Sapin II places significant obligations on large companies to implement anti-corruption compliance controls. Failure to have an effective compliance programme in place, regardless of whether corruption occurs, creates liability for corporates and individual directors who could find themselves facing large financial penalties. As detailed below, the obligations extend to overseas operations of bound entities and come into force in just two months’ time.
In addition, the new law gives the French authorities extra-territorial jurisdiction in relation to overseas corruption, creates a new French anti-corruption agency, enhances whistleblower protection and introduces the concept of Deferred Prosecution Agreements (“DPAs”) to France. In short, it is a real game-changer for France which has previously faced significant criticism by the Organization for Economic Cooperation and Development (“OECD”) for its lack of anti-corruption efforts.
The Compliance Obligations
The obligation to put in place a compliance programme will apply to companies with more than 500 employees or companies that are part of a group which globally employ more than 500 employees, have the parent company incorporated in France and have a minimum turnover of €100 million. The obligations will also apply to the directors and senior management of such entities who can face individual liability. French companies operating in Asia must therefore be aware of the new obligations that require bound entities to implement:
- a corporate code of conduct;
- a whistleblowing procedure;
- a regularly updated risk assessment;
- a third-party due diligence protocol;
- accounting controls;
- an anti-corruption training programme;
- disciplinary policies for employees; and
- ongoing monitoring to ensure the programme is effective.
The obligation enters into force in June 2017; bound entities therefore have very little time in which to ensure their anti-corruption programme is compliant.
Sapin II dramatically extends the previously limited jurisdictional reach of the French authorities in relation to the payment of bribes. The new law will apply to overseas corruption where the offence has been committed by a French National, a French resident or, crucially, a corporate that operates any part of its business in France. This affords the French authorities similar extra-territorial powers as enjoyed by the US and UK.
French Anti-Corruption Agency
A new Anti-Corruption Agency will become the primary authority to ensure compliance with Sapin II and will draft recommendations in relation to combating and preventing corruption. It has far-reaching supervisory functions, including investigative and penalty imposing powers. These powers include the ability to impose administrative sanctions for breach of the obligation to prevent bribery.
The law sets out a clear whistleblower procedure that must be implemented by companies with more than 50 employees. This sets out the definition of “whistleblower” being someone who reports a crime “selflessly and in good faith” and then a hierarchy for internal reporting and time scales by which the company must respond. If the company does not respond further timescales are prescribed for reporting the matter to the authorities and finally, to the media. Whistleblowers will be protected from retaliation under Sapin II with anonymity and non-liability measures. For many companies in Hong Kong, this may be a new concept as there is no legal obligation in Hong Kong for companies to have a whistleblower policy in place or even to protect whistleblowers.
Introduction of DPAs
The French equivalent of a DPA will be introduced via the Criminal Procedure Code. The mechanism would allow companies to avoid criminal sanctions by paying a fine instead. The fine could be up to 30 percent of the average annual turnover of the company for the preceding three years. The settlement would have to be approved in a public hearing by the French prosecutor, and is an option available only to corporate defendants. Where a company has successfully avoided criminal prosecution by paying fines instead, individuals such as executives of the relevant company could still face criminal sanctions. The system is therefore very much a mirror of the US and, more recently introduced UK, DPA regimes and we could see companies in Asia entering into DPAs with French authorities if enforcement under Sapin II follows the same trend as enforcement under the US and UK anti-corruption laws.
In 2016, 17 of the total 27 FCPA cases settled through DPAs involved conduct in China alone. This includes JP Morgan Chase & Co and its Hong Kong subsidiary that agreed to pay US$264.4 million to US authorities under a DPA in relation to the “princeling” scandal.
In the UK, Rolls-Royce recently entered into a DPA under which it will pay the UK’s Serious Fraud Office £497 million in relation to bribery across several jurisdictions including China, India, Indonesia and Thailand.
As members of the UN Convention Against Corruption, Hong Kong and France are obliged to cooperate with each other in the fight against corruption, including in relation to evidence gathering, the transfer of information and extradition of offenders.
An anti-corruption compliance programme will be a new requirement for many large companies in Hong Kong. While the Independent Commission Against Corruption recommends the adoption of an effective compliance programme, there is no obligation to have such a programme or system of leniency. Whilst many companies may be subject to the US and UK anti-corruption laws, there is a key difference. A compliance programme only comes into play once FCPA or BA enforcement action is commenced, as mitigation or defence, respectively. Sapin II places a positive burden to have a programme in place, failure to do so, in and of itself, may lead to penalties.
Sapin II was introduced following heavy criticism from the OECD for a lack of anti-corruption enforcement action by the French authorities. It therefore seems wise to assume that the French authorities will be keen to ensure high profile enforcement action for any company bound by the new law that is found to have failed to take steps to implement the required anti-corruption controls. It follows that the key take-away for corporates falling within the remit of Sapin II, including those operating in Asia, must be to review their anti-corruption programme to ensure it is up to scratch by the implementation date of June 2017. Failure to comply with those obligation, regardless of whether a corrupt event occurs, may well see corporates and individuals facing high profile and costly enforcement action.