Appendix I: Frequently Asked Questions

Who is subject to the Foreign Corrupt Practices Act (FCPA)?

Potentially anyone. The anti-bribery provisions identify three classes of possible offenders: “issuers,”[1] “domestic concerns,”[2] and all other persons.[3] An “issuer” is any natural person, company, government, or political subdivision, agency, or instrumentality of government that issues or proposes to issue any security within the United States or files reports with the SEC.[4] A “domestic concern” is a US citizen, national, or resident or a business entity that either has its principal place of business in the United States or is organized under US law.[5] The third, catch-all section applies to everyone else (such as foreign non-issuers, including non-US nationals) if acting within the territory of the United States.[6] The anti-bribery provisions also apply to “agents” acting on behalf of issuers, domestic concerns, or other covered persons or entities.[7]

Liability under the books and records and internal controls provisions is limited to “issuers,”[8] although corporations and individuals can be held liable for aiding and abetting or causing an issuer’s violations of the books and records provisions.[9]

Can the US government prosecute foreign companies under the FCPA?

Yes. Foreign companies that issue securities in the United States or that are required to file reports with the SEC are considered “issuers” and are treated the same as any US issuer.[10] Prosecution of foreign companies has been a growing enforcement trend. To date, several of the largest FCPA enforcement actions, measured by dollar volume of total penalties and disgorgements, have been brought against foreign companies.

Furthermore, even non-issuer foreign companies and individuals are subject to the FCPA if they commit any act in furtherance of an improper payment while within the territory of the United States.[11] The US Department of Justice (DOJ) has advanced aggressive theories to support jurisdiction over such defendants. For example, in the 2002 Syncor Taiwan matter, DOJ asserted jurisdiction over a foreign non-issuer company based on one of its officers sending an email while in the United States that contained a budget referring to the improper payments, thereby committing a relevant act “while in the United States.”[12] But in 2011, a federal court rejected an even more aggressive theory that a British national had acted within the United States when he mailed from London to the United States a purchase agreement related to an alleged bribery scheme.[13]

Also, the US Court of Appeals for the Second Circuit has held that a foreign defendant not otherwise subject to the FCPA can be charged under the FCPA if the defendant acts as an agent of a company that is subject to the FCPA, such as an agent of a US subsidiary of a foreign corporation.[14] In Hoskins, the defendant was working for an Alstom SA subsidiary based in France but was charged and convicted by a jury of FCPA violations on the theory that he was working as the agent of Alstom’s US subsidiary when he engaged in a conspiracy to pay bribes to officials in Indonesia.[15] However, the trial court granted Hoskins’ motion for acquittal on all the FCPA charges, a decision that was appealed to the Second Circuit.[16]

The Second Circuit affirmed the district court’s ruling on the basis that the government did not show that Alstom’s US subsidiary “actually controlled” the defendant’s actions, and therefore the government failed to establish “a principal-agent relationship within the meaning of the FCPA.”[17]

Are companies liable for the prior illegal acts of companies they purchase?

Yes, in some circumstances. DOJ and the SEC state in their Resource Guide that successor liability will generally be limited to circumstances where the successor company continued the misconduct or failed to stop it.[18] A company may mitigate its risk by conducting due diligence prior to an acquisition or merger or, sometimes, immediately following an acquisition or merger, but that is not a legal defense, and the company may still be legally susceptible to criminal prosecution.[19] Further, as stated in DOJ guidance regarding the evaluation of corporate compliance programs under the principles of federal prosecution of business organizations, a well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls. The extent to which a company subjects its acquisition targets to appropriate scrutiny indicates whether its compliance program is, as implemented, able to effectively enforce internal controls and remediate misconduct.[20] Factors that DOJ will evaluate include the breadth and quality of the due diligence process, the compliance function’s degree of involvement in mergers and acquisitions, and the extent to which the company tracks and remediates misconduct and ensures the implementation of compliance policies and procedures, as well as post-acquisition audits, in the acquired entity.[21]

Even where enforcement authorities do not take direct action against the acquiring company, actions against the acquired subsidiary can still have significant consequences for all parties. In 2007, eLandia International Inc. discovered after the fact that its recently acquired subsidiary, Latin Node Inc., had paid as much as $2.2 million in bribes to officials in state-owned telecommunications firms in Honduras and Yemen.[22] As a result of the ensuing investigation and remediation, Latin Node’s viability was weakened, and the company was eventually wound down.[23] Although the acquiring company, eLandia, was ultimately spared a criminal charge of its own, it was obligated to pay the defunct Latin Node’s fine and, of course, saw its investment wiped out.[24] In addition, several executives of Latin Node were convicted of FCPA violations, and three of them received terms of imprisonment.[25]

Can a company make a charitable contribution at the request of a foreign official?

Yes, but it should be very careful when doing so. Past enforcement actions have relied on such contributions as evidence of an improper payment.[26] Still, DOJ and the SEC have recognized that bona fide charitable contributions are permissible.[27]

At a minimum, companies should conduct due diligence into the charity, take care to document the purpose of the donation, and evaluate whether the circumstances suggest the contribution will go to the charity and not to any government official.[28]

Can a company be liable for the acts of a third party?

Yes. The FCPA prohibits the “authorization” of improper payments, which could include payments made by agents and business partners.[29]

Furthermore, the FCPA specifically prohibits payments to third parties “while knowing” that all or a portion of the payment will be used as an illegal bribe.[30] Additionally, a person’s awareness “of a high probability of the existence of [a] circumstance” is sufficient to demonstrate knowledge of the circumstance; thus, a company can be liable for willful blindness toward the conduct of a third party acting on its behalf.[31]

What provisions should an agreement with a third party contain to minimize risk?

An agreement should take into account the specific circumstances of any relationship, but as a general matter, a company entering into an agreement with a foreign representative should consider the elements outlined in DOJ’s Opinion Release 81-01, the department’s most comprehensive pronouncement on the subject:

1. Payments be made (a) by check or bank transfer, (b) to the foreign representative by name, (c) at its business address in-country (or where services were rendered), and (d) upon the written instructions of the foreign representative.

2. A representation of the representative’s familiarity with and commitment to adhere to the FCPA, including a requirement for the representative to notify the company of any request it receives for improper payments.

3. A representation that no member of the entity is a government official, an official of a political party, a candidate for political office, a consultant to a government official or affiliated with a government official.

4. The agreement is lawful in the foreign country.

5. Any assignment by the representative of any right, obligation, and/or services to be performed under the agreement must be approved in writing by the company.

6. The company can terminate the agreement where the representative has violated any of its provisions.

7. The company is permitted to disclose the agreement, including to the foreign government.

8. Adequate controls over reimbursable expenses, including potentially audit rights.

9. A representation that the representative is well established with sufficient resources to perform the work. The agreement should also refer to the company’s selection criteria for representatives, such as years in operation; size and adequacy of support staff; business outlook; reputation; professional and/or technical expertise; and familiarity with and willingness to adhere to the FCPA.[32]

In addition to those anti-bribery focused provisions, DOJ and SEC enforcement actions have emphasized that an agreement with a foreign representative should also include specific detail about the services that the representative should provide.

If necessary, how should a company make an overseas payment?

Ideally, by wire transfer to a business partner’s bank account in its home country or the location where the work was done. DOJ and the SEC insist on visibility and transparency in payments made to agents and other business partners abroad.[33]

Therefore, wire transfers are preferable to checks because they provide proof that funds were sent to an agent’s primary business account. If checks are used, they should be retained to show the place of deposit. Companies should ensure that payments to business partners are accurately recorded in their books, and domestic parents should require their subsidiaries to follow US accounting rules regarding business expenditures.

Can a company make a payment, contribution, or donation to a foreign government entity?

Yes, but it should be very careful when doing so. The FCPA prohibits payments to government officials but not to government entities themselves.[34]

Nonetheless, a payment to a government entity may be improper where it appears that it is substantially benefitting a particular government official. For example, in 2013, the SEC brought an enforcement action against medical device manufacturer Stryker Corporation. Among the alleged improper payments was a $200,000 donation to fund a Greek public university laboratory for a public official with influence over the purchase of Stryker products.[35]

There is also a risk that any payment to a foreign government may be improperly diverted to an individual official. Accordingly, any payments to government entities should be made to accounts clearly identified as such, in the country where the government operates, and supported by clear documentation, including written direction of the government entity.[36]

It is important to exercise caution when making payments, contributions, or donations to foreign governments, even when acting with the best of intentions. As DOJ and the SEC warn, “companies contemplating contributions or donations to foreign governments should take steps to ensure that no monies are used for corrupt purposes, such as the personal benefit of individual foreign officials.”[37]

Can a US company do business with an entity in which a foreign official is a participant?

Yes, but it should exercise great care in doing so. A US company does not violate the FCPA merely by doing business with an entity in which a foreign official is a passive owner.

In general, to avoid violating the FCPA, a foreign official’s participation in such an entity should be legal under the laws of the official’s country and transparent to the official’s government, and the official should not participate in any decision or transaction involving the US company.

DOJ has issued a number of opinion releases addressing this issue. For example, in Opinion Release 08-01, DOJ took no enforcement action where a US company entered into a joint venture with an entity in which a foreign official was a principal because the US company had (1) conducted extensive due diligence and made disclosures; (2) obtained representations and warranties that its joint-venture partner had not violated and would not violate anti-corruption laws; and (3) retained a broad contractual right to terminate the joint venture agreement in the event of a violation of anti-corruption laws.[38] Upon similar prophylactic measures, DOJ took no action when a US firm sought to establish an agency agreement with a foreign company whose principals were related to and managed the affairs of a foreign country’s head of state.[39]

Does the FCPA forbid corrupt payments to obtain a business advantage, such as a lower tax rate or customs duty?

Yes. The FCPA forbids corrupt payments to influence foreign officials to use their positions to assist “in obtaining or retaining business.”[40] This prohibition is not limited to commercial transactions between a US company and a foreign government, such as the award or renewal of contracts. After a lengthy analysis of the statute’s legislative history, the US Court of Appeals for the Fifth Circuit reasoned in Kay I that the FCPA prohibits payments “intended to assist the payor either directly or indirectly, in obtaining or retaining business”[41] and that it “encompass[es] the administration of tax, customs, and other laws and regulations affecting the revenue of foreign states.”[42] The court thus concluded that payments to Haitian officials to understate quantities of imported grain to reduce import taxes violated the FCPA.[43]

May a company sponsor an educational trip for a foreign official or provide other hospitality?

Yes, but only under strict conditions. The FCPA itself provides an affirmative defense for “reasonable and bona fide expenditures, such as travel and lodging expenses” when directly connected with a legitimate promotion or product demonstration, or when required as part of contract performance.[44]

Nevertheless, expenses should be reasonable, relate to legitimate educational or training needs, and not suggest an attempt to induce favorable treatment with regard to the company’s business. Indeed, both DOJ and the SEC have brought actions related to travel and entertainment expenses that have not met these guidelines.[45]

Is having an adequate compliance program a defense to corporate criminal liability for the actions of an employee violating company policy?

No. DOJ and the SEC take the position that, under principles of agency law, any action taken to benefit the company, even if also taken to benefit an employee and even if against company policy, can be attributed to the company.[46]

While there is no formal defense for having an adequate (or superlative) compliance program (as there is under the UK Bribery Act), DOJ and SEC guidance provides that the effectiveness of a company’s pre-existing compliance program may be a factor in making charging decisions or assessing the amount of a potential monetary sanction.[47]

Can an individual be prosecuted for conduct prohibited under the books and records or internal controls provisions?

Yes. By their terms, the books and records and internal controls provisions apply to issuers only.[48] But natural persons can be subject to criminal or civil liability as aiders and abettors;[49] for causing an issuer’s books and records violations;[50] and for knowingly falsifying books and records or circumventing or failing to implement adequate internal controls.[51] They also can be subject to civil liability as control persons. In recent years, DOJ and the SEC have brought several cases against individuals under the books and records provisions.[52]

Who enforces the FCPA?

DOJ and the SEC have joint enforcement responsibility.[53]

• DOJ has all criminal enforcement responsibilities for violations of the anti-bribery and books and records provisions of the FCPA.[54]

• The SEC has civil enforcement responsibility for violations of the anti-bribery provisions committed by issuers (or agents of issuers, including individuals) and violations of the books and records provisions.[55]

Under what circumstances will DOJ or the SEC decline to take enforcement action despite finding that misconduct occurred?

Declination decisions are highly fact specific. DOJ’s FCPA Corporate Enforcement Policy states that DOJ will decline prosecution where a company voluntarily discloses misconduct, cooperates with the investigation, remediates the issues that led to the misconduct, and disgorges any ill-gotten profits, except in cases with aggravating circumstances, such as widespread misconduct or recidivism.[56]

The SEC has issued no comparable policy, but available guidance suggests that it will similarly take disclosure, cooperation, remediation, and the severity of the conduct into account.[57]

How are monetary FCPA penalties calculated?

The statute provides specific maximum penalty amounts per violation: $2,000,000 criminal fine and a $16,000 civil penalty for a corporate entity.[58] In addition, a criminal fine of up to twice the gross pecuniary gain may be levied under the Alternative Fines Statute.[59]

As a practical matter, the fact that each violation may be a separate basis for a fine gives the enforcement agencies wide discretion in setting the amount of a monetary sanction. In many corporate settlements, the final amount paid is subject to negotiation between the settling defendant and the enforcing agency.

The amount of a criminal fine imposed as a result of an FCPA violation is ostensibly based on a calculation of the recommended fine under the federal sentencing guidelines, which provide federal courts with non-binding guidance governing criminal penalties arising from federal crimes. The guidelines contain a formula for calculating a corporation’s criminal fine that takes into account the nature of the crime, the amount of benefit obtained, and culpability factors such as the size of the organization, the company’s policies, and involvement of senior management.[60]

In many cases, following negotiation, a settling defendant will receive a “discount” off DOJ’s calculation of the recommended guidelines range. The FCPA Corporate Enforcement Policy is intended to make this discount process transparent and predictable by specifying the conditions that will lead to a reduction in penalty.[61]

The SEC has not provided formal guidance regarding the amount of a monetary penalty in any given case. In addition, the SEC often seeks disgorgement of ill-gotten gains.[62]

Are there benefits to voluntary disclosure?

Yes, but the extent of the benefits is highly fact specific. DOJ and the SEC encourage companies to make voluntary disclosures of wrongdoing and promise that such self-reporting will be rewarded with a lesser penalty.[63] Our analysis of recent settlements reflects that there has been an observable benefit to self-disclosure, though the extent of the benefit is difficult to quantify as many other factors may affect the ultimate size of a penalty and the nature of any resolution.

The benefits to voluntary disclosure must be weighed against the potential downsides to disclosure, including possible public disclosure of an ongoing investigation and the possibility of additional investigation directed by the government following any disclosure.

What counts as “cooperation” with the government investigation?

There is no magic formula for cooperating, but recent DOJ and SEC pronouncements and resolutions, including the FCPA Corporate Enforcement Policy, identify a number of concrete steps a company under investigation can take for which the government may give cooperation credit:

• timely self-reporting of misconduct;

• providing real-time reports about findings of the company’s internal investigation, including making proactive (rather than reactive) disclosures to the government;

• making overseas witnesses available;

• attributing facts to specific sources, if consistent with the attorney-client privilege;

• voluntarily producing relevant documents;

• translating foreign-language documents;

• providing topical collections of documents;

• preparing and producing factual chronologies;

• conducting voluntary risk assessments or reviews of other areas of the company’s business;

• assisting the government in overcoming challenges posed by foreign data privacy laws and blocking statutes;

• providing evidence regarding the individuals involved in the misconduct; and

• providing all known facts relevant to potential third-party criminal activity.[64]

The FCPA Corporate Enforcement Policy reflects that these expectations for cooperation exceed the requirements provided for corporate cooperation credit in other criminal matters.

Beyond the FCPA realm, DOJ has also announced a general policy that providing relevant information about all individuals substantially involved in or responsible for misconduct is a prerequisite to receiving any cooperation credit.[65]

What counts as “remediation” of a violation or potential violation of the FCPA?

DOJ has identified a number of factors as relevant to its assessment of remedial actions, including many that are focused on ongoing compliance, such as whether the company:

• demonstrates thorough analysis of the root cause of the misconduct;

• has an established culture of compliance, including an awareness among employees that criminal conduct is not tolerated;

• dedicates sufficient resources to compliance, including maintaining experienced and adequately compensated compliance personnel;

• maintains an independent compliance function;

• performs an effective risk assessment and tailors its compliance program based on the assessment;

• performs regular audits of its compliance function;

• maintains an appropriate reporting structure for compliance personnel within the company;

• appropriately compensates and promotes compliance personnel within the company as compared to other employees;

• appropriately disciplines employees for violations and has a disciplinary system that allows for disciplining supervisors who oversee individuals responsible for misconduct;

• allows for compensation to be altered based on disciplinary infractions or a failure to adequately supervise;

• considers any additional steps necessary to signal the importance of accepting responsibility for misconduct and measures to reduce misconduct risks; and

• appropriately maintains business records and prohibits improper destruction of such records.

• DOJ highlights certain of these factors in its FCPA Corporate Enforcement Policy.[66]

Does cooperation require waiving attorney-client privilege?

No. Both DOJ and the SEC have policies that they will not compel a company to waive privilege.[67] Nonetheless, cooperation often involves some communication about the findings of the company’s internal investigation, which must be handled with care to avoid inadvertent waiver of privilege or work product protections.

Can a US company engage in foreign bribery if it does not involve the bribing of a foreign official?

No. Although that conduct is not prohibited by the FCPA, other federal criminal statutes, including the Travel Act and the mail and wire fraud statutes, likely would apply.[68] The 2015 FIFA indictments for corrupt payments involving the international soccer organization show that US law enforcement can and will use other federal criminal statutes to investigate and prosecute alleged international wrongdoing, such as commercial bribery, outside the reach of the FCPA.[69]