United States

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

Google has been the subject of antitrust investigations regarding its alleged dominance of the advertising technology market and internet search market. Those investigations resulted most recently in the filing of an antitrust lawsuit by the US Department of Justice (DOJ) and 11 US states on 20 October 2020. Among other things, the complaint alleges that Google is a monopoly gatekeeper for the internet and controls internet search access through exclusionary agreements that prevent the development of competing search applications. The magnitude of the case against Google has been compared to the Microsoft antitrust lawsuit filed in the 1990s. Congress has also been investigating the company and other large technology companies.

2 Outline the legal framework for corporate liability in your country.

Under the doctrine of respondeat superior, a corporation may be held criminally liable for the illegal acts of its directors, officers, employees and agents. The government must establish that the corporate agent’s actions were (1) within the scope of his or her duties and (2) intended, at least in part, to benefit the corporation. The corporation need not have profited from the agent’s actions for the corporation to be held liable. Prosecutors in the United States are given broad discretion to determine whether to prosecute for violations of federal criminal law.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Corporations are subject to regulation and oversight by federal, state and local authorities depending on their businesses and industry. It is not uncommon for multiple government authorities to conduct investigations at the same time regarding the same set of facts, and agencies do not typically refrain from pursuing cases because other agencies are also involved. The DOJ has policies and protocols relating to corporate prosecutions, as well as a policy to work with other agencies investigating the same conduct to avoid ‘piling on’ penalties.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

There is no threshold of suspicion that must be met before law enforcement may initiate an investigation. Investigations may even be initiated and conducted to satisfy law enforcement that no misconduct occurred.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Civil subpoenas issued by government agencies can be challenged in court with respect to the lawfulness or scope of a subpoena. However, typically, the relevant government agency has broad authority to obtain information that is relevant to a legitimate subject of investigation.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Both individuals and corporations can benefit from co-operating with law enforcement during an investigation. Individuals may enter into agreements with the government by which they will be granted immunity or be permitted to plead guilty to a lesser charge in exchange for agreeing to provide information or testimony about other defendants. Corporations may receive non-prosecution agreements (NPAs) or deferred prosecution agreements (DPAs) in exchange for co-operating in an investigation.

7 What are the top priorities for your country’s law enforcement authorities?

Some top law enforcement priorities affecting corporations include enforcement of the False Claims Act (prohibiting overcharging and related false claims for payment by the government); securities laws regulating publicly traded companies and the stock market; anti-bribery and anti-corruption laws; cybersecurity; and laws governing consumer online privacy.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

Law enforcement authorities place significant emphasis on whether a compliance programme is adequately resourced and empowered to function effectively, the evolution of a compliance programme over time, based on a corporation’s risk profile, and the value of data for ensuring the effectiveness of a compliance programme. On 1 June 2020, the Criminal Division of the DOJ updated written guidance for prosecutors to refer to when evaluating corporate compliance programmes, building on a previous version issued in April 2019. The June 2020 revisions focus on the three general areas noted above.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

The United States does not have an overarching federal cybersecurity law; rather, each state, certain government agencies and banking regulators have created cybersecurity regulations for the corporations under their control.

For example, issuers of US securities are required to comply with the Securities and Exchange Commission’s (SEC) regulations, including: (1) Regulation S-P (17 CFR Section 248.30), which requires firms to adopt written policies and procedures to protect customer information against cyberattacks and other forms of unauthorised access; (2) Regulation S-ID (17 CFR Sections 248.201 and 248.202), which outlines a firm’s duties regarding the detection, prevention and mitigation of identity theft; and (3) the Securities Exchange Act of 1934 (17 CFR Section 240.17a-4(f)), which requires firms to preserve electronically stored records in a non-rewritable, non-erasable format. Since 2015, the SEC has brought a handful of enforcement actions against public companies for violations of these Regulations.

All 50 US states have state-specific cybersecurity laws, and a few states have laws restricting the use of biometric data such as facial recognition. All states require companies to inform consumers if their personal information has been, or may have been, compromised. In cases of significant breaches, state Attorneys General work together to bring coordinated, multi-state data breach actions. Consumers damaged by data breaches are also permitted to bring private lawsuits and class actions under state law.

State banking regulators also have cybersecurity requirements and often coordinate enforcement efforts. The New York Department of Financial Services brought its first enforcement action in 2019 against the second largest real-estate title insurer in the United States, alleging that the company exposed hundreds of millions of documents containing sensitive information such as Social Security numbers and bank account information over the course of several years.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Most cybercrime is prosecuted under the US Computer Fraud and Abuse Act, which criminalises the unauthorised access of a protected computer without proper authorisation. It covers hacking, phishing, infection of IT systems with malware, electronic theft and identity theft or fraud. Additional US statutes that cover cybercrime are 18 USC Section 1028, which criminalises identity theft; 18 USC Section 1029, which criminalises the use of unauthorised access devices to commit fraud; and the Stored Communication Act (18 USC Section 2701), which criminalises electronic theft of stored communications. The DOJ has a Computer Crime and Intellectual Property Section that investigates and prosecutes computer crimes.

The US and 60 other jurisdictions have signed the Budapest Convention on Cybercrime, which is a binding international treaty that provides a framework for international co-operation on cybercrime and electronic evidence.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

In RJR Nabisco, Inc. v. European Community (2016), the US Supreme Court set up a two-step framework for addressing the extraterritorial application of federal statutes. First, a court must determine whether the presumption against extraterritoriality has been rebutted through a clear, affirmative indication that the statute applies extraterritorially. If not, the court must determine whether the case involves a domestic application of the statute. If the relevant conduct occurred within the United States, even if some conduct occurred abroad, the case is deemed an acceptable domestic application of the statute. However, if the conduct that is the statute’s focus occurred abroad, extraterritorial application is not permitted.

The Foreign Corrupt Practices Act is an example of a statute that indicates that it can be applied against foreign companies or persons who carry out bribery schemes while acting in the United States. Since 2010, the US courts have narrowly construed the extraterritorial reach of a number of other statutes, including the Alien Tort Statute, the Torture Victim Protection Act and the Securities and Exchange Act of 1934.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

The combination of data protection regimes, blocking statutes, bank secrecy laws and employment laws outside the United States make cross-border investigations challenging. The DOJ has broad discretion to provide co-operation credit and leniency to corporations that turn over relevant facts in a timely manner. Corporations that have relevant documents outside the United States must weigh the risk of violating foreign laws against the risk that the US government will bring criminal charges against them.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

Double jeopardy does not prevent the US government from charging a corporation with a crime even if the corporation has already resolved similar charges with a foreign government. According to the dual-sovereignty doctrine, a crime under the laws of one sovereign is not ‘the same offence’ for double jeopardy purposes as a crime under the laws of another sovereign.

In May 2018, the DOJ adopted a non-binding policy into the Justice Manual that promotes coordination between US and foreign law enforcement in an effort to limit duplicative penalties on corporate entities for the same conduct. The policy instructs prosecutors that in resolving a case with a company that is being investigated by multiple authorities, the DOJ and others should coordinate with one another to avoid the unnecessary imposition of duplicative penalties against the company.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Global resolutions are becoming more common as US law enforcement increases its co-operation with law enforcement in other countries. Global settlements can benefit a corporation by presenting an efficient way to resolve issues with multiple countries at once. However, global settlements do not always result in overall reduced penalties and fines, as combined law enforcement authorities may make higher settlement demands than they would have made individually. Corporations should proceed cautiously when negotiating global settlements and be sure to invoke any applicable policies against ‘piling on’.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

A criminal decision against a corporation in another jurisdiction will not end an ongoing investigation in the United States. US law enforcement may attempt to co-operate with foreign authorities to gain additional facts about the corporation that it has been unable to obtain directly. US law enforcement may also consider the penalties and fines imposed by the foreign authority when deciding an appropriate penalty in the United States.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

The Office of Foreign Assets Control (OFAC) of the US Department of the Treasury enforces economic and trade sanctions against targeted foreign countries and individuals, and takes action against those who do business with them. Primary sanctions, which prohibit trans­actions with sanctioned countries or persons, apply to US persons, US corporations and all persons physically located in the United States, regardless of nationality. Non-US entities can also be liable for primary sanctions for taking actions within the United States, conspiring with US persons to violate sanctions, or using the US financial system. Secondary sanctions may be imposed on non-US persons or entities who engage in transactions deemed to be contrary to US national security and foreign policy interests. Although penalties cannot be imposed for secondary sanctions, they can result in access to the US financial system or markets being restricted. OFAC has brought several high-profile cases against non-US financial institutions in recent years.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

OFAC enforcement actions have increased significantly since 2018. In 2019, OFAC assessed nearly US$1.3 billion in monetary penalties across 30 public enforcement actions. This represents a significant increase compared to 2018, when US$71 million in penalties were levied across seven public enforcement actions. In 2019, OFAC announced a change in policy that may increase a corporation’s overall penalty in cases involving multiple US agencies. OFAC stated that the only penalties charged by another agency that it would deem to satisfy its own penalties would be those that fit the same pattern of conduct during the same period that gave rise to the OFAC penalty.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

The US Treasury Department and OFAC co-operate with their counterparts in countries that are allies of the United States.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

The United States has not enacted blocking legislation.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Common ways in which misconduct comes to light include regular audit and compliance activities, whistleblower complaints, government subpoenas, media reports, and business people encountering irregularities in the ordinary course of their jobs.

Under federal securities laws, when auditors become aware that an illegal act may have occurred at a public company, certain affirmative investigation and reporting obligations are triggered. The auditor is obliged to determine whether an illegal act has occurred, report it to management and assure itself that the issuer’s audit committee or board of directors has also been informed. Additional reporting obligations are imposed on the auditor if the issue is not remedied, which culminate with auditor withdrawal and affirmative reporting of the issue to the SEC.

Information gathering

22 Does your country have a data protection regime?

The United States does not have a data protection regime.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

Not applicable.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

Not applicable.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

There is no general restriction on interception of employee communications in the United States so long as employees are using company systems.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Ordinarily, US law enforcement uses subpoenas for information to obtain materials from companies. It is unusual for law enforcement to conduct a dawn raid or execute a search warrant at a company. The use of these tools generally indicates a concern that the company may either conceal or destroy relevant evidence if it was requested by a subpoena.

A search warrant allows law enforcement to search for materials specifically delineated in the warrant. While a search warrant requires a company to provide access to these materials, it does not require employees of the company to submit to interviews or to answer questions posed by law enforcement. If law enforcement exceeds the limits of a search warrant or conducts improper interviews, the company’s primary recourse would be to move to suppress the information in any subsequent legal proceeding.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Law enforcement agencies bear the responsibility for segregating privileged materials or using a special ‘taint team’ of attorneys unrelated to the investigation to review seized documents for privilege. Ordinarily, companies will not be permitted to withhold privileged documents without the consent of law enforcement. Companies can assist in the privilege review process by identifying in-house and external attorneys to the investigative agents. Companies can also be careful to segregate these materials to protect against inadvertent disclosure.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Under the Fifth Amendment to the US Constitution, an individual cannot be compelled to provide incriminating testimony against himself or herself. Any testimony improperly compelled cannot be used in a legal proceeding against the individual. Companies, however, are not protected by this privilege and cannot withhold testimony that might be incriminating. Generally, there is no right against self-incrimination for producing documents, unless the act of producing the documents would be incriminating.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

The United States does not have a comprehensive framework for protecting all whistleblowers in all situations. Instead, many different federal and state laws have been enacted to incentivise whistleblowers and protect them from retaliation. For example, the False Claims Act allows persons and entities with evidence of fraud against federal programmes or contracts to sue the wrongdoer on behalf of the government. A qui tam plaintiff can receive between 15 and 30 per cent of the total recovery from the defendant.

Additionally, the whistleblower programme under the Dodd-Frank Act provides monetary incentives for individuals to report possible violations of the federal securities laws to the SEC. Under the programme, eligible whistleblowers are entitled to an award of between 10 and 30 per cent of the monetary sanctions collected. The whistleblower programme also prohibits retaliation by employers against employees who provide the SEC with information.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Aside from any applicable whistleblower protections, employees generally do not have rights under federal or state employment laws during an investigation. This is true whether the employee is an officer, director or rank-and-file employee.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

Unless whistleblower protections apply, a company may take any number of disciplinary actions against an employee who has engaged in misconduct, including suspension or termination of contract. Public companies have a duty to their shareholders to take action and not turn a blind eye to misconduct.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

Most employees in the United States are subject to at-will employment, meaning that, unless other protections apply, their contracts may be terminated at any time. Employees whose conduct is within the scope of an investigation are expected to participate in investigations, and may be dismissed if they refuse to co-operate.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It is common to have a working investigative plan to manage investigative activities. Such a document may address:

• document preservation and gathering;
• witnesses;
• legal issues and analysis;
• factual analysis;
• key questions to be answered; and
• reporting obligations.

However, because investigations are often fluid, the expectation is that the document will be updated and revised frequently, to account for new or different tasks based on information learned in the course of the investigation.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

A company should conduct an internal investigation and remediate the issue. Most government agencies give corporations credit for investigating and self-reporting issues. The decision to self-report is fact dependent and involves weighing many factors.

Under the SEC’s regulations, an in-house lawyer at a public company is required to report ‘evidence of a material violation’ to the issuer’s chief legal officer and chief executive officer, and in some cases to the appropriate committee of the issuer’s board of directors consisting solely of independent directors, or to the whole board of directors. In the context of an investigation initiated by a public company’s external auditors, the company may have an obligation to report to the SEC if the auditors conclude that the company has not properly remediated certain illegal activities.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

The company should prepare a legal hold notice and distribute it to relevant individuals and the company’s IT department. Affirmative steps should be taken to prevent destruction of responsive materials – including discontinuing any automatic deletion of such data pursuant to data retention policies.

If the company is being investigated for potential wrongdoing, it is important that external counsel or individuals with indicia of independence and trustworthiness are responsible for preserving and collecting documents. If there is any uncertainty regarding what search terms should be used to identify responsive documents, attorneys for the corporation typically discuss search terms with the government.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

As a general matter, there is no requirement to disclose the existence of an internal investigation or the fact that the company has been contacted by law enforcement. Public companies are forbidden from making affirmative statements that are false or misleading. Thus, companies should be careful not to make statements that are untrue or misleading because of undisclosed facts about an internal investigation or law enforcement contact. There is a duty to disclose to the extent that disclosure is necessary to ensure affirmative statements are not misleading.

37 How are internal investigations viewed by local enforcement bodies in your country?

Government authorities place value on independent and thorough internal investigations. For example, the DOJ in its Justice Manual has stated that to ‘earn maximum co-operation credit, a corporation must do a timely self-analysis and be proactive in voluntarily disclosing wrongdoing and identifying all individuals substantially involved [ ] or responsible’ (Section 4-3.100(3)). The SEC describes self-reporting as one of the key factors for evaluating a company’s co-operation ‘including conducting a thorough review of the nature, extent, origins and consequences of the misconduct, and promptly, completely and effectively disclosing the misconduct to the public, to regulatory agencies, and to self-regulatory organizations’ (SEC Enforcement Manual, Framework for Evaluating Co-operation by Companies, 6.1.2). Neither agency sets forth exacting requirements for the conduct or format of the internal investigations; what is appropriate is fact-dependent.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Generally, the attorney–client privilege and the attorney work-product doctrine may be claimed over most aspects of an internal investigation so long as the fact-finding and analysis is being done by or at the direction of attorneys for the purpose of providing legal advice to the client. This privilege would cover attorney notes, interview memoranda, legal analysis and recommendations provided by counsel to the client. Companies should ensure that privileged materials are not shared with third parties and are clearly labelled as being ‘attorney–client privileged’.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Communications by corporate employees made for the purpose of assisting counsel in providing legal advice to the corporation are generally covered by attorney–client privilege. The corporation holds the privilege and it may only be waived by the corporate entity or an authorised executive (for example, the general counsel).

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

The attorney–client privilege applies equally to in-house and external counsel so long as both are providing legal advice. In certain instances, in-house counsel will be called on to provide ‘business’ advice, which is not protected even if it is provided by an attorney.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

The attorney–client privilege applies equally to US and foreign lawyers.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

While the waiver of the attorney–client privilege is regarded as a co-operative step by US law enforcement, DOJ policy prohibits law enforcement from requesting or requiring privilege waivers to receive credit for co-operation. Other federal agencies may request but do not typically require privilege waivers to obtain co-operation credit.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

Most courts will not enforce ‘selective waivers’ to government entities. Companies sometimes provide factual information to the government (rather than any legal analysis or memos) to avoid an argument by a third party that privilege has been waived.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

If the disclosure of attorney–client information was compelled in a foreign country (or the privilege was not recognised), this would generally not result in a waiver of the attorney–client privilege in the United States. However, any voluntary disclosure will usually result in a waiver.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privilege does exist in the United States. It is an extension of the attorney–client privilege to communications between two or more parties that have a common legal interest. The party asserting the privilege must demonstrate that (1) the communications were made in furtherance of a joint defence effort, (2) the statements were designed to further that effort and (3) the privilege was not waived.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

So long as a third party is working for a client at the direction of an attorney, and for the purpose of assisting the lawyer to provide legal advice to the client, this assistance will remain privileged.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes, witness interviews are a critical part of internal investigations in the United States.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Yes, companies regularly assert privilege over witness interviews and reports in the United States, provided that the interviews and reports were generated to provide legal advice.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Upjohn warnings are required when conducting witness interviews of employees and are typically provided to both current and former employees.

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Witness interviews are typically conducted by external counsel, sometimes in the presence of in-house counsel or subject-matter experts assisting counsel (or both). Documents are usually shown to the witness during interviews. Witnesses can retain their own legal representation if they so choose, but there is no requirement to do so.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

There is no overarching duty or legal obligation to self-report corporate misconduct, but there are certain specific situations in which it is mandatory, including highly regulated industries such as insurance, banking and healthcare.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

The DOJ and several other federal agencies have issued policies providing for leniency and reduced penalties for companies that self-report. It is generally understood that co-operating with a government investigation will not result in as favourable an outcome for a corporation as the combination of self-reporting and co-operating. In some cases, self-reporting corporate misconduct and co-operating with an investigation can lead to a decision not to prosecute.

Despite the strong incentive to self-report, it is not always the best course of action. Several factors must be considered, such as the severity and pervasiveness of the misconduct; whether corporate officers or board members were involved; whether the misconduct continued for a long period; and whether the investing public or consumers were harmed by the misconduct.

53 What are the practical steps you need to take to self-report to law enforcement in your country?

There is no formal process for self-reporting. Typically, external counsel will contact prosecutors or regulators and seek a meeting to explain how the misconduct was discovered, how the misconduct occurred, and what the corporation is doing to investigate and make sure the misconduct is not repeated. One of the factors the government considers is whether the company reported within a reasonable time after learning of the misconduct. Accordingly, a complete internal investigation is not required prior to self-reporting, although the company will want to understand enough facts to determine whether self-reporting is advisable.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

The first step following receipt of a subpoena would ordinarily be for external counsel to make a call to the government attorney. The purpose of the call would be to understand the nature and scope of the government’s investigation, as well as whether the company is a target of the investigation or simply a witness. Most law enforcement agencies will enter into a dialogue with a company’s external attorney prior to charges being brought. Most prosecutors’ offices will also allow companies’ attorneys to meet with senior supervisors in the relevant prosecutor’s office to present their position as to why charges should not be brought.

55 Are ongoing authority investigations subject to challenge before the courts?

Investigations are considered to be firmly within the discretion of the executive branch of government. Unless there is evidence that government prosecutors are abusing their investigative authority and violating legally protected rights, it is highly unusual for courts to interfere with an ongoing investigation.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

When a company receives multiple subpoenas regarding the same facts, the company should analyse whether this is part of a coordinated effort or whether these are entirely separate investigations. If they are coordinated investigations, it can be advantageous to ensure consistent disclosure between all jurisdictions. If they are separate investigations, it may not be advantageous to alert US authorities that foreign authorities are investigating the same issues.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

Prosecutors typically expect a company to search for and produce responsive documents in its possession, custody or control even if those documents are located outside the United States. Documents held by a company’s foreign affiliates are generally considered to be in the company’s control. If the subpoenaed documents implicate the laws of another jurisdiction, such as data privacy laws, the company should consider whether there is a way to comply with the law while also complying with the subpoena (such as by requesting the consent of employees whose data will be turned over). If responding to a subpoena would expose a company and its employees to criminal liability in another country, the company may decide to seek a protective order from a US court.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

It is common for US law enforcement to share investigative materials with authorities outside the United States, particularly when the information sharing is mutual. Sometimes co-operation occurs through formal mutual legal assistance treaties or memoranda of understanding.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Unless law enforcement agrees to be bound by a non-disclosure agreement, the government can share materials received during an investigation with other agencies or overseas investigators. The government does not typically share information with non-government third parties or allow the material to be subject to public disclosure during the course of an investigation. There are strict secrecy laws for information obtained in the United States via a grand jury subpoena. This information cannot be shared without a court order, or else under very narrow legal exceptions.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

A company should not voluntarily produce documents to US law enforcement if doing so would violate the laws of another country. If the company is compelled to produce documents by subpoena, the least risky solution is to obtain consent from the foreign country or ask law enforcement to obtain the documents through a mutual legal assistance treaty. If those options fail, the company could seek a protective order in court, seeking to be relieved of its obligation to produce such documents. If the court denies the company’s motion for a protective order, the company will have to decide whether it is more risky to continue to resist the subpoena or to comply and violate foreign law.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Not applicable.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

In some cases, there are no additional risks in producing documents voluntarily than there are pursuant to a subpoena. In other cases, however, such as when the government requests otherwise confidential information about customers or third parties, it is less risky to produce documents pursuant to a subpoena. Voluntary production may subject a company to potential liability from third parties for providing confidential information to law enforcement that was not compelled.

Documents produced to the government during the course of an investigation are exempt from public disclosure under the Freedom of Information Act during the pendency of the investigation. Information compelled by a grand jury subpoena is ordinarily protected by strict secrecy and would not be discoverable by third parties, whereas similar information that was voluntarily provided would be discoverable.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

If a company is convicted of a crime, it can be sentenced to fines, restitution, disgorgement, forfeiture of property derived from criminal activity, and suspension or debarment. Corporate monitors are also sometimes appointed to oversee a company’s ongoing activities. Individuals are subject to similar criminal penalties in addition to imprisonment.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

Depending on the context of an investigation, suspension or debarment is a significant risk in heavily regulated industries, such as healthcare and securities. When negotiating with regulators, counsel may be able to negotiate terms that would avoid or minimise the risk of these possibilities and the attendant impact on future business operations. Extraterritorial settlements are not typical because such arrangements tend not to resolve violations of US law.

65 What do the authorities in your country take into account when fixing penalties?

In the event of federal criminal conviction, sentencing courts consider factors set forth in the US Sentencing Guidelines as well as criminal statutes and policy guidelines. In general, the broad factors to be considered at sentencing are set forth at 18 USC Section 3553(a) and include:

• the nature and circumstances of the offence and the history and characteristics of the defendant;
• the need for the sentence imposed to reflect the seriousness of the offence, promote respect for the law and provide just punishment for the offence;
• to afford an adequate deterrent to criminal conduct;
• to protect the public from the defendant committing further crimes;
• to provide the defendant with the necessary educational or vocational training, medical care or other correctional treatment in the most effective manner;
• the kinds of sentences available;
• the kinds of sentence and the sentencing range established for the applicable category of offence committed by the applicable category of defendant as set forth in the US Sentencing Guidelines or applicable policies; and
• the need to provide restitution to any victims of an offence.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Both are available in the United States.

Under the terms of an NPA, the government agrees not to file a criminal charge for the specified acts under investigation. In exchange, the putative corporate or individual defendant enters into certain agreements with the government, which may include financial terms, imposition of a corporate monitor or other remedial actions. The advantage of such an agreement from the defendant’s perspective is that no criminal charge is filed and no conviction for any offence occurs (provided that the terms of the NPA are satisfied).

Under the terms of a DPA, the government agrees to hold in abeyance a criminal charge that has already been filed in exchange for the defendant’s agreement to undertake certain actions. This can include financial requirements, monitoring requirements or other conditions, depending upon the nature of the case. The advantage of a DPA is that, provided the terms of the agreement are satisfied for the designated period, the government agrees to dismiss the pending criminal case and no criminal conviction results.

The disadvantage of NPAs and DPAs is that the facts of the case are never tested by the adversarial system in court. Therefore, the government can make demands and allegations without ever having to prove, or even provide supporting evidence to establish, that a crime actually may have occurred.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

There is no restriction on reporting the existence or terms of a DPA or NPA.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Before entering into any settlement or plea bargain, companies must fully assess the risks and costs associated with trial, which involves a critical and detailed analysis of the underlying facts. If a settlement or plea bargain is the appropriate mechanism to resolve the case, companies must consider the effects on business operations and the possible ramifications for suspension, debarment, exclusion, negative publicity, effect on the company’s market valuation, or other collateral consequences that may result. Companies should be aware that a resolution with US law enforcement could prompt investigations in other jurisdictions as well as possible private civil litigation, whether in the United States or abroad.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Corporate compliance monitors are used regularly in the context of negotiated resolutions with the DOJ.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Private civil rights of action are sometimes allowed by statute. For example, securities fraud may give rise to private civil claims. Private litigants generally do not have access to the government’s files, particularly any materials in possession of the government that were obtained via grand jury subpoena, since such materials are protected by Rule 6(e) of the Federal Rules of Criminal Procedure.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

At the investigatory stage, all matters being investigated by a grand jury are protected from public disclosure. Although a company is free to disclose the existence of an investigation if it so chooses, this usually does not happen unless the company decides that the existence of an investigation should be made known to shareholders or other parties of interest.

Once a case is before a court, the court record and pleadings in the case are generally available to the public, unless the case is filed under seal. The general view is that court cases should be transparent unless there is a special reason for confidentiality being required.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

Public relations firms are commonly used to assist with corporate messaging strategy. However, careful coordination between public relations firms and counsel is of paramount importance. Although a statement may be good for the company from a public relations perspective, that same statement may be harmful to the company from a criminal law perspective, and such statements may be admissible in the event of a trial or other proceeding on the merits.

73 How is publicity managed when there are ongoing related proceedings?

All publicity should be managed through the company’s counsel. Counsel should coordinate and manage media issues in connection with public relations professionals.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Under securities laws governing US issuers, disclosure would be required if a corporation’s prior disclosures about a matter would be misleading without the updated information. Disclosure may also be required if the nature of a settlement triggers affirmative reporting obligations, for instance under SEC Regulation S-K.

Anticipated developments

75 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

A bill that is currently being considered in Congress, called the Insider Trading Prohibition Act, would shift the basis for insider trading liability from fraud to the wrongful use, gathering or communication of inside information. The bill would make it a violation to trade while in possession of material, non-public information ‘if such person knows, or recklessly disregards, that such information has been obtained wrongfully, or that such purchase or sale would constitute a wrongful use of such information’. The bill would also make it a violation for a person ‘wrongfully to communicate’ confidential information if it was ‘reasonably foreseeable’ that the recipient, known as a ‘tippee’, would trade on it. The Insider Trading Prohibition Act was passed by the US House of Representatives in December 2019, but it has not yet been passed by the US Senate.

This year is also likely to bring new cybersecurity laws and regulations. In 2020, at least 38 states, Washington DC and Puerto Rico introduced or considered more than 280 bills or resolutions that deal with cybersecurity. Most of the proposed legislation is intended to protect information held by government or businesses from unauthorised access and to defend against attacks to various networks, computers and data. Many of the proposed laws would also increase penalties for cyber-related misconduct such as computer crime and ransomware.

Footnotes