On April 8, 2015, roughly three weeks after issuance of Decree No. 8,420 (the “Decree”)1 implementing Law No. 12,846, the so-called Clean Company Act (the “Act”),2 Brazil’s Comptroller-General of the Union (the “CGU”) issued four new regulations further clarifying the Act.3 These new regulations took effect immediately and help fill out the details of the government’s expectations for companies and the process by which it will enforce the Act and Decree. We outline below the key features of the new laws and how they fit in with the provisions of the Act and Decree. I. The Clean Company Act and the Decree The Act, also known as Brazil’s Anti-Corruption Law, imposes strict civil and administrative liability on corporate entities doing business in Brazil for their corrupt conduct or bribery of Brazilian or foreign public officials, as well as fraud in connection with public tenders. It applies broadly to corporations, partnerships, and proprietorships, and to other for-profit and non-profit entities. The Act provides for monetary fines ranging from 0.1% to 20.0% of a company’s annual gross revenues. While passage of the Act was a major milestone, different aspects of its implementation remained uncertain until issuance of the Decree last month. Awaited for more than a year, the Decree clarified the process – known as the PAR (the Processo Administrativo de Responsabilização) – for imposing administrative liability on legal entities for acts of bribery or corruption under the Act. It also set forth guidelines for calculating fines, laid out rules governing leniency agreements, and established general parameters for evaluating a company’s compliance program. But as the most recent regulations demonstrate, the Decree contained gaps and left open certain questions. 1. See Andrew M. Levine, Bruce E. Yannett, Steven S. Michaels, Daniel Aun, and Bernardo Becker Fontana, “Brazil Issues Long-Awaited Decree Implementing the Clean Company Act,” FCPA Update, Vol. 6, No. 8 (Mar. 2015) (hereinafter, “Brazil Issues Decree”), http://www.debevoise. com/insights/publications/2015/03/fcpa-update-march-2015. 2. See Andrew M. Levine, Bruce E. Yannett, Renata Muzzi Gomes de Almeida, Steven S. Michaels, and Ana L. Frischtak, “Brazil Enacts LongPending Anti-Corruption Legislation,” FCPA Update, Vol. 5, No. 1 (Aug. 2013), http://www.debevoise.com/insights/publications/2013/08/ fcpa-update. 3. The new CGU regulations are available at: http://pesquisa.in.gov.br/imprensa/jsp/visualiza/index.jsp?data=08/04/2015&jornal=1&pagina =2&totalArquivos=84. Continued on page 10 www.debevoise.com FCPA Update 10 April 2015 Volume 6 Number 9 II. The New CGU Regulations A. Compliance Programs As we noted previously,4 the Act and the Decree provide that the adoption and implementation of a robust anti-corruption compliance program shall be a mitigating factor when the government is called upon to calculate fines applicable to a company’s breach of the Act. They also established that leniency agreements must contain a provision requiring the adoption, application, or improvement of an existing compliance program by the breaching company.5 The Decree anticipated that the CGU would issue further regulations and guidelines detailing the government’s expectations and standards for anti-bribery compliance programs. Recently issued Ordinance No. 909 (the “Compliance Ordinance”), arguably the most immediately pertinent of all four new CGU regulations, furthers the compliance-oriented goals set out in the Decree. In particular, it provides further guidance on how companies ought to structure compliance programs and details how authorities will assess the adequacy and effectiveness of the same in various settings. The Compliance Ordinance establishes that companies under investigation must submit a profile report identifying key facts about the firm and risk factors faced by the business, as well as a report on the company’s implementation of and adherence to a compliance program. Under the new rules, the assessment of a breaching company’s compliance program shall take into account the company’s assertions as corroborated by its profile and conformity reports. In particular, the degree to which the fine is reduced will be influenced by the operational adequacy of the company’s compliance program vis-à-vis the company’s profile and the program’s actual effectiveness. The profile report must: (i) indicate the industries in which the company operates, whether in Brazil or elsewhere; (ii) set out the company’s structure, hierarchy, and decision-making process, and the role of its boards, management, and divisions; (iii) provide data on the size of the company’s workforce; (iv) supply detail and context for the company’s interactions with domestic or foreign government entities, including the relevance of obtaining authorizations, licenses and permits for its business, the number and value of government contracts (whether in force or not) executed within the last three years and their relevance Continued on page 11 Brazil Further Regulates Its Anti-Corruption Framework Continued from page 9 4. See Andrew M. Levine et al., Brazil Issues Decree, supra note 1, at pp. 16, 22. 5. Id, at pp. 17-18. www.debevoise.com FCPA Update 11 April 2015 Volume 6 Number 9 for the company’s annual profits, and the relevance of, and frequency with which, intermediaries have been used in the company’s interactions with the public sector; and, finally (v) identify the company’s ownership stakes, including whether it controls, is controlled by, is associated with, or is a member of a consortium with another company. With reference to its assessment of the parameters for compliance programs set forth in the Decree,6 the Compliance Ordinance establishes that the report addressing the implementation of a compliance program (the “observance report”) must: (i) detail the company’s compliance program by indicating which of the compliance parameters set out in the Decree have been implemented, how these parameters have been implemented, and the relevance of each of the implemented parameters for the avoidance of misconduct under the Act, given the specific characteristics of that particular company; (ii) demonstrate the functioning of the compliance program in the company’s daily life, e.g., through the provision of historical data, statistics, and concrete examples; and (iii) explain how the compliance program achieves the deterrence, identification, and remediation of the specific misconduct at issue. Under the Compliance Ordinance, the company bears the burden of proving the contentions in its profile and observance reports. This may be achieved through a range of documents, including e-mails, letters, minutes of meetings, reports, manuals, memoranda, declarations, photos, videos and audio recordings, purchase orders, invoices, and accounting records. The authorities may also conduct interviews and request additional documents in the context of their assessment. The Compliance Ordinance provides that the maximum reduction in the amount of the fine (i.e., two-thirds of the applicable fine, as set out in the Act) is expressly Brazil Further Regulates Its Anti-Corruption Framework Continued from page 10 “In particular, the degree to which the fine is reduced will be influenced by the operational adequacy of the company’s compliance program vis-à-vis the company’s profile and the program’s actual effectiveness.” 6. Id. These include: (i) the commitment of the company’s upper management to the program; (ii) the standards of conduct and codes of ethics applicable to employees, managers, and, as appropriate, third-party service providers; (iii) periodic training; (iv) internal controls; (v) specific procedures to prevent fraud and wrongdoing in the context of bidding procedures and the performance of government contracts, among other contexts; (vi) the independence and authority of the internal body responsible for applying and overseeing the program; and (vii) disciplinary measures applicable in the event of violations. Continued on page 12 www.debevoise.com FCPA Update 12 April 2015 Volume 6 Number 9 conditioned on satisfactory compliance with the requirements for the observance report. If a company’s compliance program was not established until after the specific misconduct at issue, the third prong of the observance report requirements will be automatically deemed unfulfilled, and a fine reduction (or at least the largest one possible) based on the existence of a robust compliance program may not follow. In addition, the Compliance Ordinance provides that a perfunctory compliance program that is ineffective in deterring sanctionable misconduct will be disregarded for fine reduction purposes. Ordinance No. 910, discussed further below, touches on compliance programs in the context of leniency agreements. It provides that, prior to entering into a leniency agreement with a breaching company, the CGU will evaluate, among other things, the firm’s compliance program. It further notes that, in negotiating a leniency agreement with a breaching company, the CGU will propose specific provisions in the agreement that will seek to ensure the breaching company’s commitment to change its governance structure so as to avoid further misconduct. This is consistent with the Decree’s provisions that all leniency agreements mandate the adoption, application, or improvement of an existing compliance program. B. Leniency Agreements and Administrative Liability Processes Under both the Act and the Decree, a company that has violated the Act or certain provisions of Brazil’s legislation on public bids and government contracts may enter into a leniency agreement as a means to mitigate possible sanctions. Ordinance No. 910 restates and elaborates on several such provisions regarding leniency agreements. While the new rules shed no light on the competence of other authorities to enter into leniency agreements with breaching companies, they describe in more detail how the CGU will process leniency applications. Upon receipt of a leniency application, the CGU’s Executive Secretary will convene a commission to lead the negotiations. This commission will assess whether the company has met the requirements under the Act and Decree and is therefore entitled to enter into a leniency agreement with the CGU. The commission is required to produce a reasoned report on whether it would be appropriate to enter into the leniency agreement, and, if so, recommending the benefits to which the breaching company should be entitled and the applicable fine. In addition, Ordinance No. 910 expressly provides that – consistent with the terms of the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions (adopted by Brazil in 2000) – decisions concerning the commencement, conduct, or termination of any investigations, PARs, or leniency agreements are not to be influenced by considerations relating to Brazil’s economic interest, the potential effect upon the country’s relations with Brazil Further Regulates Its Anti-Corruption Framework Continued from page 11 Continued on page 13 www.debevoise.com FCPA Update 13 April 2015 Volume 6 Number 9 another nation, or the identity of the individuals or companies involved. Ordinance No. 910 also clarifies the operation of the PARs. In addition to restating many rules of the Decree – including on the CGU’s competence to act in the event of inaction by the authority originally tasked with handling the PAR – the new rules further elaborate on the issue of jurisdiction to initiate a PAR. Specifically, the Ordinance provides further guidance on the CGU’s concurrent jurisdiction to act in extraordinary circumstances (e.g., in complex or relevant cases), stating that the Comptroller might act at the request of the public entity harmed by the corrupt practice. However, the new regulation does not explain how potentially broad terms such as “complex” or “relevant” matters should be interpreted under the Brazilian anti-corruption framework. This question therefore remains open. Ordinance No. 910 also establishes that the CGU, through its Corrections Office, will oversee the activity of other entities at the federal administrative level, including Ministries and other agencies also tasked with applying the Act and the Decree. The CGU’s oversight activity might include visits and inspections at those other federal entities to ensure they comply with the PAR procedure set forth by the new rules. C. Other Provisions The CGU also issued two additional regulations. Instruction No. 1 contains rules that will guide determination of a company’s gross revenues for fine calculation purposes – which, under the Act, may range from 0.1% to 20.0% of a company’s gross revenues. Instruction No. 1 differentiates between companies subject to the regular Brazilian corporate income tax regulations and those subject to a simplified tax system, and provides that a company’s gross revenues will be calculated according to the applicable tax profile. Finally, Instruction No. 2 complements the Act and the Decree in regulating the operation of the national registries publicizing details about sanctioned and debarred entities. As to the National Registry of Unfit and Suspended Companies (“CEIS”) (Cadastro Nacional de Empresas Inidôneas e Suspensas), Instruction No. 2 provides that the CEIS also may publicize information about sanctions applied to a company by international organizations, foreign cooperation agencies, or multilateral entities, e.g., such as the World Bank, the Inter-American Development Bank, or similar organizations. As to the National Registry of Sanctioned Companies (“CNEP”) (Cadastro Nacional de Empresas Punidas), Instruction No. 2 clarifies the provisions of the Decree in providing, among other things, that authorities must use CNEP to publicize information regarding leniency agreements executed with breaching companies, the sanctions applied to these companies under the agreements, and any breach of the commitments undertaken by companies under such agreements. Brazil Further Regulates Its Anti-Corruption Framework Continued from page 12 Continued on page 14 www.debevoise.com FCPA Update 14 April 2015 Volume 6 Number 9 Brazil Further Regulates Its Anti-Corruption Framework Continued from page 13 III. Conclusion As anti-corruption protests continue in Brazil, the CGU has now further clarified key aspects of Brazil’s anti-corruption legal framework, including those concerning compliance programs and leniency agreements. In light of ongoing investigations, it is only a matter of time before the government starts taking action under the new rules. It is thus ever more critical that companies doing business in Brazil take measures to ensure compliance with Brazil’s anti-bribery regime.