Corporate Investigations 2021 a Practical Cross-Border Insight Into Corporate Investigations Fifth Edition

Corporate Investigations 2021 A practical cross-border insight into corporate investigations Fifth Edition

Featuring contributions from:

Anagnostopoulos Kellerhals Carrard Poul Schmith Bloomfield Law Practice Kingsley Napley LLP Rahman Ravelli Boies Schiller Flexner LLP Lydian Rui Bai Law Firm De Roos & Pen Morais Leitão, Galvão Teles, Sołtysiński Kawecki & Szlęzak Debevoise & Plimpton LLP Soares da Silva & Associados ŠunjkaLaw Dechert LLP Morgan, Lewis & Bockius LLP Wikborg Rein Gilbert + Tobin Norton Rose Fulbright LLP Iwata Godo Nyman Gibson Miralis ISBN 978-1-83918-088-0 ISSN 2398-5623

Published by

59 Tanner Street London SE1 3PL United Kingdom Corporate Investigations 2021 +44 207 3 67 0720 [email protected] www.iclg.com Fifth Edition

Publisher Jon Martin

Editor Amy Norton

Senior Editor Contributing Editors: Sam Friend David Kelley & Caroline Black Head of Production Suzie Levy Dechert LLP

Chief Media Officer Fraser Allan

CEO Jason Byles

Printed by Ashford Colour Press Ltd.

Cover image www.istockphoto.com

Disclaimer This publication is for general information purposes only. It does not purport to provide comprehensive full legal or other advice. Global Legal Group Ltd. and the contributors accept no responsibility for losses that may arise from reliance upon information contained in this publication. This publication is intended to give an indication of legal issues upon which you may need advice. Full legal advice should be taken from a qualified professional when dealing with specific situations. Table of Contents

Expert Chapters

Cross-Border Investigations: Navigating International Requirements 1 Tim Bowden, Roger A. Burlingame, Noel Power & Dae Ho Lee, Dechert LLP

Bribery and Corruption: Investigations and Negotiations Across Jurisdictions 8 Aziz Rahman & Joshua Ray, Rahman Ravelli

Corporate Cooperation: Benefits and Challenges 17 Lauren Bell & John Kucera, Boies Schiller Flexner LLP

Asia Pacific Overview 22 Phillip Gibson, Dennis Miralis & Rachel Le Bransky, Nyman Gibson Miralis

Q&A Chapters

Australia Nigeria 28 Gilbert + Tobin: Elizabeth Avery & Richard Harris 93 Bloomfield Law Practice: Adekunle Obebe & Solomon Oshinubi Belgium 37 Lydian: Jan Hofkens & Yves Lenders Norway 98 Wikborg Rein: Elisabeth Roscher & Geir Sviggum China 44 Rui Bai Law Firm: Wen Qin & Juliette Zhu Poland 105 Sołtysiński Kawecki & Szlęzak: Tomasz Konopka Denmark 49 Portugal Poul Schmith: Jens Teilberg Søndergaard & 111 Martin Sønnersgaard Morais Leitão, Galvão Teles, Soares da Silva & Associados: Tiago Félix da Costa, João Matos Viana England & Wales & Frederico Machado Simões 56 Kingsley Napley LLP: Alun Milford, Caroline Day, Áine Kervick & Philip Salvesen Serbia 117 ŠunjkaLaw: Tomislav Šunjka France 64 Norton Rose Fulbright LLP: Christian Dargham & Switzerland Caroline Saint Olive 124 Kellerhals Carrard: Dr. Claudia Götz Staehelin, Dr. Florian Baumann, Dr. Omar Abo Youssef & Germany Marlen Schultze 70 Debevoise & Plimpton LLP: Dr. Thomas Schürrle & Dr. Friedrich Popp United Arab Emirates 132 Morgan, Lewis & Bockius LLP: Rebecca Kelly & Greece Chris Warren-Smith 75 Anagnostopoulos: Ilias G. Anagnostopoulos & Padelis V. Bratis USA 139 Dechert LLP: Jeffrey A. Brown & Roger A. Burlingame Japan 80 Iwata Godo: Akira Matsuda & Minako Ikeda

Netherlands 87 De Roos & Pen: Niels van der Laan & Jantien Dekkers Welcome

Preface

We are pleased to have contributed again this year to ICLG – Corporate Investigations. The guide is a useful point of reference when reviewing and comparing common issues in investigations across multiple jurisdictions. This year, the guide contains four expert and 18 jurisdiction chapters. Our expert chapter, Cross-Border Investigations: Navigating International Requirements, compares the approaches taken by the US, UK and French authorities to investigations and considers developing enforcement trends. Rahman Ravelli’s chapter on bribery and corruption investigations across jurisdictions considers historical legislation on bribery and significant legal changes since the Bribery Act 2010. Boies Schiller Flexner has written a chapter on the benefits and challenges of corporate cooperation, and Nyman Gibson Miralis has provided an Asia Pacific overview.

David Kelley & Caroline Black Partners Dechert LLP Welcome Chapter 1 1

Cross-Border Investigations: Navigating International Roger A. Requirements Tim Bowden Burlingame

Dechert LLP Noel Power Dae Ho Lee

Introduction based on a “reasonable indication” of criminal activity, a low bar that is easily cleared.4 Prosecutorial decisions, including Since the ratification of the 1999 Organisation for Economic whether or not to open an investigation, are guided by the DOJ’s Co-operation and Development (“OECD”) Anti-Bribery Principles of Federal Prosecution of Business Organizations.5 Prosecutors Convention, signatory nations have stepped up their anti- apply nine factors, including: the nature and seriousness of corruption efforts by enacting and enforcing laws to prose- the offence; the pervasiveness of wrongdoing in the organisa- cute companies and individuals involved in wrongdoing. The tion; the organisation’s willingness to cooperate; the organisa- US were trailblazers, vigorously enforcing the Foreign Corrupt tion’s voluntary disclosure of wrongdoing; and the corporation’s Practices Act (“FCPA”) since the early 2000s, with the UK and remedial actions. France joining the fray with the passage of the Bribery Act in Unlike the DOJ, the SFO does not have a general authority 2011 and Sapin II in 2016, respectively. or duty to prosecute crimes in the UK. Instead, the SFO inves- It is clear that the investigatory processes and capabilities of tigates only the most serious and complex fraud, bribery and each of these three nations’ anti-corruption authorities have corruption cases. The SFO is empowered to investigate offences evolved significantly. Despite the turbulent nature of 2020, committed anywhere in the world by companies incorporated in the US Department of Justice (“DOJ”) instituted 23 Deferred the UK, as well as by British citizens or persons who are ordi- Prosecution Agreements (“DPAs”) and four Non-Prosecution narily resident in the UK.6 Agreements (“NPAs”); the UK’s Serious Fraud Office (“SFO”) In deciding whether to authorise an investigation, the SFO entered into three DPAs; whilst the French Parquet National considers: (1) whether harm may be caused to the public; (2) the Financier (“PNF”) concluded one convention judicaire d’intérêt reputation and integrity of the UK as an international finan- public (“CJIP”).1 cial centre; and (3) the economy and prosperity of the UK. It The Airbus DPA in January 2020 has given a clear indication will also consider whether the complexity and nature of the of the enhanced capabilities of the authorities when working suspected offence warrant the application of the SFO’s specialist together. The lessons learned and connections developed between skills, powers and capabilities to investigate and prosecute.7 the agencies are likely to have a long-lasting influence on the The PNF was created in 2013 to strengthen France’s ability to future conduct of corporate investigations. International compa- investigate and prosecute “tax fraud and large-scale economic nies should be aware that an investigation opened by one authority and financial crime”.8 The PNF focuses on the most complex may lead to investigations by others, and that investigatory efforts and serious financial crime, including corruption, misappropri- will likely be increasingly synchronised and unified, with multiple ation of public funds, aggravated tax fraud, money laundering authorities scrutinising such a company’s every move. and market abuse. It can investigate offences committed on In this chapter, we will look at: how the US, UK and French French territory as well as those committed abroad by a person anti-corruption agencies conduct investigations; the considera- or entity regularly domiciled in France.9 tions they take into account when deciding whether or not to Much like its US and UK counterparts, the PNF can receive prosecute wrongdoing; and the alternative resolutions available initiating information from domestic or foreign authorities, as to cooperative companies. well as from whistleblowers, self-reports or the media.

Standards for Investigation Conduct of Investigations Each enforcement agency employs its own standards in deter- The DOJ utilises several tools at its disposal to gather evidence, mining whether and how to initiate an investigation. However, including wiretaps, informants and cooperating witnesses. It the general principles across all three are substantially similar: typically conducts investigations through federal law enforce- they receive information; conduct preliminary inquiries; and ment agencies (such as the FBI) operating in conjunction with weigh up evidential and public interest factors when deter- grand juries – independent bodies vested with expansive investi- mining whether a full-blown investigation is warranted. gative powers tasked with determining if there is probable cause The DOJ prosecutes all US federal criminal matters, including that a federal crime has been committed. Grand jury powers the FCPA. 2 The DOJ has taken an expansive and aggressive view include the ability to compel production of corporate documents on its territorial jurisdiction, and even foreign entities and individ- and records, and command testimony from anyone within the uals involved in overseas conduct with minimal US touch-points US. The DOJ can also obtain, via court order, warrants to enter, may be subject to rigorous DOJ scrutiny.3 search and seize materials from premises. The Federal Bureau of Investigation (“FBI”) typically The rules governing grand juries prevent “unreasonable or conducts preliminary inquiries and can open a full investigation oppressive” demands for material,10 and grand jury subpoenas

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 2 Cross-Border Investigations: Navigating International Requirements

require that: (i) requests are relevant to the matter being investi- In the UK, the DPA Code of Practice17 (“the DPA Code”) gated; (ii) there is a reasonable belief that the requested materials guides the SFO’s decision on offering a DPA to companies will yield admissible evidence; and (iii) the requests are suffi- accused of wrongdoing. ciently specific to the matter being investigated.11 Moreover, In order to enter a DPA, the SFO must apply two tests: (i) the a grand jury cannot demand materials or information that are evidential test; and (ii) the public interest test. In order to meet protected by “recognized constitutional, common law or statu- the evidential test, the SFO must show that either: (a) taking tory privileges” such as attorney-client privilege.12 into account possible defences, there is sufficient evidence The recipient of a grand jury subpoena may challenge its to provide a realistic prospect of conviction; or (b) there is a validity in court, but grand jury powers are broad and courts are reasonable suspicion based upon some admissible evidence that loath to curb them without a clear cause. the company has committed an offence, and there are reason- The SFO relies on Section 2 of the Criminal Justice Act 1987 able grounds for believing that continued investigation would, to compel persons or entities under investigation, or who are within a reasonable time, provide sufficient admissible evidence believed to have relevant information, to: (i) answer questions or to establish a realistic prospect of conviction. provide information for any matter relevant to the investigation; The SFO must also be satisfied that the public interest is prop- and (ii) produce and explain relevant documents.13 In addition, erly served by entering into a DPA rather than proceeding to similar to the DOJ, the SFO can obtain court-ordered warrants prosecution. This requires balancing factors in favour of pros- to enter and search premises, and take possession of documents ecution (for example: a history of similar conduct; failure to or other materials relevant to its investigation. notify the authorities within a reasonable time; or significant Like the DOJ, the SFO can enlist support from the police in level of harm caused to the victims or the integrity of markets conducting its investigations, thereby accessing more extensive or government) against those factors opposing prosecution (for police powers. example: offering a high level of cooperation; isolated examples The PNF is also assisted by the police or specialised offices of offending; or a change in management or corporate structure). such as the OCLCIFF, which focuses on complex international For a DPA to be approved, it must be considered in a public corruption.14 hearing by a judge, who must conclude that the DPA is in the The scope of the PNF’s powers include: (1) conducting interests of justice and that its terms are fair, reasonable and compelled interviews, dawn raids and wiretaps; (2) retrieving data proportionate. To ensure full transparency, that judgment will held by telecommunications operators; and (3) running under- be published along with the DPA. cover operations. In France, at the conclusion of an investigation, the Public Whilst the Airbus DPA is a prime example of the authorities Prosecutor will decide, based on the findings of the investiga- combining their investigative tool kits, as set forth below, there tion, whether there is sufficient evidence to proceed to trial or are a number of areas where diverging processes cause friction whether a company should be offered a CJIP – an option avail- and can create dilemmas for both the investigating authorities able where that result would be in the public interest and public 18 and those under investigation. proceedings have not begun. CJIPs must also be validated by a judge during a public hearing. The judge will assess whether the company should be French Blocking Statute offered a CJIP by determining: (1) whether it is appropriate to enter into a settlement; (2) whether all procedural rules have Originally enacted in 1968, the French Blocking Statute (“FBS”) been followed during the negotiations between the company prohibits the disclosure of French commercial information for and the prosecutor; (3) whether the fine imposed is lawful;19 foreign litigation and administrative purposes. By criminalising and (4) the fine’s proportionality to the gains derived from the French individuals’ and companies’ cooperation with interna- company’s wrongdoing. tional investigations, the FBS can create significant hurdles for international authorities conducting investigations within Considerations for DPA/CJIP France.15 By the same token, the FBS also fosters international Where a company (and in the US, also individuals) decides that cooperation by allowing the PNF to become aware of foreign they would rather engage meaningfully with the authorities and interest in conduct involving France, open its own parallel inves- secure a DPA/CJIP, rather than risk the uncertainty of poten- tigation, and demand a role in a resulting joint investigation. tially lengthy court proceedings, they will need to actively seek to comply with the standards of cooperation set forth by the Resolution enforcement agencies. While each agency employs their own individual procedures and standards in determining how to resolve investigations, the Self-reporting commonalities can be encapsulated in three overarching factors: (1) the weight and severity of the wrongdoing; (2) the nature and behaviour of the entity; and (3) public policy factors. Self-reporting is one of the most serious and consequential deci- The DOJ, when deciding whether to proceed with or decline sions a company can make, and requires extremely careful and prosecution, relies on the same nine factors in the Principles of informed consideration and an in-depth analysis of the short-, Federal Prosecution of Business Organizations that guide the opening medium- and long-term risks and benefits of doing so. Whilst of an investigation. Under these standards, if a company has law enforcement agencies strongly encourage self-reporting, it is voluntarily disclosed, fully cooperated, and remediated appro- not necessarily the right decision and it is possible for a company priately, they will likely receive a DPA or NPA absent aggra- that did not initially self-report to ultimately obtain a DPA/CJIP vating factors.16 if their subsequent cooperation is sufficient. While a US DPA must be approved by a judge in court proceedings, an NPA is not a publicly filed document and does not require Cooperation review of a judge or a court; it is simply a letter of agreement between the DOJ and the offending corporate entity. Cooperation is the essential factor that the authorities will

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Dechert LLP 3

consider when determining whether or not a DPA/CJIP is an The DOJ considers the state of a compliance programme, appropriate resolution for wrongdoing. As was recently stated both at the time of the offence and at the time of the charging by Mr. Justice Davis in his judgment on the application for a decision, when deciding whether or not to prosecute. On 1 June UK DPA for G4S Care and Justice Services (UK) Ltd, it is 2020, DOJ updated its guidance to prosecutors on how to assess the overall level of cooperation that matters and “initial reluc- corporate compliance programmes, calling for “a reasonable, tance to cooperate fully can be dealt with when considering the individualized determination in each case” of the effectiveness discount on any financial penalty”.20 of a company’s compliance programme. For a company to seek to obtain a DPA/CJIP, they will In the UK, Sir Brian Leveson noted in his preliminary judg- generally be expected to identify suspected wrongdoing and ment of the Sarclad DPA29 that the government made “a policy those who committed it, report it within a reasonable time, and choice in bringing DPAs into the law of England and Wales, that preserve and provide available evidence to the authorities. a company’s shareholders, customers and employees (as well as One area of cooperation where the US deviates somewhat those with whom it deals) are far better served by self-reporting from its UK and French counterparts is with respect to the and putting in place effective compliance structures. When waiver of legal privilege. In the US, a corporate can coop- it does so, that openness must be rewarded and be seen to be erate fully with a DOJ investigation without waiving legal priv- worthwhile”. ilege. Indeed, DOJ policy specifically forbids prosecutors from Section 7(2) of the UK’s Bribery Act 2010 also provides a suggesting that a corporate under investigation waive privi- defence to companies which have put in place adequate proce- 21 lege, and its Corporate Enforcement Policy states that “[e]ligi- dures designed to prevent a bribery offence from being committed. bility for cooperation or voluntary self-disclosure credit is not in Even where procedures cannot be said to be adequate, the extent any way predicated upon waiver of the attorney-client privilege to which efforts were made to institute such procedures will be 22 or work product protection”. relevant to whether the case merits prosecution, a DPA, or no The SFO, on the other hand, views a corporate’s waiver action. of privilege over materials generated during the course of an In France, Sapin II requires companies with over 500 internal investigation as a “strong indicator of cooperation”, employees and revenues greater than EUR 100 million to imple- favourably impacting its ability to achieve a DPA.23 ment effective compliance programmes.30 Joint guidance issued The PNF asserts that maintaining legal privilege can meaning- by the PNF and AFA31 provides that the effectiveness of a fully harm a company’s ability to negotiate a CJIP.24 According to compliance programme will be “carefully examined by prose- the Guidelines issued by the PNF and the Agence française anticor- cutors when considering the possibility of entering into a CJIP”. ruption (“AFA”), (i) the work product created during an external An ineffective compliance programme will not preclude the lawyer’s internal investigation will not be covered by French company from obtaining a CJIP, but the company will need to professional secrecy (“secret professionnel ”) as a matter of course, take active steps to demonstrate that it is serious about compli- and (ii) a company’s failure to provide documents on grounds of professional secrecy can be viewed as non-cooperation.25 ance and is willing to change its culture. A circular issued by the French Ministry of Justice in June 202032 emphasised the importance of a well-tailored compliance Compliance programme programme in order for a company to be eligible to obtain a CJIP, requiring particular attention be paid to ensure that such Enforcement authorities in the US, UK, and France have all programme is adequate and proportionate to the risks faced. made clear the importance, and potential benefit, of a robust anti-corruption compliance programme. DOJ Assistant Attorney DPA/CJIP Implications General, Brian Benczkowski, told the Ethics and Compliance Initiative 2019 Annual Impact Conference that a good compliance Irrespective of the level of cooperation offered by companies programme “is the first line of defense that prevents the miscon- to the authorities, the end result of a DPA/CJIP is likely to be a duct from happening in the first place. And if done right, it has substantial financial penalty. Each of the authorities has their the ability to keep the company off our radar screen entirely”.26 own method of calculating the penalty and making appropriate He also noted that even where a compliance programme does reductions, as outlined below. In a multijurisdictional inves- not prevent misconduct, it allows for better detection and investigation, the calculation of the penalty may be influenced by tigation of the wrongdoing by the government: “At the end of penalties which are to be imposed in different jurisdictions so a corporate investigation, prosecutors would weigh heavily the as to allow for a coordinated global resolution which is fair and company’s compliance program when determining whether and proportionate, and which does not provide multiple fines for the how to resolve the case.” same conduct. The SFO’s compliance programme guidance27 provides that during investigations, the SFO “will need to assess the effec- Penalties tiveness of the organisation’s compliance programme”. In 2019, SFO Director Lisa Osofsky said that “codes that govern prosecutors’ decisions to bring charges instruct us to take into United States account the existence of effective compliance programmes and The US Sentencing Guidelines33 are the starting point for speedy self-reporting”.28 sentencing determinations. Calculating penalties pursuant to The key attributes that the US, UK and French authorities the Guidelines involves consideration of: (1) the offence; (2) the cite as characteristics of a robust anti-corruption compliance value of the loss; and (3) aggravating and mitigating factors. programme broadly align, with each authority encouraging a Where a company accused of anti-corruption offences is dynamic, tailored, and proportionate programme which: imple- found to have met all the requirements of cooperation for the ments an internal framework for investigations and compliance purposes of a DPA, the DOJ will recommend a “50% reduc- violations; provides training to employees; and effectively moni- tion off of the low end of the US Sentencing Guidelines fine tors third parties operating on behalf of the company. Each range, except in the case of a criminal recidivist”. For those authority also stresses the need for management to actively who failed to voluntarily disclose misconduct, but “later fully promote a culture of compliance. cooperated and timely and appropriately remediated”, the DOJ

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 4 Cross-Border Investigations: Navigating International Requirements

will recommend “up to a 25% reduction off of the low end” of limited scope and/or shorter terms have been seen in recent the US Sentencing Guidelines. To qualify for any reduction, DPAs, such as that agreed with Walmart Inc. in June 2019. the company must pay any and all disgorgement, forfeiture, and The DOJ generally will not require appointment of a restitution resulting from the misconduct. monitor if the corporate has, at the time of resolution, implemented an effective compliance programme. According to Mr. United Kingdom Benczkowski, “[i]n determining whether a monitor is appro- The Crime and Courts Act 2013 requires that the value of any priate, we will look to several key factors, most notably, the fine proposed in a DPA must correspond to the value of a fine investments and improvements a company has made to its that the court might have imposed if the company had pleaded corporate compliance programme and internal controls and guilty.34 Companies found guilty of bribery of another person, whether remedial measures have been tested for the ability to being bribed, or bribery of a foreign public official are guilty prevent or detect similar misconduct in the future”.37 of an offence under the Bribery Act and are liable to an unlim- In the UK, it is anticipated that under the stewardship of ited fine. The applicable UK Sentencing Guidelines35 divide Director Osofsky, a former US prosecutor and a former monitor the sentencing process into a series of steps. The appropriate in private practice, monitorships may become more prevalent level of fine is determined by assessing the gross profit from the in UK DPAs. SFO guidance on evaluating corporate compli- contract obtained, retained or sought as a result of the bribery ance programmes38 released in January 2020 acknowledged that offence (the “harm figure”), then multiplying that figure by a a DPA may still be appropriate if an organisation does not yet multiplier (between 20–400%) determined by the level of culpa- have a fully effective compliance programme, because the DPA bility attributable to the company, and the presence of a series of can be used to require further improvements. In such cases, aggravating and mitigating factors. the DPA will likely require a monitor to allow the prosecutor The Guidelines stipulate that whilst the fine must be suffi- to assess the expected reforms while the DPA is in force. SFO ciently substantial to have a real economic impact, the court Guidance published on 23 October 2020 requires a monitorship should ensure that the effect of the fine is proportionate to to be “fair, reasonable and proportionate”.39 the gravity of the offence, and will take into account whether The G4S C&J DPA in July 2020 was the first UK DPA to the fine would have the effect of putting the company out of require the appointment of a monitor (in this case, referred to business. as an external third party “reviewer”) to report on the imple- In addition to the fine component of the overall financial mentation of compliance measures. The SFO required approval penalty, the company must also disgorge profits made from of the reviewer and mandated the format for reporting back to the offending behaviour, and cover the legal costs of the SFO the SFO. incurred during the investigation. The CJIP Guidelines also provide for ongoing monitoring The fine element under a DPA may be discounted by up to under a CJIP. Responsibility for monitoring companies regis- 50% depending on the level of cooperation provided, compared tered or operating in France or on French territory is delegated with the maximum one-third discount generally available for to the AFA,40 and the company can apply for a period of up to entering an early guilty plea following charge. three years, pursuant to a five-stage process: (1) the AFA will carry out an initial audit to assess the measures in place within France the company to prevent and detect fraud; (2) the company will In the context of a CJIP, Sapin II imposes a cap on fines at 30% propose an action plan; (3) the action plan proposed will be of a company’s average annual revenue over the prior three approved by the AFA; (4) the AFA will validate the key tools of years.36 The PNF calculates fines as a multiple of the benefit the anti-corruption programme, carry out targeted audits and to the company from the criminal conduct, determined by a prepare annual reports; and (5) the AFA will carry out a final number of aggravating and mitigating factors. Aggravating audit and transmit its report to the PNF. factors include: (1) repeated or systemic acts of corruption; (2) the corruption of public officials; (3) prior convictions/sanctions Conclusion imposed in France or abroad; and (4) the use of the company’s resources to conceal the acts of corruption. Mitigating factors The world’s leading anti-corruption agencies continue to pursue include: (1) self-reporting within a reasonable time; (2) excellent wrongdoing ever more vigorously. Law enforcement processes cooperation; (3) the implementation of an effective compliance and procedures long established in the US have been increas- programme; and (4) remedial measures. ingly adopted and adapted by the UK and French authorities, who in turn are influencing the thinking of their American counterparts. The agencies’ relationships continue to evolve Monitorships and deepen as they work increasingly together and coordinate their practices. Companies need to be cognisant of the nuances US authorities are the leading proponents of monitorships, of each agency’s enforcement procedures, as well as their respec- with nearly 60% of DOJ corporate resolutions in FCPA cases tive avenues for resolving investigations. requiring the appointment of an independent compliance Changes in working practices and adjustments to normal monitor for a set period of time. operating and compliance processes as a result of COVID-19 However, the US approach to monitorships has changed in will no doubt be an area of particular focus for the enforcement recent years, driven in part by the October 2018 memorandum agencies as the corporate world begins to recover. Companies on the “Selection of Monitors in Criminal Division Matters” can ensure that they are prepared for tough regulator questions by Assistant Attorney General Brian A. Benczkowski. The by reviewing, adjusting and strengthening their compliance Benczkowski Memorandum recognised the onerous burden and practices to fit changed circumstances, and ensuring that any costs that monitorships could create, and instead advocated a flaws in the system are recognised in good time. regime focused on “whether the proposed scope of a monitor’s Where wrongdoing has been discovered, engaging with the role is appropriately tailored to avoid unnecessary burdens to the authorities in a meaningful way with the intention of obtaining business’s operations”. Whilst the use of monitorships by the a DPA/CJIP will not be in every company’s interest. However, DOJ has not dramatically changed, monitorships with a more in the current, aggressive corruption enforcement environment,

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Dechert LLP 5

companies should anticipate increased scrutiny and be ready to 16. Department of Justice Corporate Enforcement Policy, navigate multiple legal regimes, enforcement authorities and available at https://www.justice.gov/criminal-fraud/file/ procedures. Companies with potential liability in multiple juris- 838416/download. dictions should carefully consider their strategy and options at 17. The SFO and Crown Prosecution Service, “Deferred the outset and seek advice from experienced outside counsel. Prosecution Agreements Code of Practice: Crime and Courts Act 2013”, available at https://www.cps.gov.uk/ Endnotes sites/default/files/documents/publications/DPA-COP.pdf. 18. CJIP Guidelines, p. 6, 27 June 2019, available at https:// 1. Figures as at 1 November 2020. www.agence-francaise-anticorruption.gouv.fr/files/files/ 2. Justice Manual 9-2.001; 28 U.S.C. § 547, available at https:// EN_Lignes_directrices_CJIP_revAFA%20Final%20 www.justice.gov/jm/jm-9-2000-authority-us-attorney- (002).pdf. criminal-division-mattersprior-approvals. 19. Fines in France are capped at 30% of the annual turn- 3. The DOJ’s position is being tested in the courts. In June over of a company over the past three years, and any fines 2019, a Lebanese citizen alleged to have coordinated USD exceeding that amount are not permitted. 200 million in kickbacks was acquitted by a jury. Post- 20. SFO and G4S Care and Justice Services (UK) Limited; Davis trial polling revealed that the jury acquitted because they J at para. 27 of the judgment, available at https://www. could not understand how Brooklyn prosecutors had the judiciary.uk/wp-content/uploads/2020/07/SFO-v-G4S- authority to prosecute crimes not occurring within their Judgment.pdf. jurisdiction. The jury rejected the prosecutors’ argument 21. Department of Justice, Justice Manual, 9-28.710, available that the fact that bribes had passed through the US finan- at https://www.justice.gov/jm/jm-9-28000-principles-fed- cial system via correspondent bank accounts was sufficient eral-prosecution-business-organizations. to establish jurisdiction. See United States v. Boustani, 1:18- 22. FCPA Corporate Enforcement Policy, p. 4, available at cr-00681 (E.D.N.Y.). https://www.justice.gov/criminal-fraud/file/838416/ 4. AG Guidelines, available at https://www.justice.gov/ download. archives/ag/attorney-generals-guidelines-general-crimes- 23. Lisa Osofsky, Director of the SFO, speaking at the racketeering-enterprise-and-domestic#:~:text=The%20 Royal United Services Institute in London on 3 April standard%20of%20%22reasonable%20indication,a%20 2019, available at https://www.sfo.gov.uk/2019/04/03/ prudent%20investigator%20would%20consider. fighting-fraud-and-corruption-in-a-shrinking-world/. 5. FCPA Manual, Chapter 5, available at https://www.sec. 24. The CJIP is the French equivalent of a DPA and became gov/spotlight/fcpa/fcpa-resource-guide.pdf. available following Sapin II. CJIPs are available for 6. Section 12, Bribery Act 2010, available at https://www. companies (but not individuals) in matters of corrup- legislation.gov.uk/ukpga/2010/23/section/12. tion, influence peddling, and laundering of the proceeds 7. Available at https://www.sfo.gov.uk/about-us/. of tax fraud and related or connected offences. See CJIP 8. The PNF was created by Law n° 2013-1117 of 6 December Guidelines, p. 10, 27 June 2019, available at https://www. 2013 on combatting tax fraud and large-scale economic agence-francaise-anticorruption.gouv.fr/files/files/EN_ and financial crime. Also see the CJIP Guidelines, 26 Lignes_directrices_CJIP_revAFA%20Final%20(002).pdf. June 2019, available at https://www.agence-francaise-an- 25. CJIP Guidelines, 27 June 2019, available at https://www. ticorruption.gouv.fr/files/files/Lignes%20directrices%20 agence-francaise-anticorruption.gouv.fr/files/files/EN_ PNF%20CJIP.pdf. Lignes_directrices_CJIP_revAFA%20Final%20(002).pdf. 9. Articles 435-6-2 and 435-11-2 of the French Criminal 26. Assistant Attorney General Brian A. Benczkowski, Ethics Code. and Compliance Initiative 2019 Annual Impact Conference 10. Rule 17 (c)(2), Federal Rules of Criminal Procedure, avail- (Dallas TX, 30 April 2019), available at https://www. able at https://www.federalrulesofcriminalprocedure.org/ justice.gov/opa/speech/assistant-attorney-general-brian- title-iv/rule-17-subpoena/. benczkowski-delivers-keynote-address-ethics-and. 11. See e.g. United States v. Komisaruk, 885 F.2d 490, 494 (9th 27. “Evaluating a Compliance Programme”, SFO Operational Cir. 1989). This requirement may also excuse compli- Handbook, available at https://www.sfo.gov.uk/publi- ance with a subpoena if it would result in violation of a cations/guidance-policy-and-protocols/sfo-operational- foreign law; see In re Grand Jury Subpoena, 912 F.3d 623, handbook/evaluating-a-compliance-programme/ (herein- 633 (D.C. Cir. 2019) (holding that compliance with the after “SFO Guidance”). grand jury subpoena was neither unreasonable nor oppres- 28. Lisa Osofsky, Cambridge Symposium on Economic Crime sive because the appellant failed to meet its burden that (Cambridge UK, 2 September 2019), available at ht t p s :// compliance would be contrary to the foreign state’s laws). www.sfo.gov.uk/2019/09/02/cambridge-symposium-2019/. 12. In re Grand Jury Matters, 751 F.2d 13, 18 (1st Cir. 1984). 29. Serious Fraud Office v. Sarclad [2016], available at ht t p s :// 13. SFO Operational Handbook, Section 2 Notice, available www.sfo.gov.uk/download/sarclad-ltd-and-sfo-deferred- at https://www.sfo.gov.uk/publications/guidance-policy- prosecution-agreement-judgment/. and-protocols/sfo-operational-handbook/section-2- 30. Article 17, Sapin II. p owe r s/. 31. “Guidelines on the Implementation of the Convention 14. The Office central de lutte contre la corruption et les Judiciaire Intérêt Public”, AFA, at 7 (20 September 2019), infractions financières et fiscales (“OCLCIFF”) teams available at https://www.agence-francaise-anticorruption. are trained in accounting, corporate law, public procure- gouv.fr/fr/traduction-en-anglais-des-lignes-directrices- ment law and other relevant knowledge that is necessary to convention-judiciaire-dinteret-public-elaborees-par. unravel international financial crime schemes. 32. Circulaire de politique pénale en matière de lutte contre la corruption 15. Punishable by imprisonment of up to six months and/or International, French Ministry of Justice (2 June 2020), avai- a fine of up to EUR 18,000 for an individual and EUR lable at http://www.justice.gouv.fr/bo/2020/20200611/ 90,000 for a company; Article 3, Law n° 68-678 of 26 JUSD2007407C.pdf. July 1968: https://www.legifrance.gouv.fr/loda/id/JOR 33. United States Sentencing Commission, Federal Sentencing FTEXT000000501326/1980-07-17/. Guidelines Manual (2018).

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 6 Cross-Border Investigations: Navigating International Requirements

34. Crime and Courts Act 2013, Schedule 17, para. 5(4). 38. SFO, SFO Operational Handbook: Evaluating a 35. The Sentencing Council, “Sentencing Guidelines for use in Compliance Programme, 17 January 2020, available at Crown Court”, available at https://www.sentencingcouncil. https://www.sfo.gov.uk/download/evaluating-a-comp org.uk/wp-content/uploads/Fraud-Bribery-and-Money- liance-programme/. Laundering-offences-definitive-guideline-Web.pdf. 39. Available at https://www.sfo.gov.uk/publications/guid- 36. The French Code of Criminal Procedure – Article 41-1-2. ance-policy-and-protocols/sfo-operational-handbook/ 37. Id. Available at https://www.justice.gov/opa/speech/assis- deferred-prosecution-agreements/. tant-attorney-general-brian-benczkowski-delivers-key- 40. “Guidelines on the Implementation of the Convention note-address-ethics-and. Judiciaire D’Interêt Public”, 26 June 2019, at Annex 1.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Dechert LLP 7

Tim Bowden’s practice is focused on international fraud, corruption and money laundering. He represents companies and individuals under investigation by and interacting with the SFO, FCA, NCA, HMRC and their international counterparts. He also advises companies on the effectiveness of compliance policies and the application of anti-corruption, anti-money laundering and anti-tax evasion laws, including in M&A transactions. Mr. Bowden spent 12 years in practice at the independent Bar, and he was a Grade 4 prosecutor for the CPS and served on the specialist panels for organised crime and complex fraud, and the SFO panel of prosecuting counsel.

Dechert LLP Tel: +44 20 7184 7598 160 Queen Victoria Street Email: [email protected] London EC4V 4QQ URL: www.dechert.com United Kingdom

Dechert LLP Tel: +44 20 7184 7333 160 Queen Victoria Street Email: [email protected] London EC4V 4QQ URL: www.dechert.com United Kingdom

Noel Power is a criminal defence and investigations lawyer with a particular focus on multi-jurisdictional white-collar crime, corruption and internal investigations. He advises corporates, financial institutions and individuals in complex cross-border investigations and prosecutions, both domestically and cross-border, as suspects and as witnesses. He regularly advises clients on interactions with relevant national authorities including the UK SFO, NCA, the police and the FCA.

Dechert LLP Tel: +44 20 7184 7607 160 Queen Victoria Street Email: [email protected] London EC4V 4QQ URL: www.dechert.com United Kingdom

Dae Ho Lee is a dispute resolution lawyer focusing on white-collar criminal defence and internal investigations. He has represented both individuals and corporations on matters relating to fraud, corruption, market manipulation, and sanctions. He also has experience representing clients in complex civil litigation, in particular on matters relating to trade secrets and unfair competition. Mr. Lee is a U.S. qualified lawyer residing in London.

Dechert LLP Tel: +44 20 7184 7844 160 Queen Victoria Street Email: [email protected] London EC4V 4QQ URL: www.dechert.com United Kingdom

Dechert is a leading global law firm with 26 offices around the world. We Dechert was recognised in the “GIR 30 2020”, a listing of the world’s top 30 advise on matters and transactions of the greatest complexity, bringing firms for investigations by Global Investigations Review, for a fifth consec- energy, creativity and efficient management of legal issues to deliver utive year. commercial and practical advice for clients. www.dechert.com Dechert advises companies, boards of directors, executives, officers and other individuals on all aspects of white-collar crime, compliance and investigations. Our focus is on our clients’ most critical matters, with the highest levels of business and reputational risk. Working closely with our clients and other advisers, we create coordinated strategies to respond to complex situations, especially those involving multiple agencies and jurisdictions. We have repeatedly been recognised for our ability to achieve positive results for our clients, including in relation to some of the most high-profile and complex situations in recent white-collar history.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 8 Chapter 2

Bribery and Corruption: Investigations and Negotiations

Across Jurisdictions Aziz Rahman

Rahman Ravelli Joshua Ray

Bribery Allegations But 2020 did see the SFO drop its investigation into banknote and passport manufacturer De La Rue’s alleged involvement in The past decade has seen a significant legal change in the pros- corruption in South Sudan.5 The SFO also ended its bribery ecution of bribery in the UK, namely the Bribery Act 2010. probe into Swiss-incorporated ABB’s UK subsidiaries, in rela- Nevertheless, it is also important to consider what the situation tion to the long-running Unaoil investigation.6 It should be was before this Act came into effect. noted, however, that it achieved the convictions of two former We do this not simply as a historical exercise – but because Unaoil executives in 2020 for bribery relating to the oil industry the legislation that existed before the Bribery Act is still rele- in post-occupation Iraq. At the time of writing, a third man is vant and can still be used today. Even though the Bribery Act awaiting sentence in relation to this, with a fourth facing a retrial came into effect in 2011, the earlier legislation is still available in early 2021.7 to prosecutors. The Bribery Act replaced the pre-existing law, which was the The Bribery Act 20101 should be seen as the result of a decades- common law offence of bribery and the statutory offences in the long attempt to reform the law regarding bribery and corruption. Public Bodies Corrupt Practices Act 1889 (as amended)8 and the It simplified bribery into three offences – offering a bribe, paying Prevention of Corruption Act 1906 (as amended).9 Yet the old one or bribing a foreign official – while introducing a new corpo- law cannot be disregarded. It applies to cases where the alleged rate offence, under Section 7 of the Act, of failing to prevent bribery and corruption was committed before the Bribery Act bribery. Its introduction was, arguably, long overdue. came into effect on 1 July 2011. Section 19 of the Bribery Act The Act has been used sparingly in its first decade. Nearly all makes this clear. convictions have been of individuals offering or taking bribes If a company, therefore, is investigated over suspected bribery and there have been only two Section 7 convictions. Yet these that occurred before July 2011, any prosecution would be statistics may not paint the full picture. The Act has emphasised brought under the old law. This is not mere theory. Bribery the need for compliance and may well have driven companies often comes to light years after it was committed: the case of to take steps to significantly reduce the risk of them becoming Rolls-Royce, which we mention elsewhere, is a prime example. involved in bribery. The Act’s value as a tool for emphasising the It is not beyond possibility, therefore, that we may see the old need for compliance cannot be discounted. There has been crit- law used regularly as and when allegations that pre-date July icism of the UK’s Serious Fraud Office (SFO) for not bringing 2011 come to light and are investigated and prosecuted. This prosecutions in some of its major, high-profile bribery investi- was seen in 2020, when two individuals were convicted of gations. This happened most notably in 2019, when it dropped conspiracy to give corrupt payments, contrary to Section (1) of its investigation of individuals regarding the bribery involving the Criminal Law Act 1977 and contrary to Section 1 of the Rolls-Royce that saw the company pay a £497.25 million fine Prevention of Corruption Act 1906, as part of the long-run- as part of a deferred prosecution agreement (DPA).2 A DPA, ning Unaoil bribery investigation. A third person had already as we explain in detail elsewhere, involves a company admitting admitted to such offences, which related to activity in Iraq after its wrongdoing and agreeing to meet a certain set of conditions the 2003 fall of Saddam Hussein.7 in order to avoid prosecution. 2019 also saw the SFO drop its The old law applies to corruption committed within and probe into GlaxoSmithKline.3 Yet many such cases pre-date the beyond UK borders, unless it is committed in a foreign juris- Act. It is also possible, in some cases, that SFO decisions may diction by a foreign national normally based in the UK or by be driven by a need to make the most effective use of resources a subsidiary of a UK-based company without the authority or rather than by any perceived inadequacies in the legislation. involvement of that company. It is also worth noting that the It should also be noted that early 2020 saw Airbus conclude old law, unlike the Bribery Act, does not offer a company the its record-breaking DPA with the SFO.4 Under it, the aerospace adequate procedures defence; meaning a corporate could be giant agreed to pay a fine and costs totalling €991 million here prosecuted for corruption by someone working for it even if it in the UK, as part of a €3.6 billion settlement that also involved had done everything possible to prevent it. French and US authorities. This is the largest ever global reso- The old law is still in use. For example, in 2017 three senior lution for bribery and was concluded four years after the SFO employees of the FH Bertling Group were given 20-month started looking into allegations of bribery relating to Aerospace suspended prison sentences and fined under the 1906 Act for activities from 2011 to 2015 in Sri Lanka, Malaysia, Indonesia, making corrupt payments to Angola’s state oil company.10 It is Taiwan and Ghana. It is also a headline-grabbing indicator of also worth noting that there will be cases which straddle both the multinational nature of big business and the potential for regimes because the bribery began before July 2011 and continued corruption that exists. after that date. It is possible that, in such cases, charges could

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Rahman Ravelli 9

be brought under both old and new laws; depending on when Section 2 and interviews the individual offences took place. As the UK does not have any time limit on when charges can be brought regarding an This involves SFO teams of skilled experts investigating and, offence, it is likely that prosecutions will continue to be brought where necessary, using Section 2 to compel any individual or under the old law. organisation to provide the SFO with information or documents that it believes are relevant to its investigation. The SFO Prosecutions has even told lawyers that they are not guaranteed a right to accompany a client that is compelled to go in for interview under Skansen and Section 7 Section 2. If a lawyer wants to attend a Section 2 interview with their client, they must argue why they should be allowed We mentioned earlier that 2018 saw the first prosecution for to attend and even agree to certain restrictions during the inter- failure to prevent bribery under Section 7 of the Bribery Act.11 view. This is an approach that the Law Society, the solicitors’ And the case, involving office refurbishment company Skansen, professional body, has called “inappropriate’’. has to be of concern for those who want to tackle bribery in When, as part of an investigation into possible bribery and their business. corruption, three senior figures in GlaxoSmithKline were asked Skansen won two contracts in 2013, worth a total of £6 million, to attend for interview by the SFO under Section 2, the trio after its managing director paid bribes to secure the work. In said they wished to be accompanied by solicitors retained by the January 2014, Skansen appointed a new chief executive officer. company for the investigation. The SFO refused permission for He started an internal investigation, introduced an anti-bribery the solicitors to attend. The SFO informed them that the pres- policy, stopped another bribe being paid, dismissed the managing ence of solicitors in interviews may prejudice the investigation. director, filed a Suspicious Activity Report (SAR) to the National The three men were unsuccessful in their application for a Crime Agency (NCA) and reported the matter to the City of judicial review of the decision, with the High Court of Justice London Police. Skansen also cooperated fully with the police Queen’s Bench Division stating that the SFO’s stance on Section 2 interviews was in accordance with policy in the SFO’s investigation – and yet was charged with failure to prevent bribery. 13 Under Section 7, a company has a defence if it can show that Operational Handbook. The SFO’s stance on Section 2, there- it had adequate procedures in place to prevent bribery. Skansen fore, remains in force. emphasised that it had an ethos of acting with honesty, had financial controls in place and clauses in contracts preventing Section 2 and documents bribery – but was found guilty of the offence. This shows how high the bar is set when it comes to a company proving it had In 2018, the SFO received a further boost regarding its use of adequate procedures in place. When convicted, Skansen was a Section 2 powers. The High Court has held that the SFO can, dormant company without assets. One cynical reading of this under Section 2, compel companies and individuals to produce case is that prosecutors looking for a failure to prevent convic- material that is held abroad, subject to there being a sufficient tion may aim for the “low-hanging fruit’’: the easier targets with connection to the UK. less resources to defend themselves. Another reading is that In this case,14 a UK-based subsidiary of the US company KBR prosecutors may believe it is too difficult to secure a conviction was being investigated by the SFO over suspected bribery and for the Section 1 Bribery Act offence of giving bribes – as they corruption offences. KBR was also being investigated in the US must prove that the directing mind and will of the company were by the Department of Justice (DoJ) and Securities and Exchange involved – so they look to Section 7 to secure easier convictions. Commission (SEC) for similar suspected offences. In April Many will need to tread very carefully and take expert advice 2017, the SFO issued a Section 2 notice requiring the subsidiary if they suspect wrongdoing in their workplace. The irony is that to produce certain documents. The subsidiary provided docu- the Bribery Act does not go into any detail about what would ments that were located in the UK, including documents that constitute adequate procedures – and yet it expects companies had been sent to it from outside the UK. to have them. Guidance from the Ministry of Justice (MoJ) The SFO believed that the subsidiary was drawing a distinction refers to the need for procedures to be proportionate to the risk, between the documents it held in the UK and documents held have commitment from the top levels of a company and involve outside the UK that were beyond its control. It therefore issued risk assessment, due diligence, training and monitoring. But the another Section 2 notice, this time addressed to KBR, requesting same guidance then adds that the adequacy of procedures will documents held by it and not just the subsidiary. KBR objected actually depend on the facts in each case. to this and argued that Section 2 did not operate outside the UK. But Lord Justice Gross disagreed, stating that although terri- Section 2 Criminal Justice Act torial limits had not been identified in the Criminal Justice Act, the SFO could conduct investigations with an international dimension and the purpose of Section 2 might be frustrated if As we have mentioned, we have a situation, therefore, where there was a restriction on its use. He did not say that Section prosecutions can be brought under a variety of laws. The SFO, 2 would extend to all foreign companies regarding documents which was founded in 1987, is the specialist authority that inves- held abroad but referred to the need for a principled balance, tigates and prosecutes bribery and corruption. On such cases, with it being used in other countries in cases where there was a it often works with the NCA, whose International Corruption “sufficient connection” between the company and the UK. Unit investigates corruption involving developing countries. While not granting complete freedom to use Section 2 around The SFO receives information from many sources, which it the world, this ruling certainly extends the SFO’s ability to use assesses to see if it is worthy of investigation. If the SFO believes it beyond UK borders when necessary. At the time of writing, the situation undermines UK financial and corporate interests, KBR is appealing this ruling to the Supreme Court. But with its it will accept it for investigation, involving the unique range of own range of powers and its ability to ask for extra “blockbuster’’ 12 powers it has under Section 2 of the Criminal Justice Act 1987. funding for major investigations, the SFO has all the resources for a thorough investigation.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 10 Bribery and Corruption: Investigations and Negotiations Across Jurisdictions

SFO and intelligence The SFO’s Corporate Co-operation Guidance

It should also be noted that the SFO Director Lisa Osofsky, By way of guidance, the SFO published in August 2019 its who has been in her position since 2018, used a speech at the five-page memo “Corporate Co-operation Guidance’’,16 which Cambridge International Symposium on Economic Crime that outlines what the SFO expects from companies in order for year to signal her intention to seek increased levels of cooperation them to be given credit for cooperating with an investigation. with other UK law enforcement agencies. It is a theme she has In it, the SFO defines cooperation as “providing assistance to repeatedly returned to, most recently at the 2020 Symposium.15 the SFO that goes above and beyond what the law requires”, and She also wants closer relationships with the SFO’s interna- details 11 general practices that companies should consider when tional counterparts, international regulators, non-governmental preserving material and giving it to the SFO. There is specific organisations and the private sector in order to enhance its intel- guidance given relating to digital evidence and devices, hard ligence gathering. Osofsky also spoke of her desire to “focus on copies and physical evidence, financial records and analysis of the SFO’s strategic use of cutting edge technology’’ to enhance them, industry information and individuals. There appears to be its obtaining of data and intelligence. a view taken by the SFO that a company could assist the agency This all means that the scarcity of Bribery Act convictions so by alerting it to aspects of an investigation that the company far should not lull anyone into a false sense of security. Having cannot gain access to or by identifying possible witnesses. secured successful outcomes in bribery cases, we can say that In the guidance, the SFO outlines its wish for companies to there is an appetite for bribery prosecutions, even if that has not consult with it before taking steps such as interviewing poten- yet transformed itself into a string of convictions. tial witnesses and suspects. The guidance also talks of those Bribery investigations can be long, drawn-out and complex under investigation providing what the SFO calls information affairs. If an investigation commences into allegations relating to on “industry knowledge, context and common practices’’ and conduct post-July 2011, it may take months, or most likely years, on “other actors in the relevant market’’, although this is one before a decision is taken regarding whether to press charges. area of the guidance that could benefit from further explana- The lack of many charges being brought under the Bribery Act tion from the agency. Tellingly, the guidance makes the point should not, therefore, be taken as a sign that the SFO is not that compliance with the compulsory process does not, in itself, actively pursuing those it believes to be involved in bribery. indicate cooperation. It even goes as far as to say that even “full, The ins and outs of UK bribery legislation make it necessary robust co-operation’’ will not guarantee any particular outcome. for anyone who comes under investigation to be represented by The guidance reinforces the fact that self-reporting has to those with expertise in all aspects of it, who will know the best be based on an internal investigation that has been thorough, way to proceed. methodical and has utilised professionals with the relevant experience and expertise. Such people can include – but are not Investigations limited to – investigators, experts in data preservation and analysis, forensic accountants, economists and cultural experts. If a company finds out, either officially, unofficially or even from Their efforts, as well as all other aspects of the planning its own staff or third parties, that it is suspected of bribery, there and management of the investigation, have to be handled and is a course of action that it must take. This course, while not overseen by lawyers with in-depth knowledge of bribery law, complicated, must be commenced the instant any hint of bribery an awareness of how best to deal with the SFO and a realistic is suspected. An internal investigation has to be conducted approach to the need to identify and rectify the wrongdoing, immediately – into all aspects of the company’s activities. If failings or areas of risk. What must always be borne in mind those within the company are not sure how to proceed, they is that self-reporting is something that has to be done carefully should seek the relevant legal advice. It is only by conducting a and appropriately. It is a significant step and anyone considering well-devised and executed internal investigation that a company it will need advice from those with both the relevant legal exper- can properly assess the extent of any wrongdoing. tise and extensive experience of dealing with the SFO. Knowing this can help a company respond appropriately and Such expertise is necessary in order to carry out the internal with credibility to any allegations made by the SFO. Crucially, investigation properly – and also to ensure its findings are if an internal investigation produces evidence of bribery before handled appropriately. When it comes to reporting the find- the authorities are aware of it, this gives the company the oppor- ings, great consideration must be given to how and when they tunity to self-report the problem. While this cannot be seen as are reported. Any self-reporting carries the risk of giving the a magic wand that removes legal difficulties, it is likely that any authorities the evidence they require for a bribery prosecu- company that does self-report will receive more lenient treat- tion: what had been intended by those under investigation as an ment from the authorities, who will acknowledge the effort and attempt to avoid prosecution by “coming clean’’ could be used honesty that has been involved. against them if the self-reporting is not handled properly. The SFO has made it clear, however, that self-reporting is no This was further emphasised in January 2020, when the SFO guarantee that a prosecution will not follow. It will not accept a followed “Corporate Co-operation Guidance’’ with its guid- company’s report of wrongdoing at face value and will want to ance “Evaluating a Compliance Programme’’.17 This guidance make its own enquiries. Having taken such a stance, however, the outlines the SFO’s approach to assessing the effectiveness of the SFO has made it clear that it encourages companies to self-report compliance programmes of companies it is investigating. This as early as possible. The SFO’s approach is understandable and will, according to the guidance, help the SFO determine whether emphasises the fact that self-reporting has to be regarded as much prosecuting a company is in the public interest or whether the more than an attempt to avoid prosecution by saying nothing company is worthy of a DPA – and whether the company’s illegal happened. The SFO has plenty of scope when it comes compliance programme can be considered good enough for it to to the action it takes against those it suspects of bribery. Self- be able to mount the defence that it had adequate procedures in reporting gives those who believe bribery is being carried out in place in relation to a charge under Section 7 of the Bribery Act their name a real opportunity to start a dialogue with the SFO: 2010; that it failed to prevent bribery. a dialogue that could achieve that goal of avoiding prosecution.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Rahman Ravelli 11

The guidance states that, when investigating, the SFO will need no further complications. It is hard not to view this stipu- assess a company’s compliance at the time of the offending and lation as anything other than a face-saving exercise by the SFO at the current time (if the company has taken proactive, remedial in the wake of its legal defeat over privilege in relation to the action) and the potential steps that could be taken under a DPA. ENRC investigation. The guidance says that assessment of a company’s compliance Since the ENRC judgment, there have been a number of cases can be arranged around the six principles in the Bribery Act that have further clarified legal advice privilege and litigation guidance published in 2011 by the MoJ. privilege. Perhaps most notably, PJSC Tatneft v Bogolyubov [2020]20 These principles relate to: confirmed the scope of legal advice privilege when considered ■ Procedures proportionate to the risks the company faced. in the context of advice given from foreign lawyers. To protect ■ Commitment at the top level to prevent bribery. the principle of being able to obtain confidential advice from ■ An approach to risk assessment that was evolving in line lawyers, legal advice privilege includes communications from with the risks it faced. any type of foreign legal adviser, regardless of where the lawyer ■ A proportionate and risk-based approach to due diligence is based. to those working for or with it. ■ Communication and training regarding its bribery preven- Negotiations tion policies and procedures. ■ Monitoring and reviewing of its procedures. Internal investigations, therefore, must be seen as an essential Any move to self-report must be managed in a way that tool for any company looking to establish if bribery has been addresses the points made in this guidance. In a way, they can committed. They can enable a company to deduce the size of serve as a vital checklist when assessing just what has gone the problem. But they also help shape the company’s response wrong, while also providing a framework for any plan devised in to the problem. The findings of an internal investigation can the wake of wrongdoing to prevent a recurrence. help determine the company’s dialogue with the authorities and, crucially, form the start of discussions with the SFO or other agency about the remedies or penalties that may result. The Legal professional privilege clarified SFO can, obviously, prosecute those it believes have committed bribery. But it is not obliged to. It has the power not to deem an What needs to be remembered is that there is also the possi- instance worthy of prosecution, either by imposing no punish- bility of legal developments rapidly changing the scope that a ment at all or by resorting to a DPA. company has for using an internal investigation in support of its interests. The 2017 case of SFO v ENRC (Eurasian Natural Deferred prosecution agreements Resources Corporation)18 illustrated this perfectly. The case relates to allegations that the ENRC was involved in bribery in Kazakhstan and an African country. The judge, Mrs Justice DPAs were introduced under the provisions of Schedule 17 21 Andrews DBE, rejected all but one of ENRC’s claims that of the Crime and Courts Act 2013. A DPA is an agreement documents it had created during the self-reporting process were reached (under the supervision of a judge) between a prosecutor subject to legal privilege. Her ruling that documents made by and an organisation which could be prosecuted. It allows a pros- lawyers could not enjoy privilege because they had been created ecution to be suspended for a defined period provided that the before a point before criminal legal proceedings were contem- organisation meets certain specified conditions. A company plated was both a shock to the legal community and a major must admit the criminal behaviour and agree to work under restriction of privilege. certain conditions that the SFO or Crown Prosecution Service Yet 2018 was notable for this decision being reversed, with (CPS) decides to impose. Such conditions can include altera- the restrictions on privilege resulting from Mrs Justice Andrews’ tions to working practices, staff changes, paying fines and intro- judgment being removed. In September, the Court of Appeal ducing anti-corruption measures. If the company continues to ruled that in-house advice prepared prior to court proceedings is meet these conditions for a set length of time, it avoids prosecu- as protected by privilege as that given in the defence of proceed- tion. If it does not meet them, it is prosecuted. ings.19 The ruling was described by the Law Society as a boost for By the end of July 2020, there had been eight DPAs concluded 22 the principle of lawyer-client confidentiality. Without the protec- in the UK. The last of these saw G4S accepting responsibility tion of privilege this ruling offers, companies and their legal for three offences of fraud against the MoJ. This related to a representatives conducting an internal investigation would have scheme to deceive the MoJ about the true extent of G4S’ profits had to proceed with immense caution to avoid creating material between 2011 and 2012 from its contracts for electronic moni- that backs their case, only for it to be taken and used against them toring of offenders. Under the DPA, G4S paid a £38.5 million by the authorities. Thankfully, that is no longer the case. fine and the SFO’s full costs of £5.9 million. As mentioned The SFO indicated that it would not appeal this decision. earlier, 2020 also saw the record-breaking DPA between the This may be because the current SFO Director comes from an SFO and Airbus. American legal background and the US legal system holds the While DPAs are worth a chapter in their own right, it is concept of legal privilege dear. But whatever the reason, the worth noting here that they are another example of the scope ruling and the SFO’s decision not to challenge it is a welcome the SFO has when it comes to dealing with bribery. Five of the development and a boost for internal investigations. eight DPAs concluded have been the result of bribery investiga- But it is worth stating here that, in its guidance on corporate tions. Exactly what course of action the SFO takes regarding cooperation, the SFO asserts that if, during an investigation, each bribery investigation may come down largely to the way a an organisation claims privilege, it will be expected to provide company negotiates with it. certification by independent counsel that the material in ques- Speaking at a corporate crime conference, the SFO’s Joint tion is privileged. This is a major new request that places a huge Head of Bribery and Corruption made it clear that DPAs are not onus on those looking to cooperate with the SFO. This means to be regarded as the “cost of business’’, but are to be used to that another layer is being added to investigations that may well enhance public confidence in UK public limited companies and the criminal justice system.23

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 12 Bribery and Corruption: Investigations and Negotiations Across Jurisdictions

She added: acquitted of bribery after the company had agreed a DPA with 26 “Under the DPA regime in appropriate cases the SFO will the SFO. And although the SFO reached a DPA with Rolls- seek assurance the company has genuinely reviewed its Royce in 2017 over the large-scale bribery it committed over internal controls, policies and procedures regarding compli- decades, the agency closed its investigation into individuals with ance and as necessary, adopt new or modify existing controls, no charges being brought. As with Sarclad and Tesco, Rolls- policies and procedures in order to ensure it complies with Royce had made it clear it had done wrong but nobody was ever all applicable anti-corruption laws and most importantly held to account for it in a court of law. This situation was most that these are actually embedded into the business. recently echoed in December 2019, when three former employees The ultimate responsibility for identifying, assessing and of Güralp Systems were acquitted of conspiracy to make corrupt addressing risks remains with the board of directors and is payments – we acted for a senior executive in this case – leading a critical factor in any DPA discussion. We recognise that a to the removal of reporting restrictions on the DPA the SFO had 27 DPA is an attractive solution for a company. Herein lies the agreed with the company just two months earlier. advantage; if it secures an agreement and complies with its Such outcomes may affect the SFO’s willingness to offer terms, the company will account to the court for its wrong- DPAs in some circumstances. As a result, any company that doing yet avoid a conviction and all the consequent damage seeks a DPA but does not do everything possible – or is unaware that might do to its ability to conduct business in the future. of what to do – to maximise the possibility of securing one could The bar is therefore necessarily a high one.’’ be making a costly mistake. On the flip side of the coin, companies have to consider care- The SFO has, on occasions, warned that it will see through fully whether a DPA is worth seeking or whether they would any attempt to give an impression of cooperation. DPAs, it is be better to stand their ground and have their day in court, clear, have to be earned. The SFO will only invite a company if it comes to that. This latter stance was taken by Barclays to enter into an agreement to defer prosecution where the regarding the SFO’s investigation into the bank’s 2008 fund- company has genuinely cooperated with the SFO. The DPA raising in Qatar. The result was that all three bank executives Code provides that cooperation will include identifying relevant were acquitted in 2020 of conspiracy to commit fraud. Two witnesses, disclosing their accounts and the documents shown years earlier, charges brought against the bank were dismissed to them. The SFO’s conclusion of its DPA with Airbus showed by the Crown Court and an application by the SFO to have the how willing it was to use the Bribery Act’s wide territorial charges reinstated was then rejected by the High Court.28 Had reach – but also the importance of genuine cooperation. The Barclays gone down the DPA route, it may well have come to DPA explains in detail the lengths Airbus went to, including regret its decision. Similarly, it can be worth holding your nerve confirming the existence of corruption concerns, identifying and not immediately accepting any offer of a DPA. All aspects issues investigators were unaware of, reporting overseas activ- of a case need to be weighed up when making the decision ities and compiling more than 30 million documents.24 In the whether to accept or reject the offer of a DPA. 2020 has seen G4S DPA, however, the company had to pay a £38.5 million the SFO drop its Unaoil-related bribery investigations into both fine, having been given a 40% discount on it. This was only the KBR29 and ABB30 – both cases in which we were involved – second time in an SFO DPA that a discount lower than 50% had which, like Barclays, show that accepting a DPA may not always been applied – and it was due to what the judge noted was G4S’ be the best course of action. delayed cooperation. The Airbus case is a high-profile indicator of the obligations that a corporation must meet to secure a DPA. As it was part Factors in negotiation of the company’s massive settlement with authorities in the UK, US and France, it also illustrates the international dimension to When it comes to negotiation on a bribery investigation, a DPAs: they can cover activity in various parts of the world, and number of factors are crucial to enhance the chances of a more countries are starting to use them. successful outcome. The US has had DPAs since the 1990s. Other countries are now Cooperation: We have already talked about the impor- following suit. In January 2018, France’s first DPA (known as a tance placed on cooperation by the SFO, and referred to how CJIP) was reached, and the following year the French Financial G4S’s delayed cooperation led to it receiving only a limited National Prosecutor (PNF) and its Anticorruption Agency (AFA) discount on the fine imposed on it under its DPA. It is clear published their first guidelines on DPAs, in order to encourage that a company failing to self-report wrongdoing may well have self-reporting and cooperation from corporate wrongdoers. In a reduced chance of obtaining the most lenient treatment. But March 2018, Singapore passed the Criminal Justice Act, which that is not necessarily the case. A company can make up for a created the framework for DPAs. The same year saw Canada, lack of self-reporting by cooperating fully with the authorities. Argentina and Japan also introduce DPA-style arrangements, while In arguably the UK’s most high-profile DPA, Rolls-Royce did 2019 saw the Australian government tabling a bill to do the same. not report its extensive use of bribery in far-flung countries. But The increased international presence of DPAs means that many in once the SFO was aware of the bribery, the firm went to great business around the world may need to know how to obtain one. lengths to cooperate with it, even to the point of bringing to Many businesses in such a position may also need informed the authorities’ attention wrongdoing that they were not already legal advice when it comes to the issue of the company’s liability aware of. This cooperation was highlighted by the judge as a for the bribery, as opposed to the liability of those working for factor in approving the DPA and the lenient penalties within it. it or on behalf of it. The issue of corporate versus individual It is vitally important, however, that any offer of cooperation is liability is one that has surfaced on occasions where DPAs have not just offered to the SFO when it looks like a charge is likely – been concluded. In receiving a DPA in 2017 over its accounting a point that is reinforced by the SFO’s 2019 guidance. The judge scandal, Tesco accepted there had been wrongdoing, but the in the case involving the company originally referred to as XYZ31 three executives that were charged in relation to it were all – which, as referred to earlier, has since been named as Sarclad – 25 cleared, meaning that nobody was convicted for the offences stated clearly that if those under investigation did not offer open- that Tesco admitted had been committed. This contradiction ness when investigations were underway, then they could expect arose again two years later when three Sarclad employees were little or no reward. The cooperation has to be there from day

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Rahman Ravelli 13

one, and be genuine and ongoing. By appointing lawyers with Commitment experience and expertise in dealing with the SFO, you can be advised on exactly how to cooperate and what this entails. The principles outlined above regarding investigation and nego- Reform: When Standard Bank obtained the UK’s first DPA, tiation are the only appropriate way for corporates to proceed it did so having immediately reported its wrongdoing and taken a if they suspect bribery is being committed. There can be no strong, proactive approach to disclosing everything it could. Its cutting of corners when it comes to taking this course of action. cooperation stood it in good stead, as it obtained a DPA instead If corners are cut, it is likely that the investigating authority will of being prosecuted. But the leniency shown was in part due to soon realise this and take a less than charitable view of what Standard’s efforts to swiftly put right the problems that had led to has been done. It is understandable that corporates may find it facing legal trouble. The authorities welcome cooperation, but the process of investigation and negotiation overwhelming in they also want to see clear evidence of a corporate’s commitment bribery cases that cross borders. But that cannot be seen as an to changing its workplace practices to prevent any repeat problems. excuse not to do everything possible to put right the problem. But change for change’s sake will never be enough. Any Certainly, the investigating authorities in any country will action to reform a company in the wake of bribery allegations expect nothing less than a wholehearted commitment to being made must prove an awareness of the failings and a deter- resolving the problems before they consider any leniency. mination to correct them. Corporates being investigated for One thing that many multinational cases have in common, bribery are battling to minimise the financial and reputational apart from allegations of bribery, is that they are based on the damage that can result, as well as trying to avoid being prose- race to secure natural resources. Whether it be oil, gas or mate- cuted. In such a pressured environment, it is often best for a rials that are mined, a lot of the major bribery cases involve the corporate to call in outside expertise to take a considered, impar- race to secure access to and rights to sell natural resources. tial look at what needs to be changed in order to prevent repeat As such resources become scarcer and more in demand, it is problems and convince the authorities of the corporate’s deter- likely that the chances of bribery being used to secure deals could mination to “turn over a new leaf’’. increase. What those who are looking to secure such deals must remember, however, is that the authorities around the world are Across Jurisdictions now a lot more attuned to the potential for bribery and more We mentioned earlier how bribery investigations can be lengthy coordinated in their attempts to tackle it. The onus is on such and complicated affairs. This is partly due to the often complex companies, therefore, to make sure they do nothing that could nature of trading arrangements. But, in many cases, it is because be seen to be promoting bribery in any way. They are expected the deals under investigation have taken place in a number of to have taken the best legal advice and to have implemented the countries, meaning they could involve investigating authorities most appropriate measures to prevent bribery and corruption. from a number of nations – each of which has its own legal This is the case whatever line of business a company is in, system. With such cases, it cannot be over-emphasised how wherever it is based, wherever it trades and however large or important it is for anyone facing a cross-border investigation to small it is. be represented by a firm that has easy and regular access to a When it comes to investigations being complicated, multi- network of worldwide legal experts. national and involving scrutiny of a company’s working prac- Any multinational investigation requires a multinational tices, the case of Glencore32,33 – which is ongoing at the time response. It is not exaggerating to say that the outcome of many of writing – is one of the most notable examples. The Swiss- future bribery cases may hinge on the ability of the defence team based mining giant became the subject of a US corruption inves- to construct and coordinate representation in a number of coun- tigation into its business in the Democratic Republic of Congo, tries, and know how to prioritise its dealings with the various Venezuela and Nigeria. When it announced that it had received countries’ authorities. The bigger the company, the more likely a subpoena from the DoJ, requesting documents as part of an it is to trade in more than one nation. This not only increases inquiry into bribery and money laundering, its share price fell the risk of bribery: it also places a greater onus on those at the by more than 8% and $6 billion was wiped off its share value. top of the company to be aware of everything that is being done Glencore set up a committee made up of board members, on their behalf anywhere in the world. Relying on representa- including company chairman Tony Hayward, to coordinate its tion from a firm whose reach does not extend as far as the alle- response to the subpoena and announced a $1 billion buy back gations do is a high-risk approach. Such allegations can only be of shares to calm investors’ nerves. Glencore is facing a UK tackled by a legal firm that can command and coordinate the investigation by the SFO and has been the subject of a major services of experts in the relevant countries. legal action brought in the US by lawyers acting for investors, Such developments can only re-emphasise how important it is who allege that the company made misleading statements and that – as we said earlier – an internal investigation is carried out failed to disclose information to the market. properly. In cases that span countries, the challenge is all the harder. Such a case can involve a number of jurisdictions, and Multilateral development banks carrying out an internal investigation can be a much lengthier and complex process than it would be if the allegations involved Another important consideration is the increasingly aggressive one company site in just one country. The challenge in such anti-bribery efforts being made by the World Bank and other multi- situations is to devise a joined-up approach to deal with parallel lateral development banks (MDBs). MDBs are non-governmental investigations. Thought needs to be given to what material organisations that provide financial assistance to developing coun- needs to be disclosed to the authorities in two (or possibly more) tries for large infrastructure projects and health and education countries. The company must do what is required so that it is initiatives. Together, these MDBs operate throughout the world considered to be cooperating fully with all the agencies involved. and control trillions of dollars in assets. The implications of submitting documents to one agency and/or Because their lending activity is most active in countries another need to be examined carefully. A company cannot be with historically weak anti-corruption regimes, MDB-financed seen to be treating one investigating agency better than another projects are often targeted for corruption and fraud. Accordingly, or withholding some documents.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 14 Bribery and Corruption: Investigations and Negotiations Across Jurisdictions

the MDBs’ respective investigatory arms can be expected to agreed to pay a $346.7 million penalty) and, as mentioned earlier, ramp up their efforts to identify and punish wrongdoing related Airbus, which paid $2.09 billion as the US part of its multina- to bank-financed projects. MDB investigators have become tional bribery settlement. increasingly sophisticated and well resourced in recent years. In Enforcement of the FCPA has historically been divided 2019 alone, for instance, the World Bank sanctioned 53 firms and between the US DoJ (which brings criminal charges) and the individuals (similar to the number of Foreign Corrupt Practices US SEC (which brings civil charges). In 2019, however, the US Act (FCPA) actions initiated by the DoJ that year). Today, the civil regulator, the Commodity Futures Trading Commission MDBs continue to be a major force in global anti-corruption (CFTC), indicated that it intended to pursue investigations efforts, and effectively act as supranational “shadow” regulators against foreign corruption that affects commodities trading, operating in parallel to national law enforcement agencies. such as payments to foreign officials to manipulate commodi- The scope of the MDBs’ investigatory jurisdiction is extremely ties markets or using CFTC-regulated virtual currencies to pay broad, extending to virtually any entity or individual that receives bribes.38 US regulators also have various non-FCPA routes to MDB money – even if that entity or individual is unaware that a punish corruption. As an example, the prosecution of various particular project is MDB funded, as may be the case with subcon- FIFA executives relied on the “honest services” wire fraud tractors. Once an investigation is initiated, MDBs often rely on statute to obtain jurisdiction over foreign citizens who were many of the same aggressive techniques used by law enforcement: not subject to the FCPA. The Second Circuit Court of Appeal extensive documentation demands; requests for access to company upheld the convictions on the basis that the men had breached emails; employee interviews; and unannounced site visits. their fiduciary duties to their employer (FIFA) by engaging in The potential repercussions for those found by an MDB to have commercial bribery and used US wire transfers in the process engaged in misconduct are severe. The sanctions that an MDB – giving US regulators a powerful new avenue to target bribery 39 can impose include reprimand, restitution, reimbursement of the that does not fall within the FCPA’s jurisdiction. costs of an investigation and imposition of a compliance monitor. But the primary sanction is usually debarment – preclusion from Forum shopping bidding on the investigating MDB’s projects for a period of time (generally three years) or indefinitely. Since 2010, the main The possibility of prosecution in more than one jurisdiction can 34 MDBs have been party to a Mutual Enforcement Agreement lead to “forum shopping’’ by a defendant, who weighs up the that calls for a debarment decision from one MDB to be auto- pros and cons of facing prosecution in one country compared matically cross-applied by all the others. Such debarments can to another. also be extended to affiliates within a corporate group (including This was evident in the case of Saman Ahsani, a suspect in parents and subsidiaries of a targeted entity). In 2019, the African the Unaoil bribery scheme that both the SFO and DoJ wanted Development Bank debarred three former Alstom companies – to prosecute.40 The SFO issued a warrant in 2018 to extradite even though the companies were by then owned by GE Power – Ahsani from Italy so he could stand trial in the UK. But while for up to 76 months because of fraud and bribery committed by this was pending, he began discussions with the DoJ about a them on two bank-financed projects in Egypt in 2006 and 2011.35 possible plea and cooperation agreement. This led to him trav- For many firms, the financial damage from being frozen out elling voluntarily to the US in March 2019 to plead guilty to one of consideration on MDB projects can be devastating. And count of conspiring to violate the FCPA. because MDBs publicise debarred firms and individuals, various In such situations, factors such as the possibility of “doing a additional collateral consequences may follow; including reputa- deal’’ in return for lenient treatment, sentencing arrangements tional damage and enhanced “Know Your Customer” scrutiny in each country and even prison conditions can all affect such from banks and contractual counterparties. a decision. Most importantly, MDBs can, and often do, refer their findings to law enforcement agencies in the country where the Comprehensive conduct occurred, as well as where the company in question is headquartered. Where misconduct involves UK or US citizens or businesses (or otherwise touches these jurisdictions), there is It is also worth noting that when a company comes under inves- a material risk that an MDB investigation will lead to a related tigation for bribery, it is unlikely that the authorities will impose action under the US FCPA or the UK’s Bribery Act. Alstom and limits on what they are looking for. If, therefore, a company is three individuals working for it were convicted of conspiracy to investigated for bribery, the authorities are certain to look for corrupt after an SFO investigation into the company’s conduct evidence of other crimes. If the evidence trail then leads inves- regarding a number of bank-funded infrastructure projects. The tigators to what appears to be other wrongdoing, those under three were jailed and the case ended with the company being investigation have to be able to show that they did everything ordered to pay a £15 million fine and £1.4 million in costs.36 possible to try to prevent it. This means that any internal investigation must look – as we mentioned earlier – into all aspects of a company. There Anti-corruption enforcement by US regulators is little value in conducting an internal investigation solely to seek evidence of possible bribery if that investigation fails to It needs to be emphasised that the reach of American regulators uncover the evidence that exists of other business crime. If that is very long when it comes to enforcing US anti-corruption laws. other crime is then discovered by the SFO or other agency, the For this reason, any company that is subject to the UK Bribery company will be placed in an extremely difficult position. Act should also be aware of the issue of possible liability in the So while it might sound obvious, it still needs saying: any US. The FCPA broadly applies to companies that list shares on a investigation has to be a comprehensive examination of a compa- US exchange, are incorporated in the US or have their headquar- ny’s working. Only by taking such a thorough approach can a ters there.37 However, it also applies to US citizens wherever they company be sure there are no more “skeletons in the cupboard’’ are located and anyone acting as an agent of a US company. The that may be found later by the authorities. If an investigation is FCPA’s broad jurisdiction has been used to target a number of not thorough enough it is of little or no value, especially if it fails international companies in 2020, including Novartis AG (which to uncover all of the wrongdoing.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Rahman Ravelli 15

Any company coming under investigation can only hope to 21. Schedule 17, Crime and Courts Act 2013 (see https://www. negotiate a settlement if it is open and honest about its problems legislation.gov.uk/ukpga/2013/22/schedule/17/enacted). – and genuinely determined to put them right. 22. SFO Published Guidance on Deferred Prosecution Agreements (see https://www.sfo.gov.uk/publications/ Endnotes guidance-policy-and-protocols/deferred-prosecution- agreements/). 1. The Bribery Act 2010 (see ht t p s ://www.legislation.gov.uk/ 23. Speech by Camilla de Silva, Ex-Joint Head of Bribery ukpga/2010/23/contents). and Corruption at the SFO, speaking at the Herbert 2. SFO News Release, 17 January 2017 (see https://www.sfo. Smith Freehills Corporate Crime Conference on 21 gov.uk/2017/01/17/sfo-completes-497-25m-deferred-pros- June 2018 (see https://www.sfo.gov.uk/2018/06/21/ ecution-agreement-rolls-royce-plc/). corporate-criminal-liability-ai-and-dpas/). 3. SFO Case Update, 22 February 2019 (see https://www.sfo. 24. Director of the Serious Fraud Office v Airbus SE [2020] 1 WLUK gov.uk/2019/02/22/sfo-closes-glaxosmithkline-investiga- 435 (https://www.judiciary.uk/wp-content/uploads/2020/ tion-and-investigation-into-rolls-royce-individuals/). 01/Director-of-the-Serious-Fraud-Office-v-Airbus-SE-1. 4. SFO Case Update, 31 January 2020 (see https://www.sfo. pdf). gov.uk/2020/01/31/sfo-enters-into-e991m-deferred-pros- 25. SFO News Release, 6 December 2018 (see https://www. ecution-agreement-with-airbus-as-part-of-a-e3-6bn-glob- sfo.gov.uk/2018/12/06/no-case-to-answer-ruling-in-case- al-resolution/). against-former-tesco-executives/). 5. SFO Case Update, 16 June 2020 (see https://www.sfo.gov. uk/2020/06/16/sfo-closes-investigation-into-de-la-rue/). 26. SFO Case Information – Sarclad Ltd (see https://www.sfo. 6. SFO Case Update, 19 May 2020 (see https://www.sfo.gov. gov.uk/cases/sarclad-ltd/). uk/2020/05/19/sfo-closes-its-investigation-into-abb-ltd/). 27. SFO Case Update, 20 December 2019 (see https://www. 7. SFO Case Update, 30 July 2020 (see https://www.sfo. sfo.gov.uk/2019/12/20/three-individuals-acquitted-as- gov.uk/2020/07/30/second-former-unaoil-executive-sen- sfo-confirms-dpa-with-guralp-systems-ltd/). tenced-for-bribery-in-post-occupation-iraq/). 28. SFO Case Information – Barclays PLC and Qatar Holding 8. Public Bodies Corrupt Practices Act 1889 (see ht t p s :// LLC (see https://www.sfo.gov.uk/cases/barclays-qatar- www.legislation.gov.uk/ukpga/Vict/52-53/69/contents/ holding/). enacted). 29. KBR Quarterly Update, 6 August 2020 (see https://inves- 9. Prevention of Corruption Act 1906 (see https://www. tors.kbr.com/news-and-events/news/news-details/2020/ legislation.gov.uk/ukpga/Edw7/6/34/enacted). KBR-Reports-Solid-Second-Quarter-2020-Financial- 10. SFO News Release, 20 October 2017 (see ht t p s :// Results-Announces-Portfolio-Shaping-to-Advance- www.sfo.gov.uk/2017/10/20/three-men-sentenced-20m- Business-Transformation/default.aspx). angolan-oil-corruption-case/). 30. SFO Case Update, 19 May 2020, (see https://www.sfo.gov. 11. Regina v Skansen Interiors Limited, Southwark Crown Court, uk/2020/05/19/sfo-closes-its-investigation-into-abb-ltd/). Case Number: T20170224, 21 February 2018 (unreported 31. SFO News Release, 8 July 2016 (see ht t p s ://www.sfo.gov. judgment). uk/2016/07/08/sfo-secures-second-dpa). 12. Section 2, Criminal Justice Act 1987 (see https://www. 32. SFO Case Update, 5 December 2019 (see https://www.sfo. legislation.gov.uk/ukpga/1987/38/section/2). gov.uk/2019/12/05/sfo-confirms-investigation-into-sus- 13. SFO Operational Handbook (see https://www.sfo.go pected-bribery-at-glencore-group-of-companies/). v.uk/publications/guidance-policy-and-protocols/sfo- 33. Glencore Update of Subpoena from the United States operational-handbook/). Department of Justice, 11 July 2018 (https://www. 14. R. (on the application of KBR Inc) v Director of the Serious Fraud glencore.com/media-and-insights/news/Update-on- Office [2018] EWHC 2368 (Admin) (https://www.bailii. subpoena-from-United-States-Department-of-Justice). org/ew/cases/EWHC/Admin/2018/2368.html). 34. Agreement for Mutual Enforcement of Debarment 15. Lisa Osofsky address to the Cambridge Symposium on Decisions, April 2010 (see https://www.adb.org/documents/ Economic Crime, 7 September 2020 (see https://www.sfo. agreement-mutual-enforcement-debarment-decisions). gov.uk/2020/09/07/lisa-osofsky-speaking-at-a-presenta- 35. African Development Bank Group Press Release, 22 March tion-hosted-by-the-cambridge-symposium-on-economic- 2019 (see https://www.afdb.org/en/news-and-events/integ- crime/). rity-in-development-projects-the-african-development- 16. SFO Corporate Co-operation Guidance (see https://www. bank-and-ge-power-reach-settlement-on-legacy-alstom- sfo.gov.uk/publications/guidance-policy-and-protocols/ misconduct-19116). sfo-operational-handbook/corporate-co-operation- 36. SFO Case Update, 25 November 2019 (see https://www. guidance/). sfo.gov.uk/2019/11/25/sfos-alstom-case-concludes-with- 17. SFO Operational Handbook: Evaluating a Compliance sentencing-of-alstom-network-uk-ltd/). Programme (see https://www.sfo.gov.uk/publications/ 37. Overview of the Foreign Corrupt Practices Act 1977 by guidance-policy-and-protocols/sfo-operational-handbook/ the United States Department of Justice (see https://www. evaluating-a-compliance-programme/). justice.gov/criminal-fraud/foreign-corrupt-practices-act). 18. Serious Fraud Office (SFO) v Eurasian Natural Resources 38. Commodity Futures Trading Commission Press Release, Corporation Ltd [2017] EWHC 1017 (QB) (https://www. 6 March 2019 (see https://www.cftc.gov/PressRoom/ bailii.org/ew/cases/EWHC/QB/2017/1017.html). PressReleases/7884-19). 19. Serious Fraud Office (SFO) v Eurasian Natural Resources 39. United States v Napout, No. 18-2750 (2d Cir. 2020) ( ht t p s :// Corporation Ltd [2018] EWCA Civ 2006 (https://www. law.justia.com/cases/federal/appellate-courts/ca2/18- bailii.org/ew/cases/EWCA/Civ/2018/2006.html). 2750/18-2750-2020-06-22.html). 20. PJSC Tatneft v Bogolyubov and others [2020] EWHC 40. The United States Department of Justice Press Release, 2437 (Comm) (https://www.bailii.org/ew/cases/EWHC/ 30 October 20219 (see https://www.justice.gov/opa/pr/ Comm/2020/2437.html). oil-executives-plead-guilty-roles-bribery-scheme-involving-foreign-officials).

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 16 Bribery and Corruption: Investigations and Negotiations Across Jurisdictions

Aziz Rahman’s specialist knowledge, track record and growing reputation have led to his involvement in the most major investigations and a client list that includes the most significant corporations, professionals and high-net-worth individuals. His proactive, robust defence work and proven ability to assemble and direct defence teams have seen him and his firm become the logical choice for many requiring intelligent, astute representation in corporate investigations. These have included some of the most significant recent bribery cases, including ABB, KBR, Güralp Systems and a number of major FCPA investigations. His swift analysis of complex issues and tactical approach in the most complicated international and multijurisdictional cases mean he is highlighted repeatedly in legal guides. He is in demand to carry out internal corporate investigations for clients looking to identify and self-report wrongdoing, especially since the introduction of deferred prosecution agreements. His carefully considered but determined approach attracts corporates and individuals wanting to secure the best possible outcome to investigations that involve national and international agencies and a number of countries.

Rahman Ravelli Tel: +44 203 947 1539 36 Whitefriars Street Email: [email protected] London EC4Y 8BQ URL: www.rahmanravelli.co.uk United Kingdom

Joshua Ray is an acknowledged expert in multijurisdictional matters involving fraud, bribery, money laundering and market manipulation. He leads Rahman Ravelli’s US-facing business crime practice group. As a US-qualified lawyer who defends companies and individuals in complex investigations, prosecutions and regulatory actions, he represents senior corporate figures in the US and around the world. For example, he is currently lead counsel for the former CEO of a major telecommunications company under indictment in the Southern District of New York for alleged participation in a $866 million foreign bribery scheme, one of the largest FCPA cases in history. His skills are put to regular use helping clients navigate proceedings brought by British and American regulators, including the SFO, DoJ, Financial Conduct Authority (FCA), SEC, and CFTC. He also has expertise in investigations brought by the World Bank and other multilateral development banks. His in-depth experience of market manipulation investigations includes numerous significant, high-profile cases relating to trading FX, commodities and American Depositary Receipts. He has held senior defence roles in investigations into antitrust and sanctions violations, securities fraud and insider trading, and has been involved in major cases such as the Airbus bribery investigation and the 1MDB money-laundering case.

Rahman Ravelli Tel: +44 203 947 1539 36 Whitefriars Street Email: [email protected] London EC4Y 8BQ URL: www.rahmanravelli.co.uk United Kingdom

Rahman Ravelli’s depth of experience and acknowledged expertise in bribery and corruption, serious and corporate fraud, white-collar crime, regulatory matters, complex crime, market abuse, asset recovery and commercial litigation – particularly civil fraud – have ensured the highest legal guide rankings, a string of awards and legal successes and a reputation second to none. The most recent The Legal 500 guide calls Rahman Ravelli “a team of first- class lawyers with experience and expertise in financial crime’’ and “the leader in the field’’. The 2020 Chambers UK guide describes Rahman Ravelli as “absolutely outstanding’’ and “an impressive team with real depth’’. Rahman Ravelli receives instructions on the largest and most notable and complex multinational and multiagency white-collar crime investigations. It has experience in the biggest and most notable recent bribery and corruption investigations, including Airbus, Güralp Systems, ABB, KBR and a host of FCPA cases. It is in increasing demand to help corporates and senior executives investigate and self-report wrongdoing to achieve a civil, rather than a criminal, solution to an issue. www.rahmanravelli.co.uk

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 3 17

Corporate Cooperation: Benefits and Challenges Lauren Bell

Boies Schiller Flexner LLP John Kucera

Introduction and Overview punishment recommended by the U.S.S.G. Although a judge is not required to impose a sentence within the Guidelines’ range, An individual who commits criminal misconduct has the choice a judge is required to calculate the Guidelines and consider to confess his guilt or to try to sweep the misconduct under them when determining a sentence, and appellate courts will the rug and hope that no one ever discovers it. A company, by afford a presumption of reasonableness to sentences within the contrast, often does not have both of those options. Disclosure Guidelines’ range. becomes the only viable option. For example, if an internal When the criminal defendant is a company, the U.S.S.G. direct investigation uncovers significant criminal misconduct for a the court to base the criminal fine on the seriousness of the offence publicly traded company in the United States, this discovery and the culpability of the organisation. The court can consider two likely will trigger a company’s reporting requirements, because factors that mitigate the ultimate punishment of an organisation: it would qualify as a material event that would be of importance (1) the existence of an effective compliance and ethics programme; to the shareholders or the Securities and Exchange Commission and (2) the company’s self-reporting, cooperation, or acceptance of (“SEC”). Even without legal reporting requirements, however, responsibility. U.S.S.G. Ch. 8 intro. comment. In other words, a a company often has a strong incentive to self-disclose miscon- company’s cooperation with the government can reduce its crim- duct and cooperate with government enforcement agencies. inal fine. Under the U.S.S.G., a court first calculates a company’s For both public and private companies, a significant impetus base fine and then applies a multiplier to that fine to calculate the to disclose criminal wrongdoing is the credit that the company final range for the fine. The multiplier can increase an organisa- can receive from U.S. government enforcement agencies in a tion’s fine – by a maximum of four times the base fine – or the government investigation of the wrongdoing. To receive that multiplier can be less than one, thereby reducing a company’s fine credit for cooperating, upon learning of misconduct within its below what the Guidelines’ fine otherwise would be. ranks, a company often has but one choice: disclosure. This multiplier is based on a company’s culpability score, a In this chapter, we provide an overview of the benefits that a number calculated based on several factors listed in the U.S.S.G. company can receive in the U.S. criminal justice system by volun- To achieve a multiplier of less than one and thereby decrease tarily disclosing misconduct and cooperating with the subse- the fine, a company must achieve a low culpability score. In quent government investigation. We then will address possible calculating the culpability score, a court will afford the largest pitfalls of cooperating with governmental agencies. reduction in its calculation to an organisation if – prior to an imminent threat of disclosure or government investigation and within a reasonably prompt time after becoming aware of Benefits of cooperation the offence – the organisation reported the offence to appropriate governmental authorities, fully cooperated in the inves- The incentive to cooperate with U.S. enforcement agencies is tigation, and clearly demonstrated recognition and affirmative built into the criminal justice system in a number of ways. Most acceptance of responsibility for its criminal conduct. U.S.S.G. significantly, a company can minimise its exposure to criminal §8C2.5(g)(1). In order for the organisation to receive credit for liability and reduce any attendant fine by cooperating with the reporting the misconduct, the report must be made under the government’s investigative efforts. This chapter will analyse direction of the organisation. the benefits from cooperation pursuant to the U.S. Sentencing Even if an organisation fails to promptly self-disclose the Guidelines (“U.S.S.G.”) and through the policies of the misconduct, it can still receive a reduction in the calculation of Department of Justice (“DOJ”). its culpability score if it fully cooperates with the government investigation. U.S.S.G. §8C2.5(g)(2). This reduction will result A.U.S. Sentencing Guidelines in the company receiving a greater reduction in its culpability Under U.S. federal law, a company that has been convicted of a score – and therefore a lower multiplier applied to its fine – than crime is sentenced by a judge who considers a number of stat- it would get without cooperation. utorily mandated factors, such as the nature and circumstances Thus, a company’s decision to cooperate with the govern- of the offence, the history and characteristics of the company, ment can secure benefits for the organisation at sentencing if and the need for the sentence imposed to protect the public the company ultimately is convicted of committing a criminal from further crimes of the defendant and adequately deter crim- offence. inal conduct. 18 United States Code § 3553(a). In determining the severity of the punishment to impose upon a company, B. DOJ Cooperation Credit including the fine, U.S. federal courts must also consider the Even apart from the benefit that a company can receive from a court, a company has an incentive to cooperate with the

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 18 Corporate Cooperation: Benefits and Challenges

government’s investigation. DOJ has published some of its FCPA. In 2018, DOJ’s Criminal Division announced that it internal policies that guide a prosecutor’s decisions regarding was expanding the applicability of the Corporate Enforcement whether to charge an organisation and what sentence to Policy. DOJ now considers the Corporate Enforcement recommend if charges are brought. Under DOJ’s Corporate Policy’s criteria as nonbinding guidance in all corporate crim- Enforcement Policy, a company, if it meets certain criteria, can inal cases, even outside the context of violations of the FCPA, receive a significant benefit in its criminal liability, including the thereby expanding the ability of a company to receive credit for benefit of avoiding prosecution altogether, if the company elects cooperation. to voluntarily and fully cooperate with DOJ. The policy provides a tiered approach to rewarding a company Challenges Posed by Cooperation for self-disclosure and cooperation. The largest benefit is conferred on a company that voluntarily self-discloses miscon- Although cooperating with a government investigation can duct, fully cooperates, and timely and appropriately remediates confer significant benefits on a company, there are risks that the misconduct. In those circumstances, there is a presumption accompany such cooperation. This chapter will address the that DOJ will decline to prosecute the company, absent aggra- need to maintain a demarcation between a company’s internal vating circumstances involving the seriousness of the offence or investigation and the government’s investigation. The chapter the nature of the offender. In order for a company’s cooperation also will address the challenges posed when a company chooses to count as a voluntary self-disclosure, the disclosure must meet to cooperate with the government in parallel civil and criminal three requirements. First, the disclosure must be made “prior to investigations. an imminent threat of disclosure or government investigation”. Second, the company must disclose the conduct to DOJ “within Outsourcing government investigations a reasonably prompt time after becoming aware of the offense”. Third, the company must disclose all relevant facts known to Despite the incentive to cooperate fully with the government, it it, including all relevant facts about all individuals substantially is essential that a company not allow the government to co-opt involved in or responsible for the violation of law. the company’s internal investigation. In May 2019, a judge Convincing DOJ to not prosecute is the best possible outcome for the United States District Court for the Southern District for a company, and under the Corporate Enforcement Policy, of New York issued a decision that addressed the line between obtaining an agreement to not prosecute is possible, even in outside counsel and the government in internal investigations. cases of widespread misconduct. For example, in August 2020, Although still on appeal, this decision has the ability to impact DOJ agreed to not prosecute World Acceptance Corporation for the future of internal investigations and how closely a company violations of the Foreign Corrupt Practices Act (“FCPA”). DOJ chooses to cooperate with the government. agreed to not prosecute the corporation even though the bribery In United States v. Connolly, defendant Gavin Black challenged scheme spanned seven years and involved the payment of $4 the government’s use at trial of statements that Black made million of bribes to Mexican union officials and state govern- during an internal investigation. United States v. Connolly, No. ment officials. In its published decision to not prosecute, DOJ 16 CR. 0370 (CM), 2019 WL 2120523 (S.D.N.Y. May 2, 2019). stated that it had considered the corporation’s prompt, volun- Beginning in October 2008, the United States Commodity tary self-disclosure of the misconduct and its full and proactive Futures Trading Commission (“CFTC”) investigated the alle- cooperation in the matter. gation that certain financial institutions were manipulating the Under its policy, even if DOJ ultimately determines that the London Inter-bank Offered Rate (“LIBOR”) market in order to aggravating circumstances require a criminal resolution, DOJ benefit their trading positions. In an April 2010 letter from the will recommend up to a 50 per cent reduction from the low end CFTC, the government advised Black’s employer (the “Bank”) of the U.S.S.G. fine range (except in the case of a criminal recid- that the government expected the Bank to cooperate fully with ivist). This reduction can be combined with the reduction that a its investigation by, among other things, having external counsel company receives under Sentencing Guideline section 8C2.5(g). review the Bank’s LIBOR reporting. The Bank hired an outside In addition, the Criminal Division generally will not require law firm to conduct this investigation. the appointment of a monitor if a company has implemented Over the next five years, the law firm and the Bank coordi- an effective compliance programme by the time the criminal nated with the SEC, the Department of Justice, and the CFTC case is resolved. (collectively, the “Government”) as these agencies investigated The bottom tier of benefit that a company can receive occurs possible LIBOR manipulation. This coordination included if a company does not voluntarily disclose its misconduct but providing regular updates to the Government on the inves- later chooses to fully cooperate with the government and reme- tigation and its results. During one of these meetings, the diates its conduct. In that case, DOJ will recommend to a court Government instructed the law firm to interview certain people, up to a 25 per cent reduction from the low end of the U.S.S.G. including Gavin Black. fine range. The law firm interviewed Black as instructed by the Receiving a sentencing reduction from DOJ can result Government. Black agreed to the interview, in part because in a company saving a significant amount of money. For Bank policy required employees to cooperate with an internal example, Fresenius Medical Care AG & Co. entered into a investigation under penalty of termination of employment. non-prosecution agreement with DOJ to resolve its criminal During these interviews, Black denied wrongdoing, even when liability for FCPA violations that occurred between 2007 and faced with incriminating emails. 2016. As part of the resolution, Fresenius agreed to pay a crim- Near the end of its investigation, the law firm submitted a report inal penalty of $84,715,273 and an additional $147 million in (the “White Paper”) that summarised the findings of its LIBOR disgorgement and prejudgment interest to the SEC. Fresenius investigation. The White Paper was the result of nearly 200 inter- also agreed to continue to cooperate with DOJ’s investigation. views of over 50 employees and a review of millions of electronic As a result, the company received a discount of 40 per cent documents. Based on the rigour of largest internal investigation below the low end of the U.S.S.G. fine range. in its history, the Bank received substantial cooperation credit In the past, DOJ’s Criminal Division abided by its Corporate and entered into a deferred prosecution agreement (“DPA”) with Enforcement Policy in cases involving the violation of the

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Boies Schiller Flexner LLP 19

DOJ. The DPA required the bank to pay $775 million in criminal be outsourcing complex financial investigations to the corpo- penalties, continue cooperating with the government, and retain rate targets of those investigations. The court was particularly a corporate monitor. Gavin Black was fired. concerned by the situation where a corporate investigator could Relying on the investigative roadmap provided by the White use its “uniquely coercive position” to elicit statements from its Paper, the Government indicted Black. In 2018, a jury convicted employees. According to the Connolly court, when a corpora- Black of one count of conspiracy and one count of wire fraud. tion’s internal investigation (and its outside counsel) act in this Before sentencing, Black moved to vacate his conviction. manner, their actions “are fairly attributable to the government Specifically, Black argued that the Government acted through within the meaning of [Garrity]”, and these private actors are “de the law firm conducting the internal investigation to compel his facto the government”. interview statements. This, Black argued, violated his constitu- In this situation, where the government essentially co-opts tional rights against self-incrimination as articulated by the U.S. corporate investigators and causes them to act as de facto govern- Supreme Court in Garrity v. New Jersey and Kastigar v. United States. ment criminal investigators, particularly without disclosing In Garrity, the New Jersey Attorney General investigated the that function to the subjects of an investigation, the corporate alleged misconduct of police officers. During that investigation, investigators become something akin to a government agency police officers were told that refusing to answer questions would involved in a parallel investigation with DOJ. Viewed in this result in them losing their jobs with the police department. Garrity way, Connolly can be analysed using the law that applies to parallel v. New Jersey, 385 U.S. 493, 494 (1967). The officers participated criminal and civil government investigations. in the investigation, and the government used their answers to prosecute and convict them. Id. at 495. Ultimately, the Supreme Parallel investigations Court found “the statements obtained from police officers under threat of termination of employment were involuntary and therefore inadmissible”. Connolly, 2019 WL at *10 (citing Garrity). Parallel civil and criminal government investigations are Over time, courts have expanded the Garrity doctrine to apply to common, and so long as the government acts in good faith, private conduct, but only where the actions of a private employer parallel investigations do not violate due process. See United States are “fairly attributable to the Government”. Id. at *10 (citing United v. Kordel, 397 U.S. 1, 11, 90 S. Ct. 763, 769, 25 L. Ed. 2d 1 (1970). States v. Stein, 541 F.3d 130, 152 n.11 (2d Cir. 2008)). To satisfy this The government’s parallel investigation would be deemed to standard, there must be a “sufficiently close nexus between the be conducted in bad faith; for example, when the subject of an state and the challenged action”, and the government must influ- administrative or civil investigation agrees to cooperate after ence the specific, challenged conduct. Id. at *10–11 (citing Blum v. being falsely led to believe that the investigation is not crim- Yaretsky, 457 U.S. 991, 1004 (1982)). At its core, the Garrity doctrine inal in nature. See U.S. v. Tweel, 550 F.2d 297, 77-1 U.S. Tax Cas. prohibits the government from wielding a “substantial economic (CCH) P 9330, 39 A.F.T.R.2d 77-1223 (5th Cir. 1977). However, threat to coerce a person into furnishing an incriminating state- when the subject of a civil or administrative investigation coop- ment”. Id. at *11 (citing United States ex rel. Sanney v. Montanye, 500 erates or provides testimony after being advised that such infor- F.2d 411, 415 (2d Cir. 1974)). mation could be used in a subsequent criminal proceeding, the In Kastigar v. United States, the government subpoenaed certain subject waives his or her rights against self-incrimination, and people to testify before a grand jury (the “Petitioners”). 406 the government would not be considered to have acted in bad U.S. 441, 442 (1972). The district court granted immunity to the faith. United States v. Stringer, 535 F.3d 929, 936–38 (9th Cir. 2008). Petitioners, but they still asserted their Fifth Amendment privilege In Tweel, the Fifth Circuit considered DOJ’s secret use of an against self-incrimination, arguing the immunity was narrower Internal Revenue Service (“IRS”) audit in order to advance a in scope than the privilege. Ultimately, the U.S. Supreme Court criminal investigation into Nicholas Tweel. After finding that took up the issue of whether the government can compel testi- the IRS agent assigned to the audit had engaged in a “sneaky mony from an unwilling witness by conferring “use and deriv- deliberate deception” designed to mislead Tweel into believing ative use immunity”. Id. at 443. The Supreme Court concluded that he was not the subject of a criminal investigation, the court that the government must affirmatively prove that “the evidence reversed Tweel’s conviction on counts of conspiracy, tax evasion, it proposes to use is derived from a legitimate source wholly inde- and false statements on a tax return. pendent of compelled testimony”. Id. at 460. The criminal investigation into Tweel began when an IRS Noting the murky outer bounds of Kastigar, courts consider revenue agent, acting at the direction of the Organized Crime “whether the government would have taken the same steps and Racketeering Section of DOJ, notified Tweel’s accountant entirely apart from the motivating effect of the immunized testi- that the IRS would be auditing Tweel’s taxes. Before submit- mony”. Connolly, 2019 WL at *15 (citing United States v. Nanni, 59 ting his client’s tax documents to the IRS, the accountant asked F.3d 1425, 1432 (2d Cir. 1995)). the IRS agent whether IRS Criminal Investigation (“CI”) was In considering Black’s Kastigar motion in Connolly, the court involved. The agent answered “no”, an answer that was techni- agreed with Black that the Bank’s internal investigation was cally correct, CI was not involved, but the agent did not mention “fairly attributable to the Government”. Id. at *11. Based on that the IRS had initiated the investigation at DOJ’s request. the record, the court concluded that the Bank’s investigation was Following this answer, Tweel and his accountant voluntarily attributable to the Government. The court reached this conclu- turned over tax and related documents. sion because: (1) the Government directed the Bank to investigate Prior to trial, Tweel moved to suppress the documents, Gavin Black; (2) the law firm collected the information, high- arguing that he was misled regarding the nature of the inves- lighted the key issues, and shared its notes with the Government; tigation and his consent to turn over the documents was there- and (3) the Government undertook little to no independent fore obtained through deceit. The district court denied the investigative efforts. Id. at 12. The court found particular fault motion. On appeal, the Fifth Circuit found that the account- with the Government’s refusal to provide any evidence of its ant’s question about CI’s involvement was aimed at determining investigation prior to its receipt of the White Paper. whether there was a criminal investigation, and the court found Although the Connolly court did not overturn Black’s convic- “shocking” the IRS agent’s conduct in “masking the undeniable tion, the court expressed deep concerns over the “profound criminal nature of the investigation”. The court then held that implications” raised by allegations that the Government might the IRS agent’s silence amounted to a material and intentional

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 20 Corporate Cooperation: Benefits and Challenges

misrepresentation that “vitiated” Tweel’s consent, without Conclusion which the district court should have suppressed the documents as a violation of Tweel’s Fourth Amendment rights. A company must act with care when cooperating with a govern- Stringer provides a counterpoint to Tweel and shows how a ment investigation. After Connolly, one possible response might parallel investigation can be done legally. In Stringer, DOJ and be to operate all or certain corporate investigations inde- the SEC were conducting a parallel civil and criminal investi- pendently from the government. Another response might be gation related to securities fraud. The SEC coordinated its to require that Garrity-type warnings be given alongside Upjohn investigation with DOJ, and, in many instances, at the direc- warnings whenever an internal investigation could be perceived tion of DOJ, but the SEC did not conceal the possibility or the as being an “outsourced” government investigation. When likelihood of a criminal investigation from the subjects of the viewing Connolly as potentially implicating the law applicable to SEC’s investigation. Although the SEC investigators declined parallel government investigations, the answer is certainly that to confirm for the subjects the existence of a parallel criminal counsel and investigators should never affirmatively mislead investigation, the SEC gave the subjects written notice of their anyone as to the possibility or existence of a criminal investiga- Fifth Amendment rights and that the information the subjects tion. As a general rule, it is important to consider the tension provided during the investigation likely would be made avail- that exists between fully cooperating with the government and able to DOJ. turning over control of an internal investigation to the govern- Although the SEC did not specifically advise the subjects of ment. While the cooperation credit that a company can receive DOJ’s involvement, the SEC investigators made no affirmative is a strong lure, a company must take care to navigate the chal- misrepresentations and specifically advised the subjects that any lenge posed by cooperating and structure its investigation in information they provided could be used in a criminal inves- such a way that the company can receive credit for fully coop- tigation. Unlike the IRS agent in Tweel, the SEC investigators erating while avoiding the risk that the government co-opts the did not try to conceal the fact of a criminal investigation – they internal investigation. simply declined to confirm it, and the Ninth Circuit held that the subjects of the SEC investigation had waived their Fifth Acknowledgment Amendment rights. The authors would like to thank Christopher J. Hood, an associate in the Washington, D.C. office, for his invaluable assistance in the preparation of this chapter.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Boies Schiller Flexner LLP 21

Lauren Bell is an experienced litigator with a practice that focuses on government and internal investigations, white-collar defence, and complex civil litigation. She has conducted more than 30 trials at both the federal and state levels. Lauren previously served as senior counsel to the Assistant Attorney General for the Department of Justice’s Criminal Division. Prior to her role as senior counsel, Lauren was a trial attorney in the Justice Department’s Public Integrity Section, where she investigated and prosecuted public corruption and fraud offences committed by elected and appointed public officials. Lauren also served as an Assistant U.S. Attorney for the Northern District of Ohio.

Boies Schiller Flexner LLP Tel: +1 202 895 5248 1401 New York Ave, NW Email: [email protected] Washington, D.C. 20005 URL: www.bsfllp.com USA

John Kucera is a former prosecutor with extensive experience in high-profile litigation. From 2008 until 2020, John was a federal prosecutor in the Central District of California, Los Angeles. As the Coordinator of the High Intensity Financial Crime Area Task Force, John led several high-profile investigations, including the Normandie Casino conviction on money-laundering violations and the multi-billion-dollar proceedings related to 1MDB, the Malaysian Sovereign Wealth Fund. In 2018, John was appointed Special Assistant U.S. Attorney to the District of Arizona to join the prosecution and conviction of Backpage.com, a web-based platform used to promote human trafficking. John has conducted multiple international investigations in conjunction with foreign law enforcement and regulators, as well as parallel investigations in the U.S. with regulators and agencies such as the SEC, Financial Crimes Enforcement Network (“FinCEN”), and California Bureau of Gambling Control. John focuses his practice on anti-money laundering compliance, bank secrecy regulation, and international forfeiture.

Boies Schiller Flexner LLP Tel: +1 213 995 5758 725 S Figueroa Street, 31st Floor Email: [email protected] Los Angeles, CA 90017 URL: www.bsfllp.com USA

Boies Schiller Flexner is a firm of internationally recognised trial lawyers, crisis managers, and strategic advisors known for our creative, aggressive, and efficient pursuit of success for our clients. We have an established record of taking on and winning complex, groundbreaking, and cross- border matters in diverse circumstances and industries. Our litigators are recognised for prevailing when the odds are longest and the stakes highest. We have the experience, judgment, and vision to develop the arguments that achieve favourable outcomes, both inside and outside of the court- room. We build deep relationships with our clients, allowing us to represent them in any matter, in any forum, and regularly represent our clients as plaintiffs, as well as defendants. With offices located throughout the United States and in London, we operate as one firm with a seamless approach to building the most skillful and cost-effective team possible for every matter. www.bsfllp.com

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 22 Chapter 4

Asia Pacific Overview

Phillip Gibson

Dennis Miralis

Nyman Gibson Miralis Rachel Le Bransky

COVID-19 is a major ongoing global economic crisis and it primary responsibility for misconduct in the financial services would be remiss not to mention its impact in any corporate industry lies with the entities concerned and those who managed update this year. Of note for the APAC region, as of September and controlled those entities.” 2020, all emerging economies excluding China will be in The simple act of “improving governance” was a key strategic recession.1 priority for the Australian Securities Investment Commission While we may not know the true impact of the pandemic for (ASIC) in 2019, and remains as such now. Ghosn’s arrest some years, the speed and size of COVID-19 demanded emer- brought the whole of the APAC region’s corporate governance gency capital raisings and a pause on planned growth projects. It practices under the spotlight (although we may never see the also highlighted serious deficiencies in corporate disaster prepar- outcome of that prosecution, as Ghosn has fled to Lebanon). edness and crisis management plans, a lack of robust stress- The global financial crisis was a watershed moment for banks testing, and poor communication with stakeholders. In short, and corporations alike to focus on financial risks. Now, 10 years COVID-19 has exposed poor corporate governance. It is more on, in a new recession – the likes of which have not been seen likely that well-governed companies will provide much-needed since the Great Depression – authorities and consumers alike transparency, consistency and accountability to stakeholders are crying out for a return to the basics of good governance. while acting decisively to contain the impact of the pandemic. The pandemic is not the first time that good governance has Back to Basics – What is Corporate been suggested as necessary for corporate health and wellbeing. Governance? Only recently, Commissioner Kenneth Hayne AC, who oversaw the Royal Commission into Misconduct in the Banking, In the fight against financial misconduct (and to attempt to miti- Superannuation and Financial Services Industry in Australia, gate the disastrous effect of COVID-19), we must return to the published in his interim report that “every piece of conduct that basic principles of good corporate governance. has been contrary to law is a case where the existing governance As a professional, one is aware that governance is the frame- structures and practices of the entity and its risk management work which defines the relationship between shareholders, practices have not prevented that unlawful conduct”.2 management, the board of directors and other stakeholders, Although the Commissioner was speaking specifically to the and influences how a company operates. Sir Adrian Cadbury, failures of the Australian financial services sector, his senti- in the seminal 1992 Report on Financial Aspects of Corporate ment can be equally applied to revelations of corporate miscon- Governance, set out the interplay of these relationships: “Boards duct in the APAC region, and indeed, globally. And, it has been of directors are responsible for the governance of their compa- a damning few years of corporate exposure. In late 2018, Nissan nies. The shareholders’ role in governance is to appoint the direc- CEO, Carlos Ghosn, was arrested and charged with financial tors and the auditors and to satisfy themselves that an appro- misconduct, specifically, misreporting income to financial regu- priate governance structure is in place. The responsibilities of lators in Japan and using company funds for personal expenses. the board include setting the company’s strategic aims, providing In 2019, under the US Foreign Corrupt Practices Act (FCPA), the leadership to put them in effect, supervising the management the US Department of Justice (DOJ) brought individual prosecu- of the business and reporting to shareholders on their steward- tions against several high-profile executives, including the former ship. The board’s actions are subject to laws, regulations and the Goldman Sachs executives in connection with the Malaysian shareholders in general meeting.” sovereign wealth fund (1MDB), and the former president, CEO Ultimately, there are four basic principles of corporate and Chief Legal Officer of Cognizant, accused of bribery in India. governance: Commissioner Hayne went on to publish a nearly 1,000-page 1. transparency: directors and management should be able to final report with nearly 80 recommendations to redress the communicate why every material decision is made; systemic failure of corporate governance. In the opening address 2. accountability: directors should be held to account for of the final report, the Commissioner called out boards of direc- their decisions, and submit to appropriate scrutiny exer- tors and senior management: “There can be no doubt that the cised by stakeholders, in particular shareholders;

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Nyman Gibson Miralis 23

3. fairness: directors and management should give equal Commissioner Hayne found during the Royal Commission consideration to all shareholders, which assists in deterring that too often, boards did not get the right information about entrenched management, bias and vested interests; and emerging non-financial risks; but he also found that the boards 4. responsibility: directors should fulfil their duties with did not do enough to seek further or better information where honesty and integrity.3 what they had was clearly deficient, and did not do enough with It is clear, even by reading through these basic principles, that the information they had to oversee and challenge manage- global events have revealed serious shortcomings in corporate ment’s approach to these risks. governance practices, particularly the oversight and manage- For example, one major bank evidenced a “complete inability ment of non-financial risks, such as conduct risks (including not to draw together information about instances of miscon- treating stakeholders fairly) and compliance risks (not following duct identified during the immediately preceding five years”. the rules). According to the Commissioner, this revealed an inability “to Failure to implement good governance has a real impact. For identify promptly, whether for its own internal purposes or for example, Japan’s reputation, as an exemplar of strong govern- any external purpose, a single, reasonably comprehensive and ance after its stewardship code was introduced in 2014 which accurate picture of whether and how it had failed to comply with encouraged local fund managers to actively scrutinise and ques- applicable financial services laws. On the face of it, information tion directors and management, has suffered severely. A string of that kind would be important not only for managing compli- of corporate scandals and questionable governance decisions has ance with those laws but also for identifying whether separate 10 seen it slide three places, from fourth to seventh, in the biennial events stemmed from similar causes”. survey conducted by Asian Corporate Governance Association This lack of oversight, and information, is particularly prob- (ACGA) and Asia-focused brokerage CLSA. 4 lematic where global companies are increasingly vulnerable to There is also an economic argument for good governance. sanctions based on the actions of subsidiaries, or local agents. The Royal Commission in Australia revealed the real cost of not On 2 December 2019, the Australian Commonwealth implementing robust governance frameworks and compliance Government introduced the Crimes Legislation Amendment (Combatting Corporate Crimes) Bill 2019 (Cth) (“Bill”), updated practices: remediation and catch-up spending, to say nothing of from its 2017 counterpart. The Bill seeks to introduce a new strict reputational damage. liability offence for companies “failing to prevent” a foreign A study by Credit Lyonnais Securities Asia in 2002 showed bribery. Companies will face absolute liability for bribery by that, out of 495 companies examined in 25 global emerging “associates”, including subsidiaries, if they do not have adequate market countries, those with the best corporate governance procedures in place designed to prevent bribery of foreign public were eight percentage points higher in measures of “economic officials by their associates. The Bill will strengthen Australia’s value added” than other firms.5 corporate crime framework and bring Australia in line with the Research also demonstrates that investors are moving away 6 regimes in the US and the UK, who have already taken signif- from poorly governed markets. Investors are, in fact, willing icant steps to combat foreign bribery.11 Indeed, one of the key to pay extra for well-governed companies. The Global Investor policy objectives of the UK’s failure to prevent bribery offence Opinion Survey conducted by McKinsey & Company in 2002, was “to influence behaviour and encourage bribery prevention of more than 200 professional investors who collectively as part of corporate good governance”.12 manage approximately US$2 trillion in assets in 31 countries, However, if companies are not in a position to obtain revealed that a significant majority of investors were willing to adequate information about instances of misconduct, they will pay a premium for well-governed companies. These premiums certainly not have the ability to implement adequate procedures 7 averaged 20–25 per cent in Asia. to prevent bribery. There is also the added economic benefit that companies In China, the Amended Anti-Unfair Competition Law (AUCL) with good governance may avoid, or significantly lessen, crip- provides that “acts of bribery committed by a staff member of a pling criminal sanctions for misconduct. Of concern to the business operator shall be deemed the conduct of the business APAC region, of the nearly US$3 billion in fines imposed by operator, unless the business operator has evidence to prove that US authorities in 2019 for violations of the Foreign Corrupt such acts of the staff member are unrelated to seeking business Practices Act (FCPA), nearly 100 per cent involved the Asia opportunities or competitive advantage for the business oper- Pacific, primarily China and India, but also Indonesia, Vietnam, ator” (Article 7). The onus is on the company to prove that it Thailand and South Korea. In one case, Samsung Heavy has effective compliance controls, and that the offence was not Industries, the South Korean engineering company, agreed to committed to further the company’s interests. The company enter into a Deferred Prosecution Scheme to pay penalties of must prove that it neither endorsed nor acquiesced to the scheme. more than US$75 million. The US DOJ asserted jurisdiction It would be difficult for a company to prove it has effective under the FCPA against a South Korean company that bribed compliance controls if it lacks information about procedural officials in Brazil, based on the involvement of the company’s weaknesses, previous instances of misconduct, and/or whether branch office in the US.8 management is properly implementing any compliance practices. Corporate governance frameworks exist to ensure that compa- Companies must meet their obligations under these regula- nies, even multinational corporations, remain transparent and tions, but board and/or senior management must have increased accountable. The consequences are tangible, and expensive. awareness of, or access to information, regarding potential misconduct as part of good corporate governance. The Requirement for Better Oversight Methods to Address Oversight and Ease A fundamental component of corporate governance is oversight by the board of directors and senior management. They are Compliance Burdens charged with the significant task of mitigating risk. However, regulatory authorities on review found that boards, some more Supervision than others, grappled with oversight of non-financial risks. “Their oversight was less developed than what we had hoped Ultimately, entities must be in “what amounts to an always-on to see.”9 cycle to monitor culture”13 to spot deficiencies in its corporate

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 24 Asia Pacific Overview

environment that could translate into actual corporate miscon- Effective mechanisms to meet compliance standards consist- duct, such as bribery. ently is needed now more than ever, particularly considering the In Australia, regulators are increasingly using supervision as number and pace of regulatory changes. Countries in the APAC a tool to identify problems before they cause significant harm. region are voluntarily signing up to global and national initiatives For example, the ASIC Corporate Governance Taskforce is one (particularly in the banking sector) in a bid to stay globally rele- of two new supervisory initiatives that aims, through height- vant and attract foreign investment. These include: ened engagement, assessment and feedback loops, to improve ■ The Organisation for Economic Co-operation and corporate practices and address root causes of shortcomings Development-led Common Reporting Standard (CRS). before they culminate in breaches. ■ II. Basel I There is no reason why this same practice cannot be imple- ■ Net Stable Funding Ratio (NSFR). mented internally by corporations. Ideally, entities must ■ The Base Erosion and Profit Shifting (BEPS) Action Plan. constantly supervise and assess their culture and governance ■ US Foreign Account Tax Compliance Act (FATCA). frameworks, identify any problems with these frameworks, ■ European General Data Protection Regular (GDPR). address those problems, and then determine whether any Most are data and information-sharing schemes, addressing changes made are effective. The “always-on cycle” may even how data must be handled outside of the governing region, and assist entities to avoid criminal sanctions, either because they are enhancing transparency with authorities. For example, the aware of problems before they are reported or investigated, or OECD-approved CRS facilitates the exchange of information because they are found by authorities to have adequate systems gathered by financial institutions between countries to provide in place designed to prevent misconduct. tax authorities with visibility of the overseas assets and income of residents. The GDPR dictates how entities handle personal Technology to ease compliance burdens data belonging to EU individuals, including data handled outside of the EU region. Companies might also consider investing in technologies that However, studies have shown that APAC entities are strug- will assist in managing compliance comprehensively. There was gling to deal with the pace and enormity of these changes. In increasing discussion on the role of artificial intelligence in easing a survey of over 100 senior legal and compliance professionals the compliance burden, and the importance of having in-built in across the APAC region, when asked to rate on a scale of one algorithms the ability to identify risks, and send information to to 10 their confidence in their company’s ability to remain the right people at the right time. In any case, it is commonly compliant in 2019, more than one-fifth of these professionals 17 held that any technologies (including AI) must ideally: rated confidence at five or less. ■ Process large volumes of data. In 2018, Forbes published To implement measures which simultaneously increase over- that 90 per cent of the world’s data was generated over sight and confidence in compliance will go a long way in forging the past two years alone.14 It is not only indicative of the strong governance frameworks. vast amounts of information investigators need to review, but also the information that boards, senior management Foreseeable Risks and compliance teams must have oversight of to ensure Despite a strong commitment to better practice in the APAC compliance. ■ Process various forms of data. Data relevant to compli- region over the last two decades, there are a few practices in the ance and investigations is now held by social media plat- APAC region that have caused growing concern that entities are forms, mobile applications (including ephemeral messaging not prioritising governance. platforms like WeChat, which has overtaken email as the prime communicator of sensitive information used Whistleblowing by employees15), mobile communications, “back office systems”, and “customer relationship systems”. New Over the last few years, whistleblowing has come to the forefront tools are now available that can house structured data (e.g. as a global theme. In November 2019, the EU Whistleblowing transaction data) and unstructured data (e.g. emails, chat Directive was finalised, requiring the 27 Member States to legis- messages) in the same review platform, and also automati- late to provide whistleblowers with safe reporting channels and cally link between the two data sets. For example, an email protection against dismissal or retaliation. referring to payment of an invoice would normally require review of two different data platforms. Now, the email can Strong, effective whistleblower policy is a key component of be reviewed, and the actual transaction the email refers to corporate governance. It demonstrates a commitment to fair can also be located very quickly.16 treatment, stakeholders’ concerns, and transparent reporting ■ Use notifications, workflows and dashboards to flag when frameworks. compliance reports are due or when compliance deadlines However, the APAC region remains slow to implement are looming. similar requirements. For example, in Hong Kong, there remain ■ Link software with regulators enabling automatic updates, no express protections for whistleblowers, the region favouring regulatory filing and reporting from the system directly to soft law over hard regulations. On 21 December 2018, the Hong global regulatory bodies, such as ASIC. Kong Monetary Authority (HKMA) issued a notice recom- For global companies, “governance technologies” also act mending to Registered Institutions (RIs) expected standards to to centralise, structure and manage effectively the corporate prevent and manage misconduct risks in the financial industry, record. Data in an easily accessible, central location can miti- including: providing an effective feedback system to encourage gate non-financial risk, by facilitating an organisation-wide reporting of misconduct or malpractice; a culture that supports culture of compliance. It also supports governance frameworks, reporting, and protects employees from retribution; and training improving transparency, accurate and effective oversight (particu- programmes to cultivate reporting. larly within multinational corporations), and quick and informed Australia has taken a stance in respect of whistleblowing. By decision-making. January 2020, Australian public companies, large proprietary companies (with more than 50 employees or A$12.5 million

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Nyman Gibson Miralis 25

in assets), and corporate trustees of registrable superannuation Independent boards entities were required to implement a whistleblower policy and to make that policy available to officers and employees of the In response to criticism from foreign investors, Japan is company. In addition to this requirement, the Treasury Laws attempting to improve governance by introducing better over- Amendment (Enhancing Whistleblower Protections) Bill 2019 sight at board level. Japan is introducing new guidelines to (Cth) imposes significant new responsibilities on companies prevent conflicts of interest between publically traded parent trading in Australia and protections for whistleblowers.18 Some companies and their subsidiaries. It is proposed that at least amendments include: one-half or one-third of boards of listed subsidiaries are to be ■ The range of people who now enjoy protections. It is not made up of independent directors, outside the parent company. limited to whistleblowers themselves, but applies also to However, the reality of the boardroom has changed very little.23 relatives, dependents and spouses of whistleblowers. The shortcomings of these reforms are inherent in the form by ■ Clearer instructions on how to make a complaint, and the which they are being introduced – soft law guidelines, and not relevant entities to which a complaint should be directed hard regulatory change. (ASIC, the Australian Prudential Regulation Authority, or If corporate governance is prioritised, it becomes immediately an “eligible recipient” recognised by the company, such as apparent that certain trends in the APAC region are counterin- an independent whistleblower service provider). tuitive to core governance principles. ■ Allowing emergency disclosures to parliamentarians or journalists by whistleblowers if they believe there is imminent danger to the health or safety of a person. Conclusion ■ Making reports anonymously with no requirement for Poor governance, poor compliance, and financial misconduct disclosure, except confidentiality. and crime (and ultimately corporate investigations) are inex- ■ Increased civil penalties for breaching confidentiality. A tricably interlinked. To get their corporate governance frame- penalty can be imposed on a body corporate up to A$10.5 works in order, companies must take proactive steps to conduct million, or, if a Court can determine the benefit derived or targeted reviews into corporate governance, with a view to iden- detriment avoided because of the breach, up to three times tifying areas for improvement, and dealing with those problems the benefit or 10 per cent of the annual company turnover, in an effective and timely manner. It is more difficult to sanc- up to A$525 million. tion a company for non-compliance if it runs a tight ship, is up ■ The abolition of the requirement that the whistleblower’s to date with regulatory requirements, and stringently maintains disclosure be made in good faith. Although whistleblowers centralised and comprehensive data. are expected to have reasonable grounds for making the disclosure, an inquiry into the ulterior motive of a whistle- Endnotes blower is no longer relevant. If whistleblower policies are upheld as a priority for corporate 1. “Press Release: Covid-19 to Plunge Global Economy into governance, the APAC region must move more quickly to imple- Worst Recession since World War II”, The World Bank, 8 ment hard laws, and express protections, to mitigate the risk of June 2020, accessed 11 September 2020, https://www. misconduct and corruption. worldbank.org/en/news/press-release/2020/06/08/covid- 19-to-plunge-global-economy-into-worst-recession-since- world-war-ii. Dual-class shares 2. “Interim Report: Royal Commission into Misconduct in the Banking, Superannuation and Financial Services In addition, Hong Kong and Singapore recently changed stock Industry Volume 1”, Commonwealth of Australia 2018, exchange rules to allow companies to list with two classes of page 302. shares in a bid to attract large companies. 3. John D. Sullivan, Andrew Wilson, Anna Nadgrodkiewicz, However, according to ISS ESG’s Norm-Based Research, “The role of corporate governance in fighting corrup- companies with dual-class share structures are more likely to face tion”, accessed 8 September 2020, page 5, https://www2. governance challenges or environmental or social controversies. deloitte.com/content/dam/Deloitte/ru/Documents/ The CG Watch Report of 2018 went further: “While a belief in the finance/role_corporate_governance_sullivan_eng.pdf. value of transparency and accountability remains largely intact, 4. “Hard decisions: Asia faces tough choices in CG reform”, at least in official statements, some governments are showing a CLSA CG Watch, December 2018. 19 striking lack of interest in the third principle: fairness.” 5. “Saints & Sinners: Who’s Got Religion?”, CSLA CG For advocates, dual-class shares are necessary to “maintain Watch, April 2001. 20 competitiveness and fund innovation”. However, for expo- 6. “Saints & Sinners: Who’s Got Religion?”, CSLA CG nents, dual-class shares means “second-class” shareholders Watch, April 2001. whose rights are, for all intents and purposes, unimpor- 7. “Global Investor Opinion Survey: Key Findings”, tant. Further, company founders and executives can maintain McKinsey & Company, July 2002. control even as their economic stake in the business dimin- 8. “The Asia Pacific Top Ten FCPA Enforcement Actions of ishes, entrenching management and potentially skewing incen- 2019”, Steptoe & Johnson LLP, 3 February 2020, accessed tives. Dual-class companies are, in effect, building structural 8 September 2020, https://www.lexology.com/library/ 21 unfairness. detail.aspx?g=ed262e89-4763-4df9-9237-7882d3c6f5d4. In addition, fairness may not be the only governance principle 9. Keynote address by ASIC Chair James Shipton at the at stake if companies increasingly rely on dual-class companies Australian Institute of Company Directors, Essential to mitigate financial risk. Dual-class companies exhibit weak- Director Update, Sydney, 2 October 2019, accessed 8 nesses in multiple governance indicators. For example, dual- September 2020, https://asic.gov.au/about-asic/news- class companies are less likely to disclose their director evalu- centre/speeches/launch-of-asic-s-report-on-director-and- ation process, which may serve as an indicator of poor board officer-oversight-of-non-financial-risk/. accountability, renewal, and diligence.22

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 26 Asia Pacific Overview

10. “Interim Report: Royal Commission into Misconduct 15. Dora W. Wang, Michael Lowell, Peter Witherington and in the Banking, Superannuation and Financial Services Jessica Tian, “China: A New Normal Amid Rising Trade Industry Volume 1”, Commonwealth of Australia 2018, Tensions”, in GIR Insight Asia-Pacific Investigations Review 2020 page 41. (London: Law Business Research Limited, 2019), page 97. 11. “The Australian Government introduces the Crimes 16. Colum Bancroft and Edward Boyle, “Forensic Accounting Legislation Amendment (Combatting Corporate in Cross-border Investigations”, in GIR Insight Asia-Pacific Crimes) Bill 2019 (Cth) targeting corporate miscon- Investigations Review 2020 (London: Law Business Research duct and foreign bribery”, Hogan Lovells, Lexology, 21 Limited, 2019), page 37. January 2020, accessed 8 September 2020, https://www. 17. “Facing the future: Developing a response to regulatory lexology.com/library/detail.aspx?g=e3a74b67-133e-47ff- change”, Asia Risk TMF Group, January 2019, page 3. a2c8-7c2da336feda. 18. Treasury Laws Amendment (Enhancing Whistleblower 12. Ministry of Justice and Department for Business, Protections) Bill 2018, Parliament of Australia, accessed 12 Innovation and Skills (UK), “Insight into Awareness and September 2020, https://www.aph.gov.au/Parliamentary_ Impact of the Bribery Act 2010 among Small and Medium Business/Bills_Legislation/Bills_Search_Results/Result? Sized Enterprises (SMEs)”, UK Government, 2015, page bId=s1120. 3, foreword by Mike Penning MP, Minister of State for 19. “Hard decisions: Asia faces tough choices in CG reform”, Policing, Crime, Criminal Justice and Victims. CLSA CG Watch, December 2018. 13. Christian Gergis, “Key findings from the banking Royal 20. Ibid. Commission final report”, Australian Institute of Company 21. Ibid. Directors, 1 March 2019, accessed 12 September 2020, 22. Kosmas Papadopoulos, “Dual-Class Shares: Governance https://aicd.companydirectors.com.au/membership/ Risks and Company Performance”, Harvard Law School company-director-magazine/2019-back-editions/march/ Forum on Corporate Governance, 28 June 2019, accessed 8 royal-commission. September 2020, https://corpgov.law.harvard.edu/2019/ 14. Bernard Marr, “How Much Data Do We Create Every 06/28/dual-class-shares-governance-risks-and-company- Day? The Mind-Blowing Stats Everyone Should Read”, performance/. Forbes, 21 March 2018, accessed 12 September 2020, 23. Takero Minami, “Japan to curb conflicts of interest in https://www.forbes.com/sites/bernardmarr/2018/05/21/ parent-subsidiary listings”, Nikkei Asian Review, 8 March how-much-data-do-we-create-every-day-the-mind-blow- 2019, retrieved 8 September 2020, https://asia.nikkei. ing-stats-everyone-should-read/#3df46c4f60ba. com/Economy/Japan-to-curb-conflicts-of-interest-in- parent-subsidiary-listings.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Nyman Gibson Miralis 27

Phillip Gibson is one of Australia’s leading criminal defence lawyers, with over 30 years of experience in all areas of criminal law. Phillip has signiﬁcant experience in transnational cases across multiple jurisdictions, often involving: white-collar and corporate crime; asset forfeiture; money laundering and proceeds of crime; extradition; mutual legal assistance; Royal Commissions; bribery and corruption; and ICAC and Crime Commission matters. He has extensive experience in dealing with all major Australian and international investigative agencies.

Nyman Gibson Miralis Tel: +61 2 9264 8884 Level 9 Email: [email protected] 299 Elizabeth Street URL: www.ngm.com.au Sydney NSW 2000 Australia

Dennis Miralis is a leading Australian defence lawyer who specialises in international criminal law, with a focus on complex multijurisdictional regulatory investigations and prosecutions. His areas of expertise include cybercrime, global investigations, proceeds of crime, bribery and corruption, anti-money laundering, worldwide freezing orders, national security law, Interpol Red Notices, extradition and mutual legal assistance law. Dennis advises individuals and companies under investigation for economic crimes both locally and internationally. He has extensive experience in dealing with all major Australian and international investigative agencies.

Nyman Gibson Miralis Tel: +61 2 9264 8884 Level 9 Email: [email protected] 299 Elizabeth Street URL: www.ngm.com.au Sydney NSW 2000 Australia

Rachel Le Bransky is a solicitor in the International Crime and Investigations team at Nyman Gibson Miralis. She works collaboratively with the partners across a range of complex criminal matters, with a focus on white-collar crime, INTERPOL, extradition advice, Australian regulatory and compliance matters, and serious fraud and supply offences.

Nyman Gibson Miralis Tel: +61 2 9264 8884 Level 9 Email: [email protected] 299 Elizabeth Street URL: www.ngm.com.au Sydney NSW 2000 Australia

Nyman Gibson Miralis is an international, award-winning criminal defence Working with international partners, we have advised and acted in inves- law firm based in Sydney, Australia. For over 50 years it has been leading tigations involving the US, Canada, the UK, the EU, China, Hong Kong, the market in all aspects of general, complex and international crime, and Singapore, Taiwan, Macao, Vietnam, Cambodia, Russia, Mexico, South is widely recognised for its involvement in some of Australia’s most signifi- Korea, the British Virgin Islands, New Zealand and South Africa. cant criminal cases. Our international law practice focuses on white-collar www.ngm.com.au and corporate crime, transnational financial crime, bribery and corruption, international money laundering, cybercrime, international asset freezing or forfeiture, extradition and mutual assistance law. Nyman Gibson Miralis strategically advises and appears in matters where transnational cross- border investigations and prosecutions are being conducted in parallel jurisdictions, involving some of the largest law enforcement agencies and financial regulators worldwide.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 28 Chapter 5 Australia Australia

Elizabeth Avery

Gilbert + Tobin Richard Harris

12 The Decision to Conduct an Internal The proactive commencement of an internal investigation better prepares a corporation in the event that they are Investigation required to respond to the use of compulsory powers by a regulator. For example, ASIC, the financial services regulator, has 1.1 What statutory or regulatory obligations should broad powers in the exercise of its enforcement or investiga- an entity consider when deciding whether to conduct an tory functions, including compelling the production of docu- internal investigation in your jurisdiction? Are there any ments, to conduct compulsory examinations of staff members, consequences for failing to comply with these statutory and to inspect premises and documents. Similar powers exist or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? for the ACCC, the Australian Prudential Regulatory Authority (APRA), the Australian Taxation Office (ATO), the Australian Transaction Reports and Analysis Centre (AUSTRAC) (which In Australia, regulators do not commonly have the power to has regulatory responsibility for anti-money laundering and compel an entity to conduct an internal investigation, although counter-terrorism financing), and the Office of the Australian there are a range of practical measures that a regulator may Information Commissioner (OAIC). take to persuade an entity to do so. Financial services licensees can be compelled by the Australian Securities and Investments Commission (ASIC) to provide answers to questions which 1.2 How should an entity assess the credibility of a may in turn require the investigation of some facts. In limited whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal circumstances, entities that hold a regulatory licence (e.g. a implications for dealing with whistleblowers? financial services licence) may have a condition imposed on their licence that may require them to conduct some form of internal investigation. However, the imposition of a licence To enable a corporate entity to consistently determine whether an condition is most frequently used to compel an audit (and often issue raised by a whistleblower is credible, entities should main- independent) to be conducted at the conclusion of an investiga- tain a whistleblower policy which outlines the framework by tion to ensure that an already identified issue has been rectified. which they respond to a complaint by a potential whistleblower Financial services licensees also have certain supervisory obli- and assess their complaint (it is compulsory for public compa- gations as conditions on their licence that may have the effect of nies and certain other corporations incorporated in or operating requiring them to conduct investigations of issues that come to in Australia to maintain a whistleblower policy which is made their attention in order to be able to satisfy the condition. available to employees). To determine whether the complaint is Internal investigations in Australia are usually conducted on a credible, a corporate entity should undertake a confidential initial voluntary basis at an initial stage after the discovery of a compli- assessment. This should look at the nature of the complaint, ance or regulatory issue by an entity. A proactive decision to the seriousness of the allegations and concerns raised in the conduct an internal investigation carries many benefits and is complaint, the relevant work history of the complainant, whether typically a course of action that would be recommended for an supporting evidence is or could be made available, and the signif- entity to undertake. Primarily, an internal investigation allows icance of the risks posed by the complaint. an entity to identify the full nature of the compliance or regula- In addition, the use of a whistleblower policy will better tory issue that it is facing, gauge its level of exposure to regula- ensure that a corporate entity does not breach the statutory tory action, and to formulate a strategy in how to respond to the protections which exist for whistleblowers. The Corporations Act issue and any subsequent or ongoing regulator investigation/s. 2001 (Cth) (Corporations Act) protects certain whistleblower In some circumstances the approach to the investigation might activities and protects whistleblowers from persecution. The be agreed with the regulator, or the outcomes of the investiga- Corporations Act contains protections for whistleblowers who tion might be provided to the regulator. meet the statutory criteria, including: In addition, if an entity is an immunity applicant to the ■ protection of information provided by whistleblowers; Australian Competition and Consumer Commission (ACCC) in ■ protections for whistleblowers against litigation; and relation to potential cartel conduct under the ACCC’s Immunity ■ protections for whistleblowers from victimisation. Policy, then the ACCC’s grant of immunity will depend upon These protections encourage people within companies, or the entity’s full cooperation, which will require a full internal with special connections to companies, to alert the company investigation of the facts. (through its officers), or the regulator, to illegal behaviour.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Gilbert + Tobin 29

1.3 How does outside counsel determine who “the typically the “first in”; but if they fail to provide “full and frank client” is for the purposes of conducting an internal cooperation”, the “next in the queue” may be eligible. The ACCC’s investigation and reporting findings (e.g. the Legal Immunity Policy on cartel conduct only relates to civil matters, Department, the Chief Compliance Officer, the Board of as the discretion on whether to recognise cooperation and grant Directors, the Audit Committee, a special committee, immunity in criminal cases lies with the Commonwealth Director etc.)? What steps must outside counsel take to ensure of Public Prosecutions (CDPP). To facilitate criminal and civil that the reporting relationship is free of any internal immunity being granted at the same time, where the ACCC conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who considers that the applicant should be granted immunity in rela- might have an interest in influencing the direction of the tion to civil proceedings, the ACCC will make a recommendation investigation? to the CDPP regarding immunity from prosecution. If immunity is not available, the ACCC will generally consider that any “serious cartel conduct” should be recommended for A determination concerning who should be provided the find- criminal prosecution. However, if an entity was not “first in”, ings of an internal investigation should take into account how then the ACCC will generally be prepared to make a submission the internal investigation was initiated, the extent to which any to the court that the entity should be entitled to a significant regulator might be involved, the extent to which a senior officer discount on penalty for full cooperation. of the company may be implicated in the investigation and the The ACCC’s policy on leniency on enforcement matters gener- sensitivity of the issues being investigated. As a practical matter, ally applies where an entity comes forward with valuable evidence this should usually be identified and agreed at the commence- of breaches the ACCC was unaware of, where the ACCC lacks ment of any investigation retainer. Persons should be excluded enough evidence to take enforcement action. This may apply to from the investigation (or the reports) to the extent that they other forms of anti-competitive conduct or where the company may improperly influence the investigation’s findings. This is not first in line to report potential cartel conduct. There are may require either a whole or partial exclusion, and analysis on various requirements a company needs to meet to qualify for a case-by-case basis. The manager of the investigation should leniency, including that the company promptly terminates its clearly document this at the start of an investigation and have involvement in the anti-competitive conduct on becoming aware a mechanism to review this determination at regular intervals. of the breach, and was not the instigator of, and did not coerce Outside counsel should review these documented determina- others into, the conduct. tions to better inform themselves of any internal conflicts. In Because Australia has a judicial enforcement model, only the addition, outside counsel should ensure that the terms of their court may impose penalties. If the enforcement agency reaches engagement expressly set out the nature of the reporting rela- an agreement with an entity to resolve a matter, they cannot set tionship, including the extent to which persons may be excluded the penalty, but rather may make joint submissions to the court from the investigation, the extent to which their findings can be on what an appropriate penalty may be; however, this is signifi- subject to alteration by the corporate entity, and a mechanism to cantly limited in the criminal sentencing context, where the court resolve any conflicts dispute that may arise over the course of must maintain unfettered discretion to impose the sentence. the investigation. Any report of the investigation should also There are also various criteria the ACCC will take into account be clear on the nature of the engagement to avoid any potential in determining whether to reach an agreement on joint submis- for any confusion, mindful that in some circumstances clients sions to a court on appropriate penalties, including whether an may choose or be compelled to provide the report to a regulator. entity or individual has cooperated with the ACCC, and whether the individuals involved in the conduct were senior managers of 22 Self-Disclosure to Enforcement the entity or at a lower level. Authorities In some instances, entities are required to self-report breaches to the regulator within prescribed timeframes. An example is 2.1 When considering whether to impose civil or the obligation on Australian financial services licensees to make criminal penalties, do law enforcement authorities in a written report to ASIC of significant breaches or likely breaches your jurisdiction consider an entity’s willingness to within 10 business days of becoming aware of the breach or likely voluntarily disclose the results of a properly conducted breach. Self-reporting in accordance with such an obligation internal investigation? What factors do they consider? does not typically preclude the regulator from taking enforcement action in respect of the breach, but the candidness of the Yes, each of the ACCC, ASIC and ATO have cooperation poli- report and the entity’s rectification actions are among the many cies which consider an entity’s willingness to self-report breaches factors the regulator may consider in practice in determining or misconduct. While voluntary disclosure does not necessarily what action (if any) to take. deter a regulator from taking enforcement action, cooperation is typically encouraged from a relationship perspective and may 2.2 When, during an internal investigation, should a result in immunity from prosecution, joint submissions to a court disclosure be made to enforcement authorities? What for an appropriate reduction in penalties, reaching a settlement in are the steps that should be followed for making a lieu of litigation or reduced penalties for taxation offences. disclosure? The Australian Federal Police and Commonwealth Director of Public Prosecutions also have guidelines for self-reporting When disclosure should be made to regulators needs to be foreign bribery and related offences. Cooperation within those assessed on a case-by-case basis. Depending on the industry in guidelines is a significant factor in decisions to prosecute and in which the company operates, the subject matter of the investi- sentencing. Self-reporting can be done without admitting crim- gation and its outcomes, the company may be obliged to disclose inal liability or waiving privilege. Robust cooperation will be certain facts identified during the course of the investigation to expected. certain regulators. This is particularly likely in circumstances The ACCC immunity and cooperation policy for cartel conduct where there is overlap with an existing or anticipated regulatory applies to entities and individuals who are whistleblowers in rela- investigation, and if the company is seeking to self-report conduct tion to cartel conduct. Immunity is only available to one applicant,

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 30 Australia

in order to try to seek either immunity or leniency for cooper- 32 Cooperation with Law Enforcement ation in respect of penalties. In certain industries, such as the financial services industry, there may be obligations to self-report. Authorities Recently, the Australian Treasury has consulted on enhancements to the self-reporting regime for Australian financial services 3.1 If an entity is aware that it is the subject or licensees as well as the introduction of a self-reporting regime for target of a government investigation, is it required to credit licensees, with a bill addressing these matters anticipated to liaise with local authorities before starting an internal investigation? Should it liaise with local authorities even be introduced in 2020. Under the Privacy Act 1988 (Cth) (Privacy if it is not required to do so? Act), entities are also required to notify the OAIC and affected individuals where they have reasonable grounds to believe that an “eligible data breach” has occurred. While an entity that is the subject of a government investigation As noted above, in relation to potential cartel conduct, there is not obliged to liaise with local authorities before commencing may be benefits to early disclosure to the ACCC due to the poten- an internal investigation, it can be appropriate in some circum- tial to obtain immunity from civil and criminal prosecution. In stances. This will depend on the company’s regulatory engage- the first instance, an anonymous marker may be obtained from ment strategy (see section 4) and needs to be assessed on a case- the ACCC, via the potential applicant’s legal representative. If by-case basis. If the government investigation and the internal the entity decides to “perfect” the marker and seek immunity, it investigation relate to the same conduct and where there is would provide the results of its internal investigation to qualify for ongoing engagement with the relevant regulator, some level of conditional immunity. coordination is often desirable in order to reduce inefficiencies. This engagement may sometimes mean a regulator may delay or discontinue its investigation due to the internal investigation, 2.3 How, and in what format, should the findings of an provided the company commits to frank and full disclosure of internal investigation be reported? Must the findings of the outcomes of the internal investigation. Alternatively, this an internal investigation be reported in writing? What strategy may also mean the regulator requests the company cease risks, if any, arise from providing reports in writing? its own investigation due to concerns that it may prejudice the government investigation and any enforcement activity arising While the precise external reporting requirements for the find- out of its investigation. ings of an internal investigation will depend on the nature of There may also be benefits of proactive early engagement with the specific investigation being undertaken, in some instances, regulators in terms of cooperation where the company chooses to companies may be required to report the findings of internal voluntarily self-report potential breaches or misconduct, in terms investigations under statutory and regulatory reporting require- of immunity, leniency or reduced penalties (as discussed in section ments. In some cases, companies will decide to voluntarily 2). On the other hand, if companies engage prematurely with regu- report the investigation’s findings for commercial or relation- lators, this may result in regulatory enquiries commencing before ship reasons. The company’s legal advisers should give clear the company is in a position to address and respond to them. guidance about how external communications should be structured so that communications to the regulator or third parties 3.2 If regulatory or law enforcement authorities regarding the investigation do not result in privilege being are investigating an entity’s conduct, does the entity waived. The ACCC may accept oral “proffers” to avoid a waiver have the ability to help define or limit the scope of a of legal privilege. government investigation? If so, how is it best achieved? Care must also be taken to ensure the nature of the investigation, and the relationship between those carrying out the investi- No, Australian regulators will not allow an entity to define gation and the company (or relevant individuals or groups of indi- the scope of the investigation. However, typically, Australian viduals in the company) is clearly set out in the written report to regulators will engage with the entity whose conduct they are mitigate the risk of the regulator or some other party later alleging investigating and consult on the scope of a compulsory notice. that the nature of the investigation was misrepresented to achieve Often, this process is mutually beneficial, as a more detailed a favourable outcome. understanding of the entity’s structure, systems, records and It can often be difficult to establish that communications processes can assist the regulator in focusing their investigation connected with internal investigations are privileged because they on the most relevant documents (see information on the steps are often prepared for multiple purposes and because of the sheer of determining the scope of the investigation and how to assist number of documents created. Ideally, at the outset of an investi- the regulator in section 4). It is theoretically open to a company gation, companies should develop and implement suitable controls to challenge aspects of the regulator’s exercise of its investiga- over internal communications and seek to limit communication tory powers if the company considers the regulator to be acting regarding the investigation to those with a clear “need to know”. outside its statutory remit; however, this is almost never done Companies should also develop and implement appropriate confi- in practice, given that the regulators typically have very broad dentiality protocols and a clear escalation and reporting path to remits and that such a challenge would severely undermine the senior management. In order to try to manage the risks of docu- relationship with the regulator. ments being created for multiple purposes, those creating documents regarding the internal investigation should be clear about why a document is being created, and try to separate communica- 3.3 Do law enforcement authorities in your jurisdiction tend to coordinate with authorities in other jurisdictions? tions for the purposes of legal advice or litigation from communi- What strategies can entities adopt if they face cations for other purposes. investigations in multiple jurisdictions? Depending on the nature of the investigation, it may also be important to consider whether certain officers or employees may Enforcement authorities are increasingly coordinating with have interests that differ from those of the company in respect of authorities in other jurisdictions. See the answer to question 6.3 the investigation, and for those individuals to be excluded from for further details. internal communications regarding the investigation.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Gilbert + Tobin 31

For companies facing investigation in multiple jurisdictions, 4.2 When should companies elicit the assistance of it is critical to coordinate the response across the relevant juris- outside counsel or outside resources such as forensic dictions. This will typically require the appointment of a dedi- consultants? If outside counsel is used, what criteria cated individual or team to coordinate the responses and consol- or credentials should one seek in retaining outside idate the strategy. Having clear compliance and management counsel? plans in place will also help prepare an entity for a multijurisdictional investigation. Legal advice should be obtained at an early stage for all regulatory or compliance concerns that may warrant an investigation and, 42 The Investigation Process depending on the specifics of the issue, should include outside counsel. As a general rule, given the risks to independence for 4.1 What steps should typically be included in an internal lawyers, significant or sensitive investigations should investigation plan? have ongoing involvement of outside counsel. Outside counsel who are familiar with the business will be able to assist a company An investigation plan should include the following steps: to monitor its legal obligations over the course of an investigation, provide important legal advice about the substantive issues being 1) Determination of scope: This involves identifying and defining the scope of the issue that is the subject of the investigated, and also bring an independent and external perspec- investigation plan. This should include considerations of tive to the investigation to help guide the company. Additionally, what will and what will not be investigated, the key risks the engagement of outside counsel can help to ensure and make associated with the issue, the level of sensitivity associ- clear that an investigation, and sensitive materials created in it, are ated with the issue being investigated, and a preliminary protected by legal professional privilege which may otherwise be consideration of the potential levels of exposure/signifi- subject to disclosure at a later point in time. cance of the issue being investigated. Forensic consultants (or other outside resources) should be utilised on a case-by-case basis. Their use may be beneficial to: 2) Creation of investigation framework: This will involve consideration of: 1) provide additional levels of expertise that are required for a) Resources – Identifying the resources required including the investigation (e.g. a forensic accountant may be able to internal staff, I.T., and any external services (e.g. a investigate complex discrepancies in financial accounts); forensic accountant). 2) provide an additional level of scrutiny to the investigation; b) Internal management – Identifying who will be the and/or internal stakeholders responsible for the day-to-day 3) provide independent assurances regarding the reasonable- management of the investigation and the supervision ness of the methods or outcomes of the investigation. of the investigation. c) Internal risks – Identifying the level of security around 52 Confidentiality and Attorney-Client the investigation, the extent to which it needs to be Privileges quarantined from others within the organisation, and who will need to be excluded. 5.1 Does your jurisdiction recognise the attorney- d) External counsel – Planning the engagement of client, attorney work product, or any other legal external counsel. privileges in the context of internal investigations? What e) Reporting lines – Determining who will receive best practices should be followed to preserve these progress reports on the investigation, the nature of the privileges? reports and the frequency of the reports (e.g. monthly report to the Board). Legal professional privilege in Australia (also known as client f) Timeframe for report – Establishing deadlines for a legal privilege of attorney-client privilege) is generally protected preliminary and final report to be completed. under both common law and legislation. 3) Determination of regulatory engagement strategy: This Legal professional privilege applies to all confidential commu- should include consideration of whether the matter should nications (whether oral or written) and documents brought into be voluntarily (or otherwise) reported to a regulator, who existence for the dominant purpose of obtaining legal advice, should be responsible for liaising with the regulator, and the or for the purposes of actual or reasonably anticipated litiga- general approach to dealing with the relevant regulator/s tion. The protection applies to communications between a who may be interested in the outcome of the investigation. client and their lawyer, documents which record the contents of 4) Obtaining key documents and evidence: This will a protected communication (e.g. a client’s file note of a meeting include identifying what evidence is required, as well as with their lawyer), and documents created for one of the domi- who are the key custodians of information, documents, nant purposes outlined above. It may also apply to certain cate- and data necessary for the internal investigation, and gories of communications between a lawyer and a third party. undertaking steps to obtain this information. Therefore, communications in the course of an internal inves- 5) Review of evidence: The review of data and documents, tigation that are created for the dominant purpose of obtaining including witness interviews where necessary. legal advice are protected by law. 6) Report preparation/writing: This might include a consul- In order to ensure that privilege is maintained, an entity should tation period for a preliminary report to obtain feedback on maintain a policy on how it handles privileged material. At a the report’s findings, before the findings are finalised, in minimum, the policy should set out the following principles: order to correct any factual errors. 1) Ensure that privileged communications (including their 7) Report delivery: The report should be delivered, reviewed substance and effect) are kept confidential and not disclosed and responded to in a timely manner and include recom- outside the company. Loss of confidentiality in a commu- mendations for next steps, including consideration of nication is likely to be regarded as a waiver of the right to regulatory notification. assert privilege.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 32 Australia

2) Documents which attract privilege should be clearly compromised by virtue of the nature of their employment rela- marked as such to ensure that the document is not inad- tionship with their employer. Accordingly, the personal loyalties, vertently distributed by a person within the entity who is duties and interests of the in-house lawyer as an employee should unaware of its privileged status, as this may amount to a not influence the professional legal advice which they give for privi- waiver of privilege. In particular, caution should be taken lege to apply. Whether or not an in-house lawyer’s advice is consid- where there is a large volume of documents being disclosed ered independent is ordinarily determined on a case-by-case basis by an entity, as this is where inadvertent disclosure most assessing the facts surrounding the provision of that specific advice. commonly occurs. The entity providing any such large- However, some of the indicia of independence, such as terms of the scale disclosure of documents should also clearly state in employment contract, the in-house lawyer’s position in the organ- their cover letter that any inadvertent disclosure of privi- isational hierarchy of the company, whether the lawyer’s remuner- leged material is not to be taken as a waiver of privilege. ation is linked to the financial performance of the business, and to 3) To ensure that confidentiality is maintained, verbal advice whom the in-house lawyer reports may all be general factors which should be provided in private to persons who are neces- a court considers as relevant in any such determination. sarily required to receive the advice. 4) As in-house counsel must provide independent advice 5.4 How can entities protect privileged documents to maintain privilege, an in-house counsel’s legal advice during an internal investigation conducted in your should not be mixed with comments about strategic or jurisdiction? operational matters. Additionally, the personal loyalties, duties and interests of the in-house lawyer as an employee By meeting the best practice principles outlined in question 5.1, should not influence the professional legal advice which an entity can protect documents that are subject to legal profes- they give. sional privilege. In larger internal investigations, it is ordinarily 5) Care should be taken when providing legal advice to a beneficial to implement a protocol governing how privileged Board as part of any Board papers in order to ensure that documents are to be treated in a consistent manner. the communication’s dominant purpose is not diluted. Specific procedures should be followed to provide legal advice separately to any other matter. 5.5 Do enforcement agencies in your jurisdictions keep 6) The engagement of an expert during an investigation and the results of an internal investigation confidential if all communications with the expert should be made by such results were voluntarily provided by the entity? a lawyer for the express purpose of the expert providing assistance to the lawyer to give advice. This will help The voluntary disclosure of an internal investigation to an ensure privilege attaches to these communications. enforcement agency may not always be confidential. Subject to any agreement with the agency, the enforcement agency may 5.2 Do any privileges or rules of confidentiality apply choose to disclose the results publicly. to interactions between the client and third parties Additionally, documents provided to an enforcement agency engaged by outside counsel during the investigation may be subject to disclosure to an applicant who applies under (e.g. an accounting firm engaged to perform transaction the Freedom of Information Act 1982 (Cth), legislation which (subject testing or a document collection vendor)? to certain exemptions) provides a right of access to documents held by most government agencies. Legal advice should be Yes, legal professional privilege may extend to third parties if sought prior to any voluntary disclosure of an internal investiga- the dominant purpose test is met. To strengthen the privilege tion about the risks of public disclosure. claim, communications with third parties should typically be conducted by the lawyer and not the client. This will help estab- 62 Data Collection and Data Privacy Issues lish that the dominant purpose of the communication is to assist the lawyer to provide legal advice to the client. 6.1 What data protection laws or regulations apply to internal investigations in your jurisdiction? 5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal The key data protection obligations that apply to entities, investigation? including in the context of any internal investigations, are contained in the Australian Privacy Principles (APPs) in Legal professional privilege may be claimed regardless of Schedule 1 to the Privacy Act. whether the lawyer is acting in a role as in-house or outside Under the Privacy Act, if an entity holds personal informa- counsel, provided that the requirements identified in question tion about an individual that was collected for a particular 5.1 are met. purpose, the entity must not use or disclose the information for As in-house counsel may be involved in activities that are a secondary purpose without consent from the individual, or if outside the role of a lawyer as part of their day-to-day role within an exception applies. an entity, care must be taken to ensure that the in-house counsel In this context, the most relevant exceptions are: separates the legal advice they provide from other matters of the ■ where the use or disclosure of the information is required business in which they may be involved (for example, strategic or authorised by or under an Australian law or the order of commercial advice). Failure to do so may mean that the commu- a court or tribunal; nication over which privilege is asserted is deemed to be for mixed ■ an entity reasonably believes that the use or disclosure of purposes, rather than for the dominant purpose of legal advice the information is reasonably necessary for one or more or litigation. In these circumstances, privilege will not apply. enforcement-related activities conducted by, or on behalf Furthermore, an in-house lawyer must ensure that their advice is of, an enforcement body; independent for privilege to apply. An in-house lawyer will lack the ■ an entity has reason to suspect that unlawful activity, or requisite measure of independence if their advice is at risk of being misconduct of a serious nature that relates to the entity’s

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Gilbert + Tobin 33

functions or activities, is being or may be engaged in, and 6.4 What types of documents are generally deemed the use or disclosure is necessary in order for the entity to important to collect for an internal investigation by your take appropriate action in relation to the matter; and jurisdiction’s enforcement agencies? ■ the use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim. The types of documents that should be collected in an Australian internal investigation will vary depending on the nature of the 6.2 Is it a common practice or a legal requirement investigation. In general, the documents that could be collected in your jurisdiction to prepare and issue a document include internal reports, documents evidencing processes, preservation notice to individuals who may have management assurance or internal audit reports, standard forms, documents related to the issues under investigation? customer files and data, other internal data, phone recordings, Who should receive such a notice? What types of retrieval of messages from phones and tablets, correspondence, documents or data should be preserved? How should financial records, sales and marketing material and staff training the investigation be described? How should compliance with the preservation notice be recorded? instructions or manuals. In some instances, information as well as documents (including in the form of written statements) can be required. Compulsory oral testimony may also be required. While there is no legal requirement in Australian jurisdictions to prepare and issue document preservation notices, it is often prudent for companies to do so. Furthermore, there are common 6.5 What resources are typically used to collect law and legislative duties and obligations in relation to document documents during an internal investigation, and which resources are considered the most efficient? destruction, including an obligation not to destroy a document which is reasonably likely to be required in legal proceedings. The resources used to collect documents during an internal investigation depend on the nature and scope of the investiga- 6.3 What factors must an entity consider when tion, informed by the particular types of documents and data documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural the entity holds and the definition of “Document” set out in requirements, etc.)? the investigative notice. The definition of “Document” may include electronic, hard copy and draft documents, voice recordings, texts, emails, spreadsheets and instant messaging chats. If the entity wishes to move documents from Australia, there The process for the identification and collection of relevant are privacy obligations that need to be satisfied before the cross- documents depends on the investigation and its scope. Overall, border disclosure of documents located in Australia containing there needs to be an understanding of the types of documents personal information to third-party overseas recipients. These and data held and it is important to have a documented process obligations require the discloser, subject to limited exceptions, and plan for the identification and collection of relevant docu- to take reasonable steps to ensure that the overseas recipient ments, including the resources, timing and steps (such as does not breach the APPs in relation to the information (APP 8). searches) to be undertaken to locate the documents (see ques- While regulators cannot compel overseas arms of an entity to tion 4.2). Specialist I.T. and data analytics resources are often produce documents, regulators do have cooperative processes required. Entities should also consider whether third-party available to them to seek assistance from their overseas counter- verification of data or external experts are required. parts, as set out below. Court processes can also be used to seek to compel international parties to produce documents in some circumstances. 6.6 When reviewing documents, do judicial or The ACCC has a number of cooperation arrangements and enforcement authorities in your jurisdiction permit treaties with counterpart regulators internationally. While each the use of predictive coding techniques? What are best practices for reviewing a voluminous document agreement is specific to the particular agencies and the legis- collection in internal investigations? lation they administer, they generally recognise the benefits that come from cooperation and coordination in improving the effectiveness of their enforcement activities. The extent and Australian courts have increasingly accepted the use of predic- type of cooperation can include notification obligations, coor- tive coding technology, though the appropriateness of its use dination of enforcement activities, the exchange of information should still be determined on a case-by-case basis. Notably, and/or evidence, and agreements to advise of potential conflicts. the Federal Court of Australia, the Supreme Court of Tasmania The Australian corporate regulator, ASIC, has signed up to the and the Supreme Court of Victoria have each issued practice International Organisation of Securities Commissions (IOSCO) notes that support the possibility of predictive coding. Both the Multilateral Memorandum of Understanding and other bilat- Federal Court of Australia and the Supreme Court of Victoria eral agreements. The memoranda generally require ASIC and have also issued judgments in which predictive coding was the international agency to use reasonable efforts to provide permitted in the circumstances of particular cases. each other with mutual assistance, including providing and Parties should be mindful that courts might require them to exchanging information and, in some circumstances, verifying expose their predictive coding process in some detail to their information and questioning or taking testimony from witnesses. opponents to allow them to consider the sufficiency of docu- For the Australian Government and foreign governments to ment production. It may be necessary for expert reports to be request government-to-government assistance, regulators can provided or for experts to confer. also use the Mutual Assistance in Criminal Matters Act 1987 (Cth) The attitude of regulators is less clear. Regulators will not (for criminal matters) or the Mutual Assistance in Business Regulation always be given insight into the search strategies undertaken to Act 1992 (Cth) to exercise information gathering and document prepare document productions, but this might sometimes be compulsion powers (for civil matters). The Attorney-General is necessary (especially if an internal investigation is conducted with responsible for approving and making requests to foreign coun- the regulator’s agreement in place of a regulator investigation). tries for assistance in investigations.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 34 Australia

In every case, best practice using predictive coding will Where a witness is the subject of the investigation, it is advis- include detailed documentation of the methodology used, able for an entity to facilitate the provision of legal representa- because it may be necessary to justify the use of the technology. tion for this witness, to ensure that there is no later allegation of It may be prudent to obtain expert consultant reports in some impropriety against the entity. instances. More broadly, best practices for voluminous document exer- 7.4 What are best practices for conducting witness cises include: clearly documenting search and review method- interviews in your jurisdiction? ologies; identifying priority sets of documents; and treating the review as an iterative process so that strategies and insights from earlier phases of the review are formally fed into later stages. Best practice for a witness interview should be determined on Depending on the particular review, a range of technologies can a case-by-case basis. As a general practice, entities conducting usually be used to either define the review set or identify priority witness interviews should: sets, such as the use of keyword searches, predictive coding, and 1) maintain a policy which outlines how the interviews are analytical software. conducted to ensure consistency (e.g. governing periods of notice before the interview is required, the hours that an 72 Witness Interviews interview can take place, the length of an interview, and the frequency of breaks for lengthy meetings); 2) take a record of the interview (ordinarily written); 7.1 What local laws or regulations apply to interviews 3) offer the opportunity for the witness to review and, where of employees, former employees, or third parties? What necessary, correct any written record of the meeting; authorities, if any, do entities need to consult before initiating witness interviews? 4) have an independent person (whether a support person chosen by the interviewee or a HR representative) attend the interview (particularly where the interview relates to There are no protections, laws or regulations in Australia which matters of particular significance or concern); and directly apply to interviews of employees, former employees or 5) ensure that the witness is provided procedural fairness. third parties, and an entity does not need to consult any authority before initiating a witness interview. However, where an entity is seeking to interview an employee who is the subject of the inves- 7.5 What cultural factors should interviewers be aware tigation, the entity will need to be conscious of employment laws, of when conducting interviews in your jurisdiction? which offer a range of protections for employees. In particular, if an entity is seeking to take disciplinary action against the This is not applicable in our jurisdiction, although interviewers employee, it must afford procedural fairness to the employee. should be mindful and sensitive of the fact that Australia is a multicultural nation and they may encounter interviewees from a range of different cultural backgrounds. 7.2 Are employees required to cooperate with their employer’s internal investigation? When and under what circumstances may they decline to participate in a 7.6 When interviewing a whistleblower, how can witness interview? an entity protect the interests of the company while upholding the rights of the whistleblower? Employees are required to cooperate with their employer’s internal investigation. Under Australian common law, employees An entity can protect the interests of the company by reasonably are required to cooperate and participate in good faith in any questioning the whistleblower during an interview to assess the lawful and reasonable internal investigation undertaken by their merits of their complaint. An entity may choose to use outside employer. The employment contracts and entity codes of conduct, counsel to conduct this interview. which are binding on employees, will typically also impose similar To uphold the rights of the whistleblower, it is advisable for an obligations. entity to provide a whistleblower with the opportunity to retain a Employees may not need to comply in circumstances where legal representative during an interview as well as ensure adher- the questions being asked by their employer are unreasonable ence to their whistleblower policy. Additionally, at all times, an or unfair. Employees can also not be compelled to answer entity should be aware of the rights of and protections afforded questions that would be self-incriminating (given the privilege to whistleblowers, as outlined in question 1.2. against self-incrimination). An employer is not entitled to take any adverse action against the employee for the failure to comply 7.7 Can employees in your jurisdiction request to with an investigation in these circumstances. review or revise statements they have made or are the statements closed? 7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under As a matter of best practice, it is recommended that employees what circumstances must an entity provide legal are always given the opportunity to review or revise statements representation for witnesses? they have made. Where the employee is the subject of the investigation and adverse action may be taken against them on the An entity is not required to provide legal representation to basis of the statement, an employer is required to afford them witnesses either prior to or during an interview. Typically, this opportunity to review their statement. witnesses are encouraged to bring a support person to the interview (whether or not that person is a legal representative), which is a mandatory requirement where the employee is being interviewed about an allegation of misconduct against them.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Gilbert + Tobin 35

7.8 Does your jurisdiction require that enforcement 82 Investigation Report authorities or a witness’ legal representative be present during witness interviews for internal investigations? 8.1 How should the investigation report be structured and what topics should it address? In Australia, there is no requirement for a representative of an enforcement authority to be present during a witness interview, and it would be uncommon for a representative to attend. The structure of an investigation report should be determined As discussed in question 7.3, witnesses are generally encour- on a case-by-case basis, as there should be sufficient flexibility in aged to bring a support person to the interview (whether or not determining the structure to ensure the report is fit for purpose that person is a legal representative). For reasons of procedural and adequately discloses all relevant material. As a general rule, fairness, this is mandatory where the employee is being inter- the report should be structured in a manner that appropriately viewed about an allegation of misconduct against them. reflects the complexity of the issues being addressed and the recipients of reports. Reports should be as detailed as needed and should not be unnecessarily condensed. For more complex or lengthy reports, a short version of the report should also be produced to accompany the full-length report. This provides a summary version where brevity is required.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 36 Australia

Elizabeth Avery is a partner in Gilbert + Tobin’s Competition + Regulation group. Her practice includes advising on enforcement litigation and investigations, merger clearances and ongoing strategic and operational advisory work. Having practised in New York, she brings a breadth and depth of perspectives to her advice, across a broad range of industries. She has a particular focus on multijurisdictional and financial services matters, advising a range of participants on transactions, investigations and strategic initiatives. Elizabeth advised on the ACCC Inquiry into Residential Mortgage Pricing, the Productivity Commission’s Inquiry into Competition in Financial Services and represented K-Line in the first group of criminal cartel prosecutions in Australia. Elizabeth is currently ranked as a Global Elite Thought Leader and leading competition practitioner in Australia (Who’s Who Legal 2019) and is held in high regard by clients, who report: “Her exceptional technical skills are balanced by commercial acumen and a deep understanding of our business...” (Chambers Asia-Pacific 2018).

Gilbert + Tobin Tel: +61 2 9263 4362 L35, Tower Two Email: [email protected] International Towers Sydney URL: www.gtlaw.com.au 200 Barangaroo Avenue Barangaroo NSW 2000 Australia

Richard Harris leads Gilbert + Tobin’s Disputes + Investigations practice. An experienced, strategic and pragmatic litigator, Richard specialises in significant commercial litigation (including class actions) and investigations. He regularly advises banks, large corporations and their boards on major dispute, regulatory and governance issues. Richard is currently leading the team acting for Westpac in relation to multiple regulatory investigations regarding the allegations of more than 23 million breaches of anti-money laundering laws, as well as defending against associated class actions regarding disclosure requirements. Richard is ranked by leading legal directories, including Chambers Asia-Pacific, which recognises him for Dispute Resolution and Financial Services Regulation and states Richard is singled out by clients as “a key strategic adviser and the kind of person you go to for bet-the-farm litigation”, with an ability “to dive deep into all parts of a business and get across an incredible breadth of material”.

Gilbert + Tobin Tel: +61 2 9263 4413 L35, Tower Two Email: [email protected] International Towers Sydney URL: www.gtlaw.com.au 200 Barangaroo Avenue Barangaroo NSW 2000 Australia

Regulatory investigations, commissions and enquiries are increasingly a critical and everyday part of corporate life in Australia, with many sectors, and currently the financial services sector in particular, under intense scrutiny. Gilbert + Tobin’s lawyers have been deeply involved. Our Corporate and Regulatory Investigations group comprises partners and specialist lawyers with strong expertise in litigation, competition, regulatory, corporate and tax to provide coverage of regulatory compliance and investigations from end to end. Our group is known for our unparalleled work in disputes and investigations, competition law enforcement investigations and enquiries and on a range of civil and criminal investigations. We are consistently engaged on the most strategic, complex and challenging investigations, commissions and litigation, and on industry-changing reforms. www.gtlaw.com.au

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 6 37

Belgium Belgium

Jan Hofkens

Lydian Yves Lenders

12 The Decision to Conduct an Internal As a general principle under Belgian law, evidence which is obtained in breach of the abovementioned legal provisions is Investigation unlawful. A court may nevertheless accept such evidence in legal proceedings, civil or criminal, provided that: (i) the evidence has 1.1 What statutory or regulatory obligations should not been obtained in breach of formalities that are legally sanc- an entity consider when deciding whether to conduct an tioned with nullity; (ii) its reliability is not adversely affected by internal investigation in your jurisdiction? Are there any the breach; and (iii) the use of the evidence does not prevent the consequences for failing to comply with these statutory right to a fair trial. In practice, this means that the judge will or regulatory regulations? Are there any regulatory or balance the breach of protective law, on the one hand, and the legal benefits for conducting an investigation? gravity of the irregularities or fraud on the other hand. Based on this assessment, the judge will decide whether or not the unlaw- Belgian law does not provide for a specific legal framework fully obtained evidence is admitted as evidence. for internal corporate investigations. However, general rules of human rights (such as privacy and fair trial) and internal domestic law (such as criminal law and employment law) may 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an apply and govern certain aspects of an investigation, depending internal investigation is necessary? Are there any legal on the scope and circumstances of the investigation. implications for dealing with whistleblowers? The legal test is to conduct an internal investigation that is “reasonable in all the circumstances”. This means that the way in which the investigation is conducted should be “careful, There is no clear (legal) rule to assess the credibility of a whistle- balanced and thorough”. A court will not impose its own view blower. The specific circumstances will determine this assess- of what a reasonable investigation would comprise, but will have ment. The credibility of a whistleblower’s complaint, and the to decide whether the entity’s actions were reasonable and in line decision on whether or not to conduct an internal investigation, with applicable legislation. In any case, a private company may must always be assessed on a case-by-case basis. The position of never use force or violence during an internal investigation: only the whistleblower within the entity, the detail of the complaint, public authorities are allowed to use force or compulsory meas- reference to concrete situations and the existence of “prima ures (such as detention or house search) to the extent permitted facie” evidence to support the allegations are such elements to by criminal law. consider in the assessment. Guidelines and best practices in a Legal provisions aim to protect the rights of the persons whistleblower policy are in this context very useful. involved in an internal investigation, especially in the context Belgian law currently does not provide for a general legal of the tools used to collect evidence. Privacy law in general and framework for whistleblowers. However, legislation exists for data protection rules (General Data Protection Regulation (EU) certain industry sectors, such as: 2016/679, “GDPR”), in particular, regulate and restrict the use ■ The Act of 15 September 2013 on the reporting of an alleged of certain investigation methods, such as screening of mail- breach of integrity in the national administrative authori- boxes, data mining, searching of hard disks, CCTV, recording ties by its staff members. This Act, which only applies to of telephone conversations, body searches, etc. federal public authorities, offers protection to civil servants Belgian employment law, in particular, protects employees and employees who report irregularities and abuses (“whis- involved in an investigation. Specific collective bargaining tleblowers”). Sanctions affecting their careers are prohib- agreements (“CBAs”) regulate monitoring and screening of ited. Similar rules apply to regional public authorities. online communication data (CBA 81), body search (CBA 89) ■ Belgian credit institutions are obliged to set up an appro- and video surveillance (CBA 68). A breach of a CBA constitutes priate internal whistleblowing procedure to report breaches a criminal offence. of rules and codes of conduct of the institution (Article 21, Moreover, specific procedures apply when it comes to disci- §1, 8° of the Act of 25 April 2014 on the status and supervi- plinary actions against employees, such as the deadline of three sion of credit institutions). working days in which to terminate an employment contract for ■ Several legal instruments provide for a whistleblowing gross misconduct. structure in the insurance sector, such as the insurance Furthermore, internal business conduct policies or IT poli- distribution Directive (“IDD”) ((EU) 2016/97) and the cies may contain restrictions in case of an internal investigation. Packaged Retail and Insurance-based Investment Products For independent contractors, such as service providers and free- (“PRIIPs”) Regulation ((EU) No 1286/2014). The Market lancers, the contract clauses might include reporting duties and Abuse Regulations and Solvency II Law provide for similar investigation rights. This is up to the parties’ contractual freedom. procedures.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 38 Belgium

Furthermore, the Belgian Data Protection Authority issued 22 Self-Disclosure to Enforcement a recommendation in 2006 setting forth guidelines for companies on how to establish an internal whistleblowing procedure Authorities or hotline in accordance with the Belgian Data Protection Act (“BDPA”) (Recommendation 01/2006 of 29 November 2006). 2.1 When considering whether to impose civil or At European level, a Directive on the protection of persons criminal penalties, do law enforcement authorities in who report breaches of Union law (“the Whistleblower your jurisdiction consider an entity’s willingness to Directive”) was approved on 7 October 2019. The voluntarily disclose the results of a properly conducted Whistleblower Directive aims to protect whistleblowers across internal investigation? What factors do they consider? the various countries within the European Union. Member States (including Belgium) must implement the Whistleblower Yes, they can. The voluntary disclosure of the results of an Directive in national law by the end of 2021. The Whistleblower internal investigation can be regarded as a mitigating circum- Directive has a very broad scope of application, as it applies stance when imposing a penalty. to any breach of Union law in general and it covers civil serv- A voluntary disclosure might prevent the entity from prose- ants, employees, self-employed individuals and board members. cution; it can be argued, depending on the circumstances, that On the basis of this Directive, Member States are required to the criminal intent, required for the conviction, is absent. In any take all necessary measures to prohibit any form of retaliation event, it will generally be taken into account when setting the against whistleblowers. importance of the fine/penalty imposed.

1.3 How does outside counsel determine who “the client” 2.2 When, during an internal investigation, should a is for the purposes of conducting an internal investigation disclosure be made to enforcement authorities? What are and reporting findings (e.g. the Legal Department, the the steps that should be followed for making a disclosure? Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure that the reporting Under Belgian law, only a public entity, public officer or civil relationship is free of any internal conflicts? When is servant that becomes aware of a criminal offence in the perfor- it appropriate to exclude an in-house attorney, senior mance of his or her duty has the duty to report such to the public executive, or major shareholder who might have an prosecutor’s office. Also, a judge dealing with a civil matter who interest in influencing the direction of the investigation? notices/becomes aware of a criminal offence has such a duty. Hence, no general obligation to disclose criminal offences This depends on the scope and specific circumstances of the exists – although an exception is made for those who have internal investigation. In principle, the decision to conduct an witnessed an assault against public safety or against a person’s internal investigation should be taken by the board of directors, life or property. or a person duly authorised by the board to make such decision. Further, it should be noted that no one can be obliged to The board (or the person to whom such decision is delegated) also incriminate oneself. decides on the person(s) or team conducting the investigation, In addition to these general principles, some specific sector/ including legal counsel. In case of suspicion of involvement in transaction-related laws impose reporting duties. For example, irregularities against board members, the decision to investigate certain reporting must be done under the money-laundering and to appoint external counsel may be taken by the shareholder, legislation to the Financial Intelligence Processing Unit. A but this should be confirmed afterwards by a valid board decision. further specific arrangement exists in the disclosure of breaches The entity is free to decide on the members of the investiga- of competition law, i.e. a specific arrangement for leniency for tion team. This will obviously depend on the nature of the alle- whistleblowers. gations. Normally the lead will be taken by an internal specialist Finally, both in criminal and civil proceedings, the judge or of the entity (loss prevention team, compliance manager), the acting magistrate can order to submit and transfer certain supported by financial and/or technical (IT) experts. The information, including an internal investigation report. team members should sign specific non-disclosure agreements (“NDAs”) (unless such NDA is included in their contracts). The person or body authorised to take (disciplinary) decisions 2.3 How, and in what format, should the findings of an should not be part of the team. internal investigation be reported? Must the findings of It is recommended to involve the legal team from the begin- an internal investigation be reported in writing? What ning to avoid evidence being collected in breach of protective risks, if any, arise from providing reports in writing? legislation. If no internal legal team exists, or if the legal team is not experienced with this type of investigation, it is recom- The law does not prescribe the format for an internal inves- mended to appoint immediately a specialist outside counsel, tigation report. However, it is recommended to describe the whose role is to ensure that the investigation is properly findings in a written report. Indeed, as both criminal and civil conducted and evidence can be used in (disciplinary) proceed- proceedings are based on documentary evidence filed with the ings and recovery actions afterwards. court or included in the criminal file, the report should be in In principle, it is for the entity to determine who the client writing for evidence purposes. While the court can summon will be. The “client” ordering the internal investigation and witnesses, for example the investigators, the court generally instructing outside counsel may obviously not be someone who relies on the documentary evidence for its judgment. is a (potential) witness, or who is (in-)directly involved in the An internal investigation report has no specific eviden- department under investigation. An outside counsel may assume tiary value. The judge will freely assess this value. It is always that no conflicts of interest exists unless it turns out otherwise possible that in the context of a criminal investigation, the inves- pending the investigation. A signed engagement letter prior to tigation judge appoints other (external) experts to perform addi- starting the investigation is important; this engagement letter tional (technical) investigations. A civil court may also appoint should include the client for the mandate, the scope of the inves- external experts in case one of the parties challenges the validity tigation and the way of reporting. or correctness of the investigation.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Lydian 39

Having said that, a written report can be used against the to the different investigating authorities. Such outside counsel is entity as it might describe shortcomings within the entity related well placed to liaise with local counsel on strategy and local laws. to the criminal offences. To mitigate this risk and to be able to assess it before issuing a report, it is advisable that outside counsel 42 The Investigation Process acts as an intermediary. All his/her correspondence during the investigation is protected by professional secrecy. This profes- 4.1 What steps should typically be included in an sional secrecy prevents, to a certain extent, the disclosure of investigation plan? business-sensitive information from the written report. To ensure a fair, balanced and thorough investigation, the inves- 32 Cooperation with Law Enforcement tigation plan typically includes the following steps: Authorities ■ Determine the scope and approach – it is important to identify: (i) the irregularities (data) to be investigated; (ii) the 3.1 If an entity is aware that it is the subject or persons potentially involved and their inter-relations; and target of a government investigation, is it required to (iii) the methods of collecting evidence that will be used. liaise with local authorities before starting an internal ■ Preserving and securing evidence (both documents and investigation? Should it liaise with local authorities even electronic/digital data). In certain cases, it may be advis- if it is not required to do so? able to make secured copies of mailboxes or laptop hard drives, for which IT forensic specialists may be required. No, it is not. Generally, the entity will not be aware that it is the It may also be recommended to secure or restrict access subject or target of a government investigation. to the company’s building, confidential data, internet and However, as indicated above, sharing information of an bank accounts. internal investigation might have a beneficial impact on the ■ Hidden actions, which may be undertaken without entity’s own position. The decision to have the matter investi- alerting people. gated by the public prosecutor’s office, by filing a complaint, is ■ Interviews with (potential) witnesses and, at a later stage, an imprecise art. This will depend on the intent of the client, the suspects. gravity of the facts, and the specific circumstances of each case. ■ Analysis of data collected (such as financial data). In the case of serious fraud, it may be useful to file a complaint ■ Drafting of the investigation report (see further below because the public authorities obviously have greater powers question 8.1). to conduct a full investigation (including home search, wire- ■ Contradiction: submit the findings of the report to tapping, etc.). A civil litigation is suspended during a criminal suspects/people involved for comments. investigation (“le criminal tient le civil en état”). ■ Assess disciplinary actions: if the findings of the investigation might result in disciplinary actions (dismissal of 3.2 If regulatory or law enforcement authorities employees or termination of management contracts), the are investigating an entity’s conduct, does the entity process (e.g. need for a disciplinary hearing) and legal have the ability to help define or limit the scope of a timings (deadline to proceed with dismissal) should be government investigation? If so, how is it best achieved? determined. ■ Reporting and decisions: submit the report to the internal The investigating authority determines autonomously the scope person or body authorised to make final decisions on of its investigation. The elements submitted in the complaint (disciplinary) actions. or in the report will, however, be a guide to the investigating authority. If a complaint (i.e. combined with a civil claim for 4.2 When should companies elicit the assistance of damages) is filed before the investigating magistrate, an investi- outside counsel or outside resources such as forensic gation must be conducted. The scope and the way in which this consultants? If outside counsel is used, what criteria or is done is at the investigating magistrate’s discretion. credentials should one seek in retaining outside counsel? A party to the criminal proceedings is, however, at specific timings, entitled to request additional inquiries; for example, the Companies should seek the assistance of outside counsel as hearing of a (specific) witness. Once more, it will be the investi- soon as possible to ensure that the investigation process is gating magistrate who will grant or refuse such a request. compliant with legal requirements and that its result can be used as evidence in a litigation. Professional secrecy of external 3.3 Do law enforcement authorities in your jurisdiction counsel is also useful. Forensic consultants such as IT consult- tend to coordinate with authorities in other jurisdictions? ants (for e-discovery) or auditors (for financial analysis) will also What strategies can entities adopt if they face be important to involve. The entity should ensure that audit by investigations in multiple jurisdictions? external partners also complies with the requirement of a fair, balanced and thorough investigation. Yes. There exist many forms of international cooperation between law enforcement and investigating authorities, both 52 Confidentiality and Attorney-Client within the European Union and with non-European jurisdic- Privileges tions, based on bi- and multilateral treaties. This includes joint investigating teams, letters rogatory and other means of mutual 5.1 Does your jurisdiction recognise the attorney-client, legal assistance. attorney work product, or any other legal privileges in the When faced with an internal investigation or government inves- context of internal investigations? What best practices tigation covering multiple jurisdictions, the entity should appoint should be followed to preserve these privileges? a coordinating outside counsel to liaise with the several jurisdictions and to keep track of the questions raised and answers given Yes. Article 458 of the Criminal Code obliges attorneys to

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 40 Belgium

maintain professional secrecy. This provision prohibits attor- 5.5 Do enforcement agencies in your jurisdictions keep neys from making any disclosure of information that is protected the results of an internal investigation confidential if by the attorney-client privilege. A breach of this obligation can such results were voluntarily provided by the entity? be criminally sanctioned. The obligation covers the communications between a client and the attorney and between the attorney No. If used in litigation, it must be subject to the contradic- and third parties in view of advising the client. Further, all infor- tory debate. mation (fee notes/invoices, and working papers) that the attorney obtains in his/her professional capacity and in the performance of his/her profession is covered, such to the extent that the client 62 Data Collection and Data Privacy Issues has an interest in the confidential nature of such information. This privilege prohibits the attorney from disclosing the 6.1 What data protection laws or regulations apply to information. It applies in civil and in criminal matters. The internal investigations in your jurisdiction? public prosecutor is therefore not entitled to seize those documents, in principle. Internal investigations often imply the processing of personal Exceptions do, however, exist. An attorney will not be sanc- data or electronic communications (which also enjoy protection tioned if he/she discloses information covered by professional for privacy reasons and will often be included in internal inves- secrecy to a judge or in a parliamentary committee of inquiry or tigations). In this respect, the following laws and regulations if the law allows him to speak. In those situations, the attorney should be adhered to (where applicable): will have to balance the competing interests and decide him/ ■ the GDPR; herself to set aside the duty of secrecy. ■ the Belgian Act of 30 July 2018 on the protection of If the attorney is as a party implicated in a criminal offence, natural persons with regard to the processing of personal the privilege will be set aside. data (BDPA); Next to professional privilege, all correspondence between ■ the Belgian Act of 13 June 2005 on Electronic attorneys in Belgium is, in principle, confidential based on the Communications (Articles 124, 125 and 145) which ethical rules. Without the consent of the President of the Bar, such prohibits everyone, save he/she who obtained the consent correspondence may not be disclosed. However, some exceptions of all the persons directly and/or indirectly involved, from: exist; for example, for official letters between attorneys. (i) intentionally obtaining information about the existence The best practice to preserve these privileges is to instruct of any information that has been sent by electronic means an outside counsel from the beginning of an internal investi- and that is not personally addressed to him/her; (ii) inten- gation, who will act as an intermediary between the entity and tionally identifying persons involved in the transmission outside consultants. Because of this intermediation, all commu- of the information and the content thereof; (iii) intention- nications will be covered by professional secrecy. ally obtaining information concerning electronic communication and concerning another person; or (iv) modi- 5.2 Do any privileges or rules of confidentiality apply fying, deleting, disclosing, conserving, or using otherwise to interactions between the client and third parties the information, identification, or data that have been engaged by outside counsel during the investigation obtained intentionally or not. A breach of this prohibition (e.g. an accounting firm engaged to perform transaction can lead to fines up to EUR 400,000; testing or a document collection vendor)? ■ the Belgian Criminal Code (Article 314bis), which prohibits persons from intentionally, without the consent of all those No privileges or rules of confidentiality apply. taking part in the communication, intercepting or causing to be intercepted, taking note or causing to be taken note of, recording or causing to be recorded, non-publicly acces- 5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal sible communications in which one does not participate investigation? or to knowingly retain, disclose, disseminate to another person or use otherwise the content of communications that are not accessible to the public and that are unlaw- In-house counsel is also bound by professional secrecy under fully intercepted or recorded or which have been unlaw- the conditions that the in-house counsel is an employee (in the fully taken note of. A breach of this prohibition can lead sense of being subordinate to an employer) and is registered with to fines of up to EUR 160,000; the Belgian Institute of In-House Counsels. It applies to any ■ CBA 68 of 16 June 1998, which allows the use of secu- in-house counsel’s advice that has been given for the benefit of rity cameras at the workplace to the extent that it, amongst this counsel’s employer and within the framework of his/her others: (i) only serves for (one of) the purposes listed in said position as legal counsel. CBA; (ii) limits interference with the privacy of employees If the advice does not normally require the intervention of a to a minimum; and (iii) happens transparently; and legal professional, it will not be protected by this legal privilege. ■ 1 CBA 8 of 26 April 2002, which allows the monitoring As a result, privileged advice may not be inspected, copied of electronic online communication data of employees to or seized. It is the competent magistrate who decides whether the extent that it, amongst others: (i) only serves for (one or not to include the documents for which confidentiality is of) the purposes listed in said CBA; (ii) limits interfer- invoked in his criminal investigation. ence with the privacy employees to a minimum; and (iii) happens transparently. 5.4 How can entities protect privileged documents Moreover, the Belgian Data Protection Authority has provided during an internal investigation conducted in your recommendations that could be useful, such as: Recommendation jurisdiction? 8/2012 of 2 May 2012 on the employer’s supervision of the use of electronic means of communication in the workplace; and See question 5.1 above. Recommendation 1/2006 of 29 November 2006 on whistleblowing systems.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Lydian 41

6.2 Is it a common practice or a legal requirement 6.6 When reviewing documents, do judicial or in your jurisdiction to prepare and issue a document enforcement authorities in your jurisdiction permit preservation notice to individuals who may have the use of predictive coding techniques? What are documents related to the issues under investigation? best practices for reviewing a voluminous document Who should receive such a notice? What types of collection in internal investigations? documents or data should be preserved? How should the investigation be described? How should compliance with the preservation notice be recorded? Belgian law does not provide for any restrictions on using predictive coding techniques for reviewing a voluminous document collection during an internal investigation. Under Belgian law, there is no obligation to prepare or issue In practice, documents are often reviewed manually during a document preservation notice to individuals who may have due diligence. In doing so, physical documents are generally documents related to the issues under internal investigation. digitalised to convert them into searchable (PDF) documents. However, there are several legal duties to retain certain types of information for a specific minimum term (e.g. accounting 72 Witness Interviews documents, tax documents, corporate documents, social documents (personnel), medical data, etc.). In this context, it can, of course, be useful to issue a preservation notice to individuals 7.1 What local laws or regulations apply to interviews who may have documents related to the issues under investiga- of employees, former employees, or third parties? What authorities, if any, do entities need to consult before tion, in particular if the retention period is coming to an end and initiating witness interviews? the deletion of the data would be automatic. This will generally depend on practices in the relevant sector. Finally, if someone is aware of documents essential to an There are no specific legal requirements for interviews in the internal investigation in the possession of another party, while context of an internal investigation. that other party refuses to cooperate with such an investigation To ensure fair and impartial interviews, it is recommended or could possibly proceed with the destruction of said essential to apply similar principles as for interviews in the context of documents, a court may also be seized to order the production a criminal investigation. This implies that at the start of the of those documents or to prohibit the destruction thereof. interview, the interviewee should be informed of the facts under investigation and that: ■ he/she may be assisted by a legal counsel or person of trust; 6.3 What factors must an entity consider when ■ all questions and answers will be noted down in his/her documents are located in multiple jurisdictions owns words; (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)? ■ he/she can ask for an additional investigation to be carried out; ■ his or her statements can be used as evidence in court; The entity must make sure that it complies with data protec- ■ he/she cannot be obliged to self-incriminate him- or tion legislation, in particular regarding the transfer of personal herself; data within or outside the EEA. In general, data for the internal ■ he/she can use supporting documents during the inter- investigation should be collected in accordance with the laws of view; and the jurisdiction where the documents are located. ■ he/she has the right to revise, complete and/or correct the interview report. 6.4 What types of documents are generally deemed important to collect for an internal investigation by your 7.2 Are employees required to cooperate with their jurisdiction’s enforcement agencies? employer’s internal investigation? When and under what circumstances may they decline to participate in a This will depend on the circumstances, scope and purposes of witness interview? the internal investigation. There is no general list of documents that should be collected. All documents that can be of interest Employees cannot be forced to cooperate, but this may be for the internal investigation should be regarded as important. considered disloyal behaviour, which might qualify as cause for This may include email communication, accounting data, files dismissal. (both hard copy and electronic), system logs, audit reports, presentations, etc. 7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under 6.5 What resources are typically used to collect what circumstances must an entity provide legal documents during an internal investigation, and which representation for witnesses? resources are considered the most efficient? No, the entity is not required to do so. The resources will depend on the documents that are to be collected. A backup of computers and email accounts of persons 7.4 What are best practices for conducting witness involved will require IT resources. Payment information will interviews in your jurisdiction? require accounting or finance resources.

The requirement of a balanced, fair and thorough investigation should be respected during each stage of the investigation,

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 42 Belgium

including interviews. It is also recommended to have two inves- 7.8 Does your jurisdiction require that enforcement tigators present and someone to take notes. Recording of inter- authorities or a witness’ legal representative be present views is not common practice, but is possible with the explicit during witness interviews for internal investigations? consent of the interviewee. At the end of the interview, the (summary of the) witness statement should be submitted for No. However, the employee may be assisted by a trade union comments and approval. Ideally, the interviewee signs the inter- representative during the disciplinary meeting(s). The trade view report. union representative can participate in the dialogue but cannot answer questions on behalf of the employee at the meeting. 7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction? 82 Investigation Report

No specific factors or practices exist in this respect. 8.1 How should the investigation report be structured and what topics should it address?

7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while There is no specific requirement for the format or content upholding the rights of the whistleblower? of such a report and this will depend on the circumstances. However, a report may contain some or all of the following: The same rules apply as for ordinary witness interviews. If an ■ Executive summary. internal whistleblower policy exists, it must be ensured that ■ Timeline of actions and investigation methods applied. procedures set forth in this policy are respected. ■ “Cast list” of people involved and witnesses interviewed. ■ Findings: this will be the main section of the report and will detail the findings on each topic investigated, 7.7 Can employees in your jurisdiction request to including the facts and evidence presented, any inconsist- review or revise statements they have made or are the encies found with explanations where applicable, reasons statements closed? why certain evidence is preferred over others, any mitigating circumstances and any risks identified, as well as There is no legal obligation, but it is recommended to give topics that could not be investigated and the reason why. employees the possibility to review and revise statements. ■ Conclusion: it is crucial that the report is factual and impar- Comments made by the interviewee should be mentioned in the tial. It is not up to the investigators to draw conclusions statement as “additional comments”. or to qualify the facts as a (criminal) offence or breach of contract. ■ Annexes: it is recommended to attach witness statements and relevant documentary evidence to the report.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Lydian 43

Jan Hofkens is a Partner in the Employment, Pensions & Benefits practice of Lydian. He focuses on all aspects of employment law and social security law, with a special interest in business crime, restructurings, outsourcing, and negotiation of CBAs, strategic boardroom advice and international employment. Furthermore, he has extensive experience before the labour courts. He is often involved in internal investigations of corporate fraud and the disciplinary sanctions towards the employees involved. In this context, he is part of the Compliance & Internal Investigations’ practice (CINV) of Lydian. He has written numerous articles on issues of labour law. He is a frequently requested speaker, both in Belgium and abroad. His expertise has merited him an entry in legal directories such as Chambers and The Legal 500.

Lydian Tel: +32 3 304 90 04 Havenlaan – Avenue du Port 86c B113 Email: [email protected] 1000 Brussels URL: www.lydian.be Belgium

Yves Lenders is a Partner in the Commercial & Litigation practice, where he heads the Ports & Logistics team. He is also active in the Outsourcing and Insolvency teams. He specialises in commercial law and insolvency matters, next to questions on directors’ liability and shareholders’ disputes. He handles complex litigation matters and has experience in business crime. He regularly acts as a trusted advisor to his clients on commercial matters, including advising, drafting and implementing legal documentation for his clients’ businesses and on dispute resolution strategies. Furthermore, he advises clients faced with insolvent or near-insolvent counterparts. In this context, he deals with all the steps of the procedure for judicial reorganisation (Law on the continuity of enterprises – WCO). Dealing with commercial and contract matters and recovery actions, he is part of the Compliance & Internal Investigations’ practice (CINV) of Lydian.

Lydian Tel: +32 3 304 90 08 Arenbergstraat 23 Email: [email protected] 2000 Antwerp URL: www.lydian.be Belgium

Lydian is a full-service Belgian business law firm with an Anglo-Saxon Lydian believes in integrity, authenticity and consistency. Our mission is to approach to practising law. Through a fine blend of transactional law find solutions through excellent legal insight and strong business instinct. expertise and litigation skills, we deliver straight to-the-point solutions. That is how we exceed expectations, deliver consistent results and forge We listen to what is important and provide practical and personalised long-term relationships with industry leaders. advice. This requires fresh thinking and tech savviness combined with www.lydian.be proven experience. We think client-focused, act fast and speak frankly in a language that you understand. Expect accessible personalities, open minds and a pragmatic bullet-point approach. From our offices in Brussels, Antwerp and Hasselt, we work as an exten- sion of the client’s team. Our lawyers cherish a close client-lawyer relationship, while their sophisticated approach outperforms the service of many competitors.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 44 Chapter 7 China China

Wen Qin

Rui Bai Law Firm Juliette Zhu

12 The Decision to Conduct an Internal 1.3 How does outside counsel determine who “the client” is for the purposes of conducting an internal investigation Investigation and reporting findings (e.g. the Legal Department, the Chief Compliance Officer, the Board of Directors, the 1.1 What statutory or regulatory obligations should Audit Committee, a special committee, etc.)? What steps an entity consider when deciding whether to conduct an must outside counsel take to ensure that the reporting internal investigation in your jurisdiction? Are there any relationship is free of any internal conflicts? When is consequences for failing to comply with these statutory it appropriate to exclude an in-house attorney, senior or regulatory regulations? Are there any regulatory or executive, or major shareholder who might have an legal benefits for conducting an investigation? interest in influencing the direction of the investigation?

Currently, there are no statutory or regulatory obligations First of all, as stated above, the ways of dealing with whistle- with regard to conducting internal investigations in China. blowers are governed by the corporates themselves. Generally However, the China Securities Regulatory Commission revised speaking, for outside counsel, the Chief Compliance Officer the “Regulations on Strengthening the Supervision of Listed may be the best “client” to report findings as long as the compli- Securities Companies” on 17 September 2020, requiring secu- ance department is independent and does not have vested rities companies to strengthen internal control and inside infor- interest in the outcome of the investigation. In some circum- mation management. Therefore, securities companies may need stances, a special committee comprises the independent compli- to establish their own rules regarding internal investigations in ance department and in-house attorney, and whoever has the order to strengthen internal control. authority to make decisions in relation to investigations may be needed to conduct a relatively complex investigation. To ensure the integrity of the investigation, a preliminary investigation 1.2 How should an entity assess the credibility of a should be conducted to avoid internal conflicts and to exclude whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal all potentially interested parties. implications for dealing with whistleblowers? 22 Self-Disclosure to Enforcement To assess the credibility of a whistleblower’s complaint and Authorities determine whether an internal investigation is necessary, companies may need to carry out a preliminary investigation to take 2.1 When considering whether to impose civil or all circumstances into consideration, looking into the identity criminal penalties, do law enforcement authorities in and background of the whistleblower, the relationship between your jurisdiction consider an entity’s willingness to the whistleblower and the company and/or the accused, the voluntarily disclose the results of a properly conducted evidence supporting the allegation, and whether there is any internal investigation? What factors do they consider? prior record similar to the accusation. Currently, China does not have any laws or regulations that According to Article 67 of the Criminal Law, all people and specifically protect real name whistleblowers. Rules on the entities are obliged to voluntarily confess one’s crime to the law protection of whistleblowers are scattered in the Criminal Law, enforcement authorities, and such voluntary surrender may be Criminal Procedure Law, “Provisions of the Supreme People’s exchanged for a lighter or mitigated punishment. However, Procuratorate on Protecting Citizens’ Right to Report” and other there are no specific rules to govern whether the entities should regulations, but these laws and policies still remain in declara- conduct an internal investigation first. tive provisions, and are only applicable to citizens who report violations of laws and crimes to a public authority. Therefore, 2.2 When, during an internal investigation, should a the ways of dealing with whistleblowers are governed by corpo- disclosure be made to enforcement authorities? What rates themselves in articles of association and/or employee are the steps that should be followed for making a handbooks. disclosure?

According to Article 110 of the Criminal Procedure Law, any entity or individual, upon discovering facts of a crime or a criminal

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Rui Bai Law Firm 45

suspect, has the right and duty to report the case or provide infor- with these agreements. If entities face investigations in multiple mation to a public security agency, a people’s procuratorate or a jurisdictions, it is recommended to involve professional attor- people’s court. The steps that should be followed for making a neys to help them solve the problems. disclosure vary between different authorities and places. 42 The Investigation Process 2.3 How, and in what format, should the findings of an internal investigation be reported? Must the findings of 4.1 What steps should typically be included in an an internal investigation be reported in writing? What investigation plan? risks, if any, arise from providing reports in writing? Generally speaking, an investigation plan should include: firstly, According to Article 111 of the Criminal Procedure Law, reports the matter to be investigated and the action plans for different can be filed in writing or orally. The officer receiving the oral scenarios; secondly, a clear and workable rule of investigation, report shall make a written record of it, which, after being read such as the rules of evidence collection and preservation, the to the reporter and found free of error, shall be signed or sealed rule of witness interview and statement, the rule of decision by the reporter. The officer receiving the information shall making, and the rules of disciplinary and remediation meas- clearly explain to the informant the legal responsibility that shall ures; and lastly, the principle of confidentiality in relation to be incurred for making a false accusation. However, an accu- all communications – in particular, when involving the juris- sation that does not accord with the facts, or even a mistaken diction where the legal privilege is available, it is suggested to accusation, shall be strictly distinguished from a false accusa- involve professional counsel and maximise the coverage of the tion, as long as no fabrication of facts or falsification of evidence legal privilege. is involved. The enforcement authorities shall ensure the safety of reporters as well as their close relatives. If the reporters wish 4.2 When should companies elicit the assistance of not to make their names and acts of reporting known to the outside counsel or outside resources such as forensic public, these shall be kept confidential. consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside 32 Cooperation with Law Enforcement counsel? Authorities When facing professional issues, it is suggested to involve an 3.1 If an entity is aware that it is the subject or independent third-party outside counsel or outside resources target of a government investigation, is it required to such as forensic consultants. When retaining outside counsel, liaise with local authorities before starting an internal certain credentials should be taken into consideration, including investigation? Should it liaise with local authorities even their expertise and reputation in the relevant professional area, if it is not required to do so? and their overall experience, independence and impartiality.

There are no specific requirements to liaise with local authorities 52 Confidentiality and Attorney-Client before starting an internal investigation. However, Articles 306 Privileges and 307 of the Criminal Law stipulate the Crime of Destroying or Forging Evidence or Obstructing Testifying to prohibit the 5.1 Does your jurisdiction recognise the attorney-client, agent ad litem from (assisting in) destroying or forging evidence, attorney work product, or any other legal privileges in the or coercing or enticing the witness into changing testimony or context of internal investigations? What best practices giving false testimony. Therefore, it is recommended to liaise should be followed to preserve these privileges? with local authorities before starting an internal investigation to minimise the risk of incriminating oneself. Legal privileges have not been recognised in China. However, according to Article 38 of the Lawyers Law of the PRC, lawyers 3.2 If regulatory or law enforcement authorities shall keep confidential any state secret or trade secret which are investigating an entity’s conduct, does the entity has come into their knowledge in the course of their practice have the ability to help define or limit the scope of a and shall not divulge any private information of the parties government investigation? If so, how is it best achieved? concerned. Lawyers shall keep confidential any related not-to- be-divulged information of a principal or any other person, If companies have the ability to help define or limit the scope of except for the facts and information relating to the principal or a government investigation, it is recommended to do so as it is any other person’s criminal intent or conduct which jeopardises one of the ways of liaising with local authorities. However, the national security or public safety, and/or causes serious harm to enforcement authorities may still conduct an overall investiga- others’ personal safety. Further, according to Article 48 of the tion, and whether to take the findings of the entities into consid- Criminal Procedure Law, a defence lawyer shall have the right eration is at the discretion of the authorities. to keep confidential the conditions and information regarding a client known in the practice of law. However, lawyers that know in their practice of law that a client or any other person is 3.3 Do law enforcement authorities in your jurisdiction preparing for or is committing a crime compromising national tend to coordinate with authorities in other jurisdictions? security, public security or seriously damaging the personal safety What strategies can entities adopt if they face of others, must inform a judicial authority in a timely manner. investigations in multiple jurisdictions? Therefore, the best practice to be followed to preserve these privileges may be, when dealing with a multinational investiga- There are many mutual judicial assistance agreements between tion, make the most use of where the legal privilege is available and China and other countries. The law enforcement authorities will set up a clear privilege protocol to maintain confidentiality to the coordinate with authorities in other jurisdictions in accordance greatest extent.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 46 China

5.2 Do any privileges or rules of confidentiality apply issues and rules; normally in the court proceeding, a preserva- to interactions between the client and third parties tion notice is also indispensable in evidence and/or property engaged by outside counsel during the investigation preservation. Generally speaking, the notice should be deliv- (e.g. an accounting firm engaged to perform transaction ered to all the involved parties and all types of documents or data testing or a document collection vendor)? involved in the investigation should be preserved. The investigation should be addressed anonymously, and technical means As there are no privileges or rules of confidentiality when of forensic consultants may be used to record the compliance. engaging a third party, it is recommended to sign confidentiality agreements with those parties. 6.3 What factors must an entity consider when documents are located in multiple jurisdictions 5.3 Do legal privileges apply equally whether (e.g. bank secrecy laws, data privacy, procedural in-house counsel or outside counsel direct the internal requirements, etc.)? investigation? When documents are located in multiple jurisdictions, it is As stated above, legal privileges have not been recognised in necessary to engage attorneys in each jurisdiction to carefully China and the Lawyers Law of PRC is not applicable to in-house deal with those documents, as attorney-client privilege, data counsel. and individual information protection laws and regulations vary dramatically across different jurisdictions.

5.4 How can entities protect privileged documents during an internal investigation conducted in your 6.4 What types of documents are generally deemed jurisdiction? important to collect for an internal investigation by your jurisdiction’s enforcement agencies? As stated above, legal privileges have not been recognised in China. When dealing with a multinational investigation, it is There are no express requirements concerning the types of recommended to set up a clear privilege protocol to leverage the documents that ought to be collected by the enforcement agen- privileges applied. A non-disclosure agreement is also recom- cies for an internal investigation. All kinds of documents, such mended for the protection of information investigated. as written notes, emails, messages, WeChat chatting records, etc., that are related to the issues shall be deemed important. 5.5 Do enforcement agencies in your jurisdictions keep the results of an internal investigation confidential if 6.5 What resources are typically used to collect such results were voluntarily provided by the entity? documents during an internal investigation, and which resources are considered the most efficient? Currently, there are no rules to oblige enforcement agencies to keep the results of an internal investigation confidential. If the The technical means of forensic consultants are typically used entities request so, it is at the discretion of the authorities to and seem to be the most efficient way of collecting documents accept it or not. during an internal investigation, as email and online chats on various instant messenger services have become the most widely 62 Data Collection and Data Privacy Issues used communication mode nowadays. Through technical means, most records can be collected and restored, even infor- 6.1 What data protection laws or regulations apply to mation that has been deleted. internal investigations in your jurisdiction? 6.6 When reviewing documents, do judicial or Currently, there is no specific law on data protection relating enforcement authorities in your jurisdiction permit to internal investigations. However, in 2020, the draft of the the use of predictive coding techniques? What are Personal Information Protection Law will be submitted to the best practices for reviewing a voluminous document collection in internal investigations? Standing Committee of the National People’s Congress for consideration. Furthermore, there are scattered rules to protect personal information in other laws and regulations, such as the There are no specific rules governing the use of predictive Cybersecurity Law of the PRC and its accompanying guidelines coding techniques by judicial or enforcement authorities. A and regulations. thorough review of a voluminous document collection in an internal investigation can be very time-consuming. If the documents are electronic records, the best practice may be to use key 6.2 Is it a common practice or a legal requirement words to search. However, if the documents are written records, in your jurisdiction to prepare and issue a document preservation notice to individuals who may have the best practice may be to recruit independent external inves- documents related to the issues under investigation? tigators to assist. Who should receive such a notice? What types of documents or data should be preserved? How should 72 Witness Interviews the investigation be described? How should compliance with the preservation notice be recorded? 7.1 What local laws or regulations apply to interviews of employees, former employees, or third parties? What There is no legal requirement in China to prepare and issue authorities, if any, do entities need to consult before a document preservation notice to individuals who may have initiating witness interviews? documents related to the issues under investigation. However, such notice may be necessary as it helps to clearly explain the There are no local laws or regulations that apply to interviews

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Rui Bai Law Firm 47

of employees, former employees, or third parties. However, face retaliation, especially in the cases where their superiors are Articles 305 and 306 of the Criminal Law stipulate the Crimes of involved; they may also have concerns that they will lose their Perjury and of Destroying or Forging Evidence or Obstructing jobs or be shunned by other colleagues. Testifying by Agent ad litem, and thus it is recommended to consult outside counsel before initiating witness interviews 7.6 When interviewing a whistleblower, how can whenever a criminal activity may be the outcome of an internal an entity protect the interests of the company while investigation. upholding the rights of the whistleblower?

7.2 Are employees required to cooperate with their It is recommended to conduct a preliminary investigation of the employer’s internal investigation? When and under information provided by the whistleblower before launching a what circumstances may they decline to participate in a formal investigation and interviewing the whistleblower. When witness interview? interviewing the whistleblower, it is important to only ask questions or obtain information from the whistleblower rather than There are no laws or regulations obliging employees to coop- disclose any further information of the company. erate with their employer’s internal investigation. However, such obligation may be contained in the employment contract 7.7 Can employees in your jurisdiction request to and/or the employee handbook. Thus, if the employee refuses review or revise statements they have made or are the to cooperate, it is impossible to force them to participate in an statements closed? internal witness interview. There are no local laws or regulations that apply to whether 7.3 Is an entity required to provide legal representation the employees can review or revise statements they have made. to witnesses prior to interviews? If so, under The investigator may decide whether to allow the employees to what circumstances must an entity provide legal review or revise the statements. representation for witnesses?

There are no laws or regulations that require the provision of 7.8 Does your jurisdiction require that enforcement authorities or a witness’ legal representative be present legal representation to witnesses prior to interviews. However, during witness interviews for internal investigations? it is recommended to do so as it helps witnesses to better understand their rights and obligations. There are no laws or regulations that require enforcement authorities or a witness’ legal representative to be present during 7.4 What are best practices for conducting witness witness interviews during internal investigations. interviews in your jurisdiction? 82 Investigation Report Firstly, the interviews should be conducted in a separated and confidential way. Secondly, the background and issue of the 8.1 How should the investigation report be structured investigation should be explained to the witness. Thirdly, the and what topics should it address? questions should be structured and preferably be open questions, as this helps them to include more details. Lastly, the process should be recorded, preferably on video, as a written Generally speaking, the investigation report normally contains record may miss some facial expressions and body language. the following parts: the main issues investigated; the investigators who participated; the subjects involved; the process of the investigation; the findings with the supporting materials; 7.5 What cultural factors should interviewers be aware and the outcomes of the investigation with proposed remedial of when conducting interviews in your jurisdiction? measures.

In China, since the protection mechanisms of witness and whistleblowers is imperfect, the witnesses may worry that they may

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 48 China

Wen Qin is a Partner at Rui Bai Law Firm, an independent law firm and a member of the PwC global network of firms. Prior to joining Rui Bai Law Firm, Wen was a Partner at a local law firm in Beijing. He specialises in employment law, tax law, dispute resolution and general corporate. Wen obtained a Master of Laws degree from China University of Political Science and Law. Wen is a native Chinese speaker and is fluent in English. As a legal counsel to foreign investment enterprises, Wen’s services have been praised by clients. As a result, he has been continuously recommended as one of the leading lawyers by the well-known ranking and recognition organisations in the legal profession, such as Chambers and Partners, The Legal 500 and Asialaw Leading Lawyers. In 2015, he was ranked as one of the “Eminent Practitioners” by Chambers and Partners. Chambers and Partners also quotes one of his clients as saying that “[Wen] has a sound understanding of the China and global aspects of a case”.

Rui Bai Law Firm Tel: +86 10 8540 4653 Unit 01, 6/F Fortune Financial Center Email: [email protected] 5 Dongsanhuan Zhong Road, Chaoyang District URL: www.ruibailaw.com Beijing 100020 China

Juliette Zhu is an Attorney at Rui Bai Law firm, an independent law firm and a member of the PwC global network of firms. She graduated from China University of Political Science and Law with a Master of Laws degree and a Master’s degree in European and International Law (LL.M.) from the University of Hamburg. Her practice area focuses on dispute resolution, including international and domestic commercial arbitration and litigation, covering various subjects such as Chinese-foreign joint venture, direct investment, international sale of goods, etc. She is fluent in both Chinese and English.

Rui Bai Law Firm Tel: +86 10 8540 4659 Unit 01, 6/F Fortune Financial Center Email: [email protected] 5 Dongsanhuan Zhong Road, Chaoyang District URL: www.ruibailaw.com Beijing 100020 China

Rui Bai Law Firm is an independent Chinese law firm and a member of the law firm experience with in-depth understanding and knowledge working PwC global network of firms. We have access to the most geographically in-house. We put ourselves in our clients’ shoes and we share a common extensive PwC global legal services network of over 3,500 lawyers in over language with the client. 90 countries and territories, including over 20 offices across 15 countries www.ruibailaw.com and territories in the Asia Pacific. Uniquely among law firms, we provide clients with integrated legal services, working closely with tax, human resources, corporate finance, forensic accounting, valuation and other service teams within the PwC global network. We can deliver integrated solutions through specialists in banking and finance, corporate, M&A, regulatory compliance, intellectual property, aircraft and equipment leasing, litigation, arbitration and dispute resolution, labour and employment, tax and dispute resolution. We are able to deliver solutions to the most challenging business endeavour. Our lawyers combine local market knowledge and international experience into a unique skillset. Our lawyers also join extensive private practice

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 8 49

Denmark Denmark

Jens Teilberg Søndergaard

Poul Schmith Martin Sønnersgaard

12 The Decision to Conduct an Internal way of national law, other than the protection granted by employment law against harassment or unlawful dismissal. In practice, Investigation many private as well as public organisations do, however, maintain a whistleblower service in line with international best prac- 1.1 What statutory or regulatory obligations should tice. Complaints are addressed as is normal practice in other juris- an entity consider when deciding whether to conduct an dictions, typically by following a formalised and published policy internal investigation in your jurisdiction? Are there any and procedure. consequences for failing to comply with these statutory Under s.115 of the Companies Act (selskabsloven), it must be or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? assumed that a company’s management, based on the facts in each case, will have a duty to investigate any credible notification that may be submitted through a whistleblower service, or There is no statutory legislation pertaining specifically to otherwise brought to the attention of the management team. internal investigations in Denmark. Internal investigations As a consequence of Directive (EU) 2019/1937 of the conducted by outside counsel have generally been conducted in European Parliament and of the Council of 23 October 2019 the form of “Attorney Investigations” (advokatundersøgelser), and on the protection of persons who report breaches of Union law the Association of Danish Law Firms has adopted guidelines on (that is to be transposed into national law by 17 December 2021), Attorney Investigations (the “Guidelines”). Prior to the adop- Denmark will have to implement general legislation on whistle- tion of the Guidelines in 2012, there was no guidance pertaining blowing. However, the Danish Government has not yet – by the to internal investigations, but in practice the principles set out end of November 2020 – introduced such a bill. in the Guidelines were applied. Generally, a distinction is made between “regular” investigations, conducted by the company’s regular legal advisor, and independent investigations, carried 1.3 How does outside counsel determine who “the out by a law firm with little or no previous ties to the company client” is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal in question. Investigations have primarily been based solely on Department, the Chief Compliance Officer, the Board of written documentation, and interviews have been the exception. Directors, the Audit Committee, a special committee, This practice is, however, changing, and the use of interviews as etc.)? What steps must outside counsel take to ensure well as eDiscovery is becoming more normal. that the reporting relationship is free of any internal While there are no express obligations to conduct internal conflicts? When is it appropriate to exclude an in-house investigations, such obligation may arise in a given situa- attorney, senior executive, or major shareholder who tion based on the fiduciary duties of the company’s board and might have an interest in influencing the direction of the management. The main legal questions during an investigation investigation? will be in relation to privacy and labour law. There are no formal legal or regulatory benefits for conducting an investigation, but As a prerequisite for conducting an internal investigation, it is internal investigations have been given weight in favour of the not necessary to determine which individuals within the client company in subsequent criminal proceedings. organisation comprise “the client”. The whole organisation, typically the company as a legal entity, will be the client as such. However, it is envisaged that a written mandate should be put 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an in place. A key component of the mandate will be reporting internal investigation is necessary? Are there any legal lines and other governance issues related to the investigations. implications for dealing with whistleblowers? In Denmark, the investigation will typically be mandated by the Board of Directors; however, day-to-day reporting is to a senior executive of the client’s management, e.g. Head of Legal Because of EU legislation, there is a requirement to maintain a or Compliance, CEO or CFO. whistleblower hotline within the financial sector in Denmark. Anyone within the client’s organisation with an interest in Moreover, a number of entities covered by the Anti-Money the outcome of the investigation should be excluded from the Laundering Act (hvidvaskloven) are required to maintain a whistle- management of, as well as daily involvement with, the inves- blower hotline for suspicious activity concerning money-laundering tigation. However, this typically leads to difficult determina- violations. There is, however, no general statutory or regulatory tions, and must ultimately be decided by the client’s manage- requirements for maintaining a whistleblower hotline or similar. ment itself. Any relevant conflicts of interests should, however, Moreover, whistleblowers are not given any express protection by be pointed out in the counsel’s reporting of the investigation.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 50 Denmark

22 Self-Disclosure to Enforcement 32 Cooperation with Law Enforcement Authorities Authorities

2.1 When considering whether to impose civil or 3.1 If an entity is aware that it is the subject or criminal penalties, do law enforcement authorities in target of a government investigation, is it required to your jurisdiction consider an entity’s willingness to liaise with local authorities before starting an internal voluntarily disclose the results of a properly conducted investigation? Should it liaise with local authorities even internal investigation? What factors do they consider? if it is not required to do so?

The law enforcement authorities may consider an organisation’s An entity that is the subject or target of a government investiga- willingness to come forward as well as cooperate in disclosing tion is not required to liaise with local authorities before starting information when deciding on whether to prosecute a matter an internal investigation. However, an entity should be careful or not. However, there is no clear precedent in this respect. not to hamper or destroy any evidence that might become the Moreover, courts do consider self-reporting as well as willing- subject of an ongoing government investigation. Moreover, it ness to disclose information when sentencing in cases relating is advisable that the entity informs the relevant authorities of to financial crime. Other factors that may be considered by law any concurrent internal investigation, as well as coordinates any enforcement, as well as the courts, may be, e.g., how systemic investigative efforts with such authority. the crime was, at what level in the organisation it took place, the length of time of the crime, and to what extent remedial efforts 3.2 If regulatory or law enforcement authorities have subsequently been put in place. are investigating an entity’s conduct, does the entity have the ability to help define or limit the scope of a 2.2 When, during an internal investigation, should a government investigation? If so, how is it best achieved? disclosure be made to enforcement authorities? What are the steps that should be followed for making a Generally, an entity has very little or no influence on the scope disclosure? of a government investigation, and any overt attempt to do so may be viewed negatively by the authorities. The entity may, There is no requirement under Danish law to self-report to however, seek a constructive dialogue with the authority in enforcement authorities unless there is an express statutory duty question, and thus effectively have some impact on the scope of to do so (as is, for example, the case in relation to money laun- the government investigation. dering). The Board of Directors or management of a company may, however, have a duty to take such steps by way of company 3.3 Do law enforcement authorities in your jurisdiction law; namely, to protect the interests of the company. A number tend to coordinate with authorities in other jurisdictions? of factors may be relevant for the company to consider, such as What strategies can entities adopt if they face the nature and gravity of the matter, the risk of detection and investigations in multiple jurisdictions? enforcement, and more generally the entity’s view on its overriding obligation to report serious crimes to the appropriate Danish authorities will work extensively with authorities in other authorities. Should an organisation choose to self-report or jurisdictions if deemed necessary in the individual case. Should disclose information to a law enforcement authority, it should an entity face investigations in multiple jurisdictions, it will be retain legal counsel to assist in such disclosure. advised to cooperate and provide the requested assistance in Denmark, namely information and evidentiary material, to avoid 2.3 How, and in what format, should the findings of an a possible escalation of legal proceedings outside Denmark. internal investigation be reported? Must the findings of an internal investigation be reported in writing? What 42 The Investigation Process risks, if any, arise from providing reports in writing?

4.1 What steps should typically be included in an According to the Guidelines for investigations issued by the investigation plan? Association of Danish Law Firms, the investigation should be concluded by way of a written report, setting out, among other things, the mandate, findings, any conclusions and recommen- An investigation plan will typically include planning, infor- dations as well as any reservations made by the investigators. mation/data gathering, data processing and review, interviews See question 8.1 below. Any written report, whether public and subsequent iterations, final assessments, conclusions and or not, carries the risk of additional investigations being insti- reporting. More substantial investigations will most often be gated by enforcement authorities or others that may come in the assisted by eDiscovery, which will require further planning with possession of the report or gain knowledge of its existence. In respect to the investigation phases. this respect, the entity should also be aware of the legislation concerning public access to documents in public files. See ques- 4.2 When should companies elicit the assistance of tion 5.5 below. outside counsel or outside resources such as forensic consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside counsel?

In Denmark, internal investigations are generally carried out by

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Poul Schmith 51

the organisation itself or by external legal counsel. However, other Consequently, an entity cannot be certain that its in-house experts, such as accountants, may also carry out investigations. lawyer will be able to invoke legal privilege. A company should elicit the assistance of outside counsel in, at least, three situations: (i) when anyone in its top management 5.4 How can entities protect privileged documents or in key corporate functions (such as legal, finance or HR) are during an internal investigation conducted in your involved in the alleged misconduct; (ii) when the matter is of a jurisdiction? nature or magnitude that the company cannot credibly carry out the investigation within its normal legal and compliance frame- See questions 5.1–5.3 above and question 5.5 below. work; or (iii) the investigation report is intended for publication to a wider audience (e.g. to the public). When deciding whether outside counsel should be elicited, the company should also 5.5 Do enforcement agencies in your jurisdictions keep consider whether legal privilege will be of importance during or the results of an internal investigation confidential if after the investigation; see questions 5.1–5.3 below. such results were voluntarily provided by the entity? A legal counsel investigator will typically retain the services of forensic accountants and eDiscovery specialists, unless it has As a general rule, under the Danish Act on Public Access to such resources available in-house (which very few do). The main Documents in Public Files (offentlighedsloven), the results of internal criteria for obtaining outside experts, whether counsel, account- investigations voluntarily provided to enforcement agencies are ants or other experts, should be a proven track record of having subject to access to documents; see s.7(1) of the Act. However, carried out an investigation of the nature and magnitude in such investigations may be exempted from public access pursuant question, particularly with respect to handling the involved data to the Danish Act on Public Access to Documents in Public Files in accordance with necessary security and privacy requirements. if they were submitted to the enforcement agency at the agency’s request and due to a legal obligation to do so; see s.23(2) and 52 Confidentiality and Attorney-Client s.30 of the Act. In certain areas, however, special confidentiality Privileges provisions providing extended protection apply. This is the case, in particular, in the financial sector; see s.354(1) of the Danish 5.1 Does your jurisdiction recognise the attorney- Financial Business Act (lov om finansiel virksomhed ), which provides client, attorney work product, or any other legal extended protection to confidential information gained by the privileges in the context of internal investigations? What enforcement agency through its enforcement activities. best practices should be followed to preserve these If there are no special confidentiality rules, the Danish Act on privileges? Public Access to Documents in Public Files in certain situations provides for the opportunity of exempting certain information The attorney-client relationship enjoys recognition in Denmark, from the investigation. This applies in particular to data on the and generally applies to all material produced during the lawyer’s private – including financial – situation of individuals (see s.30, interaction with the client. In relation to work products, there para. 1 of the Act) as well as data that needs to be exempted for is no distinction between legal advice privilege and litigation essential reasons of prevention, investigation and prosecution privilege. Generally, the duty to provide material will have to of offences or for carrying out public control; see s.33, paras 1 be asserted based on the rules pertaining to witnesses in s.804 and 2 of the Act. Finally, in situations where non-disclosure is and ss169–172 of the Administration of Justice Act (retsplejeloven). necessary due to the special nature of the circumstances, it may Privilege should be preserved, ensuring that the attorney is in be possible to exempt data in order to protect essential private control of the investigative process, including retaining all of the and public interests; see s.33, para. 5 of the Act. records, data and work products. 62 Data Collection and Data Privacy Issues 5.2 Do any privileges or rules of confidentiality apply to interactions between the client and third parties 6.1 What data protection laws or regulations apply to engaged by outside counsel during the investigation internal investigations in your jurisdiction? (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)? In Denmark, no particular general rules on data protection in relation to internal investigations have been laid down. The Danish law does not distinguish between information and general rules on data protection as laid down in the General material from the client him-/herself and material obtained or Data Protection Regulation (“GDPR”) and the Danish Data produced by third parties on his/her behalf (such as witnesses Protection Act (databeskyttelsesloven), which supplements the and experts). The main criterion is that the material is produced GDPR in Denmark, are therefore the primary legal basis. These over the course of the lawyer’s assignment for his/her client. rules are supplemented by the European Convention on Human Rights and the Charter of Fundamental Rights of the European 5.3 Do legal privileges apply equally whether Union which lay down rules on, e.g., protection against self- in-house counsel or outside counsel direct the internal incrimination, as well as privacy and data protection. investigation? In addition, the Danish Penal Code (straffeloven) lays down prohibitive rules on, e.g., secret wiretapping or recording, and While the European Court of Justice has ruled that it does not opening of private correspondence, including emails (secrecy of recognise legal privilege for in-house counsel, the question is mail). not completely decided in terms of national law in Denmark. Finally, the general labour law in Denmark sets out rele- The Danish courts have only ruled that if a Danish attorney vant rules, including employment law principles on, e.g., general (advokat) has deposited his/her lawyer’s licence while working as control measures in relation to employees, including prior notice, an in-house legal advisor, he/she cannot invoke legal privilege. as well as the duty of employees to participate in clarifying

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 52 Denmark

matters within the limits imposed by the prohibitive rules on self- 6.5 What resources are typically used to collect incrimination, etc. documents during an internal investigation, and which resources are considered the most efficient? 6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document While the use of eDiscovery and forensic accounting is still in preservation notice to individuals who may have its infancy in Denmark, larger law firms will collect and analyse documents related to the issues under investigation? documents electronically. Unless the firm has such resources Who should receive such a notice? What types of in-house (typically, expertise regarding IT, eDiscovery and documents or data should be preserved? How should the forensic accounting), the services of a forensic specialist firm investigation be described? How should compliance with the preservation notice be recorded? will often be retained. Internationally recognised eDiscovery tools are considered the most efficient and are also regularly used by the national enforcement authorities. It is normally accepted good practice to inform all employees in writing about an internal investigation unless this would defeat the purpose of the investigation. 6.6 When reviewing documents, do judicial or The individuals whose personal data are being processed in enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are the investigation must be notified of this in accordance with the best practices for reviewing a voluminous document provisions of Articles 13–14 of the GDPR. In other words, these collection in internal investigations? persons must in general be notified individually about the investigation at the time when the data is collected. The content of the notification must be in accordance with the provisions of Articles There is no legislation or established practice on the private use 13–14 of the GDPR. According to the Danish Data Protection of predictive coding techniques in Denmark. Typically, volumi- Act, however, the obligation to notify does not apply if the purpose nous document collections will be reviewed by the use of recog- of the investigation would thereby be defeated. If so, the notifi- nised eDiscovery tools provided by the law firm itself or a third- cation may be postponed until the investigations are completed. party vendor. It will often be acceptable to not notify so-called secondary parties (bipersoner), i.e. persons who are not the subject of the 72 Witness Interviews processing of the personal data but who only appear ancillary to the information on the data subject. This applies in particular 7.1 What local laws or regulations apply to interviews if the entity has submitted a general notification to the persons of employees, former employees, or third parties? What concerned. authorities, if any, do entities need to consult before Incidentally, it follows from Danish legal practice on data initiating witness interviews? protection and labour law that employees, as a predominant general rule, must receive prior, clear and unambiguous written It is, as a general rule, within the employer’s statutory rights to notice (warning) on general, preventive control measures. request that current employees make themselves available for The written notices must be kept on file by the entity in order interviews by the entity itself or its external advisor carrying out to document compliance with the legal obligations and the prin- the investigation. See also question 7.2 below on this topic. The ciple of accountability within the GDPR. investigator must, however, respect the interviewee’s right to be protected from self-incrimination, as set out in the European 6.3 What factors must an entity consider when Convention on Human Rights. documents are located in multiple jurisdictions The prohibition against self-incrimination basically means (e.g. bank secrecy laws, data privacy, procedural that a person suspected of or charged with a criminal offence, or requirements, etc.)? possibly a more severe employment law matter, cannot be forced to contribute to the clarification of the alleged crime, and the person When documents are in multiple jurisdictions, the entity should concerned will have the right to remain silent on the matter. The retain local legal counsel before considering transferring the person in question must be informed of the protection against information to or from Denmark. This also applies when the self-incrimination and of his/her right to remain silent. Any form information is requested by the Danish authorities. This is of involvement and/or interviews of employees must therefore not due to differences in local law, particularly with respect to the go beyond what is justifiable in terms of this basic principle. transfer of data out of the originating jurisdiction. Furthermore, Generally, it is not acceptable to bring about a “confession” the entity must observe the general rules on international trans- with any form of aggressive approach, and the courts have taken fers within the GDPR if personal data is transferred to third a relatively strict approach in this respect. For non-employees, countries or international organisations. there is no duty to cooperate with a private investigation. There is no statutory or other obligation to consult with any authorities before initiating witness interviews. 6.4 What types of documents are generally deemed The Guidelines also set out guidance relevant to interviews important to collect for an internal investigation by your of employees and other witnesses. For instance, the Guidelines jurisdiction’s enforcement agencies? prescribe that an interviewee must be informed of the general framework of the interview in advance, and when necessary the Generally, the enforcement authorities will seek to collect as interviewee should also receive relevant documents, etc. before much data (documents and records) as possible under pertaining the interview is conducted. Also, the Guidelines prescribe a right procedural legislation. The rights of enforcement authorities for the interviewee to bring an advisor and highlight the right to are, broadly speaking, very wide in this respect. The collection be protected from self-incrimination. These Guidelines apply in will include traditional documents, as well as electronic files of the private as well as the public sector. accounts, email servers, databases, etc. Additional legislation concerning the right to be protected from self-incrimination applies in cases where there is a legal

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Poul Schmith 53

obligation to provide information to the public administration. use a respectful style, encouraging the witness to collaborate as These rules are set out in the Danish Act on Legal Guarantees in much as possible without the extensive use of direct questioning. the Administration’s Use of Forced Intervention and Disclosure Before the interview starts, the interviewee should be informed Obligations (tvangsindgrebsloven). of the purpose of the interview and why he/she is there. Also, Even though the right to be protected from self-incrimination the right not to self-incriminate should be explained to the inter- is considered to apply as a general principle in Denmark, it can viewee. See also question 7.3 above on best practice concerning be argued that the protection is wider in cases where the Danish offering interviewees the chance to bring an advisor. Act on Legal Guarantees in the Administration’s Use of Forced Intervention and Disclosure Obligations applies. In these cases, 7.5 What cultural factors should interviewers be aware the right applies when there is “concrete suspicion”, where in of when conducting interviews in your jurisdiction? comparison, the general principle stemming from the European Convention on Human Rights is generally said to apply only when there is a basis for charging the suspect. The Danish working environment is generally respectful and cooperative, and any overtly aggressive interviewing may be met with withdrawal and condemnation. It is also seen as a very 7.2 Are employees required to cooperate with their serious matter to allege misconduct, particularly with respect to employer’s internal investigation? When and under financial crime. This may dictate a different interview style than what circumstances may they decline to participate in a in other jurisdictions. witness interview?

Beyond the administration of justice, employees are under no 7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while general statutory duty to give evidence in internal investiga- upholding the rights of the whistleblower? tions. However, according to Danish employment law principles, employees are subject to a general duty to act loyally and truthfully in all matters relating to their employment. Hence, employees When interviewing a whistleblower, the same considerations as are under a certain duty to inform their employers of criminal set out above will apply. However, any requirement with respect offences and to contribute to internal investigations. Similarly, to maintaining the anonymity of the whistleblower may dictate as a general rule, public sector employees are obliged to provide that interaction with the whistleblower is handled by an outside relevant information about matters related to their service to their advisor. superiors, among others, and the information provided must not be incorrect or misleading. State-employed public servants 7.7 Can employees in your jurisdiction request to are, under the Public Servants Act (tjenestemandsloven), obliged to review or revise statements they have made or are the appear in official inquiries and to make a statement. statements closed? When initiating an internal investigation, it is important to pay particular attention to the prohibition against self-incrimination Pursuant to the rules of the GDPR in this respect, employees are which applies in Danish law as a general legal doctrine. See ques- normally entitled to access and rectify statements, etc. given by tion 7.1 above. It should be noted that specific rules of discipli- them to their employers. nary proceedings are laid down in the Public Servants Act with In addition, public authority employees are normally entitled regard to State-employed public servants. to be consulted and to make a statement pursuant to the Danish State-employed public servants are, in practice, rarely inter- Public Administration Act. viewed and only in exceptional circumstances; instead, the Moreover, particular rules are laid down in the Public Servants matter is clarified on a written basis. Act concerning disciplinary proceedings against State-employed public servants. According to the rules, for example, public 7.3 Is an entity required to provide legal representation servants are given the opportunity to provide written submis- to witnesses prior to interviews? If so, under sions, including after the end of the interviews. what circumstances must an entity provide legal Finally, it is general practice that the employee concerned representation for witnesses? is given the opportunity when the interview is over to review the minutes of the meeting in order to correct any misunder- No. However, according to the Danish Public Administration standings. As soon as possible after the interview, and once the Act ( forvaltningsloven), employees of public authorities are, as a employee has had the opportunity to read the minutes and to predominant rule, entitled to be accompanied by an advisor if provide any comments, the employee will normally be asked to the employee is a party to the case. The public authority must accept and sign the minutes so as to confirm his/her acknowl- inform the employee of his/her rights before the meeting is edgment of the minutes. conducted. Additionally, while it is not a legal requirement, it is best prac- 7.8 Does your jurisdiction require that enforcement tice to offer an interviewee the opportunity to bring an advisor authorities or a witness’ legal representative be present to the meeting, typically legal counsel, a union representative during witness interviews for internal investigations? or a trusted colleague. This goes for the public as well as the private sector and is stated in the Guidelines. It is customary for No. It is, however, recommended in the Guidelines that the inquiring entity to cover any costs for such representation. anyone being interviewed should be able to bring an advisor; for example, his/her own attorney. See also question 7.3 above. 7.4 What are best practices for conducting witness Typically, the enquiring entity will offer to cover the direct cost interviews in your jurisdiction? of such representation.

It is best practice for those conducting witness interviews to

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 54 Denmark

82 Investigation Report ■ A description of the material the investigation is based on, as well as any confirmation (or lack thereof) from the client as to the materials’ completeness. 8.1 How should the investigation report be structured ■ A description of the investigation team, including any and what topics should it address? third-party consultants of service providers. ■ Any qualifications to the report. The Guidelines recommend that the report should contain the ■ A factual summary of the investigation’s findings, as well following elements: as any conclusions and recommendations. ■ A description of the background for the investigation, ■ A recommendation as to the publication of the report. including the mandate and any time restrictions, as well as the law firm’s previous relationship with the client.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Poul Schmith 55

Jens Teilberg Søndergaard advises on compliance and investigations, including on whistleblower arrangements. Jens is experienced in managing large internal investigations of complex issues. Jens assists both private businesses and public authorities.

Poul Schmith Tel: +45 4090 9244 Vester Farimagsgade 23 Email: [email protected] 1606 Copenhagen URL: www.poulschmith.com Denmark

Martin Sønnersgaard, as a partner and attorney, advises public authorities and private businesses on data protection and digitisation. Martin focuses especially on assisting clients with compliance programmes, privacy programme management, data protection impact assessments (“DPIAs”), privacy by design in the development of new digital solutions, use of artificial intelligence in the realm of automated decision making (“ADM”), use of big data analytics, and drafting of codes of conduct, etc.

Poul Schmith Tel: +45 5077 8423 Vester Farimagsgade 23 Email: [email protected] 1606 Copenhagen URL: www.poulschmith.com Denmark

With a staff of more than 650 employees, Poul Schmith has grown to be one of Denmark’s largest full-service law firms. The firm attracts and only employs the most talented lawyers, which makes it a clear market leader. This growth has been organic without any mergers. In addition to advising private Danish and international clients, the firm has been the preferred legal adviser to the Danish State since 1936, which gives the firm a deep understanding of the political environment that its clients operate in. In recent years, the firm has made a strategic move and increased its market share for corporate clients, including banks, pension funds, insurance companies and private equity funds. Today the firm is recognised as the leader of the digital transformation of the Danish legal industry, the goal of which is to support and improve legal processes by developing and using legal tech. www.poulschmith.com

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 56 Chapter 9 England & Wales & Wales England England & Wales

Alun Milford Caroline Day

Philip Kingsley Napley LLP Áine Kervick Salvesen

12 The Decision to Conduct an Internal 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an Investigation internal investigation is necessary? Are there any legal implications for dealing with whistleblowers? 1.1 What statutory or regulatory obligations should an entity consider when deciding whether to conduct an Proper consideration should be given to the information internal investigation in your jurisdiction? Are there any consequences for failing to comply with these statutory provided by any whistleblower. In doing so, entities should or regulatory regulations? Are there any regulatory or remember that the Public Interest Disclosure Act 1998 protects legal benefits for conducting an investigation? whistleblowers from detrimental treatment or victimisation from their employer if, in the public interest, they expose wrongdoing. In particular, the Act provides that any dismissal of an There are no specific statutory or regulatory obligations to employee for making a protected disclosure will automatically conduct an internal investigation in England and Wales. be unfair and that any detriment suffered by an employee for However, where an entity receives information or becomes making such a disclosure will also be unlawful. aware of potential criminal or regulatory matters, it will often Whistleblowers are increasingly recognised as playing a signif- be in the company’s interest to conduct an internal investiga- icant role in ensuring good corporate governance. As such, one tion to ascertain the position and, where appropriate, approach of the requirements of the Senior Managers and Certification the relevant investigating authorities proactively. The regula- Regime on firms operating in the financial services industry is to tory framework, which can require reporting, and prosecution appoint a “whistleblowers’ champion”. Similarly, the Ministry policy encourage this approach. of Justice’s Guidance on the Bribery Act 2010 identifies whis- So far as regulators are concerned, the Financial Conduct tleblowing procedures as one of the topics that, if included in Authority (FCA) requires firms it regulates to report any matters corporate anti-bribery procedures, might render them adequate of which it would reasonably expect notice. The Information and so provide a defence against the corporate offence of failing Commissioner’s Office (ICO) requires, where feasible, General to prevent bribery. HM Revenue and Customs makes similar Data Protection Regulation (GDPR) breaches involving acci- provision in its guidance on the corporate offence of failure to dental or unlawful destruction, loss, alteration, unauthorised prevent the facilitation of tax evasion. disclosure of or access to personal data reports no later than 72 hours after the data controller has become aware of the breach. Where an entity uncovers its own possible breaches of crim- 1.3 How does outside counsel determine who “the inal law, a self-report to the Serious Fraud Office (SFO) followed client” is for the purposes of conducting an internal by active cooperation with it can assist the entity in securing a investigation and reporting findings (e.g. the Legal diversion from prosecution, typically in the form of a deferred Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, prosecution agreement. Equally, in a cartel case, an early report etc.)? What steps must outside counsel take to ensure to the Competition and Markets Authority (CMA) can help win that the reporting relationship is free of any internal immunity or leniency in any subsequent CMA investigation. conflicts? When is it appropriate to exclude an in-house Against that background, an early, professionally conducted attorney, senior executive, or major shareholder who internal investigation can greatly assist a company in deciding might have an interest in influencing the direction of the whether to engage the authorities and, if so, how best to provide investigation? them with the cooperation they will then require. For completeness, money-laundering and terrorist-financing External counsel will often first be approached by in-house counsel laws can require the disclosure of knowledge or suspicion, or senior executives within an entity for advice on conducting or of reasonable grounds for knowledge or suspicion, of an internal investigation. Identification of the ensuing client money-laundering or terrorist-financing activity. Such disclo- group will depend on the facts of each case and will differ greatly sures, known as suspicious activity reports, do not generally lead depending on the structure of the corporate entity. to full-blown internal investigations. The client group ought to include senior individuals within the entity who have the authority to make decisions on behalf

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kingsley Napley LLP 57

of it and who are not personally involved or at risk in connec- knowing or suspecting, that a person is engaged in, or attempting tion with the matters under investigation. As such, scoping to engage in, money laundering or terrorist financing. interviews with key individuals with no direct involvement in Where the entity has a choice whether or not to disclose, it the subject matter of the investigation may be necessary. Once should do so within the timescale and in the manner required the client group has been identified, external counsel must by the agency it proposes to disclose to. For example, the SFO set out the scope of an investigation clearly to all within it to encourages reporting within a reasonable time of the offending ensure both clarity of purpose and that any potential remaining coming to light and requires that initial disclosure be made by conflicts are identified and addressed at the earliest opportunity. way of a secure reporting form submitted to its intelligence unit. Where conflict does arise, the conflicted individual should be The CMA seeks to incentivise early reporting through immu- removed from the client group. nity or leniency applications. Its guidance does not require engagement prior to an internal investigation being carried out. 22 Self-Disclosure to Enforcement However, it does require the entity to ensure that CMA guid- Authorities ance on internal investigations is followed from the time that the possibility of a leniency application is contemplated.

2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in 2.3 How, and in what format, should the findings of an your jurisdiction consider an entity’s willingness to internal investigation be reported? Must the findings of voluntarily disclose the results of a properly conducted an internal investigation be reported in writing? What internal investigation? What factors do they consider? risks, if any, arise from providing reports in writing?

The Code for Crown Prosecutors governs every decision of There is no prescribed format for an internal investigation whether or not to prosecute in England and Wales. No prosecu- report. Agencies to which they are submitted will generally tion can take place unless there is sufficient evidence for a real- prefer them to be in writing, and supported by underlying mate- istic prospect of conviction and it is in the public interest to pros- rials. This means of reporting raises issues of legal professional ecute. In assessing the public interest, prosecutors should have privilege and the risk of waiver, which will need to be addressed regard to guidance issued in relevant policies or guidance issued at a very early stage in the investigation. One option is for the by the Director of Public Prosecutions (DPP). One example of report to be based or to rely heavily on pre-existing materials to such guidance is the Deferred Prosecution Agreements Code which privilege does not extend and to make no or limited refer- of Practice. The factors pointing to a prosecution include ence to witness accounts, to which privilege may well apply. (amongst other things): failing to notify the wrongdoing within The CMA allows leniency applications to be made orally. a reasonable time of it coming to light; and reporting the wrong- However, it requires the provision to it of all pre-existing written doing but failing to verify it or reporting it knowing or believing evidence of the cartel. It will usually agree that any privilege it to be inaccurate, misleading or incomplete. Factors pointing claim over such materials should be reviewed by independent away from a prosecution include (amongst other things): coop- counsel, whose conclusions will be determinative. eration, in respect of which considerable weight may be given to a genuinely proactive approach adopted by the management 32 Cooperation with Law Enforcement team of the corporate under suspicion of wrongdoing when the Authorities offending is brought to its notice; and (amongst other things) within a reasonable time of the offending coming to light, 3.1 If an entity is aware that it is the subject or reporting the company’s offending otherwise unknown to the target of a government investigation, is it required to prosecutor, together with the provision to the prosecutor of any liaise with local authorities before starting an internal internal investigation, including source documents. The SFO’s investigation? Should it liaise with local authorities even internal guidance on corporate cooperation, which it published if it is not required to do so? last year, identifies as cooperative the provision of relevant material gathered during an internal investigation. On becoming aware that it is the subject or target of a govern- It follows that self-reporting following a well-conducted ment investigation, an entity should first seek independent internal investigation can help steer a company towards a legal advice. If it has a reporting obligation, it should of course non-prosecution outcome. comply with it. But if it does not, it will need to consider carefully all of its options, including whether or not to engage with 2.2 When, during an internal investigation, should a the authorities at this stage. disclosure be made to enforcement authorities? What are the steps that should be followed for making a disclosure? 3.2 If regulatory or law enforcement authorities are investigating an entity’s conduct, does the entity have the ability to help define or limit the scope of a As already noted, immediate reports are required in some circum- government investigation? If so, how is it best achieved? stances: FCA-regulated firms must report any matters of which the FCA would reasonably expect notice; the ICO requires, where The scope of a government investigation is entirely a matter for feasible, certain GDPR breaches no later than 72 hours after the the agency concerned, provided always that it remains within data controller has become aware of the breach; people and firms its statutory remit. Attempts to define or limit the investiga- working in the regulated financial industry must make a disclo- tion’s scope would be met with suspicion and would therefore be sure, known as a suspicious activity report, to the National Crime counter-productive. A cooperative company will be able to get Agency in respect of information gathered in the course of busi- a sense of the agency’s concerns from the assistance it is asked ness if they know or suspect, or have reasonable grounds for to provide.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 58 England & Wales

3.3 Do law enforcement authorities in your jurisdiction of number and technical expertise and experience, to conduct tend to coordinate with authorities in other jurisdictions? an internal investigation without external assistance. While What strategies can entities adopt if they face appointing external counsel and other resources comes at a investigations in multiple jurisdictions? cost, their appointment will significantly reduce the burden on internal staff, including management time. Globalisation and the interconnected nature of the world Appointing external counsel also reinforces and ensures the economy mean that the vast majority of large economic crime independence and integrity of an investigation, particularly investigations have an international element. The United where members of senior management are implicated in the Kingdom authorities have shown themselves adept at working alleged wrongdoing. This is not only beneficial to the corpo- with overseas authorities in conducting such investigations and rate client in seeking to uncover the truth of the allegations, securing evidence. A good recent example is the SFO’s cooper- but will also be positively perceived by investigating authori- ation with the French and US authorities in securing a deferred ties and regulators. In many cases, appointing external counsel prosecution agreement with Airbus at the same time as those will reassure those authorities that the company can be left to authorities entered into their own settlements with the company. conduct the investigation and report its findings to the authori- If an entity faces a multijurisdictional investigation, it will ties, without the authorities having to take action in the interim. need to ensure it has a good understanding of the powers of each Privilege is another key consideration. Appointing external of the agencies investigating it, the extent of the jurisdiction they counsel can emphasise the legal context in which the work is are trying to exert and the rules of privilege applicable to each undertaken and so bolster the company’s assertion of legal priv- such investigation. It should also take advice on the extent to ilege over the product of the investigation. As such the inves- which each jurisdiction recognises double jeopardy. tigation can be undertaken, and its findings can be considered, Whilst the various authorities are liaising with each other, in confidence before making any decisions on self-reporting or there is a risk that they will make conflicting demands of the responding to any future enforcement action. entity. For example, US prosecutors favour asking internal If external counsel is to be appointed, the company will need to ensure that it has the necessary expertise, experience and investigators to conduct witness interviews, whereas the English resources. In many cases, it would be prudent for a company to and Welsh authorities tend to oppose such plans. In such cases, appoint external counsel with access to lawyers who are experts a cooperative entity should ensure that it keeps open clear lines in fields ancillary to the investigation itself, such as employment of communication with each investigating authority to try, if law (to advise on the suspension of the alleged wrongdoers and possible, to agree a way forward of which all the authorities any subsequent disciplinary action) and regulatory issues (to involved approve. advise on the company’s reporting obligations; for example, if this is regulated in the financial services industry). 42 The Investigation Process Whether or not other non-lawyer experts are required will depend on the particular circumstances of the case. In 4.1 What steps should typically be included in an document-heavy investigations, it is often advisable to instruct investigation plan? a firm of forensic evidence consultants to collect, process and preserve potential evidence in a forensically sound way; for An investigation plan should be tailored to the specific facts and example, by securing email servers, hard-copy material and elec- circumstances of the investigation. However, there are common tronic devices such as laptops and mobile phones. In certain features of investigation plans which should, at the very least, cases, other non-lawyer experts, such as forensic accountants, be considered for inclusion. In particular, an investigation translators, financial markets experts and private investigators, plan should clearly identify and define the subject matter and may be required. In each case, if non-lawyer experts are used, proposed scope of the investigation. The plan should define then clear rules need to be agreed to ensure legal professional the roles and responsibilities of the investigation team, as well privilege attaches as far as possible to the communications. as identify the client group for the purposes of the investigation and the preservation of privilege. It should record the 52 Confidentiality and Attorney-Client work streams anticipated by the investigator – for example, data Privileges collection, evidence review and witness interviews – together with a timetable for their completion. If adversarial litigation is 5.1 Does your jurisdiction recognise the attorney- contemplated, this should be recorded in the investigation plan, client, attorney work product, or any other legal together with the reasons why, in order to support any subse- privileges in the context of internal investigations? What quent assertion of litigation privilege over the product of the best practices should be followed to preserve these investigation. As with all projects, the investigation team should privileges? keep the investigation plan under review as the investigation progresses, amending and enhancing it as necessary. Legal professional privilege is a substantive right in England and Wales of which there are two forms: legal advice privilege, which 4.2 When should companies elicit the assistance of protects confidential communications between a client and their outside counsel or outside resources such as forensic lawyer made for the dominant purpose of obtaining legal advice; consultants? If outside counsel is used, what criteria and litigation privilege, which protects confidential communi- or credentials should one seek in retaining outside cations between a client or their lawyer and a third party, where counsel? that communication is for the dominant purpose of conducting existing, pending or reasonably contemplated adversarial litiga- There are practical and strategic reasons for appointing external tion. Importantly from an entity’s point of view when instructing counsel, or other external resources, to conduct an internal a lawyer, the lawyer’s client is the group of directors or employees investigation. From a practical perspective, corporate clients tasked by the entity with seeking and receiving legal advice on will often not have sufficient internal resources, both in terms its behalf. English and Welsh law recognises limited waivers of privilege and the concept of common interest privilege.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kingsley Napley LLP 59

At the outset of an internal investigation, the investigator to the investigation should be prepared, gathered and retained must define the client and establish clear lines of communica- from the point of instruction. Instruct employees not to create tions with it. As and when the investigator decides to speak to any additional materials relating to the investigation’s subject third parties, including witnesses, the investigator should record matter unless advised to do so by external legal advisers. Clearly the purpose for which those communications are made if it is mark relevant documents and email correspondence as “privi- intended to assert litigation privilege over these communica- leged and confidential”. tions. In this connection, documents made for the purpose of When engaging with third parties, consider whether a settling or avoiding litigation are as much covered by the priv- common interest privilege agreement is required to protect any ilege as those made for the purpose of resisting or defending privileged information the third party may wish to share with such contemplated proceedings. the company. The internal investigation report should record the scope of the investigation and the basis on which privilege is asserted 5.2 Do any privileges or rules of confidentiality apply to interactions between the client and third parties over it. engaged by outside counsel during the investigation Finally, remember that even if the entity has the benefit of (e.g. an accounting firm engaged to perform transaction privilege, it may have to consider waiving it in order to secure testing or a document collection vendor)? favourable treatment from the authorities in the form of a deferred prosecution agreement or a leniency arrangement. Communications between a client or its lawyer and any third party are only privileged if they are made for the sole or domi- 5.5 Do enforcement agencies in your jurisdictions keep nant purpose of preparing for actual or contemplated adversarial the results of an internal investigation confidential if litigation. It may therefore be useful to separate the internal such results were voluntarily provided by the entity? investigation report from any fact-finding reports prepared by external third parties such as an accounting firm. Whilst the authorities may well agree in principle to hold internal investigation reports in confidence, that agreement cannot over- 5.3 Do legal privileges apply equally whether ride the authorities’ disclosure obligations. Typically, these arise in-house counsel or outside counsel direct the internal in the prosecution of individuals implicated in the events subject investigation? to the internal investigation.

There is no distinction in domestic privilege law between the 62 Data Collection and Data Privacy Issues status of in-house lawyers and external counsel, both of whose legal work is capable of attracting privilege. As a practical 6.1 What data protection laws or regulations apply to matter, in-house lawyers should clearly mark as “privileged internal investigations in your jurisdiction? and confidential” any documents prepared for the purpose of seeking or giving legal advice in order to protect against any Internal investigations will invariably involve the processing challenge to this at a later stage. of personal data, particularly that of employees and other third The situation is different where European Union law is parties. In the UK, the processing of personal data is governed engaged. This holds that only external counsel have the inde- by the GDPR and the Data Protection Act 2018. pendence necessary to attract privilege. It follows that privilege In the context of an internal investigation, the key obliga- does not apply to communications to and from in-house lawyers tions to consider are: transparency, meaning the requirement in respect of European Commission antitrust and competition that individuals are informed about how their personal data is investigations, regardless of whether the domestic agency, the being used (unless there is a relevant exemption); data minimi- CMA, is assisting them. sation, meaning that the use of personal data is proportionate; ensuring that there is a legal basis for the processing of personal 5.4 How can entities protect privileged documents data (often, investigators will rely on “consent” and/or “legiti- during an internal investigation conducted in your mate interest” as the legal bases for processing personal data in jurisdiction? the course of an investigation); if the issue arises, establishing a relevant condition on which to process any “special catego- Do not assume that privilege will necessarily apply and remember ries” of personal data; and if personal data will be transferred, or that challenges to assertions of privilege are common. Indeed, accessed from, outside the European Union, ensuring that there the SFO’s Corporate Co-operation Guidance states that where a is a legal basis for that data transfer under the GDPR. company asserts privilege, it will be required to provide certification by independent counsel that privilege applies. Thus, entities 6.2 Is it a common practice or a legal requirement should ensure that their approach to privilege is carefully recorded. in your jurisdiction to prepare and issue a document First, ensure that the framework within which legal work is preservation notice to individuals who may have undertaken is clear. As such, retainer documents with external documents related to the issues under investigation? lawyers should clearly record the scope of work and any contem- Who should receive such a notice? What types of plated adversarial litigation arising from the subject matter of documents or data should be preserved? How should the investigation be described? How should compliance the internal investigation. The client should also be clearly with the preservation notice be recorded? defined, including the client group. This is particularly important if there is any doubt as to whether litigation privilege is available, meaning legal advice privilege would be the only form An important initial step is to identify where potentially rele- of privilege available. vant evidence might be held and by whom. It is considered best Next, establish consistent practices and procedures. Request practice to issue a document preservation notice (usually known advice from external legal advisers as to how material related as a “hold notice”) to those relevant individuals and entities

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 60 England & Wales

(including third parties) as soon as possible after the commence- 6.5 What resources are typically used to collect ment of an internal investigation. documents during an internal investigation, and which Before doing so, however, an investigator must consider resources are considered the most efficient? whether the issuing of a hold notice would in fact have the oppo- site effect to the one intended. In other words, is there a risk that Entities are generally best advised to instruct an external expert in issuing a hold notice might tip off data custodians, who might forensic IT and data collection, who can conduct the exercise in then destroy relevant evidence and/or take other steps which a forensically sound manner to the satisfaction of the authorities. might frustrate the investigation? If there is a real risk of that Despite the upfront costs, a properly curated and searchable body happening, the company will need to exercise care and record of data can produce efficiencies as the investigation progresses. the reasons for its decision in order to be able to meet any subsequent criticism from the authorities. It might decide to delay the circulation of hold notices to certain third parties until after 6.6 When reviewing documents, do judicial or other relevant evidence has already been secured. enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are A hold notice should specify the types of material to be best practices for reviewing a voluminous document preserved and include hard-copy materials and all electronic data. collection in internal investigations? If applicable, the notice should specify that it applies equally to any relevant material located outside the place of work such as at home or within personal email accounts, text messages and social Where data is held on an electronic review platform, the use of media accounts. predictive coding software permits the platform to learn what Investigators should keep a schedule of hold notices, including reviewers are looking for and move the most relevant docu- when the date notices were sent. Each recipient should be asked ments to the top of the review list. The software can identify to confirm their acceptance of the contents of the notice. trends and patterns in documents, potentially drawing to the investigators’ attention documents which they would otherwise not identify. This can significantly improve the efficiency and 6.3 What factors must an entity consider when effectiveness of the review. Such software is routinely used in documents are located in multiple jurisdictions complex, document-heavy investigations. It has been approved (e.g. bank secrecy laws, data privacy, procedural by this jurisdiction’s civil courts and adopted by its investigating requirements, etc.)? agencies, such as the SFO.

Data protection and bank secrecy laws in other jurisdictions 72 Witness Interviews remain an important area for consideration, particularly where relevant data is to be collected from, processed and/or transferred across multiple jurisdictions. Expert local counsel should 7.1 What local laws or regulations apply to interviews of employees, former employees, or third parties? What be consulted in each relevant jurisdiction to ensure that local authorities, if any, do entities need to consult before legal requirements are complied with. initiating witness interviews? If the personal data is to be transferred, or accessed from, outside the European Economic Area (EEA), that transfer will require a lawful basis under the GDPR. This restriction does not Current employees are likely to have an express or implied duty apply to non-EEA countries deemed “adequate” by the European to cooperate with the investigation under their employment Commission. Investigations involving data transfers outside the contract, by virtue of their duty to comply with reasonable and EEA involving jurisdictions not recognised as “adequate” by lawful instructions from their employer. Failing to attend an the European Commission will require other grounds or safe- interview will ordinarily lead to disciplinary consequences. guards to enable the transfer, as set out in the GDPR. At the This duty to cooperate may be reinforced in the regulated time of writing, there has been no decision on whether the United sector where the employees may themselves have regulatory Kingdom will be recognised as “adequate” when the transition duties, for example as senior managers or certified employees, arrangements expire on 31 December 2020. requiring them to act with integrity and to be fit and proper. Such duties could require the provision of assistance to investigators, attending interviews upon reasonable request and gener- 6.4 What types of documents are generally deemed ally being open and cooperative with their employer. important to collect for an internal investigation by your Whilst former employees no longer face the risk of discipli- jurisdiction’s enforcement agencies? nary proceedings, they may have a contractual obligation to assist; for example, following a settlement agreement on leaving An internal investigation will often require the collection and their employment. The position of other third parties will simi- preservation of a significant volume of electronic data. In addi- larly be governed by their contractual relationship with the tion to network drives, shares servers, laptops, hard drives, entity. They may, additionally, find it commercially sensible to mobile phones and tablets, consideration may need to be given assist the entity. to personal mobile phone and landline telephone records, Where fraud and other forms of misconduct are suspected, recorded telephone lines, social media, instant messaging apps, investigators should note the potential for connected regula- building security logs and CCTV footage. A forensic digital tory and/or criminal investigations by third parties such as the image of all relevant electronic data sources and devices should police, the SFO and the FCA. In each case, investigators will be taken, and an entity should consider engaging independent need to consider whether any such bodies might have an interest experts to undertake this task. in the matters being investigated before proceeding with inter- Where investigators take possession of hard-copy materials, views with potential suspects or witnesses. they should ensure that the chain of custody is documented, Investigating and prosecuting authorities are increasingly with a record kept of where the item was found, by whom and sensitive to the risks of witness contamination and tipping off. at what time. For example, the SFO and the FCA have both made clear in

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kingsley Napley LLP 61

published guidance that they place significant emphasis on example, so that the witness’ immediate, unplanned reaction to the first accounts of witnesses. In its Corporate Co-operation seeing the document can be assessed. Guidance, the SFO makes clear that it expects companies to Though there is no legal requirement to do so in the UK, it is consult in a timely way with the SFO before interviewing poten- good practice to give a variation of the “Upjohn warning”. This tial witnesses or suspects, to avoid prejudice to an investiga- warning states that the lawyers represent the company and not tion. The guidance also asks companies to refrain from tainting the employee/witness, that privilege in the interview belongs to potential witnesses’ recollections; for example, by sharing or the company and not the employee, and that the company might inviting comment on another person’s account or showing the choose to waive its privilege and disclose matters discussed in witness documents that they had not previously seen. Similarly, interview to the authorities. in Chapter 3 of the FCA’s Enforcement Guide, the FCA states The witness should be reminded of the confidential nature that in certain circumstances it would prefer that a firm does of the interview. When an entity has decided to waive privilege not commission its own investigation, because such action could prior to the interview and provide details to the authorities, the be damaging to an FCA investigation. It notes that this is true Upjohn warning will need to be strengthened. in particular of criminal investigations, where alerting poten- It is also essential to keep a record of the interview. This tial suspects could have adverse consequences. Accordingly, the takes different forms, with the interview sometimes being audio FCA recommends that firms consult with it first, if there is a recorded and transcribed, or otherwise attended by a note-taker possibility that such investigations could prejudice or hinder a taking either a verbatim or summary note of the key issues subsequent or live FCA investigation. discussed. The issue of legal professional privilege will usually be a key factor in deciding how to record an interview. 7.2 Are employees required to cooperate with their employer’s internal investigation? When and under 7.5 What cultural factors should interviewers be aware what circumstances may they decline to participate in a of when conducting interviews in your jurisdiction? witness interview? The provision of information and/or the extraction of infor- Current employees are likely to have an express or implied duty mation from a witness will differ not only culturally but legally to cooperate with the investigation under their employment between jurisdictions. Care should be taken not to compromise contract, by virtue of their duty to comply with reasonable and proceedings elsewhere, especially when interviewing suspect lawful instructions from their employer. Failure to attend an individuals. interview will ordinarily lead to disciplinary consequences.

7.6 When interviewing a whistleblower, how can 7.3 Is an entity required to provide legal representation an entity protect the interests of the company while to witnesses prior to interviews? If so, under upholding the rights of the whistleblower? what circumstances must an entity provide legal representation for witnesses? An entity must be careful to ensure that whistleblowers’ rights are protected and also that whistleblowers feel comfortable There is no legal requirement unless there is a contractual obli- disclosing their concerns fully to the investigators. Of primary gation as a result of the terms of their employment, which is very importance, whistleblowers should not be disadvantaged in any rare. In respect of senior management, it may be that the entity’s way by virtue of having reported their concerns. This applies Directors’ and Officers’ Indemnity Insurance Policy will cover in the context of their interview as well as in all other dealings. the cost of legal representation. The interview team should therefore comprise individuals In certain serious or complex investigations, it may be in both who are completely independent from the areas of the business the entity and the individual’s best interests for legal representa- forming the subject of the investigation, as this will demonstrate tion to be offered. If a witness is allowed time with an experi- that the whistleblower’s allegations are being taken seriously and enced Independent Legal Adviser (ILA) to prepare properly for are being properly investigated. At the beginning of the inter- an interview and to receive advice on the issues, then this often view, the whistleblower should be told that the interviewers are results in a more considered, coherent and reliable account being aware of their status and the protections that this affords them. provided. This is particularly relevant where there is the pros- The interviewer should remind the whistleblower that what they pect of an individual facing criminal charges regardless of the say may form part of any subsequent report to the authorities, outcome to their employer. but that any report will seek to maintain their anonymity. If a whistleblower seeks anonymity, this should be seriously 7.4 What are best practices for conducting witness considered by the entity to ensure both the integrity of the inves- interviews in your jurisdiction? tigation and that the whistleblower is not prejudiced by virtue of their disclosures. That being said, it will sometimes be neces- The interviewer must ensure that the witness understands the sary not to agree to absolute anonymity, for example where it is basis on which they are being interviewed, the purpose of that necessary to identify the whistleblower in a later interview with interview and the use that could be made of the information a person suspected of wrongdoing, in order for that person to provided, as this could impact on its admissibility and also have properly understand, engage with and respond to the whistle- data protection consequences. blower’s allegations. Different approaches are taken to documents which the investigators wish to ask the witness about during the interview. 7.7 Can employees in your jurisdiction request to Sometimes, it will be appropriate to give the witness advance review or revise statements they have made or are the sight of those documents, so they can consider them in advance statements closed? of the interview as part of their interview preparation. However, in some cases, it will be strategically important not to do so; for It is good practice to grant an employee the ongoing opportunity

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 62 England & Wales

to provide further information to the investigation team, even background to the investigation, including a summary of the if this revises their previous statements. This is usually done matters which gave rise to the investigation and a record of by informing the witness at the end of their interview that they the basis of any assertion of privilege over the report; (c) the should contact the investigation team if they become aware of scope of the investigation, reflecting the investigation’s terms any further information which is of relevance to the investiga- of reference, including a concise summary of the allegations/ tion. Due to legal professional privilege issues, it is not usual matters being investigated; (d) a methodology section, setting practice to provide transcripts or notes of interviews to witnesses. out a summary of the investigative steps taken; (e) a summary of key internal policies and procedures which applied to the matters under investigation; (f) detailed findings as to “what 7.8 Does your jurisdiction require that enforcement authorities or a witness’ legal representative be present happened”, including any findings of misconduct; and (g) an during witness interviews for internal investigations? executive summary/conclusion, including a summary of any remedial action or improvements recommended and/or taken. The investigation report might also include various appen- There is no requirement that either enforcement authorities or dices, such as a dramatis personae, a glossary of key terms, a chro- a witness’ legal representative be present during witness inter- nology of key events, excerpts from or reproductions of key views for an internal investigation. documents, and any relevant expert reports. The investigation report might also be supported by a bundle 82 Investigation Report of documents (including pre-existing documents and documents created during the investigation, such as interview notes), 8.1 How should the investigation report be structured which are referred to and relied upon in the report. and what topics should it address? The entity will need to give serious consideration as to whether it wishes to have the findings of the investigation The structure of the investigation report will depend on the presented in a written report. The alternative is that the key nature of the investigation. However, in most cases, a report findings are reported orally, which limits the level of detail that will contain the following sections: (a) a legal disclaimer setting can be provided but avoids the creation of a written document out matters such as any confidentiality and/or legal profes- in respect of which disclosure issues may arise. sional privilege asserted over the contents of the report; (b) a

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kingsley Napley LLP 63

Alun Milford is a partner in the criminal team and specialises in serious or complex financial crime, proceeds of crime litigation and corporate investigations. He has particular knowledge and experience of issues surrounding corporate crime and deferred prosecution agreements. He joined Kingsley Napley from the public sector where, over a 26-year career as a government lawyer and public prosecutor, he worked in a wide variety of roles including General Counsel at the Serious Fraud Office, the Crown Prosecution Services’ Head of Organised Crime, its Head of Proceeds of Crime and Revenue and Customs Prosecutions Office’s Head of Asset Forfeiture Division.

Kingsley Napley LPP Tel: +44 20 7814 1200 Knights Quarter, 14 St. John’s Lane Email: [email protected] London EC1M 4AJ URL: www.kingsleynapley.co.uk United Kingdom

Caroline Day specialises in serious fraud and financial crime. She represents corporates and individuals in complex global investigations. She has led numerous internal investigations on behalf of companies in relation to allegations of financial crime and misconduct, including fraud, theft, corruption, money laundering and environmental crime – including multijurisdictional. She advises companies and individuals who are subject to investigations and prosecutions by various agencies, including the Serious Fraud Office, the Financial Conduct Authority, HM Revenue and Customs, the Crown Prosecution Service, and the Competition and Markets Authority. Caroline has a particular interest in cross-border cases and her experience extends to mutual legal assistance requests and extradition.

Kingsley Napley LPP Tel: +44 20 7814 1200 Knights Quarter, 14 St. John’s Lane Email: [email protected] London EC1M 4AJ URL: www.kingsleynapley.co.uk United Kingdom

Áine Kervick is an associate in the criminal team with a wide range of criminal litigation experience. She provides advice and representation to individuals and corporates from the initial stages of criminal investigations up to trial. Her experience includes investigations and prosecutions brought by the Competition and Markets Authority, US Department of Justice and the Serious Fraud Office in relation to cartel, anti-money laundering and anti-bribery and corruption investigations. She has written extensively on anti-bribery laws in England and Wales. She regularly carries out internal investigations in corporate matters where there are allegations of wrongdoing and/or suspected criminality.

Kingsley Napley LPP Tel: +44 20 7814 1200 Knights Quarter, 14 St. John’s Lane Email: [email protected] London EC1M 4AJ URL: www.kingsleynapley.co.uk United Kingdom

Philip Salvesen specialises in representing individuals and corporates in relation to business and financial crime, financial services investigations and contentious regulatory matters. He frequently advises on complex and high-profile investigations and prosecutions by a wide range of bodies, including the Serious Fraud Office, Financial Conduct Authority, National Crime Agency and the Competition and Markets Authority. Phil also conducts internal investigations on behalf of corporates into allegations of wrongdoing, as well as advising members of staff involved in such investigations.

Kingsley Napley LPP Tel: +44 20 7814 1200 Knights Quarter, 14 St. John’s Lane Email: [email protected] London EC1M 4AJ URL: www.kingsleynapley.co.uk United Kingdom

Kingsley Napley LPP. We made our reputation on our outstanding crim- and regulatory enforcement interviews and subsequent regulatory and inal defence work, and our modern white-collar practice is built on those employment proceedings. Our international crime experience in relation foundations. The investigations practice encompasses a number of to mutual legal assistance and extradition underpins our advice to individ- teams: Criminal; Public law; Employment; Dispute Resolution; Reputation uals in global investigations. Management; and Corporate and Commercial. Our track record in www.kingsleynapley.co.uk defending individuals in corporate investigations is unrivalled, and we have acted in some of the most well-known global financial crime investigations of recent years. We frequently act for corporate clients in the most complex and fraught situations across a number of different sectors and jurisdictions. We secured the fourth UK deferred prosecution agreement in 2017. We conduct internal investigations on behalf of corporate clients and represent individuals who have been involved in internal investigation

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 64 Chapter 10 France France

Christian Dargham

Norton Rose Fulbright LLP Caroline Saint Olive

12 The Decision to Conduct an Internal is a party, or of the law and regulations, or any issue that poses a threat or a serious harm to the public interest. Investigation The entity must ensure that whistleblowers’ identities remain confidential. 1.1 What statutory or regulatory obligations should an entity consider when deciding whether to conduct an internal investigation in your jurisdiction? Are there any 1.3 How does outside counsel determine who “the consequences for failing to comply with these statutory client” is for the purposes of conducting an internal or regulatory regulations? Are there any regulatory or investigation and reporting findings (e.g. the Legal legal benefits for conducting an investigation? Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure Internal investigations are a recent phenomenon in France. There that the reporting relationship is free of any internal are no explicit statutory or regulatory obligations pertaining to conflicts? When is it appropriate to exclude an in-house internal investigations. However, the law relating to transpar- attorney, senior executive, or major shareholder who ency, the fight against corruption and economic modernisation might have an interest in influencing the direction of the of 9 December 2016, otherwise called “Sapin 2”, has achieved a investigation? milestone in the development of internal investigations in France since it introduced a new settlement system named “judicial The General Counsel or the Chief Compliance Officer of the agreement of public interest” (“CJIP”). entity are generally outside counsels’ main contact. It is recom- The CJIP does not expressly refer to internal investigations, mended to set up a special committee composed of a limited but such investigations will certainly help (i) decide whether a number of relevant functions to whom the outside counsel settlement should be entered into with the Public Prosecutor, will report findings. This will enhance independence and help and (ii) better negotiations of such settlement. preserve confidentiality and legal privilege. The members of More generally, when deciding to conduct an internal investi- this committee or any instance that will coordinate the inves- gation, an entity should pay attention to data privacy, labour laws, tigation need to be fully independent and must not be poten- influencing witnesses and legal privilege (which does not apply tially involved in the allegations. Rules should be carefully set in France to in-house counsel) rules. French law also prohibits up where the investigation covers facts which could potentially transferring any information or document to foreign authorities involve the top management, to avoid any risk of the top manage- except through the channels of international treaties/conven- ment trying to influence or stop the investigation process. tions. Breaching this law, known as the “blocking statute”, is a criminal offence. 22 Self-Disclosure to Enforcement Authorities 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an 2.1 When considering whether to impose civil or internal investigation is necessary? Are there any legal criminal penalties, do law enforcement authorities in implications for dealing with whistleblowers? your jurisdiction consider an entity’s willingness to voluntarily disclose the results of a properly conducted The entity should always ensure that alerts are gathered prop- internal investigation? What factors do they consider? erly by a referent and dealt with by people who are experienced in this area. Not all complaints deserve an internal investiga- Companies have no obligation to disclose violations of anti- tion. A prima facie assessment of the credibility of the complaint, bribery laws or associated accounting irregularities to the sometimes after further exchanges with the whistleblower when Prosecutor (however, external statutory auditors have a duty to possible, will enable the company to select those who should be disclose to the Prosecutor any crime they become aware of over further investigated. the course of their audit). The protection of whistleblowers was reinforced by Sapin 2: With the new CJIP settlement, self-disclosure to the Public whistleblowers are protected when they report, in a disinterested Prosecutor is now an option. The French Ministry of Justice issued manner and in good faith, a crime, a misdemeanour, a serious a circular on 31 January 2018 on Sapin 2 (including the CJIP) and and manifest violation of an international treaty to which France on 2 June 2020 on the fight against international corruption; and

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Norton Rose Fulbright LLP 65

on 26 June 2019, the French Anti-Corruption Agency (“AFA”) already targeted the company for an investigation, and if the issued guidelines on the implementation of the CJIP, which refer latter has decided to conduct an internal investigation, it may to the impact of self-disclosure and/or cooperation as a mitigating be useful in some cases to liaise with the authorities to try to factor on the penalties that will be imposed. persuade them that the company will conduct a proper and inde- To date, 11 CJIPs have been entered into in France. Self- pendent internal investigation, and that the authorities should disclosure is increasingly considered a mitigating factor in the soften their own investigations. Since some French authorities calculation of the penalty. As an example, in the Airbus SE are not yet fully used to internal investigations, such an attempt CJIP entered into on 31 January 2020, Airbus was rewarded may not succeed. for its cooperation and voluntary self-reporting. The French authorities decided to apply a 50% reduction on the public 3.2 If regulatory or law enforcement authorities interest fine (i.e. the punitive part of the fine) due to Airbus’ are investigating an entity’s conduct, does the entity exemplary cooperation. have the ability to help define or limit the scope of a In addition, other factors could be taken into account by government investigation? If so, how is it best achieved? the Public Prosecutor to reduce or increase the amount of the penalty. For example, the amount of the complementary penalty An entity does not have the ability to limit the scope of a govern- could be increased depending on the seriousness and the dura- ment investigation. However, it can try to convince the author- tion of the offence, the lack of cooperation of the company pros- ities to do so by providing additional evidence/information ecuted, the complexity of the fraudulent practices, and the fact that it considers helpful. When an investigating judge has been that the corrupted company is entrusted with a public service appointed, the entity could also file a request for additional mission/is a public operator. investigative steps. Also, the amount of the fine can be reduced when the prosecuted company has cooperated during the investigation, has conducted an effective internal investigation, has dismissed the executives 3.3 Do law enforcement authorities in your jurisdiction involved in the commission of the offences and has implemented a tend to coordinate with authorities in other jurisdictions? compliance programme since the disclosure of the facts. What strategies can entities adopt if they face investigations in multiple jurisdictions?

2.2 When, during an internal investigation, should a There is a net increasing cooperation with authorities of other disclosure be made to enforcement authorities? What are the steps that should be followed for making a disclosure? jurisdictions. By way of example, in May 2018, the French National Prosecutor’s office (“PNF”) concluded a CJIP with a French bank to settle suspicions of past bribery. For the first The first key step is to have full visibility of the misconduct before time since Sapin 2 entered into force, this resolution was coor- taking any decision to self-report. For example, a sole whistle- dinated with the US Department of Justice (“DOJ”), which also blowing alert is in itself insufficient to prompt a self-reporting concluded a deferred prosecution agreement with the French decision. bank based on the same facts. Also, more recently, Airbus SE Extensive internal investigations should be carried out to reached final agreements on 31 January 2020 with the PNF, the determine the seriousness and extent of the misconduct, the UK’s Serious Fraud Office (“SFO”) and the DOJ in order to individuals involved, the legal risks and the jurisdictional issues. resolve investigations into allegations of bribery and corruption. When there is a high risk that the matter may become public This constitutes the first coordinated settlement between these (e.g., through a whistleblower) before the internal investigation three anti-corruption enforcement authorities, resulting in one is sufficiently advanced, the company may decide to prompt of the world’s largest corporate fines for bribery and corruption. contact with the authorities to self-disclose. These joint negotiated settlements open a new chapter in international corruption prosecutions, demonstrating that French 2.3 How, and in what format, should the findings of an authorities are now a legitimate prosecutorial authority in the internal investigation be reported? Must the findings of eyes of the other anti-corruption enforcement authorities, espe- an internal investigation be reported in writing? What cially the DOJ and the SFO. In cases where an entity could risks, if any, arise from providing reports in writing? face investigations in multiple jurisdictions, it should carefully weigh its decision to self-report, since a voluntary disclosure in There are no legal requirements regarding the format of the find- one jurisdiction may amount to self-reporting in other relevant ings of an internal investigation. The findings may be disclosed jurisdictions. either orally or provided in a written report. A written report could be seized by the authorities or even required by an adverse 42 The Investigation Process party in civil litigation if it is not subject to legal privilege. 4.1 What steps should typically be included in an 32 Cooperation with Law Enforcement investigation plan? Authorities The following steps should be included in the investigation 3.1 If an entity is aware that it is the subject or plan: definition of the scope of the investigation; decision on the target of a government investigation, is it required to immediate measures and protective steps to be taken; identifica- liaise with local authorities before starting an internal tion, preservation and collection of relevant information; identi- investigation? Should it liaise with local authorities even fication of individuals who know relevant facts and/or who may if it is not required to do so? have been involved; document review and analysis; interviews to be conducted; and a report of findings and recommendations A company is not required to liaise with local authorities before for remediation. starting an internal investigation. When the authorities have

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 66 France

4.2 When should companies elicit the assistance of 5.5 Do enforcement agencies in your jurisdictions keep outside counsel or outside resources such as forensic the results of an internal investigation confidential if consultants? If outside counsel is used, what criteria such results were voluntarily provided by the entity? or credentials should one seek in retaining outside counsel? If a CJIP settlement is reached with the Public Prosecutor but it is not eventually approved by the President of the court, Hiring an outside counsel is crucial to benefit from legal priv- the Prosecutor cannot provide the investigating bodies or the ilege. It is also preferable to be assisted by an outside counsel criminal courts with statements or documents provided by the when there are interactions with authorities and/or when the company during the course of the negotiations. investigation covers several jurisdictions, which requires famil- Conversely, if no agreement is reached and, afterwards, a judi- iarity with various applicable laws. When the investigation is cial process or an enforcement action is initiated, the results of potentially intended to be shared with authorities, one key crite- the internal investigation may not remain confidential as they rion is that outside counsel and forensic consultants be experi- will be part of the criminal file. enced in conducting internal investigations in a way which is compatible with authorities’ expectations. 62 Data Collection and Data Privacy Issues

52 Confidentiality and Attorney-Client 6.1 What data protection laws or regulations apply to Privileges internal investigations in your jurisdiction?

5.1 Does your jurisdiction recognise the attorney- The main data protection legislation is the law of 6 January client, attorney work product, or any other legal 1978 on Information Technology, Data Files and Civil Liberties privileges in the context of internal investigations? What (the “Data Protection Act”) and Decree No. 2005-1309 imple- best practices should be followed to preserve these privileges? menting it. In addition, the following data protection laws and guidelines could apply: To the extent that a French outside counsel (avocat) conducts an ■ the General Data Protection Regulation (“GDPR”), which internal investigation in the context of the defence of the entity entered into force on 25 May 2018. The GDPR creates under investigation, French “professional secrecy” should apply. an obligation for companies to appoint a Data Protection Under this rule, exchanges between an outside counsel (avocat) Officer, who will be the adviser for data protection matters and his/her client should benefit from such protection, despite in the event of internal investigations; the fact that some prosecutors could contend that some docu- ■ the Charter of the Rights and Duties of Control ments do not benefit from professional secrecy. Stakeholders, published in April 2019 by the AFA, which provides that AFA agents must comply with the data 5.2 Do any privileges or rules of confidentiality apply protection rules communicated by the controlled entity; to interactions between the client and third parties ■ the National Commission for Data Protection and Liberty engaged by outside counsel during the investigation (“CNIL”) and AFA’s Guidelines on the implementation (e.g. an accounting firm engaged to perform transaction of whistleblowing programmes in compliance with the testing or a document collection vendor)? French Data Protection Act; and ■ until the entry into force of the GDPR, whistleblowing Communications between the client and third parties engaged systems were regulated by Single Authorisation No. 04 by outside counsel such as forensic accountants are not covered (the “AU-004”) of the CNIL. The AU-004 laid down the by the attorney-client privilege. In order for this privilege to requirements to be complied with by any whistleblowing apply, communication should be directed through the outside system set up by a company subject to the French Data counsel. Protection Act. The AU-004 was repealed by the GDPR and is no longer in force, but it still serves as the CNIL’s official guidelines in relation to the implementation of any 5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal whistleblowing system in France under the GDPR. investigation? 6.2 Is it a common practice or a legal requirement Legal privilege does not apply to communications with in-house in your jurisdiction to prepare and issue a document counsel. preservation notice to individuals who may have documents related to the issues under investigation? Who should receive such a notice? What types of 5.4 How can entities protect privileged documents documents or data should be preserved? How should during an internal investigation conducted in your the investigation be described? How should compliance jurisdiction? with the preservation notice be recorded?

Documents created internally, including by in-house counsel, There is no general legal requirement to prepare and issue a will not be privileged. Only communication with and mate- document preservation notice in connection with internal or rial created by outside counsel will benefit from legal privilege. external investigations. However, it is a common and recom- Such communication and material should be clearly marked as mended practice among professionals experienced in conducting privileged and should not be forwarded to third parties. internal investigations.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Norton Rose Fulbright LLP 67

6.3 What factors must an entity consider when 7.2 Are employees required to cooperate with their documents are located in multiple jurisdictions employer’s internal investigation? When and under (e.g. bank secrecy laws, data privacy, procedural what circumstances may they decline to participate in a requirements, etc.)? witness interview?

One key point is that the entity must comply with all relevant It is generally assumed that employees are required to cooperate local laws, failing which, both the company and investigators with an internal investigation. An employee can be compelled could be exposed to criminal risks. to deliver documents which are the company’s property but The most relevant restrictions to consider in France are the cannot be compelled to speak at an interview. so-called “blocking statute”, bank secrecy and data privacy. 7.3 Is an entity required to provide legal representation 6.4 What types of documents are generally deemed to witnesses prior to interviews? If so, under important to collect for an internal investigation by your what circumstances must an entity provide legal jurisdiction’s enforcement agencies? representation for witnesses?

There are no specific guidelines governing document collection An entity is not required to provide legal representation to in internal investigations. Any documents of relevance to the witnesses, although a witness cannot be prevented from seeking potential issues and underlying activity should be collected, such legal advice. However, it might be in the interest of the entity in as emails, memoranda, accounts, presentations, ledgers, policies some cases to arrange for such counsel. and procedures, internal audit reports, etc. 7.4 What are best practices for conducting witness 6.5 What resources are typically used to collect interviews in your jurisdiction? documents during an internal investigation, and which resources are considered the most efficient? One key point is to avoid influencing the witness. The Paris Bar and the French CNB guidance on witness interviews recom- Depending on the size of the investigation, document and data mend that outside counsel explain their role and its non-coercive collection would generally be carried out by internal or external nature. They should also specify that: (i) they represent the forensic IT specialists. IT’s role in this respect is crucial, since it company’s interests and not the witness’; and (ii) the company is is essential to be able to locate and preserve the data. not bound by the attorney-client privilege, so that any statement or information gathered during the investigation could be used by their client. 6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit In their guidance, the Paris Bar and the French CNB also the use of predictive coding techniques? What are recommend that the outside counsel conducting the interview best practices for reviewing a voluminous document informs the witness that he/she may be assisted or advised by collection in internal investigations? his/her outside counsel when it appears, prior to or during the interview, that he/she may be held accountable for any wrong- There are no specific legal restrictions on using technology- doing at the outcome of the investigation. assisted reviews or predictive coding techniques to assist and simplify an investigation. However, one should keep in mind 7.5 What cultural factors should interviewers be aware that these techniques are still new and enforcement authori- of when conducting interviews in your jurisdiction? ties may not be used to them yet. When reviewing voluminous document collection, data for review should be collected on a French actors are not yet fully used to private investigations. data-processing platform. When the internal investigation’s findings are intended to be shared with authorities, some people may find it odd to provide 72 Witness Interviews authorities with facts and evidence that will lead them to issue penalties against the company and some of its employees, 7.1 What local laws or regulations apply to interviews including top executives. of employees, former employees, or third parties? What authorities, if any, do entities need to consult before initiating witness interviews? 7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while upholding the rights of the whistleblower? There are no specific laws or regulations that apply to interviews of employees or third parties in internal investigations. The company must ensure that whistleblowers’ identities remain However, the Paris Bar and the French National Bar Council confidential. Sapin 2 introduced measures to ensure the confi- (“CNB”) have published guidelines for the conduct of such dentiality and non-liability of whistleblowers. interviews by outside French counsel (avocat) over the course of In this regard, whistleblowers’ identities shall only be commu- internal investigations. nicated to judicial authorities with the whistleblowers’ consent. In addition, investigators should keep in mind that they do not represent official authorities and that they are not entitled to extort admissions under pressure. There are no requirements to consult any authorities before initiating interviews.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 68 France

7.7 Can employees in your jurisdiction request to 82 Investigation Report review or revise statements they have made or are the statements closed? 8.1 How should the investigation report be structured and what topics should it address? In their guidance, the Paris Bar and the French CNB recommend that an interviewee should be able to review and sign his statement if a verbatim transcript has been made. Otherwise, There are no formal requirements as to how the report should there is no obligation to do so. be structured. It will generally contain: the process that has been applied for the investigation; a description of the document preservation; collection and review processes; and a description 7.8 Does your jurisdiction require that enforcement of the relevant facts and the results of the document reviews authorities or a witness’ legal representative be present and of the interviews. Since the report could be shared with the during witness interviews for internal investigations? authorities or accessed by third parties, an option is to set out in a separate document, which contains: the applicable legal and There are no such requirements. regulatory framework; a summary of the conclusions as to individual responsibilities and qualifications; and recommendations as to further remedial steps to be taken by the entity.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Norton Rose Fulbright LLP 69

Christian Dargham is a business ethics and dispute resolution lawyer. He has extensive experience in relation to business ethics and investigations (implementation of global compliance policies, day-to-day assistance to Compliance Officers, audits and assessment of compliance policies, training sessions, integrity due diligence, investigations in areas such as corruption, fraud, and international sanctions). His activity also encompasses litigation (contractual disputes, product liability and white-collar crime). Christian represents leading industrial groups and international financial institutions. Christian gives lectures at Sciences Po Paris and is a member of the editorial committee of the International Review of Compliance and Business Ethics. Christian contributed to the drafting of the French CNB’s practical guide on “the French lawyer and the internal investigations”, published in July 2020.

Norton Rose Fulbright LLP Tel: +33 1 5659 5292 40 rue de Courcelles Email: [email protected] 75008 Paris URL: www.nortonrosefulbright.com France

Caroline Saint Olive specialises in business ethics and anti-corruption matters. Caroline advises French and international corporations operating in a broad range of sectors with a focus on anti-corruption and international sanctions issues. Caroline gives lectures at Sciences-Po Paris. She graduated from the Cergy-Pontoise University with a postgraduate degree in Law and Business Ethics. She also graduated from the ESSEC Business School with an Advanced Master’s in International Business Law and Management. Caroline trained for six months at Transparency International France in 2016, where she gained experience in anti-corruption matters. Caroline was admitted to the Paris Bar in 2017 and joined Norton Rose Fulbright in October 2017 after training for six months in their offices. Caroline contributed to the drafting of the French CNB’s practical guide on “the French lawyer and the internal investigations”, published in July 2020.

Norton Rose Fulbright LLP Tel: +33 1 5659 5379 40 rue de Courcelles Email: [email protected] 75008 Paris URL: www.nortonrosefulbright.com France

Norton Rose Fulbright is a global law firm providing the world’s preeminent corporations and financial institutions with a full business law service. The firm has more than 4,000 lawyers and other legal staff based in Europe, the United States, Canada, Latin America, Asia, Australia, Africa, the Middle East and Central Asia. Recognised for its industry focus, Norton Rose Fulbright is strong across all the key industry sectors: financial institutions; energy; infrastructure, mining and commodities; transport; technology and innovation; and life sciences and healthcare. Norton Rose Fulbright’s Paris Dispute Resolution and Business Ethics and Anti-Corruption team is ranked in Band 1 of Chambers Europe 2020 (France) in corporate compliance & investigations. Christian Dargham is also ranked individually in Band 1 of Chambers Europe (France) and The Legal 500 (France) for 2020. Norton Rose Fulbright’s global compliance, regulatory and investigations practice includes 800 lawyers in more than 50 offices around the world. www.nortonrosefulbright.com

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 70 Chapter 11 Germany Germany

Dr. Thomas Schürrle

Debevoise & Plimpton LLP Dr. Friedrich Popp

12 The Decision to Conduct an Internal to provide by the end of 2021 for secure reporting channels and effective protection from retaliation for whistleblowers Investigation reporting on or disclosing breaches of certain Union laws.

1.1 What statutory or regulatory obligations should 1.3 How does outside counsel determine who “the client” an entity consider when deciding whether to conduct an is for the purposes of conducting an internal investigation internal investigation in your jurisdiction? Are there any and reporting findings (e.g. the Legal Department, the consequences for failing to comply with these statutory Chief Compliance Officer, the Board of Directors, the or regulatory regulations? Are there any regulatory or Audit Committee, a special committee, etc.)? What steps legal benefits for conducting an investigation? must outside counsel take to ensure that the reporting relationship is free of any internal conflicts? When is Corporate investigations are governed by several rules, which it appropriate to exclude an in-house attorney, senior include corporate law, criminal and administrative offences executive, or major shareholder who might have an law, workplace safety, trade regulations, employment and data interest in influencing the direction of the investigation? protection laws. A draft Corporate Sanctions Act also regulating corporate investigations and entering into force not earlier than This is determined by the client, and legal counsel usually recom- two years after promulgation has made its way to the German mends that the investigation is led by a corporate organ or body Parliament. that carries the necessary power under the circumstances to Corporate law requires the management of a German company support and enable (and to terminate) the investigation. Another to establish and maintain an adequate compliance management factor may be if the company management is actually implicated, system (“CMS”). The extent and specific shape of the CMS falls which may require the investigation to be hinged on a higher under the discretion of the company management under the busi- or more independent body, such as the supervisory board or ness judgment rule. As part of the set of obligations, the company subcommittees thereof. Caution needs to be exercised before management is required to get to the bottom of compliance defi- excluding any corporate function from the investigation manage- cits and violations. The extent of, effort to conduct and means for ment or the reporting of its results: the management of a German an investigation have to be commensurate with the anticipated corporation can only be excused from participating if there is issue. Failure to conduct an adequate investigation can result in reliable evidence that the person is implicated and no longer civil liability vis-à-vis the corporation, or criminal liability. expected to contribute impartially, or even expected to interfere.

1.2 How should an entity assess the credibility of a 22 Self-Disclosure to Enforcement whistleblower’s complaint and determine whether an Authorities internal investigation is necessary? Are there any legal implications for dealing with whistleblowers? 2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in Whistleblower allegations are to be checked and verified to your jurisdiction consider an entity’s willingness to the greatest extent possible. This is usually done in separate, voluntarily disclose the results of a properly conducted protected proceedings which may require the whistleblower to internal investigation? What factors do they consider? be forthcoming with evidence without revealing its identity. Germany offers protection to whistleblowers only in special Generally, there are no sentencing guidelines in criminal cases, instances, such as in cases of reporting the misconduct of but the authorities have discretion, within specific legal limits; companies under the supervision of the German financial they may reduce criminal sentences if the subject of the investiga- regulator, Bundesamt für Finanzdienstleistungsaufsicht (“BaFin”), tion has shown good reasons to demonstrate that compliance has in accordance with the Act Establishing the Federal Financial been ameliorated and the company is demonstrably determined Supervisory Authority or of violations of the Money Laundering to avoid compliance violations in the future. Self-reporting alone Act. German law further protects, in certain instances, whistle- is one element, but with exceptions (see below); generally, this is blowers disclosing trade secrets in accordance with the Act on not the decisive factor in current practice in Germany. It is more Trade Secrets. The statutes do not specifically provide for deal- important to show that the compliance deficit has been pursued ings with whistleblowers. An EU Directive requires Germany and remedied, the damage has been repaired and compliance management has been strengthened.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Debevoise & Plimpton LLP 71

BaFin guidelines on fines expressly provide for voluntary 3.3 Do law enforcement authorities in your jurisdiction self-disclosure and cooperation in the proceedings as a miti- tend to coordinate with authorities in other jurisdictions? gating factor. The Federal Cartel Office, Bundeskartellamt, can What strategies can entities adopt if they face grant cartel participants immunity from or reduction of fines if investigations in multiple jurisdictions? they uncover the cartel or cooperate with the Office. German authorities generally cooperate with law enforcement 2.2 When, during an internal investigation, should a authorities in other jurisdictions, and they grant legal assistance disclosure be made to enforcement authorities? What on the basis of mutual legal assistance treaties. are the steps that should be followed for making a disclosure? 42 The Investigation Process

A German company is under no duty to disclose wrongdoing, 4.1 What steps should typically be included in an apart from tax evasion or the suspicion of money laundering. investigation plan? Cooperation with enforcement authorities has proven helpful in reducing sentences, and as part of that, the strategic decision of In the investigation plan, the corporation determines the scope, if and when to disclose will take into account how the disclosed timing, responsibilities and type of reporting. It addresses information will improve enforcement, as well as the position of the involvement of the data protection officer and the Works the corporation, e.g. with a view to participation in future public Council. The plan provides for the securing and a review of data tenders that may be impaired if the company admitted to having and interview plans. It includes a strategy for communication committed or tolerated bribery. and disclosure of the results to internal and external stakeholders.

2.3 How, and in what format, should the findings of an 4.2 When should companies elicit the assistance of internal investigation be reported? Must the findings of outside counsel or outside resources such as forensic an internal investigation be reported in writing? What consultants? If outside counsel is used, what criteria or risks, if any, arise from providing reports in writing? credentials should one seek in retaining outside counsel?

There is no regulatory requirement concerning the form of The selection decision is guided by the availability of internal reporting, and an authority may also accept an oral report. resources, experience, technical equipment and budget, the Reports are, in practice, often made verbatim with slides and requirement to conduct the investigation free of conflicts of more detailed evidence production, but rarely by submitting interest, and the need to protect the results from government detailed written reports. The more important factor is that the access. Another factor may be the expectation of foreign authori- report is complete and produced in due time. A written report ties that the investigation is conducted by an independent law firm is often not really necessary, since German authorities actually experienced in investigations. The criteria for retaining outside have to collect evidence and conduct their investigations inde- counsel are its experience with internal and international inves- pendently. In addition, a written report bears the risk of being tigations, familiarity with the industry and the business culture, accessed by other authorities or being inadvertently disclosed to personal resources, personal interaction skills, and its ease of media, competitors or others. communicating with the government and other stakeholders in an investigation. Outside lawyers are often better placed to 32 Cooperation with Law Enforcement conduct sensitive investigations than in-house personnel. Authorities 52 Confidentiality and Attorney-Client 3.1 If an entity is aware that it is the subject or Privileges target of a government investigation, is it required to liaise with local authorities before starting an internal investigation? Should it liaise with local authorities even 5.1 Does your jurisdiction recognise the attorney-client, if it is not required to do so? attorney work product, or any other legal privileges in the context of internal investigations? What best practices should be followed to preserve these privileges? Authorities have to assess a case independently from a corporation and its own internal investigation. While there is no statu- German law protects the communication between an attorney tory requirement to liaise with an investigating authority, coor- and its client. It follows the civil law concept of imposing secrecy dination is recommended to avoid allegations of obstruction of obligations on the part of attorneys and safeguarding professional justice or suppression of evidence. Prosecutors generally appre- secrecy with procedural rules, providing for a right to refuse ciate the opportunity to take first accounts of key witnesses. testimony. Professional secrecy protects any kind of communication format containing attorney-client communication. There is 3.2 If regulatory or law enforcement authorities no attorney-work-product doctrine available. Thus, professional are investigating an entity’s conduct, does the entity privilege extends only to documents created by and communica- have the ability to help define or limit the scope of a tion with outside counsel, if the documents reside in the custody government investigation? If so, how is it best achieved? of the outside counsel, and are safe from seizure in criminal cases only if they were created by outside counsel in the course Law enforcement authorities determine the scope and depth of or the expectation of actual or imminent defence cases against an investigation ex officio. The corporation, as part of its coop- the client. Communications with and documents created by eration, can assist the authority in the definition of the scope of in-house counsel are not privileged, which should in particular the government investigation, but the government investigation be taken into account in communications between U.S. counsel has to come to an independent result. an EU in-house counsel. Documents that are privileged under

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 72 Germany

foreign laws may not be under German laws, and can possibly document preservation notices to individuals holding physical be seized by the prosecuting authorities at the client’s offices; or electronic documents relevant to the investigation in their in which case, the seizing should be opposed with the aim of custody. In an employment context, the employer directive to preserving foreign privilege to the largest extent possible. preserve documents does not require an extensive description of the investigation. The notice and the acknowledgment of its receipt should be documented in a manner that permits its use as 5.2 Do any privileges or rules of confidentiality apply to interactions between the client and third parties evidence in case of the custodian’s non-compliance. engaged by outside counsel during the investigation (e.g. an accounting firm engaged to perform transaction 6.3 What factors must an entity consider when testing or a document collection vendor)? documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)? To the extent the privilege exists, it may also extend to third parties engaged by outside counsel; members of a regulated To preserve the evidentiary value of documents collected in an profession with professional secrecy enjoy their own privilege. internal investigation and to avoid interference with the investigation process, the mode of collection and use of informa- 5.3 Do legal privileges apply equally whether tion has to be made in accordance with various laws, including in-house counsel or outside counsel direct the internal criminal procedure, employment laws and data protection laws. investigation? Business secrets may be protected by trade and bank secrecy laws or confidentiality agreements; other documents may Criminal law privilege does not protect communications with contain classified information subject to military secrecy duties. in-house counsel. If the corporation seeks to protect the results An analysis for every jurisdiction where the documents reside of an investigation, outside counsel should conduct the investi- and are supposed to be used is key. gation and the generation of notes on their own. 6.4 What types of documents are generally deemed important to collect for an internal investigation by your 5.4 How can entities protect privileged documents jurisdiction’s enforcement agencies? during an internal investigation conducted in your jurisdiction? In Germany, government investigations and internal investi- Corporations can keep privileged documents with outside gations are separate proceedings in principle, and the corpora- counsel. tion does not necessarily collect documents for the enforcement agency. It is the government investigation that determines the relevance of documents. If the government investigation seeks 5.5 Do enforcement agencies in your jurisdictions keep to demonstrate management involvement in corporate wrong- the results of an internal investigation confidential if doings, it may also seek to seize minutes of board meetings. such results were voluntarily provided by the entity?

6.5 What resources are typically used to collect Enforcement agencies are under a duty to maintain professional documents during an internal investigation, and which secrecy and keep the results of an internal investigation confi- resources are considered the most efficient? dential like every other piece of evidence gathered in a government investigation, irrespective of whether the documents were offered voluntarily. An aggrieved person showing a legitimate In case of voluminous data collections, experienced vendors interest may have a right to inspect the files, unless the corpora- are an important resource for the collection of emails and other tion has a prevailing interest in their confidentiality. electronic documents and, if required, the conversion of physical documents into electronic machine-readable formats. 62 Data Collection and Data Privacy Issues 6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit 6.1 What data protection laws or regulations apply to the use of predictive coding techniques? What are internal investigations in your jurisdiction? best practices for reviewing a voluminous document collection in internal investigations? The European General Data Protection Regulation and the German Federal Data Protection Act govern the collection, use It is the corporation, not the judicial or enforcement authority, and transfer of personal data relating to individuals in internal that decides on the use of predictive coding techniques in its investigations sourcing data in Germany. internal investigation.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Debevoise & Plimpton LLP 73

investigation interests prevail. There are no specific rules 7.6 When interviewing a whistleblower, how can governing the interviewing of third parties. No authority needs to an entity protect the interests of the company while be consulted before interviewing witnesses. Prior to conducting upholding the rights of the whistleblower? interviews with employees, coordination with the Works Council, the body representing employee interests vis-à-vis the manage- The whistleblower does not enjoy specific rights that have to be ment, on the methods used in the interviews is recommended. respected in an interview.

7.2 Are employees required to cooperate with their 7.7 Can employees in your jurisdiction request to employer’s internal investigation? When and under review or revise statements they have made or are the what circumstances may they decline to participate in a statements closed? witness interview?

The employee can request to review or revise statements if the Employees are required to cooperate with interviews as part of company chooses to include the interview notes in the personal their employer’s investigation if the investigated facts are work files of the employee. Best practice suggests avoiding sharing related. notes with anybody, and to rather leave it to the employees to prepare their own notes if they wish. 7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under what circumstances must an entity provide legal 7.8 Does your jurisdiction require that enforcement representation for witnesses? authorities or a witness’ legal representative be present during witness interviews for internal investigations?

The corporation is not required to provide legal representation Internal investigations are separate from government inves- to witnesses prior to interviews, but it has become a recom- tigations and there is currently no statutory requirement that mended practice to make interviews more efficient. enforcement authorities be present during the witness interview. Legal assistance for a witness is not required, but may support 7.4 What are best practices for conducting witness the process. interviews in your jurisdiction? 82 Investigation Report Best practices include thorough preparation, with an outline and relevant evidence being readily available during the interview. 8.1 How should the investigation report be structured Interviews should be scheduled well in advance and provide for and what topics should it address? a convenient setting. The interview should start with an explanation of the purpose and a clarification that the interviewing It is common practice to prepare a short investigation summary counsel’s privilege is with the corporation, which may waive the report at the end of an internal investigation, setting out the privilege. The introduction should also include a reminder of findings, remediation and future compliance measures to avoid the labour law duty to answer questions truthfully and compre- recurrence. Detailed reports are usually given only in special hensively and to keep the interview and its content confidential. meetings with the relevant departments, including all relevant evidence used for further internal measures. The structure 7.5 What cultural factors should interviewers be aware and content of the investigation report should also reflect the of when conducting interviews in your jurisdiction? mandate and the purpose of the investigation. The character- istic elements of a report should be: a definition of the scope of There are no specific cultural factors of which an interviewer the investigation; a description of the investigative process; an should be aware. assessment of the evidence; and a summary of the findings. A legal assessment and recommendations for remedial measures are optional.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 74 Germany

Dr. Thomas Schürrle is admitted to practise both in Germany and the United States, and currently serves as the Managing Partner of the Frankfurt office. He works on cross-border transactions and advises on corporate governance matters, including litigation, and he is active in the firm’s Cybersecurity & Data Privacy practice. Dr. Schürrle has been active in corporate transactions relating to biotech, IT and high-tech industries and has led several international corporate defence cases and related investigations. Dr. Schürrle has significant experience in white-collar crime marks as well as compliance with regulatory requirements for industrial and banking clients. For over more than two decades, he has assisted European clients in managing cross-border data transfer issues associated with complex multinational litigation and corporate defence cases, in particular relating to the United States.

Debevoise & Plimpton LLP Tel: +49 69 2097 5000 Taunustor 1 (TaunusTurm) Email: [email protected] 60310 Frankfurt am Main URL: www.debevoise.com Germany

Dr. Friedrich Popp is a Senior Associate in Debevoise’s Frankfurt office, and a member of the firm’s Litigation Department. His practice focuses on arbitration, litigation, internal investigations, corporate law, data protection and anti-money laundering. In addition, he is experienced in mergers & acquisitions, private equity, banking and capital markets. Dr. Popp has extensively published articles covering a wide range of topics. He is the co-author of the 2020 chapter on privilege in the “Know How” series published by Global Investigations Review. Dr. Popp is a member of the Bar Associations of Vienna, Frankfurt am Main and New York.

Debevoise & Plimpton LLP Tel: +49 69 2097 5000 Taunustor 1 (TaunusTurm) Email: [email protected] 60310 Frankfurt am Main URL: www.debevoise.com Germany

Debevoise & Plimpton LLP is a premier law firm with market-leading prac- investigations, negotiating complex global settlements, and facilitating tices and a global perspective. Approximately 800 lawyers work in 10 cooperation with government regulators. offices across three continents, within integrated global practices, serving The team also routinely counsels clients regarding preventive measures, clients around the world. compliance programmes and the collateral consequences of criminal Our White Collar and Regulatory Defense Group excels in high-profile, proceedings. complex representations for clients facing corporate crises. We work stra- www.debevoise.com tegically with international clients to anticipate and respond to risks, swiftly identifying the root of any problem. The Group is made up of highly experienced partners in Frankfurt, New York, London, Paris, Hong Kong and Washington, D.C. It is one of the few firms to have exceptional capabilities across geographies. Our expertise includes defending against criminal prosecutions and civil enforcement actions, securities-related litigation, conducting internal

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 12 75

Greece Greece

Ilias G. Anagnostopoulos

Anagnostopoulos Padelis V. Bratis

12 The Decision to Conduct an Internal 1.3 How does outside counsel determine who “the client” is for the purposes of conducting an internal Investigation investigation and reporting findings (e.g. the Legal Department, the Chief Compliance Officer, the Board of 1.1 What statutory or regulatory obligations should Directors, the Audit Committee, a special committee, an entity consider when deciding whether to conduct an etc.)? What steps must outside counsel take to ensure internal investigation in your jurisdiction? Are there any that the reporting relationship is free of any internal consequences for failing to comply with these statutory conflicts? When is it appropriate to exclude an in-house or regulatory regulations? Are there any regulatory or attorney, senior executive, or major shareholder who legal benefits for conducting an investigation? might have an interest in influencing the direction of the investigation? Greek legislation provides no general rule or obligation for entities to self-report, regardless of a company’s co-operation. The identification of the client, under the abovementioned Nonetheless, there are certain fields of activity (e.g. the banking circumstances, should be decided at the very outset of the inves- sector) wherein provisions stipulating internal investigations, tigation plan, depending on the particular elements of the case especially for specific categories of wrongdoing (e.g. money under examination (e.g. size and structure of the corporation, laundering, corrupt practices, etc.), might be more austere than nature of the investigated wrongdoing, involved stakeholders, those applying in other industries (e.g. commercial companies etc.). It is important that there is a clear mandate as to the iden- in the private sector). In these cases, an omission to conduct an tity of the client in order for the attorney-client relationship to internal investigation may bring about administrative sanctions be established beyond any doubt towards third parties or the against bound entities or criminal charges on involved natural prosecuting authorities. An entity is advised to resort to outside persons. Conversely, a decision to self-report, which should counsel, especially when there are ongoing opposing interests as probably be made after an ad hoc assessment, is likely to fulfil the to the outcome of the internal investigation. By doing so, the preconditions for a subsequent leniency programme or lead to credibility of the whole procedure will be optimised. immunity for individuals, if liability is actually detected. 22 Self-Disclosure to Enforcement 1.2 How should an entity assess the credibility of a Authorities whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal 2.1 When considering whether to impose civil or implications for dealing with whistleblowers? criminal penalties, do law enforcement authorities in your jurisdiction consider an entity’s willingness to Whether a whistleblower’s statements should instigate an voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider? internal investigation depends on various factors. Parameters to be considered include, amongst others, the level of precision of the submitted complaints, the possible existence of evidence The contribution of entities to the exposure of illicit activities adduced in support of the expressed claims, a bona fide dispo- is generally welcomed by enforcement authorities. Depending sition of the complainant, etc. In Greece, there is no system- mainly on the quality and extent of the information provided, as atic framework dealing with whistleblowers. According to art. well as the time point of the submission of the internal investi- 47 of the Greek Code of Criminal Procedure (GCCP), whistle- gation’s findings, companies may be enabled to make use of leni- blowers may be handled as witnesses of public interest, thus may ency measures, thus minimising or even eliminating the imposi- be granted certain privileges such as immunity against prosecution of sanctions, while implicated individuals could be granted tion for offences connected with the disclosure of information. immunity or face lesser criminal penalties. Such provisions are It should also be noted that the status of whistleblowers who usually connected with serious forms of wrongdoing (e.g. distur- report breaches of EU laws is expected to be more thoroughly bance of free competition and cartels, corrupt practices, organ- regulated in the not-too-distant future, since the transfer of the ised crime and terrorism, etc.). relevant Directive 2019/1937 of the European Parliament and the Council of the EU is currently pending.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 76 Greece

2.2 When, during an internal investigation, should a counterparts is common practice, usually implemented in large- disclosure be made to enforcement authorities? What are scale investigations, and covers a wide range of actions, including the steps that should be followed for making a disclosure? the exchange of information or evidence, the imposition of enforcement measures, etc. Such collaboration functions on The exact time of making a self-disclosure to the competent the basis of pertinent bilateral or international treaties or mutual authorities should be determined in relation to the nature of the assistance practices, and in the case of Greece, it is particularly investigated offences, the sufficiency of the gathered evidence effective and fast among EU Member States, due to the establish- and the degree of participation of an entity’s executives or ment of particular institutions (e.g. the European arrest warrant, employees in the detected wrongdoing. A timely and thorough European investigation order). Entities confronted with inves- report to the regulatory bodies or the prosecutor would, as a rule, tigations across multiple jurisdictions are strongly advised to lead to more favourable treatment of the involved legal person consider the aforementioned methods that authorities resort to and the concerned individuals, yet a decision to self-report should before shaping a coherent strategy. The collaboration of the be evaluated regarding all the possible risks it entails. entity with specialised legal counsel, based in each jurisdiction, would be helpful in coping with peculiarities across different judicial systems. 2.3 How, and in what format, should the findings of an internal investigation be reported? Must the findings of an internal investigation be reported in writing? What 42 The Investigation Process risks, if any, arise from providing reports in writing? 4.1 What steps should typically be included in an There is no specific framework stipulating the content or the investigation plan? format of the final report of an internal investigation. Therefore, it lies with the department that is in charge of the investigation As mentioned before under question 2.3., the department of an to specify these standards. Such a report shall contain details entity which is in charge of conducting an investigation also has about the subject under examination, the procedure that has the discretion to determine the outline of the procedure, due to been followed, the evidence that has been collected and any the absence of systematic legislation over this issue. Nevertheless, other information that is linked with the scope of the investiga- aspects of a proper investigation plan shall address the following tion. For reasons of clarity and precision, a report of this type matters: i) responsibility and clear mandate for the conduct of the shall be in written form. However, due to the absence of elabo- internal investigation; ii) scope and extent of the investigation; rate regulations over this matter, a written report might be used iii) identification of the implicated parties; iv) collection and eval- as aggravating evidence against legal or natural persons or be handled in inconsistent ways across multiple jurisdictions. uation of evidence (e.g. document preservation, witness examination, etc.); and v) general risk assessment. The investigation 32 Cooperation with Law Enforcement plan should be also subject to review, so that amendments can be promptly made if circumstances change in the meantime. Authorities

4.2 When should companies elicit the assistance of 3.1 If an entity is aware that it is the subject or outside counsel or outside resources such as forensic target of a government investigation, is it required to consultants? If outside counsel is used, what criteria liaise with local authorities before starting an internal or credentials should one seek in retaining outside investigation? Should it liaise with local authorities even if it is not required to do so? counsel?

Co-operation between enforcement authorities and corporations The contribution of outside counsel and the utilisation of that undergo a government investigation would, under some external expertise could be valuable for the progress and circumstances, be advisable. This approach could possibly give completion of internal investigations, especially when it comes an entity the opportunity to co-shape the subject and extent of an to those conducted for the detection of serious wrongdoing on investigation, better contain confidentiality risks and reputational a larger scale. By resorting to this type of resource, an entity damages or even take advantage of leniency or immunity meas- enhances the credibility and very quality of its investigation, ures, in the case that sanctions or penalties were to be imposed. thus ensuring that the outcome of this procedure will not be disputed by enforcement authorities or markets themselves. For these reasons, outside counsel shall be chosen on the basis of 3.2 If regulatory or law enforcement authorities previous experience in handling internal investigation proceed- are investigating an entity’s conduct, does the entity have the ability to help define or limit the scope of a ings and the ability to protect the interests of the client, without government investigation? If so, how is it best achieved? jeopardising the progress of the investigation or the possible co-operation with authorities. Co-operative methods aside, the validity or scope of formal investigative actions can be challenged before the compe- 52 Confidentiality and Attorney-Client tent judicial authorities, i.e. administrative or criminal courts Privileges depending on the nature of the investigation. 5.1 Does your jurisdiction recognise the attorney-client, 3.3 Do law enforcement authorities in your jurisdiction attorney work product, or any other legal privileges in the tend to coordinate with authorities in other jurisdictions? context of internal investigations? What best practices What strategies can entities adopt if they face should be followed to preserve these privileges? investigations in multiple jurisdictions? Attorney-client privilege is well established within the Greek Co-ordination between Greek agencies and their foreign legal system and covers a broad range of data (e.g. electronic

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Anagnostopoulos 77

correspondence, written memos, oral communications, etc.) investigations, general rules apply when it comes to data protec- which shall be treated as confidential. Attorney-client privi- tion issues during an internal investigation. The General Data lege can be invoked at all types of procedures, whether criminal, Protection Regulation (2016/679 Regulation of the European administrative or civil, without making a distinction between Parliament and the Council of the EU) (GDPR), which is in natural and legal persons as to the identification of the client, force across all EU Member States, along with Law 4624/2019 while sources of this privilege are to be found in the Lawyers’ (measures for the implementation of the aforementioned Code, the Criminal Code and the GCCP, as well as the Code Regulation as well as the transfer of Directive 2016/680 of the of Civil Procedure. Therefore, attorney-client privilege is not European Council and the Council of the EU) compose the core expected to be waived during an internal investigation, unless legal framework concerning the current data protection regime. those entitled to this right decide otherwise depending on the The Hellenic Data Protection Authority (HDPA) supervises the specifics of the case. proper application of the relevant laws.

5.2 Do any privileges or rules of confidentiality apply 6.2 Is it a common practice or a legal requirement to interactions between the client and third parties in your jurisdiction to prepare and issue a document engaged by outside counsel during the investigation preservation notice to individuals who may have (e.g. an accounting firm engaged to perform transaction documents related to the issues under investigation? testing or a document collection vendor)? Who should receive such a notice? What types of documents or data should be preserved? How should There is no explicit provision over this matter. Privilege can be the investigation be described? How should compliance certainly asserted regarding attorney-client correspondence or with the preservation notice be recorded? in relation to documents and data found in the lawyer’s possession, but whether an equivalent effect would be also recognised Although it is not prescribed by law, the distribution of docu- over the assistance provided by third parties is open. ment preservation notices for the purposes of an internal investigation is considered an effective method to ensure that essen- 5.3 Do legal privileges apply equally whether tial evidence remains intact until it is collected and processed. in-house counsel or outside counsel direct the internal The investigation plan shall contain analytical details regarding investigation? the recipients of such notices, as well as the kinds of data which need to be preserved, and it would be advisable for the conductors of the investigation to request a signed copy of the preser- Yes, they do apply equally, provided that in-house counsel does vation notice, in electronic or natural form, so that an accurate not hold in parallel another position within the company (e.g. member of the board). record of the relevant procedure can be maintained. It should be particularly noted that when document preservation or hand- over is requested by the authorities or the prosecutor, an entity is 5.4 How can entities protect privileged documents expected to co-operate or submit its subjections, usually on the during an internal investigation conducted in your grounds of privileged information restrictions; otherwise, more jurisdiction? assertive methods could be brought into force (e.g. confiscation or dawn raids). Pursuant to art. 212 GCCP, information in the possession of certain professionals, including lawyers (also doctors, clerics, pharmacists, etc.), is considered privileged and as a consequence, 6.3 What factors must an entity consider when documents are located in multiple jurisdictions access to such data can be denied; furthermore, arts 263 and 264 (e.g. bank secrecy laws, data privacy, procedural GCCP explicitly forbid the seizure or confiscation of privileged requirements, etc.)? documents by prosecuting authorities. Moreover, special legislation might apply to certain types of confidential material (e.g. patents), calling for non-disclosure of this information or limited When gathering documents located in multiple jurisdictions, an access to it, even for the purposes of an internal investigation. entity will be inevitably confronted with different bank secrecy or data protection regimes (e.g. EU Member States must abide by the GDPR). With the aim to handle differentiated procedural 5.5 Do enforcement agencies in your jurisdictions keep requirements or substantial prerequisites and have the widest the results of an internal investigation confidential if access possible to the requested information, entities are advised to such results were voluntarily provided by the entity? co-ordinate the investigation across their international branches or their affiliate or subsidiary companies, as well as resort to special- Irrespective of an entity’s co-operation, evidence collected in the ised counsel who will be based in each jurisdiction involved. context of an investigation must not be made public, according to the relevant provisions of the GCCP. Unlike court hearings, pre-trial investigations are non-public. However, it is possible for 6.4 What types of documents are generally deemed such information to be communicated to other agencies, national important to collect for an internal investigation by your jurisdiction’s enforcement agencies? or foreign, through formal or informal channels, for the purposes of mutual judicial assistance (see also question 3.3 above). Documentation collected in the context of an internal investiga- 62 Data Collection and Data Privacy Issues tion can provide useful insight into the subject under examination. Electronic correspondence among the members of the entity or with outside parties (emails), data stored in the company’s servers, 6.1 What data protection laws or regulations apply to financial reports, transaction records and so on, should be care- internal investigations in your jurisdiction? fully preserved and reviewed, as not only do these constitute tangible proof related to the investigated allegations, but they can Given the absence of special legislation regulating internal also be used to direct subsequent employees’ interviews.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 78 Greece

6.5 What resources are typically used to collect clear to the interviewees that the conductors of the investiga- documents during an internal investigation, and which tion act, as a rule, on behalf of the company (i.e. the client). resources are considered the most efficient? Therefore, employees who wish to have a legal representative during the internal interviews can either make a pertinent agree- The collection of previously preserved documentation could be ment with the entity or seek legal counsel independently. The more efficiently carried out in co-ordination with the IT depart- presence of a legal representative, on behalf of the interviewee, ment of the entity. The transfer and loading of all relevant elec- will usually be advisable on condition that serious misconduct is being investigated, with possible implications on the individual tronic information into special platforms with separate backups, concerned. as well as the digitisation of hard copies, where possible, are techniques that would facilitate the arrangement and processing of the gathered material. 7.4 What are best practices for conducting witness interviews in your jurisdiction?

6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit See question 7.1. above. the use of predictive coding techniques? What are best practices for reviewing a voluminous document 7.5 What cultural factors should interviewers be aware collection in internal investigations? of when conducting interviews in your jurisdiction?

Specialised expertise and advanced technological methods may In our view, there are no notable cultural parameters to be taken prove to be very helpful when reviewing massive quantities of into account during the conducting of internal interviews in documents. The use of such techniques is still limited, yet is Greece. gradually expanding within the Greek jurisdiction.

7.6 When interviewing a whistleblower, how can 72 Witness Interviews an entity protect the interests of the company while upholding the rights of the whistleblower? 7.1 What local laws or regulations apply to interviews of employees, former employees, or third parties? What If an internal investigation has been triggered following a whis- authorities, if any, do entities need to consult before initiating witness interviews? tleblower’s complaint, then interviewing said individual should be one of the first steps to be taken. In doing so, the entity shall be in a position to better assess the credibility of the allegation There is no established protocol regarding the conducting and the overall disposition of the whistleblower, as well as to of interviews for the purposes of an internal investigation; determine more effectively the extent and scope of the internal as happens with most aspects of its plan, the procedure of investigation. The entity is required to take all available meas- employees’ examination falls within the competence of the ures to protect the whistleblower against retaliation, etc. department that is in charge of the investigation. Liaising with authorities with regard to this matter beforehand is not neces- 7.7 Can employees in your jurisdiction request to sary, except if deemed appropriate in the context of an overall review or revise statements they have made or are the co-ordination. statements closed?

7.2 Are employees required to cooperate with their Yes, they can. If employees wish to provide additional infor- employer’s internal investigation? When and under mation or revise previous statements, they should be given the what circumstances may they decline to participate in a option to participate in complementary interviews. witness interview?

7.8 Does your jurisdiction require that enforcement Employees are generally expected to co-operate throughout the authorities or a witness’ legal representative be present process of an internal investigation, since such duty stems from the during witness interviews for internal investigations? general commitment they maintain towards their employer. The particular terms contained in the employment contract should Neither is mandatory nor necessary. As far as legal representa- also be taken into account. A refusal to participate in internal tion of the interviewee is concerned, please see question 7.3 interviews would be justified especially on the grounds that the above. concerned employee does not wish to risk self-incrimination or wants to protect sensitive personal data. However, in this case disciplinary measures could be implemented by the company, 82 Investigation Report while a subsequent dismissal of the employee – subject to legal requirements – would not be ruled out. 8.1 How should the investigation report be structured and what topics should it address?

7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under Please see questions 2.3 and 4.1 above. what circumstances must an entity provide legal representation for witnesses?

Before the initiation of an internal interview, it shall be made

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Anagnostopoulos 79

Ilias G. Anagnostopoulos has advised and represented corporates and individuals in prominent cases in multiple jurisdictions over the past three decades. His practice focuses on complex matters involving financial fraud, corrupt and anti-competitive practices, tax and money-laundering offences, extradition and mutual assistance requests. He regularly offers his opinion, as a legal expert, in domestic and foreign jurisdictions. Since 2013, Ilias has chaired the Hellenic Criminal Bar Association (HCBA), and from 2006 to 2013 he chaired the criminal law committee of the Council of the Bars and Law Societies of Europe (CCBE). He is a professor in criminal law and criminal procedure at the School of Law, National and Kapodistrian University of Athens. Ilias has published extensively in Greek, English and German on matters of Hellenic, European and international criminal law, business and financial crimes, reform of criminal procedure and human rights.

Anagnostopoulos Tel: +30 210 729 2010 Patriarchou Ioakeim 6 Email: [email protected] Athens, 106 74 URL: www.iag.gr Greece

Padelis V. Bratis started at Anagnostopoulos as a trainee lawyer in 2018 and went on to become the firm’s youngest associate in 2020. He received his education from the Democritus University of Thrace, School of Law (LL.B., 2017), and completed his post-graduate studies in Criminal Law & Criminal Procedure at the Law School of Athens (LL.M., 2019). Padelis specialises in business crime and criminal corporate liability, competition law and market abuse offences, anti-money laundering and anti-corruption practices, extradition and mutual assistance, and European and international criminal law. He is a member of the Athens Bar Association.

Anagnostopoulos Tel: +30 210 729 2010 Patriarchou Ioakeim 6 Email: [email protected] Athens, 106 74 URL: www.iag.gr Greece

Anagnostopoulos is a leading practice established in 1986 that assists corporates and select individuals in managing criminal and regulatory risks. The firm is noted for combining sophisticated and practical advice with forceful litigation in a wide variety of practice areas, and over the years it has built a reputation as a high-end team of specialists who take a holistic and creative approach to complex cases and are fully committed to their clients’ needs, while upholding high standards of ethics and professional integrity. The firm responds to the emerging needs of corporate clients in respect to specific aspects of corporate governance and liability, drawing upon a solid knowledge base in corporate criminal liability, internal company investigations and compliance procedures, corruption practices and cartel offences. The firm’s litigation group is led by Ilias G. Anagnostopoulos, who is considered one of the foremost white-collar crime experts, while the firm is distinguished by its track record in high-profile cases. www.iag.gr

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 80 Chapter 13 Japan Japan

Akira Matsuda

Iwata Godo Minako Ikeda

12 The Decision to Conduct an Internal decide to apply for leniency in cartel or bid-rigging cases under the Antimonopoly Act (Act No. 54 of April 14, 1947) and reach Investigation out to the Japan Fair Trade Commission (JFTC). As a result of a successful leniency application, administrative fines (surcharges) 1.1 What statutory or regulatory obligations should can be exempted or reduced depending on the applicant’s an entity consider when deciding whether to conduct an ranking. Accordingly, when an entity detects possible cartel internal investigation in your jurisdiction? Are there any conduct, it is critical to conduct an internal investigation without consequences for failing to comply with these statutory delay to gather sufficient information to assess and determine or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? the possibility or the benefit of a leniency application. In some cases (first applicant), criminal prosecution can be avoided in this context. Another example of a legal upside is the reduced There are no specific statutory or regulatory obligations to penalty in misleading representation cases granted to entities conduct an internal investigation under Japanese law even when which voluntarily report their misconduct under the Act against there is suspicion of wrongdoing, except for certain consumer Unjustifiable Premiums and Misleading Representations (Act product matters, where reporting to relevant ministers is No. 134 of 1962). required in case of recall or serious accident when the relevant minister in Japan orders the entity to do so. Accordingly, the decision to commence an internal investi- 1.2 How should an entity assess the credibility of a gation is entirely at the discretion of the company. In reality, whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal however, many companies decide to conduct internal investi- implications for dealing with whistleblowers? gations when they discover potential breaches so that they can assess their exposure ahead of formal investigations by the regulators and ensure that directors and senior management discharge It is common for entities to become aware of possible corporate their duties to the company. Entities generally conduct a prelim- misconduct through whistleblowing. Once an entity receives a inary internal investigation as soon as they become aware of the whistleblower’s complaint, it should carefully consider the infor- possibility of past or ongoing misconduct to assess its seriousness mation reported by the whistleblower and conduct a preliminary and the impact on their business in order to decide whether to investigation to assess the credibility of the complaint, unless it conduct a full-scale investigation as the next step. It is standard is clearly groundless. practice in Japan to involve outside counsel in both the prelimi- The Whistleblower Protection Act of 2004 (WPA) protects nary internal investigation and the full-scale investigation. those who expose corporate or government misconduct from A director’s duty of care to the company could force senior unfair treatment and retribution (for example, dismissal, management to decide to commence internal investigations. demotions or salary cuts). Under the WPA, a “public interest Under the Companies Act of Japan (Act No. 86 of July 26, disclosure” involves the disclosure of the Relevant Disclosure 2005), a director owes a duty of care to the company and if a Information (as defined below) by a worker to his employer, director fails to conduct an investigation despite being aware of a government agency or official having jurisdiction, or any the possibility of misconduct, such a director may be found to other person, to prevent a matter from occurring or wors- be in breach of his duty to mitigate losses or damage suffered ening. Disclosures cannot be made for illegitimate purposes. by the company. Further, industry-specific statutes or regula- “Relevant Disclosure Information” means information regarding tions may indirectly compel an entity to conduct investigations. criminal conduct or statutory violations relating to the protec- For example, when an entity learns about issues relating to the tion of consumer interests, the environment, fair competition efficacy or safety of its pharmaceuticals or medical devices, it and generally the life, body and property of the public. is obliged to report the issue to the authorities and, in order to Further to June 2020 amendments to the WPA, due to become observe such obligation, an investigation, even preliminary, effective by June 2022 at the latest, companies employing more must be conducted beforehand. than 300 employees in Japan will have to establish a whistle- Some self-regulatory organisations such as the Japan Exchange blowing system and designate a person responsible for whistle- Regulation have established their own guidelines setting forth blowing-related matters. The detail of the system and require- obligations to make efforts to conduct investigations in case a ments will be announced through explanatory guidelines. The listed company becomes aware of misconduct. requirements will likely include having a proper policy, helpline, One example of the legal benefit of conducting an internal disciplinary sanctions in case of breach of the internal whistle- investigation is that a company (cartelist or bid rigger) may blowing rules, rules prohibiting retaliation and the inappropriate

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Iwata Godo 81

treatment of whistleblowers and rules dealing with confidenti- Even if the results of a duly conducted internal investigation ality and information leakage. A person in charge of whistle- disclosed by the entity to the enforcement authority show that blowing matters will need to be appointed under the amended there is no misconduct, this would still be considered a favour- WPA. The definition of “whistleblowers” to be protected able point by the enforcement authority. Even if evidence under the WPA is broadened to include those who have retired supporting the existence of misconduct is found during the within the previous 12 months and certain officers in addi- internal investigation, it is generally advisable to disclose such tion to workers under the current WPA. Also, the protection evidence to the enforcement authorities to prove one’s willing- is enhanced to add immunity for whistleblowers from liabilities ness to come clean. for damage associated with their reporting. Furthermore, in 2018 Japan introduced a judicial dealing system (Shiho Torihiki Seido) for certain crimes, including white- collar crimes (similar to the US plea bargaining system). Under 1.3 How does outside counsel determine who “the client” is for the purposes of conducting an internal this system, an enterprise or individual accused of a viola- investigation and reporting findings (e.g. the Legal tion may enter into an agreement with the prosecutor under Department, the Chief Compliance Officer, the Board of which the accused agrees to cooperate through the provision Directors, the Audit Committee, a special committee, of evidence or testimonies that can help convict a third party etc.)? What steps must outside counsel take to ensure (enterprise or individual), and in exchange the prosecutor agrees that the reporting relationship is free of any internal to drop or reduce criminal charges. conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the 2.2 When, during an internal investigation, should a investigation? disclosure be made to enforcement authorities? What are the steps that should be followed for making a disclosure? When conducting an internal investigation, the identity of “the client” will depend on many factors such as the nature of the suspected misconduct, the person or the department within the As disclosing the results of internally conducted investigations entity suspected of being involved in the misconduct and who or is not a legal obligation, the timing will depend on the facts of whose body/department has commenced the investigation. The the case. board of directors or board of corporate auditors often becomes Where the authority has already commenced an investi- the client. When a member of the board of directors is the target gation and the target entity reasonably believes that there are of an investigation, the client may be the director in charge of no grounds for alleging or suspecting any misconduct or the legal and/or the compliance department. authority is mistaken in making allegations, the entity should In order to avoid internal conflicts and ensure due process consider voluntarily notifying the authority and submitting and the fairness and credibility of the internal investigation, supporting evidence at an early stage. It will become difficult the person or department suspected of being involved in the for the authority to change the direction of the investigation misconduct is typically excluded from internal reporting once it has spent some time on it or overturn any decisions it lines when an internal investigation is conducted. To achieve has already made. complete independence from internal reporting lines, outside In certain cases, the entity should disclose the results of counsel may recommend setting up a Third-Party Committee an internal investigation to the authority before the authority (see question 4.1 below). It has been a trend in Japan in recent commences its investigation to enjoy the benefit of making a years for companies and other organisations to set up Third- voluntary disclosure. For example, in misleading representa- Party Committees in cases of serious misconduct in order to tion cases, in order for the entity to be eligible for a reduction ensure the fairness and impartiality of investigations. in penalty, it must report to the CAA misconduct punished by the Act against Unjustifiable Premiums and Misleading 22 Self-Disclosure to Enforcement Representations (Act No. 134 of 1962) before the entity becomes aware of the investigation commenced by the CAA. Authorities In any case, it is advisable to consult with outside counsel before making any disclosure to a regulatory authority, as disclo- 2.1 When considering whether to impose civil or sure could lead to documents shared with them being subject to criminal penalties, do law enforcement authorities in document production requests by the other party in Japanese your jurisdiction consider an entity’s willingness to litigation, or a loss of client-attorney privilege where it can be voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider? protected (in countries such as the US (please see questions 5.1 and 5.5 below)).

In general, enforcement authorities such as the JFTC (especially in the context of the new leniency rules and administrative 2.3 How, and in what format, should the findings of an surcharges policy to be implemented as of 25 December 2020), internal investigation be reported? Must the findings of an internal investigation be reported in writing? What Consumer Affairs Agency (CAA), Financial Services Agency risks, if any, arise from providing reports in writing? (FSA), Securities and Exchange Surveillance Commission (SESC), Personal Information Protection Committee (PPC), and Public Prosecutors Office (PPO) take into account the will- The findings do not have to be presented to the authorities ingness of the entities involved to cooperate as a mitigating in writing; however, the authorities may request the entity to factor when considering whether to impose penalties and the report the findings in writing. Further, written form may be severity of the penalties. Therefore, the voluntary disclosure the most suitable way depending on the nature of the findings. of the results of an internal investigation to the enforcement Sometimes the format is prescribed by the regulator (e.g., for authorities is generally considered a positive step and a miti- leniency applications to be made with the JFTC). gating factor. One of the risks of providing reports in writing to the enforcement authority voluntarily is that the entity may be forced to

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 82 Japan

submit it as evidence in litigation. Under Japanese law, a party 3.3 Do law enforcement authorities in your jurisdiction in a litigation may petition the court to issue an order against the tend to coordinate with authorities in other jurisdictions? other party or a third party to submit documents in its possession What strategies can entities adopt if they face when the other party refuses to voluntarily provide such docu- investigations in multiple jurisdictions? ments as evidence or a third party refuses to cooperate. This is a limited process subject to stringent conditions that has not much Cases of coordination have increased over the years. to do with discovery in the US. One of the important excep- The JFTC has entered into international cooperation agree- tions applies to documents prepared exclusively for the use of the ments on the enforcement of competition laws with the US, EU person in possession thereof (an “own-use document”) (Article and Canada. The JFTC is actively cooperating with competi- 220 (iv)(d) of the Code of Civil Procedure (Act No. 109 of 1996)). tion authorities in several jurisdictions. Memoranda on compe- In July 2019, although this is still a lower court decision, the Osaka tition have been made with many countries and the partnership High Court ruled that an internal investigation report in general agreements to which Japan is a party include competition-related did not qualify as an “own-use” document if such a report was provisions (Chapter 16 of the Comprehensive and Progressive shared with the enforcement authorities on a voluntary basis. Agreement for Trans-Pacific Partnership and Chapter 11 of the Agreement between The European Union and Japan for an 32 Cooperation with Law Enforcement Economic Partnership). Under Article 43-2 of the Antimonopoly Authorities Act, the JFTC can exchange information with foreign competition authorities for the enforcement of their own antitrust laws under strict conditions and provided the exchange of informa- 3.1 If an entity is aware that it is the subject or tion does not interfere with the implementation of the Act or target of a government investigation, is it required to conflict with the interests of Japan. For criminal procedures, liaise with local authorities before starting an internal the Act on International Assistance in Investigations and Other investigation? Should it liaise with local authorities even if it is not required to do so? Related Matters of 1980 serves as a basis for cooperation between the Minister of Justice and its foreign counterparts. It is prudent to presume that the local enforcement authorities There is no legal obligation to liaise with the authorities before may at one point during their investigation get hold of informa- starting an internal investigation. The timing is left to the tion in the possession of foreign authorities, and therefore enti- discretion of the entity. ties that conduct business in multiple jurisdictions should pay However, in certain cases, the entity should liaise with the attention to the consistency of their position generally regarding authorities, not necessarily before starting the internal investiga- suspected breaches, and of their position with the information tion but in the course of the investigation, to move the internal they provide to authorities in several jurisdictions. investigation in the right direction. Where an entity learns of possible misconduct through the launching of a government 42 The Investigation Process investigation, the entity does not always have knowledge of the specific allegations or the details of the suspected viola- 4.1 What steps should typically be included in an tion. Therefore, the target entity should contact and try to hold investigation plan? regular meetings with the authorities to find out what the allegations or suspected breaches are in order to properly conduct its internal investigation and collect appropriate evidence to The typical steps an entity should take once it becomes aware support its position, regardless of whether it will be denying or of actual or suspected misconduct are to: (i) conduct a prelim- admitting any allegation or suspicion of wrongdoing. inary investigation in order to assess the risks and elaborate an It is also advisable to contact the enforcement authorities as overall plan to deal with the misconduct; (ii) determine whether they take into account the entity’s willingness to cooperate as a to conduct the investigation internally or to set up a Third-Party mitigating factor when deciding whether to impose a penalty; Committee; (iii) preserve, collect and assess relevant documents, e-mails and other data (both hard and soft copies) and interview or, if they do, at what level. relevant persons such as employees and directors; and (iv) (if the existence of misconduct is confirmed) analyse the causes of the 3.2 If regulatory or law enforcement authorities misconduct, consider preventive measures and implement such are investigating an entity’s conduct, does the entity measures. have the ability to help define or limit the scope of a A Third-Party Committee is an independent and neutral body government investigation? If so, how is it best achieved? consisting of external experts with no conflict of interest with the entity, generally tasked by the entity to investigate, analyse While there is no formal system under which the target entity the causes of misconduct and propose preventive measures or may request the authorities to limit the scope of the investiga- remedies. Companies in Japan generally set up a Committee tion, in practice, the target entity may do so by close cooper- in cases where the misconduct involves directors and senior ation with the authorities and outside counsel. For example, management, or where the misconduct is of such magnitude the JFTC may open an investigation into a case of abuse of that it will have repercussions in public. This step is needed superior bargaining position based on reports by businesses to ensure transparency and accountability towards stakeholders that allege they are being subject to abuse; however, the JFTC and avoid reputational and credibility risks. itself may not be clear which specific actions of the target entity If the entity decides to set up a Third-Party Committee, the may be deemed an abuse at an early stage of the investiga- assessment of documents and interviewing of employees/directors tion. Therefore, through proper explanations and the supply (see (iii) above) are conducted by the Committee. For step (iv) of appropriate materials to help the JFTC to accurately under- above, the Committee will prepare a report in which it analyses the stand its business, the target entity may influence the JFTC’s causes of misconduct and recommends preventive measures. This next steps in limiting the scope of the investigation and circum- report may be addressed to the entity itself or the board of direc- scribing the allegations and their legal qualification. tors or statutory auditors, depending on which body is heading the investigation and has decided to set up the Committee.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Iwata Godo 83

In addition to the Third-Party Committee, in case the assess- Pre-existing materials created before consulting the attorney, ment of directors’ or statutory auditor’s civil liability is required, materials indicating facts underlying confidential communication it is standard practice in Japan to set up a Liability Investigation regarding legal advice between the enterprise and attorney: these Committee consisting of independent outside counsel/attorneys so-called primary materials/fact-finding materials are outside with no conflict of interest either with the entity, the target of the scope of the arrangement. The enterprise must request the the investigation, or the board of directors and/or the board benefit of this system at the time of an order for submission. A of statutory auditors. The Committee will report the results of so-called determination officer will vet the materials earmarked the investigation to either the board of directors (when statu- as privileged by the enterprise and confirm whether these docu- tory auditors’ liability is at stake) or the board of auditors (when ments satisfy specific requirements such as proper labelling and directors’ liability is at stake), and these results are used as a basis storage, and restrictions on the scope of persons who have knowl- for their decision on whether or not to commence legal actions edge of the content of the confidential information. Enterprises against directors or statutory auditors. that wish to have certain documents treated as privileged under this system must submit to the JFTC a summary of such documents, including information such as: 4.2 When should companies elicit the assistance of outside counsel or outside resources such as forensic ■ the date of preparation of the documents; consultants? If outside counsel is used, what criteria ■ the name of the person who has prepared the documents; or credentials should one seek in retaining outside ■ the names of persons with whom the documents were counsel? shared; the attributes and summary of each documents; and ■ any out-of-scope documents included in the log to the It is standard practice for companies in Japan to obtain assis- JFTC. tance from outside counsel and set up an Internal Investigation As this summary must be submitted to the JFTC within two Committee or a Third-Party Committee when conducting inves- weeks after the JFTC issues the order for submission of docu- tigations in order to ensure adequate accountability and transpar- ments, enterprises should advisably keep track of communica- ency for the benefit of stakeholders. Under very limited circum- tions/materials that may qualify as privileged under this system. stances, where only a minor type of misconduct is suspected, may investigations be carried out internally; such cases are rare. 5.2 Do any privileges or rules of confidentiality apply Consulting a forensic expert and IT consultant is also to interactions between the client and third parties frequent, depending on the volume of digital data that needs to engaged by outside counsel during the investigation be reviewed for the investigation. (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)? 52 Confidentiality and Attorney-Client Privileges Communication between the client and third parties other than attorneys are not privileged under Japanese law. Although not a privilege strictly speaking, attorneys, doctors 5.1 Does your jurisdiction recognise the attorney- and other professionals and experts to whom confidential infor- client, attorney work product, or any other legal privileges in the context of internal investigations? What mation has been disclosed may refuse to testify and give evidence best practices should be followed to preserve these (Code of Civil Procedure, Article 197-1(2)) or refuse to submit privileges? documents (Article 220) regarding facts that have come to their knowledge in the performance of their duties. However, Article 197-1(2) does not apply where the witness is released from his or Attorney-client privilege and protection under the attorney her professional duty of secrecy under Article 197. The attorneys’ work-product doctrine are currently not recognised in Japan. obligation to keep secret information obtained in confidence However, when an investigation is conducted globally, Japanese while carrying out their professional duties is also stated under entities should pay attention to the handling of information Article 23 of the Lawyers’ Law (Law No. 205 of 10 June 1949). which may be privileged when submitted in other jurisdictions. For example, under US laws, if an entity waives the privilege by disclosing certain attorney-client privileged communication, it 5.3 Do legal privileges apply equally whether may be considered that it has also waived privilege to other infor- in-house counsel or outside counsel direct the internal mation which relates to the same subject matter as the commu- investigation? nication which has been disclosed. Therefore, it is crucial that Japanese entities carefully examine which information is privi- No legal privilege is recognised under Japanese law. leged or protected in foreign jurisdictions and take measures to protect important information under the legal privileges. 5.4 How can entities protect privileged documents For cartel investigations, the JFTC has established new proce- during an internal investigation conducted in your dures for administrative investigations to address concerns jurisdiction? regarding attorney-client privilege, which will become effective on 25 December 2020. Attorney-client privilege will be protected in administrative investigations into unreasonable restraint of As mentioned in question 5.1 above, it is important for enti- trade prohibited under Article 3 of the Antimonopoly Act, under ties that are subject to global or multijurisdictional investiga- which confidential communications between an enterprise and tions to be aware of legal privilege rules in force in each rele- its attorney that address legal issues and satisfy certain conditions vant foreign jurisdiction and take measures to protect privileged will not be able to be accessed by the investigators and must be information. Entities should advisably consult with counsel returned to the enterprise. The JFTC will establish rules under to first understand the scope of the legal privileges, then mark Article 76 of the Antimonopoly Act and guidelines based on the privileged documents and data accordingly and store them sepa- principles described below. rately from other documents or data.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 84 Japan

5.5 Do enforcement agencies in your jurisdictions keep 6.4 What types of documents are generally deemed the results of an internal investigation confidential if important to collect for an internal investigation by your such results were voluntarily provided by the entity? jurisdiction’s enforcement agencies?

While enforcement authorities are not legally obliged to keep While there are no guidelines, examples of types of documents the results of internal investigations voluntarily submitted by and data deemed important for an internal investigation are the entities, they may negotiate with the authorities and request documents requesting internal corporate approvals (Ringisho), them not to disclose the results to third parties (except for the meeting minutes, schedules, planners, memos, financial records, JFTC in antitrust investigations, where JFTC officials are under invoices and receipts, contracts, internal policies and proce- a duty to keep confidential any confidential information that dures, internal audit reports, and internal communication via comes to their knowledge while carrying out their duties under e-mail or chat, etc. the Antimonopoly Act (with certain exceptions)). Generally speaking, entities should keep in mind that the court 6.5 What resources are typically used to collect may issue an order to submit documents to a third party (see documents during an internal investigation, and which question 2.3 above) as well as request a third party, upon petition resources are considered the most efficient? from a party, to voluntarily provide documents in its possession for submission as evidence. Such third party may also include Depending on the volume of digital data, entities typically enforcement authorities. Once submitted as evidence in litiga- retain forensic experts and IT consultants to collect, extract and tion, results of the internal investigation would generally become analyse the relevant data from their servers. available to the public.

62 Data Collection and Data Privacy Issues 6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are 6.1 What data protection laws or regulations apply to best practices for reviewing a voluminous document internal investigations in your jurisdiction? collection in internal investigations?

The Act on the Protection of Personal Information (the APPI) There are no restrictions on the use of predictive coding (Act No. 57 of 2003) is the principal Japanese data protection techniques. legislation in the private sector. The PPC has adopted guide- Methods for effective review of voluminous data, for example lines to ensure the proper and effective implementation of the e-mail correspondence, include the deletion of duplicated APPI by businesses. The PPC’s general guidelines supplement messages, narrowing down by dates and sender/receiver of the the APPI, and separate guidelines apply to specific sectors such messages and use of technology-assisted review such as keyword as the finance, medical and telecommunications sectors. These search. AI-based narrowing-down of data is not yet prevalent laws and regulations also apply to internal investigations. In in Japanese practice. It is important not to excessively limit the 2020, the Diet passed a bill to amend the APPI and the amend- scope, as preservation and collection of data are done at an early ments are expected to come into force in early 2022. stage of the investigation when the scope and target of the investigation are often set tentatively. 6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document 72 Witness Interviews preservation notice to individuals who may have documents related to the issues under investigation? Who should receive such a notice? What types of 7.1 What local laws or regulations apply to interviews documents or data should be preserved? How should of employees, former employees, or third parties? What the investigation be described? How should compliance authorities, if any, do entities need to consult before with the preservation notice be recorded? initiating witness interviews?

It is not a legal requirement to prepare and issue a document There are no laws or regulations that apply to interviews of preservation notice in Japan. However, as collection of objec- employees, former employees, or third parties in Japan. Further, tive evidence such as documents and data is important in effec- there is no legal obligation for the entity to consult with the tively conducting an investigation, an entity could issue a notice authorities before initiating witness interviews. to specific individuals or relevant departments or bodies within the entity to preserve documents and data relevant to the 7.2 Are employees required to cooperate with their investigation. employer’s internal investigation? When and under what circumstances may they decline to participate in a witness interview? 6.3 What factors must an entity consider when documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural In general, employees are required to cooperate with their requirements, etc.)? employers’ internal investigation because even if such obligations are not provided for in employment contracts or office An entity in Japan should check whether documents located in work rules and other regulations, employers may order their foreign jurisdictions include personal data, as transfer of such employees to cooperate as part of the exercise of their authority documents may be subject to cross-border transfer restrictions as employers. However, employees may decline to cooperate under the data protection laws and regulations of those foreign with their employers’ internal investigation when they have jurisdictions. reasonable ground to do so.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Iwata Godo 85

7.3 Is an entity required to provide legal representation 7.7 Can employees in your jurisdiction request to to witnesses prior to interviews? If so, under review or revise statements they have made or are the what circumstances must an entity provide legal statements closed? representation for witnesses? Employees may request to review or revise their statements. If An entity is not legally required to provide legal representation a revision is made, it should be reflected in the investigation to witnesses. report.

7.4 What are best practices for conducting witness 7.8 Does your jurisdiction require that enforcement interviews in your jurisdiction? authorities or a witness’ legal representative be present during witness interviews for internal investigations? Interviews should be conducted subject to consent and the existence and contents of such interviews should be kept confiden- There are no such general requirements under Japanese law. tial. For more effective results, interviewers should be well However, if the interviewee requests the presence of his/her prepared and briefed and have sufficient background informa- legal representative during the interview, the interviewer may tion on the alleged misconduct before conducting the inter- have to allow them to be present in order to secure the interviews. Further, the interviews should ideally be conducted in viewee’s cooperation. the presence of an outside counsel to maintain the fairness of the procedure and the credibility of the results of the interview. 82 Investigation Report

7.5 What cultural factors should interviewers be aware 8.1 How should the investigation report be structured of when conducting interviews in your jurisdiction? and what topics should it address?

Interviewers should be polite and courteous and explain the A typical report conducted by a Third-Party Committee will purpose of the interview to obtain full cooperation from the cover the following topics: (i) purpose and background of the interviewees. It is important, when relevant, to clarify that the establishment of the Committee; (ii) overview of the target(s) investigation conducted by the entity is not intended to pursue of the investigation; (iii) investigation process such as preser- the employees’ liability or penalise them, but that the purpose is vation and collection of documents, interviews, and digital to investigate the facts, analyse the causes of misconduct, and forensic investigations; (iv) facts of the case analysed and issues identify preventive measures. determined as a result of the investigation; (v) assessment from a legal and/or a tax and accounting perspective; (vi) analysis of the causes of misconduct; and (vii) proposal identifying preven- 7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while tive measures, remedies and legal action/complaints. upholding the rights of the whistleblower? In some cases, the Committee produces a full version as well as a redacted version masking personal information and other business-related confidential information for publishing To avoid any witch hunt within the entity and the discour- purposes. aging of employees from using the whistleblowing system, the entity should inform the interviewed whistleblower that his/ her identity will remain confidential and that any information that may lead to the identification of the whistleblower will not be released. However, such confidential information could be disclosed in the litigation.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 86 Japan

Akira Matsuda is an attorney-at-law (admitted in Japan and New York) and a partner at Iwata Godo heading the AI/TMT and Data Protection practice group. He is based in Tokyo and Singapore. His practice focuses on cross-border transactions including mergers and acquisitions, as well as international disputes (litigation/arbitration), and advice on digital/TMT-related matters. Mr. Matsuda regularly advises Japanese and foreign clients on data security issues (Japanese laws, the Singapore Personal Data Protection Act (PDPA), and the EU General Data Protection Regulation (GDPR)), including on the structuring of global compliance systems. He also advises in complicated cross-border corporate investigation matters. He is a graduate of the University of Tokyo (LL.B.) and Columbia Law School (LL.M.).

Iwata Godo Tel: +81 3 3214 6205 Marunouchi Building 15th Floor Email: [email protected] 2-4-1, Marunouchi URL: www.iwatagodo.com Chiyoda-ku, Tokyo Japan

Minako Ikeda is an associate at Iwata Godo specialising in general corporate and dispute resolution. She handles many cross-border transactional matters as well as national/cross-border disputes. She also has experience in corporate investigation and criminal defence.

Iwata Godo Tel: +81 3 3214 6205 Marunouchi Building 15th Floor Email: [email protected] 2-4-1, Marunouchi URL: www.iwatagodo.com Chiyoda-ku, Tokyo Japan

Iwata Godo was established in 1902 and is one of Japan’s premier law firms. It is a full-service firm numbering around 80 attorneys. Iwata Godo assists its corporate clients in upgrading their internal controls, risk management policies and other corporate governance functions to prevent white-collar crime, including misuse of assets, insider trading or data protection breaches. It advises its clients and their boards on effective governance structures and compliance. The firm has many years of experience in advising on shareholder and boardroom disputes. It represents clients in investigations by regulators and prosecutors on regulatory and accounting issues, shareholder claims, directors’ liabilities, and other complex situations. A number of the firm’s attorneys have spent time with the regulators, while others have practised as judges or prosecutors. As a result, Iwata Godo can efficiently assist its clients in conducting or responding to investigations, and the firm has been involved in many high-profile cases. www.iwatagodo.com

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 14 87

Netherlands Netherlands

Niels van der Laan

De Roos & Pen Jantien Dekkers

12 The Decision to Conduct an Internal 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an Investigation internal investigation is necessary? Are there any legal implications for dealing with whistleblowers? 1.1 What statutory or regulatory obligations should an entity consider when deciding whether to conduct an An employer for whom 50 people or more work is obliged internal investigation in your jurisdiction? Are there any to have an internal reporting procedure for abuses under the consequences for failing to comply with these statutory or regulatory regulations? Are there any regulatory or Whistleblowers Authority Act. Corporate Governance Codes legal benefits for conducting an investigation? also require listed companies and companies in specific sectors (e.g. the cultural, healthcare or education sectors) to have reporting procedures. This procedure sets out how whistle- The Netherlands does not have a statutory framework that blowers can report, what happens with that report and what prescribes when or how to conduct internal investigations. protection is given to whistleblowers. In any case, an employee However, investigating potential wrongdoing is considered who makes a report of an abuse in the correct manner may not be an integral part of an adequate risk management and control disadvantaged for that reason. Complaints by the whistleblower system. Larger companies must annually report in writing to of being disadvantaged may warrant an investigation by the the supervisory board on risks and internal controls. Corporate Whistleblowers Authority, civil liability and administrative fines. governance codes, when applicable, require management boards to report in their annual statement on the effectiveness of the design and the operation of their internal risk management 1.3 How does outside counsel determine who “the client” and control systems. Investigating wrongdoing is also essen- is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal Department, the tial for financial institutions given their statutory obligation Chief Compliance Officer, the Board of Directors, the to report any “integrity incidents”. Lastly, external account- Audit Committee, a special committee, etc.)? What steps ants must report internal fraud and withhold approval of the must outside counsel take to ensure that the reporting financial statements, unless irregularities are properly inves- relationship is free of any internal conflicts? When is tigated and effective compliance measures prevent reoccur- it appropriate to exclude an in-house attorney, senior rence. Ignoring indications of wrongdoing may lead to civil or executive, or major shareholder who might have an interest in influencing the direction of the investigation? criminal liability of the entity or its directors, especially if they allowed incidents to reoccur. Immediate and effective action may avert liability and/or an investigation or report of fraud by In internal investigations, the entity itself is usually recognised the external accountant. Presenting a plan for an internal inves- as the client. Instructions to outside counsel can be given by a tigation may in some cases also prevent enforcement agencies representative body of the entity, which may also elect a contact from starting their own – intrusive – investigation and positively person to oversee the internal investigation. The client, the impact the handling of the case by the authorities (see questions scope of the work and to whom outside counsel reports should 2.1 and 2.2). be identified in the engagement letter. It is best practice to During internal investigations, Dutch privacy, data protection exclude all persons connected to the incident under scrutiny, and labour law rules should be observed (see sections 6 and 7). who could potentially be implicated for any wrongdoing, from Violation of these laws may give rise to civil liability and adminis- involvement in the internal investigation. trative and/or criminal sanctions. The professionals conducting the internal investigations are bound by the disciplinary rules 22 Self-Disclosure to Enforcement of their professional associations. The Dutch Secretary of State Authorities for the Department of Justice and Security recently indicated in a parliamentary debate that there was no intention to formu- 2.1 When considering whether to impose civil or late further instructions on how internal investigations should criminal penalties, do law enforcement authorities in be conducted. your jurisdiction consider an entity’s willingness to voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider?

There is no legal provision that provides that voluntary self-

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 88 Netherlands

disclosure may lead to immunity from prosecution, reduction of governmental) authorities before starting an internal investiga- penalties or leniency measures. However, voluntary self-disclosure tion. It is advisable to only liaise with the authorities if the entity may be interpreted as cooperation with the authorities and will- can benefit from a cooperative attitude towards the authori- ingness to take responsibility and improve compliance, which may ties. Cooperation may facilitate and expedite a criminal inves- positively affect the decision whether or not to prosecute, offer tigation and ultimately lead to sanctions for the entity. Also, an out-of-court settlement or reduce the penalty. The authori- informing the authorities of an ongoing internal investigation ties will take into consideration all facts and circumstances of the without ultimately disclosing the findings may negatively impact case, including the seriousness of the acts committed, the type the entity’s reputation and goodwill with the Public Prosecutors’ of organisation, criminal intent and/or knowledge at manage- Office. We note that in 2019, the Public Prosecutors’ Office and ment or board level, cooperation with the authorities, subsequent Secretary of State for the Department for Justice and Security introduction of compliance measures, disciplinary sanctions, opened the discussion on having companies conduct internal changes in the organisation and/or management and other rele- investigations under direction of the enforcement authorities, vant circumstances, such as a significant lapse of time. We note to make more efficient use of their limited means. It is not yet that in May 2019, the Public Prosecutor’s Office announced that clear how the proposals would work in practice and/or whom it was considering whether to introduce sentencing guidelines to would be appointed to execute such internal investigations. As encourage self-reporting, but these have not been put forward yet. the proposals were met with a lot of criticism, it is uncertain if such a policy will be implemented in the future. 2.2 When, during an internal investigation, should a disclosure be made to enforcement authorities? What are 3.2 If regulatory or law enforcement authorities the steps that should be followed for making a disclosure? are investigating an entity’s conduct, does the entity have the ability to help define or limit the scope of a government investigation? If so, how is it best achieved? Entities themselves may decide if and when to report their findings to the authorities. If possible, it is preferable to disclose after the facts have been established, disciplinary sanctions have There is no right to help define or limit the scope of a govern- been taken and effective compliance measures have been intro- ment investigation. By presenting a plan for a thorough internal duced, as this may prevent enforcement agencies from starting investigation, companies may prevent enforcement agencies their own intrusive investigation, curtail negative media expo- from starting their own investigations. Additionally, entities may sure and positively impact the handling of the case by the try to influence the scope of the authorities’ activity informally authorities (see question 2.1). However, the entity may require by liaising with the enforcement agencies and/or restricting their the investigative powers of enforcement agencies to establish cooperation to certain incidents or activities. the facts or find the perpetrator. In such cases, management may weigh the interest of the entity in finding the perpetrator 3.3 Do law enforcement authorities in your jurisdiction versus the disadvantage of potential criminal or administrative tend to coordinate with authorities in other jurisdictions? sanctions and reputational damage from self-disclosure. What strategies can entities adopt if they face investigations in multiple jurisdictions? 2.3 How, and in what format, should the findings of an internal investigation be reported? Must the findings of It is common practice for Dutch enforcement agencies to coop- an internal investigation be reported in writing? What erate and coordinate with other jurisdictions in cross-border risks, if any, arise from providing reports in writing? investigations. Similarly, the defence should seek local counsel in each jurisdiction to confer effectively on strategy and poten- There is no legal framework for the format in which the find- tial issues. ings have to be reported. A written report – especially when substantiated and provided with attachments – is more manage- 42 The Investigation Process able than a sole oral statement and therefore more likely to be followed up on. This is an advantage if the entity wishes the 4.1 What steps should typically be included in an authorities to take action against another legal or natural person. investigation plan? However, it may be a disadvantage if the entity itself is at risk of sanctions. For the overall advantages and disadvantages of The investigation plan should include a clear research question, written or oral reports, please see question 8.1. The Secretary of the scope of the investigation, approach (including the collec- State for the Department of Justice and Security recently stated tion of data and research methods), a timeline and estimated time that the report should have sufficient depth and be complete in investment. The plan should carefully weigh the entity’s legit- order to prevent a government investigation and to positively imate interest in investigating irregularities against employees’ contribute to the enforcement decision. privacy concerns and substantiate the choice of research method. 32 Cooperation with Law Enforcement 4.2 When should companies elicit the assistance of Authorities outside counsel or outside resources such as forensic consultants? If outside counsel is used, what criteria 3.1 If an entity is aware that it is the subject or or credentials should one seek in retaining outside target of a government investigation, is it required to counsel? liaise with local authorities before starting an internal investigation? Should it liaise with local authorities even if it is not required to do so? Outside counsel should be approached for advice on the investigative methods and in order to extend privilege to the internal investigation, so that the entity is not obliged to disclose its find- An entity is not required to liaise with state (local or ings to enforcement agencies and/or injured parties. Outside

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London De Roos & Pen 89

resources should be engaged when cost- and/or time-effective Attorneys working in the Netherlands must abide by the regu- or if there is a need for expertise in a specific field. Privilege is lations of the Dutch Bar Association, amongst which is the extended to outside professionals if engaged by and contacted requirement for in-house attorneys and their employer to sign through the attorney (see question 5.2). Under certain circum- a model contract (“Professional Statuut ”) safeguarding the attor- stances, it may be advisable to hire an outside counsel without ney’s professional independence. We note that the investigative a previous connection to the company, in order to execute the judge in the criminal investigation against Royal Dutch Shell internal investigation in the most independent fashion. This on bribery charges recently denied legal privilege for in-house would make the internal investigation more reliable and cred- attorneys in other jurisdictions where professional independ- ible for enforcement agencies to whom it would be disclosed, and ence was insufficiently safeguarded. According to the investiga- thus positively impact their enforcement decision. tive judge, this was the case because the head of the company’s legal department was also on the executive board, presenting a 52 Confidentiality and Attorney-Client potential conflict of interest. The ruling was met with heavy Privileges criticism and has been appealed. In addition, the European Court of Justice has not accepted full legal privilege for in-house attorneys in competition law cases, thus restricting their legal 5.1 Does your jurisdiction recognise the attorney- privilege in Dutch competition investigations. client, attorney work product, or any other legal privileges in the context of internal investigations? What best practices should be followed to preserve these 5.4 How can entities protect privileged documents privileges? during an internal investigation conducted in your jurisdiction? The Netherlands recognises attorney-client privilege in the context of internal investigations. Attorneys, their staff and the It is recommended to mark all privileged correspondence as “priv- client (and his/her staff) may invoke confidentiality and have ileged and confidential” and all documents/memoranda to and the right to refuse to give evidence with regard to any corre- from attorneys as “attorney-client work product”. Correspondence spondence or documents prepared by or for the attorney, both with third parties should be routed via the attorney. Also, it is in criminal and civil proceedings. In 2015, a lower court recog- recommended to keep attorney-client correspondence, both in nised an exemption when the attorney reported its findings as physical or digital form, in separate folders marked as privileged. being purely factual and without any legal qualification, conclu- This facilitates the identification of the documents or correspond- sion or advice. This decision met heavy criticism. However, ence as being confidential due to attorney-client privilege. as best practice, reports should always combine facts with legal advice and include a statement confirming this. In another 5.5 Do enforcement agencies in your jurisdictions keep court case, a lower court decided that bankruptcy trustees were the results of an internal investigation confidential if entitled to receive documents and reports pertaining to an such results were voluntarily provided by the entity? internal investigation conducted under legal privilege for the company, as they should be considered the legal successor of the company. It is not yet clear whether and to what extent legal If the results of the internal investigation are disclosed to law privilege can subsequently be used to prevent the bankruptcy enforcement agencies, the findings will very likely become part trustees from divulging that information to others. of the investigation file and – eventually – the case file against the defendants. The Prosecutor’s Office, the defendant, injured parties and third parties that demonstrate a legitimate interest 5.2 Do any privileges or rules of confidentiality apply in the particular documentation can be granted access to the to interactions between the client and third parties files. The entity can object to disclosure of this part of the case engaged by outside counsel during the investigation files to injured parties and/or third parties. However, only in (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)? special circumstances will the interests of the company prevail. Although the case file itself is not available to the public, the content can become part of public record via the press when Attorney-client privilege extends to professionals engaged by the discussed in court. attorney. Work product and correspondence with the law firm within the scope of engagement is confidential and subject to attor- 62 Data Collection and Data Privacy Issues ney-client privilege. However, direct correspondence between the client and the third party is not privileged. Therefore, any correspondence between the client and third parties should be 6.1 What data protection laws or regulations apply to internal investigations in your jurisdiction? routed via the attorney. It is under debate whether it is sufficient to copy the attorney in on correspondence (“cc”) or if all correspondence must be addressed to the attorney in his/her capacity Employees may have a reasonable expectation of privacy in the as legal advisor. As best practice, companies should correspond workplace. Unjustified violation of privacy may lead to civil solely with the attorney, who subsequently forwards the docu- (labour law) liability and high administrative fines by the Dutch mentation to contracted third parties under legal privilege. Data Protection Authority. From 25 May 2018 onwards, all processors of personal data have to comply with the strict regulations for collecting, processing and transferring employees’ 5.3 Do legal privileges apply equally whether personal data under the European General Data Protection in-house counsel or outside counsel direct the internal investigation? Regulation (“GDPR”). Surveillance of employees with hidden cameras without any prior notice is not allowed and is punishable as a criminal act. Under Dutch law, legal privilege applies equally to all attorneys admitted to the Bar, whether in-house or outside legal counsel.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 90 Netherlands

Data for the internal investigation should be collected according Employees have a contractual duty towards their employer to act to the law of the specific jurisdiction. In transferring personal as good employees. Refusing to cooperate in an internal investi- information outside the EU or the European Economic Area, gation is possible but may be grounds for disciplinary sanctions the entity should observe the data protection provisions of the and/or dismissal. specific jurisdiction. 7.3 Is an entity required to provide legal representation 6.4 What types of documents are generally deemed to witnesses prior to interviews? If so, under important to collect for an internal investigation by your what circumstances must an entity provide legal jurisdiction’s enforcement agencies? representation for witnesses?

There is no general stance on which documents should be There is no statutory or regulatory obligation to provide legal collected. In practice, all data that may reasonably be of interest representation to witnesses. However, it may be in the interest of for the investigators may be collected, including e-mails, and the entity to provide legal representation to employees suspected physical and electronic files. of criminal behaviour, both under the obligation to act as a good employer and given the risk that criminal acts may be attributed to the entity or damage its reputation. The legal advisor of the 6.5 What resources are typically used to collect witness should be independent and have no relevant association documents during an internal investigation, and which resources are considered the most efficient? with the attorney in charge of the internal investigation.

Typically, a full back-up (“image”) is made of all data on the 7.4 What are best practices for conducting witness entity’s server/network, the desktop computers or tablets of interviews in your jurisdiction? the persons involved and their e-mail accounts. In addition, physical files and documents are collected based on markings As best practice, witnesses are informed in writing of the date with relevant key words, such as the person, project and/or time and time of the interview, the right to consult an attorney and/or period to which they refer. Physical documents are usually digi- bring legal representation at their own expense and the fact that talised to make them searchable. Often a data analysis and/ their answers may be disclosed to the entity and/or law enforce- or IT company is engaged by the attorney (in order to extend ment agencies. The witness’ testimony is recorded on audio-tape legal privilege) in order to help collect, store and search the files and in writing. A copy of the written testimony is provided to the electronically. witness and/or his/her attorney and may be reviewed and revised. The witness is requested to sign the statement for approval. 6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit 7.5 What cultural factors should interviewers be aware the use of predictive coding techniques? What are of when conducting interviews in your jurisdiction? best practices for reviewing a voluminous document collection in internal investigations? Dutch employees are generally direct and unnuanced in tone and manner, well informed and unafraid to invoke their rights The use of predictive coding techniques is not prohibited. In under Dutch labour and/or privacy law. At management level, practice, voluminous data is still largely reviewed manually, employees are likely to engage legal assistance for witness inter- based on keyword searches. To save costs, a first review is views. Therefore, procedural mishaps are likely to be scruti- often conducted by legal assistants or junior lawyers who mark nised and weaponised in court proceedings (e.g. in labour the documents as relevant or irrelevant, followed up by a more law or civil disputes). It is therefore advisable to seek experi- detailed review of the relevant documents by senior attorneys. enced and specialised legal counsel when conducting internal investigations.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London De Roos & Pen 91

7.6 When interviewing a whistleblower, how can or allow legal representation for witnesses, but an employer an entity protect the interests of the company while does have to act fairly and fulfil his/her duty to act as a “good upholding the rights of the whistleblower? employer” (see question 7.1). It is common practice to allow employees to have legal representation present during witness Companies may formulate their own internal reporting proce- interviews for internal investigations. Since the attorney dure that regulates how whistleblowers can report, what happens conducting the interview is engaged by the entity, the witness with the report and what protection is given to whistleblowers. is not regarded as a client and his/her answers may be disclosed An employee who does not correctly follow the internal reporting to the entity. procedure can neither claim protection against disadvantage nor request help from the Whistleblowers Authority. Therefore, 82 Investigation Report companies can uphold the rights of a whistleblower while safeguarding their own interest by setting up a carefully thought-out 8.1 How should the investigation report be structured reporting procedure. and what topics should it address?

7.7 Can employees in your jurisdiction request to The investigation report should be clearly marked as privileged. review or revise statements they have made or are the It should address the scope of the internal investigation (research statements closed? question), the investigation process and limitations. The report should present the facts of the case in an objective manner, with There is no statutory framework that provides for a right to review reference to the source of the information, and provide a legal or revise statements by employees. However, it is common prac- analysis concluded by a clear answer to the research question. tice to allow employees to review and revise the statement before In consultation with the client, recommendations on improving signing it. Employers often prefer collecting a signed state- compliance measures may be provided to offer management a ment as it will have more evidentiary value in court; for example, clear guideline on possible compliance measures that can satisfy to corroborate grounds for a dismissal. It is preferable to also their duty to prevent reoccurrence. It may be preferable to record the interview on audio-tape and note the exact wording of report recommendations separately or orally, as the authorities the witness if the content of the statement is challenged. may treat a lack of follow-up on a par with taking insufficient action to prevent further incidents/misconduct. Access to the report should be monitored closely, since the 7.8 Does your jurisdiction require that enforcement confidentiality disappears if the report is openly disclosed to authorities or a witness’ legal representative be present third parties (not engaged by the attorney). If preventing disclo- during witness interviews for internal investigations? sure of the report is a priority, it is possible to only allow reading access at the law firm or solely report in oral form (with or There is no specific statutory or regulatory obligation to provide without a visual aid for future reference).

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 92 Netherlands

Niels van der Laan, LL.M. focuses on (corporate) criminal law and acts in high-profile cases and investigations. His clients are publicly traded companies, banks, trust offices, and other businesses in the financial and private sector. He advises on criminal defence and criminal liability and directs internal fraud investigations. In addition, he is active as a defence lawyer for CEOs, chairpersons, non-executive directors, managers and advisors who are involved in corruption cases, market abuse cases (insider trading, market manipulation), money-laundering cases, criminal tax cases and (other) white- collar cases. Mr. van der Laan has a great deal of experience with technically complex transnational litigations and maintains good contacts with defence lawyers abroad, especially in the US. He is considered an expert in the field of international criminal law and also litigates before the Dutch Supreme Court.

De Roos & Pen Tel: +31 6 5510 5540 Keizersgracht 332 Email: [email protected] 1016 EZ Amsterdam URL: www.deroosenpen.nl Netherlands

Jantien Dekkers, LL.M. represents individuals and companies in both financial-economic and general criminal cases. Before joining De Roos & Pen, she worked in the Corporate Criminal Law team of Houthoff Buruma, where she advised large corporations on criminal matters and was involved in performing internal investigations. Ms. Dekkers graduated cum laude in both criminal and civil law. During her studies, she worked as a clerk at the District Court of Maastricht and lectured at the university. Among other subjects, she has specialised in forensic investigations and evidence. In 2013, she published the book Forensic familial DNA searching examined: Forensic & human rights safeguards for criminal investigations into genetic family relationships. Ms. Dekkers is also an author for the SDU commentaries on criminal law.

De Roos & Pen Tel: +31 6 4700 9227 Keizersgracht 332 Email: [email protected] 1016 EZ Amsterdam URL: www.deroosenpen.nl Netherlands

De Roos & Pen Law Firm is a The Legal 500 Tier 1 firm and was estab- Thanks to our scale, De Roos & Pen is regarded as a (medium) large crim- lished in 1984. Consequently, it is one of the oldest criminal law firms in inal law office – we are always ready to put together a reliable team of the Netherlands. attorneys for every acute criminal law problem. De Roos & Pen specialises in financial economic and criminal tax law www.deroosenpen.nl and is recognised both internationally and within the Netherlands as an authority in this field. As a result, the office has a great deal of expertise and experience in handling complex fraud cases. Additionally, De Roos & Pen conducts internal investigations, mainly on behalf of the financial sector, and offers advice about compliance and corporate governance. As a result, De Roos & Pen frequently serves international (often American) companies with interests in the Netherlands or elsewhere in Europe.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 15 93

Nigeria Nigeria

Adekunle Obebe

Bloomfield Law Practice Solomon Oshinubi

12 The Decision to Conduct an Internal where appropriate. The Code mandates companies to carry out internal investigations to satisfy corporate governance and compli- Investigation ance requirements. The Code also mandates public companies to establish a whistleblowing mechanism to be known to the 1.1 What statutory or regulatory obligations should employees and the general public. an entity consider when deciding whether to conduct an The consequences of failing to comply with these statutory internal investigation in your jurisdiction? Are there any and regulatory regimes may range from criminal liability to the consequences for failing to comply with these statutory imposition of fines. Also, acting outside of stated legislative or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? boundaries is to the disadvantage of the prosecutor of criminal activities. Currently, the whistleblowing policy is not backed by any law The regulations to consider when conducting internal investi- as its legal framework is not defined by any legislation. There gations are the Criminal and Penal Codes, the Administration are also no legislative frameworks to protect whistleblowers of Criminal Justice Act, the Administration of Criminal Justice from intimidation and criminal threats where their identities are Law of Lagos State (Lagos only), as well as other specific stat- known. However, statutes such as the ICPC Act (Section 64(1)), utes enacted by the National Assembly and State Houses of the EFCC Act (Section 39) and the Freedom of Information Act Assembly, such as: the Money Laundering (Prohibition) Act; (Section 14(e)) offer some form of protection to whistleblowers the Terrorism (Prevention) Act; the Independent Corrupt by protecting their identity. However, the Whistleblower Practices and Other Related Offences Act (the ICPC Act); the (Protection) Bill, which is yet to be passed into law, seeks to Code of Conduct Bureau and Tribunal Act (the CCBT Act); the protect whistleblowers from intimidation and harassment. Economic and Financial Crimes Commission Act (the EFCC The policy which provides for rewarding whistleblowers is also Act); the Miscellaneous Offences Act; the Companies and not mandatory and cannot be enforced in any court in Nigeria. Allied Matters Act (the CAMA); the Federal Inland Revenue In the Nigerian case of WILKIE v. FGN & ORS (2017) LPELR- Service Act; the Investment and Securities Act (the ISA); the 42137 (CA), it was stated that “a policy statement or guideline Central Bank of Nigeria Act; the Banks and Other Financial by the Federal Government does not give rise to a contractual Institutions Act; and the Whistleblowing Programme under the relationship”. Federal Ministry of Finance. The Whistleblower (Protection) Bill is in the first reading stage Some of these pieces of legislation impose certain obligations on the floor of the National Assembly. It is hoped that upon on companies with respect to the conduct of internal investi- its enactment into law, whistleblowers will enjoy statute-backed gations in Nigeria. These obligations cut across issues relating protection. to self-reporting, adoption of corporate governance best practices and whistleblowing. Legislation such as the ICPC Act, as well the Terrorism (Prevention) Act, imposes an obligation 1.2 How should an entity assess the credibility of a on companies to report certain potential breaches and wrong- whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal doing. Section 26(2) and (3) of the ICPC Act requires a person implications for dealing with whistleblowers? (which includes a corporation) who has given or has been asked to give gratification to a public officer to report such payment or request to the ICPC or a police officer. As with all investigations, the credibility of a complaint and the The Terrorism (Prevention) Act also requires financial insti- end result cannot at any point be ascertained. However, under tutions to forward reports of suspicious transactions relating to the Whistleblowing Programme, the information is scrutinised terrorism to the Nigerian Financial Intelligence Unit within a to determine its validity or otherwise, as well as its credibility, 72-hour period. by the administrators of the Whistleblowing Programme. The In response to the need for companies to be more account- duration of the investigation should ideally take 10 working able and adopt the best practices of corporate governance, the days. At the end of the investigation, the whistleblower will be Securities and Exchange Commission issued a Code of Corporate informed of the outcome of the investigation. Governance (the Code) which is to be applied by public compa- There is a reward for whistleblowers of between 2–5% of the nies. Although applicable to public companies, other companies recovered funds (if applicable). However, the provision of false not covered by the Code are encouraged to abide by its principles information as a whistleblower is a criminal offence.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 94 Nigeria

1.3 How does outside counsel determine who “the client” the timeframe. In addition, there is an online feedback mecha- is for the purposes of conducting an internal investigation nism through which a whistleblower can independently monitor and reporting findings (e.g. the Legal Department, the the status or progress report of tips submitted. Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure that the reporting 32 Cooperation with Law Enforcement relationship is free of any internal conflicts? When is Authorities it appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an 3.1 If an entity is aware that it is the subject or interest in influencing the direction of the investigation? target of a government investigation, is it required to liaise with local authorities before starting an internal For the purposes of investigation, the client would usually be investigation? Should it liaise with local authorities even the highest-level security officer in the organisation. To this if it is not required to do so? end, the officer must ensure complete cooperation with the investigating government agency. It is also not unusual for the There is no law that mandates liaising with local authorities client to be an independent and impartial committee constituted before starting an internal investigation; however, in some for the purpose of the investigation. circumstances, support from local authorities may be vital for Under Nigerian criminal law, the prosecutor is usually the proper identification and discovery of any criminal elements. particular state where the crime was said to have occurred or any of the agencies granted powers by statute to prosecute certain offenders, such as the EFCC and the ICPC. 3.2 If regulatory or law enforcement authorities are investigating an entity’s conduct, does the entity There are steps that ought to be taken in all investigations have the ability to help define or limit the scope of a to ensure impartiality and a non-biased, objective approach to government investigation? If so, how is it best achieved? issues. Outside counsel must ensure their independence and maintain objectivity. In-house lawyers must cooperate with investigators to ensure transparency. In the event that a regulatory body or law enforcement agency is investigating an organisation’s activity, the entity is not at liberty 22 Self-Disclosure to Enforcement to decide the scope of investigation of the regulatory body. Authorities 3.3 Do law enforcement authorities in your jurisdiction tend to coordinate with authorities in other jurisdictions? 2.1 When considering whether to impose civil or What strategies can entities adopt if they face criminal penalties, do law enforcement authorities in investigations in multiple jurisdictions? your jurisdiction consider an entity’s willingness to voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider? Nigerian law enforcement authorities offer cooperation to law enforcement and prosecution agencies in other jurisdictions. The body’s willingness to disclose information will affect the Particularly, in this region, there is cooperation with other West extent of penalties the body accrues. However, as to whether African and African countries. Further to this, Nigeria has also the lack of willingness to disclose information imposes a civil or domesticated some conventions that require signatory coun- criminal penalty, that is determined by the breach committed. tries to cooperate with one another to fight against corruption, Under Nigerian law, where a crime is committed (e.g. theft, such as the Mutual Assistance in Criminal Matters within the corruption), criminal penalties automatically follow, and where Commonwealth (Enactment and Enforcement) Act and the there is a civil wrong committed, civil penalties ensue. Treaty on Mutual Legal Assistance in Criminal Matters between the Government of the Federal Republic of Nigeria and the Government of the Republic of South Africa (Ratification and 2.2 When, during an internal investigation, should a Enforcement) Act. disclosure be made to enforcement authorities? What Strategies for multiple jurisdictions include information are the steps that should be followed for making a disclosure? sharing, transparency and ensuring clear lines of communication. 42 The Investigation Process During an internal investigation, disclosures can be made at any point in time. A disclosure may be from an identified source, or done anonymously. The Whistleblowing Programme states 4.1 What steps should typically be included in an that information can be disclosed in writing, via the official tele- investigation plan? phone lines or via the dedicated online portal. Steps that may be included would be (i) implementation of more transparent interviewing methods, (ii) stricter disciplinary meas- 2.3 How, and in what format, should the findings of an internal investigation be reported? Must the findings of ures within the bounds of existing laws for failure to comply an internal investigation be reported in writing? What with investigations, and (iii) improvement of data-handling risks, if any, arise from providing reports in writing? methods.

Findings of an internal investigation are reported in writing. 4.2 When should companies elicit the assistance of Upon receipt of the information, an acknowledgment response outside counsel or outside resources such as forensic will be sent, and preliminary analysis to confirm whether there consultants? If outside counsel is used, what criteria or is a violation or potential violation will be conducted within 10 credentials should one seek in retaining outside counsel? working days. If an investigation has commenced, the nature and complexity of the matters under investigation will dictate The eliciting of assistance from outside counsel is at the

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Bloomfield Law Practice 95

discretion of the entity being investigated. The Constitution of 62 Data Collection and Data Privacy Issues Nigeria guarantees persons a right to prepare their defence, and therefore this is encouraged for entities. In seeking to retain outside counsel, it is important to ensure 6.1 What data protection laws or regulations apply to they are independent and experienced in handling criminal (or internal investigations in your jurisdiction? civil) matters involving statutory bodies. a. The 1999 Constitution. 52 Confidentiality and Attorney-Client The 1999 Constitution of the Federal Republic of Nigeria Privileges provides for privacy of all information (telephone, correspondence and telegraphic) of Nigerian citizens. b. The National Information Technology Development 5.1 Does your jurisdiction recognise the attorney- Agency (NITDA) Guidelines on Data Protection, client, attorney work product, or any other legal 2019. privileges in the context of internal investigations? What best practices should be followed to preserve these The NITDA Guidelines on Data Protection, 2019 regu- privileges? late the processing and transfer of personal data collected by organisations. Within the scope of internal investigations, the NITDA Guidelines would typically apply to Yes. In cases of ongoing internal investigations, adequate the collection and handling of personal data provided by protection of the findings must be in place. The company must whistleblowers. not disclose information with regard to an ongoing investiga- c. Freedom of Information Act, 2011. tion. In the same vein, the lawyer involved is also expected, Section 14 (e) of the Freedom of Information Act, 2011 under the Rules of Professional Conduct, to provide a strict level protects the identities of whistleblowers by prohibiting the of confidentiality. release of such information to the public. There also exists a right to a fair trial, freedom from discrimi- d. Nigerian Data Protection Regulation, 2019 (NDPR). nation and assumption of innocence before being proven guilty. The NDPR has introduced major compliance obligations These are all outlined under the Constitution. on Nigerian companies across all sectors, which include Ensuring that the entity instructs legal counsel on their behalf audit checks, publication of data protection policies, filing ensures that the parties are able to enforce these rights. of audit reports, etc. The NDPR also provides for severe penalties for its breach. 5.2 Do any privileges or rules of confidentiality apply e. Nigerian Data Protection Bill, 2020. to interactions between the client and third parties Although not yet law, the Proposed Bill primarily seeks to engaged by outside counsel during the investigation establish an effective regulatory framework for the protec- (e.g. an accounting firm engaged to perform transaction tion of personal data, regulate the processing of informa- testing or a document collection vendor)? tion concerning data subjects and safeguard their fundamental rights and freedoms guaranteed under the 1999 The duty of confidentiality extends to all services engaged in Nigerian Constitution. It aims to promote the code of relation to the investigation, as long as there is an engagement practice which guarantees privacy and data protection set out between the client and the party. without inordinately undermining the interest of commercial organisations and government agencies in respect of 5.3 Do legal privileges apply equally whether such data. In addition, it seeks to minimise the effects of in-house counsel or outside counsel direct the internal misuse and abuse of personal data, establish an impartial investigation? regulatory authority and ensure personal data is processed in a fair and lawful manner in line with the bill and other existing legislation. Yes. The same legal privileges are applicable to both types of counsel. 6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document 5.4 How can entities protect privileged documents preservation notice to individuals who may have during an internal investigation conducted in your documents related to the issues under investigation? jurisdiction? Who should receive such a notice? What types of documents or data should be preserved? How should Privileged documents, albeit between defined parties, may be the investigation be described? How should compliance subject to third-party discovery during investigations. It is not with the preservation notice be recorded? guaranteed that such documentation may be excluded from an investigation. In Nigeria, document preservation may come under an Anton Piller injunction granted in favour of the party seeking the seizure of the documents (or assets, as the case may be) at a 5.5 Do enforcement agencies in your jurisdictions keep the results of an internal investigation confidential if particular location. such results were voluntarily provided by the entity? This is, however, only applicable to cases which are before the courts, and may not apply to investigative stages. During an investigation, a letter may be sent to the organisa- The disclosure of information recovered from an investigation tion seeking cooperation and preservation of documents relevant is at the discretion of the investigating agency. However, with to an investigation. However, if this is flouted, a warrant may be crimes of this nature, there may be disclosure of information if it obtained, and documents may be seized from a particular entity is deemed to be of public interest. This is entirely at the discre- (organisation or individual) in order to scrutinise the same. tion of such bodies.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 96 Nigeria

The entity in question should receive the notice, and the 7.3 Is an entity required to provide legal representation documents that may be included are those within the scope of to witnesses prior to interviews? If so, under the investigation. what circumstances must an entity provide legal representation for witnesses?

6.3 What factors must an entity consider when documents are located in multiple jurisdictions (e.g. bank Where a witness is being interviewed, their right to legal secrecy laws, data privacy, procedural requirements, etc.)? representation must be communicated without delay. This is a protection offered under the Nigerian Constitution. Typically, the factors to be taken into account include data protection protocols, privity of contract obligations and the procedure 7.4 What are best practices for conducting witness for obtaining documentation in the event of non-compliance. interviews in your jurisdiction?

6.4 What types of documents are generally deemed Best practices are not codified in a body of law. However, the important to collect for an internal investigation by your general principles are enshrined in the human rights as found in jurisdiction’s enforcement agencies? the Constitution, which include the right to a fair trial, the right to adequate representation, the right to obtain defence and the Contracts between the parties would be deemed essential as right to be viewed as innocent until proven guilty. they enable the establishment of a relationship between the parties. However, documents which are deemed important may 7.5 What cultural factors should interviewers be aware vary from case to case, and the scope of the investigation would of when conducting interviews in your jurisdiction? generally guide this. Cultural factors that are prevalent include undue respect and 6.5 What resources are typically used to collect fear of authority and regulatory institutions. This may unduly documents during an internal investigation, and which intimidate witnesses. resources are considered the most efficient? In addition, the prevalence of local dialects may inhibit the ability of witnesses to understand questions posed in English. Generally, relevant documents are manually gathered. Electronic gathering is also used in some instances. 7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while 6.6 When reviewing documents, do judicial or upholding the rights of the whistleblower? enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are Interviewing may take place outside of the offices to prevent best practices for reviewing a voluminous document partiality and encourage the objectivity of witness responses. collection in internal investigations? In addition, another safeguard that may be introduced is anonymity throughout the interviewing phase. The use of predictive coding techniques to review documents is not prohibited in Nigeria. Documents may be reviewed either 7.7 Can employees in your jurisdiction request to manually or by using predictive coding technology. review or revise statements they have made or are the statements closed? 72 Witness Interviews Employees (and generally persons in Nigeria) are able to review 7.1 What local laws or regulations apply to interviews statements they have made in an investigation and are able to of employees, former employees, or third parties? What clarify ambiguities after making such statements. authorities, if any, do entities need to consult before initiating witness interviews? 7.8 Does your jurisdiction require that enforcement Pre-trial investigation rests on common law and is largely uncod- authorities or a witness’ legal representative be present during witness interviews for internal investigations? ified. However, the Criminal Procedure Act, the Criminal Procedure Code, the Administration of Criminal Justice Act and the Administration of Criminal Justice Law stipulate the rules The Constitution provides that each witness is allowed to have governing investigation in a general sense. legal representation present during all stages of investigation None of the abovementioned legislation stipulate the means and prosecution. of initiating witness interviews. 82 Investigation Report 7.2 Are employees required to cooperate with their employer’s internal investigation? When and under 8.1 How should the investigation report be structured what circumstances may they decline to participate in a and what topics should it address? witness interview? Investigation reports vary across regulatory bodies in Nigeria. Most, if not all, employees are mandated by virtue of their However, it should generally contain a summary of the facts, contracts of employment to cooperate with all internal inves- the claim against the suspect(s), the means of investigation, tigations. Declining to participate may be a breach of such the findings of the investigation and action that must be taken contract with a penalty of termination of employment. thereafter.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Bloomfield Law Practice 97

Adekunle Obebe is recognised as one of the foremost Nigerian lawyers in immigration, employment and labour matters and is frequently sought as local counsel for large international companies. He is said to be “the first port of call” and has a “long-standing reputation” in the market (Who’s Who Legal – Nigeria 2014). Adekunle advises multinational corporations, Fortune 500 companies, high-net-worth individuals and Nigerian companies on issues relating to regulatory compliance, with particular reference to expatriate and Nigerian employee work authorisation in and out of Nigeria and corporate and commercial law. He is a certified Global Mobility Specialist and a regular speaker at Nigerian and international conferences/seminars on regulatory compliance and emerging corporate immigration issues in Nigeria. He was also a member of the Executive Leadership Committee (EMEA) of the Worldwide ERC – The Workforce Mobility Association. Since 2009, he has been highly regarded in Who’s Who Legal – Nigeria, inter alia, as “one of the best” corporate immigration lawyers in the Nigerian market. Adekunle is also highly knowledgeable in commercial litigation, corporate investigations and arbitration, and tax. He is the Managing Partner and Chair of the firm’s Dispute Resolution, Tax, and Immigration, Employment & Labour Practice Groups.

Bloomfield Law Practice Tel: +234 1 454 2130 15 Agodogba Avenue Email: [email protected] Parkview, Ikoyi, Lagos URL: www.bloomfield-law.com Nigeria

Solomon Oshinubi advises corporate clients on a wide array of legal issues, ensuring that the strategies and tactics developed by management are in accordance with the law. He is a core member of Bloomfield’s Corporate Investigations Practice Group, and is also a member of the firm’s Immigration, Labour & Employment Groups. Prior to joining Bloomfield, Solomon worked in a reputable multiservice law firm where he had been involved in an array of transactions, ranging from multibillion-dollar oil and gas asset transfers to joint ventures involving one of the foremost Chinese industrial explosives manu- facturers. He is also a member of the World Youth Alliance.

Bloomfield Law Practice Tel: +234 8 166 383 106 15 Agodogba Avenue Email: [email protected] Parkview, Ikoyi, Lagos URL: www.bloomfield-law.com Nigeria

Bloomfield is the foremost full-service law firm in Nigeria. The firm provides regulatory compliance advisory services to both local and multinational companies in Nigeria. Our Partners, Associates and Support Staff provide professional service of the highest standard to our clients by combining awareness of clients’ needs with a practical and constructive approach to legal issues. The firm has been involved in providing regulatory compliance training programmes to employees of various companies and ensuring compliance with international and local regulatory provisions. www.bloomfield-law.com

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 98 Chapter 16 Norway Norway

Elisabeth Roscher

Wikborg Rein Geir Sviggum

12 The Decision to Conduct an Internal taken “all reasonable precautions to avoid corruption”, and it is not reasonable to impose liability based on an overall assessment Investigation of the circumstances of the case. Third, section 3-3 c of the Norwegian Accounting Act 1.1 What statutory or regulatory obligations should requires large and/or listed companies to include in their annual an entity consider when deciding whether to conduct an reports measures that the company has implemented with regard internal investigation in your jurisdiction? Are there any to compliance with the requirements related to, amongst others, consequences for failing to comply with these statutory corruption, human rights, workers’ rights and environmental or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? issues. Such measures will include procedures for conducting internal investigations of possible violations.

There are no general statutory or regulatory requirements that oblige companies to conduct an internal investigation under 1.2 How should an entity assess the credibility of a Norwegian law, and the questions of whether and when to whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal investigate are typically left to the discretion of the company. implications for dealing with whistleblowers? However, in the event of concerns being reported (whistleblower complaints) section 2 A-3 of the Norwegian Working Environment Act (the “WEA”) requires employers to conduct Section 2 A-1 of the WEA stipulates that any employee or an adequate investigation of such reports within a reasonable contracted/hired worker has the right to raise concerns with period of time. The provision does not set any specific require- their employer. Concerns may also be raised with supervisory ments as to what kind of follow-up measures the investigation authorities or other public authorities, cf. WEA section 2 A-2. must entail. What is to be regarded as adequate follow-up should Section 2 A-4 of the WEA states that employees are protected therefore be assessed specifically in each individual case. The from retaliation where concerns have been raised in accordance provision in WEA section 2 A-3 is new and entered into force with section 2 A-1 and 2 A-2. If the employee submits infor- on 1 January 2020. mation that gives reason to believe that retaliation has taken There are also certain other statutory provisions that are rele- place, it is assumed that such retaliation has taken place unless vant to consider when deciding whether to conduct an internal the employer proves otherwise. The employee may in such cases investigation. claim compensation without demonstrating fault on the part of First, corporate criminal liability in Norway is subject to pros- the employer, with such compensation to be fixed at an amount ecutorial discretion, cf. sections 27 and 28 of the Penal Code of the court considers reasonable in view of the circumstances of 2005 (the “Penal Code”). This means that there is no general the case. In addition, compensation for financial loss may be presumption of corporate liability under Norwegian law, i.e. the claimed under the general law. imposition of a corporate penalty depends on the circumstances As described in response to question 1.1 above, employers are of the case. When deciding whether to penalise a company, the required to conduct an adequate investigation of whistleblow- prosecutors and courts will conduct a broad overall assessment ers’s complaints within a reasonable period of time, cf. WEA based on the elements/factors set out in section 28, including: section 2 A-3. The employer must take the complaint seri- “whether the enterprise by guidelines, instruction, training, ously and formally assess in each individual case what is to be control or other measures could have prevented the offence.” regarded as adequate follow-up. Whether an internal investiga- The extent of the company’s cooperation with the authorities, tion is required will depend, amongst other things, on the nature including whether the company has conducted its own internal and seriousness of the issues raised. Employers will under no investigation, will be part of the prosecutor’s considerations and circumstances be obliged to conduct a more thorough investi- may reduce the risk of criminal liability. gation than what, objectively speaking, is warranted by the facts Second, anyone who has suffered loss as a result of corrup- underpinning the complaint. If it can be readily ascertained tion can, according to sections 1–6 of the Norwegian Liability that a complaint is unfounded, a conclusion of that nature may Act, claim compensation from the perpetrator’s employer if be sufficient. The motive of the whistleblower in raising the the corruption has occurred in connection with the execution complaint is normally not considered, unless the complaint can of work or duties undertaken for the employer. The employer be regarded as having been made without good faith. can only avoid liability if it can be proven that the employer has

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Wikborg Rein 99

1.3 How does outside counsel determine who “the relevant factors in this regard may be the extent of the compa- client” is for the purposes of conducting an internal ny’s cooperation with the authorities and disclosure of facts from investigation and reporting findings (e.g. the Legal an internal investigation. Furthermore, there is a leniency regu- Department, the Chief Compliance Officer, the Board of lation applicable to cooperation and disclosure in cartel offences. Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure that the reporting relationship is free of any internal 2.2 When, during an internal investigation, should a conflicts? When is it appropriate to exclude an in-house disclosure be made to enforcement authorities? What attorney, senior executive, or major shareholder who are the steps that should be followed for making a might have an interest in influencing the direction of the disclosure? investigation? There are no formal procedures that require companies to Internal investigations are not regulated by law in Norway. In self-report under Norwegian law, and consequently no required 2011, the Norwegian Bar Association did, however, issue a set of steps for making a disclosure. However, the enforcement indicative guidelines (the “Bar Association Guidelines”) appli- authorities (including the Norwegian National Authority of cable to lawyers’ work related to external independent private Investigation and Prosecution of Economic and Environmental investigations. The Bar Association Guidelines are currently Crime (“ØKOKRIM”)) encourage companies to disclose any under revision. suspicions of corporate crimes and to cooperate with the author- A key part of any investigation conducted by outside counsel ities on any subsequent investigation. is to ensure that a detailed and clearly formulated mandate is The authorities encourage such disclosure to be made as early as put in place before the work commences. As part of the estab- possible. However, they do typically allow a period of time for the lishment of this mandate, it needs to be precisely decided who company to assess and, depending on the severity of the case, to “the client” is and to whom the outside counsel should report. investigate the potential wrongdoing. Early self-reporting – should Outside counsel needs to be aware of potential conflicts of inter- a criminal investigation be opened – will enable the coordination ests within “the client” and to safeguard that person(s) at the of investigative steps between the authorities and the company, appropriate level of the organisation. and should enable the internal investigation to be conducted in a In practice, this typically means that an organisation’s Legal way that does not prejudice the authorities’ investigation. or Compliance team and/or the Board or Audit Committee are Early disclosure and full cooperation with the authorities will likely to comprise “the client”. Where an individual who might also be taken into consideration when exercising any prosecu- otherwise be regarded as being part of “the client” has an actual torial discretion, including the assessment of any liability or the or potential personal interest in the outcome of the investigation, that individual should be excluded from key decisions and amount of any penalty imposed. ongoing communications between outside counsel and “the client” during the course of the investigation. Another reason 2.3 How, and in what format, should the findings of an for limiting the scope of who might constitute “the client” is internal investigation be reported? Must the findings of that internal investigations are, by their nature, confidential; an internal investigation be reported in writing? What information related to the investigation should, as a general rule, risks, if any, arise from providing reports in writing? only be disclosed on a need-to-know basis. There are no requirements regarding the format in which the 22 Self-Disclosure to Enforcement findings of an internal investigation should be reported. The Authorities findings may be made orally in a meeting or by providing a written report. However, if not provided voluntarily and if not subject to legal privilege, a written report may be requested and 2.1 When considering whether to impose civil or also seized by the authorities. criminal penalties, do law enforcement authorities in your jurisdiction consider an entity’s willingness to voluntarily disclose the results of a properly conducted 32 Cooperation with Law Enforcement internal investigation? What factors do they consider? Authorities

Under Norwegian law, civil and criminal sanctions are imposed 3.1 If an entity is aware that it is the subject or in accordance with different procedural rules and by different target of a government investigation, is it required to authorities; i.e., the enforcement authorities in Norway do not liaise with local authorities before starting an internal have the power and discretion to choose between civil and crim- investigation? Should it liaise with local authorities even inal penalties. However, the extent of the company’s coopera- if it is not required to do so? tion with the authorities, including the willingness to disclose the results of a properly conducted internal investigation, is relevant There are no requirements that a company must liaise with to the procedural discretion in deciding whether or not to prose- national or local government authorities before starting an cute, cf. question 1.1 above, and can provide the basis for reduced internal investigation. However, the authorities encourage that penalties. In our experience, the agreed submission to authori- the company share the results of any investigation with them ties of the results of an internal investigation has prevented more and also that investigative steps be coordinated, particularly – in drastic measures being imposed, such as warrants to search the the case of a parallel criminal investigation – to prevent the risk company premises and seizure of documents and files. that the internal investigation may “disturb the (potential) crime Several of the various government bodies that have the authority to impose civil/administrative sanctions in their respec- scene” and thereby prejudice the authorities’ investigation. The tive areas, such as the tax authorities, the competition authority authorities may wish to discuss a work plan or to provide direc- and the financial supervisory authority, have adopted guidelines tions to the company on its internal investigation; for example, outlining the circumstances in which cases will be reported to requesting that the company does not interview certain individ- the police. In addition to the severity of the case at hand, further uals until after the authorities have conducted such interviews.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 100 Norway

Such cooperation will be viewed positively and will also be ■ Fourth, the process of collecting information commences. taken into consideration made when, for example, ØKOKRIM This will typically include the collection of physical docu- exercises its prosecutorial discretion when considering whether a mentation, electronic information, interviews and open company should be charged and the nature of such charges, and source information. when it comes to an assessment of any liability or the amount of ■ Fifth, the collected information is analysed. This will any penalty imposed. often reveal the need for further collection of information. It is not uncommon, therefore, that steps 4 and 5 need to 3.2 If regulatory or law enforcement authorities be repeated and that they run in parallel throughout the are investigating an entity’s conduct, does the entity investigation process. have the ability to help define or limit the scope of a ■ f Sixth, i the analysis of the information suggests that iden- government investigation? If so, how is it best achieved? tified entities or individuals have acted in an unlawful or otherwise censurable manner, they should be presented In general, an entity does not have the ability to influence the with the information and be given the opportunity to scope of a government investigation. provide their views. ■ Seventh, the report is drafted and concluded. The report should normally describe the scope of the investigation, 3.3 Do law enforcement authorities in your jurisdiction the procedural rules that have been applied to the investi- tend to coordinate with authorities in other jurisdictions? gation, the information that has been collected and which What strategies can entities adopt if they face factual events the investigators find proven or probable. investigations in multiple jurisdictions? The report should also clearly describe which important factual allegations the investigators find inconclusive or Yes, Norwegian law enforcement authorities normally exchange otherwise uncertain. information and coordinate with authorities in other jurisdic- ■ Eighth, the reported findings are legally assessed. Here, tions in cross-border investigations. This may, for example, be the investigators, or separate counsel, make an assessment done through treaties on mutual legal assistance. Companies of the legal implications of the factual findings. that face investigations in multiple jurisdictions would be well advised to assess which agency is likely to have the primary claim to jurisdiction. In addition, they may wish to seek guidance as to 4.2 When should companies elicit the assistance of which agency will take the lead in investigating and prosecuting outside counsel or outside resources such as forensic consultants? If outside counsel is used, what criteria the matter among the authorities in their home jurisdiction. or credentials should one seek in retaining outside counsel? 42 The Investigation Process Under Norwegian law, companies are not required to elicit the 4.1 What steps should typically be included in an assistance of outside counsel or other resources to assist in an investigation plan? investigation. There are, however, situations where this is generally preferred and recommended. First, the assistance of outside The investigation plan must be prepared based on the circum- legal counsel will invoke the attorney-client privilege, ref. section stances of each individual case, but it should always satisfy the 5 below. Second, it is often valuable to get an independent fundamental non-statutory principle of “justifiability”, which review from a third party. Third, the company may want to includes the principle of hearing both sides of a case. Typically, obtain expert assessment or opinions from an outside counsel or the following steps should be included in an investigation plan: other resources. For example, the company can, with the assis- ■ First, an investigation scope/mandate should be defined. tance of outside counsel, consider the need for conducting an This is a critical first step, as the investigation will be both internal investigation, and whether other outside resources, such inefficient and incur unnecessary time and costs if the scope as forensic consultants, are required. is not clearly defined. The scope should both define what is The most important criteria when selecting outside counsel to be investigated and also clearly describe the various roles is that the counsel has experience and a proven track record of in the investigations between, e.g., outside counsel, forensic carrying out professional and effective investigations in accord- consultants and the company’s own personnel. The plan ance with procedural requirements and within the sector or should, however, provide flexibility to address new issues geographical location relevant to the specific case. Moreover, and areas that may arise during the investigation. it should be considered whether the counsel can provide a ■ Second, guidelines for the investigation process should be team with the requisite qualifications and size to properly and established. The guidelines should set out, e.g., how the efficiently handle the investigation from beginning to end. employees of the company shall contribute, if the employees Furthermore, to avoid doubt about the impartiality of the inves- will be given the opportunity for representation by separate tigation process, companies may consider using an outside counsel, how collected information shall be handled/used, counsel who is not their regular outside counsel. etc. The guidelines should be communicated or otherwise made available to anyone affected by the investiga- 52 Confidentiality and Attorney-Client tion before they participate, e.g., by giving interviews to the investigators. The Norwegian Bar Association has issued Privileges guidelines for private investigations which most legal counsel apply when conducting external investigations. 5.1 Does your jurisdiction recognise the attorney-client, ■ Third, a timeline for the investigation should be estab- attorney work product, or any other legal privileges in the lished. This should ensure the timely completion of the context of internal investigations? What best practices investigation, but it should not be so tight that it compro- should be followed to preserve these privileges? mises the quality of the investigation. The attorney-client/legal professional privilege exists in internal

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Wikborg Rein 101

investigations in the same manner as in civil litigation and crim- When the relevant material is collected and mirror-copied inal investigations and, e.g., in relation to investigations by for an internal investigation, the entity should ensure that IT or ØKOKRIM and the Norwegian Competition Authority. This technical personnel, together with a lawyer, review all the mate- is based on long-term case law and sections 119, 204 and 205 of rial to identify documents that are privileged. Such documents the Criminal Procedure Act, as well as section 22-5 of the Civil should then be excluded from any material that is disclosed. Procedure Act. The legal professional privilege applies to qualified lawyers, 5.5 Do enforcement agencies in your jurisdictions keep and in general also to those persons, including external experts, the results of an internal investigation confidential if who assist the lawyer in his or her work. However, it is a require- such results were voluntarily provided by the entity? ment that the engagement of such “assistants” is considered derived from the engagement of the lawyer and not an inde- Documents disclosed to the authorities will be made part of the pendent engagement. case file, should an investigation be opened, and are as a main In order to be considered privileged, the information must rule accessible also to other parties with a legal interest in the be communicated to/from the lawyer in his or her capacity as a case. There is no general right of confidentiality applicable to lawyer, i.e. in connection with obtaining legal advice. The priv- the results of an internal investigation. Certain information is, ilege does not apply to information a lawyer receives or gives however, exempted from access because it is subject to a duty of when acting in another capacity; for example, as a member of confidentiality by or pursuant to law. This includes information the Board of Directors. concerning an individual’s personal affairs, technical devices and The legal professional privilege in Norway applies to all types procedures, as well as operational or business matters, which for and contents of documents, including parts of a document and competition reasons are important to keep confidential. emails in which the lawyer is copied, provided they satisfy the above criteria. There are some exceptions to the legal professional privilege; for example, in criminal investigations if it leads 62 Data Collection and Data Privacy Issues to an innocent person being convicted or a serious crime being committed. 6.1 What data protection laws or regulations apply to internal investigations in your jurisdiction? 5.2 Do any privileges or rules of confidentiality apply to interactions between the client and third parties The principal data protection legislation applying to internal engaged by outside counsel during the investigation investigations is the Personal Data Act (Act of 15 June 2018 (e.g. an accounting firm engaged to perform transaction No. 38). The law implements the EU General Data Protection testing or a document collection vendor)? Regulation (Regulation (EU) 2016/679 – “GDPR”). The purpose of the Act, which is strictly enforced, is to protect If a third party is engaged by an outside legal counsel to assist and natural persons from violations of their right to privacy through provide advice in the investigation, and this advice is included the processing of personal data. “Processing of personal data” or constitutes part of the legal counsel’s advice, the legal profes- means any operation or set of operations which is performed sional privilege will apply. This will not be the case if the third on personal data or on sets of personal data, whether or not party provides separate advice directly to the company and this by automated means, such as collection, recording, organisa- advice is not part of the legal advice provided by the counsel. tion, structuring, storage, adaptation or alteration, retrieval, If the investigation is primarily fact-finding, the legal profes- consultation, use, disclosure by transmission, dissemination or sional privilege may still apply. The Norwegian Supreme Court otherwise making available, alignment or combination, restric- has held that this, depending on the circumstances of the case, tion, erasure or destruction. Thus, the collecting and further may be the case in situations where the investigation “may have processing of personal data as part of an internal investigation legal consequences”, as the collection and systematisation of will have to comply with the GDPR, e.g. requirements related to facts and the legal considerations in such situations are closely ensuring a sufficient legal basis for collecting and retaining the interlinked. data, adequate information security throughout the process and appropriate retention/deletion routines, in addition to providing 5.3 Do legal privileges apply equally whether information to data subjects. It is likely that the investigation in-house counsel or outside counsel direct the internal process will include personal data related to different indi- investigation? viduals. There are certain exceptions from the obligation to inform the data subject about the processing of personal data related to him/her, e.g. when such exception is necessary for the Under Norwegian law, the attorney-client privileges as described prevention, investigation, detection or prosecution of criminal in question 5.1 above apply equally to in-house counsel. Hence, offences. Any exceptions from the obligation to inform should in respect of legal professional privilege, there is no difference be considered on a case-by-case basis. as to whether an in-house counsel or outside lawyer directs the Further to the GDPR and the Personal Data Act, there internal investigation. are specific regulations pertaining to the employer’s access to employees’ personal email accounts, personal areas in the 5.4 How can entities protect privileged documents network and electronic equipment provided by the employer for during an internal investigation conducted in your work-related use (Regulation 2018-07-02-1108). The legislation jurisdiction? requires, inter alia, that the employer, before accessing and exam- ining an employee’s corporate email account, personal workspace Documents protected by legal professional privilege cannot or electronic equipment provided by the company for work-re- be seized by either external or internal investigators, unless a lated use, to the extent possible, notifies the employee, and that company representative with the necessary authority has released the employee is given the opportunity to make any representa- the document from privilege. tions before such examination is carried out. The employee has

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 102 Norway

a right to be present during the examination and to be assisted by specific situations could apply, typically 49 (1) letter e – namely a representative. In case the examination is made without prior that the transfer is necessary for the establishment, exercise or warning, the employee shall receive subsequent written notifica- defence of a legal claim. After the Schrems II decision by the tion of the examination as soon as it is completed. The same European Court of Justice, transfer can no longer be based on applies if the examination has been made without the employee the Privacy Shield framework. present. The same exceptions that apply to the general duty to inform also apply to employer’s access to email, etc. 6.4 What types of documents are generally deemed important to collect for an internal investigation by your 6.2 Is it a common practice or a legal requirement jurisdiction’s enforcement agencies? in your jurisdiction to prepare and issue a document preservation notice to individuals who may have For an internal investigation in Norway, all kinds of docu- documents related to the issues under investigation? ments can be considered relevant, such as emails, other elec- Who should receive such a notice? What types of tronic communications, memos, decision documents, accounts, documents or data should be preserved? How should the investigation be described? How should compliance ledgers, presentations, etc. The relevance generally depends on with the preservation notice be recorded? the nature and scope of the investigation.

There are no specific legal requirements under Norwegian law to 6.5 What resources are typically used to collect prepare and issue a document preservation notice in connection documents during an internal investigation, and which with internal or external investigations. Practice varies as to how resources are considered the most efficient? and when this is done in connection with investigations, but it is considered best practice to issue a legal hold notice to anyone in For collection of electronically stored data, companies will typi- the company who might hold material of relevance to an investiga- cally engage a third-party forensic provider with specific soft- tion. There are no legal restrictions on issuing such a preservation ware programs and expertise to extract data and properly store notice, and it is considered part of an employer’s powers to do so. and systematise the data for review. The securing of data is Normally, the particular individuals identified as subjects of, typically done by mirror-copying the contents of servers, indi- or relevant witnesses in, an internal investigation should receive vidual laptops and handheld electronic devices. Such electronic a notice. The notice should state in general terms the scope/ mirror-copying is also considered the most efficient way of mandate of the investigation in order to give sufficient direction collecting documents, as most information these days is usually as to what kind of information should be preserved. Compliance stored electronically. With regard to access to documents in with the preservation notice is normally part of the questioning an employee’s email account or personal space in the business’ of the persons involved and control is also managed through computer network, see questions 6.1 and 6.2 above. back-up comparisons. Where any such control or comparison It is normally also necessary to involve other kinds of internal requires access to information in an employee’s email account resources to identify relevant information, such as HR, internal or in the employee’s personal space in the company’s computer auditing, the compliance function, the legal function, the IT network, the strict procedures regarding access to employee department, etc. emails and personal space set out in Regulation 2018-07-02- 1108 must be observed by the employer, as explained in ques- 6.6 When reviewing documents, do judicial or tion 6.1 above. enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are best practices for reviewing a voluminous document 6.3 What factors must an entity consider when collection in internal investigations? documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)? Predictive coding document techniques are accepted in Norway. From a data protection point of view, data subjects have the In cases where documents are located in multiple jurisdictions, right to demand a review by a physical person of data selected by the entity must comply with all local laws in each of the juris- a fully automated process. dictions in question when accessing and securing documents in connection with internal investigations. Normally, this means that one should engage local legal expertise to safeguard compli- 72 Witness Interviews ance. In Norway, an investigation will have to take into consideration the particular regulations pertaining to the employer’s 7.1 What local laws or regulations apply to interviews access to employees’ personal email accounts, personal areas in of employees, former employees, or third parties? What the network and electronic equipment provided by the employer authorities, if any, do entities need to consult before for work-related use (Regulation 2018-07-02-1108). initiating witness interviews? Regarding data privacy specifically, for countries that have implemented the GDPR, the transfer of personal data from There are no specific laws or regulations that apply to interviews Norway to such countries, as well as transfer to countries of employees, former employees or third parties in private, non-ju- that have been deemed by the European Commission to have dicial or public investigations. However, the Bar Association an adequate level of data protection, is permitted, provided Guidelines include guidelines for the conducting of such inter- there is a legal basis for the processing, including the transfer views in private investigations. The main principles are, among of personal data. On the other hand, specific requirements others, the right to privacy, the right to a fair trial, the presump- must be complied with before any transfer of personal data is tion of innocence and protection against self-incrimination. For made outside the EU/EEA, typically the use of EU Standard instance, the guidance sets out that affected parties should have Contractual Clauses (“SCCs”). In certain situations, it could the right to be represented by a lawyer (see further details under also be argued that GDPR article 49 regarding derogations for question 7.3) and to request access to information the investigator

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Wikborg Rein 103

has about him or her, as long as this does not adversely interfere 7.5 What cultural factors should interviewers be aware with the investigation or infringe the rights of any third party. of when conducting interviews in your jurisdiction? It is not necessary to consult any authorities before initiating witness interviews; however, if the public authorities have There are no specific cultural factors that need to be taken into already been notified about the internal investigation (e.g. by account. self-reporting), it would be prudent to do so.

7.6 When interviewing a whistleblower, how can 7.2 Are employees required to cooperate with their an entity protect the interests of the company while employer’s internal investigation? When and under upholding the rights of the whistleblower? what circumstances may they decline to participate in a witness interview? Norway has specific legislation on the protection of whistleblowers, affording employees a statutory right to raise concerns It is generally assumed that employees are required to cooperate as well as requiring employers to develop internal procedures or with an internal investigation, including giving interviews and other measures that facilitate such raising of concerns. providing information that can be used as evidence. All concerns (complaints) should be investigated impartially It has been questioned whether an employee may decline and the company (and any individuals against whom allega- to participate in a witness interview in order to protect them- tions are made) should be given the opportunity to consider the selves from self-incrimination. There is no clear answer to this complaints and to respond to the allegations. question under Norwegian law and the employee’s obligation If parts of the interview with the whistleblower are to be to participate in an interview has to be determined on a case- referenced in the final report, this should be done in a cautious by-case basis. manner without revealing any personal information unless strictly necessary. 7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under 7.7 Can employees in your jurisdiction request to what circumstances must an entity provide legal review or revise statements they have made or are the representation for witnesses? statements closed?

An entity is not legally required to provide legal representation When conducting interviews, it is considered good practice to witnesses. However, the Bar Association Guidelines set out to take minutes/an attendance note and to send this to the that if the investigators, according to the mandate, collect infor- employee afterwards for review, as well as potential corrections mation and also assess and conclude on the facts, an “affected and comments. party” has the right to have legal or other representation/assistance at every stage of the investigation. In the guidelines, an affected party is defined as a person whose position will be 7.8 Does your jurisdiction require that enforcement affected by the investigation and its outcome. authorities or a witness’ legal representative be present When special circumstances make it necessary, the entity during witness interviews for internal investigations? shall cover the necessary costs of such legal representation; for example, if the affected party is exposed to the risk of No, it does not. self-incrimination. 82 Investigation Report 7.4 What are best practices for conducting witness interviews in your jurisdiction? 8.1 How should the investigation report be structured and what topics should it address? The key words in this regard are due and fair process. Appropriate care must be applied both when deciding the There are no formal requirements as to how the report should scope of the mandate of the investigation and during the actual be structured. However, there is some guidance to be found in investigation. the Bar Association Guidelines. Witness interviews should be conducted in a manner that The investigation report is generally divided into three sections: ensures that the relevant parties are adequately respected and 1) description of the scope of the investigation, the methodology protected. and the procedural rules that have been applied; 2) description When conducting an interview, the interviewers should of the information that has been collected and reviewed; and 3) inform the witness of the background for the interview and the relevant assessments including which factual events the inves- scope of the investigation. The witness should also be advised tigators find proven or most likely and legal conclusions. The on the applicable guidelines for the investigation process (cf. report should also clearly describe which important factual alle- question 4.1 above), including how the information given in the gations the investigators find inconclusive or otherwise uncer- interview may be used, the reporting format, and the confiden- tain. Depending on the scope of the investigation, the report tial nature of the interview and not to discuss the matter with could also include recommendations for remediation and miti- others/colleagues. A record/summary of the key facts of the gating measures. Alternatively, the client may prefer to exclude interview should be made and the minutes/transcript should be legal conclusions and recommendations from the report in light provided to the witness, who should then be allowed a reason- of the risk of, e.g., litigation and reputational damage. able period within which to revert with any comments or other- It is emphasised in the Bar Association Guidelines that, in wise confirm their agreement. general, one should be cautious with respect to statements and conclusions in the report regarding individual (personal) guilt. Investigators should adopt a presumption of innocence approach.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 104 Norway

Elisabeth Roscher is a Partner at Wikborg Rein’s Oslo office and head of the firm’s Compliance and Investigations practice. Her main areas of practice are: ■ Corporate compliance systems and in-depth procedures in: anti-corruption; anti-money laundering; antitrust (competition law); trade control; and responsible business conduct/human rights. ■ Private investigations and crisis management for both national and international companies. ■ Criminal law, in particular corporate criminal liability. Elisabeth was ranked among the top 10 compliance lawyers in Norwegian Financial Daily’s annual lawyers survey in 2019 and 2020. She is also ranked by Chambers Europe within the Compliance category. Before joining Wikborg Rein, Elisabeth was a Partner and head of EY Norway’s Forensic & Integrity Services practices. She was previously a Senior Public Prosecutor with the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime, where she was responsible for investigating and prosecuting large complex economic crime cases – both national and cross-border. Elisabeth also has extensive competition law experience from holding positions as Legal Director and Director responsible for Investigations in the Norwegian Competition Authority.

Wikborg Rein Tel: +47 22 82 76 65 Dronning Mauds gate 11 Email: [email protected] 0250 Oslo URL: www.wr.no Norway

Geir Sviggum is a Partner at Wikborg Rein’s Oslo office and chairman of the firm’s board of directors. He headed the firm’s Shanghai office from 2008 to 2013 and was Managing Partner International with overall responsibility for Wikborg Rein’s international practice from 2012 to 2016. Geir was named International Lawyer of the Year in Norwegian Financial Daily’s annual lawyers survey in 2019 and 2020. He is also ranked Band 1 by Chambers Europe within the Compliance category. Geir’s compliance specialty focuses primarily on anti-bribery and crisis management, hereunder criminal law consequences and civil disputes triggered by potential misconduct. His experience spans from a role as public defender in Norwegian courts to crisis management on behalf of listed Norwegian companies following suspected misconduct, preventive advisory work for Norwegian companies and public authorities in their anti-bribery work and lecturing on anti-bribery legislation at universities in several countries. Geir frequently speaks at universities, conferences and in other fora.

Wikborg Rein Tel: +47 22 82 76 76 Dronning Mauds gate 11 Email: [email protected] 0250 Oslo URL: www.wr.no Norway

Wikborg Rein is one of the largest Norwegian law firms and one of only industry. Several dozen of the firm’s partners and lawyers in Norway have two Norwegian law firms ranked Band 1 by Chambers and Partners within spent years working abroad or in-house with their clients. the “Compliance” category. The firm attracts a wide range of Tier 1 clients Wikborg Rein’s broad range of legal services beyond compliance and within compliance, investigations and crisis management. Wikborg Rein crisis management includes: corporate and M&A; dispute resolution; real is the only law firm which has been engaged internationally by way of a estate and construction; banking and finance; shipping and offshore; trade, framework agreement with the Norwegian Ministry of Foreign Affairs industry and public sector (including technology, media and telecommuni- under which the firm, inter alia, leads investigations into potential misuse of cations); and energy and natural resources. Norwegian aid globally. The firm acted for most of the larger companies www.wr.no listed on the Oslo Stock Exchange in 2019 and 2020. The firm employs lawyers in Oslo, Bergen, London, Singapore and Shanghai. Its unique and long-standing presence overseas enables it to offer clients the benefit of an extensive international expertise. The firm has been heavily involved working with clients exposed to large-scale anti-bribery campaigns such as the Lavo Jato scandal concerning Petrobras in Brazil, the campaign initiated by the current government of the Peoples’ Republic of China as well as the Wikileaks bribery allegations concerning the Namibian fishing

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 17 105

Poland Poland

Sołtysiński Kawecki & Szlęzak Tomasz Konopka

12 The Decision to Conduct an Internal An internal investigation allows the persons managing a given entity to learn about material facts in the context of irregular- Investigation ities disclosed in the company; however, under the applicable law, the fact of carrying out an internal investigation does not 1.1 What statutory or regulatory obligations should constitute an independent circumstance which speaks in favour an entity consider when deciding whether to conduct an of a specific entity, e.g. in the case that criminal proceedings are internal investigation in your jurisdiction? Are there any initiated against that entity. consequences for failing to comply with these statutory or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal Some entities, e.g. banks, investment funds, entities managing implications for dealing with whistleblowers? alternative investment companies, insurance companies, reinsurance companies, as well as entities conducting brokerage activities and fiduciary banks, are obligated on the basis of The reaction of an entity depends entirely on its internal policy. special provisions to carry out inspections of compliance and However, the whistleblowing issue is beginning to appear internal audits, given the lack of general statutory regulations in Polish legislation. For instance, pursuant to the Act on concerning an internal investigation: Detecting and Preventing Money Laundering and Terrorism A. Banks are obligated to define and start up an effective Financing, some institutions like banks or other financial enti- internal inspection system on the basis of banking law. ties are obliged to create an anonymous whistleblowing proce- B. The internal inspection system must also operate in invest- dure of reporting irregularities in the scope of money laundering ment funds and in entities managing alternative investment by employees. Moreover, the planned amendment to the Act companies on the basis of the Act on Investment Funds and on Liability of Collective Entities for Acts Prohibited Under on Management of Alternative Investment Funds (“AIF”). Penalty provides sanctions for causing negative consequences to C. The obligation to introduce and start up the internal whistleblowers, which are imposed on a collective entity, e.g. a inspection system and internal audit also lies with insur- company. The mentioned draft Act on Transparency in Public ance companies and reinsurance companies on the basis Life from the previous term of Polish Sejm also contained regu- of the Act on Insurance and Reinsurance. lations that granted the status of whistleblower to people who D. Moreover, all entities conducting brokerage activity and give reliable information regarding the possibility of a corrup- fiduciary banks are obligated to comply with the condition offence being committed. tions forming the basis for granting a permit to these enti- Regardless of the above, the whistleblower, as an employee, is ties. The permit is granted only after the entity has filed subject to protection against retaliatory discrimination (e.g. the the pertinent description of the internal inspection on the employee being dismissed from the company). basis of the Act on Trade in Financial Instruments. Whistleblowers – also pursuant to general rules following from Moreover, managers of capital companies are obligated, in internal legal frameworks – are subject to protection following this regard, to observe due diligence on the basis of Arts 293 §2 from Art. 10 of the European Human Rights Convention, and 483 §2 of the Commercial Companies Code (“the CCC”). pursuant to the Strasbourg standards set out in the judgment According to the Act on Money Laundering and Terrorism of Heinisch v. Germany. These standards provide for the need to Financing Prevention, the obliged entities (such as banks, other weigh up the interests of a given entity (such as, e.g., protection of financial institutions and even law firms) are obligated to appoint a company’s good name) with the public interest and to provide a compliance officer who will be responsible for supervising the protection for a whistleblower against sanctions dependent upon appropriate application of the Act. Moreover, these entities his/her motives, as well as the alternative means available to him/ have an obligation to introduce internal procedures in the scope her for achieving the assumed goal of disclosing information. of preventing money laundering and financing terrorism. Moreover, the definition of a whistleblower is included in The draft Act on Transparency in Public Life from the Directive (EU) 2019/1937 of the European Parliament and of previous term of Polish Sejm provided an obligation to introduce the Council of 23 October 2019 on the protection of persons internal anti-corruption procedures; however, in accordance reporting breaches of EU law. A whistleblower is a person with the principle of discounting the work of the Parliament, in who reports breaches of EU law that are harmful to the public the new term of the Parliament, which started in 2019, work on interest. Whistleblowers are persons who work for, or maintain this project was not resumed. contact with, a public or private organisation in connection with

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 106 Poland

their professional activities. In the preamble to the Directive, 5 of the CC. Moreover, the aforementioned amendment to the we read that whistleblowers “play a key role in revealing and Act on Liability of Collective Entities for Acts Prohibited Under preventing such violations and in protecting the public good”. Penalty provides for voluntary submission to criminal liability The purpose of this Directive is “to ensure a balanced and effec- by a collective entity in certain circumstances, above all when it tive protection of whistleblowers” (preamble), that is to say, notifies the prosecution authorities of the crime committed and to establish “standards ensuring a high level of protection for discloses significant circumstances of the criminal behaviour. persons who report breaches of Union law”. An internal investigation may increase the chances of a perpetrator availing of the above-mentioned conditions to reduce their criminal liability. 1.3 How does outside counsel determine who “the client” is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal 2.2 When, during an internal investigation, should a Department, the Chief Compliance Officer, the Board of disclosure be made to enforcement authorities? What Directors, the Audit Committee, a special committee, are the steps that should be followed for making a etc.)? What steps must outside counsel take to ensure disclosure? that the reporting relationship is free of any internal conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who Disclosure to enforcement authorities of information gathered might have an interest in influencing the direction of the by the company during an internal investigation is recommended investigation? to a company only after all of the proceedings have been carried out, and after it has been determined that the established facts “The client” is nearly always the interested company, while of the case contain all of the material information. Otherwise, communication is essentially conducted with its pertinent repre- it is not recommended to disclose to the enforcement authorities sentative, the management board or the Chief Compliance information gathered by the company. Officer. What is problematic are situations in which a member Banks are an exception; they are obligated, under banking of the management board (or the entire management board) is law, to immediately inform the preparatory proceedings author- suspected of bringing about the disclosure of irregularities in ities about each case in which a justified suspicion arises that the company. In such cases, communication with the client is the activity of the bank has been used to conceal a tax crime, to most often conducted by other company bodies (e.g. the super- finance terrorism, to launder money, or for purposes linked to visory board). these acts. Pursuant to the Act on Detecting and Preventing Money 22 Self-Disclosure to Enforcement Laundering and Terrorism Financing, banks and other financial institutions are obliged to register transactions and convey infor- Authorities mation on transactions that are suspected to be part of money laundering. If the General Inspector for Financial Information 2.1 When considering whether to impose civil or (“GIIF”) comes to the conclusion that a given transaction is criminal penalties, do law enforcement authorities in suspicious, it may demand that the institution withholds the your jurisdiction consider an entity’s willingness to transaction and notifies the prosecutor’s office. voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider? 2.3 How, and in what format, should the findings of an Polish law essentially does not contain developed leniency-type internal investigation be reported? Must the findings of an internal investigation be reported in writing? What institutions (except for antimonopoly/antitrust law); although in risks, if any, arise from providing reports in writing? the case of criminal liability, the perpetrator’s attitude is taken into account each time. For example, Art. 15 of the Criminal Code (“CC”) provides that a perpetrator is not subject to a In all circumstances, it is recommended that a report be drawn penalty if he/she voluntarily prevented the effect of an illegal act up in writing in a properly secured file. The results of the inves- or that the penalty is reduced for a perpetrator who voluntarily tigation should only be conveyed orally in situations where it is made efforts to that end. Art. 16 of the Tax Criminal Code regu- not possible to prepare a report in writing. The risk of a disclo- lates so-called “voluntary self-disclosure”, i.e. non-imposition of sure of data contained in the written report is minimal if the a penalty for a tax crime or misdemeanour by a perpetrator who, appropriate methods for securing these data are applied; i.e., having committed an illegal act, informed the law enforcement above all, securing the file with a password, encoding the disk, authority and disclosed material facts about the act, in particular and observing the rules for handling classified documents. regarding the persons who took part in committing it. Art. 60 § It must be pointed out, however, that under the provisions 3 of the CC provides for a reduction of the penalty for a perpe- of Polish criminal procedure, a piece of evidence shall not be trator who disclosed to the authorities information concerning deemed inadmissible exclusively on the grounds that it has been a crime, in particular the identity of other perpetrators of the obtained as a result of an infringement of the procedure or the illegal act. In the case of bribery of a public official, disclo- forbidden act referred to in Art. 1 §1 of the CC, unless the piece sure by the perpetrator of all the material facts of the crime, of evidence has been obtained in connection with the fulfilment prior to their discovery by the authorities, means that under of the official duties of a public officer, as a result of: homicide; Art. 229 § 6 of the CC he/she is not subject to a penalty. The causing deliberate damage to health; or deprivation of liberty same applies in case of corruption in business relations. If a (Art. 168a of the Code of Criminal Procedure (“CCP”)). Thus, perpetrator who, granted or promised to grant material benefit, it is impossible to entirely rule out the risk of use of information notifies the relevant authorities and discloses all of the mate- – obtained as a result of the actions of investigation authorities rial facts of the crime prior to their discovery by the authori- – in a manner which is contrary to the interests of a given entity ties, he/she shall not be subject to a penalty under Art. 296a § (e.g. hacking an IT system).

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Sołtysiński Kawecki & Szlęzak 107

32 Cooperation with Law Enforcement However, it is worth mentioning that now, in the European Union, work on establishing the European Public Prosecutor’s Authorities Office (“EPPO”) is in progress. The main purpose of this institution is to combat criminal offences affecting the finan- 3.1 If an entity is aware that it is the subject or cial interests of the European Union. Poland, amongst a few target of a government investigation, is it required to other countries, decided not to be involved in the procedure of liaise with local authorities before starting an internal creating the EPPO. On 27 July 2020, the Council appointed the investigation? Should it liaise with local authorities even European prosecutors. The prosecutors will supervise investi- if it is not required to do so? gations and prosecutions, and will constitute the EPPO college together with the Chief Prosecutor for a non-renewable term of In Poland, there is no legal obligation for an internal investiga- six years. As part of the transitional rules for the first mandate, tion to be preceded by engaging in cooperation with the prose- the European prosecutors from Greece, Spain, Italy, Cyprus, cuting authorities. If, in the course of an investigation carried Lithuania, the Netherlands, Austria and Portugal – determined out by the authorities, the object of examination is the func- by drawing lots – will hold a three-year, non-renewable mandate. tioning alone of a given entity and no specific charges have yet been made against it, then it is recommended that the entity 42 The Investigation Process only discloses information obtained as a result of an investigation when it has full knowledge of the facts of the case and after it has carefully examined all of the circumstances of the case. In 4.1 What steps should typically be included in an investigation plan? a situation where proceedings before the prosecuting authorities are already at the stage of verification of specific charges against the examined entity, the rules and procedure of cooperation are The answer depends on the character of the case, but most often specified in individual summonses or notifications served on an investigation is conducted according to the following layout. that entity, and are also determined by the actions of the persons An initial outline is established of the irregularities which may carrying out tasks on behalf of the pertinent authorities. occur in the company. Then, an inspection is carried out, inter alia, of the e-mails of company employees and an inspection of procedures and IT systems, in which key data (from the point of 3.2 If regulatory or law enforcement authorities view of the subject of the proceedings) may be found. In certain are investigating an entity’s conduct, does the entity cases, it is also necessary to carry out research of documenta- have the ability to help define or limit the scope of a government investigation? If so, how is it best achieved? tion kept in paper form. If possible, it is recommended to question individual employees and persons acting within the organisation once the preliminary conclusions have been drawn by the The law enforcement authorities act independently within their persons conducting the internal investigation in the company. powers. Through cooperation with them, the entity against which the actions of the law enforcement authorities are aimed may have an indirect influence on the scope of those powers (e.g. 4.2 When should companies elicit the assistance of by filing pertinent evidence applications or by way of participa- outside counsel or outside resources such as forensic tion in the interviewing of witnesses). consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside counsel?

3.3 Do law enforcement authorities in your jurisdiction Availing of outside specialists is recommended in every situation tend to coordinate with authorities in other jurisdictions? requiring professional knowledge in a given field, in particular in What strategies can entities adopt if they face investigations in multiple jurisdictions? the area of forensics. Strong investigative skills are an important attribute. One should also take into account specialist knowledge and skills in a given sector, experience in similar cases, as Mainly, yes. Law enforcement authorities gladly avail of numerous well as analytical abilities. regulations in this regard; both those following from Polish law (inter alia, relating to the European Arrest Warrant or the actions indicated in Art. 585 of the CCP, as well as those regulated in the 52 Confidentiality and Attorney-Client Act on Exchange of Information Between the Law Enforcement Privileges Authorities of EU Member States) and those following from EU law (e.g.: from Art. 82 of the Treaty on the Functioning of the 5.1 Does your jurisdiction recognise the attorney-client, European Union; and from Art. 5 of Council Framework Decision attorney work product, or any other legal privileges in the No. 2009/948/JHA on prevention and settlement of conflicts of context of internal investigations? What best practices exercise of jurisdiction in criminal proceedings, implemented into should be followed to preserve these privileges? Polish law in Art. 592a of the CCP), as well as from agreements on mutual legal assistance (e.g. agreement between the Republic Yes. The general rule is that attorneys and legal counsel are obliged of Poland and the United States of America on mutual legal assis- to keep everything that they obtain secret when performing tance in criminal cases). their professional duties. An attorney or legal counsel cannot be If an issue being the subject of an internal investigation may released from this secrecy. This rule applies also to documents, have an international aspect, it is decidedly recommended to with the only exception provided under Arts 180 and 226 of the avail of the assistance of a team of specialists who are familiar CCP. The interviewing of persons who practise the legal profes- with various legal systems since regulations concerning the sion, e.g. an attorney or legal counsel, with regard to facts which course of an investigation, as well as of the potential obligations are subject to secrecy, is only possible when it is indispensable to disclose its results, are in many countries significantly more for the sake of justice, and the facts cannot be established on developed than in Poland. the basis of other evidence. These restrictions apply accordingly to documents containing such classified professional secrets and

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 108 Poland

may be used as evidence in criminal proceedings only when the 62 Data Collection and Data Privacy Issues same premises are fulfilled. However, the Polish CCP permits the use of evidence obtained in breach of the law, which was mentioned above. Thus, all information obtained or created over 6.1 What data protection laws or regulations apply to the course of an internal investigation carries the risk of being internal investigations in your jurisdiction? used in a manner which is contrary to the interests of the entity. Thus, it is recommended that all files are encrypted, no open The legal norms contained in the regulations on personal data correspondence should be conducted, and personnel should be protection and protection of privacy are found, inter alia, in the instructed, as appropriate, on the subject of confidentiality. Personal Data Protection Act of 10 May 2018. This Act was issued as a result of adjusting Polish law to the provisions of 5.2 Do any privileges or rules of confidentiality apply Regulation (EU) 2016/679 of the European Parliament and to interactions between the client and third parties of the Council of 27 April 2016 (the General Data Protection engaged by outside counsel during the investigation Regulation – “GDPR”). Data protection provisions are also (e.g. an accounting firm engaged to perform transaction located in the Polish CC. testing or a document collection vendor)?

6.2 Is it a common practice or a legal requirement Cooperation with third parties is carried out each time in the in your jurisdiction to prepare and issue a document form of sub-contracting, on the basis of an earlier concluded, preservation notice to individuals who may have individual agreement containing a duly developed confidenti- documents related to the issues under investigation? ality clause, adapted to the specific nature of the commissioned Who should receive such a notice? What types of activities. documents or data should be preserved? How should the investigation be described? How should compliance with the preservation notice be recorded? 5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal investigation? No. Such an institution is not used at all in view of the lack of legal regulations, which could make it effective. Moreover, one must remember that issuing a summons to secure documents In practice, cooperation with an outside entity is much more increases the risk of a disclosure of confidential information, beneficial than with an in-house one. In the former, it is and may negatively impact the prospect of securing evidence in possible to specify the scope of obligations of the outside entity possible future preparatory proceedings. (including those obligations which concern confidentiality) in a manner adapted to the specific nature of the tasks. An outside entity is also not involved in the internal relations of the organ- 6.3 What factors must an entity consider when isational structure of the client, which may have a negative documents are located in multiple jurisdictions impact on the integrity of the internal investigation. (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)?

5.4 How can entities protect privileged documents during an internal investigation conducted in your There is a large number of issues which must be taken into jurisdiction? account in case of placing information in various jurisdictions. These include subject matters in the scope of banking secrecy or the denunciation obligation, especially with regard to foreign The scope of possible security measures is very broad, and covers branches of credit institutions. Moreover, an entity must consider both purely IT-related measures and internal procedures in the other statutory secrecies; for instance, arising out of telecom- company. In practice, much benefit is gained from applying the so-called “Demilitarised Zone” (“DMZ”); i.e., a closely moni- munication law. It is also very important for an entity to obey tored, separated area of the network. In this area, one can store GDPR provisions. In the international context, one should also information of a confidential nature, for instance on a mobile take into account the possible differences in the manner of imple- server, but it is not used for ordinary communication with other mentation of EU acts, as well as in the manner and practice of units. All information of a confidential nature, including that their application in various Member States. concerning internal investigations, should be stored in a DMZ. 6.4 What types of documents are generally deemed important to collect for an internal investigation by your 5.5 Do enforcement agencies in your jurisdictions keep jurisdiction’s enforcement agencies? the results of an internal investigation confidential if such results were voluntarily provided by the entity? In principle, what is deemed important are all documents (both Information obtained over the course of preparatory proceed- in electronic versions and in writing) which are relevant to a ings, regardless of its origin, is subject to so-called “secrecy of given case, which the entity has in its possession. There are no preparatory proceedings”. Until such time as it is disclosed significant differences between the practice of internal investi- in court proceedings, it cannot be made public, under sanc- gations and the practice of preparatory proceedings conducted tion of the penalty set out in Art. 241 §1 of the CC. Anyone by law enforcement authorities. who publicly spreads information from a closed court trial will be liable to the same punishment. In the current legal state in 6.5 What resources are typically used to collect Poland, there is a possibility of closing court proceedings to the documents during an internal investigation, and which public, subject to the public prosecutor’s consent, in cases where resources are considered the most efficient? important private interest could be infringed due to a public hearing (Art. 360 § 1 and § 2 of the CCP). Most often, cooperation is engaged in with authorised employees

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Sołtysiński Kawecki & Szlęzak 109

of the client who are instructed about what tasks they should 7.4 What are best practices for conducting witness perform and what information and documents they should interviews in your jurisdiction? obtain. Documentation is then collected in electronic form, after which it is reviewed and analysed. However, seizure of There are no strict rules for conducting witness interviews, but it electronic evidence should be performed by forensic specialists is important to take care of the rights and freedoms of a witness. using dedicated hardware and software. Interviews are essentially conducted by members of the investigation team – lawyers and forensic specialists. Sometimes, HR 6.6 When reviewing documents, do judicial or and/or compliance officers of the client also participate in such enforcement authorities in your jurisdiction permit interviews. the use of predictive coding techniques? What are best practices for reviewing a voluminous document collection in internal investigations? 7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction? Various technologies and software are used to review documents. In the case of a large number of documents, it is worth Poland is a country which is quite ethnically and culturally using review platforms, for instance Relativity or Niux. uniform. In this respect, there are no particular factors which should be taken into account when planning and conducting 72 Witness Interviews internal investigations.

7.1 What local laws or regulations apply to interviews 7.6 When interviewing a whistleblower, how can of employees, former employees, or third parties? What an entity protect the interests of the company while authorities, if any, do entities need to consult before upholding the rights of the whistleblower? initiating witness interviews? In light of the absence of detailed whistleblowing regulations There are no legal regulations in this regard; however, one in Poland, it is difficult to answer this question. However, it is should always bear in mind the personal rights of the inter- inadmissible to apply any means or methods towards the whis- viewed person. The provisions of the CCP on interviewing tleblower which could infringe his/her dignity or which could witnesses or parties to proceedings do not apply. With regard restrict his/her freedom, inter alia, freedom of speech. to current employees, depending on the situation, the provisions of the Labor Code (“LC”) may apply, in particular Art. 7.7 Can employees in your jurisdiction request to 94 point 2, which regulates the obligation to organise work in a review or revise statements they have made or are the manner best suited to make effective use of working time and statements closed? achievement of high efficiency and appropriate quality of work by employees through the exercise of their abilities and qualifi- Internal investigations have an informal character, thus these cations. In addition, one has to bear in mind that an employee, if issues take different forms depending on the internal policy of a a member of a trade union, may be represented by a trade union. given entity – in certain companies there may, for example, exist There is no obligation for earlier consultation with any authori- an internal inspection regulation which guarantees the inter- ties, regardless of the intention to interview. viewed person specific rights.

7.2 Are employees required to cooperate with their 7.8 Does your jurisdiction require that enforcement employer’s internal investigation? When and under authorities or a witness’ legal representative be present what circumstances may they decline to participate in a during witness interviews for internal investigations? witness interview?

There is no such requirement in Polish law. The obligation to cooperate with the employer follows essentially from Art. 100 § 2 point 4 of the LC; i.e., the confidentiality of information, the disclosure of which could cause damage 82 Investigation Report to the employer. In the absence of application of the provisions of the CCP to internal investigations, an employee does 8.1 How should the investigation report be structured not have the right to refuse to make a statement. At the same and what topics should it address? time, however, the interviewed person does not face any consequences, apart from professional ones, in the case of making a Reports on internal investigations are almost always drawn false statement or refusing to make a statement. up in writing as this facilitates both their later use by a given entity, and the management of the information collected over 7.3 Is an entity required to provide legal representation the course of the investigation. Of course, recording the to witnesses prior to interviews? If so, under results of the investigation on a permanent carrier gives rise to what circumstances must an entity provide legal certain risks, as mentioned above in the answer to question 2.3. representation for witnesses? Situations also occur (though rarely) in which the preparation of a written report is required directly by legal provisions. An This obligation does not exist because of the informal character example of such a regulation is point 4.29 of attachment No. 2 of the internal investigation. to the regulation of the Minister for Health on the conditions of Good Manufacturing Practice.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 110 Poland

Tomasz Konopka joined Sołtysiński Kawecki & Szlęzak (“SK&S”) in 2002. Since 2013, as a partner specialising in business crime and investigation, he has headed a team of lawyers (which he created in 2008) that deals with business crime cases. Before joining SK&S, he was an attorney for a number of years and sat on the boards of a range of firms, including those listed on the Warsaw Stock Exchange. He advises and represents clients in cases involving criminal liability risk. He also advises entities that have incurred damage as a result of business crime. Tomasz has extensive experience in conducting internal clarification proceedings, covering abuses such as corruption, fraud, money laundering, acting to the detriment of business entities, forgery and other crisis situations. He advises clients on planning and implementing comprehensive compliance projects, as well as solutions which improve business security, including cybersecurity. He represents Polish and foreign clients before courts and prosecution authorities in Poland and abroad. Tomasz is a speaker at and organiser of conferences devoted to the issues of criminal liability, as well as compliance. He is the author of a range of Polish and foreign publications dealing with criminal law. Tomasz has been recommended many times as a Leading Lawyer in his field in leading foreign rankings, such as Chambers and Partners and The Legal 500, as well as in the law firm rankings of the newspaper Rzeczpospolita. He is a member of the Association of Certified Fraud Examiners (“ACFE”), and since 2020 he has been the Regional Representative for Europe in the Anti-Corruption Committee of the International Bar Association (“IBA”).

Sołtysiński Kawecki & Szlęzak Tel: +48 22 608 7067 Jasna 26 Email: [email protected] 00-054 Warsaw URL: www.skslegal.pl Poland

Opened in 1991, Sołtysiński Kawecki & Szlęzak is one of the leading law Sołtysiński Kawecki & Szlęzak employs top-class specialists who have firms on the Polish market. The firm provides a comprehensive service expert knowledge not only of the law, but also of the practical functioning to large business entities (both public and private) in Poland and abroad. of business entities. Sołtysiński Kawecki & Szlęzak employs over 150 lawyers within various www.skslegal.pl specialist areas, and thus offers a very broad range of legal services. One of the leading departments of Sołtysiński Kawecki & Szlęzak is the White-Collar Crime Department, which deals with business crime law practice; as part of this, it conducts a comprehensive service of clients, inter alia, involved in criminal proceedings. Lawyers employed in the White-Collar Crime Department carry out assignments related not only to conducting criminal proceedings themselves, but also to carrying out tasks of an investigative and audit nature, and assisting business entities in conducting internal investigations.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 18 111

Portugal Portugal

Tiago Félix da Costa

João Matos Viana

Morais Leitão, Galvão Teles, Soares da Silva & Associados Frederico Machado Simões

12 The Decision to Conduct an Internal infractions. Furthermore, the National Strategy for Combating Corruption (2020–2024) aims to introduce significant changes Investigation to the current legal framework on compliance, whistleblowing and internal investigations; however, it has yet to translate into 1.1 What statutory or regulatory obligations should concrete legislative proposals. an entity consider when deciding whether to conduct an internal investigation in your jurisdiction? Are there any consequences for failing to comply with these statutory 1.2 How should an entity assess the credibility of a or regulatory regulations? Are there any regulatory or whistleblower’s complaint and determine whether an legal benefits for conducting an investigation? internal investigation is necessary? Are there any legal implications for dealing with whistleblowers? While there are no specific rules for corporate investigations, whenever an internal investigation is or becomes aimed at sanc- Under the Portuguese AML Law, obliged entities must record tioning a particular employee, it must follow the procedural any complaints filed and must immediately proceed with the guarantees set out in the Portuguese Labour Code (Law No. implementation of new due diligence measures whenever the 7/2009, of 12 February). Failure to comply with such guarantees complaint gives the obliged entity reasons to doubt the veracity when sanctioning an employee may determine the invalidity of or accuracy of the data provided by a client. Furthermore, if the sanctions applied, as well as a regulatory offence. the complaint provides the obliged entity with enough reasons Furthermore, under the Portuguese Anti-Money Laundering to suspect that certain funds or assets may be the product of and Counter-Terrorism Financing Law (Law No. 83/2017, of 18 criminal activities or linked to the financing of terrorism, those August – “AML Law”), obliged entities are required to examine funds or assets should be reported to the authorities. and report activities which may be linked to money laundering or Certain regulators may require the submission of periodic the financing of terrorism. Moreover, entities under this obliga- reports on the complaints received. tion must define and apply internal compliance systems to miti- Whistleblowers may not be subject to any form of retaliation gate the risk of money laundering and financing of terrorism. for presenting a complaint, unless that complaint is deliberately Failure to comply with these duties is a regulatory offence and manifestly false, and their identity must remain confidential. under the AML Law. Failure to comply with these duties is a regulatory offence Under the General Data Protection Regulation [Regulation under the AML Law. Moreover, the illegal revelation, whether (EU) 2016/679 of the European Parliament and of the Council wilfully or negligently, of a whistleblower’s identity, is a criminal of 27 April 2016 – “GDPR”], the Portuguese Personal Data offence under the AML Law. Protection Law (Law No. 58/2019, of 8 August) and the Portuguese Safety in Cyberspace Law (Law No. 46/2018, of 13 1.3 How does outside counsel determine who “the client” August), entities subject to its scope are required to implement is for the purposes of conducting an internal investigation adequate measures to ensure the safety of stored data, as well as and reporting findings (e.g. the Legal Department, the to conduct impact assessments. Chief Compliance Officer, the Board of Directors, the Failure to comply with these duties is a regulatory offence Audit Committee, a special committee, etc.)? What steps under the aforementioned laws. must outside counsel take to ensure that the reporting relationship is free of any internal conflicts? When is More generally, under article 71, section 2, subsection e), it appropriate to exclude an in-house attorney, senior of the Portuguese Criminal Code (Decree-Law No. 400/82, executive, or major shareholder who might have an of 23 September), internal investigations may be construed interest in influencing the direction of the investigation? as a mitigating factor in a company’s criminal and regulatory liability if the company has ordered an internal investigation to The outside counsel’s “client”, for the purposes of an internal uncover and denounce the execution of criminal or regulatory investigation, is the company, and the outside counsel must report

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 112 Portugal

its findings to whoever is designated to act on the company’s 2.2 When, during an internal investigation, should a behalf in the internal investigation. disclosure be made to enforcement authorities? What are Outside counsel should seek, at the onset of the investigation, the steps that should be followed for making a disclosure? preferably in the engagement letter, to establish clear reporting channels and provide for an alternative reporting channel, to As explained above, under the Portuguese Competition Law be used in case a conflict of interests compromises the main and the Portuguese Framework for Regulatory Offenses in reporting channel. Moreover, obliged entities under the AML the Energy Sector, companies that disclose an infraction to Law must ensure, through their internal control mechanisms, the authorities early reap the most benefits from collaboration. that conflicts of interests can be prevented or circumvented, Therefore, disclosures should be made as soon as possible. under penalty of incurring in a regulatory offence. Pursuant to the Portuguese Securities Code, facts that may Outside counsel acts in the interests of the company, and come to be qualified as financial crimes must be immediately therefore it is always appropriate to exclude a person when disclosed to the Portuguese Securities Market Commission. there are compelling reasons to believe there is a conflict of However, the disclosure must describe the reasons for the suspi- interests between that person and the company. cion, as well as offer a detailed account of the operations in question and the persons involved. Therefore, disclosures should 22 Self-Disclosure to Enforcement be made as soon as the necessary information is obtained or Authorities deemed unobtainable by the company. In accordance with the Portuguese Criminal Procedure 2.1 When considering whether to impose civil or Code (Decree-Law No. 78/87, of 17 February), public officials, criminal penalties, do law enforcement authorities in including executives and employees of companies engaged in your jurisdiction consider an entity’s willingness to a public service concession, are required to report to authori- voluntarily disclose the results of a properly conducted ties any crime that they become aware of in the exercise of, and internal investigation? What factors do they consider? because of, their duties. Under the Portuguese AML Law, facts should be reported As mentioned above, a company’s willingness to disclose the as soon as there are sufficient reasons to believe that certain results of a properly conducted internal investigation may funds or assets are the result of criminal activity or related to the be construed as a mitigating factor, pursuant to article 71, financing of terrorism. section 2, subsection e) of the Portuguese Criminal Code. Companies should attempt to determine whether the facts Notwithstanding this general principle, there are several sectors determined during the investigation constitute an offence and of where the disclosure of information to authorities is required what kind, regulatory or criminal, in order to establish whether and/or rewarded. disclosure is warranted and which authority is competent to Financial intermediaries are required by the Portuguese receive the disclosure. Securities Code (Decree-Law No. 486/99, of 13 November) to report facts which may be linked to financial crime to the 2.3 How, and in what format, should the findings of an Portuguese Securities Market Commission, offering a detailed internal investigation be reported? Must the findings of account of the reasons for suspicion, the operations in question an internal investigation be reported in writing? What and any other relevant information. risks, if any, arise from providing reports in writing? Failure to comply with this duty is a regulatory offence under the Portuguese Securities Code. Generally, there are no format requirements for disclosing the The Portuguese Securities Code establishes that the minimum findings of an internal investigation. However, such findings will and maximum limits of the fines applicable to regulatory typically be written down by the authority receiving the disclo- offences may be lowered if a defendant assists the Portuguese sure, thus being advisable, for the sake of accuracy, to provide Securities Market Commission’s investigation. written disclosures. Some authorities, such as the Portuguese Likewise, the Legal Framework of Credit Institutions and Competition Authority, provide optional online channels for Financial Companies (Decree-Law No. 298/92, of 31 December) disclosing information. requires that the management and supervisory bodies of credit The Portuguese AML Law establishes a specific framework institutions inform the Bank of Portugal of internal or external for disclosures, which must be made in writing, through the instances of fraud with potential adverse impacts on results or secure channels defined by the competent authority. capital. Failure to comply with this duty is a regulatory offence under 32 Cooperation with Law Enforcement the Legal Framework of Credit Institutions and Financial Companies. Authorities The Portuguese Competition Law (Law No. 19/2012, of 8 May) allows the first company to report infractions in which it 3.1 If an entity is aware that it is the subject or participated to benefit from an exemption from the applicable target of a government investigation, is it required to fine, and also allows subsequent companies that offer additional liaise with local authorities before starting an internal investigation? Should it liaise with local authorities even evidence of significant value to benefit from a reduction of the if it is not required to do so? applicable penalty. The Framework for Regulatory Offenses in the Energy Sector (Law No. 9/2013, of 28 January) provides that a company that An entity under government investigation is not required to spontaneously comes forward with the necessary information liaise with any local authorities before launching an internal for the Portuguese Energy Sector Regulator to safeguard the investigation. public interest, spontaneously redresses any damages caused and, A company’s willingness to liaise with authorities may, henceforth, is fully cooperative, can benefit from an exemption however, be construed as a mitigating factor, pursuant to article from the applicable fine. 71, section 2, subsection e), of the Portuguese Criminal Code.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Morais Leitão, Galvão Teles, Soares da Silva & Associados 113

3.2 If regulatory or law enforcement authorities to any information or materials obtained in the context of the are investigating an entity’s conduct, does the entity provision of legal services. have the ability to help define or limit the scope of a Attorney-client privilege can be lifted in exceptional cases, government investigation? If so, how is it best achieved? notably in criminal proceedings or in assertion of a defence of the client or the lawyer’s legitimate interests. A company may offer relevant information or request that the authorities execute certain investigative measures, which may 5.2 Do any privileges or rules of confidentiality apply influence the scope of an investigation. However, given that to interactions between the client and third parties authorities are independent, there are no other means to define engaged by outside counsel during the investigation or limit the scope of the investigation. (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)?

3.3 Do law enforcement authorities in your jurisdiction tend to coordinate with authorities in other jurisdictions? In Portugal, many professions are subject to a professional duty What strategies can entities adopt if they face of secrecy (including accountants), which covers information or investigations in multiple jurisdictions? materials obtained in the context of the provision of the respective services. In criminal procedures, law enforcement tends to coordinate Notwithstanding the aforementioned legal duties of secrecy, and cooperate with authorities in other jurisdictions, with the it is advisable to conclude non-disclosure agreements with any aid of a specialised section of the Prosecutor General’s Office: third parties contacted during the course of the investigation. the Bureau of Documentation and Comparative Law. In regulatory offence procedures, the degree of coordination and cooper- 5.3 Do legal privileges apply equally whether ation with authorities in other jurisdictions depends on the sector in-house counsel or outside counsel direct the internal in question. The Portuguese Competition Authority, the Bank investigation? of Portugal and the Portuguese Securities Market Commission have several collaboration protocols with their respective foreign Yes, as long as the in-house counsel is a registered member of the counterparts, both within and outside the European Union. Portuguese Bar Association. When facing investigations in multiple jurisdictions, it is important to seek outside counsel with a strong international network, in order to ensure the legality of the investigation in all 5.4 How can entities protect privileged documents relevant jurisdictions. during an internal investigation conducted in your jurisdiction? 42 The Investigation Process Privileged documents should be clearly marked as such and 4.1 What steps should typically be included in an authorities should not be allowed to access them. However, in investigation plan? the event that privileged documents are accessed or seized, the validity of the access or seizure should be immediately challenged by the entity’s attorney in the authority’s report of the search. Investigation plans should establish the scope of the investigation, define main and alternative reporting channels, identify relevant documentation and individuals, provide for the 5.5 Do enforcement agencies in your jurisdictions keep proposal and execution of preventive measures and outline the the results of an internal investigation confidential if structure of the final report. such results were voluntarily provided by the entity?

4.2 When should companies elicit the assistance of Under Portuguese Law, in principle, proceedings may only be outside counsel or outside resources such as forensic confidential until criminal charges are pressed. After those consultants? If outside counsel is used, what criteria or charges are pressed, in principle, all information and documen- credentials should one seek in retaining outside counsel? tation provided to the authorities will be made public. There are, however, some exceptions to this rule, namely to ensure Outside counsel and resources should be hired whenever the the protection of privacy data and trade secrets in competition complexity of the issue demands specialised knowledge, or offence proceedings. whenever it is foreseeable that the issue may generate a conflict of interests within the company or give rise to criminal or regu- 62 Data Collection and Data Privacy Issues latory proceedings. The most important criteria for retaining outside counsel are 6.1 What data protection laws or regulations apply to experience, specialised knowledge and confidentiality guarantees. internal investigations in your jurisdiction?

52 Confidentiality and Attorney-Client All general data protection laws and regulations are applicable to Privileges internal investigations, namely, the GDPR and the Portuguese Personal Data Protection Law. Furthermore, the Portuguese 5.1 Does your jurisdiction recognise the attorney-client, Labour Code’s data protection rules will also apply whenever the attorney work product, or any other legal privileges in the investigation involves the personal data of employees. context of internal investigations? What best practices should be followed to preserve these privileges?

Portuguese Law recognises attorney-client privilege with respect

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 114 Portugal

6.2 Is it a common practice or a legal requirement 72 Witness Interviews in your jurisdiction to prepare and issue a document preservation notice to individuals who may have documents related to the issues under investigation? 7.1 What local laws or regulations apply to interviews Who should receive such a notice? What types of of employees, former employees, or third parties? What documents or data should be preserved? How should authorities, if any, do entities need to consult before the investigation be described? How should compliance initiating witness interviews? with the preservation notice be recorded? There are no laws or regulations applicable to interviews of Authorities may issue preservation notices for computer data, employees, former employees or third parties in the context of pursuant to the Portuguese Cybercrime Law (Law No. 109/2009, internal investigations. of 15 September). Complainants that have acquired “Assistant” No authorities need to be consulted before initiating such status, as well as suspects, may request from authorities the issu- interviews. ance of a preservation notice. Non-compliance with the preservation notice may constitute a criminal offence. 7.2 Are employees required to cooperate with their Furthermore, parties in civil proceedings may request that employer’s internal investigation? When and under the court order the opposing party to produce a document. what circumstances may they decline to participate in a Non-compliance with the court’s order may result in a fine and witness interview? the inversion of the burden of proof. Employees are subject to the employer’s power of direction. As 6.3 What factors must an entity consider when such, employees can be instructed to cooperate in an internal documents are located in multiple jurisdictions investigation. However, the employer’s power of direction cannot (e.g. bank secrecy laws, data privacy, procedural infringe upon the employee’s rights, namely, the employee’s rights requirements, etc.)? to privacy and to remain silent in disciplinary proceedings.

When the required documents are located in multiple jurisdic- 7.3 Is an entity required to provide legal representation tions, the company should consider whether mutual legal assis- to witnesses prior to interviews? If so, under tance is required to obtain such documents and which are the what circumstances must an entity provide legal most efficient mutual legal assistance instruments to obtain those representation for witnesses? documents. Companies are not required to provide legal representation to 6.4 What types of documents are generally deemed witnesses. However, pursuant to article 66, section 3, of the important to collect for an internal investigation by your Portuguese Bar Association’s Statutes, witnesses cannot be jurisdiction’s enforcement agencies? forbidden from seeking legal representation.

When investigating crimes and regulatory offences, authorities 7.4 What are best practices for conducting witness typically focus on bank records, transaction records and emails. interviews in your jurisdiction? Thus, internal investigations should focus on the same kinds of documents. Interviews should begin by informing the witness of the relevant context, of his or her rights, and initial questions should be open- 6.5 What resources are typically used to collect ended. Impertinent or leading questions should be avoided. The documents during an internal investigation, and which employee should be questioned on how he or she came to know resources are considered the most efficient? the facts being reported. Interviews should be documented and the resulting docu- Electronic evidence is the most common resource used when ments reviewed and signed by all participants. Audio and video conducting investigations. It is advisable that adequate measures recordings should only be used if the employee offered his or be taken to guarantee the integrity of the documents collected, her express consent. namely through the use of hash functions and by employing Non-disclosure agreements may be concluded with the digital forensics professionals. employee if the subject matter is particularly sensitive.

6.6 When reviewing documents, do judicial or 7.5 What cultural factors should interviewers be aware enforcement authorities in your jurisdiction permit of when conducting interviews in your jurisdiction? the use of predictive coding techniques? What are best practices for reviewing a voluminous document collection in internal investigations? There are no cultural factors in Portugal that require special attention when conducting interviews. In accordance with the Criminal Procedure Code, any person Portuguese authorities do not use predictive coding techniques who intervenes in a criminal procedure and does not understand for analysing data. Portuguese is entitled to an interpreter. However, several Portuguese law firms have begun adopting AI tools for due diligence and electronic discovery.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Morais Leitão, Galvão Teles, Soares da Silva & Associados 115

7.6 When interviewing a whistleblower, how can 7.8 Does your jurisdiction require that enforcement an entity protect the interests of the company while authorities or a witness’ legal representative be present upholding the rights of the whistleblower? during witness interviews for internal investigations?

Companies should ensure that complaints are acknowledged Portuguese Law does not require enforcement authorities or the and offer feedback on the complaint. Complaints should be witness’ legal representatives to be present during the witness considered credible and should be acted upon, except where interview conducted in the context of an internal investigation. manifestly false. Whistleblowers must be allowed to benefit from legal 82 Investigation Report representation during the interview. The interview should preferably be conducted by an impar- 8.1 How should the investigation report be structured tial third party. and what topics should it address? The whistleblower’s identity should remain confidential and the whistleblower should not be the target of any form of retaliation as a consequence of filing a complaint, unless that Investigation reports should include: an executive summary; complaint is knowingly and manifestly false. scope of the investigation; evidence collected (interviews and documents); facts ascertained; analysis of the facts ascertained; and recommendations. 7.7 Can employees in your jurisdiction request to Certain sectors have more specific requirements. In particular, review or revise statements they have made or are the the AML Law requires that reports contain: the identification statements closed? of the persons involved and, if known, their respective activities; the analysis methodology employed by the obliged entity; Employees are entitled to review the documentation of any a description of the suspicious operations; the concrete factors statement made and challenge its veracity or accuracy. that gave rise to suspicion; and a copy of the documentation that Employees can also ask to review or revise past statements, supports the analysis methodology. but the company is not required to allow it. Also, the Portuguese Securities Code requires that financial intermediaries, when reporting financial crimes, describe: the reasons for suspicion; the operations in question; the orders given; the persons involved in the transaction; the means of trading; the portfolios involved; the transaction’s economic beneficiaries; the markets in question; and any other information potentially of significance.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 116 Portugal

Tiago Félix da Costa joined the firm in 2007 and became a partner in 2015. He is a member of the litigation team, coordinating one of the criminal litigation, regulatory sanctions and compliance teams and the data protection team. Having been practising law since 2004, Tiago has wide experience in the areas of criminal and regulatory litigation and civil, corporate and commercial litigation. Tiago has also acted in the personal data protection field, providing legal assistance on criminal and regulatory processes in this area and assisting several companies on the creation of policies and programmes of “compliance” in the personal data protection field. From 2009 until 2018, Tiago was a Guest Professor at Nova Law School and often teaches several Advanced and Postgraduate Courses in his areas of practice. In 2017, he received the “40 under Forty Award” organised by Iberian Lawyer, which distinguishes 40 lawyers under the age of 40 in Portugal and Spain. In 2019, Tiago was nominated in “Client Choice”, exclusively for Portugal, in the category “Litigation”. He coordinates Instituto Miguel Galvão Teles, established in 2016.

Morais Leitão, Galvão Teles, Soares da Silva & Tel: +351 213 817 400 Associados Email: [email protected] Rua Castilho, 165 URL: www.mlgts.pt 1070-050 Lisboa Portugal

João Matos Viana joined the firm in 2001 and became a non-equity partner in 2019. He is a member of the litigation team. Currently, he practises in the area of litigation, focusing specifically on criminal and administrative offences involving banking, securities, insurance, competition and pharmaceutical law. João collaborates regularly within administrative, tax and corporate areas regarding criminal/administrative matters. João is the author of several articles regarding criminal law and criminal procedure law.

Morais Leitão, Galvão Teles, Soares da Silva & Tel: +351 213 817 400 Associados Email: [email protected] Rua Castilho, 165 URL: www.mlgts.pt 1070-050 Lisboa Portugal

Frederico Machado Simões joined the firm in May 2017. He is a member of the litigation and arbitration team. Previously, Frederico completed an internship with Liberum Advogados (January 2016). On the academic circuit, Frederico is a guest lecturer at the University of Lisbon School of Law and a researcher at the Center for Research in Criminal Law and Criminal Studies.

Morais Leitão, Galvão Teles, Soares da Silva & Tel: +351 213 817 400 Associados Email: fmsimõ[email protected] Rua Castilho, 165 URL: www.mlgts.pt 1070-050 Lisboa Portugal

Morais Leitão, Galvão Teles, Soares da Silva & Associados (Morais Leitão) Morais Leitão Legal Circle is an international alliance of law firms created is a leading full-service law firm in Portugal, with a solid background of by Morais Leitão, based upon the sharing of values and common princi- decades of experience. Broadly recognised, Morais Leitão is a reference in ples of action with the purpose of establishing a platform that delivers high several branches and sectors of the law on national and international levels. quality legal services to clients around the world. It encompasses a select The firm’s reputation amongst both peers and clients stems from the excel- set of jurisdictions, including Portugal, Angola and Mozambique. lence of the legal services provided. The firm’s work is characterised by a www.mlgts.pt unique technical expertise, combined with a distinctive approach and cutting- edge solutions that often challenge some of the most conventional practices. With a team comprising over 250 lawyers at the client’s disposal, Morais Leitão is headquartered in Lisbon with additional offices in Porto and Funchal. Due to its network of associations and alliances with local firms and the creation of the Morais Leitão Legal Circle in 2010, the firm can also offer support through offices in Angola (ALC Advogados) and Mozambique (HRA Advogados).

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 19 117

Serbia Serbia

ŠunjkaLaw Tomislav Šunjka

12 The Decision to Conduct an Internal as well as to protect the whistle-blower from harmful actions. The entity is obliged to designate a person authorised to receive Investigation complaints and to conduct the procedure in connection with the complaint. The entity is obliged to act on the complaint without 1.1 What statutory or regulatory obligations should delay, and at the latest, within 15 days from the date of receipt. an entity consider when deciding whether to conduct an Entities with more than 10 employees are obliged to regulate the internal investigation in your jurisdiction? Are there any procedure of internal whistle-blowing. consequences for failing to comply with these statutory With regard to the verification of the information from the or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? complaint, the entity will conduct the verification in accordance with the information available to it initially, using the formula of trustfulness of the information, which would be conveyed The entity should consider, at the minimum, the Constitution to a person with average knowledge and experience (identical (basic human rights protection), Employment Law, Company to the whistle-blower himself). After the initial check, if it is Law, Data Protection Law, the Criminal Code and the Criminal stated that there is a basis or reasonableness for any doubt, the Procedure Code, the Law on Criminal Liability of Legal Entities, entity will initiate an internal investigation. In working with the Law on Contracts and Torts (especially the part on damages), whistle-blowers, the entity must strictly abide by the Law on the Code of Professional Ethics of the Serbian Chamber of Protection of Whistle-blowers, because it is subject to the provi- Commerce, the Law on Protection of Business Secrets, the Civil sions on compensation for damages to the whistle-blower or Code (the part which refers to privilege and exemption from misdemeanour liability for the entity as well as the responsible the obligation to testify), the Law on Whistle-blowers, the Law person within the entity. on Free Access to Information of Public Importance, and the Law on Banks (the part which refers to bank secrecy). There could be various legal consequences, which could result in: an 1.3 How does outside counsel determine who “the obligation to compensate material or non-material damages for client” is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal the entity and the person who was subject to or participated in Department, the Chief Compliance Officer, the Board of the investigation as a witness; misdemeanour responsibility and Directors, the Audit Committee, a special committee, responsibility as a commercial misdemeanour, for the entity etc.)? What steps must outside counsel take to ensure and for the responsible person; and criminal responsibility for that the reporting relationship is free of any internal obstruction of justice. conflicts? When is it appropriate to exclude an in-house There are direct and indirect legal benefits from conducting an attorney, senior executive, or major shareholder who investigation, and all of the enforcement authorities, including might have an interest in influencing the direction of the the prosecutors and courts, will take a properly conducted investigation? internal investigation and cooperation with the authorities as an indirect legal benefit, which may include investigations where This presents one of the most important starting points in an there is a legal epilogue of a criminal procedure against the legal internal investigation. Outside counsel will determine that the entity, as a mitigating circumstance and a reduction; i.e., the legal entity is the client. Protection and the legal interest of the mitigation of a criminal sanction. If the legal epilogue is a crim- entity is the primary concern of outside counsels’ actions. Who inal offence of tax evasion or tax fraud, and the entity itself, has legal standing in a particular case and which corporate body after conducting an internal investigation, files the tax applica- of the legal entity is conflict-free to sign the power of attorney tion and then pays the tax, the criminal proceedings will not be and mandate letter, and to receive the report of the internal conducted and, if initiated, will be suspended. investigation and fact-findings with the conclusion and opinion (e.g. the Legal Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, 1.2 How should an entity assess the credibility of a whistleblower’s complaint and determine whether an Fraud function, anti-bribery management system (ABMS) func- internal investigation is necessary? Are there any legal tion, etc.), will be determined by outside counsel in the prelim- implications for dealing with whistleblowers? inary moment of engagement, and entered into his mandate letter or agreement on counselling. This determination can be changed if the results of the internal investigation show the The entity is obliged, in the scope of its authority, to take meas- involvement of the ordering party in the concrete case. Such a ures to eliminate identified irregularities in relation to complaints clause in a mandate letter should be inserted in advance.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 118 Serbia

As well as determining who the primary point of contact 2.3 How, and in what format, should the findings of an for the report is, the secondary point of contact should also be internal investigation be reported? Must the findings of determined in case, during the investigation, it is determined an internal investigation be reported in writing? What that the primary point of contact is in any kind of conflict of risks, if any, arise from providing reports in writing? interest, or even has direct involvement or interest. For example, if in a particular case outside counsel determines that there is Commonly, the report of the internal investigation is submitted involvement or conflict of interest on the side of the in-house in writing and contains facts finding non-conformities with attorney and senior executive, the correct contact for the report different laws, statutes and corporate rules, a major violation of would be the fraud and anti-money laundering (AML) func- different laws, statutes and corporate rules, an explanation of tion, as well as the supervisory board, the shareholder assembly the participants, interests, actions and omitted actions, an expla- and/or major shareholder; however, if there is involvement or nation and the implications of the decisions made and a proposal conflict of interest on the side of the major shareholder, outside of legal procedures and actions, civil claims, criminal claims, counsel will report to senior executive management, the super- etc. However, if such a report is written and the findings of visory board or the shareholder assembly, on which the major the report are not acted upon or there were attempts to hide it, shareholder would not have the right to vote due to conflict and yet it is still disclosed, there is a high reputation risk. When of interest. Outside counsel must stay professional and inde- a criminal offence is stated in the report and is consequently pendent, and perform their term of references, task and scope of not reported to the competent authority, it could result in legal activities only to the benefit of the entity. consequences such as a criminal procedure against the person or persons who hid it, who failed to report the preparation of 22 Self-Disclosure to Enforcement the criminal offence, or the offence itself, or whoever failed to Authorities report the perpetrator of a criminal offence. If the report and the findings of an internal investigation are in writing, this is evidence or, at the minimum, a starting point and source of 2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in valid information for the competent authority, individuals and your jurisdiction consider an entity’s willingness to stakeholders who may have interests in the process, victims and voluntarily disclose the results of a properly conducted suspected persons. internal investigation? What factors do they consider? 32 Cooperation with Law Enforcement After an internal investigation, if it is determined that there was Authorities a criminal offence, the entity will file a criminal charge to the competent prosecutor against the person/persons who were 3.1 If an entity is aware that it is the subject or deemed responsible. In an ongoing official investigation, the target of a government investigation, is it required to prosecutor, the court and the police may use the findings gath- liaise with local authorities before starting an internal ered in the internal investigation and deem it as legal evidence investigation? Should it liaise with local authorities even if it was properly conducted. In the event that a criminal proce- if it is not required to do so? dure against the legal entity is an epilogue of the said official procedure, the enforcement authorities, including the court and This question must be answered from a different perspective. In the prosecutor, will take the conducted internal investigation a civil law system, there is no obligation for the suspect (person and especially willingness to voluntarily disclose the results of or entity), who is the subject of a government investigation, to an internal investigation as a mitigating factor for the reduction cooperate with the authorities, or to provide all the evidence to of criminal sanctions, and render a conditional conviction and the authorities. In these cases and from that perspective, when judicial admonition. If the legal epilogue is a criminal offence – defending, the entity will create its own strategy – a defence for example, tax evasion or tax fraud – and the entity itself, after strategy at first, and a parallel internal investigation if the entity an internal investigation, files the tax application and then pays wants to separate its own position as an entity from the position the tax, the criminal proceedings will not be conducted and, if of the senior executives, the responsible persons or the compa- initiated, will be suspended. ny’s body.

2.2 When, during an internal investigation, should a 3.2 If regulatory or law enforcement authorities disclosure be made to enforcement authorities? What are investigating an entity’s conduct, does the entity are the steps that should be followed for making a have the ability to help define or limit the scope of a disclosure? government investigation? If so, how is it best achieved?

During an internal investigation, a disclosure should be made to In case of a formal law enforcement investigation of an entity’s the enforcement authorities immediately if the internal investi- conduct, the limitation of the scope of a governmental inves- gation discovers a criminal act while it is still happening, since tigation does not exist and the entity cannot define any limit it could be stopped and/or prevented, or if an immediate threat or scope. The scope of an investigation is determined by the to people or property exists, which can and has to be prevented. Criminal Code or similar statute as a legal basis for the action In such a case, the internal investigation engages with the entity of the authorities. If, during the law enforcement investiga- it has been in contact with, and advises it to immediately inform tion, some civil or human personal rights appear and need to be the enforcement authorities, with different demands, such as protected, the prosecutor or judge in charge will make a separate obtaining a freezing order, stopping the money transaction, decision about that and the investigation will continue. inspecting employment or construction, etc.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London ŠunjkaLaw 119

3.3 Do law enforcement authorities in your jurisdiction 4.2 When should companies elicit the assistance of tend to coordinate with authorities in other jurisdictions? outside counsel or outside resources such as forensic What strategies can entities adopt if they face consultants? If outside counsel is used, what criteria investigations in multiple jurisdictions? or credentials should one seek in retaining outside counsel? In any cross-border case, whether a criminal investigation or civil investigation or procedure, the local authorities will coop- In a situation where there is a suspicion of conflict of interest erate and coordinate with the authorities in other jurisdic- or even involvement of in-house counsel in a specific case or tions. The basis for this cooperation differs and it could be when a conflict of interest or even involvement is suspected in on different levels of authority. Cooperation can be bilateral a permanent outside law firm that supports the business oper- or multilateral, as between the police authorities, or bilateral ations of the entity daily or when the entity simply wants to or multilateral between courts, prosecutors’ offices, etc. The provide an independent professional investigation, the entity manner and kind of cooperation is determined by bilateral or will decide to engage outside legal counsel to lead an internal multilateral agreements. Usually, the legal instrument that is investigation with a mandate to engage further with outside used for cooperation is a request or notice for international legal sources, such as forensic consultants, from a specific field of assistance. In tax and customs matters, a direct exchange infor- expertise, where appropriate. In certain situations, one of the mation relationship also exists. Entities in this kind of situa- reasons for engaging with outside counsel is the existence of a tion will make the strategy of cooperation according to their legal privilege, which does not exist when it comes to in-house own estimation of their legal position in a particular case and counsel or outside consultant firms. The criteria for choosing legal situation – from full legal cooperation to a very restric- outside counsel should be: the level of expertise in particular tive defence strategy. If a defence strategy is chosen, the entity types of cases; experience and professionalism; integrity; inde- should engage defence counsel in each jurisdiction where the pendency; and work and business ethic. investigation will take place. Defence counsel will monitor the procedure. When requesting international legal assistance, the 52 Confidentiality and Attorney-Client authority, before sending such a notice or request, will have to Privileges verify the following conditions: is the particular criminal act described in the request/notice a criminal act in the domestic 5.1 Does your jurisdiction recognise the attorney- country; are all requirements by domestic/local law fulfilled; client, attorney work product, or any other legal does any political objection to the case exist; and do any local privileges in the context of internal investigations? What limitations in the disclosure of information exist, etc. best practices should be followed to preserve these Related to this matter, the local authority which is appointed privileges? for international cooperation will also look into the same conditions, and only if every condition is met will it give assistance. In our legal system, there is attorney-client privilege and similar If something is missing, the local authorities will reply to our attorney work privilege in every legal procedure, including authorities and explain to them why they did not give assistance internal investigations. These privileges are recognised by courts, and will, potentially, offer instructions to repeat the request for prosecutors and other authorities. Legal privilege is protected assistance after fulfilment of the missing condition. by law (including statutory law) and cannot be changed. For example, if in a criminal proceeding a lawyer is called upon as 42 The Investigation Process a witness, and if his testimony includes facts on his work as a lawyer, the acting judge will ask his client if he releases the lawyer 4.1 What steps should typically be included in an from confidentiality, and if he does, the lawyer will be able to investigation plan? answer the questions of the judge and other participants in the proceedings. We have experience of this. In a criminal white- When an investigation plan is created, the following must be collar crime case, where we represented a legal entity, there was considered: which organisational unit and which persons in that a legal question of who instructed the outside lawyer to draft the organisational unit of the entity will be the subject of the inves- contract which created intentional damage to our client – the tigation; what is the subject of the investigation; what constitutes legal entity and the victim. The outside lawyer was engaged offi- the legal framework for the investigation; what is the scope of cially with our client, but it was unclear who really instructed the investigation; what is the goal of the investigation; who will him. Our client – the legal entity – informed the judge in the case conduct the investigation and who the report will be submitted in writing about the releasing of privilege and gave full authority to; the budget of the investigation; the timeframe; the frame- to the judge to take a statement from the outside lawyer. We work for the order of activities such as the reading and control of asked questions, too, and he was obliged by law to answer us. documents; determining the relevant documents for the forensic process, if necessary, or implementing other forensic processes 5.2 Do any privileges or rules of confidentiality apply in relation to the circumstances of the case, such as the use of to interactions between the client and third parties IT, revision of fuel consumption, financial, including tax, impli- engaged by outside counsel during the investigation cations; whether, in the specific case, all functions of the entity (e.g. an accounting firm engaged to perform transaction reacted in accordance with their internal obligations such as testing or a document collection vendor)? compliance, AML, etc.; and taking statements from witnesses and ultimately from persons who are possibly the target of an In relation to interactions between the client and third parties investigation. The final part of the plan is the drafting of the engaged by outside counsel during the investigation (for example, report, with fact-finding, including the discovery of major and an accounting firm engaged to perform a transaction test or a minor legal non-conformity and/or violations, observations and vendor collection of documents), there is no legal privilege. In opinions reserved for the next steps, initiating legal procedures, this relationship, the contract defines business secrets and confi- if any. dentiality. The disclosure of a business secret and confidentiality

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 120 Serbia

is in itself a particular criminal offence and a basis for compen- one or more specific purposes, when processing is necessary to sation for damages. However, a business secret and confidenti- execute the contract concluded with the data subject or to take ality does not exist if its disclosure is required by the state author- action, at the request of the data subject, before concluding the ities. In that case, the third party will have the status of a witness contract, and when processing is necessary to comply with the without any limitation or protection. legal obligations of the operator. The GDPR applies to the processing of personal data of data subjects who are in the European Union (EU) by a controller or 5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal processor not established in the EU, where the processing activ- investigation? ities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, or the monitoring of their behaviour as far as their behaviour takes Legal privileges apply differently whether in-house counsel or place within the EU as well as to the processing of personal data outside counsel direct the internal investigation. In our legal by a controller not established in the EU, but in a place where system, in-house counsel only has the status of an employee and Member State law applies by virtue of public international law. does not have any legal privilege. Only outside counsel has the right of legal privilege according to law and Bar rules which regulate the status of lawyers. 6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document preservation notice to individuals who may have 5.4 How can entities protect privileged documents documents related to the issues under investigation? during an internal investigation conducted in your Who should receive such a notice? What types of jurisdiction? documents or data should be preserved? How should the investigation be described? How should compliance with the preservation notice be recorded? Entities will protect privileged documents during an internal investigation by giving them to outside counsel for inspection and selection. If outside counsel does not share the documents Here it is necessary to distinguish whether the document is of with anyone, legal privilege is fully secured. If there is a need a personal nature and represents information about a person for part of the documents to be subjected to forensic exper- protected by law; for example, health records, a document tise, outside counsel will carry out the selection of the docu- which by its nature is property of the entity but is located with ments that will be disclosed and will protect them by the laws a particular individual, or a mutual document for the indi- concerning business secrets. In that case, the third party will vidual and the entity. Personal information is any information have the status of a witness without any limitation or protection. pertaining to a natural person, regardless of the form in which it is expressed, the information carrier it is stored on, on whose behalf the information is stored, the date of the creation of the 5.5 Do enforcement agencies in your jurisdictions keep information, the location where the information is stored, the the results of an internal investigation confidential if such results were voluntarily provided by the entity? method of finding the information (directly, through listening, viewing, etc., or indirectly, by inspecting the document in which the information is contained, etc.), or other properties of the Enforcement agencies will keep all confidential information information. In accordance with the Civil Law Code, if one as confidential or secret only if it is defined as secret by the party invokes the document and claims that it is in the posses- Criminal Procedure Code or by basic special laws such as the sion of the other party, the court will invite the party that has the Data Secrecy Law. In this sense, they do not distinguish the data document to file the document and order a deadline for it. Such from the internal investigation and other data that they have order will always be directed to the person/persons that has/ obtained, but the criteria for keeping confidentiality are defined have the document in question in his/her possession. A party only by the aforementioned legal provisions. cannot refuse the filing of a document if he/she invokes the document for proof of his/her allegations, or if the document is 62 Data Collection and Data Privacy Issues considered common with both parties. From the point of view of an internal investigation, a person may refuse to provide the 6.1 What data protection laws or regulations apply to documents that are only his/hers if those documents are only internal investigations in your jurisdiction? available to him/her.

The following laws and regulations apply: the Constitution 6.3 What factors must an entity consider when (basic human rights protection); the Personal Data Protection documents are located in multiple jurisdictions Law; the Criminal Code; the Criminal Procedure Code; the Code (e.g. bank secrecy laws, data privacy, procedural of Professional Ethics of the Serbian Chamber of Commerce; requirements, etc.)? the Law on Protection of Business Secrets; the Civil Code (the part which refers to privilege and exemption from the obliga- Bearing in mind that every jurisdiction has its own law and tion to testify); the Law on Whistle-blowers; the Law on Free rules governing the obtaining of documents, all of the above Access to Information of Public Importance; the Law on Banks should be considered. In terms of bank secrecy, the Law on (the part which refers to bank secrecy); and Company Law (the Banks usually prescribes which documents and data are consid- part referring to business secrets). It is important to note that ered public and can be provided, and which documents can be Serbia started application of the new personal data protection provided upon request of an authority. When data privacy is law in August 2019, which is, in most part, similar to the General in question, the situation is the same. Data that is considered Data Protection Regulation (GDPR). Similar to the GDPR, the personal information can usually be provided only upon request Personal Data Protection Law deems processing of personal of an acting authority, excluding the data that the entity has and data lawful when it is performed on the basis of consent, for is obliged to have by law. In a procedural sense, the manner of

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London ŠunjkaLaw 121

obtaining the documents must always be considered in the sense 7.2 Are employees required to cooperate with their of addressing various foreign authorities, which documents can employer’s internal investigation? When and under be considered public data, etc. The GDPR should always be what circumstances may they decline to participate in a addressed, having in mind its territorial (within the EU) and witness interview? ex-territorial (outside of the EU) applicability and its defining of personal data as any information relating to an identified or There is no obligation whatsoever for the employees to coop- identifiable natural person, one who can be identified, directly erate. Usually, over the course of an investigation it is suggested or indirectly, in particular by reference to an identifier such as to the employees that in the event of cooperation, they will a name, an identification number, location data, an online iden- receive certain legal benefits, whatever the result of the investi- tifier or to one or more factors specific to the physical, physio- gation; thus they will usually cooperate. logical, genetic, mental, economic, cultural or social identity of that natural person. 7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under 6.4 What types of documents are generally deemed what circumstances must an entity provide legal important to collect for an internal investigation by your representation for witnesses? jurisdiction’s enforcement agencies? No, it is not required to provide legal representation to witnesses The corporation’s statutory documents are generally deemed prior to interviews. If witnesses want to have legal representa- important, which will describe the rights and powers within the tion, it is their call and at their own cost. entity, labour contracts and management contracts, the rules of procedure and the job classification system, to determine who is 7.4 What are best practices for conducting witness responsible for what, who is authorised and the scope of author- interviews in your jurisdiction? isation, contracts and contract documents, signature specimens, cash flow and bank statements, orders and decisions regarding the particular case, the compliance programme, the internal When conducting witness interviews, the best practice includes anti-corruption programme, etc. three steps. The witness is firstly, with his consent, recorded in audio or video when making his statement on the matter. Secondly, the statement is transcribed in written form, which is 6.5 What resources are typically used to collect provided for the witness to read and, if necessary, complete, add documents during an internal investigation, and which to or amend. Lastly, such written statement is certified before resources are considered the most efficient? the public notary, in the presence of the witness giving the statement, and thus becomes an official document. The typical resources used are the internal resources of the entity, the collection of documents in electronic forms (.pdf, .jpeg, .mobi, .xlsx, .doc, etc.), if possible; if not, hard copies, the public 7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction? register, the private investigation of third parties and the entity in accordance with the law, and private evidence of witnesses as well as possible targets of the suspect are used. Interviews must be conducted with respect and appreciation, regardless of their position in a concise internal investigation or future official investigation. The witness has to be protected 6.6 When reviewing documents, do judicial or from insults, threats and any other kind of attack. enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are best practices for reviewing a voluminous document 7.6 When interviewing a whistleblower, how can collection in internal investigations? an entity protect the interests of the company while upholding the rights of the whistleblower? Artificial intelligence is at an embryonic stage locally. However, software from consulting houses which are part of the global As stated in the previous question, a whistle-blower has to be networks and operating in Serbia are used, as well as predictive treated with respect and appreciation and has to be protected coding techniques such as JPEG-LS or DPCM, or similar. from insults, threats and any other kind of attack. The employer is obliged, within the scope of his authority, to take measures 72 Witness Interviews to eliminate the identified irregularities in relation to the information obtained from the whistle-blower and he is obliged, 7.1 What local laws or regulations apply to interviews within the scope of his authority, to provide protection from of employees, former employees, or third parties? What the harmful activity, as well as to take the necessary measures authorities, if any, do entities need to consult before to stop the harmful action and to eliminate the consequences of initiating witness interviews? the harmful activity.

Taking statements before the initiation of official procedures is 7.7 Can employees in your jurisdiction request to voluntary. None of the authorities have to be consulted if doing review or revise statements they have made or are the so. If the interviewee accepts, his statement is taken in accord- statements closed? ance with the provisions of the Civil Law Code, which can be given before the public notary or outside counsel who leads the If the statement is signed, and if it is not just the note of the indi- investigation. vidual who leads the internal investigation, the statement can definitely be read and altered, completed and explained.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 122 Serbia

7.8 Does your jurisdiction require that enforcement 4. Which activities were undertaken. authorities or a witness’ legal representative be present 5. Fact-findings and non-conformities with current domestic during witness interviews for internal investigations? laws. 6. Major and minor violations. No, our jurisdiction does not require that enforcement author- 7. Observations. ities or a witness’ legal representative be present during witness 8. Opinions. interviews for internal investigations. 9. Recommendations for next steps and legal proceedings. 10. Depending on the concrete case, the structure of the 82 Investigation Report report or the report in general can be extended or be more focused. (The following main points should be covered: Executive 8.1 How should the investigation report be structured Summary; Background; Scope of the Report; Looking Back; Key and what topics should it address? Takeaways; Structure of the Report; Regulation and Practice; Investigation; Purpose and Scope; Overall Conduct of the The investigation report should be structured as below and Portfolio Investigation; Methodology Regarding Customers; provide answers, at the minimum, to the following: Methodology Regarding Employees and Agents (Possible Internal 1. The date of the report, who conducted the internal inves- Collusion); Overview of Events; Organisational Overview; tigation, and on what basis (mandate letter or agreement). Acquisition; Operation; Termination; Investigation; Individual 2. Who gave the mandate for the investigation and with what Accountability; Introduction; Overview; Board of Directors; scope. Chairman of the Board of Directors; and Chief Executive Officer.) 3. Who participated and in what timeline it was conducted.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London ŠunjkaLaw 123

Tomislav Šunjka is the founder and principal of the independent law firm ŠunjkaLaw in Serbia. His background is in business and transactional law, and everything connected with transactions, M&A and tax planning law, privatisation law, public-private partnership law, foreign investment law, dispute resolution and complex litigation, and other business laws throughout the world. Because of this background, he understands the nature of transactions, bank transfers and financial arrangements very well and uses this knowledge as a tool in his practice of asset tracking and asset recovery. Tomislav is a former regional representative for Europe on the International Bar Association (IBA)’s Anti-Corruption Committee, a co-chair of the IBA’s Asset Recovery Subcommittee, as well as an exclusive member for Serbia, the Balkan region and ex-Yugoslavian states in the International Chamber of Commerce (ICC)’s FraudNet, a worldwide network of lawyers specialised in asset tracking and recovery. Tomislav is also certified as an auditor by Ethic Intelligence for ISO standards 19600 and 37001, Compliance Management Systems and Anti-Bribery Management Systems. He has recently published articles in: Getting The Deal Through – Asset Recovery Review, The Asset Tracing and Recovery Review, and Getting The Deal Through – Market Intelligence on the latest global trends within anti-corruption legislation and investigations; Lawyer Monthly on fraud and asset tracing in Serbia and fraud litigation; Diplomacy and Commerce Magazine, on the UK Bribery Act, anti-corruption, business fraud and asset tracing and recovery; TalkFraud of ICC FraudNet (“Global Collaboration Falling Short”); and in many other publications. He regularly attends the IBA’s Anti-Corruption Conferences, and C5’s and ICC FraudNet’s conferences, in the capacity of a speaker, panelist and moderator. Tomislav is fluent in English and Russian.

ŠunjkaLaw Tel: +381 21 47 21 788 Sremska Street No. 4/1 Email: [email protected] 21000 Novi Sad URL: www.sunjkalawoffice.com Vojvodina Serbia

ŠunjkaLaw provides fast, high-quality responses to legal issues combined simply involve a single employee; others may be more complex, uncovering with broad experience, integrity and independence, building trustworthy elaborate schemes at multiple facilities in numerous countries and/or relations with each client, while maintaining a conflict-free environment. different specific issues in case. The Firm’s practice includes anti-corruption, and anti-bribery and integrity, We perform interviews. The basis of any effective interview is its ability business law, complex litigation, enforcement of foreign judgments and to discover deception and reveal the true facts. We offer expertise to help arbitration, corporate and internal investigations, crisis and conflict cases corporations get to the truth faster during any type of investigation. In the and management and damage control, Danube shipping, detailed analyses role of interviewer, we act as true investigators, not just lawyers, and we learn of corporations and individuals around the world, international sports law, and understand the details of each single investigation. We help organisa- international trade, regulatory, customs, USA trade, investor-state arbitra- tions with their critical fact-finding when they need to conduct internal inves- tion, trade policy & negotiation, trade remedies and disputes, regulatory tigations or to examine allegations of wrongdoing. Whether actual miscon- and sanctions, white-collar and financial crime. duct is discovered or not, such inquiries, and their aftermath, can pose Our acclaimed investigations practice handles sophisticated national, serious risks to companies and their stakeholders, damaging their reputa- cross-border and multijuridical investigations, in all forms of corporate tion, disrupting their business operations and exposing them to government and internal investigations, both inside and outside of the client’s organi- scrutiny, as well as to potential criminal, civil and regulatory liability. sation. We can investigate the issues, assess the likelihood that a breach www.sunjkalawoffice.com has occurred and advise on any reports which may need to be made to relevant bodies, as well as assist with remedial steps. As a trusted partner, we are engaged to conduct investigations into a wide array of corporate risk concerns, including internal employee issues, theft, embezzlement, Ponzi schemes, threats, policy violations, blackmail, and other corruption and external risk mitigation, internet fraud and cyber-crime, electronic bugging, extortion, competitive intelligence, industrial espionage, due diligence matters, kickbacks, product diversion, etc. Some investigations may

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 124 Chapter 20 Switzerland Switzerland Dr. Claudia Götz Dr. Florian Staehelin Baumann

Dr. Omar Marlen Kellerhals Carrard Abo Youssef Schultze

12 The Decision to Conduct an Internal Non-compliance with reporting duties can trigger serious sanctions, and thus the conducting of internal investigations remains Investigation one of the only means an entity is able to systematically gather, process and evaluate the necessary information in order to be 1.1 What statutory or regulatory obligations should in compliance with its respective regulatory obligations. The an entity consider when deciding whether to conduct an providing of FINMA with false information by a natural person is internal investigation in your jurisdiction? Are there any a criminal offence bearing a fine of up to CHF 250,000 when done consequences for failing to comply with these statutory so negligently, and a maximum sentence of three years’ imprison- or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? ment in the instances of intentional non-compliance. The sanctions against the entity involved may include the disgorgement of unlawfully generated profits and can go as far as the revocation Swiss law does not contain any explicit regulatory obligations of the entity’s licence to conduct business, in particular in cases of which would require a company to conduct an internal investi- repeated misconduct. Comparable sanctions apply in case of the gation. Internal investigations are part of an effective compli- violation of other reporting duties, e.g. to the MROS. ance management system and serve a variety of objectives and Further, it is also important for legal entities to consider that purposes. If there is a suspicion of a compliance violation, the they may be held criminally liable if they are deemed to have company will often come to the conclusion that it wants to failed to take adequate measures to detect or prevent the commis- clarify the matter internally. The internal investigation usually sion of crimes within their company. Primary liability is levied holds more advantages than disadvantages for the company. for specific offences such as, in particular, money laundering and Based on the results of the internal investigation, the company corruption, if the entity failed to take all the reasonable organi- retains control of the matter and can ideally avert an official sational measures that were required in order to prevent such an investigation or, if necessary, cooperate with the authorities in offence. Subsidiary liability of the entity arises in respect of any full knowledge of the facts, which can have a positive effect on other felony or misdemeanour committed in the exercise of the the assessment of sanctions. entity’s commercial activity, provided that due to the inadequate/ In addition, there are statutory obligations whose compli- inefficient organisation it is not possible to attribute the offence ance therewith may implicitly require an entity to do so. In to any specific natural person acting for the company. particular, the Swiss Financial Market Supervisory (FINMA) Finally, senior management and compliance officers of a imposes regulations on financial service providers, which have company may be held criminally liable for the failure to inter- a standing duty to proactively notify FINMA of the occurrence vene or prevent criminal behaviour within their organisations. of any substantial events. Such notification regularly requires They are furthermore subject to civil liability if they violate a prior investigation of the facts and an analysis of the legal duties of care imposed by Swiss corporate law in order to protect consequences. Furthermore, FINMA may, and regularly does, financial interests of the company and the stakeholders. Timely order the entities under its supervision to make information and internal investigations may prevent or mitigate such criminal or documents available in relation to occurrences which come to its civil liability. attention. The SIX Swiss Exchange, the Swiss stock exchange, Compliance with competition law may also require internal further imposes ad hoc notification duties, and financial inter- investigation to avoid respective sanctions. In particular, there mediaries have the duty to investigate and report to the Swiss are statutory leniency programmes within competition law that Money Laundering Reporting Office (MROS) regarding any offer partial or complete immunity from sanctioning if the questionable activity they may encounter. entity reports the unlawful restraint of competition before the Regulating authorities such as FINMA typically also have the other transgressors. This operates as a further incentive for authority to order entities to conduct internal investigations, and proactive internal investigation. if deemed necessary, appoint an independent investigator in the matter, with said independent investigator often being an audit or law firm. If an entity is able to demonstrate that a compre- 1.2 How should an entity assess the credibility of a hensive and independent internal investigation has already been whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal conducted, they may be able to prevent the appointment of an implications for dealing with whistleblowers? external investigator, thereby preserving control over the entity’s internal affairs. Early investigations also allow for a level of preparation for answers to governmental or media enquiries, The adequate response to the complaint of a whistleblower will should they arise. need to be established in each case individually, based on the

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kellerhals Carrard 125

circumstances. However, any such complaint should be taken the investigation. Furthermore, it is important to plan internal seriously and be investigated with due care and diligence. investigations carefully from beginning to end, i.e. remediation. Corporate entities of a certain size should have internal policies In order to avoid potential conflicts, it must be ensured that in place that set out the necessary measures for the handling of the investigation team, both internal and external, does not whistleblower complaints and the assessment of their credibility. include any persons who may be involved with, affected by or These policies ensure, among other things, that the reported hold any other interest in the conclusion of the investigation. facts are expertly reviewed, necessary interviews are conducted, In order to ensure this, outside counsel, amongst other things, and any further reports that may support the complaint are eval- should request uninhibited access to the relevant internal records uated. It is additionally important to ensure that such measures and employees. are taken in a timely manner in order to preserve any evidence that may be relevant. The investigative process should be suffi- 22 Self-Disclosure to Enforcement ciently documented. If a complaint proves to have merit, meas- Authorities ures should be taken to sufficiently sanction and mitigate the misconduct internally (especially adaptation of the compliance management system) and prevent negative consequences exter- 2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in nally (criminal/civil liability or administrative sanctions). your jurisdiction consider an entity’s willingness to Currently, there is no specific protection afforded to whistle- voluntarily disclose the results of a properly conducted blowers in the private sector under Swiss law. Rather, the compe- internal investigation? What factors do they consider? tent courts decide on a case-by-case basis whether the reporting of irregularities is legitimate. Swiss courts assess in each indi- As for criminal proceedings, the competent authorities take vidual case, applying a balancing of interests’ test, whether the factors such as self-reporting of the offence, cooperation in employee’s notification of an irregularity to the employer, the detecting the facts, remorse or efforts of remediation into authorities or the media was lawful in the concrete case, and account. The disclosure of the outcome of an internal investi- examine the facts of the case primarily in relation to the employ- gation may thus qualify as a mitigating factor. There has been ee’s duty of loyalty. However, it is regarded as best practice to one notable case in which a company self-reported bribery of have reporting mechanisms in place which adequately protect foreign officials to the authorities, shared information from an the whistleblower from negative consequences. The termina- internal investigation and admitted to being guilty in failing to tion of an employee solely on the grounds of lodging a complaint implement adequate measures to prevent the bribery. Due to may constitute an unfair dismissal under Swiss law. In the public such unrestricted cooperation combined with the commitment sector, under the relevant Cantonal or Federal Personnel Acts, to improve its compliance systems, the company was sanctioned Swiss officials may be required to report crimes and offences to with a symbolic fine of only CHF 1. However, the company did their supervisors or directly to the criminal authorities. not avoid the disgorgement of illegal profits in the amount of CHF 30 million. 1.3 How does outside counsel determine who “the With regard to FINMA investigations, FINMA has wide client” is for the purposes of conducting an internal discretion to mitigate sanctions in view of the financial interme- investigation and reporting findings (e.g. the Legal diary’s cooperation during the investigation, including efforts Department, the Chief Compliance Officer, the Board of for reparation. Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure As mentioned above, in competition law the voluntary disclo- that the reporting relationship is free of any internal sure of violations can trigger immunity to the entity which is conflicts? When is it appropriate to exclude an in-house first to self-report. attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the 2.2 When, during an internal investigation, should a investigation? disclosure be made to enforcement authorities? What are the steps that should be followed for making a The company should clearly define the reporting lines from disclosure? the start. The specific facts of the investigation will determine who is best suited to be the outside counsel’s liaison within the With the exception of competition law, which requires early client’s corporate structure. disclosure to benefit from statutory lenience provisions, or other The responsible person generally will internally coordinate ad hoc reporting obligations that may come into play, a company the investigation and the outside counsel will report to them. is generally free to determine the appropriate time for disclo- There are various factors that the outside counsel should keep sure. The factors to be considered, from a strategic point of view, in mind when determining who the effective “client” should be, when determining the timing are: what effect will the disclosure such as the events leading up to the initiation of the investiga- have on the internal investigation, if still ongoing; what form of tion, the severity of the allegations, the rank of those potentially support may be needed from the authorities regarding gathering involved, and whether or not reporting obligations may have of evidence, asset recovery, interrogations, etc.; what are the likely been or will be triggered. The potential level of media interest consequences of the self-reporting, such as coercive measures should also be taken into account. Swiss in-house counsel do ordered by the investigating authority, legal assistance requests not enjoy legal professional privilege but may be chosen as the by other domestic or foreign authorities and media coverage. “client” for other reasons. In the case of multijurisdictional Once the authorities have been informed and involved, the investigations, it may be advisable to have, or include, in-house company will lose control over the investigation and will become counsel as the client in order to ensure that communication subject to external pressure. It is thus advisable not to rush into remains privileged. In large-scale or sensitive investigations, self-reporting, but to first get a clear view of the main facts, the it may be prudent to establish a steering committee to oversee persons involved and the potential legal implications.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 126 Switzerland

2.3 How, and in what format, should the findings of an 3.3 Do law enforcement authorities in your jurisdiction internal investigation be reported? Must the findings of tend to coordinate with authorities in other jurisdictions? an internal investigation be reported in writing? What What strategies can entities adopt if they face risks, if any, arise from providing reports in writing? investigations in multiple jurisdictions?

If the investigation is ordered by the authorities, they will regu- Swiss law enforcement authorities often cooperate and coordi- larly require a written report. As for voluntary self-disclosure, nate their investigations with authorities of other jurisdictions. there are no formal requirements. However, in practice, the Switzerland has ratified multiple treaties and implemented legis- submission will usually be in writing; on the one hand for lation regulating the subject matter and procedure of the coop- evidentiary reasons and transparency, and on the other hand eration between Swiss and foreign law enforcement authorities. to demonstrate the highest level of cooperation and diligence There are numerous cases involving international cooperation towards the authorities. (e.g. Siemens, Panalpina, FIFA, Odebrecht). Once a written report is voluntarily submitted to an authority, If investigations into an entity are pending in multiple juris- any relating legal professional privilege is considered to be fully dictions, an overall strategy, by which not only the legal chal- or partially waived and, accordingly, the report can be held lenges and possible solutions of one jurisdiction but of all against the submitting entity. In relation to other authorities involved jurisdictions are taken into account, is required. or third parties, the legal professional privilege may in prin- Coordination and global resolution are mostly in the company’s ciple still apply. However, the authority receiving the report best interest, and it is necessary for the entity to continuously may often be obliged to cooperate with other domestic or strategically weigh and coordinate the effects of an investigation foreign authorities and, thus, the report may end up circulating in one jurisdiction with regard to possible developments in the beyond the authority to which it was submitted. The risk of other jurisdictions involved. This includes seeking legal advice media leakage and statutory or contractual obligations to protect in all involved jurisdictions and contacting foreign authorities employees or third parties should also be taken into account. It at an early stage, in order to make sure that they understand the is therefore advisable that companies discuss the format, scope restrictions resulting from Swiss law provisions on sovereignty, and handling of their reports with the authorities and external data protection and/or confidentiality. or internal counsel prior to any disclosure or submission. 42 The Investigation Process 32 Cooperation with Law Enforcement Authorities 4.1 What steps should typically be included in an investigation plan? 3.1 If an entity is aware that it is the subject or target of a government investigation, is it required to An investigation plan should typically include the following liaise with local authorities before starting an internal steps: investigation? Should it liaise with local authorities even ■ definition of the purpose and the scope of the investiga- if it is not required to do so? tion as well as the legal issues that shall be addressed; ■ establishment of an investigative team; Entities subject to government investigations are not required ■ evaluation of the need and if necessary implementation to liaise with the authorities, with the exception of government of interim measures, in particular in regard to securing investigations within regulated markets. However, depending evidence; on the individual case, in order to prevent government inves- ■ identification, preservation and collection of relevant tigations from being impeded (in particular with respect to evidence; employee interviews), it may be advisable for entities to inform ■ review and analysis of documents (electronic and physical); the authorities that they intend to start their own investigation. ■ interviews with employees (scoping and substantive); In general, it is crucial for the entity to carefully weigh whether ■ preparation of investigation report(s); it will liaise with the authorities or rather behave defensively. ■ communication with internal and external stakeholders Depending on the case at hand, liaising with the authorities may and, if necessary, the authorities and the media; and prove to be advantageous; e.g., in order to avoid dawn raids or to ■ conclusions and consequences with regard to possible benefit from a lighter sentence. sanctions against employees and the identified weaknesses in the compliance management system. 3.2 If regulatory or law enforcement authorities are investigating an entity’s conduct, does the entity 4.2 When should companies elicit the assistance of have the ability to help define or limit the scope of a outside counsel or outside resources such as forensic government investigation? If so, how is it best achieved? consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside In criminal proceedings, the prosecuting authorities define and counsel? determine the scope of their investigations independently, i.e. without giving the concerned entity the opportunity to comment The decision to engage outside counsel for the purpose of on the extent of their investigation. However, in an investiga- an internal investigation should be taken at an early stage, in tion conducted or ordered by regulators, such as FINMA, there order to give effect to legal professional privilege as early as may be room to influence the scope of the investigation. This possible. There are multiple reasons why the engagement of is due to the fact that the scope, the most efficient methodology outside counsel could be beneficial. Apart from ensuring that and the deadlines are, on a regular basis, amongst the subject the investigation is conducted independently and lending the matter of the discussions with the involved entities. investigation credibility, the main reason is to guarantee that the results of the investigation are privileged. This is all the more

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kellerhals Carrard 127

important when one takes into account that in-house counsel of the instructing attorney if they can be categorised as a person in Switzerland do not enjoy attorney-client privilege (cf. ques- assisting an attorney. For a third party to be equally bound by tion 5.3 below). the professional rules of confidentiality, as applicable to the When selecting outside counsel, entities should consider the attorney, they must qualify as a person assisting the attorney in abovementioned reasons, as well as the following: know-how the performance of its duties in some form. The main require- and experience; reputation; and resources of outside counsel. ment for privilege to be applicable is that the attorney exercises With respect to cross-border investigations, outside counsel the required amount of direction and supervision. should in particular have experience in conducting large-scale To make sure that the third party assures the adequate measures investigations in multiple jurisdictions and in cross-border of confidentiality, and to preserve privilege, the scope of the assis- issues, such as Swiss sovereignty, data protection and confiden- tance provided by the third party should be established in writing. tiality law. To exercise and comply with the required amount of direction and supervision, reports to the attorney should occur on a regular 52 Confidentiality and Attorney-Client basis and the attorney should be copied into all correspondence. Privileges 5.3 Do legal privileges apply equally whether 5.1 Does your jurisdiction recognise the attorney- in-house counsel or outside counsel direct the internal client, attorney work product, or any other legal investigation? privileges in the context of internal investigations? What best practices should be followed to preserve these No, legal privileges do not apply equally to in-house counsel privileges? when directing the internal investigation. Legal professional privilege in Switzerland is currently reserved for attorneys who Internal investigations are covered by attorney-client privilege as are registered with the Bar Association and does not extend to long as the internal investigation is conducted by lawyers regis- in-house counsel (see question 5.1 above). tered to practise law in Switzerland and under certain circum- Foreign proceedings have shown that Swiss companies may stances in EU and EFTA countries, and the investigation is suffer procedural disadvantages because of the lack of legal priv- related to the attorney’s typical professional activity. Conversely, ileges for in-house counsel. After numerous failed attempts to investigations carried out purely internally, without the involve- change this regulation, there is currently a parliamentary proposal ment of external attorneys, are not protected by attorney-client to extend privilege to in-house counsel in civil proceedings. privilege (see below question 5.3). According to this proposal, attorney-specific activities of in-house While the conduct of internal investigations potentially qual- counsel would be protected by legal privilege. In order to guar- ifies as providing legal services, due to recent decisions of the antee privilege, it must therefore be an activity that would also be Swiss Federal Supreme Court, there is uncertainty as to which considered profession-specific for a Bar-registered attorney. The activities are specifically protected by legal privilege. Caution proposal is currently being discussed at the legislative level. It should be applied in the case of investigations involving money is, however, not foreseeable when a decision will be made and laundering or banking regulatory compliance. According to the whether the proposal will be accepted. Swiss Federal Supreme Court, the work product of attorneys in an investigation is not privileged if the client was obliged by 5.4 How can entities protect privileged documents statute or regulation (i.e. anti-money-laundering regulations) to during an internal investigation conducted in your undertake the investigative measures (decision 1B_433/2017 of jurisdiction? March 2018 and reiterated in 1B_453/2018 of February 2019). How this precedent will unfold outside of money-laundering compliance remains to be seen. As mentioned above (see above question 5.3), in-house counsel Careful planning of the investigation is required to coun- are not allocated attorney-client privilege, and therefore the use teract this uncertainty and to preserve privilege. Best practices of external attorneys is recommended in internal investigations. to follow include: It is further recommended to follow the best practices outlined ■ The scope of the attorney’s engagement and the purpose in question 5.1. of the investigation must be carefully defined at the outset of the investigation. 5.5 Do enforcement agencies in your jurisdictions keep ■ Documents of a highly sensitive nature are best kept in the the results of an internal investigation confidential if custody of outside counsel and are only shared on a “need- such results were voluntarily provided by the entity? to-know” basis. ■ By means of personnel or organisational measures, poten- Enforcement agencies are bound by official secrecy. The disclo- tially unprotected tasks may be separated from privileged sure of the results of an internal investigation depends on tasks, thus ensuring attorney-client privilege. whether the enforcement agency has a duty to notify another ■ The term “Privileged & Confidential” should only be used authority of any unlawful conduct they may have become aware when appropriate. of. The way these findings were obtained, voluntarily or invol- untarily, is not important, if submitted. 5.2 Do any privileges or rules of confidentiality apply However, the disclosure of voluntarily submitted results of to interactions between the client and third parties investigations to other enforcement authorities discourages volun- engaged by outside counsel during the investigation tary submitting and affects cooperation in the long run. Entities (e.g. an accounting firm engaged to perform transaction are torn between disclosure and criminal self-incrimination. The testing or a document collection vendor)? approach of agencies dealing with voluntarily disclosed results is not uniform. In the past, FINMA has refused requests by crim- Third parties, such as forensic experts or accounting firms, inal prosecuting authorities to divulge internal investigation supporting outside counsel may fall under the legal privileges reports that were submitted to them on a voluntary basis. Other

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 128 Switzerland

agencies, however, strictly follow their obligation to report. It is 6.2 Is it a common practice or a legal requirement therefore recommended to consult with the relevant enforcement in your jurisdiction to prepare and issue a document agency before voluntarily disclosing the results of an internal preservation notice to individuals who may have investigation. documents related to the issues under investigation? Who should receive such a notice? What types of documents or data should be preserved? How should 62 Data Collection and Data Privacy Issues the investigation be described? How should compliance with the preservation notice be recorded? 6.1 What data protection laws or regulations apply to internal investigations in your jurisdiction? There is no general requirement to preserve documents, unless required under specific legislation (e.g. tax or corporate law) or The collection and processing of data is regulated by the Federal so ordered by an authority. International companies operating Act on Data Protection (FADP). The FADP recently underwent in Switzerland are often subject to the US obligation to retain a comprehensive revision. The revised Act was approved by relevant data as soon as a lawsuit or investigation is imminent, Parliament in September 2020 and is expected to enter into force or when such an event can reasonably be expected. For a cred- not before 2022. The aim of the total revision was to adapt the ible investigation and in the case of foreseeable regulatory or liti- existing FADP (dating from 1992) to today’s social and techno- gation proceedings, companies tend to issue data preservation logical developments and to bring it into line with the more recent notices. There are no formal requirements on how such notices and modern regulations in the European data protection envi- are to be issued. ronment (in particular, the General Data Protection Regulation Data protection regulations may limit which data may be (GDPR)). While the basic principles of Swiss data protection law preserved, especially with regard to employee data; in principle, remain unchanged, the new revised FADP will amend the law in only the employee data of persons likely to have business-related a wide range of areas. The sanctions for non-compliance have information relevant to the investigation is to be preserved. also been amended and increased in the new draft FADP. The Unless there are reasonable grounds to believe that the infor- GDPR is applicable to Swiss companies if they process personal mation would risk a data deletion or otherwise compromise the data in relation to the offering of goods or services to, or the confidentiality of the investigation, the FADP requires that the monitoring of the conduct of data subjects in, the EU. employee is informed about the purpose of the preservation and Due to the employer’s duty of care as set out in the Swiss the anticipated use of the data. Exceptions to disclosure can be Code of Obligations (CO), the employer must ensure that the found in the FADP. personal rights of all individuals, affected by an internal investigation, are protected and that the processing principles under data protection laws are observed. Also, employment law 6.3 What factors must an entity consider when documents are located in multiple jurisdictions may restrict which employee data may be processed within an (e.g. bank secrecy laws, data privacy, procedural internal investigation. Cross-border disclosure of personal data requirements, etc.)? is not permitted if this would seriously endanger the personality of the persons concerned, in particular if there is no legislation that guarantees adequate protection. This is especially the case Cross-border investigations can pose multiple challenges for for the USA. In this case, such a transfer is only permitted if it the company as they must simultaneously comply with the laws is legally justified. Under the current FADP, this requirement of several jurisdictions. Substantial hurdles for Swiss compa- is regularly one of the biggest hurdles in cross-border investiga- nies arise from the provisions of art. 271 SCC (see above questions, and the adequate protection of personal data has proven tion 6.1) or other information protection regulations (e.g. from to be one of the most challenging, time- and cost-intensive the FADP or employment law; see above question 6.1). In addi- requirements in cross-border internal investigations. tion, the provisions on the protection of manufacturing or trade In addition, in cross-border internal investigations, the secrets must in particular be observed (arts 273 and 162 SCC). so-called Swiss “Blocking Statutes” must be observed (art. 271 According to these provisions, anyone who makes a manufac- Swiss Criminal Code (SCC)). Swiss law provides that whoever, turing or business secret available to a foreign official body is without authorisation, carries out activities on behalf of a liable to prosecution. The purpose of art. 273 SCC is not (only) foreign state or a foreign party or organisation on Swiss terri- to protect the owner of the secret, but to protect the overall tory, where such activities are the responsibility of a public economic (public) interests of Switzerland. The company that authority or public official, and whoever encourages, or aids has ordered for the internal investigation to be conducted, as the or abets such activities shall be liable to imprisonment or to a owner of the secret, may waive its own trade secrets. In the case monetary penalty. Thus, art. 271 SCC prevents an “official act” of art. 273 SCC, this waiver does not per se lead to the inappli- from being performed on behalf of a foreign authority on Swiss cability of art. 273 SCC: if there is an overall economic (public) territory, and can have the effect of blocking the collection of interest of Switzerland or if business secrets of a third party are evidence located in Switzerland if it is intended for use in foreign involved, the disclosure of such secrets to a foreign authority is proceedings. Formal interviews of employees in the course of not permitted. an investigation which are carried out for a foreign investi- The scope of the application of attorney-client privilege in all gating government, or if work products of such interviews are the affected jurisdictions must also be clarified. The process later made available to the authority of a foreign state, fall under selected for the collection, processing and transfer of data must the prohibition of this provision. Under certain conditions, the also be handled in compliance with the legal requirements of the competent federal department may, in individual cases, issue a respective applicable jurisdictions. permit for cooperation with the foreign state authority. Practical experience has shown that cross-border investigations require overall strategies that address legal challenges in all

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kellerhals Carrard 129

the countries involved. The effects of the investigation activi- with investigating authorities, the search criteria implemented ties in one country must be continuously weighed and strate- should be approved prior to the conducting of the review. With gically coordinated in regard to possible developments in all regard to best practices for voluminous document collections, other involved countries. Companies should manage expec- see question 6.5. tations and inform regulators early on of local provisions that could restrict the company’s ability to share information across 72 Witness Interviews borders (see question 6.1 above). 7.1 What local laws or regulations apply to interviews 6.4 What types of documents are generally deemed of employees, former employees, or third parties? What important to collect for an internal investigation by your authorities, if any, do entities need to consult before jurisdiction’s enforcement agencies? initiating witness interviews?

There are no guidelines in place that govern document collection Requirements for interviews of employees arise from, among within internal investigations: rather, this depends on the type of others, the provisions on employment law in the CO. The investigation. The forms of admissible evidence in an investiga- admissibility of conducting interviews and the formal and tion carried out by an enforcement agency are very broad. Thus, content-related parameters are limited by the employer’s general companies are advised to collect any and all evidence deemed duty of care. To begin with, the interview must be related to necessary in the course of the investigation. This may include the interviewee’s employment and must be conducted fairly any type of electronically stored information (e.g. emails, SMS, and without pressure or coercion at any time. Additionally, the chats and office data), hard-copy data (e.g. policies, minutes, HR employee must be informed about certain details at the begin- files) or lawfully obtained telephone and audio-visual recordings. ning of the interview, such as the purpose and contents of the interview and the allegations. This ensures that the employee’s right to be heard is respected and that they have the opportunity 6.5 What resources are typically used to collect to comment on the allegations. documents during an internal investigation, and which resources are considered the most efficient? General data protection provisions apply to employee interviews as well as to former employees and third parties. Formal questioning of employees in the course of internal The resources that are used to collect and process documents investigations which are conducted for a foreign authority, or if depend on the scope, funding, and subject of the investiga- work products of such interviews are later to be made available tion. Over the course of a large-scale investigation, the latest to the authority as evidence, may breach art. 271 SCC (see ques- scientific technology for the collection and processing of data tion 6.1 above). is used. Due to the ever-increasing amount of data, modern review techniques and tools for the analysis and organisation of very large amounts of data are becoming increasingly impor- 7.2 Are employees required to cooperate with their tant. They rely on statistical, mathematical and linguistic tech- employer’s internal investigation? When and under what circumstances may they decline to participate in a niques to enable a more precise review. In addition to data dedu- witness interview? plication and email threading (only the last email in the chain remains in the review), Technology-Assisted Review (TAR) is becoming increasingly important. This includes machine It follows from the employee’s general duty of loyalty that the learning, in particular. Here, the computer learns from the employee must cooperate in the clarification of the facts under- evaluation decisions of human data analysts and automatically lying the internal investigation. An obligation to cooperate is transfers decisions to the overall data volume. By means of also derived from the employee’s obligation to report all facts and so-called “Artificial Intelligence Clustering”, the total amount circumstances of which they have become aware in the course of of data is categorised by algorithms to recognise conceptually their employment. Based on the employer’s right to issue instruc- similar data and information and to present it visually in groups tions, the employer may request the employee to participate in an for simplified review. interview with regard to events relevant to the employer’s busi- It is advisable to use trained forensic specialists for the ness. However, the employer’s right of instruction does not apply securing of electronic evidence from the outset, who ensure that to former employees. Further, current employees are bound by a the chain of custody can be presented without interruption and general duty of truth towards their employers. that the data is not altered during the securing process or during However, this obligation of the employee to participate and the investigation. to make a truthful statement is not without limitations. The employee’s general duty of loyalty is limited by their own legitimate interests. Currently, it has still not been clarified by the 6.6 When reviewing documents, do judicial or Swiss Federal Supreme Court whether the employee is entitled enforcement authorities in your jurisdiction permit to the right to refuse to answer certain questions or to cooperate the use of predictive coding techniques? What are best practices for reviewing a voluminous document on the grounds of the right against self-incrimination. collection in internal investigations? 7.3 Is an entity required to provide legal representation There are no specific restrictions regarding the use of TAR or to witnesses prior to interviews? If so, under predictive coding techniques. When conducting an investi- what circumstances must an entity provide legal representation for witnesses? gation, the basis should always be to plan carefully and keep records of important decisions made during the review process. The data collected on a processing platform should then be There is no general obligation to provide legal representation to reviewed based on the search criteria aligning with the objec- witnesses prior to interviews. The question of a right to legal tives of the investigation. If the company intends to cooperate representation is to be decided in each individual case. A witness

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 130 Switzerland

that is questioned as a pure source of information has neither a 7.6 When interviewing a whistleblower, how can claim to nor a reason for legal representation. However, if there an entity protect the interests of the company while are conflicts of interest between the entity and the witness, the upholding the rights of the whistleblower? latter must be able to appoint an attorney. This is the case, for example, if the witness’s conduct is subject to possible criminal In principle, the best practices for employee interviews (see ques- sanctions. The involvement of an attorney can also increase the tion 7.4) also apply to interviewing a whistleblower. If the whis- willingness of the witness to cooperate. If the witness is likely tleblower is an employee, and there are grounds to believe that to expose themselves to criminal prosecution, the company the whistleblower may receive a negative reaction, then measures should consider carefully whether it grants the employee legal will need to be taken to protect the whistleblower. This includes representation. ensuring that the identity of the whistleblower is protected and preventing retaliation against the whistleblower. 7.4 What are best practices for conducting witness interviews in your jurisdiction? 7.7 Can employees in your jurisdiction request to review or revise statements they have made or are the The following guidelines serve as best practices for witness statements closed? interviews: ■ Introduction of the interviewers and their role. It is best practice that the interview be documented. To ensure that ■ Indication that any attorneys present represent the inter- the witness’ statements have been accurately recorded and repro- ests of the entity and not those of the witnesses to be duced, and are processed in compliance with data protection law, interviewed. the minutes of the interview should be presented to the witness ■ Purpose and background of the investigation/interview. for review. This way, future disputes regarding the contents may ■ Any allegations against the witness. be avoided. The company should refrain from distributing the ■ Reference to the confidentiality of the interview. interview notes as the investigation is confidential. ■ Clarification about the intended use of the information gathered. ■ The witness must be given the opportunity to comment on 7.8 Does your jurisdiction require that enforcement authorities or a witness’ legal representative be present the allegations. during witness interviews for internal investigations? ■ ts If i i deemed likely that an interviewee could expose themselves to criminal prosecution, entities should act with caution and consider carefully whether the witness There is no requirement for enforcement authorities to be should be offered legal representation. present during internal investigation witness interviews. ■ The interview should be documented in some form, Contrary, such attendance would be highly unusual and detri- and the witness has to be informed about the form of mental to the purpose of the internal investigation. For legal documentation. representation of the witnesses, see question 7.3 above. 82 Investigation Report 7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction? 8.1 How should the investigation report be structured and what topics should it address? An internal investigation and, especially, an interview can be very stressful for the witness. It is therefore important that the interviewer adopts a neutral and trustworthy position in rela- Elements of an investigation report do not follow mandatory tion to the interviewee. To build trust, the interviewee must rules and vary depending on the objective of the investigation. be actively listened to and should not be interrupted. This is An investigation report should include the following elements: particularly important in a predominantly hierarchical corpo- ■ an executive summary; rate structure, as still found in many Swiss companies. Also, it ■ the background of the investigation; should be remembered that internal investigations in Switzerland ■ the trigger for the investigation; are still a new phenomenon and not many employees are accus- ■ the object and purpose of the investigation and the legal tomed to them. questions; Interviewees should be given the opportunity to reply to ques- ■ the overview of the evidence gathered and the methods tions in their native language. It is advisable to engage transla- used, including document analysis and interviews; tors for employees who are not native speakers of the language ■ a presentation of the pertinent facts pertaining to the core the interview is being conducted in, in particular given the fact objective of the investigation; that Switzerland has four official languages. This allows the ■ a legal analysis (depending on mandate); interviewee to build trust, and thus the interviewer is more likely ■ the conclusions regarding the core objective; to get the answers they need. ■ if need be, the recommendations and next steps; and ■ the exhibits referenced, which usually form part of the investigation report. In the case of a report on an investigation pursuant to statutory or regulatory obligations, it may be prudent to separate the facts found from the legal assessment (see question 5.1 above).

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Kellerhals Carrard 131

Dr. Claudia Götz Staehelin, head of the Kellerhals Carrard Investigation practice group, is a litigation and investigation partner and specialises in international dispute resolution, as well as internal investigations across various industries. She advises her clients in compliance, internal investigations, cross-border proceedings, international mutual legal assistance and data privacy, and supports her clients in dispute resolution crisis management. Claudia combines investigation and dispute resolution expertise with significant business experience. Before joining the firm, Claudia was the head of litigation at Novartis, where she led large multijurisdictional disputes and investigations and advised senior management on company litigation risks, as well as on financial and reputational impact.

Kellerhals Carrard Tel: +41 58 200 30 65 Henric Petri-Strasse 35 Email: [email protected] P.O. Box 257, 4010 Basel URL: www.kellerhals-carrard.ch Switzerland

Dr. Florian Baumann, head of the Kellerhals Carrard White-Collar Crime practice group, graduated from the University of Zurich (Juris Doctor and Master of Laws) and is admitted to all Swiss courts. He wrote his doctoral thesis on the confiscation of illicit proceeds and completed postgraduate studies at the Collège d’Europe in Bruges with the H.E.E. His practice focuses on cases involving both criminal and civil law. He represents clients in multinational asset recovery cases, criminal and administrative legal assistance proceedings and internal investigations. He advises banks and other financial intermediaries on compliance issues, including representation in administrative investigations or compliance-related litigation. He lectures on forfeiture and money laundering at the MAS Economic Crime Investigation at the University of Luzern and has contributed to the Basel Commentaries on the Swiss Criminal and Swiss Criminal Procedure Codes, and on international criminal law.

Kellerhals Carrard Tel: +41 58 200 39 00 Rämistrasse 5 Email: [email protected] P.O. Box, 8024 Zurich URL: www.kellerhals-carrard.ch Switzerland

Dr. Omar Abo Youssef is a member of Kellerhals Carrard’s White-Collar Crime practice group. He graduated from the University of Zurich (Juris Doctor and Master of Laws) and Geneva (Certificate of Transnational Law) and is admitted to all Swiss courts. He lectures in criminal law and criminal procedural law at the University of Zurich and is chairman of the Schulthess Conference on White Collar Crime. Omar specialises in complex criminal, regulatory and civil litigation matters, with a special focus on white-collar crime, international assistance in criminal matters and asset recovery. Omar has authored numerous publications on matters of criminal law, criminal procedural law, international criminal law and international assistance in criminal matters, including the chapters on tax offences and enforcement of criminal judgments in the Basel Commentaries on Swiss tax law and on international criminal law.

Kellerhals Carrard Tel: +41 58 200 39 00 Rämistrasse 5 Email: [email protected] P.O. Box, 8024 Zurich URL: www.kellerhals-carrard.ch Switzerland

Marlen Schultze is an associate at Kellerhals Carrard. She has extensive experience in criminal law and criminal procedural law, with a focus on white-collar crime, the prevention of corruption and money laundering and international mutual assistance in criminal matters. In addition, she advises clients on compliance, conducts internal investigations and advises and represents clients in domestic and international litigation and arbitration.

Kellerhals Carrard Tel: +41 58 200 30 00 Henric Petri-Strasse 35 Email: [email protected] P.O. Box 257, 4010 Basel URL: www.kellerhals-carrard.ch Switzerland

Kellerhals Carrard employs more than 200 professionals, with offices and antitrust, and executive and internal misconduct. Kellerhals Carrard’s in Basel, Bern, Lausanne, Lugano, Sion, Zürich and Geneva, as well as compliance specialists have broad experience in advising companies representation offices in Shanghai and Tokyo. The law firm is one of the within various industries on the proper measures to address compliance largest in Switzerland and boasts a rich tradition going back to 1885. deficiencies, including in the areas of bribery and corruption, fraud, money Kellerhals Carrard’s Internal Investigation and White-Collar Crime laundering and insider trading. Department has extensive experience in conducting internal investigations, www.kellerhals-carrard.ch providing advice and court representation for a wide variety of business crime matters; our specialists have led major international legal assistance matters and related commercial litigation, as well as asset-tracing and recovery matters. Our continually expanding Internal Investigation Team has experience in the investigation of a broad range of legal and regulatory matters, including bribery and corruption, fraud, violation of banking and capital market rules, disclosure and accounting issues, competition

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 132 Chapter 21 United Arab Emirates Arab United United Arab Emirates

Rebecca Kelly

Morgan, Lewis & Bockius LLP Chris Warren-Smith

12 The Decision to Conduct an Internal Countering the Proliferation of Weapons of Mass Destruction and All Related Resolutions; and in addition the two finan- Investigation cial free zones: (i) Abu Dhabi Global Market (“ADGM”); and (ii) Dubai International Financial Centre (“DIFC”) have both 1.1 What statutory or regulatory obligations should implemented additional legislation regarding AML compliance. an entity consider when deciding whether to conduct an The National AML/Combating Financing of Terrorism internal investigation in your jurisdiction? Are there any (“CFT”) Committee has begun implementing the National AML consequences for failing to comply with these statutory Strategy 2019–2021 to strengthen the UAE’s overall AML/CFT or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? framework. The scope of the UAE’s AML/CFT preventive measures now include the full range of financial institutions and designated non-financial businesses and professions (“DNFBPs”) When deciding whether to conduct an internal investigation, the covered by the Financial Action Task Force (“FATF”) and does company should take into consideration a number of factors, not set out any exclusions from AML/CFT requirements, requiring including: (i) whether an investigation is required by any specific such entities to apply enhanced and implied measures in line with law; (ii) the scope and severity of the alleged misconduct; (iii) money-laundering and terrorism-financing risks. whether the alleged misconduct could be a potential violation All Federal and Emirate level laws apply to organisations in of law and regulation; (iv) the potential for, or interest in, litiga- the UAE regulated by the SCA and the UAE Central Bank. The tion by government regulators; and (v) the overall benefits and UAE Central Bank and the SCA also issue circulars and manda- risk to the corporation, its officers, directors and employees of tory procedures which apply to regulated entities. such an investigation. The UAE Penal Code provides that corporate bodies, with the The legal framework governing fraud, bribery and corrup- exception of governmental agencies and certain public entities, tion in the United Arab Emirates (“UAE”) is governed by are responsible for any criminal act committed by their repre- Federal Law No. 3 of 1987 as amended (“UAE Penal Code”). sentatives, directors or agents. Individuals can also be subject Federal Law No. 35 of 1992 as amended (“Penal Procedures to a range of penalties including fines, imprisonment and a bar Law”) prescribes the procedures under the UAE Penal Code. on doing business and/or entering the UAE. Anyone directly However, there are a number of other laws at Federal and harmed as the result of a crime is also entitled to pursue a civil Emirate level that may apply, which also contain provisions action before the UAE courts. dealing with foreign and domestic fraud. The UAE has rati- The UAE has a number of free trade zones governed by their fied a number of international conventions aimed at combat- own framework of regulations; for example, the DIFC. UAE ting corruption and introduced Federal Law No. 19 of 2016 on criminal law applies in the DIFC but the civil and commercial Combatting Commercial Fraud, which sets out further penal- laws of the UAE do not, as the DIFC has its own set of commer- ties applicable to both corporate bodies and individuals who cial laws based on the laws of England & Wales. This chapter does commit, or attempt to commit, corporate fraud. not specifically deal with the jurisdiction or laws of the DIFC or The laws governing anti-money laundering (“AML”) have the Abu Dhabi Global Market, which may have additional regula- been repealed and updated over the past few years in the UAE. tions applicable to entities operating free zone entities. The following AML laws include: Federal Law No. (7) of 2014 regarding Combating Terrorist Crimes; Cabinet Resolution No. (38) of 2014 concerning the Executive Regulation of the 1.2 How should an entity assess the credibility of a Federal No. 4 of 2002 Concerning Anti-Money Laundering and whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal Combating Terrorism Financing; Federal Decree Law No. (20) implications for dealing with whistleblowers? of 2018 concerning Anti-Money Laundering and Countering the Financing of Terrorism (repeals Anti-Money Laundering Law); Cabinet Resolution No. (10) of 2019 concerning the Not all reports of employee misconduct within a company will Executive Regulations of Federal Decree Law No. (20) of necessitate an internal investigation conducted either by outside 2018 concerning Anti-Money Laundering and Countering the counsel or by management. Where the alleged misconduct Financing of Terrorism (does not repeal Cabinet Resolution (38) involves an individual employee and does not implicate poten- of 2014 specifically, but where there is an inconsistency Cabinet tial violations of Federal or Emirate-based laws, the in-house Resolution (10) of 2019 applies); Cabinet Decision No. 4 (20) of counsel, often in conjunction with the company’s internal audit 2019 Concerning the Implementation of UNSCRs Relating to department, will initially investigate the allegations and submit Countering and Preventing Terrorism and Terrorism Finance and recommendations to management for the appropriate “next

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Morgan, Lewis & Bockius LLP 133

steps”. These next steps may include immediate remedial and Pursuant to UAE Central Bank and SCA regulations, direc- personnel actions and may also include voluntary disclosure to tors or employees who have knowledge of money laundering but the authorities. fail to report it will be committing a criminal offence. Within the UAE, the existence of documented evidence will In the UAE, early and consistent cooperation with the author- be critical for the advancement of any criminal complaint, so the ities may justify a less aggressive regulatory response and/or a collation of appropriate material and the existence of witnesses mitigated penalty. to provide written statements will be important, especially if the investigation gives rise to a potential (and reportable) violation 2.2 When, during an internal investigation, should a of the applicable laws and regulations. disclosure be made to enforcement authorities? What are the steps that should be followed for making a 1.3 How does outside counsel determine who “the disclosure? client” is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal When it becomes apparent during an investigation that a crime Department, the Chief Compliance Officer, the Board of has been committed, pursuant to UAE law, there is a legal obli- Directors, the Audit Committee, a special committee, gation for the company and/or the individual to inform the rele- etc.)? What steps must outside counsel take to ensure that the reporting relationship is free of any internal vant authorities. Failure to notify the authorities is of itself an conflicts? When is it appropriate to exclude an in-house offence pursuant to the UAE Penal Code. attorney, senior executive, or major shareholder who The main authorities involved in the prosecution, investigation might have an interest in influencing the direction of the and enforcement of fraud, bribery and corruption are the UAE investigation? police, the Public Prosecutor and the criminal courts. Disclosure can either be made directly to the police in the Emirate in which In most cases, the company will engage external counsel to the crime is committed or directly to the Public Prosecutor. conduct the investigation and the company itself will be the However, with some offences, a report should also be made to “client” for the purpose of the investigation. If, during the the UAE Central Bank and the SCA. Importantly, all material course of the investigation, any of the employees seek to be submitted to the authorities must be submitted in Arabic. separately represented, then the company may assist and seek The UAE also has a new mechanism of automatic transpo- additional counsel. The company and external counsel would sition and notification for terrorism financial sanctions, via a be responsible for managing any potential conflicts. public-facing website hosted by the Committee for Commodities At the outset of the investigation, the company should Subject to Import and Export Control, and there are mandatory establish a small and independent internal management team freezing and reporting requirements which extend to DNFBPs. (comprising senior individuals who have no involvement with DNFBPs are required to check the website on a daily basis, and the matters giving rise to the allegations or with the individ- immediately freeze funds and assets in case of an exact match uals involved). Depending on the size of the investigation, the with United Nations and domestic action lists: only upon first team will usually consist of one or more members of the legal freezing such funds and assets should a DNFBP report a suspi- team, the head of the relevant business unit, a representative cious transaction to the authorities, terminate the relationship from the IT department and a member of the human resources or both (as a failure to do so can result in the return of funds to department. Communications between external advisers and the customer). the company should be limited to the internal investigation team in order to ensure confidentiality. 2.3 How, and in what format, should the findings of an It must be noted that in a large number of corporate crime internal investigation be reported? Must the findings of cases, the directors or senior directors (those managing the an internal investigation be reported in writing? What company’s affairs) will be responsible for the alleged miscon- risks, if any, arise from providing reports in writing? duct. In such circumstances, it is very often the parent company or shareholders who will enlist the assistance of external counsel A written report is not required by the authorities; however, and be the “client” to whom the findings will be reported. where a company wishes to demonstrate that a crime has been committed and to pursue criminal and/or a civil complaint 22 Self-Disclosure to Enforcement against a “fraudster”, for example, a collation of relevant Authorities evidence will be necessary in order to file a complaint. If, during the police investigation, the police or the Public 2.1 When considering whether to impose civil or Prosecutor require additional information, they have the right criminal penalties, do law enforcement authorities in to request such information. Companies involved in litigation your jurisdiction consider an entity’s willingness to as a result of an investigation within the UAE, are not, however, voluntarily disclose the results of a properly conducted under an ongoing duty of disclosure. internal investigation? What factors do they consider? It is critical to mention at this point that there is no concept of attorney-client privilege, so any documents prepared during Pursuant to the UAE Penal Code, a party who takes the initi- the course of the investigation may be disclosed to any authority ative to report to the authorities the existence of an offence requesting them. There is no protection afforded in any capacity before it is discovered by the Public Prosecutor can be exempted to any documents prepared in advance, in contemplation or for from individual criminal liability. The Public Prosecutor, at the sole purpose of advising the client on the steps they should their own discretion, may also dismiss a criminal complaint or take. Please see further guidance on this point at question 5.3. abstain from prosecuting a briber or intermediary who informs the judicial or administrative authorities of the crime, or who confesses the crime before it is discovered.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 134 United Arab Emirates

32 Cooperation with Law Enforcement has extra-territorial reach. Global policies allow an organisation to adopt a coordinated and efficient approach should they face Authorities investigations in multiple jurisdictions.

3.1 If an entity is aware that it is the subject or 42 The Investigation Process target of a government investigation, is it required to liaise with local authorities before starting an internal investigation? Should it liaise with local authorities even 4.1 What steps should typically be included in an if it is not required to do so? investigation plan?

During the investigation phase of any police or public prosecu- Once notified, the organisation should establish a small and tion investigation, individuals and companies must always coop- independent internal management team (comprising senior erate with the local authorities. individuals who have no involvement with the matters giving In addition, if certain offences have been committed, such as rise to the allegations or with the individuals implicated in the under the Anti-Money Laundering Law, then there is an obli- investigation). gation to inform the authorities of any such suspicious transac- While there is no set structure to carrying out the investigations. Cooperation with the authorities may justify a less aggres- tion process and the methodology will depend on the facts, and sive regulatory response and/or a mitigated penalty; however, with many businesses operating with a remote workforce during this is by no means guaranteed. the COVID-19 pandemic, some of the steps will have to also FATF has recommended that the UAE provide more specific consider access to and availability of evidence and witnesses: guidance to DNFBPs on enhanced due diligence measures ■ testing the credibility of the complaint and assessing and suspicious transaction reporting, to ensure that DNFBPs potential violations of law (in the event the allegation is are able to identify, assess and review money-laundering and proven) and establishing an Investigation Protocol to terrorism-financing risks, in line with their obligations under maintain confidentiality; the Anti-Money Laundering Law, particularly with regard to the ■ gathering and preserving evidence; identification of politically exposed persons. ■ review of evidence; ■ identification of key personnel and third parties critical to the investigation and initial interviews with each; 3.2 If regulatory or law enforcement authorities ■ consideration of evidence and identification of any poten- are investigating an entity’s conduct, does the entity tial disclosures required; and have the ability to help define or limit the scope of a government investigation? If so, how is it best achieved? ■ cooperation with the regulators and prosecuting agencies (if applicable). It is not possible to limit the scope of a criminal investigation as the police have far-reaching investigative powers. The police 4.2 When should companies elicit the assistance of have the power to collect all information and evidence necessary outside counsel or outside resources such as forensic for the investigation of criminal offences. In terms of compel- consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside ling disclosure, the UAE Penal Procedures Law gives the Public counsel? Prosecutor the power to order the accused to surrender anything that the Public Prosecutor deems is in the possession of the accused which should be seized. Usually, this will mean that Once the investigation has commenced, consideration should computer hard drives, physical files and passwords for online immediately be given to engaging specialists, including forensic file sites must be handed over. consultants, IT experts and even public relations teams. Where investigations involve alleged bribery or corruption, factual discovery and legal analysis may need to be conducted quickly. 3.3 Do law enforcement authorities in your jurisdiction This will almost always require the engagement of external legal tend to coordinate with authorities in other jurisdictions? counsel who will have the skills and experience to conduct a What strategies can entities adopt if they face thorough and efficient investigation. investigations in multiple jurisdictions? 52 Confidentiality and Attorney-Client Federal Law No. 39 of 2006 on International Judicial Co-operation in Criminal Matters establishes a number of Privileges circumstances in which UAE state authorities can request assistance from judicial authorities. In addition, the UAE is a signa- 5.1 Does your jurisdiction recognise the attorney- tory to many cross-border judicial cooperation treaties that client, attorney work product, or any other legal facilitate the transfer of information between judiciaries and privileges in the context of internal investigations? What best practices should be followed to preserve these authorities. The jurisdictions with these treaties in place include privileges? all of the other Gulf Cooperation Council (“GCC”) countries (Bahrain, the Kingdom of Saudi Arabia, Kuwait, Oman and Qatar), Australia, India and the United Kingdom (amongst The concept of attorney-client privilege that exists in the UK many others). or USA is not recognised in the UAE. UAE law does recognise Many global companies will implement standardised anti- the concept of “advocate-client” privilege and appreciates that bribery and anti-corruption policies (albeit with minor differ- an advocate’s work product is privileged; however, this is not ences to comply with local laws) across each of their interna- always applicable across the legal profession as an “advocate” tional offices. These policies should recognise international best is an Emirati local licensed to appear before the UAE courts. practice in dealing with investigations and responding to corrup- A licensed local Emirati advocate must not reveal any confiden- tion allegations in line with local legislation and legislation that tial information without the consent of his client unless he believes

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Morgan, Lewis & Bockius LLP 135

that his client intends to commit a crime. In addition, interro- by the authorities. There is a possibility the internal investiga- gating a licensed local Emirati advocate or searching his office is tion may be referenced in court during the prosecution of a crim- not allowed without the prior consent of the Public Prosecutor. inal case; however, documents used in criminal cases are not However, this only applies to licensed local Emirati advocates available to the public. However, if the proceedings involved, who have the right to appear before the courts of the UAE. Most for example, the possible extradition of a foreign national, it may legal professionals who work in the UAE tend to be categorised be assumed that the UAE court will transfer all of the relevant as “legal consultants” who are not afforded the same protec- court documents (including any reports already in the court file) tion. Legal consultants include the majority of legal professionals to other relevant authorities. who work at international law firms and who are not Emirati by birth. However, these legal consultants are also governed by their 62 Data Collection and Data Privacy Issues respective professional obligations, depending on where they are admitted, which would include the duty of confidentiality. 6.1 What data protection laws or regulations apply to In practice, it is very unlikely that the Public Prosecutor would internal investigations in your jurisdiction? oblige an attorney to breach confidentiality and the product of legal advice should not be provided readily to the authorities. Despite this, unless with respect to advice produced by a The UAE does not have a specific “data protection law”. Certain licensed Emirati advocate, theoretically the Public Prosecutor Federal laws recognise an individual’s right to privacy as well as as part of a criminal investigation could direct the search and protect companies’ confidential information. Such Federal laws seizure of any documents which could assist the investigation include criminal, civil, commercial and labour provisions. of a criminal case. An individual’s right to privacy is overarching and should be borne in mind when carrying out internal investigations. The UAE Penal Code prohibits publishing any information relating 5.2 Do any privileges or rules of confidentiality apply to the “secrets” of the private or family life of individuals, even to interactions between the client and third parties if they are true. engaged by outside counsel during the investigation However, both the DIFC and ADGM will have data privacy (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)? issues, as both these financial free zones have their own regulations concerning data collection and privacy.

Confidentiality between the client and third parties engaged by outside counsel would be governed by the confidentiality 6.2 Is it a common practice or a legal requirement terms under the agreement for services. There would also be an in your jurisdiction to prepare and issue a document preservation notice to individuals who may have implied duty of confidentiality where a third party is instructed; documents related to the issues under investigation? however, there are no special rules governing such a relationship Who should receive such a notice? What types of and it is always prudent to ensure that the third party enters into documents or data should be preserved? How should an express confidentiality agreement. the investigation be described? How should compliance with the preservation notice be recorded?

5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal Preserving all relevant evidence relating to the alleged offence investigation? will be crucial and will likely be requested by the authorities at some stage. Any gaps in data, either because it was lost, In-house counsel would be considered to be providing their destroyed or is in the possession of a former employee, will services on an employment basis and there are no special protec- impede the organisation from carrying out a full investigation tions addressing privilege. However, all employees have a duty into what happened and may prove detrimental to the company of confidentiality to their employer and must not reveal secrets in any subsequent litigation. Although the UAE does not recog- under the UAE labour law. As set out in question 5.1, privilege nise in its laws or regulations the concept of a “preservation only attaches to work with respect to licensed Emirati advocates. notice”, companies should ensure that when they conduct an internal investigation, all data is preserved.

5.4 How can entities protect privileged documents during an internal investigation conducted in your 6.3 What factors must an entity consider when jurisdiction? documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)? Marking documents “Privileged and Confidential” could go some way towards notifying any foreign regulator that the parties The factors that must be considered will depend on which juris- intend the document to be privileged. However, working with dictions are involved. Local legal advice should be sought in a licensed local Emirati advocate (often under the instruction of each case. However, it should be noted that the UAE is not an international law firm) may also help to protect confidential generally considered a jurisdiction with an adequate data protec- documents from disclosure, but it is an unlikely solution. Most tion regime with respect to EU law and caution should be investigators should prepare their documents understanding used when transferring personal data to the UAE as part of an that they will be subject to disclosure to the authorities. investigation.

The results of an internal investigation will be kept confidential The types of documents deemed important for collection will

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 136 United Arab Emirates

depend on the allegations. Emails and other types of corre- private without the prior consent of the participants is regarded spondence will usually be important in any form of investiga- as an invasion of privacy under the UAE Penal Code. The person tion. If the alleged offence relates to corporate fraud such as responsible for recording the conversation will be committing a embezzlement and money laundering, it will be vital to collate crime and any evidence obtained through the recordings will interim and annual financial reports, board of directors’ reports, not be admissible in court. audit reports, balance sheets, cash flow statements, documents relating to the annual budget and profit and loss accounts. 7.2 Are employees required to cooperate with their The police have the power to collect all necessary informa- employer’s internal investigation? When and under tion and evidence for investigation and indictment of criminal what circumstances may they decline to participate in a offences. witness interview?

6.5 What resources are typically used to collect Under UAE labour law, there is no specific requirement for documents during an internal investigation, and which employees to cooperate with their employer’s internal investiga- resources are considered the most efficient? tions. However, there may be a term in the employee’s employment contract that requires them to cooperate with an internal The data review process can be assisted using a data management investigation and any failure to do so may be a disciplinary matter. platform that allows for a proportionate and targeted review of Failure for an individual to notify the competent author- documents uploaded on the company’s systems – primarily emails ities of a crime of which they have knowledge is a criminal and other forms of communications. eDiscovery is now assisted offence under the UAE Penal Code. Moreover, any individual by complex technology that can be tailored to suit the type of who, having knowledge of a crime, conceals any evidence of investigation, including audio review, web-based review software the crime, by knowingly delivering false information, shall be and enhanced chat review. Predictive coding can be used to work committing a criminal offence. with large-scale, multilingual corpuses. Such resources are often offered by external forensic teams and legal teams are used at the 7.3 Is an entity required to provide legal representation review stage to accurately identify relevant documents. to witnesses prior to interviews? If so, under what circumstances must an entity provide legal representation for witnesses? 6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are There is no requirement to provide legal representation to best practices for reviewing a voluminous document witnesses prior to internal interviews. collection in internal investigations?

7.4 What are best practices for conducting witness The data review process can be assisted using a data management interviews in your jurisdiction? platform which utilises predictive coding techniques. There is nothing prohibiting the use of such techniques. However, the Cyber Crime Law (Federal Law by Decree No. 5 of 2012) contains Interviews should be conducted by experienced interviewers offences for the dissemination of any information obtained and accurately recorded in a witness statement. The witness through “computer technology” without authorisation or consent should sign this statement to confirm that the content of the by the owner of the material. In this situation, all forensic statement is true and correct. Best practice in the UAE would be accountants and data reviewers must ensure they have the right to for the witness to sign each page of the statement and confirm access, review and share (for example, to external counsel) any of that he is of sound mind and that the statement is made out of the data they extract and collate. If they fail to obtain, in writing, free will. Witness interviews should always be conducted with a the appropriate authorisations, they may be held criminally liable minimum of three people in the room, so if required, the addi- for dissemination of confidential information. tional person can also affirm the nature of the interview and the answers provided by the witness. 72 Witness Interviews 7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction? 7.1 What local laws or regulations apply to interviews of employees, former employees, or third parties? What authorities, if any, do entities need to consult before For internal investigations, it is illegal to tape or video record initiating witness interviews? the interviews without obtaining the prior written consent of the witness. Although not required by law, you should consider Conducting interviews with employees (both current and the native language of the witness and provide a translator. For former) is necessary in any internal investigation. There is no any police interviews, the language of the interview will always requirement to consult with authorities during an internal inves- be Arabic and the witness may request translators if required. tigation. Where the potential offence involves a transaction The witness will be required to sign a statement at the end of the involving the proceeds of crime, it is important to ensure that interview in Arabic, so they should always have it read to them carrying out interviews would not amount to “tipping off” as set by a translator in their native language. out in Federal Law No. 4 of 2002. Tipping off any person who was involved with a suspicious transaction that it is being scruti- 7.6 When interviewing a whistleblower, how can nised by authorities would amount to a criminal offence leading an entity protect the interests of the company while to fines and potentially imprisonment. upholding the rights of the whistleblower? It is also important to note that covert recording in the UAE is a crime. Recording or copying any conversation conducted in An organisation should take all reasonable steps to protect

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Morgan, Lewis & Bockius LLP 137

employees reporting suspected fraud or corruption. There is that it is correct before signing. A witness may be required to some statutory protection (for example, Dubai Law (4) of 2016) give evidence in court or again to the Public Prosecutor, and offered to whistle-blowers in the UAE in certain circumstances. if the company wishes to rely on the witness statement in any It is nevertheless advisable for organisations to have in place subsequent proceeding, it should also be recorded that they are a comprehensive whistle-blowing policy which outlines the willing to do this. The statement should be witnessed by all the procedures a whistle-blower should follow in order to raise a people in the room at the time of the interview. complaint internally and the steps that the company will take to investigate such complaints. This will allow the organisation 7.8 Does your jurisdiction require that enforcement to protect the company’s interests by ensuring that individuals authorities or a witness’ legal representative be present are not treated detrimentally for raising suspicions of corporate during witness interviews for internal investigations? fraud, while allowing the company to investigate such allegations before the competent authorities are notified. There are no special requirements concerning witness inter- During an investigation, information regarding the complaint views for internal investigations. It is always best practice to and investigation should remain confidential and access should have a second person in the room for any investigation, but be limited to those individuals who require it (such as the please note that no one should record the audio of the interview internal investigation team). The identity of the whistle-blower without the interviewee’s express written consent. Failing to should also be kept confidential and interviews conducted obtain their prior written consent and recording the interview in private. The company should demonstrate that it will not covertly is a criminal offence. tolerate any detriment to anyone reporting suspected corruption and take action against any individuals who threaten or take action against any person reporting suspected fraud. 82 Investigation Report

8.1 How should the investigation report be structured 7.7 Can employees in your jurisdiction request to and what topics should it address? review or revise statements they have made or are the statements closed? It is usual for companies to require, for their internal records, an For Public Prosecutor interviews, see the comments at question outcome-based report only with a record of the outcome of the 7.5. investigation and containing any information about remedial When conducting an internal investigation, a witness should steps that must be taken to prevent the issues arising again. As sign a statement confirming that the content is a true reflec- a report is not mandated by the authorities, companies should tion of the interview and their recollection of facts. A witness exercise caution when recording the methodology and outcome should therefore thoroughly review the statement to ensure of the report and disseminating that information widely.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London 138 United Arab Emirates

Rebecca Kelly represents both the United Arab Emirates and international entities regionally and internationally as a litigation and regulatory specialist, and counsels clients on arbitration, litigation, corporate and regulatory compliance. Her clients include companies involved in the construction, finance, technology, education, healthcare, and pharmaceutical sectors, and they are based throughout the United States, Europe, Middle East and Asia Pacific. Over the past 15 years working in the Middle East, Rebecca has represented companies involved in global cross-border white-collar crime investigations, including guiding companies through Foreign Corrupt Practices Act and UK Bribery Act investigations, as well as Middle East regulatory investigations. She is recognised as a leading legal expert in the Middle East and is consistently and globally ranked as a specialist in white-collar crime. Rebecca is the Middle East lead for the firm’s global crisis management team and the Managing Partner of the Dubai office.

Morgan, Lewis & Bockius LLP Tel: +971 4 312 1830 Office No. C, th10 Floor Email: [email protected] Emirates Towers Offices URL: www.morganlewis.com PO Box 504903 Sheikh Zayed Road, Dubai United Arab Emirates

Chris Warren-Smith represents clients in investigations and disputes matters, including corporate investigations, commercial and international litigation, arbitration and dispute resolution, and regulatory enforcement proceedings. Representing clients across all sectors, and across many jurisdictions including the United Arab Emirates and GCC, Chris has worked on many high-profile issues and crises that have arisen over the years. He serves as deputy chair of the firm’s white-collar and corporate investigations practice and as a member of its global crisis management team. He represents clients in a wide range of investigations, including UK proceedings conducted by the Financial Conduct Authority, the Serious Fraud Office, and Lloyd’s of London, and those involving regulators such as the US Department of Justice, US Securities and Exchange Commission, and US Commodity Futures Trading Commission, as well as regulators and professional bodies in many other jurisdictions throughout the world.

Morgan, Lewis & Bockius LLP Tel: +44 20 3201 5450 Condor House Email: [email protected] 5–10 St. Paul’s Churchyard URL: www.morganlewis.com London, EC4M 8AL United Kingdom

Morgan Lewis offers more than 2,200 lawyers, patent agents, benefits advisers, regulatory scientists, and other specialists – in 31 offices across North America, Asia, Europe, and the Middle East. The firm provides comprehensive litigation, corporate, transactional, regulatory, intellectual property, and labour and employment legal services to clients of all sizes – from globally established industry leaders to just-conceived start-ups. www.morganlewis.com

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Chapter 22 139

USA USA

Jeffrey A. Brown

Dechert LLP Roger A. Burlingame

12 The Decision to Conduct an Internal an effective compliance programme and something that should be considered by prosecutors in determining the resolution in a Investigation corporate criminal investigation. In September 2020, the CFTC also issued guidance on evaluating compliance programmes in 1.1 What statutory or regulatory obligations should connection with enforcement matters, which identifies detec- an entity consider when deciding whether to conduct an tion and evaluation of misconduct as factors to be considered by internal investigation in your jurisdiction? Are there any the Enforcement Division’s staff in determining an appropriate consequences for failing to comply with these statutory civil monetary penalty. or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation? 1.2 How should an entity assess the credibility of a Under U.S. law, there are very few statutory or regulatory obli- whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal gations to conduct an investigation, and the question of whether implications for dealing with whistleblowers? and when to investigate is typically left to the discretion of company management. However, despite the absence of affirmative obligation, there are significant incentives under law for a An appropriate response to a whistleblower complaint requires company to investigate any allegation or suspicion of miscon- some degree of investigation, irrespective of any perceived lack duct. As a general rule, businesses that identify, investigate, of credibility. Companies that fail to investigate a whistleblower and self-report misconduct prior to a government investiga- complaint because they choose to disbelieve the whistleblower tion may receive leniency in any subsequent enforcement action. take significant and unnecessary risk. Of course, the degree of Further, where a government investigation commences without investigation may depend in part on an assessment of the whis- a self-report from the company, the company can nonetheless tleblower’s credibility, including an assessment of the whistle- benefit from commencing and conducting an internal investiga- blower’s role in the organisation, his or her direct knowledge tion alongside, and in coordination with, U.S. authorities. of the events in question, and the existence or non-existence of In certain limited circumstances, public companies and other corroborating information. highly regulated entities may be subject to statutory and regula- A company’s response to a whistleblower complaint may impact tory obligations to conduct internal investigations, depending on whether U.S. authorities will choose to bring an enforcement the nature of the alleged or suspected misconduct. For example, action. For example, the SEC’s Whistleblower Program, estab- corporate officers of companies that are registered with the U.S. lished under the Dodd-Frank Wall Street Reform and Consumer Securities and Exchange Commission (SEC) periodically certify Protection Act of 2010 (Dodd-Frank Act), specifically encour- that financial reports accurately reflect the registrant’s financial ages whistleblowers to report misconduct internally prior to condition. Accurate certification may require a company to inves- approaching the SEC. This gives companies the chance to investigate any allegation of misconduct occurring during the reporting tigate. If the SEC, or any other U.S. regulator or prosecutor, period that could materially affect its financial condition. believes a company given such a chance has not adequately inves- Similarly, member-entities of self-regulatory organisations (SROs) tigated the complaint, it can increase the chance of a subsequent may be subject to SRO rules that require them to conduct inves- enforcement action. tigations in certain circumstances. For example, the Financial Whistleblowers employed by publicly traded companies are Industry Regulatory Authority (FINRA) requires member firms afforded significant protections under the Dodd-Frank Act to promptly investigate suspicions of insider trading. and the Securities Exchange Act, among other regulations. In the broad range of circumstances where investigation is Protection under the Dodd-Frank Act’s anti-retaliation provi- not obligatory, but rather discretionary in nature, regulators and sion, however, is available only to whistleblowers who report the prosecutors, including the SEC, Department of Justice (DOJ), alleged misconduct directly to the SEC. Consequently, whis- Commodity Futures Trading Commission (CFTC), and Office tleblowers may be inclined to report to the SEC shortly after of Foreign Assets Control (OFAC) grant leniency or cooperation reporting internally, and companies should consider this factor credit to companies that investigate and self-report violations, in determining whether to promptly proceed with an internal or conduct an investigation alongside and in concert with the investigation. Additionally, public companies may face civil or authorities. For example, the DOJ’s Guidance on the Evaluation criminal liability for discriminating or retaliating against whis- of Corporate Compliance Programs, which was recently updated tleblowers who provide information to supervisors or govern- again in June 2020, continues to identify the existence of an ment officials. effective investigation process and structure as a hallmark of

1.3 How does outside counsel determine who “the of all individuals involved in or responsible for the misconduct, client” is for the purposes of conducting an internal but requires the identification of all individuals substantially investigation and reporting findings (e.g. the Legal involved in or responsible for the misconduct for the company Department, the Chief Compliance Officer, the Board of to receive any cooperation credit. Directors, the Audit Committee, a special committee, The DOJ has also adopted a policy that discourages “piling etc.)? What steps must outside counsel take to ensure on”, that is, multiple regulators imposing multiple penalties on a that the reporting relationship is free of any internal company in relation to investigations of the same conduct. The conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who policy encourages greater coordination among DOJ components might have an interest in influencing the direction of the as well as with other federal, state, local, and foreign enforce- investigation? ment authorities. The policy sets forth factors considered by the DOJ in determining whether multiple penalties serve the interests of justice, including the egregiousness of the wrongdoing, Attention to this question at the outset of any investigation is statutory mandates regarding penalties, the risk of delay in final- essential. The client should be explicitly defined at the start of ising a resolution, and the adequacy and timeliness of a compa- the outside counsel’s engagement and set out unambiguously ny’s disclosure and cooperation with the DOJ. Nevertheless, in writing. Ultimately, questions regarding the identity of the the frequency of corporate resolutions involving the payment of client are determined by the party seeking representation, and fines and penalties to multiple enforcement agencies does not not by counsel. In the case of an internal investigation, the client appear to have declined. can be the company itself, but is often the board of directors, or a sub-group of the board, such as the audit committee, whose mandate often includes the conduct of internal investigations. 2.2 When, during an internal investigation, should a Where the company is the client, the company will often request disclosure be made to enforcement authorities? What that the outside counsel represent both the entity and those are the steps that should be followed for making a employees of the entity whose interests are not divergent, which disclosure? is appropriate and not objectionable. If there is even slight potential for corporate and individual interests to diverge, this issue If and when an entity becomes reasonably certain of misconduct should be identified early during the course of any investigation constituting civil or criminal wrongdoing, it should consider and the affected individuals should be advised to retain their own self-reporting to capture the significant benefits of early cooper- counsel, or counsel should be arranged for them. Often, simi- ation credit and voluntary disclosure. However, while an inves- larly situated individuals needing representation separate from tigation need not be completed prior to self-reporting, the entity the entity can be represented jointly by “pool counsel”. and outside counsel (if any) should thoroughly understand the Individuals whose conduct is, or may be, implicated in the scope of the alleged conduct and the identity of the individuals investigation should not participate in the direction of the involved to avoid incomplete or inaccurate disclosure that may investigation and should not participate in the investigation’s diminish prospects for cooperation credit and unnecessarily reporting structure while the investigation is in progress. increase regulators’ scrutiny.

22 Self-Disclosure to Enforcement 2.3 How, and in what format, should the findings of an Authorities internal investigation be reported? Must the findings of an internal investigation be reported in writing? What risks, if any, arise from providing reports in writing? 2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in your jurisdiction consider an entity’s willingness to Investigative findings need not be reported in writing. Oral pres- voluntarily disclose the results of a properly conducted entations best preserve applicable privileges and permit interim internal investigation? What factors do they consider? reporting prior to reaching final conclusions, avoiding memo- rialising inconsistencies that can ultimately be resolved prior Self-reporting is a significant factor in the calculation of what, if to the investigation’s conclusion. However, when an investiga- any, penalty to impose for misconduct. Regulators and civil and tion in a matter that has attracted attention and public scrutiny is criminal enforcement authorities typically consider a company’s complete and the findings are secure, a publicly available written timely and voluntary disclosure in determining whether to bring report may be desirable for reputational or other reasons. a criminal or civil enforcement action against the company. If a proceeding is ultimately brought, voluntary disclosure may be a 32 Cooperation with Law Enforcement significant factor in a regulator’s decision to seek a reduced penalty. Authorities For example, in evaluating the appropriate sanction, the DOJ, SEC, and CFTC consider an entity’s self-disclosure and subse- 3.1 If an entity is aware that it is the subject or quent cooperation, which can include document production and target of a government investigation, is it required to assistance with employee interviews, as one of a number of rele- liaise with local authorities before starting an internal vant factors, including the nature and seriousness of the offence, investigation? Should it liaise with local authorities even the entity’s history of misconduct (if any), the existence and if it is not required to do so? effectiveness of the entity’s compliance efforts, and the actions the company has taken in response to the misconduct. Companies are not generally required to seek permission or other- Many regulators and prosecutors, including the SEC and wise to confer with regulators before investigating. However, in CFTC, have recently adopted policies explicitly stating that in certain limited circumstances where a company is in a coopera- order to receive cooperation credit, an entity must identify all tive posture, regulators may make requests to the company about employees involved in or responsible for the misconduct and contacting certain individuals in order to preserve the sanctity of provide all facts relating to the misconduct. The DOJ recently the regulator’s parallel investigation. revised its policy so that it no longer requires the identification

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Dechert LLP 141

Although liaising with authorities is generally not required, it is information in one jurisdiction to another jurisdiction’s author- often advisable, for the reasons described elsewhere in this chapter. ities, such as the U.S.-U.K. Bilateral Data Access Agreement, A company under investigation may benefit from disclosing the which became effective in July 2020 and allows U.S. and U.K. existence and preliminary findings of its internal investigation to law enforcement agencies to compel U.S. and U.K. cloud service the investigating authority not only because of eventual cooper- providers to disclose electronic data in criminal investigations. ation credit, but also to help confine the contours of the outside Furthermore, whenever an entity is subject to investigation by investigation. However, a company cooperating with authori- multiple authorities, the entity should, at the early stage, explore ties should be aware that if it is later deemed that the company whether a coordinated or global resolution of the investigation was directed in the conduct of its investigation by the govern- is possible. ment, such that the company could be argued to have acted as the government’s agent in the course of the investigation, the failure 42 The Investigation Process by the company to afford certain Constitutional protections to its employees may be the subject of later litigation regarding the 4.1 What steps should typically be included in an admissibility of statements and other evidence obtained in the investigation plan? course of the investigation. An investigation plan should set forth clearly the scope of the 3.2 If regulatory or law enforcement authorities investigation, in terms of geography, relevant business units, and are investigating an entity’s conduct, does the entity the pertinent time period. Necessary steps include document have the ability to help define or limit the scope of a preservation, collection, and review, which begins with the iden- government investigation? If so, how is it best achieved? tification of relevant document custodians, and, if the review is electronic, relevant document search terms. A plan for further Where regulators act within the lawful scope of their authority, fact development typically includes witness interviews and, in a corporate entity has little ability, aside from cooperation and many cases, expert analysis. The plan should also include an self-disclosure, to control the scope of a government investiga- understanding of how and when investigative findings will be tion, which is ultimately a matter of the government’s discre- shared with the client. When cooperating with investigating tion. However, where an entity cooperates with the investiga- authorities, it is often advisable to share the scope of the inves- tion, discloses its own investigation, and shares its findings with tigative plan with the authorities to ensure it meets with their the government, such cooperation and disclosure may serve satisfaction and that cooperation credit is being secured. to focus the government’s investigation and limit its scope. Where an entity is not in a cooperative posture with the government, and a regulator exceeds its authority, the entity may have 4.2 When should companies elicit the assistance of outside counsel or outside resources such as forensic recourse to the judicial system to oppose investigative meas- consultants? If outside counsel is used, what criteria ures and requests that are intrusive and burdensome, but such or credentials should one seek in retaining outside recourse is typically limited. counsel?

3.3 Do law enforcement authorities in your jurisdiction For any matter involving activity beyond a routine response to an tend to coordinate with authorities in other jurisdictions? information request, the hiring of outside counsel is common- What strategies can entities adopt if they face place. Even where in-house legal departments are experienced investigations in multiple jurisdictions? with investigations involving suspected civil or criminal violations and are comfortable interfacing with government authori- Cross-jurisdictional coordination between U.S. authorities ties, the hiring of outside counsel can serve to demonstrate that and law enforcement and regulatory agencies outside the U.S. the entity is taking the issue seriously and responding sincerely. is commonplace and increasing. The most recent high-profile Regulators and prosecutors tend to scrutinise investigations example of such coordination involved the DOJ cooperating closely in which the entity is, in effect, investigating itself. with the U.K. Serious Fraud Office and the French Parquet Whether to retain additional outside consultants, including National Financier to conduct a foreign bribery investigation data forensics experts or subject-matter consultants, should be against Airbus, which led to a global settlement of the matter. discussed closely with outside counsel. Any such experts should Given the increasing level of both domestic and cross-border be retained by outside counsel to ensure that communications inter-agency cooperation and coordination, entities subject to made by the experts pursuant to the investigation remain subject investigation should assume, as a matter of course, that informa- to any applicable privileges. tion presented to one authority will be shared with other authorities, whether domestic or foreign. When that happens, it is 52 Confidentiality and Attorney-Client essential that the information presented to multiple authorities Privileges be consistent. Such consistency is best achieved through coordination with regulators, which has the additional benefit of easing the burden of responding to multiple and different requests for 5.1 Does your jurisdiction recognise the attorney- information from various authorities. Entities under investiga- client, attorney work product, or any other legal privileges in the context of internal investigations? What tion should seek to liaise with regulators early in the investiga- best practices should be followed to preserve these tive process, harmonise where possible the scope of the inves- privileges? tigations, and identify opportunities to eliminate duplicative work and the risk of inconsistency. For example, counsel may choose to create document depositories with rights of access U.S. law does not provide for a general investigative privilege. for multiple regulators or invite multiple authorities to witness As a result, clients and counsel need to take affirmative steps interviews. Additionally, entities should be mindful of agree- within the conduct of an investigation to establish and abide by ments between government authorities that allow the sharing of the necessary conditions to ensure that all applicable privileges

are preserved. The privileges recognised in U.S. law include 5.4 How can entities protect privileged documents the attorney-client privilege, the “common interest” or “joint during an internal investigation conducted in your defence” privileges, and the attorney work-product doctrine. jurisdiction? The attorney-client privilege protects communications between client and counsel wherein legal advice is sought or provided. Proper identification and handling of privileged documents is The common interest and joint defence privileges provide for the critical to preserving applicable protections. Privileged docu- protection of legal communications with third parties (and their ments created during the course of the investigation should be attorneys), if the client and the third party share a common legal clearly marked with the applicable privilege on each page of the interest and the communications are made in furtherance thereof. document. Privileged communications that pre-date the investi- It is important to note that these privileges protect communica- gation should be identified and clearly marked during the docu- tions, not facts. By virtue of being communicated to counsel, ment review phase of the investigation, and set aside so as to facts themselves do not become subject to privilege. avoid inadvertent disclosure to regulators or other third parties. The attorney work-product doctrine protects materials – Additionally, entities and their counsel should be mindful that documents, memoranda, and analyses – prepared by attorneys U.S. courts have ruled that a client may waive the work product in anticipation of litigation. Depending on the nature of the protection for materials prepared by counsel, such as interview work product, it may be afforded a different degree of protection notes and memoranda, by providing oral summaries of inter- from discovery. The “ordinary” work product, which consists views or allowing the auditor to produce memoranda summa- of gathered materials and facts, is accorded less protection than rising the findings to government authorities like the SEC. the “opinion” work product, which contains the thoughts and analysis of counsel. The primary purpose of the internal investigation is an impor- 5.5 Do enforcement agencies in your jurisdictions keep the results of an internal investigation confidential if tant factor in determining whether the investigation is protected such results were voluntarily provided by the entity? by privilege. U.S. courts have applied the attorney-client privilege where the primary purpose of the investigation was to obtain or provide legal advice, but not where the purpose was to Some materials provided to U.S. enforcement agencies are provide business advice. protected from general disclosure by law, such as materials Applicable privileges can be waived, both explicitly and by provided pursuant to a U.S. federal grand jury subpoena. But the conduct of the holders of the privilege. To preserve priv- investigating authorities are typically not under a legal obliga- ileges, privileged materials should be clearly marked and kept tion to maintain the confidentiality of information voluntarily confidential. provided by an entity about the results of an internal investigation. Entities making disclosure of materials typically seek to limit further disclosure of such materials, including through 5.2 Do any privileges or rules of confidentiality apply requests for confidential treatment under the Freedom of to interactions between the client and third parties Information Act (FOIA). However, as stated elsewhere in this engaged by outside counsel during the investigation chapter, entities should assume that law enforcement agencies (e.g. an accounting firm engaged to perform transaction will share information with other domestic or foreign authorities. testing or a document collection vendor)? Further, where the investigating authority is under no obligation to keep the information confidential, or the agency determines it Communications with, and materials prepared by, experts hired may disclose the information consistent with its objectives – for by counsel are protected by the attorney-client privilege and example, detailing facts supporting an agreement that includes a attorney work-product doctrine, provided that such communi- penalty imposed upon the entity under investigation – the infor- cations and materials are made in furtherance of providing legal mation may become public. Nonetheless, where the entity is in advice to the client. a cooperative posture, counsel can work with the investigating authorities to limit the scope of information disclosed. 5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal 62 Data Collection and Data Privacy Issues investigation? 6.1 What data protection laws or regulations apply to U.S. privilege law applies equally to in-house and outside internal investigations in your jurisdiction? counsel. However, privileges asserted for communications with and materials prepared by in-house counsel may be challenged, Unlike some other jurisdictions, the U.S. does not have a specific particularly if in-house attorneys also provide business advice data protection or data privacy regime applicable to internal or other non-legal advice to employees. In such circumstances, investigations. Certain DOJ policies and procedures provide it is important for in-house counsel to separate legal and busi- for the redaction or non-disclosure of sensitive personal infor- ness communications. Accordingly, including outside counsel mation like social security numbers and other identifying data, on any investigation-related communications may provide a but such protections are not mandated by statute. stronger shield against disclosure and U.S. courts have found While the U.S. does not have an equivalent to the European the retention of outside counsel to be an important factor in Union’s General Data Protection Regulation (GDPR), entities determining whether the primary purpose of the investiga- producing information in the course of investigations should pay tion is to obtain legal advice. Additionally, internal investiga- close attention to the data protection or data privacy law of the tions should be conducted at the direction of counsel – whether states in which they do business. Notably, the California Consumer internal or external – rather than compliance officers, who are Privacy Act (CCPA), which became effective on January 1, 2020, not attorneys, so that the documents relating to the investigation requires companies to make disclosures to consumers regarding are protected by the attorney-client privilege. the collection, use, and sharing of personal information. While the CCPA does not restrict an entity’s ability to comply with a

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Dechert LLP 143

government investigation, it may nonetheless alter data collec- Engaging local counsel experienced in complying with non-U.S. tion and retention policies for certain consumer-facing compa- data protection regimes may be necessary to this process. nies, and entities should make themselves aware of the manner in which data privacy statutes and the ability to comply with infor- 6.4 What types of documents are generally deemed mation requests from regulators may conflict. important to collect for an internal investigation by your jurisdiction’s enforcement agencies? 6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document Which types of documents must be collected will depend on the preservation notice to individuals who may have particular facts and the matters under investigation. An entity documents related to the issues under investigation? Who should receive such a notice? What types of should collect broadly and consider at the outset of collection documents or data should be preserved? How should which types of documents may have relevance to the potential the investigation be described? How should compliance issues and underlying activity. Typical examples include phys- with the preservation notice be recorded? ical and electronic documents and communications, recorded audio communications, trade records, payment and transaction While it is not a legal requirement to preserve data unless an ledgers, and relevant policies and procedures. Particular atten- investigation or litigation commences or is reasonably foresee- tion should be given to whether, in the context of the investi- able, entities should maintain and periodically update a written gation and given its specific focus, employees’ mobile devices document retention policy that is accessible to all employees should be collected and imaged. that clearly and thoroughly delineates under ordinary circumstances what data should be retained by the entity, for how long, 6.5 What resources are typically used to collect and when and under what circumstances data may be deleted documents during an internal investigation, and which or destroyed. Compliance with document retention policies, resources are considered the most efficient? including deletion policies, can be a useful safeguard against suspicions or allegations that data has been selectively deleted Where large volumes of data and documents need to be collected for nefarious purposes. and reviewed, an entity will often hire a third-party data vendor Once a litigation or investigation is foreseeable and a duty to identify and secure the relevant materials. Outside counsel to preserve does arise, failure to preserve data can have conse- may begin its investigative process by conducting interviews in quences ranging from potential criminal liability for obstruc- collaboration with the vendor to better understand what catego- tion of justice to evidentiary inferences of consciousness of ries of documents and data may exist, where they are kept, and guilt that can significantly alter civil and criminal proceedings which employees are most likely to have responsive materials. regarding the matters under investigation. As such, entities should issue a document preservation notice, which suspends the operation of the ordinary course document retention policy, 6.6 When reviewing documents, do judicial or not only when notice is given of a potential government inves- enforcement authorities in your jurisdiction permit tigation, but also whenever an internal investigation is initiated. the use of predictive coding techniques? What are best practices for reviewing a voluminous document The notice should be sent to employees, as well as third parties, collection in internal investigations? who are likely to possess relevant documents and data. It should state the existence of the investigation, briefly describe the relevant subject matter so that employees can identify documents The scope of document review and production is increasingly the and data that must be preserved, explain the importance of data product of a negotiation between the entity and the investigating retention, and identify potential locations and categories of rele- authority. Typically, the entity, in collaboration with outside vant data and documents. Entities should also send the notice counsel and any outside data collection and review vendors, iden- to their IT departments to prevent ordinary course document tifies a population of employees (“custodians”), a date range, and destruction or overwriting of electronic media from continuing. a set of search terms to apply to the documents possessed by To record compliance with the notice, the notice should provide that set of custodians, and seeks the approval of the investigating some form of acknowledgment, often a signature affirming authority to conduct its collection according to the proposed receipt and compliance, by each employee receiving a copy. scope. The resulting documents will be reviewed by counsel for responsiveness and any applicable privileges prior to production. Some entities use predictive coding and other forms of 6.3 What factors must an entity consider when technology-assisted review (TAR) in lieu of search terms and documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)? first-level document review. An increasing number of courts have been accepting the use of predictive coding in civil cases, and it may be particularly useful for financial institutions or The overriding consideration in the investigative context is often other entities with large volumes of data. However, TAR has not the company’s desire to preserve the perception of compliance yet been widely used to identify materials responsive to govern- and cooperation with the investigating authority’s requests. The ment requests and investigations. delays and difficulties that can arise from complying with the overlapping, and sometimes conflicting, data privacy regimes of foreign jurisdictions can threaten the perception that a 72 Witness Interviews company is providing information in a forthcoming manner. Multijurisdictional entities should have thoroughly developed 7.1 What local laws or regulations apply to interviews standing protocols for navigating investigative requests that of employees, former employees, or third parties? What authorities, if any, do entities need to consult before implicate competing disclosure and privacy regimes, should be initiating witness interviews? attentive early in the investigative process to the complexities and delays that may arise, and should be aware of measures, including informed consent of employees, that can alleviate such delays. Companies need not consult with any authorities prior to

initiating witness interviews in connection with an internal 7.5 What cultural factors should interviewers be aware investigation, except in the limited circumstance discussed else- of when conducting interviews in your jurisdiction? where in this chapter, in which as part of a cooperative investigation, an authority requests that an entity shall not interview Though the U.S. is likely not unique in this regard, employees or contact an individual until the authority has had the oppor- may generally be wary of interviews and reluctant to interface tunity to interview that person. with counsel, particularly with unfamiliar outside counsel. As a result, employee interviews are often designed to be as accom- 7.2 Are employees required to cooperate with their modating as possible to the witness so as to encourage the employer’s internal investigation? When and under greatest candour. Such interviews are conducted in an informal, what circumstances may they decline to participate in a non-confrontational fashion to ease the employee’s concerns and witness interview? to ensure the most thorough information-gathering possible.

In the U.S., employees are often required to cooperate with 7.6 When interviewing a whistleblower, how can internal investigations as a condition of their continued employ- an entity protect the interests of the company while ment, and declining to participate may result in dismissal. upholding the rights of the whistleblower?

7.3 Is an entity required to provide legal representation As described elsewhere in this chapter, whistleblowers are to witnesses prior to interviews? If so, under afforded certain protections under U.S. law, and companies what circumstances must an entity provide legal may face civil or criminal liability for discriminating or retali- representation for witnesses? ating against whistleblowers who raise concerns about company misconduct to outside authorities. However, there is nothing There is no statutory requirement to provide separate legal particular about the interview context that requires modifica- representation to employees prior to interviews, though certain tion for the interview of a whistleblower. All employees are key employees may negotiate indemnification for legal fees in due respect and consideration in the investigative process, and their employment agreements and may hire counsel if they feel whistleblowers are no different. Nonetheless, a routine measure their interests diverge from those of the company or if they may that may protect the interests of both the whistleblower and the face criminal charges. Even absent such contractual provisions, entity is the provision of separate counsel to the whistleblower entities will often provide separate counsel for employees and at the entity’s cost, which signals to both the authorities and the pay counsel’s fees. whistleblower that the matter is being treated seriously and that the whistleblower’s individual rights are being respected. 7.4 What are best practices for conducting witness interviews in your jurisdiction? 7.7 Can employees in your jurisdiction request to review or revise statements they have made or are the Witness interviews should be conducted in a manner and location statements closed? that affords privacy to the witness and avoids speculation among other employees and resulting disruption to the company’s busi- Often, counsel representing employees will ask what statements ness activities. This often means interviews are conducted at the their client made to the company prior to the involvement of offices of outside counsel or at a separate location. the employee’s counsel. Such requests are routinely accom- Interviews should be memorialised in writing by counsel modated in one form or another, but with due attention paid and attended by a sufficient number of counsel so that in the to avoiding any waiver of applicable privileges or protections. unlikely event an attendee were needed to testify about what However, such requests are granted as a matter of discretion, not was said in the interview, a member of the legal team could do entitlement. If a witness wishes to clarify or supplement a prior so without disqualifying the law firm or otherwise disrupting statement, such requests are typically viewed as beneficial to the the representation. The conditions of the interview should be truth-finding process, and are permitted, absent circumstances clearly described to, and understood by, the witness, including indicating a motive to fabricate. whether the attorney-client privilege applies to statements made therein and whether counsel represents the entity, the witness, 7.8 Does your jurisdiction require that enforcement or both. In the U.S., in an employee interview where counsel authorities or a witness’ legal representative be present represents the entity but not the witness, the interview typi- during witness interviews for internal investigations? cally begins with a formal instruction known as an “Upjohn warning”, which clarifies that in-house or outside counsel repre- Government authorities are not required to be, and are typically sents the entity and not the witness, and that it will be within the not, present at employee interviews during internal investigations. entity’s discretion, and not the witness’s, whether to share the If an employee is represented by separate counsel, in connec- content of the interview with government authorities. tion with the investigation, counsel will generally attend all inter- The written memorandum of the interview should not be a views of the employee. Indeed, ethical rules in many jurisdic- verbatim recitation of what was said, but rather should reflect tions forbid a lawyer from contacting an individual he or she the mental impressions of the attorneys present, so that, as set knows to be represented by counsel outside the presence of said forth elsewhere in this chapter, the work-product doctrine will counsel, though this protection can be knowingly waived. protect the memorandum from compelled disclosure. In addition to a description of the witness’s responses, the memorandum should reflect who was present at the interview, the approximate length of the interview, and whether the Upjohn warning was given.

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Dechert LLP 145

82 Investigation Report and less elaborate than a report intended for public access. Any report, whether public or private, should contain factual findings, legal conclusions, and recommendations for remediation, 8.1 How should the investigation report be structured if findings of deficiency were made. and what topics should it address? Acknowledgment The structure of any investigative report may vary according to the particular facts and circumstances of the matters under The authors would like to acknowledge the invaluable contribu- investigation and the ultimate audience and purpose of the tion of Hayoung Park, an Associate in Dechert LLP’s New York report. To the extent that the written report is for the internal office, in the creation of this chapter. use of the client, it is likely to be less formal, less structured,

Jeffrey A. Brown focuses his practice on white-collar defence, securities litigation, Securities Exchange Commission enforcement actions, and related commercial litigation. His experience includes conducting internal investigations across multiple industries and across international boundaries, representing companies and individuals in connection with investigations by the Department of Justice, the Securities Exchange Commission, and state and local prosecutors. Mr. Brown’s practice also includes representing individuals investigated for “spoofing” and other market manipulation in markets for various commodities. Mr. Brown previously worked for almost 10 years at the United States Attorney’s Office for the Southern District of New York, where he served as Co-Chief of the General Crimes Unit, and before that, as Acting Deputy Chief of the Narcotics Unit. As an Assistant U.S. Attorney, Mr. Brown investigated and prosecuted crimes in the Terrorism, International Narcotics Trafficking, Narcotics, Violent Crimes and General Crimes Units. Many of Mr. Brown’s representations at Dechert involve investigations brought by his former Office.

Dechert LLP Tel: +1 212 698 3511 Three Bryant Park Email: [email protected] 1095 Avenue of the Americas URL: www.dechert.com New York, NY 10036-6797 USA

Roger A. Burlingame focuses his practice on white-collar criminal defence, internal investigations, regulatory enforcement matters and related civil litigation. A former high-ranking prosecutor for the U.S. Department of Justice and seasoned trial lawyer, Mr. Burlingame defends individual and corporate clients in the EMEA region from cross-border U.S. government investigations and related civil litigation. He routinely serves as lead defence counsel in high-profile investigations relating to fraud, collusion, manipulation and abuse in the financial markets, FCPA violations, money laundering, asset forfeiture and tax evasion. Mr. Burlingame also represents companies and individuals facing U.S. sanctions violations, import/export controls, as well as issues involving the International Emergency Economic Powers Act and the Committee on Foreign Investment in the United States. Consistently recognised as a leading lawyer by EMEA-based clients facing U.S. government criminal and regulatory investigations, Mr. Burlingame is described by Chambers and Partners UK as “the go-to guy for any case with a US angle” and by The Legal 500 UK as “the go-to guy for European targets of high-profile US-facing investigations”.

Dechert LLP Tel: +44 20 7184 7333 160 Queen Victoria Street Email: [email protected] London EC4V 4QQ URL: www.dechert.com United Kingdom

Corporate Investigations 2021 © Published and reproduced with kind permission by Global Legal Group Ltd, London Other titles in the ICLG series

Alternative Investment Funds Digital Health Oil & Gas Regulation Anti-Money Laundering Drug & Medical Device Litigation Outsourcing Aviation Finance & Leasing Employment & Labour Law Patents Aviation Law Enforcement of Foreign Judgments Pharmaceutical Advertising Business Crime Environment & Climate Change Law Private Client Cartels & Leniency Environmental, Social & Governance Law Private Equity Class & Group Actions Family Law Product Liability Competition Litigation Fintech Project Finance Construction & Engineering Law Foreign Direct Investment Regimes Public Investment Funds Consumer Protection Franchise Public Procurement Copyright Gambling Real Estate Corporate Governance Insurance & Reinsurance Renewable Energy Corporate Immigration International Arbitration Restructuring & Insolvency Corporate Tax Investor-State Arbitration Sanctions Cybersecurity Lending & Secured Finance Securitisation Data Protection Litigation & Dispute Resolution Shipping Law Derivatives Merger Control Telecoms, Media & Internet Designs Mergers & Acquisitions Trade Marks Digital Business Mining Law Vertical Agreements and Dominant Firms

@ICLG_GLG The International Comparative Legal Guides are published by: