Production of Information to the Authorities

The SFO’s Corporate Co-operation Guidance continues to confirm that co-operating organisations should supply relevant material held abroad, where it is in the possession or control of the organisation. A company in receipt of a formal production notice will need to assess whether the notice extends to documents outside the jurisdiction and, if so, the extent to which the company has ‘custody or control’ over documents held by subsidiaries or overseas branches. The board of a parent company will not necessarily control the management of a subsidiary.

The Corporate Co-operation Guidance also confirms that the SFO will expect co-operating organisations to identify relevant material in the possession of third parties and assist in obtaining it. Companies should also inform the SFO about relevant material that the company is unable to access (such as messaging apps and bank accounts).

Where production is voluntary, a company may take a more holistic view of the investigation and production (subject to local law restrictions). The extent to which it may want to voluntarily disclose information may depend on the ability of the investigating authority to obtain that information itself. However, given the increasing co-operation between authorities on the international stage, careful voluntary production of material is likely to be preferable, and vital if the company seeks co-operation credit. To receive credit for full co-operation under the FCPA Corporate Enforcement Policy, a company cannot simply refuse to produce certain documents on the basis that production is prohibited by rule or regulation. Rather, the company ‘bears the burden of establishing the prohibition’ and ‘should work diligently to identify all available legal bases to provide such documents’.

17.2.3.2 Mutual legal assistance

Mechanisms for legal assistance (UK)

In the United Kingdom, sections 7 to 9 of the Crime (International Co-operation) Act 2003 (CICA) govern requests to obtain evidence from abroad in relation to an investigation or prosecution taking place in the United Kingdom, shaping the MLA powers of UK authorities. Under CICA, an MLA request can only be made if it appears to the investigating authority that an offence has been committed or there are reasonable grounds for suspecting that one has, and proceedings have been instituted or the offence is being investigated. The request must relate to the obtaining of evidence ‘for use in the proceedings or investigation’. But it could allow an investigating agency to have foreign law enforcement officers launch raids, arrest suspects or conduct interviews on its behalf. If the implementation of an MLA request in the requested state requires a court order, the court in the requested state is likely to apply the relevant principles in its own jurisdiction to satisfy itself that the order is justified.

Following the United Kingdom’s exit from the European Union in January 2020, it lost access to the European Investigation Order process and must instead rely on the European Convention on Mutual Assistance in Criminal Matters of 1959, plus two additional protocols. The UK government signed the EU–UK Trade and Cooperation Agreement (TCA) in December 2020, which includes further MLA provisions and information regarding how MLA should work with EU countries. Although some EU Member States have confirmed that the provisions of the TCA are directly applicable, others have indicated that they need to adopt additional legislation that would complement the procedure at the national level.

In the United Kingdom, the Crime (Overseas Production Orders) Act 2019 deals with cross-border access to electronic evidence. This legislation empowers UK authorities (including the SFO and FCA) to apply to a UK court to compel a company operating, or an individual based, outside the United Kingdom to provide electronic data stored abroad. This law allows UK authorities to sidestep the notoriously slow process of seeking MLA in favour of obtaining an overseas production order (OPO), which can be served directly on the person storing the electronic data. For an OPO to be issued, a bilateral agreement must be in place between the requesting country and the country where the service provider holding the data is based. At the moment, there is only one such agreement in place, with the United States (the Data Sharing Agreement). This has, in principle, brought the United Kingdom into alignment with the US regime. In 2018, the US federal government passed the Clarifying Lawful Overseas Use of Data (CLOUD) Act, explicitly authorising US law enforcement agencies to obtain data held by US cloud service providers regardless of where in the world the data is physically stored. The CLOUD Act also created a framework by which foreign countries could seek disclosure of data held by US cloud service providers, without US co-operation or oversight.

The MLA process can be cumbersome, but it presents a very real threat if a company does not co-operate. A company should also not overlook the significant scope for informal direct investigator-to-investigator co-operation. Agencies such as Interpol have dedicated programmes to share information between, and support investigations by, investigating agencies in different countries. Communications between the SFO and the DOJ are frequent. The FCA, specifically, has a broad discretion to assist foreign regulators. This discretion is set out in section 169 of FSMA. The statutory power is supplemented by FCA policy. Subsection 169(4) sets out the considerations in the FCA’s decision as to whether to assist a foreign regulator. It provides:

4. In deciding whether or not to exercise its investigative power, the regulator may take into account in particular:
   1. whether in the country or territory of the overseas regulator concerned, corresponding assistance would be given to a United Kingdom regulatory authority;
   2. whether the case concerns the breach of a law, or other requirement, which has no close parallel in the United Kingdom or involves the assertion of a jurisdiction not recognised by the United Kingdom;
   3. the seriousness of the case and its importance to persons in the United Kingdom;
   4. whether it is otherwise appropriate in the public interest to give the assistance sought.

In an early decision on the application of this section, Financial Services Authority v. Amro International, the Court of Appeal held that there was nothing in section 169 that required the FCA’s predecessor body – the Financial Services Authority (FSA) – to satisfy itself of the correctness of what it was being asked to investigate or gather by way of information. At the SEC’s behest, the FSA could seek any document that it reasonably considered relevant to the investigation the SEC was conducting. The Court of Appeal made clear that the only requirements the FSA must meet were contained in the statute. The Court of Appeal also noted that in exercising these powers, the stricter rules attaching to the drafting of a subpoena did not apply and the description of the documents sought would be acceptable provided the recipient could identify the documents he or she was required to produce.

In addition to the FCA’s statutory powers, a number of memoranda of understanding (MOUs) are in place between UK regulators and their overseas counterparts (most notably the SEC and other US regulators) concerning co-operation and information sharing. Recent years have seen significant co-operation between the SEC and the FCA and its cognate agencies.

Similarly, the United States has entered into mutual legal assistance treaties (MLATs) with more than 70 foreign jurisdictions, which can be used for the sharing of information and taking of evidence abroad. Some US authorities also have MOUs in place with sister agencies outside the United States, which can allow for inter-agency sharing of documents.

Following the United Kingdom’s exit from the European Union, the SFO has lost access to some European intelligence-sharing programmes such as Europol and Eurojust. International agencies have, however, continued to collaborate with the SFO to find workable solutions due to the shared benefit of co-operation and intelligence-sharing. The TCA further expressly provides for joint investigation teams (JITs) between UK and EU Member State investi­gating authorities. The TCA is largely silent on the detail, except to stipulate that where a JIT involving more than one Member State is set up, the relationship between them will be governed by European law, regardless of the law stipulated in the JIT agreement. JITs have historically proved to be an invaluable tool in cross-border general criminal and money laundering investigations, with the Airbus JIT demonstrating their utility in financial and white-collar crime investigations. In this case, the JIT structure permitted the SFO to navigate the French blocking statute, including attending interviews and taking investigative steps in France. JITs do, however, require agencies to compromise their interests in favour of the overall interests and goals of the JIT; therefore, shifting relations between agencies will determine their effectiveness in the future.

Mechanisms for legal assistance (US)

In the United States, prosecutors also have access to MOUs and MLATs to facilitate the discovery of evidence overseas, as do foreign prosecutors looking to obtain evidence in the United States. The process triggered on receipt of a foreign MLAT request is codified in the Foreign Evidence Efficiency Act. The decision whether to grant a request is at the federal district courts’ discretion. US and foreign prosecutors and investigators may also use financial intelligence units to collect information about potential crimes. In the United States, the Financial Crimes Enforcement Network of the US Treasury (FinCEN) is a member of the Egmont Group, a network of financial intelligence units to share information and improve support among member governments in the fight against financial crimes. In the absence of a relevant MOU or MLAT, or recourse to FinCEN, federal courts may issue letters rogatory to foreign courts at the request of a litigant. Letters rogatory may only be used in ongoing legal proceedings, however, and are of limited value during an investigation or internal agency proceeding.

The DOJ’s authority with respect to cross-border investigations was recently expanded with the passage of the Anti-Money Laundering Act of 2020, or Corporate Transparency Act, in January 2021. Specifically, under the Act, the ‘Secretary of the Treasury or the Attorney General may issue a subpoena to any foreign bank that maintains a correspondent account in the United States and request any records relating to the correspondent account at that foreign bank, including records maintained outside the United States’ that are subject to an investigation or civil forfeiture action. Therefore, federal prosecutors can obtain a significant amount of financial information from foreign banks without needing to use a cumbersome MLAT process.

The DOJ has also adopted a ‘no piling on’ policy regarding penalties. This policy explicitly includes co-operation with foreign agencies. Former Deputy Attorney General Rod Rosenstein explained in remarks in May 2018 that the policy discourages ‘disproportionate enforcement of laws by multiple authorities’ by ‘instructing Department components to appropriately coordinate with one another and with other enforcement agencies in imposing multiple penalties on a company in relation to investigations of the same misconduct’. This policy was applied in the Airbus and Glencore resolutions where the DOJ credited part of the fine against payments made or due to other national authorities. Finally, there are mutual legal assistance tools authorised by international or multinational treaties that are particularly relevant in cross-border investigations and that would apply to investigations by both UK and US regulators or law enforcement. The UN Convention Against Corruption covers fraud, money laundering, bribery, embezzlement and other crimes. Article 46, addressing mutual legal assistance, provides that ‘State Parties shall afford one another the widest measure of mutual legal assistance in investigations, prosecutions and judicial proceedings in relation to the offences covered by this Convention’. Such assistance may include taking of evidence; effecting service of judicial documents; executing searches, seizures, and freezing; examining objects and sites; providing evidence and expert evaluations; providing relevant documents and records, ‘including government, bank, financial, corporate or business records’; ‘[i]dentifying or tracing proceeds of crime, property, instrumentalities or other things for evidentiary purpose’; facilitating voluntary appearance of persons; ‘[a]ny other type of assistance that is not contrary to the domestic laws of the requested State Party’; identifying, freezing, and tracing proceeds of crime; and recovery of assets. Importantly, the Convention does not permit a state to ‘decline to render mutual legal assistance pursuant to this article on the ground of bank secrecy’.

17.2.3.3 Data protection

Responding to an investigation (and conducting an internal investigation) requires processing data about individuals. This engages a number of data protection considerations. A company cannot assume that complying with the data protection requirements in the investigated jurisdiction will mean compliance with overseas data protection laws. Local law may also restrict a company’s ability to transfer data relating to individuals overseas. The European Union’s General Data Protection Regulation (EU GDPR) applies within the European Union and to those data controllers and processors outside the European Union who offer goods and services to EU consumers. In the United Kingdom, data processing is covered by the General Data Protection Regulation (UK GDPR) (which effectively retains the EU GDPR in UK law), and the UK Data Protection Act 2018 (DPA 2018). Sanctions for breaches under the GDPR are the higher of £17.5 million or €20 million or up to 4 per cent of annual worldwide turnover, meaning that data privacy in relation to individuals needs to be afforded a high degree of consideration in internal investigations.

The UK GDPR and the EU GDPR are extraterritorial in their effect – they catch overseas companies without a presence in the United Kingdom or European Union that actively offer goods and services to, or monitor the behaviour of, individuals within the United Kingdom or European Union, even if the data is stored overseas. Multinational organisations subject to cross-border investigations may therefore need to comply with both the EU GDPR and the UK GDPR in cross-border investigations.

In the United States, the Federal Trade Commission (FTC), under Section 5 of the Federal Trade Commission Act, prohibits ‘unfair or deceptive acts or practices in or affecting commerce’. The FTC further requires companies to be transparent about personal information they collect and how it is used, shared and maintained – for both online and offline data practices. The FTC has also used its ‘unfairness’ authority under Section 5 against companies whose information security practices were alleged to have caused ‘substantial injury to individual consumers’, including initiation of enforcement actions based on alleged failures to take ‘reasonable’ steps to protect consumer data. In addition, state attorneys general exercise consumer protection authority under state laws that protect personal privacy, including personal information. The SEC’s Regulation S-P has similar protections, requiring registered broker-dealers, investment companies and investment advisers to ‘adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information’.

17.2.3.4 Blocking statutes

Blocking statutes prevent the disclosure of certain documents for the purpose of legal proceedings in a foreign jurisdiction, except pursuant to procedures set out in an international treaty or agreement. Articles 1 and 1bis of the French Blocking Statute provide:

Subject to international treaties or agreements, it is forbidden for any French national or for individuals usually residing in France and for any director, representative, agent or employee of a legal person having its head-offices or establishment in France to communicate by writing, orally or in any other form, in any place whatsoever, to foreign public authorities, documents or information of an economic, commercial, industrial, financial or technical nature, the communication of which is likely to undermine the sovereignty, security, essential economic interests of France or its public order . . . . [I]t is prohibited for any person to request, to investigate or to communicate in writing, orally or by any other means, documents or information relating to economic, commercial, industrial, financial or technical matters leading to the establishment of proof with a view to foreign administrative or judicial proceedings or as a part of such proceedings.

There has historically been very little enforcement of the French Blocking Statute – with some companies choosing to ignore it completely. However, as a consequence of the Sapin II law, which was implemented in June 2017, France’s financial crime agency (Parquet National Financier (PNF)) has begun to lead cases involving the enforcement of the Blocking Statute, signalling that the French authorities are considering the issues raised by the Blocking Statute in more depth. Counsel advising on cases where foreign authorities are involved must be particularly sensitive to this question and handle any productions abroad accordingly.

The French anti-corruption regulator (Agence Française Anticorruption (AFA)) is responsible for ensuring compliance with the Blocking Statute in cases where a French company has to execute a foreign authority decision concerning the strengthening of its corruption prevention or detection policies.

The joint guidelines on the French equivalent of the DPA (convention judiciaire d’intérêt public (CJIP)) issued by the PNF and AFA in 2019 indicate the French authorities’ willingness to enter into coordinated settlement discussions with foreign enforcement authorities in cases involving multi-jurisdictional misconduct. The guidelines do not set out any differences in complying with the Blocking Statute when co-operating with foreign enforcement authorities. Therefore, adherence to the Blocking Statute is expected. However, the guidelines suggest that when the PNF negotiates a joint settlement with other authorities, it may propose that the AFA act as a monitor to prevent a violation.

The French authorities have traditionally taken any derogation from the letter of the law seriously and insist on the use of MLA requests and inter-agency communications. This can leave companies in the unenviable position of being caught between authorities (if the US authorities, for example, expect production directly from the corporate). In such circumstances, agency-to-agency communications should be encouraged. Similarly, Article 271 of the Swiss Criminal Code prohibits a person performing an ‘official act’ on behalf of a foreign authority on Swiss soil. This can block the collection of evidence located in Switzerland intended for use in proceedings outside the country.

China is another jurisdiction to have enacted laws to block the transfer of information to foreign government authorities in criminal proceedings. In October 2018, China enacted the International Criminal Judicial Assistance (ICJA) law, prohibiting institutions, organisations and individuals within China from providing evidentiary materials and assistance to foreign countries in criminal proceedings (e.g., before seeking to comply with a subpoena from a foreign government authority in a criminal investigation) without approval from the competent Chinese authorities. In accordance with the ICJA law, this legislation is to be applied in a manner that does not harm national sovereignty, security or public interests, giving the Chinese government broad discretion to refuse or block foreign governments’ requests for assistance. The ICJA law governs all requests for ‘judicial assistance’ between China and foreign jurisdictions in relation to international criminal proceedings, including the service of documents, evidence collection, witness testimony, seizure and confiscation of illegal assets, and the transfer of convicted persons.

A decision to refuse to disclose documents or information due to a blocking statute may not be respected by the requesting authority and could affect any co-operation credit available – leaving the company between a rock and a hard place. This demands early and detailed dialogue with the relevant authority alongside expert local counsel who can educate the regulators about the relevant laws and any potential workarounds for production of information.

17.2.3.5 Banking secrecy

Bank secrecy laws prohibit banking officials from releasing confidential information about a customer to third parties outside of financial institutions, unless compelled by law. Sometimes, such a disclosure is criminalised. A bank under investigation may seek to rely on this secrecy. It should also be cautious not to infringe this secrecy inadvertently in providing information to a regulator. Note, though, that a historical deference to the banking secrecy rules of foreign jurisdictions, premised on comity or respect for the acts of foreign governments, may slowly be eroding. Even Switzerland, in recent times, has stripped away a number of its many layers of secrecy through international agreements, and, in our experience, has become, in practice, more willing to co-operate with requests for information.

17.2.3.6 State secrets

Sending data outside a jurisdiction may be contrary to state secrecy laws. Some jurisdictions, such as China, have wide definitions of what amounts to a state secret. The Law of the People’s Republic of China on Guarding State Secrets, at Article 8, defines state secrets to include ‘secrets in national economic and social development’ and ‘secrets concerning science and technology’. Similarly, Kazakhstan treats some geological data as a state secret. The consequences of violation can be serious. Article 111 of the Chinese Criminal Law makes violating state secrets a capital crime. In countries such as China, where many companies are state-owned, this is not straightforward. Again, finding expert local counsel is a must.

State secrecy laws may also restrict certain categories of documents to authorised eyes only. In the United Kingdom and the United States, there is a common law doctrine designed to prevent the disclosure of sensitive state secrets or information of national security significance. The definition of ‘state secret’ is construed more narrowly than in countries such as China. The common law doctrine is invoked by the state or executive branch to ensure that state secrets are not intentionally or inadvertently disclosed. In the United Kingdom, the state secrets privilege is known as ‘public interest immunity’. This doctrine ‘may prevent the case from being heard if it is not possible to rely on other evidence; however, over the years it has been interpreted as leaving a more substantial role for courts in evaluating the grounds for the claim of privilege’. In criminal trials, public interest immunity ‘is governed by statute, which imposes duties of disclosure on the prosecution’, namely, the UK Criminal Procedure and Investigations Act of 1996 and the Criminal Justice Act of 2003, but in civil trials, public interest immunity is governed by the common law. This issue has impacted the investigation and prosecutions of companies in the defence industry such as BAE Systems and GPT Special Project Management Ltd.

In the United States, the state secrets doctrine ‘may prevent the disclosure of information in a judicial proceeding if ‘there is a reasonable danger’ that such disclosure ‘will expose military matters which, in the interest of national security, or [foreign affairs] should not be divulged’. Specifically, it is invoked through ‘formal claim of privilege, lodged by the head of the department which has control over the matter, after actual personal consideration by that officer’. In practice, the state secrets doctrine may bar an entire case or preclude the production of certain evidence.

As in the United Kingdom, this is particularly pertinent for defence companies. Withholding production of such documents will require careful negotiation. Finding a practical way for these to be produced by external lawyers (where prior authorisation is unlikely) will likely be more difficult and undoubtedly will increase the time it will take to respond to a request for documents and may require the review of documents ‘in country’ instead of producing the documents to the US authorities. Another potential work­around is production of information through MLATs and MOUs that allow a company to first produce documents to a local authority and thereby comply with the relevant regulations.

17.3 Documents obtained through dawn raids, arrest and search

During a raid (or execution of a search warrant) on corporate premises, it is important to obtain, and understand the terms of, the warrant. Check simple facts such as the premises’ address, the date and relevant powers and authorisations. If appropriate, a company may challenge the scope of the warrant (if it is unduly wide or based on erroneous facts or information). Importantly, the company and its advisers should ensure during the raid that documents outside the terms of the warrant are not seized (unless taken under relevant search-and-sift powers, or as can be justified under ancillary legislation) and take care both during and after the raid to protect legally privileged materials. In the United States, it is nearly impossible to challenge the scope of a warrant that calls for the immediate search of a specific location. More likely, a company would have to seek an order returning such property, or seek to suppress evidence obtained pursuant to a warrant in a later proceeding. There may, however, be opportunities to challenge the scope of a warrant seeking electronically stored information before the data is actually collected and produced. As an example, where a company is asked to execute a warrant on behalf of the government, such as when a service provider is asked to collect electronic information of a third party, there may be additional opportunities for a company to challenge the scope of a subpoena. It is likely that the vast majority of documents obtained during a search will be electronic. It is important to agree to a process with the authorities for dealing with any electronic media that is privileged. In the United Kingdom, most investigative agencies have developed sophisticated procedures in this area. The SFO’s policy and system for dealing with material covered by legal professional privilege (LPP) is explained in its Operational Handbook:

When the SFO requires the production of material, or seizes material pursuant to its statutory powers, all material which is potentially protected by LPP must be treated with great care to:

• Minimise the risk that LPP material is seen or seized by an SFO investigator or a lawyer involved in the investigation.
• Ensure that any LPP material which is seized is properly isolated and promptly returned to the owner without having been seen by an SFO investigator or a lawyer involved in the investigation.
• Ensure that any dispute relating to LPP is resolved in advance of the material being seen by an SFO investigator or a lawyer involved in the investigation.
• Ensure that where an SFO investigator or a lawyer involved in the investigation inadvertently sees LPP material, measures are in place to ensure that the investigation and any subsequent prosecution is not adversely affected as a result. Care must always be taken that LPP material is not viewed by the SFO staff involved in the investigation.

The Operational Handbook then sets out a procedure for dealing specifically with electronic material that may be privileged. Under this procedure, the SFO will first notify the company’s lawyers if it believes that IT assets it has seized might contain privileged material (in practice, it is prudent for the company’s lawyers to advise the SFO of the potential existence of privileged material at an early stage). A list of search terms should be agreed (including names of lawyers, relevant firms, etc.) to enable the identification and isolation of the material for review by independent counsel. Independent counsel will review the material using search software and return only non-privileged material to the SFO investigative team to examine. It is normally possible to have productive discussions with investigators to determine the relevant search terms that might identify privileged material. It is then possible to make representations on the client’s behalf to independent counsel about the extent of privilege. This procedure updates and works alongside the well-established ‘blue-bagging’ approach used for hard-copy materials that may be privileged, by which authorities will send seized documents that may be potentially privileged, sealed in an opaque bag, to the custody of an independent legal adviser (usually a barrister) for review.

The DOJ has used three different procedures for reviewing potentially privileged information, each of which requires a ‘neutral’ third party to first review potentially privileged data. In certain instances, the court may review the data on its own. A court may also appoint a ‘special master’ to handle the review of privileged information. In other instances, a ‘taint team’ may be used to review the files. When a taint team is used, an ethical wall will be placed between the individuals who review the documents and those who are actually participating in the investigation. Importantly, courts have had differing reactions to the use of taint teams and may not always conclude that the procedures implemented to screen materials were sufficient.

17.4 Informal disclosure requests: voluntary production and co-operation

17.4.1 Generally

A company may wish to consider voluntarily providing documents to an authority as part of a self-report or to demonstrate its co-operation with an investi­gation. Government investigators and investigating authorities regularly hold out the possibility of co-operation credit to companies to encourage them to provide information about their own misconduct.

From February 2014, DPAs have been available in the United Kingdom to the SFO and Crown Prosecution Service for disposing of corporate criminal conduct relating broadly to economic crime (including, in particular, fraud, corruption and money laundering). The SFO and the English courts have emphasised that one of the most important factors for a DPA is early reporting and co-operation by the company. Co-operation should be ‘genuinely proactive’. This includes the voluntary production of relevant documents, the importance of which has been demonstrated in a number of DPA cases, including SFO v. Rolls-Royce PLC, SFO v. Airbus, SFO v. G4S and SFO v. Amec Foster Wheeler. In the United Kingdom, the Director of the SFO, Lisa Osofsky, has explained that corporate co-operation means ‘making the path to a case easier’ for the prosecutor. This means that companies will be expected to provide the SFO with evidence it does not already have and guide the SFO’s investigation to help it focus on the most relevant lines of enquiry, including in respect of assistance with future prosecutions of individuals.

In August 2019, the SFO updated its Operational Handbook to provide guidance on corporate co-operation (Corporate Co-operation Guidance), confirming a non-exhaustive list of good practices that SFO officers should consider when assessing an organisation’s co-operation with the SFO, with a view to being invited to enter into DPA negotiations. The Corporate Co-operation Guidance sets forth detailed provisions on the SFO’s expectations regarding the preservation and provision of materials relating to digital and hard-copy evidence, financial records and analysis, industry and background information, dealing with individuals connected to the investigation, and more contentious issues such as witness accounts and waivers of privilege. The Corporate Co-operation Guidance confirms that ‘cooperation means providing assistance to the SFO that goes above and beyond what the law requires’ and that this includes identifying individuals involved in the misconduct. Timing is important, both for a potential DPA and in relation to anti-cartel regimes, which often provide an amnesty only to the first discloser.

Principle 11 is mainly intended as a supervision tool and sets out a broad duty of co-operation that the FCA often relies on to oblige the production of documents before formal investigations begin (sometimes, but not always, to decide whether an investigation should be commenced and in respect of which firms and individuals). The FCA’s view of what is meant by being open and co-operative within Principle 11 is set out in the FCA Handbook, in the ‘Supervision’ (SUP) section. SUP 2.3 provides that being ‘open and co-operative’ includes a regulated entity making itself readily available for meetings with the FCA, giving the FCA reasonable access to records, producing documents as requested, and answering questions truthfully, fully and promptly. Where a formal investigation has commenced, the FCA would not seek to rely on Principle 11 as a substitute for its other statutory powers that compel production. While it would be a clear breach of Principle 11 to fail to comply with a statutory request for the production of documents, a failure to comply with a voluntary request would not, of itself, result in disciplinary proceedings:

The FCA will not bring disciplinary proceedings against a person for failing to be open and co-operative with the FCA simply because, during an investigation, they choose not to attend or answer questions at a purely voluntary interview. However, there may be circumstances in which an adverse inference may be drawn from the reluctance of a person (whether or not they are a firm or individual) to participate in a voluntary interview. If a person provides the FCA with misleading or untrue information, the FCA may consider taking action against them.

The Enforcement Guide further provides that if a person does not comply with a requirement imposed by the exercise of statutory powers, he or she may be held in contempt of court. The FCA may also choose to bring proceedings for breach of Principle 11. Therefore, while there is no guidance indicating that a failure to produce documents voluntarily (as opposed to attending a voluntary interview) would result in an adverse inference being drawn, a decision by a company not to produce documents voluntarily in any particular case should not be made without careful forethought and proper advice on the potential consequences.

As this suggests, the Enforcement Guide recognises the importance of an open and co-operative relationship with the firms it regulates to the effective regulation of the UK financial system. When deciding whether to exercise its enforcement powers, the FCA considers, among a number of factors, the level of co-operation demonstrated by a firm. When weighing the level of co-operation, the FCA considers whether the firm has been open and communicative with it.

In the United States, too, the authorities have routinely emphasised that they will consider self-reporting and co-operation with government investigations as a key factor when determining whether to charge a corporation. The DOJ considers co-operation ‘a mitigating factor, by which a corporation – just like any other subject of a criminal investigation – can gain credit in a case that otherwise is appropriate for indictment and prosecution’. The DOJ’s Justice Manual (which governs the conduct of Assistant US Attorneys during the course of civil and criminal investigations, including Foreign Corrupt Practices Act (FCPA) investigations) therefore encourages corporations, typically through their compliance programmes, to conduct internal investigations and voluntarily self-report misconduct. Importantly, the Justice Manual states that prosecutors may also consider voluntary disclosure when determining whether to bring charges for criminal misconduct. However, ‘willingness to cooperate, including as to potential wrongdoing by its agents’ and ‘timely and voluntary disclosure of wrongdoing’ are just two of 11 illustrative factors that prosecutors should consider in determining whether to bring an action against the corporation.

Likewise, under the DOJ’s FCPA Corporate Enforcement Policy, which has been incorporated into the Justice Manual:

[W]hen a company has voluntarily self-disclosed misconduct in an FCPA matter, fully cooperated, and timely and appropriately remediated, all in accordance with the standards set forth below, there will be a presumption that the company will receive a declination absent aggravating circumstances involving the seriousness of the offense or the nature of the offender.

As publicly stated in the first year of the Biden administration, there is a heightened focus on FCPA and sanctions enforcement. The DOJ has made clear that, with such enforcement, it hopes to encourage companies to voluntarily disclose their misconduct. As Deputy Attorney General Lisa Monaco explained at a June 2022 conference:

[W]e aim for our sanctions enforcement to incentivize companies to come forward and voluntarily disclose discovered misconduct. As with the FCPA, the department – through the National Security Division I had the privilege to lead earlier in my career – has a self-disclosure program to address potential criminal sanctions violations. We drew on the model from the FCPA with this self-disclosure program and since the relevant NSD guidelines were revised in 2019, the number of voluntary self-disclosures is increasing.

Voluntary disclosure carries a risk that the authority may not give any meaningful credit and may nonetheless decide to prosecute or expand an investigation already under way. Therefore, the company should weigh the likelihood of the authority being able to serve a formal request for disclosure in the relevant jurisdiction.

In some instances, a formal notice for disclosure will be preferred: for example, where a company has obligations of confidentiality, preventing voluntary disclosure. The most common examples are lawyers and financial institutions, who could both face an action for breach of confidence for supplying documents or information without a formal regulatory request. In some self-reporting circumstances, it may be appropriate for a company to seek such a notice from the relevant authority to ensure that it does not open itself up to civil action. The notice should be narrowly drawn, in consultation with the regulator, and should not affect the company’s co-operation credit. Likewise, in some situations, the company may prefer to ask to be provided with a formal document request to demonstrate that it has been compelled to produce the documents to the authorities and has not done so voluntarily.

17.4.2 Disclosure of results of internal investigation

In most instances, a company will have to make expansive disclosures regarding its internal investigations to get full co-operation credit. The DOJ has issued guidance in the Justice Manual that explicitly states that companies will have to self-report both the results of internal investigations and individual misconduct to receive any co-operation credit. Whether such thorough disclosures are in the best interests of the company is something that will need to be determined in a timely manner.

17.4.3 Self-reporting of misconduct not yet known to regulators

A company’s decision as to whether to self-report is often complicated. There may be opportunities for a company to internally address misconduct without it coming to light. However, it can be very difficult for a company to keep its misdeeds from being disclosed to the relevant authorities. Whistleblower rewards provide incentives for employees to report misconduct. Federal statute provides protections for whistleblowers, and in 2017 the SEC imposed penalties on financial institutions attempting to prohibit employees from seeking those bounties. Disgruntled employees can report corporate misconduct as retaliation, to attempt to avoid prosecution themselves or simply because they do not feel that the corporate is handling the issue appropriately via its internal process. In the United Kingdom, broadly speaking, those working in the field of financial services are subject to suspicious activity reporting obligations. This means that banks, accountants and transactional lawyers must make reports to the authorities of suspicions of money laundering (including acquiring assets that may be tainted by fraud or corruption). A failure to make a report is a criminal offence – as is tipping off the subject of the report (which in some instances may be the individual’s own client). Investigative journalism and non-governmental organisations also continue to be important sources of information for regulators – as the ‘Panama Papers’ scandal illustrated.

The Deferred Prosecution Agreements Code of Practice (the DPA Code) issued by the SFO and the Crown Prosecution Service indicates that, to be eligible for a DPA, a company will likely have to report voluntarily any mis­conduct within a reasonable time of becoming aware of it – and prior to it becoming known to the authorities. In fact, in a number of the 12 DPA cases, the companies self-reported their misconduct to the SFO in circumstances where the SFO had no prior knowledge of the misconduct and, in all likelihood, would not have learnt about the misconduct if the company had not self-reported.

But, in the Rolls-Royce case, which was concluded by a DPA in January 2017, the company did not self-report to the SFO the conduct that led to the SFO’s investigation. Instead, the SFO became aware of the need for an investigation through internet postings by a whistleblower. That Rolls-Royce did not self-report weighed against the SFO offering a DPA; yet, Rolls-Royce chose to co-operate fully with the investigation after the SFO approached the company, and undertook its own internal investigation (in close consultation with the SFO). In total, Rolls-Royce collected over 30 million documents and subjected them to electronic document review as part of this investigation. One of the main features of Rolls-Royce’s co-operation was that it provided all materials requested by the SFO voluntarily, without the SFO having to compel it to provide any. Rolls-Royce also chose not to perform any legal professional privilege review over the documents (instead allowing independent counsel to resolve issues of privilege) and worked with the SFO as it used sophisticated artificial intelligence searches to interrogate the data. This process led to the SFO uncovering information that may not have otherwise come to its attention. Ultimately, SFO counsel described the extent of Rolls-Royce’s co-operation with the investigation as ‘extraordinary’. The Amec Foster Wheeler DPA is another example of a company failing to self-report; however, once Brazilian authorities opened an investigation, the company co-operated ‘extensively’ with the subsequent SFO investigation and foreign investigators, resulting in the provision of previously unseen documents to the SFO both voluntarily and in answer to statutory notices leading to the discovery of further offending. Amec Foster Wheeler further agreed to a limited waiver of legal professional privilege for the purposes of the SFO investigation over advice received by the company during the period of the alleged offending.

While the decision to provide documents voluntarily to the SFO was one of a number of measures taken by Rolls-Royce and Amec Foster Wheeler to demonstrate their co-operation with the investigation, this decision was of fundamental importance to the court when deciding to approve the DPAs. The companies’ voluntary disclosure of investigation documents therefore mitigated its failure to voluntarily disclose misconduct. This is particularly evident in the Amec Foster Wheeler DPA, where the company still obtained 50 per cent credit on the fine imposed despite its lack of self-reporting.

From the US perspective, failure to self-report misconduct before it becomes otherwise known to the authorities can have a significant impact on the resolution of the corporate investigation. Although there is no bright-line rule for timing, disclosures should occur prior to the imminent threat of investigation and in a timely manner. Further, representing another shift in government policies, the DOJ has returned to a prior investigative and prosecutorial focus, requiring that companies adhere to more fulsome disclosure standards. As Deputy Attorney General Lisa Monaco stated in October 2021:

It will no longer be sufficient for companies to limit disclosures to those they assess to be ‘substantially involved’ in the misconduct. Such distinctions are confusing in practice and afford companies too much discretion in deciding who should and should not be disclosed to the government. . . . cooperating companies will now be required to provide the government with all non-privileged information about individual wrongdoing.

This approach is consistent with the general policy of the DOJ under Attorney General Merrick Garland: ‘[I]t is unambiguously this department’s first priority in corporate criminal matters to prosecute the individuals who commit and profit from corporate malfeasance.’

In furtherance of this policy shift, on 15 September 2022, Deputy Attorney General Monaco issued a formal DOJ memorandum entitled ‘Further Revisions to Corporate Criminal Enforcement Policies Following Discussions with Corporate Crime Advisory Group’. Among other things, this memorandum emphasises that: ‘The Department’s first priority in corporate criminal matters is to hold accountable individuals who commit and profit from corporate crime.’ Accordingly, the DOJ will require co-operating companies to prioritise prompt and comprehensive disclosures regarding executives and other individual actors. Should prosecutors identify any ‘undue or intentional delay’ in a co-operator’s production of information or documents, particularly where the information impacts the assessment of individual culpability, the company’s co-operation credit will be reduced or eliminated. Pursuant to these policies, prosecutors must adhere to two core principles regarding voluntary self-disclosure aiming to incentivise corporate co-operation. First, absent aggravating factors, the DOJ will not seek a guilty plea from a corporation if the corporation has voluntarily self-disclosed, fully co-operated, and timely and appropriately remediated the criminal conduct. Second, the DOJ will not require an independent compliance monitor for co-operating self-disclosers if, at the time of resolution, the co-operating company can demonstrate that an effective compliance programme has been implemented and tested.

Organisations should therefore be cognisant that individuals at various levels of the organisation may bear greater liability, and when making voluntary disclosures in investigations, all relevant individuals should be considered.

17.4.4 Production of investigation reports

To obtain co-operation credit, prosecuting and government agencies require that companies provide the complete factual findings of an internal investigation, including relevant source documents. The Justice Manual recognises ‘the sort of co­operation that is most valuable to resolving allegations of misconduct by a corporation and its officers, directors, employees, or agents is disclosure of the relevant facts concerning such misconduct’.

Similarly, the UK DPA Code provides that co-operation will include ‘providing a report in respect of any internal investigation including source documents’.

Careful consideration should be given to the manner of disclosure of information. In the United States, the consideration for credit is that the relevant facts are disclosed, regardless of format and without need to waive privilege. A company bears the burden, however, of disclosing the facts necessary to qualify for co-operation credit, and if a company chooses not to waive relevant privileges, it is unlikely to be able to share the investigative reports prepared by counsel conducting the investigation. Instead, it will have to carefully craft presentations that disclose only non-privileged facts. Oral presentations and high-level overview summaries relying on primary source evidence may reduce the risk to a company, although even these methods of disclosure can face judicial resistance with respect to maintaining privilege. Therefore, companies and their legal counsel can face challenging strategic decisions when weighing co-operation with the government against maintaining privilege. And, because there can be no claim that the materials are privileged, a company should also expect that it will have to produce presentation materials in any related civil litigation.

In the United Kingdom, there is currently much debate over the production of the first accounts of witnesses, which may have been taken by investigating attorneys. The SFO’s preference is that these are taken so that legal privilege does not apply. It also indicates that it does not consider all privilege claims over interview materials to be made out under English law and, until the Court of Appeal’s decision in The Director of the Serious Fraud Office v. Eurasian Natural Resources Corporation (ENRC), was actively challenging such assertions. Where a valid claim for privilege exists, co-operation credit will be given for the disclosure of interview memoranda. A failure to disclose will be considered co-operation neutral. As Alun Milford, then SFO General Counsel, has previously said: ‘If a company’s assertion of privilege is well-made out, then we will not hold that against the company: to do otherwise would be inconsistent with the substantive protection privilege offers.’ In two of the UK cases in which the court has approved DPAs, the company made oral disclosure only of the content of witness interviews. However, Rolls-Royce, Airbus and G4S all chose to provide the interview memoranda or transcripts to the SFO on the basis of a limited waiver of privilege. This was another way Rolls-Royce in particular used the voluntary disclosure of documents to counterbalance any actual or perceived failure to voluntarily disclose the misconduct. Other materials voluntarily provided to the SFO by companies subject to executed DPAs have included regular reports and presentations on the findings of the internal investigations; unfiltered access to the ‘digital repositories or email containers’ for past and present employees; and key documents identified by the internal investigations.

The SFO has affirmed its position on witness accounts and privilege as part of the Corporate Co-operation Guidance, which confirms that a company’s failure to waive privilege means that it will not attain the corresponding factor against prosecution in the DPA Code, but that the SFO will not penalise the company in this regard. The Corporate Co-operation Guidance suggests that while an organisation will not get the full co-operation credit potentially available in these circumstances, the SFO will not automatically refuse a DPA if it can demonstrate other co-operative factors pointing against a public interest in prosecuting the company, in accordance with the DPA Code.

17.4.5 Identification of witnesses to authorities

In its initial assessments of whether to co-operate with authorities, a company will have to consider the implications of disclosing information about key employees. As noted above, US and UK authorities have indicated that co-operation will require disclosure of facts relevant to the misconduct of individual employees.

While the DOJ’s current policies require companies to make fulsome disclosures of any and all individuals who may have been involved in alleged misconduct, the ‘unequivocal co-operation’ necessary to be eligible for a DPA in the United Kingdom additionally includes identifying relevant witnesses, disclosing their accounts of the alleged misconduct and any documents shown to them and, where practicable, making those witnesses available for interviews by investigators – together with ongoing co-operation with the authorities.

When seeking a DPA, a corporate should consider liaising closely with the SFO, which may wish to undertake witness interviews, or interviews under caution, with individuals before corporate counsel does so. The Corporate Co-operation Guidance confirms that the SFO will expect organisations to identify individuals responsible for the suspected wrongdoing (and support the SFO’s disclosure obligations in its prosecution of individuals) and potential witnesses, and that co-operating companies should consult with the SFO before interviewing potential witnesses or suspects, or taking human resources actions or other overt steps. Once the individuals have been identified to the government or prosecuting authorities it may be difficult, if not impossible, for them to continue working for the company. A company may feel pressure to terminate the employee or place that individual on leave, which could have a significant impact on the operations of a business unit. Even if the company does not terminate an employee under investigation, targets of a government investigation are likely to engage their own counsel who may advise the employee to stop co-operating with its employer – leading to a ‘walk or talk’ decision. Depending on the nature of any employment agreement, a company may have to advance fees and costs of an individual’s representation. Also, since 2004, the United Kingdom has imposed an extensive Code of Practice for Disciplinary and Grievance Procedures on employers, which sets out standards of procedural fairness that a UK employer should comply with if it takes action that will detrimentally affect an individual’s employment.

17.5 Privilege considerations

17.5.1 Generally

In the United States, generally the attorney–client privilege entitles a party to withhold from production (1) communications, (2) with an attorney, his or her subordinate or agent, (3) made in confidence, (4) for the primary purpose of securing an opinion of law, legal services or assistance in a legal proceeding. It applies to corporations as well as individuals, and therefore protects communications between corporate employees and a corporation’s in-house and external legal counsel on matters within the scope of the employees’ corporate responsibilities. Communications between non-legal corporate employees can also be privileged where an attorney neither authors nor receives the communication, if the communication contains or refers to previously transmitted legal advice or identifies specific legal advice that the non-attorneys will seek from attorneys in the near future. Additionally, the work-product doctrine protects documents and tangible things, otherwise discoverable, prepared in anticipation of litigation and in connection with a threatened or pending government investigation. The doctrine can apply to documents prepared by both attorneys and non-attorneys. Attorney notes, research and compilations of background materials, memoranda, investigative reports, witness statements, and materials prepared by non-legal personnel such as investigators are examples of the types of documents that may be protected. Work-product containing an attorney’s mental impressions is referred to as ‘opinion’ work-product and is afforded greater protection than other ‘ordinary’ work-product.

In the United Kingdom, privilege attaches to (1) confidential communications between a lawyer and his or her client for the purpose of seeking and receiving legal advice in a relevant legal context, including factual reporting (legal advice privilege), and (2) confidential communications between a lawyer and his or her client or a third party (or both), or between a client and a third party, provided that such communications have been created for the dominant purpose of obtaining legal advice, evidence or information in preparation for actual litigation, or litigation that is ‘reasonably in prospect’ (litigation privilege). English case law has traditionally called into question the availability of litigation privilege for documents created during a regulatory investigation, as an investigation alone lacks the adversarial character of litigation. In the ENRC decision, the Court of Appeal looked at the issue of when a corporate might reasonably contemplate prosecution (and therefore the necessary ‘litigation’) in the context of a self-reporting process, commenting as follows:

[W]e are not sure that every SFO manifestation of concern would properly be regarded as adversarial litigation, but when the SFO specifically makes clear to the company the prospect of its criminal prosecution . . . and legal advisers are engaged to deal with that situation, as in the present case, there is a clear ground for contending that criminal prosecution is in reasonable contemplation.

But the Court went on to say that no particular action in the course of engagement with a regulator will allow a company to say that at a particular date it contemplated a criminal prosecution and privilege crystallised. Every case will turn on its own facts, and the evidence will be assessed in the round.

The corporate must also have created the documents for the dominant purpose of the contemplated litigation. In ENRC, even where ENRC might have created documents for the dominant purpose of merely investigating ‘the facts to see what had happened and deal with compliance and governance’, the Court held:

Although a reputable company will wish to ensure high ethical standards in the conduct of its business for its own sake, it is undeniable that the ‘stick’ used to enforce appropriate standards is the criminal law and, in some measure, the civil law also. Thus, where there is a clear threat of a criminal investigation, even at one remove from the specific risks posed by the SFO should it start an investigation, the reason for the investigation of whistle-blower allegations must be brought into the zone where the dominant purpose may be to prevent or deal with litigation.

So, litigation privilege may well cover a significant proportion of documents created during an internal investigation into possible criminal activity after the regulator has made clear there is a prospect of prosecution. Again, though, the reasons the corporate created particular documents is important. If a corporate creates documents specifically to disclose to the regulator, then it seems unlikely that a claim to litigation privilege against that same regulator will succeed, at least in relation to the final versions of these documents.

The Court of Appeal also discussed the policy behind applying litigation privilege in this area:

It is, however, obviously in the public interest that companies should be prepared to investigate allegations from whistle blowers or investigative journalists, prior to going to a prosecutor such as the SFO, without losing the benefit of legal professional privilege for the work product and consequences of their investigation. . . . The remedy for the SFO is not to allow prevarication and delay . . . to prevent a timeous investigation, when it becomes clear that the company is not wholeheartedly reporting its own conduct and making appropriate waivers of privilege.

It went on to make clear that determining the extent of co-operation by a company (in an analysis of whether a DPA was in the public interest) included determining ‘whether the company was willing to waive any privilege attaching to documents produced during internal investigations, so that it could share those documents with the SFO’. But, past practice in both the United Kingdom and the United States suggests that a corporate does not need to waive privilege over all its investigation documents to receive co-operation credit.

In presenting the underlying facts of an internal investigation, a company must be mindful of the inherent risk that this will be deemed a privilege waiver in any subsequent proceedings. In the United States, if a disclosure of privileged information to a federal office or agency is deemed intentional, the privilege will be waived in any federal or state proceeding. However, if a disclosure of privileged information is unintentional, it will not create a broad waiver so long as the holder of the privilege took steps to prevent the disclosure and then promptly took reasonable steps to seek return of any inadvertently disclosed information. Accordingly, if a company decides that it does not intend to waive privilege, it should devise reasonable steps that highlight the company’s decision not to waive privilege, including providing written notice of the intention not to produce privileged materials in any letter or other correspondence that accompanies a document production. Courts in England and Wales have held that a company can share the contents of a privileged communication with a regulator or other third party, keeping the privilege intact, so long as this desire is made clear, the disclosure is confidential and the communication is not proliferated widely.

The SFO has clarified its position on privilege considerations as part of the Corporate Co-operation Guidance, confirming that if an organisation asserts legal privilege over relevant materials (such as first accounts, internal investi­gation interviews or other documents), the SFO may challenge the privilege assertion where it considers it necessary or appropriate to do so. The Corporate Co-operation Guidance also includes an additional step for companies, requiring organisations to provide certification by independent counsel that the material is privileged. In the United States, certain portions of internal investigations are protected by the attorney–client privilege and the work-product doctrine, and courts routinely uphold those privileges. This can be true even where the purpose of an investigation is to ensure regulatory compliance, or where non-lawyers are involved in key parts of the investigation. The DOJ can take a more aggressive stance challenging claims of the attorney–client privilege in certain instances, however. For example, as demonstrated by a motion for sanctions the DOJ filed in an antitrust action in spring 2022, if the DOJ believes that in-house legal counsel is copied on communications simply to shield communications from investigation by regulators and not to provide legal counsel, the DOJ has recently challenged the invocation of privilege. Organisations should take care in their internal approach to privileged communications and assertion of privilege for general business or public relations matters that do not actually solicit or require professional legal advice.

17.5.2 Privilege in cross-border contexts

It may not be clear which privilege rules apply when a company discloses in one jurisdiction documents created in another. Companies should be aware that some countries do not have developed principles of legal privilege and special care is required in creating or sending otherwise privileged documents to such jurisdictions. Likewise, in some jurisdictions privilege does not extend to communications with in-house counsel and the role of internal counsel may be held by someone who is not an attorney, and therefore privilege may not be recognised in connection with their communications.

Further complications come when dealing with international regulatory bodies. In Akzo Nobel, for example, the European Court of Justice held that the law of the European Union superseded that of the relevant national jurisdictions; therefore, in competition cases, internal counsel’s advice will not be privileged – nor will that of external legal advisers who are not EU-qualified lawyers.

17.6 Protecting confidential information

Companies producing information to the government should take steps to protect its confidentiality. In the United Kingdom, the High Court confronted these issues in Standard Life Assurance v. Topland Col. The SFO had disclosed information it had obtained through its compulsory powers under section 2 of the CJA to a Standard Life employee it wished to interview. The SFO later discontinued the related investigation. Standard Life then used some of this information as part of civil proceedings against Topland. The Court noted that the SFO was not entitled to disclose any material obtained by it during an investigation except for the purpose of its investigation (which was the original purpose of the disclosure in this case). A person who wished to prevent disclosure of genuinely confidential information, either by the SFO or by a person it had disclosed documents to, would need to rely on judicial review proceedings or seek an injunction to prevent a breach of confidence. This suggests that, to avoid relying on these indirect remedies, a company should agree with the SFO before disclosure how the SFO might control the further dissemination of confidential or sensitive documents. Safeguards may include the SFO returning the documents following a short time or notifying a disclosing party before the SFO intended to disseminate documents further. On the other hand, a company may also wish to construct potential safeguards around material produced to it during DPA negotiations and that may otherwise be discoverable in subsequent civil proceedings against it. This point was particularly relevant in Omers Administration Corp & Ors v. Tesco Plc, where the SFO had provided Tesco with a number of confidential documents during DPA negotiations that it had obtained from third parties using its section 2 CJA investigation powers. These documents subsequently became subject to the standard disclosure test under Part 31 of the Civil Procedure Rules when two groups of shareholders brought civil proceedings against Tesco. The High Court considered the conflict between Part 31 and Tesco’s confidentiality obligations to the SFO and found that the key question to be considered was whether the overriding objective of dealing with a case justly and at a proportionate cost could be solved with the production of relevant documents. Applying the facts of the case, the High Court ordered disclosure as the documents were likely to contain material ‘necessary for the fair disposal of the action’; and the public interest in confidentiality (even though this held particular weight when documents were originally obtained by compulsion under the SFO’s powers) was overridden by the public interest in ensuring ‘the courts try civil claims on the basis of all relevant material’.

In the United States, the government must keep information produced in response to a grand jury subpoena confidential, although a court may authorise disclosure subject to any conditions it directs (such as disclosure to a defendant post-indictment during discovery). Additionally documents under the control of a government agency can be subject to requests made pursuant to the Freedom of Information Act (FOIA), although exemptions to FOIA may allow an agency to withhold certain documents from disclosure.

The procedures necessary to shield confidential information from disclosure can be quite complex. Each regulatory body has its own procedures for seeking confidential treatment of information. The SEC, for example, has Rule 83, which provides a procedure for requesting that information submitted to the SEC be withheld from FOIA requests. The SEC requires that each page of a document containing confidential information be stamped with a specific legend and that a request for confidential treatment go to the individual receiving the documents and the Office of Freedom of Information and Privacy Act Operations. However, organisations should take care because documents typically shielded from disclosure by FOIA and other regulations are not exempt from production to the United States Congress, which can, in turn, make the information public. Many states have their own versions of FOIA governing the treatment of information provided to, among others, state attorneys general. And, at the federal level, the Privacy Act and Trade Secrets Act also protect a company’s information that has been disclosed to investigators and forbid those investigators from further disclosing information.

17.7 Conclusion

Companies have an incentive to co-operate with a government investigation, especially if co-operation credit does not necessarily require self-reporting of the misconduct. But self-reporting will assist companies alongside the voluntary provision of relevant materials. The additional advantages of co-operation – control of the investigation process, orderly production of materials and managing press intrusion – are likely to be great when weighed against the disruption and publicity of formal actions including raids, arrests and prosecutions. In cross-border investigations, companies will need to devise due process safeguards to protect the rights of individuals and respect local law requirements. Ensuring local law specialists are instructed to work as part of a multidisciplinary team will be key.

Footnotes