Russia

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

In 2021, some of the highest-profile corporate investigations being conducted by the Federal Antimonopoly Service (FAS) and the Russian data protection authority, Roskomnadzor, are against Western technology companies.

For example, in August 2021, FAS imposed a fine of 1.3 billion roubles on Booking.com (11.5 per cent of its annual turnover in Russia in 2020) for abusing its dominant market position. In April 2021, FAS opened an investigation against Google for abusing the dominant market position of YouTube. In October 2021, another investigation was opened against Apple for prohibiting Russian developers from informing buyers of applications in the App Store of alternative payment methods.

In March 2021, Roskomnadzor slowed down Twitter for not removing forbidden content. In August 2021, a Russian state court confirmed the fines imposed by Roskomnadzor on WhatsApp (4 million roubles), Facebook (15 million roubles) and Twitter (17 million roubles) for violating the Russian data localisation requirements. In August 2021, Roskomnadzor ordered Apple and Google to remove from their stores all applications used to further extremist activities.

2 Outline the legal framework for corporate liability in your country.

Corporations can be held liable only for violations of the Administrative Offences Code. Individuals can be held liable for violations of the Administrative Offences Code and the Criminal Code. Under Russian corporate law, each director of a company (supervisory board member, general director and member of the management board) can be held liable by the company’s shareholders for damage caused to the company as a result of culpable actions or omissions. In practice, directors are regularly held liable for damage caused to their companies by the payment of fines under the Administrative Offences Code.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Offences under the Administrative Offences Code (committed by corporations and individuals) are investigated by the Public Prosecutor’s Office or by other law enforcement authorities that perform supervisory functions in certain areas, such as the FAS and Roskomnadzor.

Offences under the Criminal Code (committed by individuals) are generally investigated by the Public Prosecutor’s Office. The relevant functions of the Public Prosecutor’s Office are distributed among (1) the General Prosecutor’s Office at the federal level, (2) the prosecutor’s offices in the 85 ‘subjects of the Russian Federation’ at the regional level, and (3) the prosecutor’s offices of the districts and cities at the municipal level.

In addition, the Investigative Committee of the Russian Federation – a federal authority previously part of the of the Public Prosecutor’s Office but now (since 2011) separate and subordinated directly to the President of the Russian Federation – performs pre-investigative reviews of notifications on offences and preliminary investigations against individuals for certain offences under the Criminal Code. The Investigative Committee performs its functions at the federal, regional and municipal levels, through (1) its central office at the federal level, (2) investigative departments in the subjects of the Russian Federation, and (3) investigative departments of the districts and cities.

In some cases, the prosecuting functions of several law enforcement authorities may overlap. For example, violations of antitrust requirements during public procurement processes – especially state tenders (which are investigated by the FAS) – are often accompanied by bribery and corruption offences. Following the completion by FAS of its own investigation and the imposition of administrative penalties for the violation of antitrust requirements, the matter may then be transferred to the Public Prosecutor’s Office for the opening of bribery investigations.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

An administrative case (against corporations and individuals) can be opened by the competent law enforcement authority based on (1) the direct discovery of facts that sufficiently indicate that an administrative offence has been committed, (2) materials received from other law enforcement authorities and non-government organisations, which contain facts indicating the commission of an administrative offence, and (3) reports from individuals and legal entities, or mass media information, that contain such facts. An administrative investigation is initiated with the opening of the case if time-consuming procedural actions must be taken to clarify all circumstances of the offence.

A criminal case (against individuals) can be opened based on (1) the reporting of a criminal offence by individuals or public officials, (2) voluntary self-reporting by the criminal offender and (3) information about a criminal offence received from other sources. In each case, facts are required that sufficiently indicate the existence of the elements of a criminal offence.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

As a general rule, a notice or subpoena from a law enforcement authority, which violate the rights or legal interests of the company and do not comply with Russian legislation, can be challenged in a Russian state court. The procedure for challenging a notice or subpoena depends on the legal basis of the relevant act.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

There is no option to enter into co-operative agreements for suspects in administrative proceedings (corporations and individuals) under the Administrative Offences Code.

Since 2009, the Criminal Procedural Code allows ‘pretrial co-operation agreements’ with suspects in criminal investigations (but individuals only), including for bribery and corruption offences. They are particularly relevant for individuals who have committed offences about which they cannot self-report to be excluded from liability, as defined in Article 290 of the Criminal Code (bribe-taking by a public official). Under a pretrial co-operation agreement, the defendant undertakes to assist in the investigation of other individuals who participated in the relevant offence. If all statutory requirements are met, the defendant’s sentence will be reduced to not more than half the maximum punishment for the relevant offence under the Criminal Code.

7 What are the top priorities for your country’s law enforcement authorities?

According to statistics published by the Russian Ministry of the Interior for 2020, Russian enforcement actions against white-collar crime focused on cybercrime (roughly 25 per cent of all registered criminal offences), fraud (16 per cent), economic crime (5 per cent) and bribery and corruption (1.5 per cent).

Anti-bribery and corruption enforcement actions against corporations focus on bribery of domestic public officials. According to statistics published by the Russian Supreme Court for 2020, a total of 322 corporations were convicted of all types of bribery (as defined in Article 19.28 of the Administrative Offences Code, i.e., unlawful remuneration on behalf of a legal entity). As in the past, most corporations were fined for bribing domestic public officials, a category that also includes employees of the many state-owned companies that are characteristic of the Russian economy.

Bribing public officials also involves the greatest liability risks for individuals. In 2020, there were 4,446 convictions for bribery of public officials (giving or taking a bribe as defined in Articles 290, 291 and 291.2 of the Criminal Code) compared with only 201 convictions for commercial bribery (as defined in Article 204 of the Criminal Code).

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

Under the Administrative Offences Code, a corporation will be guilty of an administrative offence if it can be established that it did not take all necessary measures to ensure compliance with the violated regulations and this violation constitutes the relevant administrative offence. That means that a corporation accused of an administrative offence, as defined in Article 19.28 of the Administrative Offences Code (unlawful remuneration on behalf of a legal entity), may claim that it has taken all measures necessary to prevent bribery by its employees or agents.

In particular, the legal entity may arguably claim that it fully complied with its obligations under Article 13.3 of the Anti-Corruption Law to take anti-corruption measures to be exempt from administrative liability. These measures include those that must be taken by Russian organisations according to Article 13.3 of the Anti-Corruption Law (appointment of a compliance officer, adoption of a compliance code, prevention of conflicts of interest, co-operation with law enforcement authorities, etc.). The Russian Labour Ministry has issued detailed recommendations for their implementation.

Since 2018, the Supreme Court of the Russian Federation has expressly referred to the requirements of Article 13.3 of the Anti-Corruption Law when reviewing cases of corporate bribery. Some of the lower courts have also referred to Article 13.3 in their decisions. Further, the prosecutor’s offices at the municipal level apparently have started to consider non-compliance with these requirements when bringing bribery charges against legal entities. However, the authorities and courts failed to answer the decisive question: to what extent the implementation of these measures may exempt companies from liability, or reduce their liability, in a specific administrative case.

In the prosecution of Russian Standard Bank for corporate bribery in 2019–2020, case law on the benefits of a compliance management system was developed further. For the first time, a higher Russian court (i.e., the Fourth General Jurisdiction Court of Cassation) elaborated on the specific anti-corruption measures that a company must take to be excluded from liability for bribery. Although the relevant decision was subsequently vacated on procedural grounds, it provided an interesting insight into the requirements that courts may place on compliance management systems. In this particular case, the court was of the opinion that all necessary measures to prevent the offence had been implemented because the bank had adopted an internal anti-corruption regulation, familiarised the relevant employees with this regulation, and incorporated a general obligation to comply with these internal regulations into the employment agreement. This means that, in certain circumstances, even taking a few formal anti-corruption measures may suffice to shield a company from liability for bribery.

Following legislative changes that entered into force in March 2020, corporations may adopt an antitrust compliance programme consisting of certain measures that are listed in the law. This compliance programme must be adopted in the form of an internal document at company or group level, which is then published on the internet. A properly adopted compliance programme may reduce or even exclude liability for antitrust violations under the Administrative Offences Code.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities in your country to cybersecurity-related failings.

Cybersecurity is regulated mainly by Federal Law 187-FZ ‘On security of critical information infrastructure . . .’ which entered into force on 1 January 2018. This Law imposes certain obligations on authorities, organisations and companies that operate information systems, telecommunication networks or automated control systems in sectors that are strategically important for the state – healthcare, science, transport, communications, power, financial markets, fuel and energy, defence, space rockets, mining, metallurgical and chemical industry. Their obligations include a categorisation of the relevant critical information infrastructure and taking measures to protect the entity against cyberattacks depending on the results of that categorisation. Compliance with the law is monitored by the Federal Service for Technical and Export Control.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Chapter 28 of the Criminal Code prohibits various forms of cybercrime, including cyberattacks (unlawful interference with critical information infrastructure: Article 274.1) and hacking (unlawful access to computer information: Article 272).

Countering cyberattacks on information systems, telecommunications networks and automated control systems falls into the competence of the Federal Security Service (the FSB). Various acts of computer fraud and phishing are investigated by the Russian police and other law enforcement authorities who have created separate divisions specifically for the purpose of fighting cybercrime.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Only certain provisions of Russian administrative and criminal law have extraterritorial effect. In particular, Article 19.28 of the Administrative Offences Code (unlawful remuneration on behalf of a legal entity) prohibits the bribery of foreign public officials by corporations. This offence punishes the illegal transfer, offering or promise of money, securities or other property, valuable services or other property rights to a foreign public official on behalf, or in the interest, of a corporation, in return for the foreign public official using his or her authority to act in favour of the corporation. A foreign public official is defined as any appointed or elected person holding any position in a legislative, executive, administrative or judicial body of a foreign state, and any person performing any public duties for a foreign state, including for a public authority or public enterprise.

Since March 2016, Russian law enforcement authorities may prosecute domestic and foreign corporations for bribery offences committed outside Russia. Prosecution in this context requires additional justification: the offence must be directed against the interests of the Russian Federation or that possibility must be established by international agreements acceded to by the Russian Federation (Administrative Offences Code, Articles 1.8(3) and 2.6(2.1)). Since the term ‘interests of the Russian Federation’ is not defined under Russian law, theoretically any foreign bribery offence involving a Russian element may be subject to administrative proceedings in Russia.

The bribery of foreign public officials by individuals is prohibited by Article 291 of the Criminal Code (giving bribes). According to the applicable court practice, this offence punishes the payment of bribes in return for (1) a foreign public official using his or her authority to act in favour of the bribe giver or the persons represented by him or her, (2) the foreign public official enabling another public official to take such actions, (3) general patronage or (4) general connivance. Further, Article 291.1 of the Criminal Code (mediation in bribery) punishes individuals for the direct transfer of bribes to foreign public officials on a considerable scale (i.e., exceeding 25,000 roubles) on instructions by the bribe giver or bribe taker, as well as promises and proposals of such transfers. Smaller bribery offences committed by individuals (those involving bribe payments to foreign public officials not exceeding 10,000 roubles) are punishable under Article 291.2 of the Criminal Code (small-scale bribery).

Russian citizens can be held liable for any offence under the Criminal Code that has been committed outside Russia (Criminal Code, Article 12(1.)). Foreign citizens can be prosecuted for criminal offences if they are directed against the interests of the Russian Federation or that possibility is established by international agreements (Criminal Code, Article 12(3.)).

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Up to now, Russian anti-bribery enforcement actions have been limited almost entirely to purely domestic cases. Foreign individuals who are not from a Member State of the Commonwealth of Independent States are punished only sporadically; foreign corporations are prosecuted only in exceptional cases. Despite Russia’s accession to the Organisation for Economic Co-operation and Development’s Convention on Combating Bribery of Foreign Public Officials in International Business Transactions in 2012, there seems to be no prosecution of bribery of foreign public officials.

Cross-border investigations by foreign law enforcement authorities or multinational companies regularly require the transfer of protected data from Russia to foreign jurisdictions. The collection and cross-border transfer of such data is subject to extensive Russian regulation. In particular, the transfer of the personal data of Russian citizens requires the relevant individuals’ written consent to the transfer. Since the consent can be difficult to obtain in practice, the relevant data may have to be depersonalised before the transfer.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

In certain circumstances, Russian law enforcement authorities may prosecute domestic and foreign corporations for offences under Article 19.28 of the Administrative Offences Code (unlawful remuneration on behalf of a legal entity) committed outside Russia. However, the law expressly prohibits double jeopardy – Russian jurisdiction arises only if the corporation has not been held liable in a foreign state.

Foreign citizens must not be prosecuted in Russia for a criminal offence committed outside Russia if they have been convicted for this offence in a foreign state.

There is nothing analogous in Russia to the ‘anti-piling on’ policy as exists in the United States to prevent multiple authorities seeking to penalise companies for the same conduct.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Not applicable.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

To date, none of the foreign enforcement actions based on bribery and corruption offences relating to Russia (in particular under the US Foreign Corrupt Practices Act or the UK Bribery Act) seem to have triggered any subsequent investigations by Russian law enforcement authorities.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Russia’s sanctions programme consists mainly of economic sanctions and measures that have been introduced to respond to the sanctions imposed on Russia by the United States and the European Union.

On 7 August 2014, an import ban on agricultural products, raw materials and food from the United States, EU Member States and other states supporting the anti-Russia sanctions was initially imposed for one year and has been regularly extended since then. This import ban is based on Federal Law 281-FZ ‘On special economic measures’ of 30 December 2006, which authorises the Russian president to take temporary measures to respond to unfriendly actions by foreign states that threaten the interests of the Russian Federation.

Federal Law 127-FZ ‘On measures (countermeasures) in response to unfriendly actions of the United States . . .’ came into force on 4 June 2018. This Law constitutes another basis for the Russian president to take extensive economic countermeasures against the United States and other ‘unfriendly states’ supporting the anti-Russia sanctions. In contrast to measures under Federal Law 281-FZ, countermeasures under this law can be unlimited in time. The taking of any countermeasures is at the sole discretion of the Russian president. To date, countermeasures under Federal Law 127-FZ have been taken against Ukraine, the United States and the Czech Republic:

• In response to ‘unfriendly actions’ by Ukraine, Presidential Decree 592 of 22 October 2018 and Government Order 1300 of 1 November 2018 imposed the first measures under Federal Law No. 127-FZ. The assets (non-cash funds, non-documentary securities and property) of currently 849 individuals and 84 companies – almost all of them Ukrainian – and of the legal entities controlled by them that are located in Russia have been blocked or frozen. It is also prohibited for their funds to be transferred out of Russia. On 23 October 2020, the State Duma adopted Draft Law 996800-7 at its first reading, which regulates the practical implementation of the asset freeze; this Draft Law is likely to become law.
• Based on Federal Law 127-FZ, Presidential Decree 243 of 23 April 2021 and Government Order 1230-r of 13 May 2021 imposed certain restrictions regarding the employment of individuals located in Russia by diplomatic and consular bodies, as well as representative offices of state authorities and state bodies of ‘unfriendly states’, namely the Czech Republic and the United States.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

In 2018, the Russian Federation introduced for the first time comprehensive sanctions in the form of countermeasures to respond to sanctions by the United States and the European Union. This response was triggered mainly by the adoption of the US Countering America’s Adversaries Through Sanctions Act on 2 August 2017 and the extension of the US sanctions on 6 April 2018. These countermeasures are a combination of economic sanctions and measures to prevent the implementation of US and EU sanctions in Russia.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Not applicable.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

On 15 May 2018, the State Duma adopted at its first reading a draft blocking law that provides for criminal liability with a penalty of up to four years’ imprisonment for any Russian or non-Russian individual who complies with foreign sanctions and thereby restricts the ordinary business operations of Russian persons. In addition, deliberate actions by Russian individuals that facilitate the introduction of foreign sanctions against Russian persons shall be punished by up to three years’ imprisonment. Currently, this legislative initiative has been put on hold.

However, Russia has adopted other legislation that aims to prevent the implementation of US and EU sanctions in Russia.

Throughout 2018, the Russian government issued orders restricting the disclosure of information relating to sanctioned persons. Information available from public sources may now be incomplete with respect to sanctioned persons. Apparently, these restrictions are designed to protect the business partners of sanctioned persons from the consequences of sanctions violations.

On 19 June 2020, changes to the Russian Arbitrazh (Commercial) Procedural Code came into force, which establish a specific jurisdiction in Russia for any disputes with the participation of listed Russian persons as well as foreign legal entities that have been listed because of sanctions imposed on Russian persons. In certain circumstances, these disputes now fall into the exclusive competence of the Russian commercial courts. To enforce the new rules on specific jurisdiction in Russia, the Russian court may order the counterparty to pay a penalty to the protected listed person. As a result, in many cases, listed Russian and foreign persons (as well as parties in disputes having their basis in sanctions against Russian persons) may be able to transfer their dispute to a Russian commercial court.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Since 2018, Russian courts have developed case law that aims to prevent the implementation of US and EU sanctions in Russia. Two court decisions stand out.

On 13 February 2018, the Russian Constitutional Court issued a landmark decision on parallel imports in which it stated in an obiter dictum that ‘compliance with a sanctions regime against the Russian Federation . . . can by itself be viewed as bad-faith conduct’. Since the Russian Civil Code obliges all parties to exercise their civil law rights in good faith, the court’s position may render unenforceable any sanctions clauses in agreements governed by Russian law (e.g., rights to terminate an agreement if the Russian counterparty becomes sanctioned).

In Siemens v. Technopromexport (concerning the delivery of gas turbines to Crimea), the Ninth Commercial Appellate Court stated in its dismissal of Siemens’ appeal on 10 April 2018 that:

the main consequence of granting the appeal would be the de jure application of economic sanctions imposed by the European Union on the territory of the Russian Federation (i.e., the acknowledgement by the court that Russian legal entities have an obligation to comply with them), which would clearly contradict the fundamentals of the legal system of the Russian Federation (public order) – and cause damage to the sovereignty of the state.

Since an action that is contrary to public order can be a ground for refusing the recognition of foreign arbitral awards in Russia, this position may render unenforceable any arbitral awards based on the exercising of rights under sanctions clauses.

Owing to recent legislative changes that establish a specific jurisdiction in Russia for sanctions-related disputes, foreign corporations may be faced with this court practice more often when trying to enforce claims against listed persons or rights under sanctions clauses. This applies in particular when the foreign corporation owns assets in Russia, or the court decision or arbitral award would have to be enforced in Russia. It is even more important, therefore, to draft sanctions clauses carefully in each case, taking into account applicable Russian court practice.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Misconduct is most often revealed by external and internal whistleblowers. Most whistleblowers do not simply allege violations, they accuse specific employees or the management of the Russian company of personal misconduct. Usually, the main trigger for reporting an actual violation is a personal grudge or the intention to harm a workplace rival. Further, employees often do not sufficiently trust the local management. Many whistleblowers thus prefer to report anonymously, which makes it harder to assess the allegations. However, these anonymous whistleblowers may be as credible as those who disclose their identity.

Information gathering

22 Does your country have a data protection regime?

Yes, the processing of any personal data of Russian citizens triggers the application of Federal Law 152-FZ ‘On Personal Data’ of 27 July 2006. Under this law, personal data is defined as ‘any data that relates directly or indirectly to an individual who can be identified by this data’. The processing actions that trigger the application of the law are recording, systematising, aggregation, storage, specification (updating and modification) and extraction of personal data.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

The Russian data protection authority, Roskomnadzor, performs its own monitoring of data breaches (including monitoring the internet and relevant news). Roskomnadzor also actively responds to complaints that, in practice, can be filed by data subjects, prosecutors or competitors. Following a complaint or based on the results of its own monitoring, Roskomnadzor can perform a non-scheduled audit, giving a company only 24 hours’ prior notice of the audit.

Roskomnadzor also performs a substantial number of scheduled audits. The relevant schedules are published on the official websites of the relevant territorial subdivisions of Roskomnadzor at the beginning of each calendar year. As a result of such an audit, Roskomnadzor can issue an order to remedy a breach or institute administrative proceedings before a court.

Roskomnadzor performs more audits of corporations in industries that are considered more risky from a privacy angle. For example, in 2020, Roskomnadzor mostly concentrated on banks (OTP Bank and Russian Standard Bank), airlines (Aeroflot and Nordwind), insurance companies (Ingosstrakh) and a few subsidiaries of multinational companies (General Electric, KIA and Alibaba). Roskomnadzor also took action against companies that do not have a presence in Russia (such as Facebook and Twitter).

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

The processing of personal data requires the consent of the relevant employee. Usually, there are no statutory exemptions from the consent requirement that apply to an internal investigation. In particular, according to the current practice of Roskomnadzor, the corporation may not argue that the processing of the personal data is necessary for the exercise of its rights or legitimate interests. Since the employee must consent to the transfer of data to each specific data recipient, all participants in the investigation must be named in the consent. Even stricter requirements apply to data transfer to countries such as the United States, which are not considered to provide adequate protection to personal data. The consent to such data transfer must be issued in writing (ink on paper). Problems can be caused if the employee revokes his or her consent.

In addition, the employing company and each specific data recipient must enter into a data transfer agreement that stipulates that the data recipient will ensure at least the same level of data protection as applied by the Russian company. A separate Russian law agreement is generally advisable.

The cross-border transfer of personal data must also comply with data localisation requirements. In particular, the Russian database must be the primary one and a foreign database could be either a partial or a full (mirroring) copy of the Russian primary database.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

The review of emails and computers of employees in Russia is allowed if the employee agrees to the relevant procedures and, most importantly, to the access to his or her communications. This agreement may be given either in (1) a handwritten consent, (2) the employment contract or (3) an internal policy of the company under which the employee puts an ink signature confirming his or her acknowledgement and consent. Otherwise, the company may face potential criminal accusations for the breach of privacy of communications or for illegal access to computer information containing information about an employee’s private life or family secrets.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Russian law enforcement authorities at the federal, regional and municipal levels conduct audits of companies quite frequently. The procedures for these audits are regulated by various laws that set out in detail the rights and obligations of the company and the relevant authority. The general principles are laid down in Federal Law 294-FZ ‘On the protection of legal entities during the exercise of state control’.

Companies can be targeted by ‘scheduled’ and ‘non-scheduled’ audits (i.e., dawn raids). Scheduled audits are conducted according to annual schedules, a consolidated version of which is published on the website of the General Prosecutor’s Office until 31 December of the preceding year. Non-scheduled audits are conducted based on specific grounds and must usually be notified to the company at least 24 hours in advance. In most cases, both types of audits are conducted in the form of a request for documents or an on-site visit to the company’s premises (or both). An audit must not take longer than 20 business days.

An audit can only be conducted on the basis of a written order, which must comply with certain formal requirements and has been issued by the head or deputy head of the relevant authority. The authority must document the results of the audit in detail in a written report in two original copies, one of which must be handed over to the company. Objections regarding the content of the audit report must be submitted to the relevant authority in writing within 15 calendar days. Other decisions, actions or inaction of the authority in connection with the audit must be challenged in a Russian state court.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

There is no general attorney–client privilege, according to Western understanding, under Russian law. Only certain work-product of specially licensed attorneys (advocates) enjoys limited protection from seizure by ‘advocate secrecy’.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Each individual is generally obliged to provide testimony as a witness in administrative and criminal proceedings (Administrative Offences Code, Article 25.6.(2); Criminal Procedural Code, Article 56(6.)(2)). Refusal to provide testimony may entail criminal liability (Criminal Code, Article 208). According to Article 51 of the Constitution of the Russian Federation, an individual is not obliged to provide testimony against himself or herself, his or her spouse or close relatives. If the individual voluntarily provides testimony, he or she must be warned that the testimony can be used as evidence in a criminal case (Criminal Procedural Code, Article 56(4)(1)).

There are no comparable provisions that would protect corporations in administrative proceedings against them.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Article 9(4) of the Anti-Corruption Law states that public officials who report on corruption violations are protected by the state in accordance with Russian law. The law therefore only confirms that whistleblowers in the public sector enjoy the protection of the general rules of, for example, Federal Law 45-FZ ‘On state protection of judges, officials of law enforcement bodies . . .’, Federal Law 119-FZ ‘On state protection of victims, witnesses and other participants of criminal court proceedings’ and the Criminal Procedural Code. In addition, Presidential Decree 309 dated 2 April 2013 provides for some restrictions on the taking of disciplinary measures against state employees who report corruption.

Even less protection is granted to whistleblowers reporting corruption who are employed in the private sector. Except for a general provision of Presidential Decree 309 dated 2 April 2013, according to which citizens shall be granted legal aid when preparing to report corruption, they are only protected by the general rules of criminal procedural law. A draft law that provided for extensive protection of whistleblowers reporting on corruption in the public and private sectors, and which already had been adopted by the State Duma at its first reading on 13 December 2017, was ultimately rejected on 19 June 2019. In the foreseeable future, therefore, whistleblowers in the private sector can rely only on the protection granted by their employers in accordance with applicable internal rules.

Irrespective of the insufficient whistleblower protection, the Russian state is trying to encourage whistleblowing with monetary rewards. Since 28 August 2018, the Russian Ministry of the Interior is authorised to pay individuals who report on crimes, including bribery and corruption, rewards that may exceed 3 million roubles, according to Order 356 of the Ministry of the Interior dated 6 June 2018.

In contrast to reporting channels established by the state, reporting channels of multinational companies for Russia may violate the Russian data localisation requirements. In particular, this is the case where, upon the receipt of reports, personal data of Russian citizens are collected and saved for the first time outside Russia. Reporting channels with foreign telephone numbers, as well as email addresses or websites with data storage on servers abroad, are therefore not permitted. That means that group-wide whistleblowing systems cannot be extended to Russia without problems.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Except for potentially applicable whistleblower protection, employees, including officers and directors, do not have any special rights under Russian employment law during internal or external investigations.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

A company can apply disciplinary measures against employees who have engaged in misconduct only in compliance with the strict requirements of the Labour Code. Disciplinary measures for a specific violation must be imposed within a month of the violation being uncovered. There is also an overall limitation period for disciplinary measures, which commences when the violation occurs. In practice, these limitation periods – in particular the one-month period commencing on the date of discovery of the violation – prevent the company in many cases from taking disciplinary actions against employees who have violated their labour duties and, in some cases, even committed administrative or criminal offences. To apply disciplinary measures, the company must obtain and properly document the investigation results prior to the expiry of these limitation periods.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

Employees must participate in an internal investigation only to the extent that the required action falls within the scope of their labour duties such as, for example, the provision of documents and information to the company’s management. A one-time refusal to take such action, however, is unlikely to constitute a ground for dismissal under the very employee-friendly Labour Code. Employees are free to choose whether or not to take any action outside the scope of their labour duties (e.g., whether to participate in interviews with external advisers).

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

In many Russian companies, internal investigations are conducted on an ad hoc basis by the company’s security department, which is staffed by former military and police personnel. Therefore, the practice of preparing an investigation plan can rather be found in international law firms that assist multinational companies in internal investigations at their Russian subsidiaries.

The investigation plan would set out the major investigation steps as well as timing and responsibility for the relevant steps. At the initial stage of an investigation, the plan would typically include the following steps:

• examination of the whistleblower’s report and correspondence with the whistleblower;
• preliminary analysis of potential liability risks;
• preservation of emails and hard copy documents;
• preparation of documentation required for compliance with data protection requirements;
• background interviews with local personnel and management;
• e-search and review of hard copy documents;
• interviews with employees who are suspected of misconduct, during which evidence is presented;
• implementation of disciplinary measures; and
• communication with local management and other logistical issues.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

The company should conduct an internal investigation to clarify the issue, take the required disciplinary measures against employees who have engaged in misconduct, ensure that any established violations are treated with strict confidence within the company, and improve the company’s compliance management system to avoid repeated violations. Additional internal steps such as, for example, reporting to a group-wide compliance department, may be required according to the company’s internal regulations.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Documents and information must be requested by the Russian law enforcement authorities based on written requests that specifically list the requested material. The material must be provided within a limited period which, in some cases, may not be more than a few business days. Failure to meet the deadline may entail administrative liability of the company and its management. Therefore, immediately upon receipt of the request, the company’s management should instruct a senior employee to collect the requested materials. The collected materials should be provided to the authorities by the relevant deadline in strict compliance with all formal requirements.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

The company is generally not obliged to publicly disclose internal investigations or the fact that it has been contacted by the authorities.

37 How are internal investigations viewed by local enforcement bodies in your country?

The concept of internal investigations according to Western understanding is foreign to Russian law. Russian law enforcement authorities have not imposed any requirements regarding the conduct or format of such internal investigations.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

There is no general attorney–client privilege under Russian law. Only information connected to the provision of legal services by specially licensed attorneys (advocates) to their clients is protected. This information falls under what is known as advocate secrecy. Therefore, internal investigations can be protected by advocate secrecy only to the extent that they are conducted by advocates.

Given the limited scope of advocate secrecy, the onus is usually on the investigators to take practical measures to protect the investigation results. Apart from that, the investigators must consider what is required to maintain privilege protections under other jurisdictions – in particular the US attorney–client privilege.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

The protection afforded by advocate secrecy is rather limited:

• An advocate (a specially licensed attorney) cannot be called or questioned as a witness regarding facts that became known to him or her in connection with his or her legal services.
• Law enforcement authorities may search the advocate’s premises only on the basis of a court order.
• The advocate’s work-product that has been obtained during a search is barred from being used as evidence for the prosecution.

There are no differences when the client is an individual.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Advocate secrecy does not usually apply to in-house counsel. The reason for this is that the advocate status entails restrictions that significantly complicate the employment of an advocate in-house. In practice, the status of advocate is therefore obtained only by external counsel.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Under the Advocacy Law, advocate secrecy does not generally apply to advice sought from foreign lawyers practising outside Russia. It is unclear to what extent the privilege applies to foreign lawyers who are registered with the Register of Foreign Lawyers at the Russian Ministry of Justice.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Not applicable.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

Not applicable.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Waiving privilege in another country does not affect advocate secrecy in Russia.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Not applicable.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Advocate secrecy extends to any information received by an advocate from third parties in connection with his or her legal services.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

The interviewing of witnesses as part of an internal investigation is not regulated by Russian law.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

The company itself cannot claim privilege over internal witness interviews or attorney reports. Such materials may enjoy the limited protection of advocate secrecy if they constitute certain work-product of advocates (specially licensed attorneys)

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Employees are free to choose whether or not to participate in a witness interview. Most employees, however, will agree to an interview, especially if they are asked to do so by the local company’s general director or a representative of the foreign shareholder. Giving warnings to the employee prior to the interview are neither required by law nor widespread in practice. There are also no such requirements when interviewing former employees or other third parties.

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Experience shows that the best results can be achieved if the interview is conducted in Russian by a small external team. Documents are presented to the witness as needed. There is generally no need for a lawyer or representatives of a union or workers’ council to be involved. Audio or video recording is only permitted with the written consent of the witness.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

The company is generally not obliged to inform the authorities of any misconduct. External advisers of the company, including advocates (specially licensed attorneys), are subject to reporting obligations if there is suspicion of money laundering or terrorist financing. In addition, any individual must report to the law enforcement authorities a limited number of violent offences, such as terrorist activities (Criminal Code, Article 205.6).

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Self-reporting to exclude or mitigate potential liability is an option available to the company and its representatives for a number of violations under the Administrative Offences Code and the Criminal Code. The self-reporting option for companies to be released from liability for bribery (Administrative Offences Code, Article 19.28: unlawful remuneration on behalf of a legal entity) was only introduced in August 2018. To benefit from self-reporting, it is usually necessary that the authorities have not yet otherwise learned of the violation. However, there are often uncertainties about how to apply the relevant provisions of the law, and fundamental concerns regarding co-operation with the authorities. Therefore, self-reporting in Russia is currently advisable only in exceptional circumstances.

53 What are the practical steps you need to take to self-report to law enforcement in your country?

The process of self-reporting is usually not regulated by Russian law and depends on the practice of the relevant law enforcement authority. As a general rule, the benefits of self-reporting by a company will be limited to the reporting company itself. The individuals who committed the violations on behalf or in the interest of the company will still face prosecution under the Criminal Code. However, in some cases, individuals may separately self-report under the leniency provisions of the Criminal Code. Therefore, self-reporting by both the company and its representatives may have to be harmonised.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

In Russian practice, the law enforcement authorities are generally considered to be adversaries of the company. Therefore, on the one hand, the company will fully comply with the notice or subpoena from the authority. On the other hand, the local management will take measures to protect the company’s interests against potential hostile actions by the authority. The protective measures to be taken differ depending on the investigating authority and the type of violation being investigated.

55 hAre ongoing authority investigations subject to challenge before the courts?

As a general rule, legal acts, decisions, actions or inaction of the law enforcement authorities in connection with an investigation that violate the rights or legal interests of a company, and do not comply with Russian legislation, can be challenged in a Russian state court.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

Owing to the different priorities of Russian law enforcement and the general absence of co-operation with its Western counterparts, parallel investigations by Russian and foreign authorities regarding the same facts or allegations currently are very unlikely. Should such a situation arise, the company should handle the Russian investigation separately from the foreign investigation.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

The company must provide any material requested by the Russian law enforcement authority, including material located or issued in other countries. Documents issued in other countries must be provided with an apostille and a certified translation into Russian.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Russian law enforcement authorities can request and provide legal assistance on the basis of the treaties on mutual legal assistance entered into with other countries, including many European countries (e.g., according to the European Convention on Mutual Assistance in Criminal Matters of 1959) and the United States (e.g., according to the Treaty Between the Russian Federation and the United States of America on Mutual Legal Assistance in Criminal Matters of 1999). In practice, however, information and investigative materials are shared with foreign authorities only in exceptional cases.

The purpose of legislative changes that entered into force at the end of 2019 is to enable the increased prosecution of foreign companies for bribery offences committed in or outside Russia. If the prosecutor’s office sends a letter rogatory to a foreign authority in the course of an investigation, the duration of the administrative investigation can be extended from the previous maximum of two months to 12 months. In the current political climate, it is certainly questionable whether these legislative changes will indeed lead to intensified co-operation by Russian law enforcement agencies with their foreign counterparts.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

The Russian law enforcement authorities must process protected information (such as state secrets, commercial secrets and official secrets) that they receive during an investigation in accordance with secrecy regimes established by Russian law (in particular, by Law RF 5485-1 ‘On the state secret’ and Federal Law 98-FZ ‘On the commercial secret’).

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

The company should provide to the Russian law enforcement authority a letter from a law firm in that country, which confirms that the production of the documents would violate local law. To be accepted by the Russian authority, the letter should be provided with a certified translation into Russian.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Not applicable.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

The voluntary provision of material to the Russian law enforcement authorities may violate contractual confidentiality obligations towards third parties. Material provided to Russian authorities, whether compelled or voluntarily, is generally not discoverable by third parties. The authorities must keep provided material confidential to the extent that it is protected by secrecy regimes established by Russian law (in particular, the state secret regime and the commercial secret regime).

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Under the Administrative Offences Code, companies generally may face fines, confiscation of the instrument of the administrative offence and suspension of operations. Directors and officers of the company are liable under the Administrative Offences Code to fines and occupational bans from certain professions. Any employee of the company may face penalties under the Criminal Code, including fines, occupational bans and imprisonment.

For example, for the commission of offences under Article 19.28 of the Administrative Offences Code (unlawful remuneration on behalf of a legal entity), the following penalties may be imposed on a company:

• minimum: penalty of up to three times the amount of the bribe sum, but not less than 1 million roubles;
• large-scale bribery: if the bribe sum exceeds 1 million roubles, a penalty of up to 30 times the bribe sum, but not less than 20 million roubles; and
• extra large-scale bribery: if the bribe sum exceeds 20 million roubles, a penalty of up to 100 times the bribe sum, but not less than 100 million roubles.

Money, securities or other property, valuable services or other property rights that had been transferred, offered or promised shall be confiscated from the company.

In addition, companies convicted of bribery are being included in a blacklist, which is published on the website of the General Prosecutor’s Office. Listed companies are excluded from state procurement processes for two years.

Individuals who commit a bribery offence on behalf or in the interest of a company may face fines, occupational bans and imprisonment under the various bribery offences of the Criminal Code; for example, a bribe given to a domestic public official (Article 291) or commercial bribery (Article 204).

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

Not applicable.

65 What do the authorities in your country take into account when fixing penalties?

When imposing penalties under the Administrative Offences Code, the courts and authorities shall take into account the financial situation of the company as well as any circumstances that mitigate or aggravate the administrative liability. In general, the fines imposed on companies for corporate misconduct are much lower than those imposed in Western countries.

For example, the fines that are usually imposed by the courts on companies for bribery and corruption are low, not only compared with other countries. They are also well below the maximum fines under Russian law, which may range up to 100 times the bribe sum. Most companies have to pay only the statutory minimum fine of 1 million roubles. The reason for this is the preference of the prosecutor’s offices for prosecuting smaller companies on which even the minimum fine of 1 million roubles can have a crippling effect. In many cases, the courts have to decrease even the minimum amount owing to financial difficulties on the part of the companies being fined.

According to information published by the General Prosecutor’s Office, however, the amount of the maximum fine imposed for corporate bribery during the year increased significantly, from 30.5 million roubles in 2018 to 50 million roubles in 2019 and 59.8 million roubles in 2021. In 2019, the court of first instance imposed a fine of 100 million roubles in addition to the confiscation of the 56 million roubles bribe. This indicates that higher fines are not inconceivable.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Not applicable.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Not applicable.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Not applicable.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Not applicable.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Not applicable.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Under Russian law, companies can be held liable for corporate misconduct under the Administrative Offences Code. Information about scheduled audits of companies is published on the website of the General Prosecutor’s Office and the law enforcement authorities conducting the relevant audit. Further, some law enforcement authorities – such as the Federal Antimonopoly Service (FAS) and the Russian data protection authority, Roskomnadzor – may publish information about the opening of administrative cases on their website. Once a company has been convicted of an administrative offence, information about the case can be obtained from published court decisions, press releases of the law enforcement authorities and public registers of offenders.

For example, companies convicted for corporate bribery are included on a blacklist that is published on the website of the General Prosecutor’s Office. In 2020 alone, this blacklist gained 325 new entries. For companies with international operations, being included on the blacklist not only results in a loss of reputation; it may also expose companies to additional prosecution risks outside Russia.

The actual purpose of the blacklist is to exclude punished companies from state procurement processes for two years. However, there is currently no automated procedure by means of which the data of excluded companies are transferred to the authorities responsible for state procurement. Therefore, as the results of an investigation initiated by the General Prosecutor’s Office show, this exclusion is still not always properly enforced in practice. In 2019, for example, 22 blacklisted companies were able to enter into procurement contracts in 36 Russian regions.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

In most cases, corporate communications in Russia are managed in-house directly by the company’s management and without instructing a public relations firm.

73 How is publicity managed when there are ongoing related proceedings?

In most cases of ongoing related proceedings (e.g., criminal investigations against individuals), publicity is usually managed directly by the company’s management.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Russian law does not generally provide for settlements in administrative proceedings against companies.

Environmental, Social and Corporate Governance (ESG)

75 Does your country regulate ESG matters?

On 12 July 2021, the Bank of Russia issued ‘Recommendations for the disclosure of non-financial information . . .’. These recommendations encourage public joint stock companies, which are regulated by the Bank of Russia, to publicly disclose information about how they take into account ESG factors and implement them into their business model and development strategy.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

On 2 July 2021, the State Duma adopted Federal Law 296-FZ ‘On the reduction of greenhouse gas emissions’ ,which will enter into force on 30 December 2021. This Law sets out the legal basis for further regulation of economical and other activities so as to reduce the emission of greenhouse gases in Russia.

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

Russia has started to adopt legislation addressing ESG matters only very recently. Therefore, so far there has been no increase in related enforcement activity.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

We are currently not expecting to see any key regulatory or legislative changes emerge that are designed to address corporate misconduct. In particular, the National Anti-Corruption Plan for 2021 to 2024, which was adopted by the Russian president on 16 August 2021 to coordinate the efforts to combat corruption in Russia, does not provide for such changes.

Footnotes

¹ Hannes Lubitzsch is an associated partner at Noerr.