This article was contributed to Corporate Compliance Insights by Edward J. Krauland, David S. Lorello, and Michael M. Lieberman of Steptoe & Johnson LLP.
Aggressive Export Enforcement
Spurring More Internal Investigations
In recent years, the United States and its major trading partners have expanded export controls and economic sanctions restrictions in connection with transactions that have been deemed to threaten national security interests. These restrictions extend to the export of products that have potential military, nuclear-related, or other sensitive applications, as well as commercial dealings with certain countries, entities, and individuals that have been identified as supporters of terrorism, weapons proliferation and other restricted conduct.
Given the array of due diligence standards, complexity of supply chains, multiplicity of intermediaries and the relatively low standards of intent necessary to be accused of a violation, companies today face unprecedented challenges and risks in managing compliance with those regulations.
In the United States in particular, expansion in the scope of export controls and economic sanctions has been combined with an increase in enforcement from the responsible U.S. government agencies, with more frequent and larger penalties for companies that violate the relevant laws and regulations. Consequently, the frequency and scope of internal corporate reviews and government-initiated investigations in connection with export controls and economic sanctions restrictions is on the rise.
This article presents an overview of some of the particular issues and challenges that companies may face in conducting internal investigations in the area of export controls and economic sanctions compliance.
Enforcement is Getting Tougher While the Net is Growing Wider
In the past five years, over 350 companies have been penalized for violations of U.S. sanctions laws – which are administered by the U.S. Department of Treasury, Office of Foreign Assets Control (“OFAC”) – with fines reaching up to $40 million dollars. In 2009 penalties have already totaled some $20 million. U.S. export controls enforcement – which is administered primarily by the Department of Commerce, Bureau of Industry and Security (“BIS”) under the Export Administration Regulations – has been similarly robust. In fiscal year 2008 agency investigations led to forty criminal convictions, with over $3.5 million in forfeitures and criminal fines, and fifty-six civil enforcement actions resulting in $3.6 million in administrative penalties.
Increasingly the U.S. government is also pursuing enforcement actions against foreign entities. Numerous non-U.S. entities have, for instance, been penalized in the last two years for conducting business transactions with Iran (a country subject to U.S. economic sanctions) – those penalties generally have arisen because the non-U.S. entity has involved U.S. companies indirectly in the transactions in question (such as, for example, by procuring parts from U.S. suppliers, or involving U.S. financial institutions in the transactions). The penalties against the non-U.S. entities in those cases have, in fact, been among the highest penalties on record (including a record $350 million fine in January 2009 against Lloyds TSB Bank plc arising from the company’s transactions with Iran-based entities).
Export Investigations: A Two-Level Game
Deciding to undertake a corporate investigation in response to emerging evidence of potential non-compliance with export controls or sanctions restrictions can be a difficult choice. Investigations can be time- and resource-consuming, yet are often very important to allow the company to understand the causes of compliance lapses, to define any remedial measures that may be warranted, and to manage discussions with enforcement agencies to the extent misconduct is disclosed to those agencies or otherwise comes to their attention.
Investigations in the export controls and sanctions field can be particularly complex insofar as the underlying issues often involve more than one government agency, multijurisdictional entities, globally located facilities, third-country nationals and numerous domestic and foreign laws that can be unclear in their content and application.
Upon initiating an investigation, counsel must account for a range of considerations. These can be broken into two sets of separate, interrelated concerns: A) substantive legal issues that determine the scope of liability and penalties; and B) procedural and logistical issues in conducting the investigation itself.
Legal Implications of Potential Misconduct
The first set of factors to be accounted for is the substantive legal issues raised by the potentially non-compliant conduct.
Counsel Must Consider the Full Range of Possible Violations.
At the outset, counsel must consider the full scope of potential legal or regulatory violations that may be raised by the conduct at issue. The intersection of anti-bribery, export controls and sanctions regimes, for example, presents a significant risk area for many companies. Consider a company that makes an improper payment to a foreign official in a sanctioned country to purchase a controlled product from a wholly-owned subsidiary of a U.S. parent. In that scenario, the company is faced with at least three separate legal regimes – the U.S. Foreign Corrupt Practices Act, the EAR, and the various country- and conduct-specific OFAC prohibitions (such as the Iranian Transactions Regulations or the WMD Proliferators Regulations), not to mention parallel laws abroad to the extent they are applicable.
While often there will be one primary regime of concern, the investigation may identify related violations—e.g. customs, anti-boycott, anti-money laundering, government procurement—that may come to light as additional facts and circumstances become known. On top of all this is the need also to consider the range of mitigating circumstances that might come into play—from a multijurisdictional perspective—and to explore facts that might allow a company to take advantage of them.
Assessing the Various Restrictions.
Even within a particular legal regime, the same conduct may implicate numerous prohibitions, which themselves raise additional legal questions. Since these initial theories will guide the collection of data and the investigation work plan, it is important to sketch out as much as possible the varying regulatory risks that a company may be facing. The company must consider not just the obvious modes of liability such as the unlicensed export of a controlled good, but also related activities also covered by the law.
For example, was the recipient or end-user a Specially-Designated National or do they appear on the Department of Commerce’s Entity List? Might conversations or bidding documents prepared for the order have revealed unlicensed technical data separately controlled for export? Do the parts have any application in the development of WMD, and if so were US persons involved? Were there red flags that the company should have noticed? What mis-statements may exist in commercial or shipping documents, which are themselves separate infractions? Have there been any record-keeping infractions? Are foreign customs laws implicated in the sense that an error on the export transaction and documentation might translate into an infraction of the importing country’s customs laws?
Even when the risks have been identified, counting the number of potential “violations” – and, therefore, the potential quantum of a penalty – can be challenging. For example, where a US component is incorporated into an item that is fabricated and shipped overseas, does US jurisdiction still attach, or is the content excluded from US controls (for example, because it qualifies for “de minimis” treatment under the EAR)? What if the product is reexported, or transshipped to another destination? In such circumstances, counsel must often understand complex supply chains, inventory practices and manufacturing procedures before even beginning to marry the facts to what are often broadly-worded regulatory requirements.
Managing Export Investigations: Some Key Logistical and Procedural Matters
The second set of issues to consider are the procedural and logistical issues that the investigation will entail.
Top-level Support and Clear Reporting Channels are Essential.
While central to any internal review, analysis of the substantive law issues at play will usually take relatively little time compared to the responsibilities of managing an investigation. At the outset it is vital that counsel work to ensure top-level corporate support by clearly conveying the risks involved. Such support is vital to ensure that procedures are instituted to prevent ongoing violations from occurring and also to allow those conducting the investigation to have full access to the required information and company personnel. One key question for outside counsel is to clearly identify the “client.” For example, is it the general counsel, the company board or the audit committee? Resolving these questions quickly is important to preserve confidentiality and attorney-client privilege and avoid competing directives.
Establish Document Preservation, Identification and Management Protocols.
Export investigations under any legal regime are likely to be document intensive. Identifying and preserving electronic and paper records is thus an essential early activity. One must consider not only obvious sources such as shipping records and purchase orders, company servers and local hard drives, but also (depending upon the nature of the investigation) electronic files such as email accounts, purchasing and logistics data sets, and shared file servers. One must ensure that documents (both electronic and hard copy) that may be relevant to an investigation are preserved and accessible to the investigation team. Establishing a system to gather, store and review this information is the next step, and depending on the magnitude of the investigation, can often be assisted by a third-party vendor (normally under the supervision of the legal counsel managing the investigation).
Counsel Must Take Steps to Preserve Attorney-Client Privilege.
The importance of protecting attorney-client privilege is especially important in internal investigations, where inadvertent breaches can compromise the company’s right to confidentiality vis-à-vis third parties, such as government officials or litigants looking to file derivative civil suits. Maintaining the privilege presents unique challenges when operating abroad, where equivalents to the U.S. attorney-client privilege and work product doctrine may be of a different – and in some cases narrower – scope. For example, in some jurisdictions in Europe the confidentiality protections afforded to communications between a company and its in-house counsel can be quite narrow.
Data Privacy and Employment Laws May Pose a Major Hurdle.
The issue of data privacy is emerging more frequently as investigations increasingly cross national boundaries. This is true globally, but especially in Europe, where many U.S. export controls and economic sanctions investigations lead. The EU Data Protection Directive (95/46/EC) regulates the access, control and transfer of “personal data,” which is broadly defined. Each state implements the Directive for itself, resulting in different nuances in each EU Member State. Managing those restrictions can present challenges in conducting witness interviews, looking at personnel files and accessing employee email accounts, which of course can very often contain personal information in addition to work correspondence.
European employment laws also can present challenges in performing these investigatory tasks, and (in some cases) taking remedial action for employees suspected of misconduct. For example, in some countries employee works councils have substantial rights to consultation and, for certain company activities, approval requirements. It is important to have a clear understanding of the interplay between the export controls / sanctions laws and these local regulatory regimes before initiating an internal investigation.
Counsel Must Obtain a Thorough Understanding of Business Operations.
In an export investigation, a comprehensive understanding of business operations is essential. Reviewing shipping records and purchase orders is necessary, but not sufficient to assess the full scope of potential liability. Counsel must obtain a clear picture of the company’s corporate structure, its business units, its manufacturing and R&D process (particularly in cases where technical data export controls breaches are at issue) and its corporate reporting chains. In economic sanctions investigations, it usually is important to have a clear understanding of the roles of any U.S. citizens and lawful permanent residents of the company in overseas operations, which may involve consultation with human resources as well as operations management personnel.
Of utmost importance, of course, in most export controls investigations is understanding intra- and inter-company supply chains, third party suppliers, inventory procedures, manufacturing techniques and other logistical issues bearing on possible regulatory violations. Such knowledge is necessary to collect the proper documentation for each type of potential violation. Evidence of a brokering violation, for instance, may lie in the marketing and shipping departments; evidence of the improper transfer of technical data may be in a field services unit or engineering department; and evidence of an unlicensed shipment of physical items may depend on inventory and manufacturing records. Counsel must follow the lead of the operative legal theories, trace their implications and follow the evidence pursuant to a clear understanding of how the business actually works, often to minute levels of detail.
Conclusion
In a complex multinational business environment regulated by multiple, complicated regulatory regimes, even the most scrupulous companies may confront issues of compliance. When this occurs, whether it is under the eye of the government or a purely internal review, conducting an internal investigation will often be necessary to mitigate penalties and reduce future risk. To do so effectively, companies and their counsel must think broadly and delve deeply into the entire array of legal and operational issues at play.
**********
About the Authors
Edward J. Krauland is a Partner at Steptoe & Johnson LLP in Washington, DC where he leads the firm’s International Regulation & Compliance practice group. David S. Lorello is an associate in the firm’s London office and Michael M. Lieberman is an associate in the firm’s Washington, DC office.
PDF 
