Five more compliance triumphs of 2024

For many subscribers to Compliance Week, positive enforcement outcomes are few and far between. There’s a reason regulatory agencies investigate, and most often it’s because of misconduct that went unchecked. For those companies, a big lump of coal can be expected in their stocking this Christmas in the form of reputational damage, lost revenue, and increased compliance costs.

In a business climate in which compliance is a cost center and often considered “the department of ‘no,’” companies that don’t brush misconduct under the rug and own up to their mistakes should be celebrated.

These compliance wins often go on behind the scenes, without much fanfare. Namely because finding workers with integrity and honor isn’t as easy as you think.

For companies searching for their ethical mensch, here are five more compliance triumphs from 2024:

MilliporeSigma

The Department of Justice (DOJ) has been telling companies for a while that voluntary self-disclosure is the way to receive leniency.

In May, “extraordinary cooperation” earned MilliporeSigma, a Massachusetts-based biochemical company and a subsidiary of Merck, the first-ever corporate declination under the DOJ National Security Division’s voluntary self-disclosure program.

The company’s prompt disclosure helped the DOJ foil a “rogue” employee’s scheme to procure and ship discounted products to China using falsified export documents.

Assistant Attorney General Matthew Olsen of the DOJ’s National Security Division said the case “reflects the value for companies like MilliporeSigma to quickly self-disclose potential criminal activity and reaffirms our commitment to work in partnership with the private sector to root out conduct that violates the law and jeopardizes our national security.”

In August, the Commerce Department’s Bureau of Industry and Security used the case as an example in export control guidance for academic research institutions.

SAP

When a company agrees to pay $220 million in penalties and enters into a three-year deferred prosecution agreement (DPA) over recidivist sanctions and FCPA violations across nine countries, it’s usually not considered a “triumph.”

But when the penalty reflects a 40 percent reduction off the 10th percentile above the low end of the DOJ’s sentencing guidelines, and acknowledges noncompliant employees were disciplined under the agency’s compensation clawback pilot program, it certainly becomes noteworthy.

The DOJ’s investigation against German-based software company SAP focused on schemes to pay bribes to government officials in South Africa and Indonesia, while the Securities and Exchange Commission (SEC) said SAP employed third-party intermediaries and consultants to pay bribes to government officials across seven countries: Azerbaijan, Ghana, Indonesia, Kenya, Malawi, South Africa, and Tanzania.

Held against the company were its settlements with the DOJ and other agencies in April 2021 for admitted Iran sanctions violations and with the SEC in 2016 over alleged FCPA violations in Panama.

SAP told Compliance Week in January it “separated from all responsible parties” now nearly six years ago and has since “significantly enhanced its global compliance program and related internal controls.”

Acting Assistant Attorney General Nicole Argentieri of the DOJ’s Criminal Division said at the time the case demonstrates how the agency’s corporate enforcement policies “incentivize companies to be good corporate citizens” and remediate criminal misconduct.

Kiromic BioPharma

When allegations came to light from two anonymous complaints filed on Houston-based Kiromic BioPharma’s whistleblower hotline, the company took the allegations seriously. So seriously it led to SEC charges and fines against the company’s chief executive officer and chief financial officer. The company, however, walked away without a fine.

Earlier this month, Kiromic self-reported material omissions related to Federal Drug Administration holds on two cancer drugs that raised $40 million from investors.

In response to the whistleblower complaints, the company’s board formed a special committee of independent directors and hired outside counsel to investigate. The probe confirmed that the FDA had placed holds on the clinical trials in June of 2021, and that the company had not disclosed that fact to investors.

Following the investigation, the board appointed an interim CEO “who received training on appropriate disclosure controls and procedures,” the SEC said. The board also established a disclosure committee comprised of management and appointed two new independent directors to the board.

Whistleblowers

In February, a significant ruling by the Supreme Court of the United States (SCOTUS) reaffirmed protections for whistleblowers guaranteed under the Sarbanes-Oxley Act.

While there have been other SCOTUS rulings this year that have spurred consternation in compliance circles, namely the Chevron doctrine and SEC in-house tribunals getting nixed, the court decided protecting whistleblowers is a priority.

In the case, Murray v. UBS Securities, the court said whistleblowers don’t have to prove they were terminated because of “retaliatory intent”–a decision expected to set a precedent that impacts all corporate internal reporting cases in favor of whistleblowers.

The Supreme Court argued the appeals court erred by “making proof of ‘retaliatory intent’ a requirement.” Instead, the “actionable discrimination” of a whistleblower was the real burden of proof, in the court’s opinion.

Robert Herbst, Murray’s lead trial attorney and counsel of record in the Supreme Court, called the decision “a significant victory across the board” for whistleblower protections, whether it be at the corporate level, governmental, or nongovernmental.

Boston Consulting Group

Prompt cooperation is always good, but not always enough to earn a DOJ declination.

For Boston Consulting Group (BCG), the company avoided criminal prosecution for FCPA violations related to $4.3 million given to secure contracts in Angolan by terminating personnel involved in the misconduct with “compensation-based penalties.”

This included requiring implicated BCG partners in Portugal to give up their equity in the company, denying financial transition benefits, and withholding bonuses.

The DOJ listed seven other reasons for not prosecuting BCG, including “significant improvements to its compliance program and internal controls,” along with “formalizing employee training and vendor/client screening protocols, establishing local and global risk committees that meet regularly, and developing guidelines for opening offices in new and emerging markets,” a letter by Glenn Leon, chief of the DOJ’s Fraud Section, to BCG’s attorneys, stated.

BCG has since closed its office in Luanda, Angola, according to a statement, and is committed to strengthening internal controls, scaling up its risk and compliance function, and improving its systems and technology.