The evolving corporate risk landscape requires in-house legal and compliance teams, as well as outside counsel, to stay up-to-date on the latest regulations in order for organizations to most effectively prevent violations of laws governing sanctions, fraud, corruption and bribery, securities, market manipulation and other economic crimes.

In 2023, senior leaders from A&M’s Investigations & Compliance team, including Jenelle Beavers, Steve Spiegelhalter, Laureen Ryan, Kenneth Jones, Ana San Luis, Karen Chon and Jeremy Tilsner, attended the American Bar Association’s 38th National Institute on White Collar Crime to hear from U.S. prosecutors, practitioners and attorneys about the latest trends and developments in the domestic and global regulatory environment.

Here are our five critical takeaways for investigation and compliance professionals from this year’s conference.
 

1. U.S. DOJ is focused on moving cases quickly and generating new cases through big data.

DOJ has expressed a desire to push cases forward quickly by increasing the resources available and collaborating with international regulators and law enforcement partners. Given the current geopolitical environment, DOJ is also strengthening partnerships with the National Security Division in the investigation and prosecution of white collar crime cases, including the creation of the first-ever Chief Counsel for Corporate Enforcement of the National Security Division.

U.S. prosecutors are increasingly relying on big data to generate new case leads. At the ABA conference, Assistant Attorney General Kenneth A. Polite, Jr. remarked, “We detect wrongdoing through proactive and sophisticated methods of identifying criminal wrongdoing, including groundbreaking data analytics.”[1]

Companies should focus on moving their own investigations quickly if they decide to report to DOJ or are otherwise before prosecutors. Companies should start from day one along two tracks: First, figure out what happened — including the root cause of any controls violations. Second, work from day one to remediate controls and compliance failures. Companies that start thinking about compliance just as they are starting to discuss resolution with DOJ or other regulators will find themselves far behind and much more likely to face difficult resolutions that could include independent compliance monitors.

DOJ will also hold companies to the DOJ standard: If DOJ is using big data, so should companies with the resources to do so. Controls function better when monitored in real time, and that monitoring should take advantage of all the data that companies can repurpose to compliance.
 

2. Prosecutors will consider compensation and clawback policies when evaluating compliance programs.

At the event, Kenneth J. Polite, Jr. announced that efforts by corporations to include clawbacks and compensation consequences for executives, in order to deter misconduct, would be taken into account when determining fines in resolutions.

Companies should proactively update their corporate compliance programs — and likely their employment contracts — to account for DOJ’s new focus on compensation. Companies should consider introducing compliance KPIs for executives and other key functions. This exercise is not so straightforward, and companies should reevaluate how the KPIs function as those companies audit their compliance function and annually renew their risk assessment. As in many spaces, DOJ finds thoughtful consideration persuasive.
 

3. A focus on sanctions.

2022 saw a dramatic ballooning of sanctions largely due to the war in Ukraine. As a result, DOJ is increasing scrutiny on investigations involving alleged sanctions violations across numerous industries. This changing landscape creates challenges for companies navigating sanctions compliance.

Staying abreast of the many global sanctions regimes is a full-time job, and companies with potential sanctions exposure should dedicate enough resources to make sure they comply. Consistent with preexisting FCPA compliance and corporate good practice, companies must fully understand with whom they are doing business. Scrubbing vendor masters, dropping inactive vendors and running full diligence on new vendors is a critical part of avoiding sanctions violations.
 

4. Data solutions are integral to robust compliance programs.

Obtaining accurate and timely information is integral to running successful compliance programs. Today, many data solutions are available to provide continuous and detailed insight into a company’s critical data in order to readily identify issues when they arise.

Nearly every function within a company produces valuable data that companies use to run their business and maximize profit. DOJ now expects companies to use that same data to detect potential compliance issues. At small companies, this can be as simple as pulling accounting reports on a monthly basis for compliance review. These can include, for instance, asking accounting personnel for reports of transactions just below the threshold for enhanced management review. Larger companies with more data and more resources will be expected to use big data to monitor transactions throughout the company, either in real time or with a delay that allows for the audit of high-risk transactions.
 

5. In the U.S., voluntary self-disclosure is encouraged.

U.S. regulators are increasingly looking to corporates to voluntarily disclose potential issues when they are discovered, and regulators are expanding incentives for companies when they do so. In her remarks at the ABA conference, Deputy Attorney General Lisa O. Monaco stated, “Absent aggravating factors, no department component will seek a guilty plea where a company has voluntarily self-disclosed, cooperated and remediated the misconduct.”[2]

Self-disclosure is a complicated calculus in most situations, but one thing is clear: Companies must investigate and remediate corporate wrongdoing as if DOJ is in the room, even if the company has decided for now not to self-disclose alleged wrongdoing. This means conducting independent investigations and documenting them should you later decide to self-disclose or if someone else discloses.