France

France has seen two major developments in early 2023: (1) the publication of the first joint anticorruption internal investigations guidelines by regulators the Agence française anti-corruption ("AFA") and Parquet National Financier ("PNF"), and (2) the new PNF guidelines on La convention judiciaire d'intérêt public ("CJIP") (French deferred prosecution agreement mechanism). 

However, these two official documents fail to address two essential issues for companies and practitioners:

• First, is the internal investigation report covered by legal privilege in France? 
• Second, what do companies gain if they come forward in cases of fraud and self-disclose to the regulator? 

As these issues remain open, and the regulators do not wish to commit themselves, companies looking to manage their risk need to take appropriate legal advice. 

United Kingdom

Major changes are contemplated by the new Economic Crime and Corporate Transparency Bill (ECCTB), including a new corporate criminal offence of failing to prevent fraud. However, the biggest change that the Bill is likely to make to the corporate risk landscape comes, in our view, in the form of new provisions designed to make it easier to hold companies to account for economic crimes. These will expose corporates to criminal penalties and the threat of conviction where their senior managers commit an economic crime, while acting within the actual or apparent scope of their authority. 'Senior manager' is defined in high level terms and is designed to capture those who sit below board level. Whilst some might be tempted to see the new provisions as codifying the existing law of 'directing mind and will', we believe they go materially further and require careful consideration.

See our detailed summary of this development here. 

Germany

Germany has introduced new legislation, coming into force in 2023, which forces affected corporations to take new and comprehensive compliance measures: 

• the Act on Corporate Due Diligence Obligations in Supply Chains or “Supply Chain Act” (Lieferkettensorgfaltspflichtengesetz, LkSG); and 
• the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG). 

See our summary of the latter Act here. 

In addition, there are some developments regarding a potential “Corporate Sanctions Act”. Although the legislative process failed (again) in the last legislative period, the first calls for a new draft have already been made. If a Corporate Sanctions Act is brought in during this legislative period, a further considerable tightening of the criminal sanctions against corporations can be expected. 

France

The French enforcement landscape has tremendously changed since the creation of CJIP which came into effect in 2017. Whereas it was not clear if judges would adopt this new instrument, which was a small revolution in the French judicial world, we can now say that it has been a success as 18 CJIPs have been entered into by prosecutors.

However, it is clear that the PNF wishes to keep up the momentum and remind companies they should continue to cooperate to avoid criminal prosecutions. One of the reasons for this is the fact that, in the vast majority of cases, the PNF has failed to bring cases against individuals after the signing of the said CJIPs as the agency’s efforts to prosecute individuals following corporate resolutions are often hamstrung by slow judicial processes. We think this is the reason why the regulators chose to adopt a hard stance.

United Kingdom

The proliferation of legislation handing UK prosecution agencies and regulators a greater say in how companies conduct business, ostensibly to prevent harm to UK plc and the wider public, is not a new trend. 

These recent proposals stem directly from a Law Commission report listing the ways that corporate liability could be reformed, which was itself a reaction to the challenges of holding large or complex corporates to account brought into sharp focus in the case of SFO v Barclays. 

This also demonstrates the UK Government's self-proclaimed "fundamental shift" in its approach to tackling fraud and other economic crimes connected to the UK. The momentum needed to push these reforms through has been heightened by Russia's invasion of Ukraine and a recognition by government that the UK's open financial economy has led to large amounts of Russian and other suspect money passing through its financial system.

Germany

Various compliance-related laws in Germany (such as the Whistleblower Protection Act) are driven by or result from EU legislation. Various further regulations can be expected from the EU over coming years. 

Comparable to the UK, there has been a trend and a desire for tougher and “more effective” sanctions against corporations in Germany. This is due to recent "scandals", resulting in fairly broad consensus that the means available in Germany to sanction companies have not been sufficient so far. 

Further regulations on health, safety and environmental compliance and on money laundering are to be expected. 

Staying out in front: UK perspective

The implementation timescales for the new laws discussed above is likely to be very short. Whilst the provisions of the ECCTB technically remain in draft at the time of writing, Corporates should consider now what impact they might have on their workforce and internal policies and procedures. What is their internal messaging around these reforms going to be and how can they leverage existing work, for example, any analysis of 'directing mind and will'?

The UK Government is also proposing a narrow jurisdiction to prosecute companies for the acts of their senior managers taking place wholly outside the UK, so long as there is jurisdiction to prosecute the underlying offence. This has the potential to add an extra level of complexity for corporates grappling with these new provisions who have footprints in different jurisdictions with different standards of corporate criminal liability.

Tackling the risks head on: French perspective

It is clear that companies willing to undertake internal investigations (in France and elsewhere) need to tread carefully.

First of all, if companies want to benefit from the possibility of obtaining a CJIP or, the English or American equivalent, they will need to show “good faith”. One element required to show such “good faith” is precisely to launch an internal investigation to discover the entirety of the facts at stake. However, French regulators have taken the position that an internal investigation report is not covered by legal privilege.

Such position – which is all but evident - created a huge surprise and practitioners fear that their reports will now be seized by French agencies or police. Additional care must therefore be taken to protect the confidentiality of the results of internal investigations, especially for international companies.

Secondly, it is not obvious what companies will gain when choosing to self-disclose a fraud or an act of corruption. In practice, companies who have signed a CJIP have mostly agreed to pay huge fines – the idea being that you accept to pay to close the investigation and get back to business as usual. 

In practice, you will need a thorough risk-assessment before deciding to self-report anything in France.

Quality and speed of response: German perspective

To avoid significant fines or other sanctions, such as exclusion from public procurement procedures, the (new) legal requirements mentioned above (LkSG and HinSchG) must be implemented. Compliance management systems must be continuously monitored and, if necessary, adapted to the constantly changing and expanding legal requirements. It is essential that such compliance measures are not only on the books, but also actually effective. Authorities and courts pay particular attention to this.

Legal developments both at EU level and in Germany should be observed. For example, it is to be expected that the German Supply Chain Act will become even stricter as a result of new EU regulations.

Due to often very short implementation timescales for new regulations, the implementation processes should be tackled at the earliest convenience, and ideally before regulations enter into force. 

The sanctioning of corporations that have not prevented offences (where their compliance measures are believed to be insufficient) is steadily increasing in Germany. At the same time, fines against corporations or their management for offences conducted by employees can be significantly reduced or even prevented through appropriate compliance measures. 

There is an ongoing desire to reform corporate criminal liability across key jurisdictions where we and our clients work. Companies are now under scrutiny for not just how they do business but how they oversee their staff, conduct their internal investigations and police their own supply chains. 

Many of the issues discussed above can be avoided with thoughtful and carefully structured compliance programmes. We are on hand to help businesses review and assess their compliance infrastructures and to respond to these changes with purpose.