The National Security Division of the U.S. Department of Justice (DOJ) recently released guidance (Guidance) designed to encourage business organizations to voluntarily self-report criminal export controls and sanctions violations, cooperate with government investigations and remediate. Building on the September 2015 Yates Memo, the main tenet of which — holding individuals accountable — is emphasized throughout the Guidance, DOJ states that the intention of the Guidance is to deter individuals and companies from violating export controls and sanctions laws and to provide greater transparency about what is required from companies seeking credit for self-reporting. For details on the Yates Memo, please see our prior Sidley Update. While the Guidance may be seen as replicating the Foreign Corrupt Practices Act (FCPA) pilot program that DOJ announced roughly seven months earlier, it differs in the level of benefits offered, the clarity as to how far the credit will go, and the enumeration of aggravating factors that may justify a harsher outcome for companies and individuals involved in these types of violations, given the potential threat to national security that such conduct raises. For details on the FCPA pilot program, please see our prior Sidley Update. Moreover, just as DOJ and the Securities and Exchange Commission jointly are responsible for enforcing the FCPA, the Commerce, State and Treasury Departments actively enforce DOJ economic sanctions and export controls. As detailed below, companies now must integrate the Guidance into their assessment of how to comply in a multiagency environment.
CRITERIA FOR CREDIT
Voluntary Self-Disclosure. To receive credit for voluntary self-disclosure, the Guidance requires that a company disclose to DOJ’s Counterintelligence and Export Controls Section, as well as the appropriate regulatory agency, all relevant facts known to the company, including those about individuals involved, prior to an imminent threat of disclosure or government investigation. Notably, the Guidance states that if a whistleblower has informed the government of export controls or sanctions violations, but the company remains unaware of this fact and discloses the violations, the company will be considered to have made a voluntary self-disclosure.
Cooperation. The Guidance is clear that the principles articulated in the Yates Memo are a threshold requirement for a company to be considered cooperative. In addition, the Guidance sets out 10 other enumerated steps companies generally should undertake to be eligible for full cooperation credit. In broad strokes, those steps focus on disclosure of all relevant facts and attribution of those facts to specific sources, including documents, information and identification of sources of evidence that may be outside the company’s possession, with a particular emphasis on assisting DOJ in obtaining documents and testimony from foreign jurisdictions. DOJ expects that disclosure will be made proactively and on a rolling basis while the company continues its internal investigation, and it counsels companies to coordinate (i.e., “de-conflict”) their internal investigations with the government’s investigation.
The Guidance also concedes that there may be limits on what is expected from companies, depending on circumstances. It acknowledges that some companies may not have the resources to conduct an expansive investigation quickly, but notes that the company will bear the burden of proving that its financial condition impaired its ability to cooperate more fully. The Guidance also provides for “appropriately tailored investigation[s],” stating that a company is not expected to investigate additional matters unrelated in time or subject to the matter under investigation. It also contemplates that disclosure of overseas documents, which it encourages, may not be permissible under foreign law, and requires the disclosing company to establish that there is a prohibition and that, despite diligent effort, the company cannot identify a viable basis to provide the documents.
Provided companies meet the principles outlined in the Yates Memo, they should be eligible for some cooperation credit even if they do not satisfy all of the criteria outlined in the Guidance. However, they can expect to find those benefits markedly less robust than for full cooperation, depending on the nature and extent to which DOJ considers the cooperation deficient.
Timely and Appropriate Remediation. To emphasize the significance it places on remediation, DOJ is explicit in the Guidance that companies that fail to cooperate will be ineligible for credit for taking steps to remediate. Timely and appropriate remediation generally will require the following:
First, companies must implement an effective compliance program that matches the needs of the company. The compliance function must be independent, sufficiently resourced with qualified and experienced personnel, periodically assessed against the risks facing the company, and audited to ensure effectiveness. To augment this function, companies must establish a culture of compliance, implement a technology control plan and regularly train employees, and ensure an effective internal reporting structure.
Second, companies must appropriately discipline employees, including those responsible for criminal conduct and those with oversight over individuals who engage in violations. Potential discipline should include affecting employee compensation for misconduct or failure to adequately supervise.
Third, DOJ is looking to see that companies recognize the seriousness of the conduct, accept responsibility for it, and have implemented measures to prevent recurrence.
In addition to outlining what is required to mitigate penalties, the Guidance provides examples of aggravating circumstances that would result in a more severe penalty because of the heightened risk to national security such circumstances present. While many are unsurprising, such as the export of military items to a hostile foreign power, three bear particular mention:
- repeated violations, including similar administrative or criminal violations in the past
- knowing involvement of upper management in the criminal conduct
- significant profits from the criminal conduct, including disproportionate profits or margins, whether intended or realized, compared with lawfully exported products and services
Notably, the Guidance does not say that companies with one or more such aggravating circumstances are ineligible for self-disclosure credit. Therefore, companies that voluntarily disclose, cooperate and remediate misconduct still should be in a better position in a criminal resolution than if they had chosen not to self-disclose — but all of this is untested, and it remains to be seen the extent of credit DOJ may give to a company in that circumstance. A company in such a situation will need to evaluate the facts and circumstances of its particular case before making any disclosure decisions.
BENEFITS TO BUSINESS ORGANIZATIONS
The Guidance articulates two levels of benefits for companies under investigation. First, where a company voluntarily self-discloses criminal violations of export controls and sanctions, meets the threshold for full cooperation and appropriately remediates the misconduct, the company may be eligible for a significantly reduced penalty that may include the possibility of entering into a non-prosecution agreement, reduced fines and forfeiture, reduced period of supervised compliance and no requirement for a monitor. Second, where a company does not voluntarily self-disclose the violation but nonetheless fully cooperates and remediates, the company may be eligible for the possibility of a deferred prosecution agreement, a reduced fine and forfeiture and an outside auditor as opposed to a monitor. The Guidance notes that a company that does not voluntarily disclose will “rarely qualify” for a non-prosecution agreement.
DISCLOSURE GUIDANCE FROM OFAC, BIS AND DDTC
DOJ’s Guidance complements existing guidance from administrative agencies and should be viewed in the broader context of a government-wide effort to encourage companies to make voluntary self-disclosures of export control and sanctions violations by increasing the transparency of the government’s investigation and decision-making processes and by providing mitigation credits to those who disclose, cooperate and remediate. The Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the State Department’s Directorate of Defense Trade Controls (DDTC) long have provided guidance on the voluntary self-disclosure of violations of U.S. sanctions regulations and U.S. export controls for defense articles, respectively. The Department of Commerce’s Bureau of Industry and Security (BIS) released new guidance on the voluntary self-disclosure of export control violations this past June.
Guidance from OFAC, DDTC and BIS states that voluntary self-disclosure is a mitigating factor in determining what administrative sanctions, if any, companies may face. Companies may receive mitigation credit for voluntary self-disclosure if they initiate the notification of an apparent violation; notify the relevant agency; and make the disclosure before that agency or any other federal, state or local government agency or official discovers the apparent violation or another substantially similar apparent violation.
Successful voluntary self-disclosure can have significant benefits for companies with the administrative agencies. Both OFAC and BIS provide for reduction of the base penalty amounts for egregious and non-egregious apparent violations by 50 percent if the case is based on a voluntary self-disclosure.
IMPACT ON REPORTING: WHERE TO DISCLOSE NOW
The Guidance marks a shift in voluntary self-disclosure (VSD) and penalty determination practice. Previously, a company might disclose a potential sanctions or export control violation to the agency administering the relevant regulations with the understanding that the agency, in its discretion, might refer egregious violations to DOJ for potential criminal prosecution. BIS guidance, for example, states that in the case of a referral, BIS will notify DOJ that voluntary self-disclosure has been made. BIS guidance further explains that consideration of this factor is within the discretion of DOJ. 15 C.F.R. § 764.5. Similarly, DDTC reserves the right to refer matters to DOJ for criminal prosecution and states that while DDTC will notify DOJ of the self-disclosure, DOJ is not required to give that fact any weight. 22 C.F.R. § 127.12.
Now, the administrative agencies are no longer the sole gatekeepers. According to the Guidance, when a company, “including its counsel, becomes aware that the violations may have been willful, it should within a reasonably prompt time also submit a VSD” to DOJ. This adds a new layer of tension to the voluntary self-disclosure calculation because companies may simultaneously be arguing that their conduct was not “willful” to administrative agencies and to DOJ itself, after making a disclosure to DOJ predicated on an acknowledgment that the conduct “may have been willful.”
Notably, “[b]ecause financial institutions often have unique reporting obligations under their applicable statutory and regulatory regimes, this Guidance does not apply to [them].” Financial institutions nevertheless are encouraged to make voluntary disclosures to DOJ as they “may benefit from such disclosures under DOJ policy applicable to all business organizations.”
As it did with the FCPA pilot program, DOJ is attempting to incentivize companies to voluntarily self-report willful (i.e., potentially criminal) violations of export controls and sanctions, cooperate with DOJ and remediate the issues in order to receive benefits that now purportedly are transparent. The reality, however, is that the potential benefits are all that is now transparent. The threshold requirement that companies satisfy the Yates Memo’s mandate and the assessment of the degree to which a company has satisfied the remaining elements of “cooperation” and fully remediated the underlying issues are firmly in the discretion of DOJ. How the program is implemented, particularly in light of civil enforcement by BIS, DDTC and OFAC, remains to be seen.
If you have any questions regarding this Sidley Update, please contact the Sidley lawyer with whom you usually work, or
Colleen M. Lauerman
Andrew W. Shoyer
To receive Sidley Updates, please subscribe at www.sidley.com/subscribe.
Sidley Austin provides this information as a service to clients and other friends for educational purposes only. It should not be construed or relied on as legal advice or to create a lawyer-client relationship.
Attorney Advertising - For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300; One South Dearborn, Chicago, IL 60603, 312.853.7000; and 1501 K Street, N.W., Washington, D.C. 20005, 202.736.8000.