Despite the fact that there is no private right of action under the FCPA, shareholders have brought derivative and class action claims against companies and their executives for allowing violations to occur and incurring the large costs of investigating alleged misdeeds. The author discusses several such cases and the Department of Justice's new FCPA policy.

Companies facing potential criminal or civil regulatory action often respond by commencing an internal investigation, promising to share the results with regulators and shareholders. However, in the zeal to avoid civil or criminal penalties, internal investigations can have the unintended consequence of creating liability to shareholders. This is because internal investigations are costly. Attorneys' fees and expenses can quickly escalate and exceed $100 million.

This is particularly so with investigations into possible violations of the Foreign Corrupt Practices Act of 1977 ("FCPA"). For example, Avon Products spent nearly $100 million on its internal investigation of potential violations in 2011 alone. This was on top of $95 million the company spent in 2010 and another $59 million the year before. Moreover, these costs only escalate if litigation ensues and more counsel and litigation support are added to the mix.

Of course, no company wants to be accused of hamstringing an investigation with budgetary constraints. Nor could they. Even if they wanted to rein in expenses, publicly traded companies typically have indemnification obligations that require them to subsidize the defense of their officers and directors who may be accused of a violation, and in most cases those costs must be advanced during the course of an investigation or prosecution.

These costs are a real concern to the company's investors who ultimately bear them. Investigations and litigation can drag on for years, while costs spiral out of control. Recent "claw-back" provisions entitling companies to recover from wrong-doer executives are rarely used or are otherwise ineffectual in the face of enormous expense. While there is no private right of action under the FCPA, shareholders have increasingly pursued derivative and class action claims against companies and their executives that allow violations to occur or spend hundreds of millions of dollars investigating alleged misdeeds. Increasingly, the investigations themselves become the subject of shareholder litigation for corporate waste, breach of fiduciary duty, unjust enrichment, or other claims. The corporate harm that may result from internal investigations can include not only the enormous investigation costs but also reputational harm, lost goodwill, business interruption, and talent flight.

Avon's FCPA experience is illustrative. In the late 2000's, the former beauty products powerhouse, known for its "Avon calling" catchphrase, focused its expansion efforts on new markets in China in response to flagging sales in the United States. Avon's direct sales operations in China were authorized under highly coveted licenses granted by the Chinese government.

However, on October 20, 2008, Avon disclosed that it had received a whistleblower report that certain travel and entertainment expenses associated with the company's China operations may have violated the FCPA, which prohibits payments to foreign government officials intended to secure government contracts. This law imposes strict accounting rules requiring companies to make and keep books and records that accurately and fairly reflect corporate transactions in foreign countries. Avon also announced that it had launched an internal investigation.

Nevertheless, Avon's sales in China grew steadily between 2008 and 2011. However, in late 2011, the SEC announced that it was commencing a formal investigation of the company. By the end of 2011, Avon announced that its CEO would step down from management but would remain as Executive Chairwomen for two years. In early 2013, Avon disclosed that its Chief Financial Strategy Officer had been terminated in connection with the ongoing investigation. In 2014, the SEC formally charged Avon with violating the FCPA by failing to put controls in place to detect and prevent payments and gifts to Chinese government officials. Avon agreed to pay $135 million to settle the SEC charges and a parallel criminal case.

Shortly after the SEC announced its investigation, Avon shareholders filed the first of several securities class action lawsuits against the company, and certain of its directors and officers. The gravamen of plaintiffs' claims were that Avon's top executives failed to implement and maintain adequate internal controls and accounting systems necessary to ensure FCPA compliance. As a result, according to the complaint, Avon violated the FCPA, which caused the company to incur significant costs in the ensuing government and internal investigations. The plaintiffs asserted common law claims for breach of fiduciary duty, waste of corporate assets, and unjust enrichment. However, the action was brought in the federal court for the Southern District of New York, asserting subject matter jurisdiction under 28 U.S.C. 1331, because the claims were "dependent on the resolution of substantial questions of federal law" i.e., the FCPA. In a wellreasoned decision, the federal district court judge, Paul G. Gardephe, dismissed the action for lack of jurisdiction. The court disagreed with plaintiffs and found that resolution of the claims would not "implicate the validity of the FCPA or the requirements that the Act imposes."1 In short, the court declined to create a private right of action under the FCPA where Congress had expressly declined to do so.

Last year, federal district court judge Andrew L. Carter of the Southern District of New York addressed a similar question in In re VEON Ltd. Securities Litigation,2 namely, whether a securities fraud claim based on statements made during the course of FCPA violations "constitutes an impermissible end-run around the FCPA's lack of a private right of action."3 The shareholder plaintiffs in VEON alleged that the telecommunications company failed to disclose that its increased broadband subscriptions in Uzbekistan and corresponding revenue growth were attributable to bribes paid to government officials in Uzbekistan, which violated the FCPA. The price for the company's publicly traded American Depositary Receipts dropped precipitously after a series of disclosures, including investigations by U.S. and Dutch authorities, as well as VEON's own internal investigation. VEON later entered into a deferred prosecution agreement with the U.S. Department of Justice in which it pleaded guilty to a two-count criminal investigation charging the company with conspiracy to violate FCPA. VEON also agreed to pay more than $460 million in penalties and subject itself to outside compliance monitoring. Moreover, the company disclosed that it had reserved $900 million for investigation and litigation costs.

In its motion to dismiss, VEON argued that "Plaintiffs' claims regarding the company's financial disclosures are, in reality, an improper attempt to enforce the FCPA, which has no private right of action . . . . [and] a company is not required to disclose uncharged wrongdoing."4 Judge Carter, however, disagreed. "Plaintiffs' claim is not simply that VEON should be found liable for violations of Rule 10b-5 and 20(a) because it did not disclose its FCPA violations."5 Instead, "once VEON put at issue its increased subscribers and income in Uzbekistan, `it was duty bound not to omit the rest of the story, i.e., that the growth was attributable to falsely concealed bribery payments. By failing to do so, its omissions were actionable.'"6

The court found that "Plaintiffs' allegations regarding the misrepresentations in VEON's SEC filings are sufficiently distinct to avoid any potential concern that Plaintiffs are seeking to enforce the FCPA by this securities fraud action."7 At bottom, the court applied a traditional omissions analysis, reasoning "the failure to disclose uncharged criminal conduct may be actionable where the failure to do so would make other disclosures materiality misleading."8

Finally, the court found actionable statements regarding "the existence and efficacy" of internal controls for FCPA compliance.9 Rejecting defendants' contentions that the claims were predicated on mere corporate mismanagement or forward-looking statements protected by the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, the court found plaintiffs' claims were not based solely on the underlying failures of VEON's internal controls to detect and prevent FCPA violations. Instead, the company's own admissions in the deferred prosecution agreement and based on its own internal investigation confirm "that management knowingly failed to implement adequate controls governing due diligence, contract approval, and internal audit, and, at the time, was aware that its internal controls were not effective."10 Accordingly, plaintiffs adequately alleged that defendants' statements and Sarbanes-Oxley certifications regarding the existence and sufficiency of FCPA controls were false and misleading when made.

As other U.S.-traded companies have expanded into global markets where bribery and corruption are often commonplace if not necessary business practices, government investigations and FCPA proceedings have also increased. In 2015, the SEC brought nine FCPA actions, including against The Bank of New York Mellon, Bristol Myers Squibb, Hitachi, and others, and imposed fines totaling more than $100 million. In 2016, the SEC prosecuted 25 actions and recovered more than $3 billion for FCPA violations. But in 2017, FCPA prosecutions dropped off. The SEC pursued only seven civil enforcement actions and recovered just over $1 billion. Nevertheless, the SEC claims that "[e]nforcement of the [FCPA] continues to be a high priority area."11

However, a recent enforcement policy change may impact the number and frequency of FCPA investigations and proceedings and, by extension, the prevalence and success of follow-on shareholder litigation. Last year, the U.S. Department of Justice announced a "revised FCPA Corporate Enforcement Policy." In announcing the new policy at the 34th International Conference on the Foreign Corrupt Practices Act, Deputy Attorney General Rod Rosenstein explained the new policy was intended to "provid[e] incentives for companies to engage in ethical corporate behavior . . . . [by] fully cooperating with government investigations, and doing what is necessary to remediate misconduct." Among other things, the new policy is intended to incentivize companies to come forward and self-report. "Good corporate behavior also means notifying law enforcement about wrongdoing." In exchange, companies would be rewarded with leniency and potential "declination" meaning the Department would formally decline to prosecute.

The revised policy has three key features. First, when a company voluntarily discloses potential violations, cooperates fully with the government's investigation, and takes timely and appropriate remediation steps, "there will be a presumption that the Department will resolve the company's case through a declination. That presumption may be overcome only if there are aggravating circumstances related to the nature and seriousness of the offense, or if the offender is a criminal recidivist."

Next, if the company satisfies all requirements for presumptive declination, but "aggravating circumstances" nevertheless warrant an enforcement action, the company may be eligible for a 50% reduction off the low end of the Department's fine range.

Third, the new policy gives the Department flexibility in determining the sufficiency of a company's compliance program based on the company's size and resources.12

It is still too early to tell whether the Department's revised FCPA Corporate Enforcement Policy will spur companies to voluntarily self-report and fully cooperate with government investigations. Since the policy was adopted late last year, the Justice Department has announced no new FCPA investigations or proceedings. Similarly, it is too early to understand what effect, if any, the new policy may have on shareholder litigation. Will self-reporting, full cooperation in government investigations, and robust remediation become tantamount to an admission of wrongdoing? Such facts would surely strengthen shareholder claims that the company's failure to design and implement appropriate compliance programs in the first instance harmed shareholders. On the other hand, the government's declination may bolster corporate arguments in defense of such claims.