2019 has been an eventful year for anti-corruption compliance in Russia with an extension of enforcement actions against companies, the strengthening of anti-corruption laws and new domestic compliance requirements. The crucial developments for companies are summarised below:

Investigation of large-scale bribery. Until recently, it was one of the peculiarities of Russian enforcement practice that companies were prosecuted almost exclusively for small and mid-scale bribery[1]. Recent cases indicate that Russian enforcement actions, finally, may extend to more severe offences as well: To date, ten convictions of companies for large-scale or extra large-scale bribery with penalty payments of RUB 20 million (EUR 290,000) or more have been disclosed in 2019 – compared to only four cases in the whole of 2018. While the disclosed maximum penalty in 2018 was RUB 30.5 million, the current year has already seen a penalty payment of RUB 50 million (EUR 700,000)[2].

Punishment of bigger companies. Until recently, Russian authorities also used to look the other way when bribery offences were committed by bigger companies. This may change now as well: In July 2019, AO Russian Standard Bank, which is among Russia’s 200 largest companies according to Forbes Russia[3], had to pay a penalty of RUB 26.5 million (EUR 380,000) for bribing bailiffs in Crimea in order to speed up enforcement proceedings against defaulted debtors[4]. This is the first time that a large Russian bank has been convicted for bribery in Russia.

Foreign companies in focus. Also foreign companies so far were mostly exempted from prosecution for bribery[5]. There could be a change of political course now: Legislative changes entering into force in December 2019 provide for an extension of the investigation term to up to twelve months in cases where international judicial assistance is required[6]. The express purpose of this extension is to prosecute foreign companies for bribery[7]. The question arises whether this is only a symbolic reaction to foreign enforcement actions against Russian companies (e.g. the punishment of MTS by U.S. authorities[8]) or whether foreign companies will now indeed be targeted by domestic investigations.

Extended scope of corporate liability. As in previous years, the legislator has strengthened anti-corruption laws. In particular, legislative changes which entered into force in February 2019 closed gaps in the liability of companies for bribery: Bribery became equally punishable if it was committed for the benefit of related companies. The changes also clarified that bribery includes payments to third parties designated by the bribe taker to receive the bribe[9]. At the same time, the rather questionable initiative provided by the National Anti-Corruption Plan for 2018 to 2020, according to which anti-corruption rules may not apply in certain cases of "force majeure"[10], currently seems to be on hold.

Scope of anti-corruption measures. Considering the increased liability risks for companies, implementing a compliance management system in accordance with the Russian requirements is becoming more important. Based on the mandatory requirement of the Russian Anti-corruption Law to take anti-corruption measures[11], in September 2019 the Russian Labour Ministry again issued detailed recommendations for their implementation[12]. However, also in 2019 authorities and courts failed to answer the decisive question: to what extent the implementation of these measures may exempt companies from liability, or reduce their liability, in a specific bribery investigation.

First self-reporting cases. Court practice from 2019 for the first time allows an assessment of how the new self-reporting rules for corporate bribery which were introduced in August 2018[13] work in practice. Due to the current restriction of enforcement actions to smaller bribery cases, none of the available court decisions deals with the reporting of large-scale bribery. However, these cases confirm that self-reporting may generally be an option to exempt companies from liability[14]. At the same time, given the general concerns regarding reliable cooperation with Russian authorities, the benefits and risks of self-reporting should be calculated in each individual case.

No whistleblower protection. In June 2019, the legislative initiative aimed at the protection of whistleblowers in corruption cases ultimately failed[15]. The draft law, which had been adopted at the first reading in December 2017, provided for comprehensive rights of whistleblowers, and responsibilities of employers and law enforcement authorities. Since August 2018, Russian authorities have been authorised to pay whistleblowers rewards which may exceed RUB 3 million (EUR 40,000)[16]. However, rewards alone will hardly suffice to incentivise whistleblowing. Russia’s fight against corruption is therefore further falling behind the EU, which adopted their Whistleblowing Directive in October 2019 and Ukraine, in which a comparable whistleblower law will enter into force next year[17].

Restricted cross-border data transfer. Finally, foreign companies which have integrated their Russian subsidiaries into group-wide compliance procedures may now face additional difficulties. These are caused by fines for violations of Russian data localisation rules of up to RUB 18 million (EUR 250,000) which were introduced in December 2019[18]. These fines could also apply to whistleblower channels from Russia abroad and data transfers during corporate investigations. In these cases, group-wide procedures may have to be adjusted. Another legislative initiative of May 2019 proposing the punishment of individuals for cross-border data transfers potentially leading to new anti-Russia sanctions seems to be less critical[19]. To date, none of the draft laws against sanctions compliance in Russia has become law.