SAPIN 2 LAW Anti-corruption provisions How to prepare

Transcription

1 Clifford Chance Europe LLP 9 November 2016 SAPIN 2 LAW Anti-corruption provisions How to prepare On 8 November 2016, the French National Assembly adopted a law dealing with transparency, the fight against corruption and the modernization of economic life, called 'Sapin 2'. The law requires large French companies and groups to take measures to prevent and detect acts of corruption and influence peddling committed in France or abroad. The anti-corruption provisions (article 17 of the law) will come into effect the first day of the sixth month following its enactment, therefore from 1 May 2017 or from 1 June 2017, depending on the date of enactment. The law also requires companies with more than 50 employees to put in place a system to monitor and collect information as part of the anti-corruption measures provided for by the law. Subject to review of the law by the Constitutional Council (which it will probably pass), affected companies and groups should begin to prepare for the new rules as soon as possible. Our Investigation and Compliance team has prepared this briefing with the aim of assisting clients in this exercise. The anti-corruption provisions of Sapin 2 (article 17) Which companies are affected? Commercial businesses or public industrial and commercial bodies: with at least 500 employees, or belonging to a group of companies which has at least 500 employees and parent company headquarters in France; and having a turnover, or consolidated group turnover, of more than 100 million Euros. The provisions apply equally to a parent company, its subsidiaries, and companies it controls within the meaning of article L of the French Commercial Code. A parent company can implement the anti-corruption measures required by Sapin 2 for the whole group. In this case, the subsidiaries and controlled companies are deemed to have satisfied their obligations in respect of the law.

2 Which persons are responsible for implementing the Sapin 2 anti-corruption measures? Depending on the entity's corporate structure, the following persons are responsible for implementing the anti-corruption provisions of article 17 of Sapin 2: Corporate structure Limited company (SA) Simplified limited company (SAS/SASU) Limited Liability Company (SARL/EURL) Company limited by shares (SCA) General Partnership (SNC) Individual responsible The President, the Directors, the Executive Committee The President, the Directors (as the case may be) Manager Manager Manager The above individuals are those responsible in the first instance in respect of the obligations imposed by article 17 of the law. In the event of default, they face a personal fine (administrative in nature, rather than criminal) of up to 200,000 Euros. Legal entities, which can equally be held liable, face a fine of up to 1 million Euros. Can this responsibility be subject to a delegation of power? Nothing would seem to prevent managers delegating their power and responsibility to employees, in particular the compliance officer. The delegation of power must meet legal requirements in order to be effective. What does the law require as regards to the code of conduct to be established by the company? The law requires the company to establish a code of conduct to prevent corruption. It must contain, a minima, a clear and accessible definition for all employees as to the different types of behaviour which are prohibited as potentially constituting acts of corruption or influence peddling. This covers active and passive corruption (and influence peddling), the public and private sector, and the domestic and international level. The code of conduct should also include examples to illustrate these behaviours. Where possible, these examples should be adapted to the operational reality of the company. The code of conduct should form an integral part of the internal company rules. It should therefore (i) be subject to a Works Council consultation (after notifying, if applicable, the committee for health and safety and working conditions), (ii) be sent to the labour inspectorate and filed with the labour tribunal having jurisdiction over the company in question, and (iii) be displayed in the company's premises. A whistleblowing system should be put in place allowing employees to report the existence of behaviour or situations contrary to the code of conduct.

3 Clifford Chance Europe LLP 9 November 2016 How to align the code of conduct with your company's existing anti-corruption measures? If the company already has a code of conduct or anti-corruption measures, these should be reconciled with the Sapin 2 requirements mentioned above. This includes conducting a 'gap analysis' and ensuring that the code is integrated into the company's internal rules. What is the whistleblowing system to be implemented? The law requires the implementation of an internal whistleblowing system that enables employees to signal the existence of behaviours or situations which violate the code of conduct. It is therefore necessary to specifically include code of conduct violations, which is to say acts of corruption and influence peddling, within the remit of the whistleblowing system, as is required by article 8 of the law. This system should conform with the wider measures provided for by article 8 of the law, as described in more detail below. What is the risk map required by the law? The law requires the implementation of a risk map for corruption. Under the law, the risk map is a document, regularly updated, which identifies, analyses and prioritises, the risks of those external interactions which expose a company to corruption, notably according to the sector and geographic area in which the company operates. To this end, the risk map must, a minima: identify risk factors (notably operational) pertaining to the company's activities, the geographic location of those activities, its interaction with public figures, and use of intermediaries; assess the identified risks both in terms of prevalence and seriousness; assess the impact of existing preventative measures on these risks; assess the residual risks and determine whether additional preventative measures are necessary. The method of implementation and the degree of sophistication of the risk map depends on the size and complexity of the company in question, as well as the nature of its activities. It should therefore be adapted on a case-by-case basis. The map should be updated regularly and in line with the evolution of the company (takeover, change of commercial strategy, new markets ) What are the assessment procedures required for clients, major suppliers and intermediaries used by the company? The law requires the implementation of assessment procedures for clients, major suppliers, and intermediaries.

4 This involves due diligence which aims to ensure that suppliers, major clients and intermediaries used by the company do not present a corruption risk. This process requires each client, supplier and intermediary affected to transmit, before any business relationship is established, all information necessary to confirm its integrity and probity in order that the company does not participate, via these intermediaries, in any criminal practices. The due diligence may be conducted through questionnaires, audits of publically available information or outsourced to specialist companies, and primarily involves: Identification of shareholders and economic beneficiaries of the business partner; Checks on the good standing of the business partner (ongoing investigations, past convictions, reputation ); Assessment of any anti-corruption measures already implemented by the business partner; Analysis of potential 'red flags' (an offshore account or corporate structure, lack of transparency, association with politically exposed persons ); The capacity of the business partner to take steps to prevent corruption These procedures will be more or less extensive depending on the results of the company's risk map analysis and any country-specific risks. The new French anti-corruption Agency will probably issue guidelines clarifying the extent of the due diligence to be undertaken. What are the accounting controls required by the law? The law requires the implementation of accounting control procedures, internal and external, designed to ensure that the company's books, registers and accounts are not used to disguise corruption or influence peddling. These accounting controls should primarily ensure that, beyond applicable accounting principles, (i) bills for goods and services performed by the company are legitimate and proportionate to their value and contractual description, (ii) expenses are paid in accordance with specific rules and authorisations, (iii) cash payments are limited in amount, above which specific authorisation is required. Specific account audits designed to detect corruption risks can also be undertaken. These obligations invite companies to include financial management within their wider project of anticorruption, alongside being a legal and compliance exercise. What training should be put in place? The law requires the implementation of a training program to prevent corruption and influence peddling. This training is intended for those executives and staff most exposed to these risks, which can primarily be identified using the risk map. Generally, this includes management, buyers, sellers and those staff in contact with public figures. This training is essential to implement an ethical working culture within the company, especially at the operational level.

5 Clifford Chance Europe LLP 9 November 2016 The law is silent as to the specific content of the training. However, it should cover the principles of integrity upheld by the company, the risks created by criminal practice, the internal rules regarding prevention of corruption, available anti-corruption IT resources, the applicable process, the individuals responsible for compliance, and the whistleblowing system. The training should be bolstered through practical examples and role-play scenarios. How to establish a disciplinary regime tackling code of conduct violations? In legal terms, the code of conduct is integrated into the company's internal rules. As such, compliance is obligatory for employees. All code of conduct violations therefore give rise to punishment according to the normal disciplinary procedure and punishment scale established by the internal company rules. What monitoring of the anti-corruption measures should be implemented? The law requires affected companies and groups to implement an internal system of control and evaluation to identify and prevent corruption. Any compliance program should be responsive and therefore periodically re-evaluated. Audits should be carried out regularly in order to test the efficiency of the system. For example, these audits may ensure the effectiveness of the procedures in place and the adherence of employees with the compliance rules imposed by the system. Apart from these regular audits, companies must also ensure that their compliance program evolves with developments in the company. For example, a change in strategy, increasing external growth, or entry into new markets all pose new risks and anti-corruption measures would need to be reevaluated. Who is responsible for implementing the measures and procedures described above? The law creates a new French anti-corruption agency (the "Agency"), aligned with the Minister for Justice and the Minister for the Budget, which is charged with: Developing recommendations to help companies implement measures to prevent corruption and influence peddling, extortion, 'illegal taking of interest', misappropriation of public funds, and favoritism. These recommendations, to be regularly published in the Official Journal, should be adapted to the size and risk-level of the companies; they will likely be issued shortly after the creation of the Agency. Monitoring company compliance with the above mentioned measures and procedures. In this context, it has the right to access all documents and information held by affected companies which are relevant to its mission. It can also conduct site visits (although without coercive powers) and interview people who may hold relevant information.

6 The Agency, whose precise operational remit is to be established by State Council decree, will replace the current Central Anti-Corruption Service (Service Central de Prévention de la Corruption) (SCPC). In case of a violation of the law, the Agency can: (i) issue a warning to the company representatives, (ii) refer the issue to its sanctions commission. The Agency's sanctions commission, after giving the accused person the chance to state their case, can: Issue an injunction obliging the company's representatives to adapt their anti-corruption and detection procedures in line with the Agency's recommendations within no more than three years; Impose a financial penalty proportionate to the seriousness of the violation and the financial situation of the company, of no more than 200,000 Euros for individuals and 1 million Euros for legal entities; Order the publication, distribution or display of the injunction or financial penalty. Will the new Agency also have powers to pursue acts of corruption? No, the Agency only has authority to monitor, and where applicable, punish violations of Sapin 2 - not any corruption itself which might be revealed in the course of carrying out these duties. Nonetheless, in that situation the Agency, acting through its director, would have a duty to report the corruption to the public prosecutor, who could launch investigations.

7 Clifford Chance Europe LLP 9 November 2016 The provisions relating to whistleblower protection (articles 6 to 16) Which companies are affected? Companies with more than 50 employees will have to organize the reporting and alert processes for whistleblowers, which can include its employees as well as external and/or occasional partners. External and/or occasional partners could include, according to parliamentary debates, contractors, sub-contractors, suppliers, interns What is the definition of "whistleblowers" under the law? Under the law, whistleblowers are defined as : An individual, who reports, without ulterior motive, and in good faith, a fact that he/she has personally become aware of. The scope of reporting includes: A crime or an offense, A serious and blatant violation of France's international commitments, or unilateral acts made by an international organization applicable to France, the violation of a law or a regulation, a threat or serious prejudice against the general interest. The law excludes the reporting of facts, information and documents which are classified as top secret ("secret défense") or covered by the physician-patient privilege and/or the attorney-client privilege. What are the reporting steps under the law? Under the law, the alert must first be reported to the whistleblower's direct or indirect manager, or to a person that is specifically designated by the company to receive such whistleblower alerts (such as, for example, a compliance officer). If there is no follow-up within a reasonable time, then the whistleblower can report the alert directly to the competent authorities, i.e. judicial, administrative or professional authorities. As a last resort, if the above-referenced authorities do not follow-up on the alert within three months, then the whistleblower can make the alert public. According to the law, compliance with the reporting procedure is considered as an element of good faith. In other words, the above-stated steps must be respected by the whistleblower in order to benefit from the protection provided to whistleblowers under the law. Nevertheless, the law provides

8 for one exception to the reporting procedure: in the event of serious and imminent danger, or in the event of an irreversible risk, the alert can be directly reported to the judicial or professional authorities. It can also be made public "depending on the predominant public interest in knowing this information, the authenticity of the information, the risk of damage from its advertising, and in terms of the motivation of the person revealing the information." What are the applicable confidentiality rules under the law? Under Sapin 2, the reporting procedure must guarantee the strict confidentiality of (i) the whistleblower's identity (including any information that could facilitate his/her identification), (ii) individuals concerned by the facts alleged in the alert and (iii) information collected by the receivers of the alert. Any violation of this confidentiality obligation is punished by two years of imprisonment and up to Euros in fine. Companies are therefore required to develop strict confidentiality rules that will guide those employees who receive a whistleblower alert, and/or those in charge of the follow-up and traceability of information. What are the applicable rules with respect to anonymous whistleblowers? The law is silent on this point. It therefore does not restrict or prohibit anonymous alerts. It should be noted that as regards whistleblowing in general, the CNIL states that a company should not encourage anonymity. However, the CNIL also acknowledges that anonymity can be preserved in exceptional circumstances where (i) the severity of the facts at hand is established and these facts are sufficiently detailed, and (ii) responding to the alert is subject to special precautions such that the first recipient of the alert makes a judgment as to the appropriateness of revealing it in the context of the whistleblowing program. How are whistleblowers protected under the law? The law provides for standard anti-retaliation provisions protecting whistleblowers against any action that could jeopardize his/her professional evolution (hiring, access to information, disciplinary sanctions, discrimination, remuneration, assignment ). The law also provides for a reversed burden of proof in the event of litigation. So long as the whistleblower can demonstrate his/her good faith in reporting an alert, the employer will have the burden of proof to demonstrate that the decision to report the alert is justified by objective reasons unrelated to the alert. Subject to certain conditions, the Defender of Rights can give financial aid to the whistleblower in the form of an advance on costs incurred. Finally, the law provides for an "offense of obstructing the report of an alert," punishing any individual who obstructs the reporting of an alert by one year's imprisonment and a fine of up to 15,000 Euros.

9 Clifford Chance Europe LLP 9 November 2016 What steps to be taken regarding personal data under the law? Currently this is just a prospective analysis but the following major principles should apply: Steps vis-à-vis the CNIL : The CNIL could make a demand for access to the personal data in question (i.e. of both the whistleblower and the subject of the alert). Could this authorization be obtained as part of a simplified procedure for so-called 'single authorization' (as is the case for certain whistle blowing schemes within the scope of the single authorization AU-004)? This could be confirmed in due course by a resolution of the CNIL. Personal information of those concerned : Whistleblowers as well as those they report should be given clear and complete information as regards the treatment of their personal data in accordance with the law n of 6 January 1978, as amended (e.g. the identity of the person controlling the data, purpose of the alert process, recipients of the alert, any right to access and correction). Since the entry into force of Law No for a digital Republic on 7 October 2016, the persons concerned must also be informed of the duration that their personal data will be retained, or if this is not possible, the criteria used to determine this duration. Meeting this requirement could be onerous for businesses. More specific information might also need to be given (e.g. the voluntary nature of whistle blowing, or any transfer of data outside the European Economic Area, if such a transfer would be permitted by the law). What are the steps to follow with respect to staff representative bodies? Aside from procedural steps before the CNIL, both the Work Council and the committee for health and safety and working conditions should be informed and consulted prior to the establishment of a whistleblower program. In addition, the company must inform each employee individually before setting up a whistleblower program. Although the law does not provide for any specific conditions when making individual notifications, the company must preserve all proof that such notifications were effectively made. As such, it is recommended for companies to use platforms that can preserve and demonstrate that individual notifications were effectively made (letter with acknowledgment of receipt, letter delivered by hand against receipt, with acknowledgment of receipt and/or read). In addition, potential users, primarily the employees, must also receive clear and comprehensive information with respect to the whistleblower program. 1 1 Délib. Cnil n , 8 Dec., art. 8

10 Lastly, the whistleblower program must be included in the company's code of conduct, and fully integrated into the company's internal procedures. Thomas Baudesson Avocat à la Cour T: E: Charles-Henri Boeringer Avocat à la Cour T: E: