New FCPA enforcement policy provides additional certainty, but risks remain

In November 2017, the United States Department of Justice (DOJ) announced a potentially significant change to how it will evaluate and reward corporate cooperation and self-disclosure in Foreign Corrupt Practices Act (FCPA) cases. In a speech to the 34th International Conference on the Foreign Corrupt Practices Act on November 29, 2017, Deputy Attorney General Rod Rosenstein announced that the DOJ would add a “revised FCPA Corporate Enforcement Policy” to the US Attorney’s Manual. The new policy, which codifies and expands upon the DOJ’s 2016 FCPA Pilot Program, underscores the DOJ’s professed desire to incentivize companies to self-disclose potential FCPA violations and cooperate fully in any resulting investigations. On its face, the policy aims to enable companies and their advisors to better predict the pros and cons of self-disclosing potential FCP violations by defining the benefits that could be obtained by timely self-disclosure and complete cooperation.

As welcome as this increased certainty may be for companies concerned about FCPA exposure, the analysis of whether a disclosing and cooperating company will qualify for the new benefits is not a simple one, and there are thus still significant risks in self-disclosing potential FCPA violations. DOJ prosecutors retain significant discretion in determining how to resolve a matter even with this new policy, especially in how prosecutors determine what constitutes a qualifying “voluntary” self-disclosure. Recent case resolutions have shown, for example, that some self-disclosing companies have been denied self-disclosure credit because information about the alleged corrupt conduct had already appeared in the public domain. While the new FCPA policy may raise the hope of greater certainty about self-disclosure decisions, the benefits of the policy may remain highly limited and navigating the incentive structure could create a trap for the unwary.

The purpose of the 2016 pilot program was to deter FCPA violations, encourage strong anti-corruption compliance programs, and provide greater transparency to companies who sought mitigation credit for fully cooperating with the DOJ. Under the pilot program, companies that 1) voluntarily self-disclosed suspected violations; 2) fully cooperated with the DOJ; and 3) implemented appropriate remedial measures, could earn up to a 50 percent reduction from the bottom of the US Sentencing Guidelines (USSG) fine range at the time the case was resolved. While this incentive could be significant, it still would only be realized if the company was convicted or entered into some form of resolution with the DOJ. The pilot program left unclear the extent to which self-disclosure and cooperation could lead the DOJ to decline prosecution altogether.

While there was an increase in voluntary self-disclosures after the commencement of the pilot program, there was only a moderate increase in the publicly disclosed number of declinations. The DOJ only publically announced declinations in seven matters under the pilot program, though estimates indicate that there may have be fifteen or more total declinations during the period of the program.¹Considering the DOJ issued as many as twelve declinations in the year before the pilot program, it was not clear that the chances of obtaining a declination under the pilot program were meaningfully different than before. This may have been a function of the program’s opaque and discretionary incentive structure. As we warned when the DOJ announced the pilot program,²the program’s criteria were vague and the benefits were far from guaranteed given the prosecutors’ wide latitude in determining the appropriate penalty. Indeed, the DOJ retained broad discretion under the pilot policy not to grant any leniency even if a company voluntarily self-disclosed, cooperated, and appropriately remediated the misconduct.

The revised FCPA corporate enforcement policy is designed to address some of the shortcomings of the pilot program. In announcing the policy, Deputy Attorney General Rod Rosenstein noted that one of the goals of the new policy is to provide “greater clarity” about the DOJ’s decision-making in connection with FCPA enforcement decisions and “reassure corporations that want to do the right thing.” Along these lines, the new policy has been added to the U.S. Attorney’s Manual so that, in Rosenstein’s words, it can be “readily understood and easily applied by busy prosecutors.”

Elements of policy

The requirements for obtaining full cooperation credit remain similar to those in the pilot program: companies must timely disclose all relevant facts; proactively cooperate and disclose information even if not asked; collect and preserve relevant documents; engage in de-confliction of internal investigations where asked; and make current and former employees and officers available for interviews.

The most substantive changes appear designed to reduce the uncertainties present in the pilot program. Most notably, the policy provides companies that fully comply with all of the requirements with a presumption – not just the mere possibility – that the matter will be resolved with a declination. Specifically, the revised policy provides that “when a company has voluntarily self-disclosed misconduct,…fully cooperated, and timely and appropriately remediated, ... there will be a presumption that the company will receive a declination, absent aggravating circumstances.” Some uncertainty nevertheless remains as what constitutes aggravating circumstances, as it is not necessarily an objective determination. Still, this reflects a stark change in position towards incentivizing self-disclosure by providing stronger metrics for companies and their advisors to use when evaluating whether to self-disclose potential FCPA violations.

Moreover, in the event aggravating factors are present and the DOJ proceeds with seeking a criminal resolution of the matter, the new policy still provides for greater certainty for cooperating companies that satisfy the program’s requirements. Specifically, the new policy unequivocally states that the DOJ “will accord … a 50 percent reduction off of the low end of the” USSG fine range. This is a significant positive change for companies compared to the pilot program, which only noted that companies could receive up to a 50 percent reduction.

However, the revised policy has a new and potentially significant caveat: companies must pay “all disgorgement, forfeiture, and/or restitution resulting from the misconduct” in order to even qualify for the policy. This language appears broader than the pilot program requirement to disgorge “all profits from the FCPA misconduct at issue” and which made no mention of restitution payments. Additionally, the new provision may expand the conduct for which payments are required as it refers to all misconduct, as compared to the pilot program’s explicit reference to FCPA-related conduct.

To summarize, the following chart highlights some of the notable differences between the pilot program and the revised FCPA corporate enforcement policy.

While the policy on its face appears to provide significantly more certainty to companies facing decisions about self-disclosing FCPA violations in exchange for a possible declination or mitigation credit, prosecutors still have significant “wiggle room” to withhold those benefits and resolve matters criminally if they so choose. As with the pilot program, the policy is only a guideline that creates no enforceable rights. In other words, there are no guarantees.

“Voluntary” self-disclosure

The revised policy largely keeps intact the pilot program’s strict definition of what constitutes a “voluntary” self-disclosure. In order for a self-disclosure to be considered voluntary, it must: 1) qualify under the USSG “as occurring prior to an imminent threat of disclosure or government investigation;” 2) be made “within a reasonably prompt time after becoming aware of the offense” with the company having the burden to show timeliness; and 3) disclose all relevant facts known to it about the violation. Helpfully, a self-disclosure can still be considered “voluntary” even if the company is contractually or otherwise obligated to make it. The revised policy removes a criteria under the pilot program that a disclosure “that a company is required to make by law, agreement, or contract, does not constitute voluntary self-disclosure.”

Unhelpfully, however, the new policy retains the requirement that to be considered a “voluntary self-disclosure,” companies must disclose the potential misconduct before there is a threat of public disclosure. Even if the DOJ or other regulators are unaware of the conduct, some amount of press reports (even outside the United States) or other public information could disqualify the company from self-disclosure credit if that public information creates an “imminent threat” of government investigation.

To be clear, the language of the policy could disqualify a company’s disclosure even if there is no information in the public domain if it soon might become known.

This poses a complex problem for companies wishing to, as the DOJ says, “do the right thing” – as whether or not they will receive credit is highly dependent on an unknowable variable, namely whether the DOJ already knows or believes it would soon know about the issue. Recent enforcement actions make clear that any amount of publicity – including publicity outside the United States—regarding a purported FCPA violation, regardless of where or even the factual basis thereof, could preclude self-disclosure credit being granted. This is the case regardless of whether or not the DOJ is actually aware of that publicity, and there is no burden on the DOJ to demonstrate whether it knew or was about to learn of the press reports in some demonstrable way. Consistent with the so-called Yates Memorandum, the revised policy also requires the disclosure to include “all individuals involved in the violation of law” in order to qualify. Given the importance of the timeliness of the self-disclosure in the evaluation of the cooperation credit, companies will often have to make a decision whether to self-disclose at an early stage, before a proper internal investigation can be completed and before the extent of the alleged misconduct may be understood. That decision will further have to be made before there is complete knowledge about the extent of the involvement of various directors, officers, or employees. Thus, the new policy does not eliminate the tension of making such significant decisions on imperfect information, and may actually enhance it. Once the self-disclosure is made, of course, there is no ability to undo it even if the DOJ later decides in its discretion that the disclosure was not timely.

The announcement and implementation of the revised FCPA corporate enforcement policy do, on the whole, suggest the DOJ is being serious in trying to incentivize voluntary self-disclosure and full cooperation. The additional (but not complete) objectivity of the new policy is a welcome step forward in helping companies and their advisors to be better able to perform a meaningful cost-benefit analysis in determining whether to self-disclose a potential FCPA violation. However, as the DOJ has shown, even with this additional guidance, companies are not guaranteed credit for their self-disclosure. Companies must still weigh the serious risks and benefits of self-disclosure that remain under this new policy.