United States: Avoiding Common Pitfalls When Cooperating with Government Investigations

In summary

Before opening a dialogue with the government, defence counsel and defendants should ensure that they understand the potential risks as well as the possible rewards of cooperation with the US government, and that they are clear about regulators’ expectations and are prepared to meet those expectations.

Discussion points

• Making timely disclosures and maintaining responsiveness in cooperation must be carefully balanced with providing accurate and complete information and avoiding missteps
• Companies should implement policies governing the messaging tools used by employees
• Data privacy restrictions that may impede document or information sharing should be raised for discussion with US regulators as early as possible
• Investigation targets should ensure joint defence agreements provide clear procedures for withdrawal and transparent standards that preserve flexibility
• When reporting facts to the government, companies should aim to provide ‘detail-free conclusions’ to interview subjects, without attribution of those facts to particular witnesses
• The increased reliance on remote, virtual testimony presents additional unique challenges for companies and individuals seeking cooperation credit

Referenced in this article

• US Department of Justice, Justice Manual
• US Securities & Exchange Commission, Enforcement Manual
• US Commodity Futures Trading Commission, Enforcement Manual
• US Department of Treasury, OFAC Enforcement Guidelines

For better or worse, cooperation with the government has become the most reliable way for companies under criminal or regulatory investigations to obtain leniency. Indeed, for many companies, a fight with the government is simply too costly to be a real option, so they are left with mitigation defences like claims of cooperation. Many US governmental enforcement agencies have published guidelines outlining the steps that defendants must take to earn cooperation credit, with the goal of either avoiding prosecution or minimising penalties. And it often seems simple enough: follow the guidelines and cooperation credit will follow. In practice, however, it can be all too easy to run afoul of the guidelines and risk losing the leniency that otherwise may have been earned.

Overview of cooperation guidelines

Many US enforcement agencies have issued guidelines for evaluating cooperation, with some even providing specific guidance in determining the leniency that should be afforded on a sliding scale of credit for cooperation efforts. These guidelines tend to be relatively similar in application and generally provide for extraordinary potential benefits, including lesser charges, lower penalties or even a decision not to pursue enforcement at all. While this chapter cannot discuss all of the US enforcement agencies that may have issued cooperation guidance, the following section highlights guidance issued by some of the most active enforcement agencies.

US Department of Justice

The Department of Justice Manual (Justice Manual), which is intended as a guide to federal prosecutors, provides a list of ten factors, including cooperation, that prosecutors are meant to consider when determining whether to prosecute a company.^[1] Key to obtaining cooperation credit is that the company must disclose ‘all relevant facts’ regarding the conduct of ‘all individuals’ (including employees and other agents) who were ‘substantially involved’ in the misconduct.^[2] While there has been substantial fluctuation over the past decade in how fulsome disclosures must be to warrant cooperation credit, since 2018 the Department of Justice (DOJ) has applied a sliding scale that generally considers whether a company has provided all non-privileged information and identified all of the individuals who were significantly involved in or caused the criminal conduct.^[3]

Securities and Exchange Commission

The Securities and Exchange Commission’s (SEC) primary guidance on entity cooperation explains that the commission evaluates four broad measures including self-policing, self-reporting of the misconduct, remediation (including dismissing or disciplining wrongdoers, and modifying and improving internal controls) and cooperation with law enforcement authorities (including providing SEC staff with all information relevant to the underlying violations and the company’s remedial efforts).^[4]

Commodity Futures Trading Commission

The Commodity Futures Trading Commission (CFTC) has issued several forms of guidance on the subject of cooperation, including recently issued guidelines for the calculation of monetary penalties.^[5] To receive credit, companies must provide cooperation to the CFTC that is ‘sincere, robustly cooperative and indicative of a willingness to accept responsibility for the misconduct, where appropriate’.^[6] A key factor is whether the company has outlined findings and relevant evidence regarding the misconduct and produced ‘full and complete reports of any internal investigations’ to the staff. These should include the identities of individual wrongdoers and culpable senior executives inside and outside of the company, and all relevant facts about individual wrongdoers, including relevant communications, documents and data.^[7] Also, while cooperation can be an important mitigating factor when it comes to calculating a penalty, a failure to fully cooperate potentially may be used as an aggravating factor.

US Department of Treasury, Office of Foreign Assets Control

The Office of Foreign Assets Control’s (OFAC) Enforcement Guidelines have been codified under the agency’s implementing regulations.^[8] Like other agencies, OFAC considers the ‘nature and extent’ of a company’s cooperation in determining its enforcement approach – which can range from a non-public, no action letter to steep financial penalties. OFAC does not limit the factors that it will consider in evaluating cooperation, but specifically identifies the following as critical factors:

• voluntary self-disclosure;
• provision of ‘all relevant information’;
• whether the company has conducted an investigation sufficient to identify, disclose and remediate other, similar violations;
• whether documents were provided voluntarily or in response to a subpoena;
• timeliness of responses; and
• whether the company agreed to toll the statute of limitations as to the violations at issue if requested by OFAC.^[9]

Hazards when preserving and producing documents

One of the greatest benefits of cooperation for the government is the ability to obtain relevant documents on a voluntary basis. However, the government expects cooperators to adhere to the same standards as in compelled production, including with regard to preservation and collection protocols and evaluating the legal basis for redacting or withholding documents.

Preservation challenges

When a company learns that it is subject to an investigation, one of the first steps it needs to take is to issue a litigation hold and preservation notice to stop the destruction of documents and suspend routine short-term document retention policies. Failure to do so could upend all of the hard work that a company otherwise takes to cooperate with an investigation.

Document preservation often is easier said than done. Identifying all sources of paper documents (in the office, outside the office and in archive storage) is challenging enough. Locating all sources of electronically stored information (ESI) (including electronic communications, audio communications, archived servers, data logs, ephemeral messages, text messages located only on individual phones, chats on social messaging platforms, among others) can be a herculean effort in a decentralised, global organisation.^[10] It is critical to issue detailed hold notices swiftly, survey all relevant individuals as to the devices and messaging tools they use, interview the IT department to ascertain all relevant sources of data and obtain timely confirmations (preferably in writing) that document destruction for all in-scope ESI has been suspended.

Ephemeral messaging tools

Ephemeral messaging tools (where messages are automatically deleted either after they are read or after a set period of time) are being used more frequently nowadays. These include messaging applications such as WhatsApp, Signal, Slack and Snapchat. Many businesses use these applications for a variety of reasons, but they can be particularly problematic when it comes to preserving information during an investigation. Others prohibit the use of such tools but prohibition is not uniformly honoured in practice by employees.

Recently, the DOJ has focused increasingly on whether companies are effectively preserving information transmitted through ephemeral messaging. For example, the DOJ’s Foreign Corrupt Practices Act Corporate Enforcement Policy (DOJ’s FCPA Policy) ties remediation credit to:

prohibit[ing] the improper destruction or deletion of business records, including implementing appropriate guidance and controls on the use of … ephemeral messaging platforms. ^[11]

To avoid missteps, companies should implement policies governing the messaging tools used by employees, including when and how to preserve messages communicated through them, so that appropriate action can be taken swiftly to preserve information transmitted through such applications in the event of an investigation. Indeed, the DOJ’s FCPA policy is the reason many companies simply ban the use of these tools.

Data privacy restrictions

Restriction on the disclosure of personal and sometimes even corporate information under foreign data privacy laws is a hurdle frequently encountered in the context of cooperation in cross-border investigations. It is common to encounter data privacy restrictions in foreign jurisdictions that limit the ability to share documents and information with US regulators. Nevertheless, US regulators often view such limitations sceptically. For instance, the DOJ’s FCPA Policy provides that:

Where a company claims that disclosure of overseas documents is prohibited due to data privacy, blocking statutes, or other reasons related to foreign law, the company bears the burden of establishing the prohibition. Moreover, a company should work diligently to identify all available legal bases to provide such documents. ^[12]

Likewise, guidance recently issued by the DOJ regarding ‘Evaluation of Corporate Compliance Programs’ cautions prosecutors to press companies under scrutiny to support claims as to foreign law restrictions and to identify solutions that avoid impeding corporate compliance.^[13] This reference is aimed squarely at limiting companies’ ability to invoke foreign data privacy laws to restrict information sharing across borders, both within their organisation and with US regulators.

Cooperation can become strained where protected foreign-origin documents or information are implicated. To avoid missteps and mistrust, companies cooperating in cross-border investigations should ensure that they have advice from data privacy counsel in each implicated jurisdiction. This advice should be pressure tested because US enforcement agencies often are sceptical of interpretations of foreign data privacy laws that seem sweeping or are not informed by local regulatory guidance and enforcement examples. Any restrictions that may impede document or information sharing should be raised for discussion with US regulators as early as possible in the investigation and solutions such as redactions or alternative sources of similar information should be presented as well.^[14]

Attorney–client privilege and work-product protections

To earn cooperation credit, corporations must disclose the facts relating to potential legal violations that they uncover through internal investigations. Such disclosures, however, often seem in tension with the confidentiality requirements of the attorney–client privilege and the attorney work-product doctrine. US agencies generally do not require a corporation to waive the attorney–client privilege or work-product protection over its internal investigative files to receive cooperation credit.^[15] In practice, however, it can be difficult to satisfy fully the criteria for cooperation without risking a waiver of those protections – especially where the facts were gathered through privileged communications and memorialised in attorney work-product. The consequences of a waiver can be severe where communications and materials may be subject to discovery by private litigants in related civil litigation.

Companies seeking cooperation credit often will provide the government summaries of privileged interviews conducted by counsel and work product prepared by or for counsel. In those circumstances, some courts have rejected a defence counsel’s attempts to protect the privilege from subsequent challenges by relying on alternatives to outright disclosure of privileged material that nevertheless provide the same information. For example, several courts have found that where counsel provided the government oral downloads of interview memoranda, the disclosure was functionally equivalent to a waiver vis-à-vis third parties.^[16]

Similarly, defence counsel may try to protect disclosures by entering into written selective waiver agreements with the government providing that a waiver of privilege as to the government is not intended to waive the privilege as to third parties.^[17] Most courts, however, have been reluctant to uphold those types of agreements, often finding that the government and the company were adversaries in the investigation and therefore did not share a common interest necessary to support such an agreement.^[18]

To guard against such waivers, when reporting facts to the government, companies should aim to provide ‘detail-free conclusions’ or ‘vague references’ to interview subjects, without attribution of those facts to particular witnesses.^[19] When necessary, rather than providing a detailed summary of witness interviews, counsel can suggest witnesses the government might want to consider interviewing. Further, counsel should avoid providing or even showing slide decks or other handouts in presentations to the government, unless they are prepared to waive the privilege or are confident that the jurisdiction will uphold a selective waiver and the company has entered into a confidentiality agreement with the government.

Redactions

Redaction is a critical tool to facilitate cooperation in circumstances where data privacy restrictions or privilege considerations limit the documents that can be shared. While voluntary production in the context of cooperation can take on a relatively informal tone, redaction of documents produced to the government should be approached carefully. Errant, unmarked or inappropriate redactions can generate distrust and lead to loss of cooperation credit if the government views them as ‘misleading’ or ‘material omissions’ that may be intended to impede the investigation.^[20]

Maintaining a detailed document production and privilege log can be an important control in this regard. Even in small productions, to the extent that redactions are made, it may be prudent to provide a redaction log to enforcement counterparts identifying and supporting each redaction. This practice ensures a contemporaneous record to avoid allegations of undisclosed omissions. Moreover, maintaining a log of this nature encourages evaluation of the substantive basis given for each redaction (eg, attorney–client communication; personal information protected by data privacy restrictions), ensuring that redactions are well-founded and clearly explained to avoid misunderstandings.

Challenges when coordinating with other parties

US regulators often seek information from numerous parties with varied roles in the underlying events under investigation, and parties may find efficiencies in coordinating and sharing information.

Conflicts of interest

When a company faces a government investigation involving one or more individual current or former directors, officers or employees, company counsel must consider whether the same counsel can represent the individuals or whether they will need separate counsel. There are many reasons the company and any individuals may wish to have the same counsel.^[21] But there are circumstances in which it may be either unwise or improper to have the same counsel represent the company and one or more individuals. The most common and important reason for seeking separate counsel is when there is a present conflict of interest or the possibility for a conflict to arise between two potential clients. DOJ policy – which underscores the need for a company seeking cooperation credit to identify culpable individuals – heightens the burden on company counsel coordinating an internal investigation to do a careful conflicts analysis at the outset and to revisit conflicts issues periodically, so as to ensure separate representation of individuals who may have individual culpability or who may be witnesses but have evidence against others.^[22]

Where company counsel perceives a potential conflict between the company and an employee, the most prudent solution may be to recommend separate conflict counsel for the employee. If the employee has separate counsel, company counsel and conflict counsel can share information under a common interest arrangement, which maintains the privilege. Further, obtaining separate counsel for individuals may have the added benefit of conveying to government investigators that the company takes the investigation seriously and is trying to remain neutral and avoid influencing witnesses.

Joint defence agreements

Companies and individuals involved in a government investigation often enter into joint defence or common interest arrangements so they can share confidential information without destroying the attorney–client privilege. The common interest privilege is an exception to the general rule that the attorney–client privilege does not protect communications made to third parties.^[23] In order to qualify for protection, the communications must be confidential and otherwise privileged and must be shared with participants who have a common legal interest for the purpose of furthering that common interest.^[24]

While joint defence agreements can be helpful where parties facing a government investigation seek to pool resources and coordinate strategy, such arrangements also may create additional challenges where one or more participants seeks to cooperate with the government. To the extent the joint defence agreement is made orally, it may be unclear who controls the privilege. Generally, each party to the agreement may waive the privilege as to the use of their own communications, but one party cannot unilaterally waive the privilege for all the others.^[25] However, where the participants are an employer and employee, the company typically controls the privilege and the company has the right to disclose information received from the employee, but not vice versa.^[26]

Further, where one party withdraws from the joint defence agreement and cooperates with the government against another party, it may create untenable conflicts preventing counsel from continuing to represent their clients.^[27] Such agreements also may impede a cooperating defendant in its ability to provide information to the government that is implicated as part of the joint defence agreement. While DOJ guidance makes clear that ‘the mere participation by a corporation in a joint defence agreement does not render the corporation ineligible to receive cooperation credit,’ that same guidance also cautions that where a joint defence agreement prevents a company from providing some relevant facts to the government, it will ‘limit the company’s ability to seek . . . cooperation credit.’^[28] As the DOJ has suggested, investigation targets should tread cautiously in entering joint defence agreements, ensuring that such agreements provide clear procedures for withdrawal and set out transparent standards that preserve flexibility so as not to unduly limit the ability to make disclosures in the context of future government cooperation.^[29]

High hurdles to meeting government expectations for cooperation

Each US agency has its own expectations of companies and individuals in the context of cooperation but all agencies tend to set a high bar for affording prosecutorial leniency in exchange for cooperation and a relatively low bar for missteps that may diminish such credit.

Self-disclosure

For many regulators, voluntary self-disclosure is one of the most critical factors in awarding cooperation credit. The CFTC has made clear that, notwithstanding the other criteria, self-reporting before a CFTC investigation is under way is one of the most important drivers to a decision to award full cooperation credit.^[30] In that context, it bears noting that some regulators apply strict guidelines to determine whether a self-disclosure merits credit. For instance, OFAC guidance confirms that voluntary self-disclosure ‘generally will result in mitigation,’ but it defines such self-disclosure relatively narrowly. In particular, OFAC declines to afford self-disclosure credit under many circumstances including where the disclosure ‘is materially incomplete,’ where the facts were required to be reported to another regulator by the company or any third party (for instance, a bank with suspicious activity reporting requirements) or where OFAC or any other regulator pre-emptively ‘discovers the apparent violation or another substantially similar apparent violation.’^[31]

Independent investigation

In some instances, a company’s zealous efforts to cooperate with the government may go too far and ultimately risk undermining the government’s case. Recent case law underscores the potential pitfalls that can arise when a cooperating company’s internal investigation becomes so closely intertwined with a parallel government investigation that it appears as if the company has been an agent of the government – thereby implicating both the Fourteenth Amendment right to due process and the Fifth Amendment right against compelled testimony.^[32]

Companies should seek to mitigate this risk by taking steps to establish and document the independence of their investigation. In particular, before commencing an internal investigation, company counsel should memorialise the independent corporate reason for the investigation and document its scope, action plan and priorities – as distinguished from the government’s instructions and demands.

In addition, when appropriate, the company may seek to avoid the appearance of coercion by minimising the number of attorneys present and providing employees with counsel and information or documents before the interview. Moreover, if the company disciplines an employee for misconduct or for refusing to be interviewed, the company should ensure that the record reflects that the decision was based on its own assessment, rather than based on any direction from the government.

Balancing accuracy, completeness and timeliness

While it is tempting to provide quick answers to government investigators based on current knowledge in an effort to be helpful and establish that the company is providing full cooperation, these discussions need to be handled with care to avoid diminishing cooperation credit through material omissions or even raising questions regarding obstruction of an investigation.

US regulatory guidance sets high standards of accuracy, completeness and timeliness for obtaining credit for cooperation. While the DOJ encourages early voluntary disclosure and ‘does not expect that early disclosures would be complete . . . , the Department does expect that, in such circumstances, the company will move in a timely fashion to conduct an appropriate investigation and provide timely factual updates to the Department.’ ^[33] DOJ guidance also specifically instructs prosecutors to consider whether a company has made ‘representations or submissions that contain misleading assertions or material omissions’ or ‘incomplete or delayed production of records.’ ^[34] The DOJ’s FCPA Policy further confirms that the burden is on the company to demonstrate that disclosure was made ‘within a reasonably prompt time after becoming aware of the offence.’ ^[35]

Likewise, OFAC denies disclosure-related credit for disclosures that are ‘materially incomplete’ or contain ‘false or misleading information,’ and requires that disclosure ‘include, or be followed within a reasonable period of time by, a report of sufficient detail to afford a complete understanding of an apparent violation’s circumstances.’ ^[36] Also similar to the DOJ, OFAC directs enforcement decision-makers to consider whether a company has at any point engaged in an attempt ‘to hide or purposely obfuscate its conduct in order to mislead OFAC, federal, state or foreign regulators, or other parties involved in the conduct about an apparent violation.’ ^[37]

The desire to make timely disclosure and maintain responsiveness in cooperation must be balanced carefully against the need to provide accurate and complete information and, above all, to avoid missteps that may be characterised by the government as obstructing an investigation. To avoid this, cooperating companies should be scrupulously transparent about document and information gathering protocols and limitations thereon, as well as any reservations about the accuracy or completeness of information being provided.

18 United States Code Section 1001

Misstatements and omissions can have consequences even more dire than loss of cooperation credit. Under 18 United States Code Section 1001, it is a felony to knowingly and wilfully make a material false statement or conceal a material fact in connection with any matter within the jurisdiction of an agent or agency of the federal government. False statements can be oral or written and do not have to be made under oath to violate the law.^[38] Further, there is no requirement that the false statement be an express statement; an implied false statement may lead to Section 1001 liability.^[39]

Commodity Exchange Act Section 6(c)(2)

Further, when interacting with the CFTC in particular, firms should be extra mindful that Commodity Exchange Act (CEA) Section 6(c)(2) authorises the Division of Enforcement to sue entities and individuals for making false or misleading statements to the commission.^[40] The CFTC’s enforcement authority under Section 6(c)(2) exceeds that of other US regulators in significant ways. First, Section 6(c)(2) applies to statements made to the CFTC in any context – whether under oath, in response to an investigative subpoena or voluntarily.^[41] The CFTC has held firms accountable for false or misleading statements or omissions by agents, representatives and employees within the scope of their employment.^[42]

Second, Section 6(c)(2) only requires a showing of negligence, allowing the CFTC to prevail in an enforcement action if it can prove that a speaker ‘reasonably should have known’ that a statement was false or misleading, even if the speaker did not have actual knowledge that his statement was false, and did not recklessly disregard the truth. ^[43]

Third, Section 6(c)(2) authorises the CFTC to bring charges for false statements without referring the matter to the DOJ for prosecution. Because Section 6(c)(2) contemplates a civil enforcement action rather than a criminal prosecution, the CFTC need only prove its case by a preponderance of the evidence, not beyond a reasonable doubt, and it may be entitled to an adverse inference if an individual refuses to testify. ^[44]

Given the far-reaching potential exposure under Section 6(c)(2), companies need to pay particularly close attention to all representations they make to the staff in any context. Even if firms believe their answers are true at the time they are given, the CFTC nevertheless may consider them to violate CEA Section 6(c)(2) if they later prove to be incorrect.

Making witnesses available

A key and often thorny component of corporate cooperation is the ability to make witnesses available, both for information gathering in the context of an internal investigation and for government interviews. US regulators have high expectations of companies in terms of their efforts to gather and provide information that may be available only through interviews of current or former employees. The ability to access witnesses is cited frequently as a critical factor in enforcement guidance.^[45]

The handling of this issue should be at the heart of any investigation work plan. In particular, termination or suspension decisions should be made with an eye toward avoiding action that may lead to untimely loss of access to critical fact witnesses. Forward-thinking companies will anticipate the issue and build the potential need for cooperation in an investigation into their employee and vendor onboarding and termination processes.^[46]

Even in the absence of such provisions, an individual employee must consider whether declining an interview may create discord between her and her employer and additional hurdles or problems for her employer in the course of the government’s investigation. Indeed, if the investigators or the employer view the employee’s refusal to sit for an interview as a failure to cooperate with a government investigation, it may even cost the employee her job.

Remote testimony

The increased reliance on remote, virtual testimony in light of covid-19 presents additional unique challenges for companies and individuals seeking cooperation credit. While the government may seek to press forward with interviews and testimony, defence counsel should consider a range of issues before agreeing to proceed with remote testimony, including counsel’s ability to fully assess and prepare the client, the client’s potential exposure and the consequences of delay or refusal to proceed with the interview.

Declining to participate voluntarily in a remote interview may have significant collateral consequences for the individual client. The government may regard the individual’s refusal as an indication that they have something to hide and draw a negative inference about the client and their credibility. It also may frustrate investigators and potentially cost the client valuable cooperation credit. Further, in some instances, regulators might bring additional rule violation charges for failing to comply with their testimony requests.

Potential collateral consequences

One of the gravest potential pitfalls of cooperation is the failure to anticipate and take steps to ameliorate collateral consequences. The piling on of consequences – attendant civil litigation as well as related criminal and regulatory enforcement actions – can be extraordinary.

Multi-regulator and jurisdictional enforcement

In the context of cooperation with any US regulator, it will be important to consider the extent to which there may be other interested regulators – both within the United States and abroad – to which outreach should be made. The DOJ has issued specific guidance directing ‘appropriate coordination of the government’s criminal, civil, regulatory, and administrative remedies,’ including policies that ‘stress early, effective and regular communication between criminal, civil and agency attorneys to the fullest extent appropriate to the case and permissible by law.’^[47] Prosecutorial guidance further directs coordination ‘to avoid the unnecessary imposition of duplicative fines, penalties and/or forfeiture against the company,’ including with regard to foreign enforcement authorities.^[48] Nevertheless, companies should be proactive about ensuring parallel disclosures and dialogue with relevant agencies where appropriate, to avoid duplicative enforcement and streamline cooperation efforts with multiple regulators.^[49] In addition, companies should consider carefully the array of potential enforcement implications of any disclosed activity, noting that the DOJ directive to avoid duplicative penalties applies only to those actions ‘seeking to resolve a case . . . for the same misconduct.’^[50] For instance, tax evasion relating to a bribery scheme typically would not be considered ‘the same misconduct’ as the bribery. Companies should keep this in mind when cataloguing the potential enforcement efforts and penalties that may arise from any disclosure.

Related civil litigation

Collateral litigations, such as shareholder derivative suits, often follow the public disclosure of a criminal or regulatory investigation. As explained, it can be difficult to provide full cooperation without risking a waiver of the attorney–client privilege and work product protection. Companies must think carefully about how they communicate information to the government and how much detail they provide in order to balance cooperation against the risk that the information provided could be deemed to have caused a waiver as to subsequent civil litigation.^[51] Companies can try to limit the potential harm from a waiver by:

• limiting the information disclosed to that which is necessary to reveal critical facts to the government;
• providing information to the extent possible orally instead of in writing; and
• negotiating a selective waiver agreement with the government (documenting that a waiver as to the government is not meant to waive the privilege as to other third parties).

Conclusion

Cooperation with the US government in the context of criminal and regulatory investigations can yield great benefits for potential corporate and individual enforcement targets. But the path of cooperation is winding and there are potholes – some deep and wide. Before opening a dialogue with the government, defence counsel and defendants should ensure that they understand the potential risks and rewards of cooperation under their particular circumstances, are clear eyed about the expectations of relevant regulators and that they are prepared to meet those expectations.

Notes