Over the past several years, there have been many attempts to garner greater transparency of the government’s use of nonprosecution agreements and monitorships. On three occasions the party attempting to obtain a ruling that would reign in the government’s authority over these matters has won at the district court level. In each of these instances, however, the court of appeals reversed. Continue reading
Author Archives: Michelle Louise Austin
Repeat Corporate Misconduct
But for other more salacious political concerns, the biggest story of the last couple weeks likely would have been Mark Zuckerberg’s testimony before Congress. Zuckerberg spent two days answering hundreds of questions from lawmakers.[1] Much of the questioning was concerned with Facebook’s protection, or alleged lack thereof, of its users’ privacy. The testimony, however, once again raises questions about how companies that engage in repeated instances of misconduct should be sanctioned. Continue reading
The Evolving First Line of Defense
by Michael Held
Keynote Address
Good morning. It’s an honor to join you at the 1LoD Summit. The views I express today are my own, not necessarily those of the Federal Reserve Bank of New York or the Federal Reserve System.[1]
I’ve heard it said that being in the risk control business can be, and often is, a thankless task. We get all the blame when something goes wrong, and none of the glory when things go right. So, I want to start my remarks with a word of gratitude to you, my fellow travelers in the world of risk controls. Thank you—not just for the invitation to speak today, but also for the work you perform each day at your firms.
The growing sophistication and stature of the first line of defense is, in my view, an unqualified improvement in corporate governance—especially at financial firms. Let’s begin with what you are defending. Continue reading
The Rule of Law and the Responsible Corporate Officer Doctrine after Quality Egg
by Jason Driscoll
This post is the second part of a two-part post by the author.
Introduction
In my previous post (DeCoster v. United States: Testing the Limits of the Responsible Corporate Officer Doctrine), I discussed how the Food and Drug Administration (“FDA”) and the Department of Justice (“DOJ”) have revived the Responsible Corporate Officer (“RCO”) doctrine in an attempt to increase compliance with the Federal Food, Drug, and Cosmetic Act (“FDCA”). In light of the incarcerative sentences in the Quality Egg case, I addressed the DOJ’s new strategy of seeking enhanced sanctions in RCO cases. In United States v. Quality Egg, LLC,[1] the government brought FDCA Section 333(a)(1) misdemeanor food adulteration cases against two corporate officers—Jack and Peter DeCoster—ultimately securing three-month prison sentences premised largely on the RCO doctrine.[2] On appeal, the DeCosters argued that the incarcerative sentences violated due process absent evidence of mens rea or actus reus.[3] The Eighth Circuit affirmed the sentences, however, holding that a three-month strict liability prison sentence was “relatively light” doing “no grave damage” to an offender’s reputation.[4] A petition for a writ of certiorari followed, inviting the Supreme Court to review the doctrine for the first time since 1975, but was denied. Continue reading
FinCEN Releases Frequently Asked Questions Regarding Customer Due Diligence and Beneficial Ownership Requirements
by David S. Cohen, Franca Harris Gutierrez, Sharon Cohen Levin, Jeremy Dresner and Michael Romais
Last week the Financial Crimes Enforcement Network (FinCEN) issued much-anticipated Frequently Asked Questions (PDF: 387 KB) (FAQs) that provide additional guidance to financial institutions relating to the implementation of the new Customer Due Diligence Rule (CDD Rule), set to go into effect on May 11, 2018.[1] In general, the FAQs clarify certain issues that have caused implementation challenges for financial institutions. While FinCEN’s earlier guidance provided a general overview of the CDD Rule—including the purpose of the rule, the institutions to which it is applicable, and some relevant definitions—the new FAQs provide greater detail for financial institutions seeking to comply with the CDD Rule. The FAQs are meant to assist covered financial institutions in understanding the scope of their customer due diligence (CDD) obligations, as well as the rule’s impact on their broader anti-money laundering (AML) compliance. While the guidance is helpful in clarifying some of FinCEN’s expectations, the implementation challenge lies in applying the CDD Rule to a financial institution’s specific products and services.
As financial institutions work to meet the CDD Rule’s fast-approaching May 11 compliance deadline, they should pay special attention to the following key areas summarized below. Continue reading
Hacking Global Reputations
by Pat Akey, Stefan Lewellen, and Inessa Liskovich
Corporations have reputations, just like individuals. However, the costs of protecting a corporate reputation, or the costs of losing one, are not well understood. Negative reputation shocks can be costly, and recent scandals at well-known firms such as News Corp. and Volkswagen have reaffirmed the fragility of corporate reputations. However, corporations can also invest in technologies such as corporate social responsibility (CSR) to build their reputations or to provide insurance against a future reputation shock. In a recent paper, we find that negative reputation shocks are at least partially insurable through CSR and that firms actively invest in CSR as the result of a negative reputation shock. Continue reading
Retaliation on the Rise; How Should Companies Respond?
Summary
Avoiding retaliation for reported workplace misconduct is essential for companies and enforcement officials. Companies are accountable not just for their bad acts, but also for the cover up, including how they respond to allegations. A new survey of conduct in the US workplace by the Ethics and Compliance Initiative (ECI)[1] has some bad news. Employees say that retaliation against whistleblowers is on the rise, doubling in the past four years. These disturbing results should motivate companies to (1) encourage candid internal discussions of what exactly constitutes retaliation (and what does not); (2) train managers to handle retaliation concerns and to avoid unintended acts of retaliation; and (3) ensure anti-retaliation programs are supported by a strong ethical culture.
The ECI Survey
Since 2000, ECI, a leading ethics and research organization for compliance professionals, has surveyed workplace conduct from the employees’ perspective. Their 2017 survey of more than 5,000 employees across the US has good and bad news. Continue reading
Maximizing Value and Avoiding Pitfalls when Purchasing Cyber Insurance
by Ian Boczko, Marshall L. Miller, and Timothy C. Sprague
In recent years, companies have heightened their focus on cybersecurity issues, dedicating substantially more resources to mitigating escalating cyber risks. Increasingly, these efforts include purchasing some form of cyber insurance.
Any cyber insurance policy should supplement, rather than replace, a cybersecurity risk mitigation program. While such a policy may be a useful element of a multifaceted strategy, cyber insurance is far from a panacea. First, the size and types of damages resulting from a catastrophic cyber incursion can exceed even significant policy limits. Additionally, cyber insurance coverage is unlikely to extend to reputational losses or intellectual property theft. Moreover, the cyber insurance market is relatively young and policy forms are still evolving. Thus, cyber insurance does not have the same claims history or established understanding of policy terms that can be found in more mature insurance markets. Continue reading
Cyberspace is the New Battlespace
[Following personal reflections on his return to private life from public service, former U.S. Secretary of Homeland Security Jeh Charles Johnson delivered the following keynote address at the Global Cyber Threats: Corporate and Governmental Challenges to Protecting Private Data cybersecurity conference held by the Program on Corporate Compliance and Enforcement at New York University School of Law on April 6, 2018.]
Like millions of other Americans, my world was rocked by the terrorist attack that occurred a few blocks from here on September 11, 2001. Like many of you, I am a New Yorker, and was in Manhattan that day. September 11 also happens to be my birthday. I have a vivid recollection of the day, both before and after 8:46 a.m., when the first plane hit the World Trade Center. At 9:59 a.m., when the first tower collapsed, it was perhaps the only time in my life when my mind could not believe what my eyes were seeing. Neither would I have been able to comprehend then that 15 years later, there would be something called the Department of Homeland Security, that I would lead it, and that the Secretary’s New York office would occupy the 50th floor of a taller, stronger World Trade Center tower standing in the same place. Continue reading
Singapore Introduces Deferred Prosecution Agreements
by Zachary S. Brez, Brigham Q. Cannon, Mark Filip, Asheesh Goel, Cori A. Lable, Kim B. Nemirow, Abdus Samad Pardesi, Richard Sharpe, William J. Stuckwisch, Marcus Thompson, Satnam Tumani, and Jodi Wu
On 19 March 2018, Singapore passed legislation introducing the concept of the deferred prosecution agreement (“DPA”) to the jurisdiction for the first time. Under the new laws, corporations (but not individuals) facing prosecution for offences of corruption, money laundering or receipt of stolen property may attempt to negotiate the terms of a DPA with prosecuting authorities, under which they would avoid prosecution, in return for adherence to various conditions imposed upon them, for a set period of time.
By introducing the DPA as an enforcement tool, Singapore joins the ranks of the United States[1], Brazil[2], the United Kingdom[3] and France,[4] which form the vanguard of an increasingly consistent global approach to corporate criminal resolutions. Australia and Canada are also both currently evaluating whether to introduce similar legislation. Continue reading