Follow us on Twitter @mlbulletin and join discussions in our LinkedIn group

www.moneylaunderingbulletin.com

FEATURE ❱ PRACTICE FINDINGS

He’s watching for a sign: working eff ectively with a Corporate Compliance Monitor The fi rm’s in trouble but can avoid criminal sanction by mending its ways under the watchful eye of a ‘corporate probation offi cer’. Nigel Coles of Exiger, which was formed to monitor HSBC’s compliance with its deferred prosecution agreement, looks at how to manage a highly nuanced relationship.

Th e ability to ‘defer’ the prosecution of corporate entities facing criminal charges has been an option available to United States (US) prosecutors for a number of years. Now combined with the use of independent monitors since at least the mid-1990s, the Deferred Prosecution Agreement (DPA) is a relatively common practice there. Until recently, deferred prosecution has been a virtually unknown concept in the United Kingdom (UK) corporate environment, but its profi le is rising steadily, as a result of two recent events. Th e DPA between HSBC, a bank registered in the UK, and the US Department of Justice just two years ago - together with the passing of the Crime and Courts Act by Parliament in 2013 (the “Act”) and its consequent Code of Practice, issued in February 2014 [2] (the “Code”) - have raised questions in the minds of many in the corporate world.

Issue 2211 He’s watching for a sign:

working eff ectively with a Corporate Compliance MonitorThe Deferred Prosecution Agreement in practice

6 NewsHSBC private bank helped clients evade tax, others faced serious criminal allegations, leaked fi les show

7 Protected disclosers – a limit on civil liability for suspicionProceeds of Crime Act amendments to help banks

9 Black gold’s black marketIllegal oil extraction – an exploration

13 Take ‘em out – AML goes into attackAdvance free fraud off ensive

14 EU sanctions update – RussiaNew names and a listed entity’s legal challenge

15 Insolvency practitioners must not act in haste, lest they repent at leisurePre-packs and phoenixes call for caution

18 Closer to the ownerSo near, yet so far – and that’s only the legislation

20 Does Norway need a new master builder?FATF mutual evaluation fi ndings

23 What’s wrong with AML?A range of informed opinion

25 Isthmus and nexus – the misfortune of Central AmericaThe narco-fi nance trap

27 Linkedin discussions, Diary

➤ IN THIS ISSUE

March 2015

New York: 600 Third Avenue, 10th Floor, New York, NY 10016

+1 212 833 3411

London: Nexus Place, 4th Floor, 25 Farringdon Street, London, EC4A 4AB

+44 (0) 207 029 5121

www.exiger.com

2 Issue 221 • March 2015

What are the typical features of a DPA? How is the company’s compliance with the terms of an agreement supervised by a monitor? And, what can companies and fi nancial institutions do to ensure that the supervision process leads to the satisfactory resolution of the agreement?

Whilst the detail and form of DPAs and the use of monitors in the US are not directly comparable to those envisaged in the UK – indeed there are notable diff erences [3] - many of the lessons learned in their practical implementation are nonetheless instructive. Th is short piece highlights some of the key issues that a company that enters into a DPA will face, and off ers, based on previous experience, some insights to assist in the negotiating process.

Deferred prosecution in the UK Schedule 17 of the Act came into force in February 2014 and defi nes the characteristics of a DPA in the UK. In the UK, a DPA is an agreement between a prosecutor and a company – but not an individual – whom the prosecutor is considering prosecuting for any one, or more, of a number of off ences of fi nancial crime as defi ned in the Act. Whilst designated off ences include theft, conspiracy to defraud, customs and excise off ences, forgery, fraud, and contraventions of the Financial Services and Markets Act , those most likely to feature in the fi rst UK DPA’s are off ences of bribery and corruption, or of money laundering.

DPAs in the UK must contain two mandatory features. First, the agreement requires an agreed statement of facts relating to the alleged off ence, and may include specifi c admissions by the company. Second, an expiry date must be specifi ed when the DPA will cease to have eff ect – and by which time the issues leading to the DPA will have been remediated. Although not required by law, these two features are nearly always present in US DPAs as well.

A range of optional features of a DPA, or ‘terms’, are envisaged in section 5(3) of the Act, and include: the payment of a fi ne, the payment of compensation to any victims, a donation to charity, the disgorging of any profi ts accrued through the criminal conduct, the implementation of a compliance programme, cooperation with investigators and the payment of any reasonable costs of the prosecutor. Th e Act itself does not specifi cally refer to a requirement for a corporate compliance monitor, but does note that the examples included in section 5(3) are by no means a fi nite list. Interestingly, in June 2013, the Directors of the Serious Fraud Offi ce and of Public Prosecutions jointly issued a draft Code for consultation that explicitly referred to the use of a monitor as one of the possible terms in a DPA. Perhaps surprisingly, no objections to the use of a monitor were received during the consultation period,

and detailed suggested practices on the use of monitors duly appear in the fi nal version of the Code.

Although the Code is jointly issued by the two principal prosecuting Directors in the UK and is intended to apply to the full range of fi nancial crimes, the tone, language and examples provided are heavily infl uenced by issues of bribery and corruption. It is therefore not unreasonable to anticipate that the fi rst DPAs will in all likelihood relate to off ences committed against the UK Bribery Act 2010 , and, further, that those DPAs may well include provision for a corporate compliance monitor.

The corporate compliance monitor Why is a requirement for a monitor likely to be a feature? A DPA is an agreement between two parties, each of whom haS very diff erent objectives. For the prosecutor, with limited resources, the use of a monitor extends reach and capability. A monitor provides the ability to form a dedicated team of professionals on a single issue for an extended period. For the off ending corporation, the active engagement of a monitor provides reassurance that remediation measures, albeit with some readjustment along the way, will satisfy the terms of the DPA and avoid more serious sanctions.

One dictionary defi nition of a ‘monitor’ is “one that admonishes, cautions, or reminds, especially with respect to matters of conduct”, which neatly summarises the role from both perspectives. Th e ‘basic structure is that a corporation is to retain at its own expense a monitor to oversee its compliance with the (deferred prosecution) agreement and its implementation of required reforms, such as an improved compliance program’. [4]

If a monitorship is to be eff ective during the life of the DPA, addressing some fundamental considerations at the outset is likely to avoid diffi culties later. Actively negotiating the requirement for, and the terms under which a monitor is to operate should be the fi rst issue for a company considering a DPA.

Negotiating the monitor requirement in a DPA Not every instance of corporate misconduct leading to a DPA will be appropriate for the use of a monitor. A single instance of criminal conduct, however egregious, or conduct in a rogue unit or subsidiary may not in itself warrant the continuous attention of a monitor - with the associated expense. But where the conduct forms a pattern, and there has been systemic failure over an extended period, an independent monitor is more likely to be able to persuade the prosecutor and the ratifying court of a company’s genuine contrition and desire to fi x its failures. Similarly, if an inappropriate ‘tone from

© Informa UK Ltd 2015 3

www.moneylaunderingbulletin.com

the top’ has been a signifi cant factor in allowing the off ending company to engage in criminal conduct – perhaps through a ‘results at all costs’ company ethos – then the programme necessary to address the consequent negative behaviours may benefi t from the discipline aff orded by monitor oversight.

Th e requirement for the formal appointment of a monitor may, however, be avoided if the company acts decisively during the period between the discovery of criminal conduct and the fi nal negotiation of the detailed provisions of the DPA. For instance, if the company self-disclosed the conduct in question, initiated a thorough independent external review of its compliance processes - perhaps by an individual who has undertaken the role of monitor in the past - assists investigators in identifying errant employees and makes signifi cant changes (for example, to its training programme), then a monitor might not be deemed necessary.

Multiple monitors An off ending company could breach, say, both the US Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act and be potentially faced with more than one prosecution on similar facts. In such a case, a DPA might be negotiated with each of the prosecuting agencies. Or, where a DPA is being contemplated by a prosecutor, the primary regulator – such as the Financial Conduct Authority (FCA) – might also decide to impose parallel supervisory arrangements under its section 166 ( Financial Services and Markets Act ) powers. Although the prosecutors will often be cooperating with one another, separate negotiations are typically necessary. As such, the temptation could be to consider appointing diff erent individuals for each role. Th is is likely to be a mistake.

Th e engagement of a monitor and his team will be expensive and will require considerable time and eff ort on the part of the company. A monitor will be collecting information, preparing reports and making recommendations. Th ere will be heavy engagement with counsel representing the company. Not only would a second monitor eff ectively double the commitment required of the company, but the company could be presented with confl icting recommendations. A company faced with the potential for the appointment of multiple monitors or ‘skilled persons’ should therefore endeavour to negotiate agreement between the parties for a joint monitor. In such negotiations the advice of an experienced monitor will pay dividends.

Selecting the right monitor If a monitor is required, it will be vitally important for a company to secure the services of a monitor with which it will be comfortable working. Critical to the selection will be a genuine appreciation of the fundamental role of

a monitor. He or she is not a compliance consultant or a corporate advisor. Although paid for by the off ending company the monitor is an independent third party. Monitors have been described as ‘corporate probation offi cers’, an analogy that neatly encapsulates the relationship between the monitor and the off ending corporate. Th e relationship should be business-like and supportive, but it is never going to be entirely comfortable. Th e monitor will be duty-bound to point out uncomfortable facts and will have to report in detail on the progress of the engagement to the prosecutor at various stages.

For these reasons, the initial selection of the right monitor is of the utmost importance. In the US, it has often been the practice for the off ending company to provide a short-list of three candidate monitors to the prosecutor indicating their preferred choice, a model that has been adopted in its entirety in the UK. [5] Separately engaging an experienced monitor (who is not vying for the job) to assist in the process of identifying the short-list of monitors may be an astute move. Th e advising monitor will have experienced the best and the worst aspects of a monitored compliance programme, and will be able to advise accordingly. Monitors and their teams should not only be experts in corporate compliance, but must also have a developed understanding of government and regulator’s expectations of what constitutes an eff ective programme and how the engagement of a monitor will facilitate its implementation. Because any monitorship will at times involve the consideration of complex legal issues, many monitors also have a legal background and, for example, in the US many have been prosecutors in white-collar crime cases.

Th e nationality of a monitor can be important and sometimes is eff ectively prescribed by law, especially where the activity to be monitored is conducted in multiple jurisdictions. For example, in the 2010 DPA between the US DOJ and the French company Technip SA (relating to infringements of the FCPA), it was specifi ed that the monitor should be a French citizen because domestic French law prohibits any foreign investigation on French soil. Conversely, many non-US companies party to a DPA with US authorities have chosen US citizens to be monitors because of their experience with the prosecuting and regulatory agencies there. As the use of corporate compliance monitors becomes a common feature of UK DPAs, companies may fi nd that experienced monitors (or their teams) with an established UK footprint can provide a useful level of insight.

A corporate compliance monitor must be able to demonstrate manifest independence and objectivity. Often this will mean that the proposed monitor has had no previous (or at least recent) relationship with the off ending corporation or position in the Government of the jurisdiction into which the DPA was entered or where the corporation has major operational centres. Inevitably, this may mean that large professional services

4 Issue 221 • March 2015

fi rms who have engaged with the off ending corporate in the past will struggle to demonstrate a suffi cient level of third party independence. UK prosecutors are entitled to reject a company’s preferred monitor if they consider there to be a confl ict of interest.

Another critical factor will be the level of specialist resources accessible by monitor candidates. Although it is not essential that the monitor should personally have detailed knowledge of the specifi c business sector himself, he or she will need to be able to access that knowledge within the monitor team. Many monitor teams are therefore multidisciplinary groups comprising lawyers who may have subject matter expertise in the particular fi eld, former compliance offi cers, ex-prosecutors and those with investigative or audit experience. Successful monitor teams are also able to attract the services of senior individuals with technical or operational experience of the relevant business sector.

Working with the monitor Th e off ending company must immediately grasp the fundamental function of a monitor. Following early experience in the US, there has been increasing clarifi cation of the role of a monitor there. For example: “A monitor’s primary responsibility should be to assess and monitor a corporation’s compliance with those terms of an agreement that are specifi cally designed to address and reduce the risk of recurrence of the corporation’s misconduct, including, in most cases, evaluating (and where appropriate proposing) internal controls and corporate ethics and compliance programs.” [6]

Because the monitor is duty bound to assess and oversee compliance with the terms of the agreement the company should understand from the outset that the monitor will be watching, testing and assessing how closely it is complying with the key elements of the agreement. Th is is not a retrospective assessment at the end of the DPA period but real-time, live oversight. Th e principal means by which a monitor will undertake his assignment is through the collecting of information and the preparing of reports.

Typically a monitor will issue a ‘work-plan’ setting out the key areas of the company that he will be inquiring into and giving a time-line along which this will be conducted including the dates by which key reports will be submitted. Th e Code actually requires the work-plan in advance of the DPA being fi nalised, detailed for the fi rst year but less so for subsequent years. Th is document will be set out at a fairly high level but the company should use this as a clear indication of what the monitor is interested in and thus prepare its managers and staff as best it can.

Th e information collection process will usually start with the provision by the company of compliance policies and procedures, management information reports, and internal audit fi ndings and is often augmented

by presentations from key personnel in the company. Th e monitor will not ordinarily seek to reinvestigate the fi ndings that led to the DPA itself, but will need to understand the full extent of the company’s misdeeds, whether those conditions persist and how they are being ameliorated. Th e monitor will inevitably be extremely demanding in his request for documents and such demands may initially be relatively unfocussed until a fuller understanding of the company is reached. Th is is hugely resource-intensive for the company and provision for a well-staff ed ‘monitor liaison team’ or ‘offi ce’ is better provided from the outset than through the continual reinforcement of an under-strength unit.

Th e Code asserts that a company subject to a DPA “shall aff ord to the monitor complete access to all relevant aspects of its business during the monitoring period as requested by the monitor”. [7] Nevertheless, there will inevitably be diffi cult negotiations between every company and its monitor with regard to access to ‘confi dential’ information, and the amount of time and eff ort required by each party for this purpose should not be underestimated. It is beyond the scope of this piece to detail all aspects of what is always a complex and detailed area, but discussions usually include issues of attorney-client privilege, data protection, client-confi dentiality and the information security arrangements in the monitor’s team.

Nowadays, US DPAs tend to specifi cally state that no attorney-client privilege will attach to the relationship with or to communication between the monitor and the company. Th is is considered necessary because the monitor’s independence might be compromised if he owed such a duty to the company. But the absence of such privilege gives rise to heightened legal risk for the company, as such material can be discovered in third party litigation. Any company subject to a monitorship provision in a DPA must contemplate the requirement for signifi cant in-house or seconded specialist legal counsel – the costs of which will not be inconsiderable.

In respect of costs more generally, each monitorship is unique to the circumstances of the particular case, and the size of the monitor team will vary accordingly. As the Code makes clear, the subject company is responsible for paying “all the costs of the selection, appointment, (and) remuneration of the monitor” in addition to “the reasonable costs of the prosecutor”. [8] Th e company should understand that such costs are likely to be considerable as they will include not only those of the monitor himself but all the members of his team – professional members, administrative staff and legal counsel - too. To these costs should be added the expense of the company’s own staff seconded to their in-house monitor liaison team, any external legal expenses and the opportunity costs associated with senior and mid-level personnel preparing for and engaging directly with the monitor.

© Informa UK Ltd 2015 5

www.moneylaunderingbulletin.com

Developing an eff ective relationship with the monitor Th ere is always the potential for tension in the relationship between a monitor and the company and there will be periods when this is more strained that usual. But both parties should put considerable eff ort into developing a strong relationship that is eff ective from each of their perspectives. Like all relationships, the strongest are built on mutual trust, respect and cooperation.

For the monitor, this means a company that is responsive to his requests for information, that freely provides access to senior executives and other staff , and that allows him to visit company premises without impediment. For the company, it means gaining confi dence in the monitor if he is transparent and communicative and keeps them abreast of his thoughts and assessments. Sharing drafts of the monitor’s formal reports before they are submitted to the overseeing prosecutor is not always possible and may even be constrained by the terms of the DPA itself. Nevertheless, in a healthy and cooperative monitorship, as long as the monitor remains cognizant of his duty of absolute independence, the monitor will usually be keen to ensure that the Chief Executive Offi cer, General Counsel and certain senior executives, such as the Chief Risk Offi cer, are briefed in advance on the main themes of his fi ndings.

Th is is why it is so important for a company entering into a DPA to understand what it is signing up to at the outset. To satisfy himself that he is obtaining a genuinely accurate picture of the company, the monitor will initially adopt what may appear to be a highly intrusive approach. Every monitor will wish to leave the company in better shape than when he was fi rst engaged but he will not – indeed cannot - shrink from reporting what he identifi es are failures to satisfy the terms of the DPA. A company should therefore recognize that “this isn’t personal – it’s business!” A monitor should be professional, courteous and even-handed, but neither he, nor his team, will support the company to the detriment of the court or the prosecutor.

Th e company cannot aff ord for the relationship to become anything less than respectful and functional. Th e recent falling-out between Apple Corporation and its monitor illustrates just how much a company will struggle to win in any signifi cant disagreement. Apple’s corporate compliance monitor was appointed under a DPA with the US Department of Justice entered into in October 2013. Just a month later, Apple complained that the monitor had been trying to aggressively interview top executives, even though his mandate required him to review the implementation of the company’s antitrust policies within 90 days of his appointment. Apple also complained about his proposed hourly fee rate of $1,100, which Apple said gave him an incentive to run “as broad and intrusive an investigation as possible”.

Th e Department of Justice supported the monitor’s position and ultimately the court has found in his and the prosecutor’s favour, ruling that Apple must re-engage with its monitor and cooperate fully. [9]

It is certainly unusual for a dispute between a monitor and a company to reach court in the US. More commonly, the prosecutor will be the fi nal arbiter in any dispute and, in the absence of manifest error, will likely support the monitor. Although the Code is silent on this issue there is no reason to think that the position will be at all diff erent in the UK.

Reports and recommendations A monitor will be required to make periodic reports to the prosecuting agency and through them to the supervising court. Th ese reports are typically an initial assessment report in the fi rst year of the monitorship and annual reports thereafter, perhaps following particular themes or specifi c jurisdictions, but various ad hoc reporting may also be requested in the intervening periods. Th e style and nature of these reports will vary with the nature of the monitorship but will often include a number of recommendations by the monitor.

Th e nature of any recommendations will vary with the specifi c DPA and with the professional style of the monitor himself. Where the monitor and the company have an eff ective relationship any disagreement over recommendations are likely to be confi ned to the time-scales for implementation or the sequencing between diff ering recommendations rather any substantive diff erence of view. But if a corporation does not adopt the recommendations of the monitor within the specifi ed time, the monitor will be expected to report that fact together with any explanations the company has provided. In practice, such recommendations come to be seen by the internal compliance personnel as supporting them in their own eff orts to persuade sceptical executives of the merits of an eff ective control environment in the company.

Prompt implementation of the monitor’s recommendations, not just a written acceptance of them, during the course of the monitorship will help to persuade him that the factors which led to the DPA are being satisfactorily addressed by the company. Signifi cant progress may even lead to the monitor’s advising the prosecutor that his appointment may appropriately be terminated early. Conversely, any hesitation in accepting the recommendations or delay in actively implementing them will make the monitor consider carefully whether there is a requirement for his appointment to be extended – with all the consequent additional costs.

Concluding the monitorship Finally, the monitorship comes to an end with a determination by the monitor and the prosecutor that

6 Issue 221 • March 2015

the company has satisfactorily completed the terms of the agreement. It will have been a long-term engagement of at least three years, and possibly more than fi ve. Hopefully, the presence of the monitor comes to be seen by the company as an opportunity for it to re-set ‘normal’. Where a company had inadequately resourced its audit or compliance functions, had been reluctant to implement an eff ective committee structure or had tolerated a mismatch between income generation and risk control then a monitor can actually represent a tipping point. Over time, a monitor can push a company into a more responsible long-term state. It will likely not have been easy. It certainly will not have been an inexpensive exercise. But if a company truly understands what it is getting in to at the outset, works with a monitor rather than against him and sees the engagement as an opportunity it can be a genuinely positive experience.

Notes 1. ‘He’s watching for a sign’ is taken from ‘Th e Sentinel’: Judas

Priest, 1984 2. Crown Prosecution Service & Serious Fraud Offi ce

‘Deferred Prosecution Agreements Code of Practice: Crime and Courts Act 2013’, February 2014.

3. Goel, A., Th ompson, M. & Sandford, K. ‘Comparing Deferred Prosecution Agreements in the UK and US’

Corporate Counsel Weekly Newsletter, 29 CCW 20, 14 May 2014

4. Ford, C and Hess, D “Can Corporate Monitorships Improve Corporate Compliance?” Th e Journal of Corporation Law Vol. 34:3 (679) 2008-2009

5. Crown Prosecution Service & Serious Fraud Offi ce, supra (para. 7.15)

6. Memorandum from Craig S. Morford, Acting Deputy Attorney General to Heads of Department and US Attorneys (March, 2008) (commonly called the ‘Morford Memorandum’).

7. Crown Prosecution Service & Serious Fraud Offi ce, supra (para. 7.14)

8. Crown Prosecution Service & Serious Fraud Offi ce, supra (para. 7.13)

9. U.S. v Apple Inc et al, U.S. District Court, Southern District of New York 12-2826

■ Nigel Coles (+44 (0)20 7029 5056, ncoles@exiger.com ) is a Managing Director with Exiger Ltd, a global regulatory and fi nancial crime, risk and compliance fi rm that advises on and conducts corporate compliance monitorships. Exiger was formed by Michael Cherkasky - the monitor appointed under the Deferred Prosecution Agreement of December 2012 between the US Department of Justice and HSBC (Holdings) PLC.

News HSBC private bank helped clients evade tax, others faced serious criminal allegations, leaked fi les show HSBC assisted customers of its private bank in Switzerland to evade millions of dollars in taxes due in their home jurisdictions according to leaked documents covering the period 2005–2007. Th e records reveal how individuals accused of drug traffi cking, corruption and money laundering were also clients of the bank.

Files on some 30,000 accounts, stolen by Hervé Falciani, an IT expert at the Swiss bank, have been passed to various media outlets, including Th e Guardian newspaper [1], Le Monde, BBC Panorama and the International Consortium of Investigative Journalists (ICIJ). Th e cache, a unique window on the operations of a Swiss private bank, includes numerous memos on some questionable clients.

One note reports how the bank opened an account for Emmanuel Shallop, who was later sentenced to six years in jail by an Antwerp court for importing Angolan confl ict diamonds.

Rami Makhlouf, a cousin of President Bashar al-Assad, held at least $15m in multiple accounts at the bank in 2006, the Guardian reports. Makhlouf, who controls Syria’s largest phone company, was added to the US

Specially Designated Nationals (SDNs) list in 2008 for “benefi ting from Syrian corruption” but the leaked fi les give no indication that HSBC’s Swiss bank previously treated him as a high-risk customer: Swiss banking rules have required enhanced due diligence on politically exposed persons (PEPs) since 1998.

During 2006–7, the bank reportedly operated 19 accounts for Arturo del Tiempo Marqués, a Spanish property developer who is currently serving seven years in prison after a shipment of construction materials, in 2010, was found to contain more than a tonne of cocaine. Marqués would make large cash withdrawals

New York: 600 Third Avenue, 10th Floor, New York, NY 10016

+1 212 833 3411

www.exiger.com

London: Nexus Place, 4th Floor, 25 Farringdon Street, London, EC4A 4AB

+44 (0) 207 029 5121