiffs (BuzzFeed and one of its investigative reporters) sought the 1,000-page confidential report issued by the independent monitor pursuant to the DPA between the government and HSBC. BuzzFeed alleged simply that the US DOJ was a federal agency subject to the FOIA and the report was not exempt under that statute. The government withheld the report, claiming numerous exemptions under the FOIA, and both parties moved for summary judgment concerning the applicability of those exemptions. The district court found two exemptions to be applicable: the exemption protecting sensitive commercial and financial information provided to the government under the assurance of confidentiality; and the exemption that applied to reports concerning the examination or operation of a financial institution even if the withholding agency was not the regulator. As such, the district court denied BuzzFeed’s motion for summary judgment, but also denied the government’s motion, holding that the government had failed to satisfy its obligation to segregate releasable information. The district court directed the government to ‘conduct a line-by-line review’ of the 1,000-page report ‘to determine whether any information can be reasonably segregated and released’. As of February 2022, the parties were still litigating whether the FOIA exemptions applied to protect the report against disclosure.
The New York Times preceded BuzzFeed by seven months in seizing on the FOIA as a means to obtain access to monitors’ confidential reports. In New York Times Co v. United States DOJ, the New York Times and one of its reporters brought an action against the US DOJ under the FOIA seeking a monitor’s report concerning Volkswagen AG’s compliance with a 2018 plea agreement arising out of Volkswagen’s scheme to evade emissions requirements. The plea agreement contained a provision specifying that the monitor’s reports were intended to be non-public unless required by law or if the US DOJ, in its sole discretion, determined that disclosure would be in furtherance of its duties. In contrast to HSBC, the government did release portions of the report in the New York Times case, while withholding other portions pursuant to FOIA exemptions covering ‘inter-agency or intra-agency memorandums or letters’. The district court denied both parties’ motions for summary judgment and ordered production for the report for in camera review. The decision is noteworthy for its lengthy analysis of whether the monitor’s report contained ‘commercial’ information for the purposes of the FOIA. The court noted that the Second Circuit had not yet addressed whether ‘information about the implementation of a company’s compliance program is itself “commercial” within the meaning of [the relevant FOIA exemption]’. However, in the court’s view, the cases in which information about compliance programmes was held to be exempt were ones where that information was ‘intertwined’ with other information that could fairly be described as commercial. One hopeful feature of the court’s analysis was with respect to another FOIA exemption. As to that exemption, the court held that the monitor was a ‘consultant corollary’ to the US DOJ, and that the report was ‘predecisional’ and ‘deliberative’. The court went on to hold that in camera review was necessary to determine whether the government had redacted factual, as opposed to deliberative, material.
Federal and state banking law privilege
There are a handful of federal and state statutes and regulations that bear on privilege and confidentiality in connection with financial institutions. Although a full discussion of these provisions and their intricacies is beyond the scope of this chapter, a basic introduction is important for an understanding of the manner in which monitorships of federal-regulated and state-regulated financial institutions may implicate the protection of confidential and privileged information.
Federal bank examination privilege, confidential
Supervisory information and anti-waiver provision
Bank examinations are a regular and important part of the life cycle of a financial institution. The purpose, in general, is to assess the safety and soundness of the financial institution and to ensure its compliance with a host of requirements applicable to banks. These examinations, the reports regulators make of them and other materials generated by bank regulators in the performance of their duties with respect to specific institutions, are non-public and are not easily obtained as a result of federal regulations that make them privileged.
Beyond these specific regulations, there is a qualified common law privilege widely recognised by US courts: ‘Stated broadly, the bank examination privilege is a qualified privilege that protects communications between banks and their examiners in order to preserve absolute candor essential to the effective supervision of banks.’ It is not without its limits, however, and has frequently been held to be confined to opinions and recommendations, not factual material. Indeed, in opposing the disclosure of the report of the monitor in HSBC, the Board of Governors of the Federal Reserve Board invoked the bank examination privilege and, while not quite contending that it was applicable to the HSBC monitor, noted the similarity between bank examinations and the monitor’s endeavour.
Finally, 12 US Code Section 1828(x) of Title 12 permits a financial institution to disclose privileged information to a wide variety of federal, state and foreign banking authorities, without waiving the privilege as to third parties to whom the disclosure is not made. It is, in effect, a federal statute that permits selective waiver:
The submission by any person of any information to the Bureau of Consumer Financial Protection, any Federal banking agency, State bank supervisor, or foreign banking authority for any purpose in the course of any supervisory or regulatory process of such Bureau, agency, supervisor, or authority shall not be construed as waiving, destroying, or otherwise affecting any privilege such person may claim with respect to such information under Federal or State law as to any person or entity other than such Bureau, agency, supervisor, or authority.
New York State Banking Law Section 36.10
There is a wide variety of state law relevant to the question of whether any privilege or confidentiality attaches to information and documents. Given its importance as a financial centre, the number of US and global banks with operations in New York, and the prominent role of its banking regulator, the most significant state statute is Section 36.10 of the New York State Banking Law.
Section 36.10 identifies a broad category of documents and materials that constitute ‘confidential communications’. These documents include ‘[a]ll reports of examinations and investigations, correspondence and memoranda concerning or arising out of such examination and investigations’ held, in general, by entities supervised by the New York State Department of Financial Services (NYDFS). Section 36.10 provides that confidential communications ‘shall not be subject to subpoena and shall not be made public’.
Indeed, Section 36.10 has become significant beyond the express purpose of shielding information from discovery and has been used, in effect, as a stand-alone enforcement mechanism. For example, in connection with concerns about the work done by consulting firms on behalf of entities supervised by the NYDFS, the Department’s then Superintendent, Benjamin M Lawsky, noted in 2013 that, under the resolution with one of those firms:
If [the firm] breaches this agreement, DFS could issue an order pursuant to New York Banking Law § 36.10 barring regulated financial institutions from sharing confidential supervisory information with [the firm]. Under New York Banking Law § 36.10, a statute that dates back to 1892, DFS can revoke a consultant’s access to confidential supervisory information if continued access to that information would not serve ‘the ends of justice and the public advantage.’ . . .
Regulators basically hold the keys to the kingdom for consultants in the form of access to confidential supervisory information. We have the power to shut off the spigot. Using that authority could be a way to impose accountability in an area that’s seen precious little of it.
But Section 36.10 has been subjected to scant testing and has not always resulted in the confidentiality of monitor-generated documents being maintained. For example, in a False Claims Act case brought in Texas, the relator sought via subpoena documents generated by the monitor of a mortgage servicing company that had entered into a consent order with the NYDFS. In the litigation, the monitoree and the NYDFS opposed the subpoena and asserted, among other grounds, Section 36.10.
The district court denied the motion to quash. The court found, first, that the monitor’s reports were not settlement communications protected by Rule 408 of the Federal Rules of Evidence because they were generated long after the resolution with the NYDFS. The court then applied a balancing test to determine whether Section 36.10 should be recognised under Rule 501 of the Federal Rules of Evidence and considered a variety of factors:
(1) whether the communications originated in a confidence that they will not be disclosed; (2) whether confidentiality is essential to the full and satisfactory maintenance of the relation between the parties; (3) whether the relation is one in which the opinion of the community ought to be sedulously fostered; and (4) whether the injury that would inure to the relation by the disclosure of the communications is greater than the benefit gained for the correct disposal of litigation.
Ultimately, the court rejected recognition of Section 36.10 under Rule 501 and ordered the monitor’s reports to be produced.
Additional monitor–monitoree considerations
Discovery of new or continuing unlawful conduct
Monitorships are increasingly global in nature. More and more, the conduct that has resulted in the monitorship and the work of the monitorship spans many areas of an institution’s operations and in different countries. As a result, the possibility that the monitor will uncover new or continuing unlawful or problematic conduct is frequently present. Recent DPAs provide the monitor with significant discretion to determine how to proceed following the discovery of such conduct, including immediate disclosure of actual misconduct to the US DOJ, with the option to disclose the actual misconduct to the monitoree’s general counsel, chief compliance officer or audit committee; immediate disclosure of possible misconduct to the US DOJ, but not the company, under certain circumstances; and immediate disclosure of possible misconduct to the monitoree’s general counsel, chief compliance officer or audit committee, with optional disclosure to the US DOJ.
Other monitorships have given the monitor more flexibility in determining how to respond to newly discovered conduct:
If potentially illegal or unethical conduct is reported to the Monitor, the Monitor may, at his or her option, conduct an investigation, and/or refer the matter to the Office. The Monitor should, at his or her option, refer any potentially illegal or unethical conduct to [the entity]’s compliance office. The Monitor may report to the Office whenever the Monitor deems fit but, in any event, shall file a written report not less often than every four months regarding: the Monitor’s activities; whether [the entity] is complying with the terms of this Agreement; and any changes that are necessary to foster [the entity]’s compliance with any applicable laws, regulations and standards related to the Monitor’s jurisdiction as set forth in [the agreement].
Whenever the company itself learns of the misconduct, it will typically conduct its own investigation, separately from the monitor, to preserve whatever privilege may attach to its findings. An additional consideration here is when the government has asked either the monitor or the company’s counsel to defer to the other in looking into this misconduct as part of a deconfliction effort.
Monitor’s access to privileged monitoree information
Monitorships are typically governed by a written mandate setting out the scope of the monitor’s work. Frequently, the mandate of the monitorship is forward-looking, that is, the monitor is tasked with ensuring that the monitoree complies with the terms of its resolution with the government going forward.
Often, the key component of the resolution is to ensure the robustness of the monitoree’s current compliance programme so as to reduce of the risk of recurrence of the conduct that resulted in the enforcement effort that brought about the monitorship. As one resolution described the monitor’s mandate:
The Monitor’s primary responsibility is to assess and monitor the Company’s compliance with the terms of the Agreement, including the Corporate Compliance Program . . . so as to specifically address and reduce the risk of any recurrence of the Company’s misconduct. During the Term of the Monitorship, the Monitor will evaluate, in the manner set forth below, the the effectiveness of the internal accounting controls, record-keeping, and financial reporting policies and procedures of the Company as they relate to the Company’s current and ongoing compliance with the [Foreign Corrupt Practices Act] and other applicable anti-corruption laws (collectively, the ‘anti-corruption laws’) and take such reasonable steps as, in his or her view, may be necessary to fulfill the foregoing mandate (the ‘Mandate’). This Mandate shall include an assessment of the Board of Directors’ and senior management’s commitment to, and effective implementation of, the corporate compliance program described [elsewhere in] the Agreement.
However, there are monitorships that have an historical or retrospective component that may require the monitor to investigate matters of the past. For example, one resolution required the monitor to review and report on various current compliance issues as well as ‘[t]he elements of the Bank’s corporate governance that that contributed to or facilitated the improper conduct discussed in this Consent Order and that permitted it to go on’.
These types of monitorships, with both an historical and prospective component, can be uniquely challenging. Experienced corporate monitor Bart M Schwartz, of Guidepost Solutions, has expressed strong views about the difficulties of successfully completing monitorships having both backward-looking and forward-looking components. He has written:
[A] Monitor should be forward looking. It is NOT ‘another investigation.’ I have turned down assignments where a company asked me to investigate wrongdoing and help build a compliance program. You can do one or the other; but I believe doing both is difficult, if not impossible, and if undertaken will cause problems on both sides of the equation. Think about it, how can one assign blame on one day and then seek cooperation the next day? It will not work.
A contrary and perhaps equally valid view is that an investigation of historical practices may inform future improvements, particularly where management and line-level employees have remained in place between the time of the conduct that resulted in the monitorship and the present.
Whether Schwartz is correct or not in his view of the impossibility of contemporaneously ‘investigat[ing] wrongdoing and help[ing] build a compliance program’, dual historical and prospective monitorships do generate unique issues regarding privilege. Namely, if the mandate of the monitor is to ‘investigate the investigation’ that the entity undertook when it became aware of the misconduct or when the government was investigating the misconduct, will the monitor by necessity be required to delve into information that may otherwise be protected by the attorney–client privilege and work-product protections?
If the answer to this question is yes, the monitorship may require a resolution of what are likely to be complicated questions of privilege. No easy solutions to the question of a monitor’s access to company-privileged information are identifiable, even in solely prospective monitorships with no historical investigation required. Given the difficulties of solving these problems in advance, some monitorships – including those with only a going-forward perspective – have directed the monitor and the monitoree to work cooperatively to solve these problems:
In the event that the Company seeks to withhold from the Monitor access to information, documents, records, facilities, or current or former employees of the Company that may be subject to a claim of attorney–client privilege or to the attorney work-product doctrine, or where the Company reasonably believes production would otherwise be inconsistent with applicable law, the Company shall work cooperatively with the Monitor to resolve the matter to the satisfaction of the Monitor.
The alternative to the monitor and monitoree’s resolution on their own of thorny questions of privilege or, for that matter, complicated questions of access to material under foreign law, is to put the government in the unenviable position of mediating these disputes:
If the matter cannot be resolved, at the request of the Monitor, the Company shall promptly provide written notice to the Monitor and the Department. Such notice shall include a general description of the nature of the information, documents, records, facilities or current or former employees that are being withheld, as well as the legal basis for withholding access. The Department may then consider whether to make a further request for access to such information, documents, records, facilities, or employees.
It is notable that recent resolutions that employ this language do not provide that the government will resolve disputes. The recent language provides simply that the dispute will be brought to the attention of the government for further action.
Everyone involved in a monitorship has a vested interest in its success. The monitoree has a desire to improve its compliance programme, prevent future unlawful conduct and allow the monitor to complete its work in as timely, efficient and cost-effective a manner as possible. The monitor seeks to drive real improvement in the monitoree’s compliance programme and ensure lasting change, so that the problems of the past do not recur, by completing the work within the time allotted by the monitoree’s resolution with the government. Further, the government has an interest in preventing further unlawful conduct by leveraging the expertise and resources of an external party.
That said, each of the parties involved in a monitorship approaches the issues of privilege and confidentiality from very different perspectives. Given the unsettled nature of some important questions of privilege and confidentiality in the monitorship context, the most successful monitorships will frequently arise where there is a repository of trust, good faith and flexibility on the part of all concerned.
1 Daniel W Levy is a principal at McKool Smith PC. Doreen Klein, previously senior counsel at McKool Smith, is senior counsel at Harris Beach PLLC.
This chapter specifically concerns monitorships in the United States. Only recently have foreign authorities begun to instal monitorships as the result of resolutions with them. See, e.g., ‘Airbus reaches agreements with French, U.K. and U.S. authorities’ (31 Jan. 2020), available at https://www.airbus.com/newsroom/press-releases/en/2020/01/airbus-reaches-agreements-with-french-uk-and-us-authorities.html (last accessed 9 Mar. 2022).
2 In the federal context, deferred prosecution agreements (DPAs) are filed in federal court, are predicated on the filing of a charging document and are subject to some limited court approval. Non-prosecution agreements are agreements between the US Department of Justice (US DOJ) and the corporation. There are no charges filed and the agreement is not reviewed by a court. See Craig S Morford, Acting Deputy Attorney General, ‘Memorandum Regarding Selection and Use of Monitors in Deferred Prosecution Agreement and Non-Prosecution Agreements With Corporations’ (7 Mar. 2008) (Morford Memorandum).
3 See, generally, Brian A Benczkowski, Assistant Attorney General, ‘Memorandum Regarding Selection of Monitors in Criminal Division Matters’ (11 Oct. 2018).
4 Morford Memorandum at 4–5.
5 Merrick Garland, Attorney General, ‘Civil Settlement Agreements and Consent Decrees with State and Local Governmental Entities’ (16 Apr. 2021), available at https://www.justice.gov/ag/page/file/1387481/download (last accessed 10 Mar. 2022).
6 Merrick Garland, Attorney General, ‘Review of the Use of Monitors in Civil Settlement Agreements and Consent Decrees involving State and Local Governmental Entities’ (13 Sep. 2021), available at https://www.justice.gov/ag/page/file/1432236/download (last accessed 10 Mar. 2022). The review itself was limited to consent decrees and settlement agreements in civil cases involving state and local governmental entities, and therefore did not apply to the use of monitors involving corporations in the criminal context.
7 See American Bar Association, Standards for Criminal Justice: Monitors and Monitoring (ABA Standards), at 2 (noting that monitors serve various functions, but ‘have certain central features in common, including being independent of both the Government and the [corporation]’).
8 See, e.g., United States v. Sociedad Química y Minera de Chile, SA, Case No. 17 Cr. 13, Deferred Prosecution Agreement, Attach. D, at Paragraph 5 (DDC 13 January 2017).
9 See, e.g., In the Matter of Zhongxing Telecom. Equip. Corp., Superseding Order at 7 (8 June 2018).
10 ABA Standards, at 35.
11 See Morford Memorandum, at 6 (‘The monitor must also have the discretion to communicate with the Government as he or she deems appropriate’, including ‘issues arising from the drafting and implementation of an ethics and compliance program’; moreover, ‘it may be appropriate for the monitor to make periodic written reports to both the Government and the corporation regarding’, inter alia, ‘whether the corporation is complying with the terms of the agreement’ and ‘any changes that are necessary to foster the corporation’s compliance with the terms of the agreement’); ABA Standards, at 2 (the monitor has ‘an obligation to report to the court, the Government, or both, concerning the [corporation’s] conduct’).
12 The attorney work-product doctrine protects materials prepared in anticipation of litigation. However, monitorships are typically imposed after the threat of litigation has ended and as part of a resolution. And the mandate of a monitorship is typically to ensure compliance with the terms of a resolution and investigative in nature, efforts that, without more, do not comfortably fit into the category of efforts in anticipation of litigation. As such, in the typical situation, there is little basis to protect information gathered and work done under the rubric of the attorney work-product doctrine.
13 In the Matter of Yucaipa Master Manager LLC, Order Instituting Cease-and-Desist Proceedings, Admin. Proceeding File No. 3-18930 (13 Dec. 2018), Paragraph 37, items (1)–(5).
14 US DOJ, Fraud Section, ‘The Fraud Section’s Foreign Corrupt Practices Act Enforcement Plan and Guidance’, at 8 (5 Apr. 2016). The converse is also true: a company may agree to a monitorship if its previously undertaken remedial measures were incomplete. Sociedad Química y Minera de Chile, SA, Deferred Prosecution Agreement, Paragraph 4(d) (‘Although the Company has taken a number of remedial measures, the Company is still in the process of implementing its enhanced compliance program, which has not had an opportunity to be tested, and thus the Company has agreed to the imposition of an independent compliance monitor for a term of two years to diminish the risk of reoccurrence [sic] of the misconduct’).
15 In the Matter of Barclays Capital Inc, Order Instituting Administrative and Cease-and-Desist Proceedings, Paragraphs 62, 65, Admin. Proceeding File No 3-17077 (31 Jan. 2016).
16 In the Matter of Mashreqbank, PSC, New York State Department of Financial Services, Consent Order (10 Oct. 2018) (‘Transaction monitoring remained a significant challenge for the Branch. The New York Branch’s system at that time was generating nearly 2,000 transaction monitoring alerts monthly. Although the Bank had engaged third-party consultants to help implement a more effective transaction monitoring system, substantial deficiencies persisted.’).
17 United States v. SBM Offshore N.V., Case No. 17 Cr. 686, Deferred Prosecution Agreement, Attach. C, D (S.D. Tex. 29 Nov. 2017) (requiring defendant to engage in ongoing monitoring and reporting on implementation of agreed-upon procedures).
18 United States v. Odebrecht SA, Case No. 16-643, Plea Agreement, Attach. D, Paragraph 23 (E.D.N.Y. 21 Dec. 2016).
19 United States v. Société Générale SA, Case No. 18-cv-10783, Deferred Prosecution Agreement, Paragraphs 21 to 22 (S.D.N.Y. 18 Nov. 2018) (filed in connection with civil forfeiture complaint).
20 United States v. Bleznak, 153 F. 3d 16 (2d Cir. 1998). The Second Circuit endorsed the view of the district court that, without the consent decree, ‘there would be no tapes to discover or use as evidence’. ibid., at 19.
22 McCoo v. Denny’s Inc, 192 F.R.D. 675 (D. Kan. 2000). The provision stated that information that was ‘generated, maintained, produced or preserved’ pursuant to the agreement would be kept confidential, and would not be disclosed to anyone not a party to the agreement, including any person seeking the information in other litigation.
23 Pursuant to the consent decree, Denny’s obtained the monitor’s permission to conduct an internal investigation of a discrimination complaint, and subsequently wrote to the Kansas Human Rights Commission with the results of that investigation. The court ordered Denny’s to produce the letters. ibid., at 682.
24 United States v. Hinds County, No. 3:16-CV-489-CWR-RHWR, 2022 U.S. Dist. LEXIS 22759 at *8 (S.D. Miss. 8 Feb. 2022).
25 ABA Standards, at 38.
26 See https://www.justice.gov/atr/case-document/second-report-extenal-compliance-monitor-non-confidential and https://www.justice.gov/crt/consent-decree-monitor-reports (web pages last accessed 10 Mar. 2022).
27 See Lana N Pettus, ‘Court-Appointed Corporate Monitors in Environmental Crimes Cases’, Department of Justice Journal of Federal Law and Practice, Volume 69 (Dec. 2021), 101, 117–33.
28 See https://www.justice.gov/criminal-fraud/monitorships (last accessed 10 Mar. 2022).
29 See the chapter titled ‘Judicial Scrutiny of DPAs, NPAs and Monitorships’ in this guide for more information.
30 Parties can also seek clarification from the court where agreements are silent on the issue of disclosure. See SEC v. Am. Int’l Group, 712 F. 3d 1 (D.C. Cir. 2013) (parties filed joint motion to clarify that the independent consultant’s reports were intended to be confidential); see also United States v. Philip Morris USA, Inc, 793 F. Supp. 2d 164 (D.D.C. 2011) (collecting cases where parties sought clarification of consent orders from the court).
31 See United States v. Computer Associates International, Inc, Case No. 04 Cr. 837, Pitofsky Letter (19 Apr. 2005).
33 The court entered a jointly filed Stipulated and Agreed Protective Order providing that all information obtained by the independent examiner, as well as the independent examiner’s ‘files, notes and mental processes’, were protected from disclosure to third parties, and the independent examiner and his ‘agents, counsel, accountants and other experts shall not be required to answer any subpoena seeking materials referenced in paragraphs one and two of this Order and shall not be subject to any depositions or other discovery requests’. See United States v. Computer Associates International, Inc, Case No. 04 Cr. 837, Stipulated and Agreed Protective Order (19 Apr. 2005).
34 See Federal Rules of Evidence, Rule 502, Paragraphs (d) and (e).
35 The ABA Standards note that ‘there are . . . compelling reasons for keeping Monitor reports confidential’, including the release of proprietary, confidential or competitive business information that may harm the corporation; the monitor’s inability to promise confidentiality may inhibit the free flow of information; individuals named or easily identifiable in the report may not be able to challenge what they perceive as unfair denigration; other entities may be deterred from cooperating; and disclosure of the report may dissuade other entities from agreeing to the engagement of a monitor. ABA Standards, at 40. Even disclosure of the monitor’s fees might be seen by an entity as concerning, for fear that high monitor costs will be seen by others as evidence that the entity engaged in serious misconduct. ibid., at 33.
36 See Osterneck v. E.T. Barwick Industries, Inc, 82 F.R.D. 81 (N.D. Ga. 1979) (special counsel retained to assist in investigation and preparation of committee report to board of directors pursuant to consent agreement with SEC was not retained to give legal advice and work was neither privileged nor done in anticipation of litigation; court ordered special counsel to appear for depositions and produce documents concerning its work); see also Litton Indus., Inc v. Lehman Bros. Kuhn Loeb, Inc, 125 F.R.D. 51 (SDNY 1989) (receiver was an agent of the court and not the government and not entitled to common law deliberative process or law enforcement investigative privilege, nor work-product protection because interviews were not in anticipation of litigation and ‘work product immunity requires a more immediate showing than the remote possibility of litigation’).
37 In re LTV Securities Litigation, 89 F.R.D. 595 (N.D. Tex. 1981) (LTV).
38 In Hofmann v. Schiavone Contr. Corp, 630 Fed. Appx. 36 (2d Cir. 2015), the Second Circuit cited LTV in considering, but ultimately sidestepping, the concept of the ‘special officer privilege’. In affirming the district court’s grant of a motion to quash an application seeking materials from an ethical practice attorney, the Second Circuit noted that ‘[i]n our Circuit, we have not adopted a blanket “investigatory” or “special officer” privilege for consent decree monitors’, but that under the facts of the case there was no need because ‘[t]he [Ethical Practices Attorney] (EPA) was operating under continuous anticipation of litigation given his role under the consent decree’. Examination of the consent decree shows that the EPA had a mandate to investigate and eliminate corruption, with broad powers to interview union members, oversee and monitor the elections, issue subpoenas, take sworn testimony, commence disciplinary proceedings and recover assets that were dissipated or otherwise misappropriated. See Hofmann v. Schiavone, Case No. 11 Civ. 2346 (2d Cir.), Letter Motion, Ex. B (Consent Decree) (17 Oct. 2012). Absent these broad powers, it is unclear whether the court would have strained to find any privilege protection for the ethical practice attorney’s work.
39 United States v. HSBC Bank USA, NA, Case No. 12 Cr. 763, 2013 U.S. Dist. LEXIS 92438 (E.D.N.Y. 1 Jul. 2013).
40 See United States v. HSBC Bank USA, NA, Case No. 12 Cr. 763, Moore Letter (5 Nov. 2015).
41 United States v. HSBC Bank USA, NA, Case No. 12 Cr. 763 2016 US Dist. LEXIS 11137 (E.D.N.Y. 2016).
42 See United States v. HSBC Bank USA, NA, Case No. 12 Cr. 763, Motion for Leave to File Monitor’s Report Under Seal by USA (1 Jun. 2015) (HSBC 1 Jun. 2015).
43 See United States v. HSBC Bank USA, NA, Case No. 12 Cr. 763, Letter in Support of the Motion for Leave to File Monitor’s Report Under Seal by USA (1 Jun. 2015) .
44 See HSBC 1 Jun 2015 (op. cit. note 44, above), Exhibit 35-2 (letter stating that publication of the report would reduce the monitor’s effectiveness because HSBC personnel would be less forthcoming, which could affect Federal Reserve examiners similarly, and because foreign regulators would be reluctant or unwilling to authorise the monitor to obtain information in their jurisdictions).
45 See HSBC 1 Jun 2015 (op. cit. note 44, above), Exhibit 35-3 (letter stating that it had a shared interest in regulating HSBC, the monitor was bound by confidentiality restrictions that applied to the FCA, publication of the monitor’s report would risk foreign jurisdictions’ refusal to allow the monitor to assess HSBC’s operations throughout the remaining term of the DPA, and would enable money launderers to evade sanctions).
46 See HSBC 1 Jun 2015 (op. cit. note 44, above), Exhibit 35-4 (letter stating that it viewed the monitor’s work as strong support for its own supervision of HSBC and the publication of the report may limit the extent to which whistleblowers and staff would come forward and candidly communicate with the monitor).
47 See HSBC 1 Jun 2015 (op. cit. note 44, above), Exhibit 35-5 (letter stating that it had previously granted approval for the monitor to access confidential information from HSBC Malaysia and its customers based on the assurance that the information would be kept confidential to evaluate internal controls).
48 United States v. HSBC Bank USA, NA, 863 F. 3d 125 (2d Cir. 2017).
49 In a strongly worded concurrence, Judge Pooler urged Congress to consider legal reforms addressing more oversight over DPAs, writing: ‘As the law governing [deferred prosecution agreements] stands now . . . the prosecution exercises the core judicial functions of adjudicating guilt and imposing sentence with no meaningful oversight from the courts.’ In United States v. Toyota Motor Corp., 278 F. Supp. 3d 811 (S.D.N.Y. 2017), the court granted the government’s motion to dismiss its prosecution on the basis that the defendant had complied with a deferred prosecution agreement, but endorsed Judge Pooler’s views, noting that DPAs ‘introduce opaqueness to criminal proceedings and have created a cottage industry of monitorships doled out by the Department of Justice’ and urging Congress to ‘step in to clarify the contours of a court’s authority in connection with corporate prosecutions’.
50 5 U.S.C. § 552, et seq.
51 United States v. HSBC Bank USA, N.A. 863 F.3d at 142 n.7 (internal quotation marks and citation omitted).
52 Leopold v. United States DOJ, No. 19-3192 (RC), 2021 U.S. Dist. LEXIS 6236 (D.D.C. 13 Jan. 2021).
54 See Leopold and Buzzfeed, Inc. v. U.S. Department of Justice, Case No. 1:19-cv-03192-RC, Complaint (24 Oct. 2019).
55 Leopold v. United States DOJ, 2021 U.S. Dist. LEXIS 6236 at *32.
56 See Leopold and Buzzfeed, Inc. v. U.S. Department of Justice, Case No. 1:19-cv-03192-RC, Reply to Opposition to Cross-Motion for Summary Judgment (2 Feb. 2022).
57 New York Times Co. v. United States DOJ, No. 10 Civ. 1424 (KPF), 2021 U.S. Dist. LEXIS 20776 (S.D.N.Y. 3 Feb. 2021).
58 See generally 12 C.F.R. Section 4.36 (Office of the Comptroller of the Currency); 12 C.F.R. Section 261.20 (Federal Reserve Board); 12 C.F.R. Section 309.6 (Federal Deposit Insurance Corporation); 12 C.F.R. Section 1070.41 (Consumer Financial Protection Bureau).
59 Wultz v. Bank of China Ltd, 61 F. Supp. 3d 272, 281 (S.D.N.Y. 2013).
60 Schreiber v. Society for Sav. Bancorp, Inc, 11 F.3d 217, 220 (D.C. Cir. 1993).
61 See United States v. HSBC Bank USA, NA, Case No. 12 Cr. 763, Letter from Jack Jennings, Senior Associate Director, Division of Banking Supervision and Regulation 2-4 (29 May 2015) (Docket Entry 35-2).
62 For a discussion of the laws of other states, which are similar, but by no means uniform, see, generally, Eric B Epstein, ‘Why the Bank Examination Privilege Doesn’t Work As Intended’, 35 Yale J. on Reg. Bull. 17 (2017).
63 New York State Department of Financial Services, Excerpts From Superintendent Benjamin M Lawsky’s Remarks on Consulting Reform at American Bar Association Financial Services Regulatory Forum (24 Jun. 2013), available at https://www.dfs.ny.gov/reports_and_publications/press_releases/pr1306242; see also In the Matter of Promontory Fin. Grp, LLC, Agreement (18 Aug. 2015), available at https://www.dfs.ny.gov/docs/about/ea/ea150818.pdf (web pages last accessed 15 Mar. 2022).
64 Federal Rules of Evidence, Rule 408 precludes the use at trial of evidence of settlement communications, but only in certain circumstances and not for all purposes. However, Rule 408 does not control the discoverability of settlement-related communications. See Fed. R. Evid. 408 advisory committee’s 1993 and 2006 notes.
65 ibid., Rule 501 requires a district court, in the absence of a constitutional right, specific federal statutes, or federal rules, to apply the common law ‘as interpreted by United States courts in the light of reason and experience’ to questions of privilege. If state law provides the rule of decision for a claim or defence, state law governs.
66 United States ex rel. Fisher v. Ocwen Loan Servicing LLC, Case No. 12 Civ. 543, 2015 WL 3942900 (E.D. Tex. 26 Jun. 2015); see also Rouson ex rel. Estate of Rouson v. Eicoff, Case No. 04 Civ. 2734, 2006 WL 2927161 (E.D.N.Y. 11 Oct. 2006).
67 Odebrecht SA, Plea Agreement, Attach. D, Paragraph 20, items (a)–(c).
68 United States v. Toyota Motor Corp, Case No. 14 Cr. 186, Deferred Prosecution Agreement at 9 (S.D.N.Y. 19 Mar. 2014) (emphasis added).
69 For a general discussion of deconfliction, see Lanny A Breuer and Mark T Finucane, US DOJ ‘“Deconfliction” Requests: Considerations and Concerns’, Law360 (1 Mar. 2017).
70 Sociedad Química y Minera de Chile, SA, Deferred Prosecution Agreement, Attach. D, Paragraph 2 (emphasis added).
71 See In the Matter of Commerzbank AG, New York State Department of Financial Service, Consent Order, Paragraph 49(a) (12 March 2015) (emphasis added).
72 Bart M Schwartz, Guidepost Solutions LLC, ‘Clarifying the Role of a Monitor’ (24 Feb. 2014).
73 Odebrecht SA, Plea Agreement, Attach. D, Paragraph 5; see also Toyota Motor Corp., Deferred Prosecution Agreement, at 7 (‘To the extent that the Monitor seeks access to information contained within privileged documents or materials, [the entity] shall use its best efforts to provide the monitor with the information without compromising the asserted privilege.’)
74 Odebrecht SA, Plea Agreement, Attach. D, Paragraph 6.