UNDER INVESTIGATION: A GC GUIDE TO WHITE COLLAR AND SANCTIONS TRENDS IN 2021 INT CONTENTS

ARB 02 EDITOR’S LETTER IN T ERNAT IONAL ARBIT R AT ION CEN T RE 06 FOREWORD: LATHAM & WATKINS

08 MOVING THE GOAL POSTS

16 IN CONVERSATION: AHMAD ISMAIL, SAUDI ARAMCO JUBAIL REFINERY COMPANY

20 DATA ANALYSIS PART ONE: THE ETHICAL SHIELD MARKET-LEADING BESPOKE ONLINE INTERNATIONAL ARBITRATION CENTRE ARBITRATION PLATFORM 190 Fleet Street 24 DIGITAL LAUNDERY London EC4A 2AG IN CONVERSATION: RITANKAR SAHU, MAXPOWER GROUP n Online arbitration room – a decluttered screen focused 34 on tribunal, advocates and witnesses CEO: Owen Lawrence 38 LATHAM & WATKINS: ENFORCEMENT PREDICTIONS FOR 2021 n All involved, clients, support lawyers etc can attend and sit at the back of the hearing room DDI: 0203 928 7288 Email: [email protected] n Hearing room dashboard, allowing all to navigate LinkedIn: Owen Lawrence 42 PREPARING FOR THE WORST between the hearing room and physically separated private breakout rooms n Two-layer added security 49 DATA ANALYSIS PART TWO: SEEKING COUNSEL n Full administrative support n IAC technician in the virtual arbitration room at all times 52 IN CONVERSATION: OLIVER JABERG, FIFA n Full pre-arbitration training, confi guration and BANKING ON A BRIGHTER FUTURE familiarisation for every attendee 56

66 IN CONVERSATION: SERGEY VITOROV, NOVO NORDISK

www.int-arb.com 70 IN CONVERSATION: SESHANI BAHU, CHARTERED ACCOUNTANTS ANZ E D I T O R ‘ S L E T T E R G C M A G A Z I N E

WELCOME TO GC: WHITE COLLAR SPECIAL EDITION

We first began surveying global general Russian hackers breached the US government’s counsel for this report in August 2020. At the computer systems, and at the end of it all a time, many of them reported that so much constitutional crisis. had changed in such a short space of time that they were struggling to plan effectively. In a world where compliance is a constantly moving target, few GCs feel confident that they The bad news for these GCs is that the level are following best practices. We hope that this of uncertainty has continued to grow. To take report will put their minds at rest, offering insight developments in the US as a benchmark, the into the measures their peers around the world second half of 2020 saw the tech industry are putting in place and describing some of the facing an anti-trust crackdown, cybersecurity most important emerging threats their businesses taking on a whole new level of importance after are likely to face in the coming months.

2 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 3 Chairman John Pritchard (Solicitor) CONTRIBUTORS AND EDITORS

Managing Director David Goulthorpe GREG HALL Publishing Director: The Legal 500 Series EDITOR-IN-CHIEF David Burgess Greg is managing editor of GC. He is a graduate of the Director of Content Stephen Jones University of Auckland Law School, with professional

Editor-in-Chief experience in the legal, publishing and consulting sectors. Greg Hall Outside of GC, Greg is an American football enthusiast,

Features Writer contributing as a writer and expert commentator to a Catherine Wycherley range of international outlets. GLOBAL LEADER IN Digital Editor Harveen Kaur +44 (0) 20 7396 5615 harveen.kaur@ gcmagazine.com WHITE COLLAR DEFENSE

Junior Features Writer CATHERINE WYCHERLEY Aminah Karim FEATURES WRITER

Senior Key Catherine is features writer at GC. She has spent several Strategic solutions for our clients Account Manager David Freeman years researching and writing about a full range of legal +44 (0) 20 7396 9324 Local presence in every major international market david.freeman@ markets across the globe. Catherine has also worked as a legal500.com conference producer, actor and voice-over artist. Outside Formidable team of advocates and counselors Head of Print and Digital the office, she can be found writing plays for production on Production Sian Goodwin London’s fringe.

Content Development Editors Stephanie Nash, Claire Slater

Graphic Design HARVEEN KAUR Harry Milburn DIGITAL EDITOR

Copyright applies: no Harveen is digital media journalist at GC. She is a Journalism photocopying (Copyright Licensing Agency Ltd and and Laws (honours) graduate, who began her career as a Publishers Licensing Society Ltd licences do not apply). commercial property solicitor. Harveen previously worked

For licensed photocopying for Sky News Australia for both the business and weather within a firm or company, channels. Outside the office, Harveen is an avid landscape please call: photographer. Tel: +44 (0) 20 7396 5648

© Legalease Ltd 2021

GC (Legalease Ltd) 188 Fleet Street London EC4A 2AG AMINAH KARIM Tel: +44 (0) 20 7396 9292 JUNIOR FEATURES WRITER

Printed and bound by Aminah is junior features writer at GC. She is a graduate of Park Communications www.parkcom.co.uk The City Law School, University of London, with diverse

February 2021 professional experience across the legal sector. Outside of gcmagazine.com GC, Aminah is training as a barrister. In her free time, she legal500.com works as a private tutor and enjoys travelling. Follow us: LW.com FOREWORD

or companies and their general counsel – as Additionally, although robust white collar with the rest of the world, generally – 2020 enforcement has continued in a number of areas Fpresented unique challenges. As we move over the past four years, the 2020 US Presidential through 2021, organisations of all sizes and election will usher in a new administration that across all industries face unprecedented forms will likely adjust its regulatory and enforcement of scrutiny, liability, and potential “bet-the- priorities on several fronts. With new leadership, company” penalties for misconduct by US and financial regulators – including the DOJ and other international regulators. US Securities and Exchange Commission – are FOREWORD poised to take more aggressive stances to In response to the COVID-19 pandemic, combat alleged corporate wrongdoing. governments worldwide have distributed significant amounts of emergency relief funds It is no surprise, therefore, that global general to help manage the pandemic and mitigate counsel are expressing heightened concern its impact on individuals and businesses. Over over these new and emerging challenges. the course of the last year, the United States, To gain more direct insight into these issues, for example, has passed the largest spending Latham & Watkins is delighted to partner with measures ever enacted, providing more than five GC Magazine and The Legal 500 in their inaugural trillion dollars in aid through multiple stimulus “Under Investigation: A GC Guide to White Collar bills and more is being proposed. Those relief and Sanctions Trends in 2021” to ask GCs about funds include oversight mechanisms based upon their top regulatory challenges. The following TARP that seek to combat potential fraud, waste, responses offer a snapshot into the concerns and abuse on behalf of fund recipients, paving and risks GCs around the world have identified as new avenues for regulatory scrutiny. top-of-mind in this evolving regulatory climate.

In June 2020, the US Department of Justice (DOJ) issued updates to its Evaluation of Douglas Greenburg Corporate Compliance Programs as part of its Benjamin Naftalis overall framework that prosecutors should Nathan Seltzer consider in conducting corporate investigations. That framework will apply to COVID-related Global Chairs investigations. It also provides insight for GCs of White Collar Defense & Investigations corporations seeking to develop and implement Latham & Watkins LLP a best-in-class compliance program. Among its recommendations, the guidance encourages companies to leverage technology and engage with compliance data real-time – a clear signal to businesses of the importance of data management and security in building a robust compliance program.

6 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 7 MOVING THE GOAL POSTS

Planning for investigations and prosecutions is challenging enough in a vacuum, but a rapidly changing global environment has exacerbated this further, redefining the risk profiles of many businesses in the process. GC looks at the ways in-house counsel are grappling with such constantly disrupted risk environments.

8 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 9 MOVING THE GOAL POSTS MODERN SOLUTIONS TO NOVEL RISKS

lans to mitigate sources of investigatory accountable for the weakest link: a company in On a scale of 1 to 5, how would you rate the following risk areas in terms of concern for you and risk and respond when an investigation the United Kingdom may be perfectly above- your business, currently and for the next five years? P does occur must change according board in a foreign jurisdiction, but regulators to the risk profile of the business. Between now hold those companies to the standard of novel technologies, evolving sensibilities UK law for their actions in jurisdictions further Accounting fraud 3.08 3 .17 and seismic shifts within industry, regulators up the supply chain, where protections against and investigatory bodies are changing focus abuse and exploitation are not as strong. Antitrust/price-fixing 3.33 regularly. So too are business attitudes toward 3.48 risk changing. READING THE ROOM Bribery and corruption 4.05 4.37 Generally speaking, when asked how the risk Compliance/ 4.27 4.49 profile of their business has changed over the GC surveyed top in-house counsel from across due diligence past five years, 53% of in-house counsel said it the world, asking participants to rate their Cybersecurity and 4.48 4.75 had at least somewhat increased. When asked to organisation’s current risk levels on a scale of 1 data privacy look ahead at the next five years, 26% felt that the to 5, 1 being the lowest risk, and 5 the highest. Environmental 3.52 3.46 risk profile of their business would significantly The responses were broken up into the following regulatory increase over the next five years, with 61% feeling categories: Money laundering 3 .17 3.29 that there would be at least a slight increase in their business’ risk profile. • Accounting fraud Sanctions evasion 3.24 3.29

When looking at changing risk profiles, data • Antitrust/price-fixing Securities/ 2.87 2.75 breaches are a good example: it wasn’t so long commodities fraud ago that the range of companies that rely on • Bribery and corruption Tax evasion 3.03 3.05 the collection and use of data was limited. Now, data has pervaded nearly every aspect of • Compliance/due diligence Trade/foreign 3 .14 3 commerce. Retail stores that may historically investment violations have collected very little personal data now • Cybersecurity and data privacy capture all manner of information at the point Current sources of risk Within the next five years of sale for loyalty programmes, not to mention • Environmental regulatory the continued recission of relatively anonymous brick-and-mortar buying in favour of online • Money laundering shopping. Cybersecurity and data privacy risks were asked to look ahead at the next five • Sanctions evasion were rated as the highest concern by survey years. To go back further, increasingly globalised respondents, both in terms of the risk they markets and supply chains have largely • Securities/commodities fraud currently pose to businesses and how that Compliance and due diligence are also top of informed recent interest in modern slavery. risk was expected to change in the next five GCs’ minds – both when speaking about their Modern slavery regimes set an expectation that • Tax evasion years. Cybersecurity and data privacy risks organisation’s current level of risk and when companies must not hide behind the strongest were rated at an average of 4.48/5 currently, looking ahead to how this might change over the link in the compliance chain, instead being held • Trade/foreign investment violations which ballooned to 4.75 when respondents next five years – coming in at an average rating

10 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 11 MOVING THE GOAL POSTS MODERN SOLUTIONS TO NOVEL RISKS

of 4.27 with an expected increase of 0.22 to 4.49 increased dramatically in the last few months ‘With the rapid development of online services, Greatly Unsure Greatly in the next five years. amidst the pandemic.’ the risks associated with data storage and increased 2.6% reduced cybersecurity will develop,’ agrees Roman 14.29% 9.09% On average, nearly every category is expected Until relatively recently, it might have made sense Kuznetsov, legal manager at WILO RUS. to become more risky over the next five years. to talk about cybersecurity and data privacy in Somewhat Bribery and corruption risks polled the biggest terms of specific sectors, but the adoption of Bala has worked closely with stakeholders in the reduced jump, increasing by 0.32 points on the survey’s mobile platforms and cloud services – be they wider business to make sure data protection How has the 16.88% five-point scale. for internal operations, customer interactions, policies are both clearly understood and risk profile of or both – has made cybersecurity everybody’s rigorously enforced. your organisation problem. In fact, the sector in which a given changed in the past RISKING IT ONLINE survey respondent is working had virtually no ‘Once we have made sense of that, we can then five years? impact on their perception of cybersecurity drive processes and controls to reduce risk in With cybersecurity and data privacy almost and data privacy as a risk: GCs working for that space. We partner very closely with our IT unanimously rated as the most pressing risks for manufacturing companies were just as worried as team. I think that has probably been the biggest No significant GCs both currently and in the coming years, many those working for healthcare providers. change I have seen the last 12 to 24 months. I change Somewhat 18.18% think Legal and IT need to be best of friends increased This is something that Seshani in-house, and you really need an integrated 38.96% Bala, general counsel at Chartered approach to effectively manage risk in that ‘CYBER ATTACKS HAVE Accountants of Australia and New space.’ Zealand, has seen personally. INCREASED DRAMATICALLY IN ‘Before moving to a digital solution, I think Will significantly ‘Another big challenge is that we it is really key to understand how each platform Unsure increase are trying to give customers and stores, secures and moves data. Mapping 10.4% THE LAST FEW MONTHS.’ 25.97% members a personalised experience, out that data flow process and understanding Will significantly and to make data-driven decisions as a the data risks and data journey, as well as how decrease business,’ says Bala. it integrates with other platforms or plug-ins in 6.49% of the in-house counsel surveyed and interviewed other locations is important. It’s a given How do you for this report had much to say on the subject. ‘So, we are collecting more data to focus on that digital solutions need to comply with anticipate the risk that personalised, segmented experience. applicable privacy laws but legal technology profile of your Will slightly ‘Cyber threats form one of the biggest security That increases the potential privacy risks in solutions also need to appropriately protect decrease organisation changing risks of the 21st century,’ said Ritankar Sahu, the event of a data breach. The penalties are legal privilege, corporate record holding, 12.99% in the next five general counsel and head of compliance for very high under GDPR and Australian law. We and in-house destruction and recovery years? the Maxpower Group, operating throughout are now seeing other countries move to a policies.’ Southeast Asia and the Middle East. mandatory notification system that is in line with GDPR standards, and this poses greater No significant ‘Most Fortune 500 companies have been pressure on organisations to make sure they MODERN WORKING change victims to some form of cyberattack leading to have robust policies and procedures to Will slightly 9.09% economic damage ranging from a few thousand quickly comply with those notification While the large difference between current increase to a few billion dollars. Cyber-attacks have requirements.’ risk and expected risk over the next five years 35.06%

12 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 13 MOVING THE GOAL POSTS MODERN SOLUTIONS TO NOVEL RISKS

is undoubtedly a reflection of an increasingly work platforms and digital ecosystems,’ says ‘We have also seen our mail servers being ‘Increased oversight by regulators is reshaping data-driven world, the effects of the COVID-19 Sahu. the victim of ransomware attacks and we the way we approach risk,’ agrees Armando pandemic will certainly also be playing a role. have had to strengthen our firewalls,’ Cruz, director at KPMG in Mexico. With home working becoming near-ubiquitous ‘This has made us highly dependent on explains Sahu. ‘In the months to come, I over the past few months, the volume of data technology which in turn has exposed us to am certain that companies will allocate And as with everything, this dynamic between being transmitted – either from workstation to more sophisticated cyber threats. For more budget and resources to address regulators and the market is being redefined by workstation, colleague to colleague or business MAXpower, this has not been much different. cybersecurity risks, and I do see a rise in COVID-19, according to Maria Alvear, general to customer (and vice versa) – is at an all-time Our fleet of gas engines are spread across procurement of cybersecurity insurance counsel at Chile’s GASVALPO. high. This, too, means that the scope for bad remote sites in South Asia, and given applicable coverage.’ actors to gain access to confidential data is also travel restrictions, we have had to rely ‘In my view, the whole landscape will change higher than ever. extensively on our cloud based technology after COVID-19 crisis lowers its impact. It will platform which lets us track ‘live’ operating REGULATORS probably remain within us for a while and ‘The effects of the pandemic, and the performance, profitability and emissions from that encourages us to change our old ways of current situation the world is in, pose several a centralised asset dashboard. The technology The interaction between the regulators’ working and doing business, including regulatory challenges for us in terms of rearranging our also lets us engage in predictive analytics attitudes to risk and the reality on the ground risk management. and gives us valuable fleet-level for in-house counsel is complicated. In some insights.’ instances, regulators are leading the charge by focusing on an area of ‘ENTERPRISES STILL HAVE LOTS ‘From a risk management concern and proactively shoring up perspective, I think the industry the relevant protections, or cracking 'INCREASED OVERSIGHT BY view is that enterprises still have lots down on non-compliant entities. On TO DO BEFORE THEY CAN CLAIM to do before they can claim that they the other hand, regulators may have REGULATORS IS RESHAPING THE are breach-proof. MAXpower’s fallen behind the in-house community THAT THEY ARE BREACH-PROOF.’ exposure is no less than other in how they approach these areas similarly placed power producers in of concern. In this way, regulators WAY WE APPROACH RISK.' the market.’ can make a company’s compliance journey both easier and more fraud agenda,’ says Gustavo Sáchica, chief ‘We constantly strive to make our systems difficult. legal and compliance officer at Allianz in less vulnerable to digital threats. As ‘Regulatory risk management has been Colombia. general counsel, I recognise that we are Khaled Shivji, chief legal officer at the UAE’s very challenging during these months, with not breach-proof and regularly engage in Moro Hub, highlights this point. ‘In order to several regulations being issued due to ‘In-house legal counsel need to anticipate conversations with our operations folks reduce the regulatory cost of compliance, COVID, so it’s hard to keep up-to-date and the possibilities of fraud under pandemic trying to gauge whether we are doing we would be grateful to see more proactive perform accordingly. I guess this uncertainty circumstances. At Allianz, we have measured enough.’ guidance from regulators and prosecutors that we are facing will remain; sticking to and stressed our risk tests in order to consider as about the kinds of risks they believe are rated regulatory compliance will become more many possibilities as possible.’ For some in-house counsel worried about by the national and state governments as important than it is today to avoid a situation what the future might hold for their risks that, if not tackled, will diminish the where lack of control and uncertainty ‘Due to Covid-19, increased working from cybersecurity efforts, the risk is already country’s overall international rankings give space for corruption to enter the home has resulted in a rise of remotely-accessed eventuating. concerning white-collar crime.’ business.’

14 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 15 DOMINO EFFECTS

During times of economic uncertainty, the prevalence of white-collar crime appears to be increasing, believes Ahmad Ismail, general legal counsel at Saudi Aramco Jubail Refinery. He shares his thoughts on how the business AHMAD ISMAIL, landscape has changed for the oil and gas industry since Covid-19, and what other general counsel working in the sector should expect. GENERAL LEGAL COUNSEL, believe the most important item for has increased simply because earlier in the year, general counsel is to be a good role model nobody knew about how this pandemic would SAUDI ARAMCO JUBAIL I and especially when protecting against pan out. Most organisations will have to be agile, white-collar crime. General counsel, many of and optimise their operations, because their whom advise at the board level, are seen as overall risk profile has increased. REFINERY COMPANY critical enablers to ensure that the company maintains and sustains its ethical behaviour. Focusing on the economic changes, an industry that has been clearly impacted is the travel Earlier this year nobody knew anything about industry. Aeroplanes are not flying and as a result Covid-19. This has significantly changed the are not going to be using as much fuel. As a whole business landscape in relation to how consequence, oil and gas companies do not need parties are conducting business, how people are to produce so much jet-fuel for the aeroplanes. contracting and how people are negotiating. The It is a domino effect which will snowball and role of general counsel is a tough one because impact our revenue. If we need to shut down you need to protect the company, yet maintain equipment, for instance, that will have a ripple that balance to ensure businesses can survive. effect and this will impact the whole eco-system, We need to behave legally, ethically, morally right down to the janitor who cleans that and responsibly, especially when reputation is at equipment. stake. There is no price you can put, as general counsel, on a company’s reputation. In addition, as businesses and offices are being run remotely, we are turning to technology to When we look at the risk profile of an ensure that compliance is being met. To a certain organisation, firstly you need to define what extent, even artificial intelligence in the legal risk profile means. In this case, it means what field may become a new norm in the profession. the management has recommended and the Board has approved. That involves a whole set The risk to cyber security has also increased in of considerations: business economics, viability, recent times. The nature in which business is business environment, future technology, to conducted has changed and now more than 50% name just a few. Regardless, the risk profile for of work is done at home. Everything is going most organisations in the oil and gas industry digital and that poses a big risk.

16 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 17 When it comes to cyber security, we have several adhered to. This is a moral obligation for GCs read your file and know what is going on before so many times and it is something we do not like, policies to ensure that all our employees are in to do the right thing and use their moral making a diagnosis. but as general counsel we need to ensure the strict compliance with our own cyber security compass. company has sufficient systems in place. This is guidelines and policies. We do many internal That is the process I have put forward for particularly relevant to cyber security, which is phishing campaigns and document who clicks on As lawyers, we are trained to follow certain legal and compliance, but when it comes to an area that can be easily crippled in uncertain the links. We make a note, and this will impact rules, so, in our legal department, we have compliance, there is a bit more structure in terms economic conditions. their year-end performance. That is how extreme created a legal and compliance procedure of process. I will take the laws and legislation we go to ensure that all our employees abide where there are several legal and compliance which effect oil and gas operations, and develop In current times, businesses are going to checklists. This can be a compliance checklist to ensure everything be impacted any way you look at it. General used in relation to a legal is compliant with the dispute, a clarification or law. The respective I HAVE A VERY CLEAR LEGAL PROCESS whenever someone comes stakeholders will then ANTI-BRIBERY AND CORRUPTION IS to legal needing an answer. have to complete their AND I ENCOURAGE ALL LEGAL COUNSEL I will conduct a clarification yearly sign-off to ensure ALWAYS AN ISSUE OF CONCERN FOR session and ask them to compliance. TO HAVE THAT. fill in a legal action request form enclosing supporting Also, anti-bribery and MANY FAST-MOVING ORGANISATIONS. documents and information. corruption is always an I rely on that to make my issue of concern for many legal analysis and make fast-moving organisations. by our guidelines. Nobody likes it, but it is very decisions on matters. I have a very clear legal When you move fast, there will be people under counsel are going to be pressured. I believe effective in driving the message of cyber security process and I encourage all legal counsel to pressure who are tempted to cut corners and a tsunami is coming that will affect economic home. have that so that we can track and measure take shortcuts. This is when the problems start. conditions. The skies ahead are gloomy and our performance. I need to know all the I think bribery and corruption is on the rise: I do there is going to be a storm; you need to These are unique and unprecedented times and information and be satisfied with the facts not want to be negative, but this is just what I have an umbrella, when you look at the Covid-19 has shown the world how the planet before I can pass judgement. The way I think have seen having gone through two economic future. In the end, general counsel will always has been mistreated. I think because of this, the about it is it’s like going to the doctor: Before crises in the past. Whenever there is an economic aim to follow the spirit of the law. What is role of general counsel has expanded in that you see the doctor you need to register crisis, there is always backlash and an increase in the spirit of the law? It is to be fair, that rule there is now a higher expectation for general yourself, your blood pressure is taken and bribery and corruption. I do not know why, but of law principle needs to be upheld by counsel to ensure compliance regulations are your weight is checked. The doctor would then this seems to always be the case. I have seen it everyone.

18 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 19 THE ETHICAL SHIELD

irtually all respondents to our does – or doesn’t – manifest within the wider DATA ANALYSIS PART ONE: survey had an opinion on whether business. V ethics and compliance were treated as two different topics within their organisation. Despite near-universal agreement among There was no overwhelming consensus, in-house counsel that their teams are THE ETHICAL SHIELD however 61% of survey participants said important to an organisation’s ethical that they are not treated as distinct concepts makeup, just 63% felt that they and their within their organisations; 35% said that they teams are appropriately placed to promote were. an ethical business culture within their organisation. ‘Many companies think that these should be separated, where one should focus on the ‘Even though they are managed by same team, law and the other on the company culture as they are materially different,’ says Miguel a whole,’ explains Armando Cruz, director at KPMG in Mexico.

Regardless of the relationship between Do you currently feel that you and your team the two, some consensus has emerged are appropriately placed within your from the results suggesting that the question organisation to promote an ethical business of ethics does and should touch all areas culture? of the business – not least of all in avoiding the ire of regulators and investigatory bodies.

90% of in-house counsel consider corporate ethics highly important in avoiding white- collar investigations. Similarly, 87% considered 36.51% the legal team as ‘highly important’ to the promotion of an ethical business culture within an organisation – 12% consider it Yes ‘moderately important’ – and just 1% of respondents thought that the legal team was No less important than that. Just as compliance continues to take on increasing importance for businesses around the world, so too have questions of ethics. But the The results show a near-universal appreciation for ethics within a business 63.49% relationship between the two concepts and their implications for business by in-house counsel. This is unsurprising. in general are not always easy to pin down – particularly in the context of However, what is surprising is the extent to which that feeling from general counsel investigatory risk.

20 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 21 DATA ANALYSIS PART ONE COUNTRY Giving the in-house community COMPARATIVE greater insight into unfamiliar jurisdictions GUIDES #legal500 2021 #compguides If no, what would you say is the biggest reason?

4.35% 34 80+ 375

13.04% Practice Areas Jurisdictions Contributing fi rms

4.35%

60.87%

17.39%

Responsibility not assigned to one Institutional structure makes the department in particular. Not well defined involvement of legal impractical

Not enough resources Culture and conduct are the domain of another department Not enough organisational interest

Oyonarte, VP legal and corporate affairs Indeed, those who didn’t feel that their include Contributors at VTR Comunicaciones SA. team is appropriately placed overwhelmingly pointed to factors external to the legal ‘Ethics is much bigger in terms of scope team as being the biggest reason. 61% and impact on culture. For its successful cited institutional structure as making legal’s management, it requires the lead of the CEO involvement impractical. The next most and all their direct reports. It is also much more cited reason was that culture and conduct difficult to change – it requires full cultural were the domain of another department change.’ (17%). legal500.com/guides/ From the publishers of All Comparative Guides are free to view online 22 | GC | GCMAGAZINE.COM DIGITAL LAUNDERY

As cryptocurrencies continue to proliferate, concerns about their vulnerability to criminal money laundering are becoming more common. GC talks to counsel from the crypto eco-system about how big of a problem money laundering is for crypto, and how in-house teams can prevent it.

24 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 25 DIGITAL LAUNDERY CASHING IN ON CRYPTO

FUTURE FINANCE held by every other participant in the blockchain, DANGEROUS MONEY with a mission to making breakthroughs in as well as all of the subsequent transactions that core blockchain technology and the integration Cryptocurrencies and the blockchain technology have been recorded. Some sceptics of the digital asset revolution of blockchain with other industries. It has underpinning them have seen exponential point to the difficulty of protecting against over US $1bn trades occurring daily on their adoption over the past ten years. Perceived ‘Blockchains are basically networks – a series criminal misuse: after all, regular currency cryptocurrency exchange. failures of the status quo and a desire from of computers – that rely on a process system has financial institutions mediating each innovators for improvement has meant that of interconnected computers who validate transaction and leaves a supposedly identifiable today, cryptocurrencies are now widely accepted transactions,’ explains John Roth, chief paper trail. The anti-money laundering battle is WASHING DIRTY CASH in many corners, from retailers to charities to compliance and ethics officer at Bittrex.com. big enough with traditional forms of currency, governments. The underlying technology is Bittrex is a US-based cryptocurrency exchange so how can digital currencies avoid criminal Criminals are able to use crypto money finding wide application, being used to reinforce with a large clientele of institutional investors. misuse? laundering to disguise the criminal source of supply chains and preserve evidence. He is also a former US Department of Homeland their cash assets employing a combination of Security Inspector General and The United Nations Office on Drugs and Crime different approaches. The most simple method Department of Justice prosecutor. estimates that US$800bn to $2tn is laundered of money laundering banks on the fact that THE EXPLOSION OF DIGITAL every year – most of this being in cash. According undertakings made with cryptocurrencies are ‘In plain English, there are computer to the Chainalysis 2019 Crypto Crime Report, pseudonymous. operators who are ensuring that the US$2.8bn in Bitcoin was laundered by criminal ASSETS HAS BEEN ENABLED BY networks are healthy and that as you entities in crypto exchanges. ‘The reason that criminal activities increasingly engage in transactions, these are involve digital assets is because of the anonymity BLOCKCHAIN TECHNOLOGY. actually valid transactions. Most folks ‘One of the key benefits from blockchain is features of these digital assets,’ says Ng. ‘But, aren’t doing it for free, they’re doing it user autonomy in that users are able to control looking at the recent trends, there are actually because they’re incentivised by crypto how they spend their money without dealing fewer criminal activities using digital assets for currency. So, blockchain is more than with an intermediary authority like a bank or laundering.’ just value transfer.’ government,’ says Swadesh Gupta, Director of The explosion of digital assets has been enabled Legal and Strategy at Wallet Circle, a hyper-local The usual approaches that apply to conventional by blockchain technology. A blockchain is a ‘Crypto is getting less and less risky because customer engagement platform. cash money laundering also apply to crypto- series of mathematical structures, inside which there are more and more providers of services laundering. There are three key phases of individual transactions are recorded. The record which have been in the business for multiple Roth expands: ‘There’s a fallacy out there that (crypto) money laundering: placement, hiding of each transaction – each ‘block’ – is dependent years which educate the people,’ describes Lars somehow these digital currency transactions and integration. on the block that came before it, and becomes a Hodel, Head of Legal and Compliance Bitcoin are secret – actually, nothing could be further permanent part of the history of the blockchain. Suisse AG, which was established in 2013 and is from the truth. These are very transparent Placement is moving the dirty cash from its This means that the record cannot be tampered the first Swiss-regulated financial intermediary transactions, you can identify transactions by original source into a legitimate cryptocurrency with: once it is added to the blockchain, all specialising in crypto-financial services. date, time, amount and blockchain location.’ system. subsequent transactions are recorded in relation to that block and all of the blocks that ‘If you want to buy Bitcoin or get crypto asset ‘It resolves the trust issues in a transaction, ‘The first crypto placement stage is super came before it. Following each transaction, exposure today, you don’t need to log into some and the transactions on blockchain are totally important to focus on,’ explains Roth. ‘Any time the updated blockchain is distributed to each shady-looking site, you can just Google and find transparent,’ adds Gilbert Ng, legal counsel at that there is a bridge between fiat currency and participant. Any attempt to change a record in your providers to see that it’s real people. Access Huobi Group. Huobi Group is a world-leading digital currency, you really want to pay attention the blockchain will put it at odds with the version to crypto assets is getting easier.’ company in blockchain and digital asset industry to it.’

26 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 27 DIGITAL LAUNDERY CASHING IN ON CRYPTO

This is done through often loosely regulated you’ve had in the traditional banking world for Hodel expands further, adding that: ‘Even if ‘But, the risk that exists in cryptocurrency that crypto exchange platforms and initial years.’ you use privacy coins where you can’t trace doesn’t exist in typical currencies, is the idea that coin offerings, right through to the use of transactions, you need to explain why you used you can do a peer to peer transfer of value: cryptocurrency ATMs which have already that coin. Any provider who sees a client using I’m a bad person, you’re a bad person and we proliferated throughout bars and grocery stores THE ‘LAYERING’ PHASE privacy coins on a large scale needs to question want to do some sort of financial exchange. around the world. The complicity of crypto ATMs their client about why they’re using them. If a We can do so with cryptocurrency without in the process highlights one of the reasons The second stage, hiding or ‘layering,’ conceals provider sees an unusual fund and analyses this involving a bank or a credit card company these novel digital assets are being used to the origin of the dirty cash through a sequence on a professional level, then this will be flagged.’ because peer-to-peer transfers are with cash. launder criminal funds. What might initially be of transactions and financial tricks, moving the This is a new paradigm for criminals to exchange thought of as a necessary lowering of the barrier cash through different accounts, currencies and ‘When you look at currencies such as Monero, value without somebody looking over their for widespread crypto adoption now represents exchanges to obscure its true origin. Just how they use ring signature encryption which makes shoulder.’ an easy access point for moving dirty money into effective a would-be launderer can be using it incredibly difficult for any company to track the the digital financial system. digital assets will depend on the asset itself and source of that asset,’ says Gordon. The final stage, integration, involves the the infrastructure used to deal with it. Some newly laundered money being returned to the ‘We know that in the placement stage, cryptocurrencies have specific focus on privacy, ‘However, some privacy coins do have people transact with crypto ATMs,’ explains such as Monero. Others do not. keys to reveal the true owner of the Rory Gordon, legal and compliance officer at assets which must be given over if SOME CRYPTOCURRENCIES HAVE Coinfloor, the UK’s longest established Bitcoin As Roth describes, all transactions are recorded there’s subpoenas or relevant court exchange. on the blockchain, which provides a level of orders, but generally privacy coins SPECIFIC FOCUS ON PRIVACY, transparency which ultimately makes complete allow virtual anonymity.’ ‘We’ve had concerns from the police before privacy difficult. Monero circumvents this. because [crypto] ATMs have been particularly Monero transactions hide the sender by ‘signing’ ‘Technically, criminals can stay SUCH AS MONERO. popular with drug dealers, seeking to convert each transaction with multiple signatures, only anonymous under blockchain,’ says Ng. large quantities of cash. A popular way to get one of which is that of the actual sender. The rid of that cash is through [crypto] ATMs amount being sent and the receiver are similarly ‘But, practically, no. Most criminals because you can deposit the cash, get the private. will use crypto exchange platforms or over-the- launderer with an apparently legitimate – or at Bitcoin, and from there it’s much easier to counter (OTC) agents to convert digital assets least, unknowable – legacy. If money reaches make up a backstory as to where you got it all ‘It depends largely on whether they’re using into fiat currencies. In such cases, their identities the integration stage, it becomes much more from.’ regulated exchanges. In the EU, US, Canada would probably be revealed if proper KYC (know difficult to trace back to its criminal origins from and Australia, the exchange networks are your client) procedures are in place. that point. There are also the more conventional concerns very heavily regulated and require verification at the placement stage, as Hodel explains: procedures that make customer identification ‘It’s a fairly easy exercise to see through what’s and law enforcement considerably easier. So, if a really happening,’ says Roth. ANTI-MONEY ‘It’s very easy to ask your friends to deposit criminal uses one of those exchanges it’s almost LAUNDERING SOLUTIONS money for you or ask a stranger if you can use a trivial exercise to be able to expose them. And ‘With decentralised exchanges, it depends his ID to open an account. These are the things because digital currency transactions are publicly on what the exchange looks like and how it Considering that blockchain technology that we see which are the most used cases in indelible, all they need to do is cross-exchange operates. It may make it more challenging, but administers a public log of each and every money laundering. These are very traditional, once and it can be traced all the way back,’ no more challenging than tracing traditional transaction – leaving behind a permanent non-blockchain, non-crypto attack factors that explains Roth. money laundering through traditional banks.’ trail – susceptibility to money laundering

28 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 29 through cryptocurrencies is somewhat ‘What helps is installing an in-house legal and value transfer, but the measures for AML are country follows is super important. Otherwise, manageable. compliance department and then training people largely the same,’ says Roth. you get a regulatory arbitrage where money - not only on the technicalities, but, also on launderers will gravitate towards to weakest ‘Even if you are a weak provider or intermediary what AML exactly is. Technical understanding is ‘You have to KYC and understand your regulatory scheme.’ in the placement phase, who doesn’t take anti- crucial. You need to know what you’re dealing customer’s business, so you can understand money laundering (AML) seriously, I can still check with. If you take a retail compliance officer, you what typical business transactions look like ‘Like any nascent industry, one needs to be that in the integration phase at a later stage on the probably wouldn’t get the compliance challenges and have alerts generated for transactions or very aware of the risks that surround the crypto blockchain, which is great because you can’t do that you would expect from a tri finance bank a series of transactions which deviate from the industry, especially when dealing with non- that in the traditional banking world,’ says Hodel. and vice versa,’ adds Hodel. expectation of what that customer is doing. You regulated entities,’ notes Jonathan Galea, CEO must have good AML hygiene. It really isn’t all of BCA Solutions and a long-standing crypto- ‘It’s wrong to say that cryptocurrencies can Gordon echoes this sentiment: ‘Having a much different than what traditional financial focused lawyer who wrote his 2015 Doctorate of facilitate money laundering. Cryptocurrencies can compliance and legal department and having institution programmes look like.’ Laws thesis on crypto and AML. be used for money laundering like any other asset, the right policies and procedures in place, be that fiat, art or even physical precious metals. actually gives you the tools to tackle this. Of ‘In fact, most companies would treat crypto In the beginning, technology is usually used by course, you need to obtain the necessary CLEAN REGULATION as a high-risk industry. However, one needs people who want to take advantage of the fact documentation on your customers. You need to to differentiate between the various service that some technologies are not used very broadly.’ know who they are but you also need to monitor Globally, when it comes to cryptocurrency providers and stakeholders involved in the their activity and have intelligent checkpoints in transactions and AML enforcement, the law industry, versus the actual technology powering ‘It was exactly the same with the internet, place. ’ drastically differs from jurisdiction to jurisdiction: crypto as we know it. The latter, namely people used it to hack things and then today you from relatively strict regulations in the likes of UK, blockchain technology, has proven to be a far still have online banking, despite the hacks. With Though bad actors will continue endeavours the US, and much of Europe to practically non- better tool for tracking and tracing movements crypto, it’s the same – it was used by people to bypass and manipulate blockchain, money existent enforcement in many other countries. of money than traditional technologies. This who wanted to try to find a new way across the laundering can be prevented with devices that is precisely the reason why one shouldn’t go banking system, to money launder.’ pair consumer data with their respective crypto ‘Money laundering is an international crime and overboard, or essentially over-regulate, before a transaction records. These tools can make it money launderers, just like other criminals, don’t sufficient understanding of a new technology and But while cryptocurrency is not the ultimate relatively easier for businesses to clamp down respect international boundaries,’ argues Roth. its repercussions is obtained, and then proceed enabler of laundering that it is sometimes on crypto-laundering, stay AML compliant and to assess the various stakeholders in a particular accused of being, stamping out money isolate high-risk clients. ‘The ability to coordinate, harmonise and correlate industry in order to regulate them properly.’ launderers requires supervision and a these individuals to laws in a way that levels the commitment to compliance on the part of ‘With crypto, there’s nothing new under the sun, playing field, among many different countries, Arguably, the general lack of consistent global companies within the ecosystem. this is simply a different sort of take on typical with a uniform set of standards of laws that every regulation is creating considerable risks in

30 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 31 DIGITAL LAUNDERY CASHING IN ON CRYPTO

increasing the scope of potential manipulation under regulated countries, on the other hand,’ unified approach towards this is something US$829m Bitcoin was spent on the dark web. of cryptocurrencies by criminals – therefore, says Roth. that makes it extremely difficult,’ adds Hodel. To put these figures into context, that’s only the effectiveness of such protections against 0.5% of all Bitcoin transactions, with 2 to 5% money-laundering is somewhat questionable ‘There needs to be more global coordination, Roth agrees. ‘There’s a variety of legislation of global GDP, or up to US$2tn through the and perhaps even discourages the broad scale and less tolerance for countries that prevent that we deal with. One issue we have here in traditional financial institutions. adoption of cryptocurrencies. core regulation, so we have the cryptocurrency the US, you probably don’t have as an issue exchange market which is not completely in the UK or the EU is here, is that we’re also ‘Money laundering is not as big of an issue ‘One of the biggest challenges is that we’re dominated by these large exchanges who are governed by state law. So, because we’re in the crypto space as it is often reported to be not all speaking a common language across purportedly registered in the Seychelles, Malta, operating in all 50 States, we are required to or often perceived. It’s a misconception and jurisdictions in terms of enforcement,’ adds Hong Kong or Singapore, but are in fact, not be compliant with state law as well as federal it’s actually very easy to counter,’ maintains Liat Shetret, Senior Advisor for Crypto Policy regulated at all.’ law. So the biggest challenge that we have is Gordon. and Regulation at Elliptic, a blockchain analysis scanning a variety of different laws that apply to provider which specialises in crypto compliance However, Gordon argues that the possibility of us and ensuring that we are in compliance with ‘We’re still in the early adopter phase of and risk monitoring technology. exploitation by criminals is being eroded: that.’ cryptocurrency,’ says Roth.

‘It’s definitely an issue, but it’s However, Hodel argues that ‘if you’re working ‘In the grand scheme of things, it’s just a tiny being mitigated this year by the in the financial industry, you’re used to having fraction of the global financial world. But, I ‘WITHOUT STANDARDISATION, THE 5th EU Anti-Money Laundering different legal and regulatory frameworks apply think cryptocurrencies will reach a tipping Directive – so that’s the reason for to your product. It would be nice to have one law point where it’ll be common for you to have the Financial Conduct Authority that is applicable to any situation worldwide but a Visa, Mastercard and a cryptocurrency REGULATORY NUANCES BETWEEN taking crypto under its wing. this is not how law works. Just because crypto backed debit card in your wallet to engage in We’re seeing a lot more global co- is not part of the financial market regulation transactions. We think that the next two to NATIONS CAN BE EXPLOITED.’ operation with crypto compliance yet, we still have the very basic civil and penal five years will be a mainstream adoption of now.’ codes which, for example, provide punishment cryptocurrencies in a way that will fundamentally for fraud. We have a common understanding of change the volumes of crypto involved, as ‘Global regulations are developing what should be okay and what is not okay, and well as the risks.’ and on the right track, but it this doesn’t change when we’re dealing with ‘Without standardisation, the regulatory takes time for regulators to acquire sufficient crypto.’ Gordon agrees: ‘In the coming years, we’re nuances between nations can be exploited. knowledge of this industry,’ adds Gilbert Ng. going to see mass adoption, with big traditional If there is a loophole, it will be found by bad financial players eventually entering the actors, especially if there’s an assumption they One of the biggest challenges facing in- CRYPTO DISRUPTION crypto industry once the regulation comes in. won’t be caught because they assume their house legal teams is one of compliance with Crypto will be used as a store of value for a activity on the blockchain is anonymous. everchanging AML and crypto regulation Despite the fact that cryptocurrencies can lot of unbanked individuals. Last year around What many don’t realise is that all through differing jurisdictions. indeed be used to conduct illicit criminal activity, 1.7 billion people were without banking cryptocurrency transactions on the blockchain the principle impact of such currencies on globally. The great thing about crypto is that are immutable.’ ‘This is one of the risks that we face. We need illicit crimes, such as money laundering, when you can easily set up a wallet by yourself on to vet every country – literally – for what is juxtaposed to cash transactions, is little to the phone or computer. I think it has enormous ‘There’s a vast disparity between the EU and the allowed and what isn’t. It differs even if you’re none. According to The Foundation for Defense potential to transform economies and provide US on the one hand, and what I would call the EU member states. That we do not have a of Democracies and Elliptic’s 2019 report, opportunities to people the world over.’

32 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 33 COMPLIANCE MAINTENANCE

The world is evolving, and white-collar crime remains a forefront concern for many general counsel. Discussing why that may be the case is Ritankar Sahu, general counsel and head of compliance at MAXpower in Singapore.

RITANKAR SAHU, serve as the general counsel & head of application of the FCPA (or the UKBA) is that compliance of MAXpower Group, Asia’s it is not dependent upon the existence of any I leading gas to power specialist and a key contractual arrangements that a company may GENERAL COUNSEL AND developer, owner and operator of small-to- have in place. We have to engage in an extensive medium gas-fired power plants. I also sit on dialogue across all ranks of employees to the Board of the MAXpower-Mitsui & Co., a socialise our exposure. HEAD OF COMPLIANCE, joint venture which operates a separate group of power assets in Myanmar. In addition to The biggest FCPA concern in emerging providing strategic business governance markets is pressure to pay. We try to tackle both MAXPOWER GROUP counsel to the Board, my work involves advising the supply and demand side (more so under on power projects, turnaround management, kleptocracies) of the bribery problem through FCPA enforcement and special situations M&A. a concentrated effort of top-level leadership, Prior to joining MAXpower, I was the regional tone in the middle, a robust code of conduct, a corporate counsel for Jacobs Engineering tactical internal conduct code training process, Group’s Asia operations, based in Singapore ground-level determination, and ingenuity. We and Mumbai. I have also worked for Norton also try to convey the message to employees Rose Fulbright, at the firm’s London and Abu that penalties for non-compliance are severe, Dhabi offices with a practice focus on energy including imprisonment, unlimited fines (typically projects. fixed at tens or hundreds of millions of US dollars), debarment from public procurement For MAXpower, white-collar crime exposure contracts, company director disqualification, means unfavourable exposure to laws on asset confiscation, disgorgement of profits, bribery, sanctions, export control, anti-money adverse reputational consequences and laundering, internal controls, audit standards substantial legal costs. To have greater impact, violations, etc. The potential breach of certain our training materials focus on figures (i.e. anti-bribery legislation like the US Foreign potential economic disruption) and flesh Corrupt Practices Act 1977 (FCPA) or the UK and blood references from past individual Bribery Act 2010 (UKBA) may pose a greater prosecutions. risk than others. The FCPA is the single biggest legislation affecting anti-bribery compliance The four broad components of a successful programmes globally. The complexity of the compliance programme consist of an

34 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 35 analytical enterprise-wide risk management can also impact compliance efforts. Through and the Head of Procurement on speed dial) are acts as an assurance for the public that the framework taking operating environments into our bespoke training and targeted employee very important. company is a good corporate citizen. Good consideration, broad institutional assent from engagement processes, and try to challenge compliance credentials will help in building public participants, control structures within which such countervailing social norms. We also As part of our corporate messaging, we also trust for the company. the leadership can act to stem breaches, and try our best to secure workforce assent to highlight that business conduct training is monitoring by independent specialised actors. the compliance programme and aim for an simply not moral rhetoric, but that breaches Year on year, the world grows more tech-savvy. As general counsel, I play the independent institutionalised acceptance of the bribery of applicable law can cause major economic Most large in-house departments already use and graft problem. As disruption leading to loss of jobs, amongst AI or automation tools in some form, and it general counsel, I know other real-world consequences. The company does result in cost savings. From a white-collar that what may work for leadership has also committed to encouraging crime angle, it is important to mention that the PRE-CONCEIVED NOTIONS OF WHAT the developed world reporting mechanisms of potential violations Criminal Division of the US Justice Department will not always work for by offering a sense of assurance to employees (DOJ) updated its memo on evaluation of ACTUALLY CONSTITUTES ‘MISCONDUCT’ emerging markets, and that no retaliation will occur, subtle or overt, compliance programmes in June 2020; this is a hence we deploy a risk- to ensure that employees feel safe to report good reference document from a prosecuting CAN ALSO IMPACT COMPLIANCE EFFORTS. based approach. We, concerns. We also realise that inconsistent moral agency setting out expectations on what a as a company, also realise messaging can be confusing for employees robust compliance programme should look like. that an eco-system of if legally enshrined moral principles (or The new subsection on access to data stresses zero corruption is an organisational value systems) conflict with their the DOJ’s recognition that data access and illusion. own socio-cultural beliefs, as shaped by local monitoring is critical to the proper functioning monitoring role. We train our senior leadership standards and ways of doing business. We are of a compliance programme. Data analytics can to comprehend (with the understanding that It is often the case with general counsel (no conscious that a sound code of conduct crafted help determine whether compliance failures the message will flow down) that in the case different in my case) that their formal authority with the right ethical considerations will boost are systemic or more aberrational. Such data of foreign laws and regulations like the FCPA, a falls far short of their responsibility, and their the company’s long-term competitiveness. can also help a company monitor investigations subject company has no means to contract out success is dependent on others outside their and discipline to ensure consistency, which of potential liability. own chain of command. Therefore, general It is also important to realise that strategic legal the memo suggests is part of a compliance counsel (who also have responsibility for or compliance personnel are not hired to be programme’s effectiveness. The focus on data Extra-territorial laws (like the FCPA) lack compliance) need to be a jack of all trades ‘liked’. Companies should remember that such analytics is thus a good indication that AI, public assent in most emerging markets, which and be savvy enough to drive through crucial personnel need to be respected as a voice of machine learning and automation tools will play adds to compliance challenges. Pre-conceived compliance controls. The right relationships authority by employees of all ranks. In most a more significant role in legal and compliance notions of what actually constitutes ‘misconduct’ inside a company (including by having the CFO listed companies, the chief compliance officer functions in the years to come.

36 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 37 LATHAM & WATKINS LLP

Douglas Greenburg, Benjamin Naftalis, and Nathan Seltzer of Latham’s ENFORCEMENT White Collar Defense & Investigations Practice look ahead to the PREDICTIONS FOR 2021 enforcement trends facing businesses in 2021.

ince November 2020, white-collar defense in the Obama era, which alone would mean an lawyers have faced one question: will the increase in the volume of white-collar work. S Biden administration change US priorities when it comes to pursuing a range of economic While it is still too early to judge exactly how the crimes? legislative and regulatory priorities of the new administration will impact business, existing Generally, it takes a relatively long time for a new features of the enforcement landscape will administration to have an impact on white-collar continue to have a big impact on international crime enforcement. White-collar matters often business. take a long time to process: cases that are not already being investigated can take months First, we expect to continue to see a to appear on the radar, and the decentralised sustained emphasis on anti-money laundering nature of the US system means that changes at enforcement, and the FCPA will remain one the national level are often less consequential of the most important US federal laws for than appointments of US Attorneys at key multinational companies. Second, sanctions and offices throughout the country. In addition, the trade controls will similarly continue to exert previous administration did not roll back on a substantial influence on enforcement in the its enforcement pursuits to the extent many US and beyond, largely because – in the United had anticipated. For example, aggressive FCPA States – there is rare bipartisan consensus enforcement continued through the last four on the value of sanctions as an instrument of years, in contrast to many expectations. All that national policy. One area we expect an uptick in said, we expect the next four years will bring enforcement is securities fraud investigations rigorous white collar crime enforcement across a against both corporations and Wall Street spectrum of white-collar cases. institutions, both civil and criminal, as we expect the new Administration will be highly Early indications of the new administration’s motivated in this area. Lastly, the aftermath of approach can already be seen in the COVID-19 will likely result in heavy scrutiny of appointments made by various regulatory potential fraud related to various COVID relief agencies, with Obama-era alumni returning to programs and in their related significant federal senior positions. Given the likelihood of similar investment. appointments at the DOJ, the SEC, and other relevant regulatory bodies, the next four years General counsel will need to mitigate these and could be marked by a return to the priorities set other emerging risks in the coming months.

38 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 39 COMPLIANCE FROM HOME REGULATORY COOPERATION expect its laws to play some part in mitigating to see how something evolves is no longer an AND CONFLICT the alleged misconduct. As any multinational option in a world where every country has the Almost without exception, all major policies and legal or compliance team knows, misconduct ability to bring sanctions, and coordination procedures related to compliance presuppose For multinational companies, the list of often occurs in countries that do not have a well- among international regulators is the norm. that employees are physically present in an office; potentially relevant prosecutorial authorities established judicial system or, in some cases, Pick up the phone and call someone who can that employers know where data and other grows with every year. We continue to see effective rule of law. This situation makes the help you avoid compliance problems that will records are stored; and that compliance teams increasingly aggressive white-collar enforcement resolution of any potential compliance issues in prove far more expensive than taking the have the ability to directly monitor staff activity. in many countries around the world, such countries challenging at best. necessary actions to prevent them. And, when an accompanied by closer international cooperation investigation arises, GC’s will need experienced For many companies, the global pandemic has among governmental authorities. Additional complexity can result by “blocking counsel who can ensure the company cooperates introduced new remote working environments statutes” increasingly prevalent in certain when appropriate, but who can also advocate where the physical presence of a company’s At the same time, conflict of laws between jurisdictions, effectively prohibiting compliance aggressively, when necessary. employees is largely uncertain, data may be jurisdictions is becoming more common, with US sanctions. This creates a challenge for stored across a wide range of depositories, and meaning multinationals must navigate a world GCs of multinationals, who must navigate an training is limited to formal interactions over where they face competing laws in different increasingly interconnected world while also Authors: webcam. For the past year, corporate compliance markets. For example, US authorities have adhering to sometimes completely incompatible has taken on an entirely new identity. come to recognise that companies are limited sets of laws and regulations. Douglas Greenburg, Global Chair of the White in what they can lawfully do to cooperate Collar Defense & Investigations Practice, is a Finding ways to ensure proper oversight of when an enquiry requires the production of General counsel will need to be sophisticated at partner in the Washington, DC office of employees in a remote environment is a work European data. Governmental authorities will navigating the relevant laws to avoid trouble. The Latham & Watkins LLP. in progress, and it remains to be seen how be pushed to cooperate ever more closely world is becoming more complicated and risks to regulators will evaluate the measures taken because US authorities often will only be able businesses are growing. This means their advisers Benjamin Naftalis, Global Vice Chair of the by employers. Even without worrying about to obtain necessary data only from their foreign will have to find unique solutions to a host of White Collar Defense & Investigations the stance regulators are likely to take, counterparts. As a result, multijurisdictional difficult challenges. The days of rolling out the Practice, is a partner in the New York office of businesses must work out how to build and investigations will increasingly be coordinated same playbook for every problem are over. Latham & Watkins LLP. maintain a strong culture of compliance in a between the different national bodies involved in remote working environment. Establishing investigating and prosecuting a case. Above all, GCs should remember the first law of Nathan Seltzer, Global Vice Chair of the the right tone and culture is, of course, much compliance: when problems arise, one cannot White Collar Defense & Investigations more difficult without physical interaction; The more white-collar crime is viewed as ignore them in the hopes that they will disappear. Practice, is a partner in the London office of nevertheless, it is a challenge businesses and a matter for collaboration among national At minimum, GCs will need to identify and act on Latham & Watkins LLP. GCs must reconcile for the future. regulators, the more likely a jurisdiction will potential problems as soon as possible. Waiting

40 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 41 PREPARING FOR THE WORST

GC surveyed top in-house counsel around the world to understand how businesses prepare for white collar and general investigatory risk, revealing little uniformity across companies and jurisdictions alike.

42 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 43 PREPARING FOR THE WORST A PLAN OF ACTION

t a time of increasing regulatory scrutiny that they did not believe that they had such Kjell Clement Ludvigsen, general counsel at almost a point (0.97 and 0.92, respectively) from in virtually all corners of business, and protocols and 22% were unsure. Norway’s Nortura. companies without a plan compared to those A with the stakes having never been with one. higher, now is the time for companies to get While it might first seem reasonable to assume ‘It should be very clear to all that they are their house in order in terms of their compliance larger companies are more well-resourced and responsible themselves for what they do, but ‘Aramco has zero tolerance in relation to any and investigatory response regimes. Our thus more likely to be in a position to create they should ask for assistance from legal or anti-bribery and corruption activities,’ says survey of top in-house counsel from across an investigatory response plan, this does not compliance if they are in doubt.’ Ahmad Ismail, general legal counsel at Saudi the globe revealed great disparities between appear to be the case. In looking at whether Aramco Shell Refinery Company. organisations, not just in terms of how they plan respondents’ organisations had implemented for a potential investigation or prosecution, a response plan, those from larger companies PREPAREDNESS ‘Therefore, I align my plan backwards from there. but also in terms of how high a priority such an (with over 100 employees) were less likely At each board meeting, I will align this with my endeavour is, and who within the business is best to report their organisations as having Another problem with trying to get a clear view president – I will check if there are changes, or placed to take ownership of it. implemented a response plan, at a rate of just of where businesses are in their white collar any fine tuning for the plan. We need to be agile 57%, compared to almost 80% of those from investigations risk is that areas of concern will yet able to optimise. But while most businesses – and certainly nearly smaller (less than 100 employees) companies. differ from company to company, every lawyer – would recognise the risk of and sector to sector. Our survey inadequate preparation in this area, whether ‘There can often be too many distinct business asked respondents to rate their this recognition had translated into action is units that would be involved in an organisation- level of preparedness in a variety ‘ARAMCO HAS ZERO TOLERANCE another story. Just 57% of respondents in our wide plan. What you end up finding is in those of key areas on a scale of 1 to 5, White Collar Investigations Survey reported that cases, it’s much harder to get a far-reaching plan with one meaning ‘not prepared their organisation had implemented a response together as in-house counsel,’ says one legal at all’ and five ‘very prepared’. On IN RELATION TO ANY ANTI-BRIBERY plan for regulatory investigations or white director in the Australian telecommunications average, respondents reported that collar prosecutions. 39% reported that their sector. their business was most prepared in AND CORRUPTION ACTIVITIES.’ organisation has no such plan. terms of their financial compliance ‘It is very important in our view to avoid a culture policies, scoring an average of 3.9. 49% of respondents felt that their company had where the operating commercial organisation Companies were least prepared in robust and effective investigative protocols in believe that no written guidelines from the top terms of their modern slavery policies, which came ‘Particularly now, as we have seen Saudi Aramco the event of an external investigation; 29% said of the organisation means “green light”,’ says in at an average of 3.0. has been listed on the stock exchange, that represents a higher level of responsibility, Those who said that their organisation had citizenship and corporate compliance for the implemented a response plan for regulatory organisation, including at the subsidiary level.’ Financial Bribery/ Modern Whistleblowing Crisis investigations or white collar prosecutions compliance corruption slavery policies response reported being more prepared almost across policies policies policies process the board than those who did not. In particular, WHOSE PROBLEM? respondents whose organisations had such a plan rated their preparedness, on average, up One reason why organisations appear to be Average 3.9 3.9 3.0 3.7 3.7 to a full point higher than those who did not. In behind the curve on investigatory planning is score (1-5) particular, both bribery/corruption policy and that it isn’t an area that uniquely lends itself modern slavery policy preparedness increased by to the legal team. Efforts in this area are likely

44 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 45 PREPARING FOR THE WORST A PLAN OF ACTION

How often do you review your planning and at all. 13% – the second most common response – on measures to be implemented to mitigate ‘The way I align my plan – especially in relation to preparation processes in this context? said it was currently a multi-departmental effort, legal and compliance risks – including the risk of anti-bribery and corruption and also in relation to and 10% said it was the domain of a dedicated investigation and prosecution.’ legal and compliance – is that I first understand crisis management team. the company legal risk appetite and then align 1.3% that to the business cycle of the organisation,’ he ‘Day by day, the executive team is more ANNUAL REVIEWS says. conscious of the importance and necessity of 19.48% the identification, mitigation and follow-up of Another reason that uptake and confidence ‘Clearly, all organisations have their own business risks,’ explains Diana Daza, legal director at SGS in organisations’ planning for white collar planning cycles, and within that business plan in Colombia. investigations is subdued might be because cycle you decide on the capital expenditure of 3.9% 37.66% there needs to be an ongoing commitment to the organisation, in other words, what type of ‘As a legal team, we are highly involved in daily reviewing and modifying the plan in order for investments they are making for the year.’ risk management operations in order to prevent it to stay effective: external risks are changing these sort of risks.’ constantly, while the risk profile of a business will ‘That is normally also mapped against the likely change as it expands or contracts into or company’s risk map. So based on that, I will Despite a current lack of ubiquity around which away from new business units. 37.66% departments are given investigation planning responsibilities, there is a sentiment that this is When it comes to reviewing their changing. From interviews with participants in planning and preparation processes ‘IN-HOUSE LEGAL TEAMS SHOULD this survey, it seemed a common view that over in the context of investigation Annually Never time, the pre-investigatory planning job and white collar prosecution risks, is landing more and more with the in-house 38% said that they review their ALREADY BE INVOLVED AT AN As-need basis Unsure team. process annually, while another 38% reported only conducting such EARLY STAGE BY THE BUSINESS.‘ Every five years ‘Based on conversations that I have had with a review on an as-needed basis – peers, it has become quite common that legal another 19% said that they never teams, in particular the leadership team, are review their plans in this area. involved in assessing the risk of investigations determine what the plan would be for the year to require active input from all corners of the and prosecutions,’ shares Oliver Jarberg, deputy ‘We undertake an annual review and it is critical in relation to legal compliance. I would analyse business, as well as an ambient level of support chief legal and compliance officer and director of to understand both the changes in the legal that risk map, and get clarification from the from the leadership team. integrity & anti-doping at FIFA. landscape as well as regulators’ approach,’ auditor and the Chief Financial Officer and the explains Kwong Wen Wan, group chief corporate controller. I’d then identify what would be the Indeed, when asked who within their ‘I personally believe that it is one of the key officer and group general counsel for Mapletree risk appetite for the organisation, and then organisation was responsible for designing aspects – in particular at management level in Singapore. I’d map the plan for legal compliance for the and maintaining the response plan, answers – for the legal and compliance function to be year.’ were split. While the legal team was the most involved with. In particular, in-house legal teams Ahmad Ismail is both a proactive participant in commonly cited department, it ultimately should already be involved at an early stage by his organisation’s investigation preparation, and For Jaberg, ‘at FIFA, we have a working group accounted for just 35% of the responses – and the business so as to flag critical operations, an avid proponent of conducting regular reviews composed of representatives of different just as many reported not having a response plan transactions, and provide advice and support of any plans or policies. professional functions within the organisation,

46 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 47 PREPARING FOR THE WORST

including internal audits, finance, legal and RENEWED INTEREST compliance, and different business units. FROM REGULATORS DATA ANALYSIS PART TWO: ‘They meet on a regular basis to map FIFA’s main Give the importance of preparedness for risks and devise strategies and plans so as to regulatory investigations and white collar mitigate the risks identified within this working prosecutions, why do companies of all sizes and SEEKING COUNSEL group.’ sectors report such vastly different levels of planning in this area? ‘I think it is important to establish a formalised risk management process to identify the While the subject may have been on in-house different risks – including that of investigations counsel’s radar for many years, many counsel and prosecutions – as well as ensuring interviewed for this report mentioned a ‘sea the processes and measures designed to change’ in the wake of the global financial crisis, which saw a redoubling of efforts on the part of regulators to rein in inappropriate and illegal conduct, ‘IT TAKES TIME – LOTS OF TIME – particularly in the financial sector. While a decade is a long time in some TO SEE REAL CULTURAL CHANGE respects, in terms of cultural shifts within massive organisations it isn’t very at all, and businesses are still TAKE HOLD IN A COMPANY.’ coming to terms with heightened sensitivity on the part of regulators and similar investigatory bodies. mitigate such risks are defined, evaluated and ‘It takes time – lots of time – to see real cultural implemented. As risks evolve over time, I think change take hold in a company, or industry,’ says it is important that they are reassessed and one long-time banking general counsel based in the processes to address such risks are then the United Kingdom. amended as required, based on the learnings related to each risk identified. So, in fact, this ‘There is an increased level of consciousness is a very dynamic task which also requires the around white-collar crime which I would say legal and compliance function to thoroughly began post-GFC and has continued since then. understand the business, the processes and But unless an organisation has already been Given the potential for external investigations and prosecutions to operations of the company.’ stung, it can be difficult to enact change quickly – severely impact an organisation, efforts to prevent, respond to and something I suspect every in-house lawyer will be ‘It’s important to be agile and on top of things, familiar with. It is on the in-house lawyer to keep mitigate this risk will naturally extend beyond just the legal team. and adapt to the changing circumstances as their foot on the gas and make sure the company Bringing in external counsel seems inevitable, but at what stage should required to protect the interests at stake.’ keeps momentum towards compliance.’ the in-house team seek outside assistance?

48 | GC | GCMAGAZINE.COM 49 | GC | GCMAGAZINE.COM DATA ANALYSIS PART TWO SEEKING COUNSEL

Method of engagement he use of external counsel, once business is critical,’ explains one senior an investigation or prosecution legal director in the European aviation has been made official, received industry. T 20.21% across-the-board support from participants in this survey. 77% of respondents considered ‘Departments are strapped for resources it at least moderately important for external as it is; the overhead of responding to a counsel to be involved at that point, with regulator – or worse, a formal prosecution – almost half of those considering it highly is beyond the capabilities of most departments.’ 14.78% 14.13% important. 14% reported feeling that external 13.7% counsel would not be involved. Those counsel who were a part of smaller departments were more likely to expect 11.47% ‘Especially in smaller departments I have external counsel to be involved. Respondents 10.28% been a part of, having a good lawyer in teams of 50 or larger were less likely than 9.19 % outside your business who knows your any other group to involve external counsel, with 31% reporting no involvement of external counsel at that stage. 6.24%

When it comes to involving external counsel How important are external counsel in in anticipation of an investigation (as opposed the event of an external investigation/ Direct Formal pitch Selection Selection Referral Referral from Referral from Referral from to when one has formally been announced), outreach to process/ from from insured- from former professional professional customer/ prosecution? approaches differ. Just 8% or respondents single firm ‘beauty contest’ firm-curated curated schoolmate/ within same from external business reported always involving external counsel at to select from preferred preferred colleague firm firm client this stage; 33% reported occasionally involved collection of provider provider Unsure external counsel and 38% reported involving firms panel panel 1.78% counsel ‘often’. Almost 20% rarely involve Not involved Highly external counsel at any point before the 14.29% important formal launching of an investigation or 37.5% prosecution. While the in-house community has been vocal it ‘moderately important’. Just 5% felt it Slightly in pushing for diversity in their partner law unimportant. important ‘We are in almost constant contact with at least firms, a company instructing external counsel 7.14 % one outside lawyer to consult with on any real on an investigatory or other white collar In choosing external counsel, respondents or potential investigations,’ says one veteran matter is typically more likely to involve a single reported choosing from a variety of sources. in-house counsel in the North American energy practitioner for representation than other types On average, in-house counsel were most likely sector. of legal work. Therefore, survey participants to have found their chosen counsel by direct were asked how important of a factor diversity outreach to single firms – 20% of counsel ‘We can’t afford not to. If the first time you and inclusion is when selecting counsel in these reported choosing their representation this are meeting with a lawyer is when the regulator situations. The overwhelming majority felt it way. The next most popular source was the Moderately is at your door, a lot of (avoidable) damage important, with 40% considering it a ‘highly use of a company-curated preferred provider important has been done.’ important’ factor and another 40% considering panel at 15%. 39.29%

50 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 51 ETHICAL GOALKEEPING

Dealing with bribery and corruption is a game that FIFA cannot afford to lose. Oliver Jaberg, Deputy Chief Legal & Compliance Officer and Director of OLIVER JABERG, Integrity & Anti-doping, shares how he continues to score goals for his legal team. DEPUTY CHIEF LEGAL & enerally speaking, there is a trend include players, referee officials and other with political and public pressure stakeholders – that it is usually too late when COMPLIANCE OFFICER G continuing to drive significant changes we need to open investigations into alleged in white-collar law enforcement throughout violations of rules safeguarding the integrity the world. In my opinion, it is important for in- of sports. When we have to investigate AND DIRECTOR OF house counsel to be on top of things in this misconduct, the damage is already done. So, area and particularly when it comes to advising with efficient, proactive and preventative our internal clients with the view to mitigate measures, such as training, online awareness INTEGRITY & risk. In particular, recent developments in campaigns and so on, we can ensure that all relation to the COVID-19 pandemic have put those concerned know what the rules are, a lot of pressure on colleagues at the forefront. and are able to avoid – as much as possible – ANTI-DOPING, FIFA We deem that it is our duty as in-house things going wrong. However, when things counsel to provide practicable legal advice go wrong, it is also key that we ensure that to the business, and at the same time adequately issues are addressed in a timely and thorough addressing the legal and compliance manner and that we bring to justice those risks. who don’t play by the rules and who are responsible for bringing our sport into Our first aim has always been to help our disrepute. internal clients and members make decisions that are in line with the applicable regulatory Football, similar to many other aspects of framework. This includes policies relating to business life, is not exempt from the risks ethical conduct such as – in our case – the FIFA of bribery and corruption. We have seen Code of Ethics and the FIFA Code of Conduct. that different individuals and companies who We aim to provide them with the knowledge and have been involved in football have been tools needed to identify legal risks in advance found guilty, amongst other things, of bribery and make decisions that adequately address and corruption. In that respect, it is very these risks. important to have the right tools in place, including the right regulations and processes In sports, when it comes to integrity and to address risks. Equally, it is important to compliance, I always tell our clients – which learn from mistakes that have been made

52 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 53 in the past and to avoid making the same to encourage a culture of speaking up and stringent processes. Of course, the actions many different initiatives, processes and mistakes again. flagging wrongdoing, as it is discovered. We committed by the perpetrators concerned tools. For example, our code of conduct have established eligibility checks including are also corrupt conduct, and here specifically serves as a one-stop shop; it provides direct FIFA has undergone a very thorough and integrity and background checks for all of in the context of sports, such corrupt and access to the code in all different languages, comprehensive governance reform process FIFA’s committee members. We have further illegal actions go against the very essence and it provides for different and direct links over the past years with the aim of addressing strengthened the processes in the context of the game; the integrity of the sporting to relevant directives, training materials and certain deficiencies that were discovered. As of the funds we invest to develop the game competition is destroyed, as is with the templates, including contract templates. We of football. We have case with the use of doping. But what is also have in person training, for example, we enhanced our processes more, if the unpredictability of the organised a compliance summit specifically when we check on the sporting result is jeopardised, the sport is tailored to the needs and challenges of WE HAVE A PARAMOUNT RESPONSIBILITY service providers and basically deprived of its very essence, which our 211 members associations, the football third party vendors with is not to know in advance of a competition confederations and other stakeholders. In TO DO WHATEVER WE CAN TO BEST whom we do business. who the winner will be. If this element is lost, fact, we are currently planning our next We have also massively no one will watch football matches in the compliance summit which will be held online PROTECT THE INTEGRITY OF OUR GAME. revamped our bidding stadiums or in front of the TV, and the in Autumn. processes for FIFA commercial partners that are helping generate competitions, including revenue, which is reinvested in the sport, Overall, when looking into the future, I the FIFA World Cup and will no longer be interested. It is a vicious circle personally am convinced that legal tech the FIFA Women’s World and we have a paramount responsibility to do and artificial intelligence will be highly an example, we have strengthened and Cup. We have also amended our policies to whatever we can to best protect the integrity relevant and beneficial for in-house counsel. formalised our compliance function. We have make them more user-friendly and relevant in of our game. We have already evolved quite significantly, further strengthened the system of checks everyday business transactions. These are compared to where we stood five years and balances, including the implementation of only a few examples, but all this was, amongst This is also why we work with many different ago. But, I believe that we are still in the terms of office, and segregation of powers other reasons, also done to strengthen our stakeholders to address the challenges of doping early stages and that the technological of the different bodies of the organisation. position in terms of anti-corruption and anti- and match manipulation and why we are also revolution for in-house counsel is just Also, we have strengthened the function of bribery. dedicating a lot of resources and also expertise beginning. What I am convinced of is that our audit and compliance committee, which and effort to address these challenges. we as lawyers and in-house counsel need consists mainly of independent members. We When focusing on the game of football, to be open to innovation and technology, have established a confidential reporting we see that match-fixing and doping are When it comes to compliance and due amongst many other things to enhance our system or whistle-blower hotline in order highly complex problems that require very diligence, we as an organisation have enacted risk management.

54 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 55 MODERN SOLUTIONS TO NOVEL RISKS

BANKING ON A BRIGHTER FUTURE

The Australian financial sector has gone through a major regulatory overhaul after allegations of misconduct were exposed through a Royal Commission. GC magazine investigates the impacts of these reforms on the role of general counsel.

56 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 57 BANKING ON A BRIGHTER FUTURE LOOKING INTO THE MIRROR

n the 30th of November 2017, The historical development of banks in Australia. Since the Royal Commission was televised, law reform process since the 1900s. The reform Australian Government announced a Jeff Morris was a financial adviser for Australia’s Australians saw the direct impact financial package addressed issues of weak regulation, O Royal Commission into Misconduct in the Commonwealth Bank and more importantly, was misconduct had on individual’s livelihoods, corrupt reward structures and an overall disregard Banking, Superannuation and Financial Services a key whistleblower spurring the public enquiry. prosperity, and dignity. The erosion of consumer for client interests. From the 76 recommendations Industry (Royal Commission). Appointed to confidence and trust in the sector was – and to made, 54 were directed to Government, 12 to preside over the public inquiry was High Court ‘What I noticed was the mentality of banks; some extent still is – extensive. regulators and 10 to industry leaders. Justice, Kenneth Hayne. He was tasked with they lost their way, and they lost sight of their identifying the underlying causes of financial history,’ explains Morris. ‘The thing that was so distinguishing about ‘Together, these reforms have and will continue sector misconduct, and to uncover evidence of the Banking Royal Commission, was how it to ensure that Australia’s financial systems systemic issues within corporate practices. ‘The history of Australian banks is a good and captured the public’s attention because of how deliver fairer outcomes for consumers and honourable one, and an important contributor it connected through case studies into such remains resilient to enormous stresses caused The Commission was precipitated by a series of to national economic growth. It was in the 90s deep feelings and experiences within Australian by events like the global financial crisis and now high profile exposés implicating Australia’s biggest when things began to change. American consumers,’ says Grant Jones, banks in scandals covering fraud, predatory sales sales cultures came in and banks got infected General Counsel & Executive practices, FOREX trading impropriety, interest rate with the remuneration US banks had always Lead, Regulatory Affairs at MLC SINCE THE ROYAL COMMISSION, THE rigging and more. The Commission conducted paid.’ Life Insurance. seven rounds of public hearings over 68 days, called more than 130 witnesses, and reviewed over This shift away from customer-focused services ‘It showed how customers ROLE OF IN-HOUSE COUNSEL HAS 10,000 public submissions. The findings made front towards bonus schemes led to deceptive felt so vulnerable to large page headlines across the country. Concluding the conduct. Claims that arose included: charges institutions, and it gave voice to BEEN CAST INTO THE SPOTLIGHT. public inquiry, Commissioner Hayne put forward for services that were not provided; continuing this feeling and experience.’ 76 recommendations directed at government conflicts of interest affecting financial advisors; institutions, regulators and industry leaders. and an insufficient focus on risk management. This sentiment was shared by In more severe cases, some financial institutions David Cullen, general counsel The Commission’s findings heralded sweeping had inadvertently facilitated money laundering, of AMP, one of Australia’s leading wealth the coronavirus,’ said a spokesman from the changes within current operational frameworks turned a blind eye to terrorism financing, and management companies. Australian Treasury. in the financial advice, life insurance and promoted a culture of greed. superannuation sectors. Leading general ‘I think it certainly is a pretty challenged counsel working across these industries in Refusing to stay silent, Morris filed several environment after the Royal Commission. There LEANING INTO LEGAL Australia candidly share their experiences in complaints to ASIC (The Australian Securities is lots of activity and focus on remediating and rebuilding consumer trust, as they work towards Investment Commission) Australia’s financial rectifying legacy issues, making compliance Since the Royal Commission, the role of in- transforming regulatory practices across the regulator, outlining acts of misconduct he improvements, and leaning into a much greater house counsel has been cast into the spotlight. country. had witnessed. For years ASIC did little to regulatory change environment than we have Professor Michael Adams, head of law at investigate the claims and in 2013 Morris decided seen in recent years.’ Australia’s University of New England explains go public. Several media outlets began to the delicate position of corporate counsel. CASHING IN report upon allegations of fraud, forgery and The findings of the Royal Commission and the management coverups. This ultimately suggested reform package put forward by ‘The Royal Commission has really highlighted To understand the damning findings of the Royal resulted in a parliamentary inquiry and Royal Commissionaire Hayne represents the largest the role of lawyers within financial services, and Commission it is crucial to reflect back upon the Commission. and most comprehensive corporate and financial in particular the role of various in-house counsel

58 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 59 LOOKING INTO THE MIRROR

within these entities. I think there has been a lot ‘What the Commission particularly highlighted BLOWING THE WHISTLE of soul searching and discussions about whether through its case studies, is how easily unfair more could have been done, or if they should have decisions which have real adverse impacts on During a time when it would have been easier to turn a blind eye, Jeff Morris been more vocal in management discussions.’ people can become normalised within a large chose to do the right thing and blow the whistle. By doing so he would embark on commercial operations.’ a ten year crusade which would culminate in a Royal Commission. ‘First and foremost, if you are a practicing lawyer, solicitor or barrister – you are an officer of the ‘This was a very confronting realisation for ‘It’s a lot more difficult, to be your own man, chart your own course if you have to court and you have duties which are predominately industry because the vast majority of people stand alone, against everyone else who wants you to do nothing,’ explains Morris. to the court, above and beyond that to your across financial services get up each morning client, even as in-house counsel. So, in theory the and go to work, wanting to do help and do It all started in 2008 when Morris was working as a financial advisor at delineation is very clear,’ says Professor Adams. some good and to make a contribution to their Commonwealth Bank - one of Australia’s biggest. He became deeply concerned customers and community. They are horrified at about the severe losses and emotional distress being experienced by many ‘In practice in-house counsel roles are subjected any prospect of hurting customers.’ elderly and vulnerable clients as a result of poor financial advice. to a range of pressures. The more senior of a lawyer you are, the more likely you ‘What I saw and the thing that actually got to me, was when some elderly people are part of the management decision- ‘IF YOU ARE A GENERAL COUNSEL came into my office and physically broke down in distress because they had half making process. If you are a general counsel at a financial entity, you are part a million dollars vaporised from their investments. They couldn’t get a straight AT A FINANCIAL ENTITY, YOU ARE of the c-suite. answer out of their financial planner or any of the managers in the organisation. ‘You are there to facilitate your PART OF THE C-SUITE.’ ‘There were some other blokes who were having similar experiences to me; organisation to develop new products we got together and decided this was not going to happen on our watch. This and get around legal barriers and is when I wrote to our corporate regulator ASIC (The Australian Securities regulatory hurdles. That is part of your Investment Commission). The regulators were absolutely useless. job. However, you do have an obligation to speak ‘So when industry people saw the impact of out against ethical violations to explain when particular conduct through the lens of impacted ‘That is why in June 2013, nearly five years later, I went public. I needed to expose something is misleading or unreasonable.’ customers – it was a very confronting moment – not only what the banks were doing, but what the regulator was letting them do people felt deep shame and were challenged at a while they were sitting there asleep at the wheel.’ level of personal values. It was a real moment.’ GETTING ETHICAL Morris’s plight to expose corrupt banking practices resulted in one of the biggest Similarly, Elizabeth Weston, former head of regulatory overhauls for the industry. Navigating commercial obligations, whilst acting investment legal and governance at Cbus Super as a trusted advisor may sometimes present Fund reflects on the on the Royal Commission ‘It is I guess quite fortuitous banks had a tune up and a realignment of attitude. The ethical grey areas for corporate counsel. and its importance on ethical conduct. economic carnage at the moment would be just absolutely appalling. Getting banks back on the path of righteousness probably came in just the nick of time. The way ‘The Royal Commission constituted a profound ‘For me, it was about primacy of community the finance industry and banks respond to coronavirus will be extremely important.’ point of inflection in the industry where firms were expectations vs the black letter of the law. As forced to publicly look into a dark mirror and make a lawyer, obviously people can sail close to the a decision to fundamentally change,’ says Jones. wind, but just because you can do something

60 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 61 BANKING ON A BRIGHTER FUTURE LOOKING INTO THE MIRROR

does not mean you should do something. So, ‘Rewarding misconduct is wrong. Yet incentive they will see where you are coming from and act ‘There are two clear learnings that I took from this was a stark reminder of the importance of bonus and commission schemes through the accordingly?’ the Royal Commission that influence how I community expectations and the obligations to financial services industry have measured sales perform my new role today. always act in the best interests of members.’ and profit, but not compliance with the law and Looking to the future post-Royal Commission, proper standards.’ the role of in-house counsel is fundamental in ‘Number one is fairness. I believe fairness will be Since the Royal Commission, there has been a influencing healthy cultural practices within the the defining regulatory principle of our time. The renewed focus on ethical conduct within the Therefore, cultural practices play a pivotal role in workplace. second learning is that fairness needs the most financial sector. driving or discouraging misconduct. protection in every 100 small decisions that are ‘The role of in-house counsel is more important made across a company every day, relative to the ‘I really think those in the sector occupy a ‘Quite often, an in-house counsel’s job is going than ever; certainly in this sector they are busier fewer and bigger decisions a board will make that unique position of trust, because they are to be telling people unpleasant truths, things than ever,’ says Cullen. have the benefit of lots of perspective and debate. looking after the financial wellbeing of they do not want to hear. In a culture where everything is being covered up, in a ‘I am a bit wary of the view that in-house lawyers ‘Why is the first important? It is important toxic culture, in-house counsel will are the conscience of an organisation because because it prompts the question, how do you ‘FOR ME, IT WAS ABOUT PRIMACY frequently be pressured to suppress really I think everyone should shoulder that embed fairness in your business processes? news and not present senior conscience. But we do have a key role in setting Fairness is an idea, it does not have a fixed executives with bad news that they and being part of the moral compass of an perimeter and is entirely subjective. With that OF COMMUNITY EXPECTATIONS VS know they do not want to hear,’ says organisation. being the case, how can it be a principle of law Morris. that you can design processes and products off THE BLACK LETTER OF THE LAW.’ ‘I think the other key thing in the Royal the back of? This is the challenge for industry Weston agrees: ‘As in-house counsel Commission was about misconduct. It was participants and regulators, but it’s a critical – especially in financial services – asked to look into conduct that may fall below issue to solve.’ there is always a risk that you will community expectations – even where not strictly fall captive to business and rubber contrary to law. Now, that is quite a challenging Australians, which is a responsibility and a stamp initiatives. One of the key challenges is the environment for lawyers to operate in because GOVERNANCE GLOW UP pretty heavy one. But it is also a privilege,’ fact that you are sometimes delivering deeply generally lawyers are most comfortable when explains Cullen. unpopular messages.’ dealing with black letter legal obligations. As a result of the increased regulatory The concept of what is and is not contrary to environment following the royal commission, ‘As you become more senior, you become community expectations will be something companies across the financial sector are CULTURE CORRUPTED resigned to the reality of your function as not lawyers have to consider as part of their advice. reassessing their internal corporate governance merely a trusted counsel but also as an officer of It raises the issue of ‘where is the line drawn?’ but processes. In particular, one of the most obvious One of the major criticisms coming out of the court. I think at times nobody really wants to increasingly this is another challenge that in-house shifts for in-house counsel post-Royal Commission the Royal Commission was the toxic culture hear the squeaky wheel, but it is better they do lawyers will have to grapple with.’ has been the push towards strengthening internal prevalent within financial service industries. so, before all the wheels fall off the wagon.’ corporate governance framework. In fact, Commissionaire Hayne in his final report Fairness is another concept that does not outlined harmful cultural practices directly ‘I think for me it is about how to deliver that necessarily follow the black letter of the law, ‘In Australia, we have come out of a Royal linked with risky, immoral and even illegal message in a way that stakeholders are able to yet according to Grant Jones, general counsel at Commission into Financial Services which has activities from financial providers. He identify an alignment of interests. How do we MLC Life insurance, it has become a key topic for really emphasised the need for robust corporate wrote: counter that risk and deter it in such a way that consideration post-Royal Commission. governance and seen an increased focus by our

62 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 63 BANKING ON A BRIGHTER FUTURE

regulators to take action against white-collar ‘I was hoping that the Royal Commission would crime. That trend is unlikely to change,’ explains lead to a renaissance for legal function within GLOBAL PRESENCE Seshani Bala, group general counsel & corporate financial services. Perhaps it did within the retail ARGENTINA assurance at Chartered Accountants ANZ. banking sector, but I am not sure if it did so much AUSTRALIA in the industry funds sector,’ says Weston. CHINA ‘One of the things I noticed following the Royal Commission was the broadened remit CYPRUS EXPERT CONTRIBUTORS of the General Counsel. I previously led the FOCUSING ON THE FUTURE MALAYSIA legal function and my remit was extended to RUSSIA risk and governance. There is definitely a trend Overall, the Royal Commission and its findings SOUTH AFRICA towards integrating those functions so you can sent shock waves through the financial sector SOUTH KOREA really drive process synchronisation. Risk can be of Australia. Revelations of systemic misconduct UAE identified and managed and governance around and corporate coverups brought to light + MANY MORE that risk solidified.’ shameful practices and toxic work cultures. WIDERANGING TOPICS ‘Sometimes it takes a disaster or a near PRACTICAL GUIDANCE CORPORATE ETHICS disaster for people to recognise – really ‘THE APPROACH TO INTERACTING truly appreciate – cognitive diversity. COVID19 As a legal professional you bring a CRISIS MANAGEMENT WITH REGULATORS IS OF different perspective to bear because THE DIGITAL FUTURE of your discipline and because of your INSOLVENCY FUNDAMENTAL IMPORTANCE.’ training as an officer of the court,’ INSURANCE outlines Weston. M&A RESTRUCTURING ‘I think as lawyers I have always felt PRIVATE PRACTICE, IN-HOUSE REAL ESTATE that we know about worst case AND INDUSTRY PERSPECTIVE + MANY MORE This shift has also been observed by Cullen: scenarios, we seem to be the people who ‘Supporting boards and their increased envision it, we seem to be the people who governance needs has undoubtedly heightened consider what it would look like on the front post the Royal Commission. I also think the page of the paper, rather than waiting until it is approach to interacting with regulators is of on the front page of the paper.’ fundamental importance.’ Although the financial sector in Australia In-house legal teams across the finance industry has gone through significant regulatory are tasked with improving corporate governance transformation, acknowledging past mistakes TARGETED AND frameworks in order to avoid public scrutiny and implementing new frameworks aimed RELEVANT AUDIENCE or corporate watchdog fines. Raising the at improving industry practices are the first accountability and governance standards across steps towards rebuilding consumer the financial sector is crucial. trust.

64 | GC | GCMAGAZINE.COM PROMOTING ETHICAL BUSINESS

Working together is pivotal for companies wanting to protect against white SERGEY VITOROV, collar crime. Sergey Vitorov, legal and compliance and quality director at NOVO Nordisk discusses how and why compliance and legal teams should LEGAL COMPLIANCE AND take a collaborative approach.

QUALITY DIRECTOR, BACIS, y role in Moscow is heading It is up to us lawyers to understand up the legal and compliance team. technicalities. But when it comes to business NOVO NORDISK M I am responsible for this whole clients, they have to understand the principles area, which includes things such as: risk behind why specific rules were introduced. management, internal investigations, Also, the more our internal clients believe preparation and execution of compliance and and understand corporate ethics, the fewer legal plans, litigation, contractual work and number of white-collar crimes will be committed, really everything you can think of. and in-house counsel will be able to dedicate their time to other important matters. Promoting I am not aware of any multinational ethical culture means not only constant training organisations nowadays which does not efforts in this direction, but also fostering the have a compliance policy and framework. right mindset. It is important for us to ensure Almost all of them have a compliance our clients will understand not only the letter specialist or in-house legal person in place. of the law, but also its spirit, and the rationale In order to move forward, the biggest behind a certain legislative provision, therefore challenge nowadays is to foster a proper enabling them to make the right choice in a compliance mindset. This is so that people dilemma. will not perceive compliance as merely a ‘tick the box’ exercise. That is the challenge that I When looking at my own team, further believe remains in place in many parts of the improvements can be made to promote world. Even many senior colleagues in large ethical business culture. For instance: companies still view compliance as a ‘tick making legal and compliance functions the box’ exercise. They view it as only being independent from the business (solid the responsibility of legal and compliance reporting lines should flow into that function departments. and not into business. Legal and compliance should have their own independent budget); Obviously, corporate ethics is not only making sure that legal and compliance about compliance with applicable laws and directors are part of the management teams regulations, it is also about sustaining the for respective business units; and when long-term business success of an organisation. deciding where to hire a legal and compliance

66 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 67 professional it is necessary to take into are at the top of the agenda of international management would be aware and endorse sophisticated. If we look back five or ten account not only business considerations pharma companies. Due diligence risks our actions, and offer their advice based on years ago, if a person wanted to defraud a (size of the business, its growth and primarily relate to the difficulties in identification their knowledge and experience. We of course company, he or she would simply use his or profitability) but also a risk profile of a of real ultimate beneficiaries in high risk took independent legal advice as well. In the her credit card improperly. Now, corporate given jurisdiction. jurisdictions (Latin America, CIS, Southeast end we decided to run more enhanced due fraud is more sophisticated. People are Asia) due to the sophisticated techniques diligence checks over our critical high-risk becoming more underhanded when it comes When it comes to bribery and corruption used by those who try and conceal real partners. to white-collar crime; it is getting harder to and due diligence, the pharmaceutical industry ownership. detect and prevent. In addition, the regulatory is highly regulated. It inherently requires us to Also, when it comes to crisis management, framework for the pharma industry is not getting deal a lot with governmental officials (while For instance, we had a case where the real we have a very solid risk management easier. registering products, running clinical trials, ownership of one of our distributers was framework in place which enables us to concealed. According to address crises in a speedy and coherent Cyber-crime is also a growing risk area the official registers the way. For example, we ran a whole risk going forward. The main thing here is to shareholder of the company assessment when things started to go off make people aware of the core techniques BRIBERY RISKS ARE AT THE TOP OF THE was person X, but it transpired recently due to the coronavirus outbreak. that criminals can use. It is important to that the real beneficiary behind We immediately decided to make be on high alert and to no longer perceive the AGENDA OF INTERNATIONAL PHARMA was a completely different all our sales calls virtual, even in regions where virtual world as not real; it is very much real. person. In fact, that person the government had not yet mandated it. Also, people should not look at cyber-crime COMPANIES. was a governmental official. Legally, it was permissible to do face to face as purely the responsibility of IT. It is the This created a lot of legal meetings in some countries at the start of responsibility of every employee and people risks. We hired a private the pandemic. However, we considered the should be trained to detect phishing emails and investigator to run an in-depth safety of our customers and our own personnel, be aware of their VPN when sending corporate compliance check mandated and we decided to take everything virtual. sensitive data. selling medicines to the government etc). by our compliance policy and procedure. We also created some new platforms, Moreover, due to the state-owned nature When we received the report from the and as a result tweaked our compliance rules When overcoming these future and of many healthcare systems, administrators investigator, we took a risk-tailored approach and procedures to the virtual working current challenges, it helps when compliance in clinics and doctors can be classified as and discussed each and every red flag related environment. and legal teams come together in a co-ordinated governmental officials from both the FCPA to the situation. As a team we tried to find effort. They may be two separate functions, (Foreign Corrupt Practices Act) and UKBA a meaningful solution. We then took it to I think when we look to the future, white- but a collaborative approach is best when (UK Bribery Act) angles. Thus, bribery risks the senior levels of our company so that collar crime is going to become more preventing white-collar crime.

68 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 69 DIGITAL EXPOSURE

During a pandemic, businesses are looking towards digital solutions to manage their teams. Seshani Bala, group general counsel and corporate assurance at Chartered Accountants Australia and New Zealand discusses SESHANI BALA, how to manage new cyber security challenges. GROUP GENERAL y past in-house roles were in fast deal so quickly. I did a brief in-house secondment moving consumer goods (FMCG) and loved it – everyone told me that once COUNSEL & CORPORATE Mcompanies where I had international you go in-house, you will never go back! remit and exposure to the benefits of legal My first in-house role was as international operations and using digital solutions in general counsel for an FMCG company ASSURANCE, CHARTERED European and US markets. Having a cross-border where I had remit for all legal matters across perspective has really shaped my legal career 43 markets globally. I gained wonderful and how I view in-house lawyering, particularly experience about customer needs and how ACCOUNTANTS ANZ with respect to ensuring in-house legal teams to provide business-ready advice. In my join the data world so they can make data-driven current role at Chartered Accountants ANZ, decisions in this digital economy. a professional membership body with over 125,000 members globally, I lead the legal, In terms of how I got to my current role, governance, risk, compliance and operational I have always loved problem solving and excellence teams which provide integrated driving outcomes. When I was in high school I assurance and enable the organisation to grow, really focused on science and maths subjects, react and adapt to a changing environment but decided I wanted a complete change across Australia, New Zealand, Asia and the when I entered law school at university. I United Kingdom. ended up doing a combined Law and Arts degree at The University of Auckland and then The privacy and cyber landscape is constantly did the usual ‘kiwi’ thing of working in large evolving across the globe – we are seeing corporate law firms before heading off an increase in disruptive technologies, a overseas for the traditional ‘OE’ (overseas move to digital delivery, the rise of the experience). ‘no touch’ economy, the commercialisation of consumer data and consumer demand for I really enjoyed the fast-paced M&A and delivery at pace. But in parallel, we are also private equity deal work in private practice, faced with an increase in privacy regulation but I never got the opportunity to view and the risk of cyber threats. In fact, in 2020, business transactions across their life cycle, we’re experiencing a year like no other, as because I always had to move onto the next we all navigate through a global pandemic!

70 | GC | GCMAGAZINE.COM GCMAGAZINE.COM | GC | 71 MOVINGSESHANI THE BALA, GOAL CHARTERED POSTS ACCOUNTANTS ANZ GC MAGAZINE

Privacy and cyber security are front of but this needs to be operationalised – using mind as our business balances rapid digital a secure digital platform is the best way of transformation with ensuring our post-COVID mitigating risks in this space. operating model is relevant in this new world. External counsel certainly do play a role when it comes to the investigations process, but that Women in Law: Latin America For example, the rapid change from an on- depends on the type of investigation. Some WOEN IN LAW: LATIN AERICA | IN-HOUSE TECHNOLOGY IN LATINGC | IN-HOUSE TECHNOLOGY AMERICA | GCMAGAZINE.COM premise technology operating model to a investigations need to be conducted under legal GC | WOMEN IN LAW: LATIN AMERICA | GCMAGAZINE.COM In this edition, GC profiles a group of trailblazing women in- ‘cloud model’ has resulted in a proliferating professional privilege and using an external house counsel across Latin America – women who have, in the of data across platforms and increased firm assists with maintaining privilege. It also face of quite significant challenges, broken through barriers and Our Latin America Practice Group external cyber exposure to corporate systems. provides a level of independence, and external Entrepreneurial Spirit glass ceilings, and are paving the way for others to follow. This will surely increase to the point where law firms are also able to offer practical guidanceCollaborative Approach Client Focus on how to manage an issue What became abundantly clear through all of the interviews

based on their experience Our attorneys work seamlessly across practices and was the determination of these women (and men!) to effect borders to deliver efficient and innovative structures LOOKING TOWARDS THE FUTURE, I with other clients and and solutions to our clients’ complex challenges. real change in their organisations, and to use their positions as a regulators. There are definitely platform to help others. benefits with using external THINK IN-HOUSE LEGAL TEAMS NEED counsel, but not with every investigation. A lot of things can be done in-house, so it In-house Technology in Latin America TO BE MUCH MORE TECH SAVVY. INHOUSE TECHNOLOG IN LATIN AERICA really depends on the risk | IN-HOUSE TECHNOLOGY IN LATINGC | IN-HOUSE TECHNOLOGY AMERICA | GCMAGAZINE.COM profile of an organisation and GC and WSG are delighted to present the second in this series, the cost/benefit analysis. this time turning the spotlight on Latin America. data will no longer reside in a traditional on- Looking towards the future, I think in-house The vast majority of those surveyed believe in technology’s premise location, changing how we manage legal teams need to be much more tech savvy. potential to enhance outcomes for their in-house departments. and protect both cyber and data privacy Innovation intelligence and being a quick adopter However, within Latin American in-house teams, the jury is still forever. of technology is one of our legal team’s KPIs. out on AI – a spectre that has hovered on the horizon of the Technology was previously a job for IT teams, legal profession for years now. Digital solutions are also key in managing now it is a whole of business function focused areas like whistleblowing. Recent legislative on protecting data. I think in-house counsel are changes support the trend towards well placed to show leadership in this space due whistleblowers being seen as a corporate to the privacy, governance and risk management asset and key to maintaining a culture of good responsibilities they have. In-house legal corporate governance. teams need to get a deeper understanding of technology and need to partner very closely with Businesses can have a good whistleblowing IT teams. There are huge opportunities for in- TO READ THE FULL REPORTS VISIT policy which contains anti-victimisation house legal teams to step up in this space – it’s an provisions and provide for anonymous disclosure exciting time to be an in-house lawyer! GCMAGAZINE.COM

72 | GC | GCMAGAZINE.COM