Nigeria

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The investigation of the 2021 Pandora Papers scandal, which uncovered alleged offshore hide­aways tied to mega-banks, corporate bribery and scandals of companies, and prominent individuals in Nigeria, remains the country’s highest-profile corporate investigation. The outcome of the investigation of the allegations is yet to be released by the Code of Conduct Bureau (CCB).

An interesting development about the few details that have emerged was that there is a current investigation involving several entities from banks, corporate organisations and some prominent individuals in Nigeria. About 21 Nigerians were reportedly identified as owners of assets in two tax haven banks worth more than 117 billion naira.

The Nigerians involved reportedly had a combined haul worth about US$100 million and £77.3 million in assets, cash, bonds, equities, mutual funds and property holdings controlled by a major financial institution in Guernsey, Jersey and the United Kingdom.

2 Outline the legal framework for corporate liability in your country.

The liability of a corporation under criminal law is provided in a key criminal statute known as the Criminal Code. Interestingly, the Code makes no special provisions concerning the criminal liability of companies.

In its interpretation section, an offence is an act or omission that renders the person doing the act or making the omission liable to punishment under any act or law. Furthermore, the Code defines a ‘person’ to include corporations. Thus, companies in Nigeria can be held liable and prosecuted for criminal offences occasioned by their agents. In a prominent case in which the Nigerian court was faced with determining whether a company can be prosecuted for a crime in Nigeria, the court held that a company can be prosecuted as if it were a natural person. Corporate mens rea is said to include corporate intent, knowledge and recklessness.

Furthermore, under the Companies and Allied Matters Act, 2022, a company would be liable to a third party for the acts of any officer or agent, except where there is collusion between the officer or agent and the third party.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

There is no sole agency responsible for law enforcement against Nigerian companies. However, a principal body charged with the regulation of all companies in Nigeria is the Corporate Affairs Commission (CAC). The CAC is not without certain law enforcement powers in addition to its regulatory, administrative and supervisory roles regarding the operational and administrative matters, and compliance monitoring.

There are other law enforcement authorities that regulate companies in specific sectors, including the Securities and Exchange Commission (SEC), a body charged with the regulation of investments and securities in Nigeria, and the Federal Inland Revenue Service, which is responsible for taxation and tax enforcement actions against corporations.

The jurisdiction between the authorities largely depends on the subject matter of the infraction, the sector of the violating company and the discretion of the Attorney General of the Federation, among other factors. These entities have policies or protocols relating to the prosecution of corporations, which include the Companies Regulations, 2021 and the SEC Nigeria Consolidated Rules and Regulations, among others.

The CAC and the SEC often collaborate with traditional law enforcement agencies, such as the Nigerian Police Force and the Economic and Financial Crimes Commission, in investigations where law enforcement or investigation is primarily required in their roles as company regulators.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

The CAC may initiate an investigation against a company following an application by a member of the company or under the directive of a court order. Any reasonable suspicion, however minute, is sufficient for an authority to initiate an investigation against a company.

Usually, investigations are commenced by way of a petition or complaint addressed to the relevant authority against the erring company.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

The lawfulness or scope of a notice or subpoena from an authority may be challenged by way of an application to the relevant high court or the Federal High Court, depending on the authority in question, seeking relief to set aside the unlawful notice or subpoena. Some of the grounds on which a court may set aside a subpoena include the following:

• The scope of the documents or information requested unfairly burdens or prejudices the recipient of the subpoena.
• No factual or lawful bias was demonstrated for the issuance of the subpoena.
• Legal privileges, such as attorney–client privilege or spousal privileges, exist.

However, most often, the court is reluctant to interfere with likely or pending investigations by authorities.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

There are no dedicated laws that expressly provide for or mandate the use of co-operative agreements to give immunity or leniency to individuals who assist or co-operate with authorities, nor is it given as a right or as a matter of course. Nevertheless, co-operative agreements do exist as special provisions under state and federal criminal legislation.

The state only enters into such agreements after consultation with the police or law enforcement officer responsible for the investigation of the case and the victim, if reasonably feasible, and with due regard to the nature of and the circumstances relating to the offence, the defendant and the interests of the community.

7 What are the top priorities for your country’s law enforcement authorities?

The present Nigerian government, re-elected in 2019, has prioritised the fight against corruption, money laundering and cybercrime. Since 2019, there have been several arrests, trials and convictions of individuals, both prominent and average citizens, on charges of money laundering, fraud and cybercrime. The major law enforcement agency vested with investigative powers in matters of economic, financial or cybercrime is the Economic and Financial Crimes Commission (EFCC).

The EFCC’s activities show that notable individuals and the country’s politically exposed persons (PEPs) are often investigated and prosecuted for corruption, with low results in convictions; in contrast, the success rates in securing convictions for non-PEPs are high.

In the first eight months of 2022, the EFCC secured the conviction of 2,210 persons. In 2021, 80 per pent of secured convictions concerned cybercrime and involved mostly non-PEPs.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

Law enforcement and regulatory agencies with law enforcement powers have shown a great deal of interest recently in enforcing effective compliance programmes. Companies that fail to comply with the various compliance requirements might face the risk of being sanctioned by the relevant regulatory authorities. Sanctions for non-compliance by companies are in the form of fines, penalties, investigations or convictions, which could, in turn, affect the revenue made by the defaulting company and disrupt the business activities of the company.

Compliance programmes in Nigeria are multilateral and vary from one agency, or sector, to another. The compliance programme is largely superficial, documentary and reporting-based (without a robust systemic design by companies or relevant law enforcement authorities), and thus grossly inefficient to cater for perceived or actual risks. The most commonly emphasised components are anti-money laundering, data privacy, statutory financial and tax returns, and know your customer.

For example, financial institutions in Nigeria are usually under the radar of the Federal Inland Revenue Service, the CAC, the Central Bank of Nigeria and the National Information Technology Development Agency.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

The National Information Technology Development Agency (NITDA) regulates cybersecurity in Nigeria. The approach of law enforcement agencies to cybersecurity breaches is usually investigative. When incidents have been established, fines are imposed. Cybersecurity standards in Nigeria for corporates are prescribed by the Nigerian Data Protection Regulations (NDPR) and the NDPR Implementation Framework.

Regulation 2.1(1)(c) of the NDPR requires all personal data to be protected from security hazards and breaches such as theft, cyberattack, viral attack, etc.

These regulations further prescribe enforcement action such as discovery, civil and criminal proceedings. All data controllers, as defined by the NDPR, must adopt security measures, including but not limited to protecting systems from hackers, setting up firewalls, storing data securely with access to specifically authorised individuals, employing data encryption technologies, developing an organisational policy for handling personal data (and other sensitive or confidential data), protecting email systems and continuous capacity building for staff.

Further, regulatory agencies in different sectors realised the need to adopt measures to govern cybersecurity in their various sectors, modified to suit sectoral peculiarities. For example, the Central Bank of Nigeria passed Guidelines for Deposit Money Banks 2019, which promote safe practices to ensure cybersecurity for banks and payment service providers, and a Risk-Based Cybersecurity Framework.

In recent times, NITDA has actively engaged in investigation and enforcement campaigns against cybersecurity breaches.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

A Cybercrime Act, passed in 2015, created specific criminal offences prohibiting conduct ranging from cyberstalking, the unauthorised access of information and trading in stolen information. It also imposed an obligation on financial institutions to verify the identities of their customers, through documentation, before validating any online transaction.

Law enforcement agencies such as the police and the Economic and Financial Crimes Commission are active in the fight against cybercrime and often collaborate with law enforcement agencies in other countries, such as Interpol, to repatriate stolen funds held by Nigerians in other jurisdictions.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Nigerian criminal law has no general extraterritorial effect. Nigeria is a monist state by virtue of the 1999 Constitution, the application of which is limited to individuals and corporations in Nigeria.

However, as has been determined in certain cases, if an offence is committed outside Nigeria but part of the offence is committed in Nigeria, the courts are vested with jurisdiction to try the matter, subject to applicable conflict of laws principles.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

By virtue of the Extradition Treaty 1984 between Nigeria, Togo, Ghana and Benin, the Extradition Act, 1965, Part II, No. 18 Order, 1984 (a multilateral international convention) and the Nigerian Extradition Act, Nigeria is obliged to engage in cross-border investigations. However, the implementation of treaties and conventions is hampered by weak collaborative efforts by countries, uncoordinated state security agencies, and restrictions on the type of data that can be collected or transferred out of jurisdiction, among other things.

Despite the treaties with other countries, no significant progress has been recorded.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

By virtue of the 1999 Constitution, persons cannot be tried for an offence of which they have previously been convicted or acquitted by a competent court. However, it is doubtful whether this provision can avail a corporation that is not incorporated or carrying on business in Nigeria.

If the company is incorporated in Nigeria, it must have been a party to be able to take advantage of the provision. Furthermore, a deferred prosecution agreement does not amount to an acquittal or conviction.

There is currently no similar policy on the coordination of corporate resolution penalties in Nigeria.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements are not common in Nigeria. Companies that have issues in other jurisdictions may have to resolve those issues relating to the same misconduct separately in Nigeria if that misconduct constitutes an offence or a crime in Nigeria.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

Decisions of foreign authorities on an investigation of the same matter in Nigeria are considered merely persuasive. Nigerian authorities are not bound by the decisions of foreign authorities on an investigation of the same matter.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Economic sanctions enforcement includes trade embargoes, seizure or forfeiture of assets, expropriation of assets and nationalisation of assets.

Expropriation of assets is the seizure of property by the government or a change to existing private property rights usually for public benefit, whereas the nationalisation of assets is the process of transforming privately owned assets into public assets by bringing them under the public ownership of a national government or state.

Forfeitures are common in Nigeria though hardly abused by authorities. In June 2022, the Federal High Court ordered the final forfeiture and confiscation of landed property worth 1 billion naira. Also, the Federal High Court recently froze 157 accounts on alleged diversion of funds.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Economic enforcement sanctions commonly in use include trade embargoes, the seizure or forfeiture of assets, expropriation of assets and nationalisation of assets.

There has been a recent increase in sanctions enforcement activity in recent years. Statistically, about 6 billion naira and 30 real estate assets were seized between March and June 2022.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

The Economic and Financial Crimes Commission (EFCC) is currently in partnership with agencies outside the country for enforcement in a bid to combat economic and financial crimes in the country.

Interpol also collaborates closely with Nigeria’s other leading agencies, including the National Drug Law Enforcement Agency, the EFCC, Immigration Services, Customs, the National Agency for the Prohibition of Trafficking in Persons and the National Agency for Food and Drug Administration and Control.

Interpol supports the law enforcement agencies in Nigeria through the strengthening of information sharing and utilisation of the organisation’s database of global suspects. Nigeria has no sanctions programme and tends to be the subject of sanctions imposed by foreign governments, rather than a jurisdiction that imposes sanctions.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

We are not aware of any blocking legislation in Nigeria in relation to the sanctions measures of third countries.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Nigeria is yet to enact any blocking legislation.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct in Nigeria usually arise through whistleblowing, internal audits, compliance and media reports. A matter of concern that arises from whistleblowing, however, is the victimisation and dismissal of whistleblowers from reported corporations.

In a recent incident, a non-teaching employee was threatened and ultimately sacked for exposing corruption at a popular college of education. Further, an employee’s employment was terminated for exposing corruption at an embassy in Nigeria.

Another concern that arises with media reports is that companies may engage a media house to release a contrary narration in the media to contradict an allegation of misconduct, hence diluting the truth.

Furthermore, in the case of compliance, compliance agencies rarely maintain accurate data and records of misconduct and investigations.

Information gathering

22 Does your country have a data protection regime?

The National Information Technology Development Agency (NITDA) issued the Nigerian Data Protection Regulations (NDPR) in 2019. These are the principal regulation and framework for data protection in Nigeria.

The NITDA also issued an Implementation Framework in 2020 in respect of the NDPR and Guidelines for the Management of Personal Data by Public Institutions in Nigeria to regulate personal data processing within public institutions.

The NDPR provide legal safeguards for the processing of personal data. Under the NDPR, personal data must be processed for a specific, legitimate and lawful purpose consented to by the data subject.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

The NITDA inaugurated an Administrative Redress Panel in 2019, which has the responsibility to hear, investigate and determine appropriate redress within 28 working days. However, only a small proportion of Nigerians know about the existence of the Administrative Redress Panel, its functions and how they can seek redress in the event of a data privacy breach.

NITDA’s Data Breach Investigation Team, also inaugurated in 2019, collaborates with the Nigeria police and other law enforcement agencies to investigate cases of alleged data breaches, among other things.

Furthermore, the most common mode of enforcement for an individual is through a complaint to NITDA (which often leads to investigations) or consequent litigation in a court of competent jurisdiction to seek redress for breach of data privacy.

The NDPR outlines fines for non-compliance with the NDPR based on the size of the company: a fine of 10 million naira or 2 per cent of annual gross turnover for the preceding year, whichever is greater, for controllers processing the data of 10,000 subjects; and a fine of 2 million naira or 1 per cent of gross turnover for the preceding year for controllers processing the data of fewer than 10,000 subjects.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

Prominent data protection issues in an internal investigation are the frequent cyberattacks on corporate websites and phishing. This is aside from the prevalent rates of processing and access to employee data and information without first obtaining consent.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

The NDPR is silent on the interception of employees’ communications. However, the Cybercrime Act’s provisions, though general and not specific, provide that all employees in both the public and private sectors must relinquish or surrender all codes and access rights to their employers immediately upon disengagement from their employment. Failure to do so attracts punitive measures.

The 1999 Constitution guarantees the right of citizens to private communications in their homes, correspondence, telephone conversations and telegraphic communications.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Search warrants or dawn raids on companies are a feature of law enforcement although they are rarely used in Nigeria. A search warrant is usually issued by a magistrate or a justice of the peace. The law enforcement authority must show that there are reasonable grounds to believe the search will provide evidence that a crime has occurred or is likely to occur.

The search warrant must be executed in the presence of two witnesses, and the person to whom the search warrant is addressed may also provide a witness within the neighbourhood. Where the law enforcement authority executes a warrant in the absence of sufficient witnesses, a court may preclude admitting or using any evidence illegally or improperly obtained during court proceedings.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Privileged materials can be lawfully protected from seizure during a dawn raid or in response to a search warrant by interlocutory or anticipatory orders.

Courts have a general power to grant injunctions in all cases in which it appears to the court to be ‘just and convenient’. Nigerian courts have been known to issue injunctions to restrain or compel the performance of an act.

Privilege may also be used to protect or preserve the subject matter of the suit in the event of imminent harm.

At the request of a party, the court may exercise its discretion based on certain conditions, including balance of convenience, imminent harm to the res (i.e., an asset or object that is the subject of a suit of dispute) or if there is an undertaking from the applicant.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

The Evidence Act regulates the competence and compellability of a witness. An individual’s testimony can be compelled by way of subpoena or witness summons. The failure of a witness to honour a court summons may amount to contempt of court, for which the witness may be tried and convicted.

In Nigeria, certain privileges can prevent an individual from providing testimony, including the attorney–client privilege, spousal privileges and diplomatic privileges.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Nigeria currently has no comprehensive whistleblowing legislation. There are several bills before the National Assembly, however, that aim to regulate the receipt and investigation of wrongdoing in the public sector, as well as the protection of whistleblowers from reprisals and other adverse actions.

Also, there is sector-specific whistleblowing legislation, including the Whistle Blowing Guidelines for Pensions, 2008, and the Code of Corporate Governance for Banks and Discount Houses in Nigeria, among others.

In the absence of whistleblowing legislation, the Federal Ministry of Finance has set up a whistleblowing programme designed to encourage members of the public to report any violation of financial regulations, mismanagement of public funds and assets, financial malpractice, fraud and theft.

Also, the Investments and Securities Act, 2007 provides that an employee of a capital market operator or public company shall have the right to disclose any information connected with the activities of the workplace that tends to show that a criminal offence has been, is being or is likely to be committed or that a person has failed, is failing, is likely to fail or has otherwise not complied with any legal obligation.

Furthermore, the Financial Reporting Council of Nigeria issued the Nigerian Code of Corporate Governance enacted in January 2019. The Code provides comprehensive guidelines for the protection of whistleblowers in the private sector.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Generally, rights are afforded to an employee under local employment laws if their conduct is within the scope of an internal or external investigation. However, under the 1999 Constitution, the guarantee of every person to a fair hearing (which in itself subsumes or associates with other rights such as the right against double jeopardy, the right against self-incrimination, the right to defend oneself personally or through a legal practitioner, etc.) is available to employees under investigation.

Similarly, save when there are express provisions creating the liability of officers or directors in a contract of employment or company handbook, or under a specific statute, there are no liability-limiting protections afforded to an employee under employment law. For example, under the Nigerian Data Protection Regulations, which regulate data privacy in Nigeria, a chief executive officer of the body corporate or any officer acting in that capacity or on behalf of an officer shall be liable for an offence committed by a body corporate or firm.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

The rights of an employee under employment law do not differ.

The steps an employer may take regarding an employee suspected of misconduct depends on the terms of the employment contract, the company’s handbook and its company policy. A company must grant the employee a fair hearing in line with the 1999 Constitution and any specific provisions in the employment contract. The company may suspend an employee who is suspected of misconduct, but the employee is entitled to be paid a salary or wages pending a recall to employment or dismissal. This is subject, however, to the provisions of the handbook and the contract of employment.

When investigations have been concluded, a company may dismiss an employee who is found guilty of the allegations and report the employee to the appropriate law enforcement authority.

An aggrieved employee reserves the right to seek redress in a competent court.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

An employee may be dismissed for refusing to participate in an internal investigation if that refusal amounts to a breach of a contract of employment.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

There is no law to our knowledge that stipulates the need for a document setting out the terms of reference or investigatory scope before commencing an internal investigation. However, as a matter of common practice, companies issue an employee handbook as a manual to be used as a valuable communication resource for both the employer and the employees. A typical handbook includes a summary of ascertained facts, the objectives and scope of an investigation, the procedures for the conduct of the investigation and any limitations that there may be in carrying out the investigation.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

When a company becomes aware or engages in an issue prior to the authorities becoming aware or engaged, there are no clearly defined steps that a company must take. Any action to be taken is solely at the discretion of the company. However, a company should rectify the issue to protect itself from criminal liability or any liability from the appropriate authorities.

Under the Nigerian Data Protection Regulations (NDPR), data subjects, civil societies or professional organisations may report a breach of the Regulations to the National Information Technology Development Agency (NITDA) through the relevant advertised channels. Further, a data controller has a duty to report personal data breaches to NITDA within 72 hours of knowledge of the breach or immediately if the personal data breach is likely to result in high risks to the freedom and rights of the data subject.

Furthermore, a company can engage external solicitors for advice on conducting internal investigations.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

When a subpoena or notice is served on a company by a law enforcement authority, the company may adopt one of two procedures.

First, on receipt of a subpoena or notice, the designated officers of the company are informed. The notice or subpoena may then be passed to the legal department for advice.

Alternatively, a company may call a board meeting with the subpoena or notice as one of the matters to be discussed and make a resolution about it. Thereafter, the subpoenaed documents will be gathered for onward submission to the relevant law enforcement entity.

If a notice or subpoena has been improperly issued, an application may be filed to set it aside. However, if the notice or subpoena was properly issued, the appropriate authorities must be provided with the relevant documents.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Private companies are not required to publicly disclose the existence of an internal investigation or contact from a law enforcement authority. However, Rule 187 of the Securities and Exchange Commission’s Rules and Regulations makes it mandatory for a public company to disclose any information likely to affect the financial condition of a company and disclose the same on the trading floor immediately after the information is available.

37 How are internal investigations viewed by local enforcement bodies in your country?

Internal investigations are welcome by local enforcement bodies. Under the NDPR, the requirements for internal investigation include notification of the breach to the relevant agency. Where it is a data breach, the notification to the law enforcement agency should contain the following:

• description of the circumstances of the loss or unauthorised access or disclosure;
• date or period during which the loss occurred;
• description of the personal information involved in the loss or unauthorised access;
• assessment of the risk of harm to individuals;
• description of steps the organisation has taken to reduce the risk of harm; and
• name or contact details of a person who can answer on behalf of the organisation.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

The attorney–client privilege may be claimed over any aspect of an internal investigation where a legal practitioner has been engaged by the client and obtains or receives the company’s information in the course of and for the purpose of employment as a legal practitioner.

The Rules of Professional Conduct for Legal Practitioners impose a duty on legal practitioners not to disclose or reveal any information obtained in the course of employment. However, where such information is disclosed with the consent of the client or the disclosure is permitted under the relevant rules or law, there is no attorney–client privilege.

A company can protect the privilege or confidentiality of an internal investigation in any of the following ways:

• Identifying the purpose of the internal investigation: A company should record the purpose of the investigation and reflect it in all correspondence and interviews conducted.
• Involving a lawyer at each stage of the investigation: The best practice is for a lawyer to plan the investigation, coordinate document collection, lead witness interviews and oversee reports.
• Informing witnesses of the purpose of the investigation: A company’s claim to privilege or confidentiality is strongest when employees are informed at the beginning of the interview about the purpose of the investigation and the need for confidentiality.
• Marking communications: All communications to or from counsel in connection with an investigation must be marked or labelled appropriately.
• Considering retaining external counsel: For an added layer of protection, external counsel should be involved in any sensitive investigation.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

The Evidence Act and the Rules of Professional Conduct provide that the key principles or elements of the attorney–client privilege in Nigeria as it relates to corporations are:

• there is communication;
• the communication must be made between privileged persons;
• the communication must be made in confidence; and
• the communication must be to seek, obtain or provide legal assistance to the client.

A legal practitioner may not, except with the consent of the client, (1) disclose communications made in the course and for the purpose of employment as a legal practitioner by or on behalf of the client, (2) state the contents or condition of any document with which the practitioner has become acquainted in the course and for the purpose of professional employment, or (3) disclose any advice given to the client in the course and for the purpose of the employment. A legal practitioner is the holder of this privilege.

There is no difference when the client is an individual.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

The attorney–client privilege applies equally to in-house and external counsel. The Evidence Act does not distinguish between the categories of legal practitioners that are bound by the attorney–client privilege. Further, the Legal Practitioners Act defines a legal practitioner to include barristers and solicitors.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

The legal privilege in the Evidence Act and the Rules of Practitioners Conduct is only applicable to a legal practitioner called to the Nigerian Bar. However, courts are now enjoined to apply foreign laws that grant privilege to foreign in-house counsel.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

We are not aware of any instance when the attorney–client privilege as a co-operative step has arisen.

There are situations in which the waiver of privilege is mandatory. A legal practitioner may waive attorney–client privilege where:

• the confidence or secret is necessary and permitted under the rules or required by law;
• the intention of the client was to commit a crime, and the information was disclosed to the law enforcement agency by a legal practitioner to prevent the crime;
• the confidence or secret is necessary to establish or collect the practitioner’s fee or to defend the practitioner or the practitioner’s employees or associates against an accusation of wrongful conduct.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

Although the concept of limited waiver of privilege exists, it is not commonly practised in Nigeria. Typically, limited waiver of privilege arises when a company enters into an agreement with a third party and the agreement stipulates the extent to which either party may waive that privilege and should be able to require parties to maintain confidentiality about further disclosures.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Yes, if the information is treated as privileged information by Nigerian law.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

The concept of common interest privileges is unknown to Nigerian law.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Third parties can claim privilege on the assistance given to lawyers if they are agents of the client. They are bound by the same obligations as the lawyer based on the principle of agency.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes, Nigeria permits the witnesses to be interviewed as part of an internal investigation.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Yes. Communications made or evidence obtained in anticipation of litigation during internal witness interviews and attorney reports are deemed privileged.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

There are no special legal or ethical requirements or guidance to be adhered to during an interview of an employee as a witness, as applicable to employees. However, there are general principles enshrined in the 1999 Constitution to protect an employee’s right to a fair hearing, adequate representation and fair trial, which shall be available to an employee in these circumstances.

The requirements are no different when interviewing third parties.

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

There is no prescribed way of conducting an internal interview in Nigeria. The way in which an internal interview is conducted is determined by the internal policies and procedures of the company.

Documents are put to witnesses if they are relevant to the investigation.

It is not mandatory for employees to have legal representation at an interview. However, the option for the same should be provided to employees.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Certain types of conduct must be reported to law enforcement authorities, including money laundering, mismanagement of funds, and such other types of conduct as prescribed under the Money Laundering Act, the Economic and Financial Commissions Act and the Corrupt Practices and Other Related Offences Act, 2000 (in respect of reporting the solicitation of bribes).

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Under the Nigerian Data Protection Regulations, a company has a duty to report personal data breaches to the National Information Technology Development Agency within 72 hours of knowledge of such a breach. Also, if the personal data breach is likely to result in high risks to the freedom and rights of the data subject, the company is obliged to self-report to the relevant law enforcement agency.

53 What are the practical steps needed to self-report to law enforcement in your country?

The practical steps to self-report to law enforcement will depend on the nature of the violation. If the violation is a data breach, the notification to the law enforcement agency should contain the following:

• description of the circumstances of the loss or unauthorised access or disclosure;
• date or period during which the loss occurred;
• description of the personal information involved in the loss or unauthorised access;
• assessment of the risk of harm to individuals;
• description of steps the organisation has taken to reduce the risk of harm and;
• name or contact details of a person who can answer on behalf of the organisation.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

If a subpoena or notice is served on a company by a law enforcement authority, the company may adopt one of two procedures.

First, on receipt of a subpoena or notice, the designated officers of the company are informed. The notice or subpoena may then be passed to the legal department for advice.

Alternatively, a company may call a board meeting with the subpoena or notice as one of the matters to be discussed and make a resolution about it. Thereafter, the subpoenaed documents will be gathered for onward submission to the relevant law enforcement entity.

If a notice or subpoena has been improperly issued, an application may be filed to set it aside. However, if the notice or subpoena was properly issued, the appropriate authorities must be provided with the relevant documents.

It is possible to enter into a dialogue with the relevant authority before or after charges are brought. A company can enter into dialogue with the law enforcement authority where it is a notice or executive subpoena. However, discretion on dialogue rests with the relevant authority. Once a charge has been brought, the dialogue would require the intervention of the court.

55 Are ongoing authority investigations subject to challenge before the courts?

Ongoing authority investigations are subject to challenge before the courts. The aggrieved party can file the necessary application seeking relief to halt the ongoing authority investigations under certain conditions.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

If a subpoena or notice is served on a company by a law enforcement authority, the company may adopt one of two procedures.

First, on receipt of a subpoena or notice, the designated officers of the company are informed. The notice or subpoena may then be passed to the legal department for advice.

Alternatively, a company may call a board meeting with the subpoena or notice as one of the matters to be discussed and make a resolution about it. Thereafter, the subpoenaed documents will be gathered for onward submission to the relevant law enforcement entity.

If a notice or subpoena has been improperly issued, an application may be filed to set it aside. However, if the notice or subpoena was properly issued, the appropriate authorities must be provided with the relevant documents.

It is possible to enter into a dialogue with the relevant authority before or after charges are brought. A company can enter into dialogue with the law enforcement authority where it is a notice or executive subpoena. However, discretion on dialogue rests with the relevant authority. Once a charge has been brought, the dialogue would require the intervention of the court.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

Upon receipt of a notice or subpoena, a company is obliged to produce materials relating to a particular matter that crosses borders. Some of the difficulties encountered by the company include the differences in access to information, data transfer and privacy control. Another challenge in the production of the material is the difference in multi­lingual documentation and the associated cultural and language differences.

When complying with such a request will have the effect of processing the data of residents of other jurisdictions, requisite consent from law enforcement authorities must be obtained.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Law enforcement agencies routinely share information or investigative materials with law enforcement in other countries for public security reasons and the safety of lives and properties.

This is based on treaties, conventions or agreements entered into formally or informally by Nigeria with other friendly countries. The framework comprises treaties such as the Extradition Treaty 1984 between Nigeria, Togo, Ghana and Benin, the Extradition Act, 1965, Part II, No. 18 Order, 1984 (a multilateral international convention) and the Nigerian Extradition Act.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Law enforcement authorities have a confidentiality obligation in relation to information received during an investigation. Under the Freedom of Information Act, and other statutes, a law enforcement agency, being a public institution, may deny an application for any information that unavoidably discloses the identity of a confidential source or if the information is privileged, proprietary and confidential. Third parties are also under this obligation if they have received information from law enforcement authorities for the performance of a public duty that the law enforcement agencies cannot execute directly.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

A subpoena or notice is a document compelling the addressee to do a particular act. Hence, we would advise the company that has received a request from a law enforcement authority seeking documents to immediately proceed to court to set aside the subpoena on the basis that the production would violate the laws of the other country.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Nigeria has an Official Secrets Act enacted in 1965 aimed as a check against the publication of highly confidential information or documents that may threaten the security of the state.

Also, the 1999 Constitution provides for a right to the privacy of homes, phone conversations and telegraphic communications.

Nigeria does not have a blocking statute.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

The main risk is that the complete privacy of the materials produced to the authority cannot be guaranteed.

The materials may be accessed by third parties under the Freedom of Information Act.

There are no confidentiality rules attached to production to law enforcement in Nigeria. However, law enforcement agencies are usually unwilling to disclose or share information with non-official bodies except for security purposes or when compelled to do so by a court order.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

The penalties for companies are fines, winding up of the company and forfeiture of assets. Directors and officers are subject to imprisonment, debarment, fines, forfeiture and performance of community service for a number of months or years.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

There is no formal framework restricting a corporate that is suspended, debarred or restricted in Nigeria from settling in another country based on the principle of sovereignty of the other country.

65 What do the authorities in your country take into account when fixing penalties?

The authorities consider the gravity of the offence, the punishment prescribed by law, the health status of the defendant, the first offender status, the interests of the public and other mitigating circumstances.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

There are no provisions for non-prosecution agreements or deferred prosecution agreements for corporations in Nigeria.

Non-prosecution or deferred prosecution agreements are not frequently used.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

There is no clear formal framework for reporting restrictions or anonymity for corporates that have entered into non-prosecution or deferred prosecution agreements. However, the Witness Protection and Management Act, 2022, generally provides for the safety and welfare of witnesses who provide information, evidence or any other form of assistance to the relevant agency.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

The considerations that companies should be aware of include the amount of the settlement, tax implications, confidentiality against third parties, and whether the settlement amounts to the final disposal of the matter, among other things.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

The Federal Inland Revenue Service, the Federal Reporting Council and the Corporate Affairs Commission rely on externally audited financial statements from licensed accountants for publicly listed companies.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Parallel private civil actions are allowed provided the cases are not similar in subject matter or the relief sought.

In criminal actions, cases are handled by the state and not private individuals, except where the private individuals obtain a fiat from the chief judge of the state in question.

Generally, private individuals do not gain access to the authorities’ files. However, where such an individual has obtained the fiat of the chief judge, the private individual will have access to the authorities’ files, although the right of access is limited to the scope of the fiat granted by the chief judge.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

The 1999 Constitution guarantees the freedom of speech and expression by extension of the right to criminal publicity, if the publicity is not reasonably determined or likely to impugn the fair trial of the suit.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

The first step in managing corporate communication is to identify and prioritise the company’s goals while developing a strategy in line with the same. The strategies for managing corporate communications include using press releases, or other official statement delivered to members of the news media to provide information, issuing an official statement or making an announcement directed for public release, and disclaimers (i.e., statements of information that help limit legal liability).

Companies rarely use public relations firms to manage a corporate crisis in Nigeria.

73 How is publicity managed when there are ongoing related proceedings?

Public (or media) interest in ongoing proceedings is covered by Nigeria’s print and electronic media. Proceedings in court are open and public except where the proceedings border on defence or security cases.

Records of proceedings are also accessible to the public upon an application made by the interested party; however, proceedings may not be available where the proceedings relate to cases of a public or sensitive nature.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Public quoted companies are mandated under the rules of the Securities and Exchange Commission to disclose to the Commission all information likely to affect the financial condition of the company.

Also, the Corporate Affairs Commission makes it mandatory for companies to disclose to the Commission all information likely to affect the company.

Environmental, social and corporate governance (ESG)

75 Does your country regulate ESG matters?

We are not aware of any law that specifically addresses ESG matters. However, owing to its global significance, ESG principles are now gradually influencing laws and regulations, including the Companies and Allied Matters Act, 2020, the Federal Competition and Consumer Protection Act, 2018 and the Petroleum Industry Act, 2021. These statutes impose reporting obligations on directors and shareholders for filing directors’ and shareholders’ returns, and regarding change of ownership structure, among other things. There are current demands by various stakeholders for a codified law that specifically applies to ESG-related matters.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

We are of the opinion that with the growing sensitisation and the new wave ushered in by ESG, regulators, policymakers, governments and organisations are keen on the codification of a law to govern and regulate ESG in Nigeria.

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

There have been various litigations on ESG-related issues, particularly environmental. Nigeria is a major oil-producing state; thus, several multinational companies carry on business in mining, extraction and similar activities. This has resulted in a major increase in oil spillage and water pollution in rural communities.

Hence, companies have been subjected to class actions and suits because of the damage caused to the commodities in the course of oil extraction.

On 15 August 2021, Royal Dutch Shell, one of the world’s six ‘super major’ oil companies, announced that it will pay 45.9 billion naira to settle a decades-long legal dispute concerning an oil spill that occurred during the Biafran–Nigerian Civil War.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

We expect that, in the coming years, there will be new sectoral corporate misconduct regulations aimed at curbing and addressing misconduct in conformity with inter­national standards.

Also, there will be a more enabling environment for collaboration between regulatory and law enforcement agencies to minimise corporate misconduct.

Footnotes