Friday Roundup
Former SEC FCPA Unit Chief Kara Brockmeyer on declinations and voluntary disclosure, Wal-Mart’s global chief ethics and compliance officer on increased standardization in global anti-corruption efforts, scrutiny updates, French first, and for the reading stack.
It’s all here in the Friday Roundup.
Former SEC FCPA Unit Chief Kara Brockmeyer On Declinations and Voluntary Disclosure
Brockmeyer is profiled in this recent Corporate Crime Report Q&A. (See here for a recent FCPA Flash podcast with Brockmeyer).
Fresh Off Its 2016 FCPA Enforcement Action, SAP Is Again Under FCPA Scrutiny
As highlighted in this previous post, in February 2016 SAP (a German company with American Depository Shares registered with the SEC) resolved an FCPA enforcement action based on conduct in Panama. Without admitting or denying the SEC’s finding’s in an administrative order the company agreed to pay approximately $3.9 million and the SEC ordered the company to cease and desist from committing or causing any violations and any future violations of the FCPA’s books and records and internal controls case.
Fresh off this 2016 FCPA enforcement action, SAP is again under FCPA scrutiny.
Issues To Consider From The SAP Enforcement Action
Coming in at a “mere” $3.9 million settlement, this week’s SAP enforcement action will not make anyone’s list of “significant” enforcement actions.
Yet, as highlighted in this post, the enforcement action raises several significant (and alarming) issues.
Sole Actor
In the minds of some, rogue employees are figments of the corporate apologists imagination and no enforcement action has ever been based on the conduct of just one individual.
This has always been an off-target observation and the SAP action is yet another example of a company being the victim of a rogue employee (technically the individual was not even an employee of SAP, but rather a subsidiary company).
As stated by the SEC, SAP has 272 subsidiaries, its business is conducted through a network of more than 11,500 partners that provide an additional workforce of 280,000 individuals. The SAP enforcement action was based on the conduct of Vicente Garcia and set forth below in pertinent part is what the SEC found.
- Garcia “created a slush fund” that was used to pay the bribes and kickbacks
- Garcia “concealed his scheme from others at SAP”
- Garcia “circumvented SAP’s internal controls”
- Garcia “justified the excessive discounting by falsifying SAP’s internal approval forms”
- Garcia “self-profited through kickbacks”
- Garcia used his “personal e-mail” in connection with the scheme
- All of Garcia’s accomplices were “others outside of SAP” (a term used by the SEC multiple times)
Ineffective Internal Controls?
Notwithstanding the above, in the perfect hindsight driven, would have, could have, should have world in which the SEC’s resides, the SEC states that SAP’s “deficient internal controls” “allowed” Garcia to engage in the improper conduct.
When analyzing whether SAP had “reasonable” internal controls (the statutory standard after all) consider the following SEC statements.
- “In June 2009, SAP conducted an internal investigation and found that Garcia violated its internal Code of Business Conduct when he invited an executive of Petroleos Mexicanos (“PEMEX”), the Mexican national oil company, to an SAP marketing event at the Monaco Grand Prix. SAP did not find any attempt to improperly influence any government official in connection with the 2008 PEMEX sale. As a result of the internal investigation, SAP revised its policies prohibiting government officials or employees from attending any “hospitality” event, which it defined as any event where business constitutes less than 80% of the event.”
- “One of the four contracts was a software license sale to the Panamanian social security agency, which was initially proposed to be a direct sale with the assistance of local partners. In order to facilitate the bribery scheme, the existing partners were replaced with a new local Panamanian partner. This last-minute change, and other red flags, triggered an SAP compliance review which resulted in SAP rejecting Garcia’s request to pay a commission to the local partner. Therefore, Garcia and others began looking for other ways to advance the bribery scheme. Finally, in the fall of 2010, Garcia finalized an indirect sale of the software license to the agency through the local partner, who, with Garcia’s assistance, ultimately sought and obtained an 82% discount on SAP’s sale price to the local partner. Garcia caused various approval forms to be submitted that misstated the reasons for the large discount. Garcia stated that the discounts were necessary to compete with other software companies in establishing a relationship with the government of Panama when, in fact, the discounts were necessary to fund and pay bribes to government officials. Garcia and others planned to sell SAP software to the local partner at an 82% discount, who in turn would sell the software at significantly higher prices to the Panamanian government and use part of the profits from the sale to pay bribes.
- The underlying activity which SAP was faulted for in the enforcement action – large customer discounts – was something “SAP routinely” provided to “local partners for legitimate reasons.”
Based on the above SEC findings, the SAP enforcement joins prior FCPA enforcement actions against Oracle and H-P (also technology companies) as being truly alarming. (See this prior post highlighting how the former Assistant Chief of the DOJ’s FCPA Unit blasted various aspect of SEC FCPA enforcement including in the Oracle action – observations which equally apply to the SAP action).
What makes the enforcement actions alarming is not only the key statutory language of “reasonable,” but also prior SEC enforcement agency guidance. As highlighted numerous times on these pages, the most extensive SEC FCPA guidance states as follows.
“The test of a company’s internal control system is not whether occasional failings can occur. Those will happen in the most ideally managed company. But, an adequate system of internal controls means that, when such breaches do arise, they will be isolated rather than systemic, and they will be subject to a reasonable likelihood of being uncovered in a timely manner and then remedied promptly. Barring, of course, the participation or complicity of senior company officials in the deed, when discovery and correction expeditiously follow, no failing in the company’s internal accounting system would have existed. To the contrary, routine discovery and correction would evidence its effectiveness.”
No-Charged Bribery Disgorgment
The SAP enforcement action is the latest example of the SEC ordering disgorgement even though the offending company was not charged with violating the FCPA’s anti-bribery provisions.
As highlighted in this previous post, so-called no-charged bribery disgorgement is troubling.
Among others, Paul Berger (here) (a former Associate Director of the SEC Division of Enforcement) has stated that “settlements invoking disgorgement but charging no primary anti-bribery violations push the law’s boundaries, as disgorgement is predicated on the common-sense notion that an actual, jurisdictionally-cognizable bribe was paid to procure the revenue identified by the SEC in its complaint.” Berger noted that such “no-charged bribery disgorgement settlements appear designed to inflict punishment rather than achieve the goals of equity.”
2016 FCPA Enforcement Begins With SEC Action Against SAP
When Vicente Garcia (a former head of Latin American sales for SAP) resolved a parallel DOJ / SEC FCPA enforcement action in August 2015 (see here for the prior post), the question remained: would there also be a Foreign Corrupt Practices Act enforcement action against SAP?
Yesterday, the SEC answered that question in the affirmative by announcing an enforcement action against SAP (a German company with American Depository Shares registered with the SEC).
The SAP action is the first FCPA enforcement action of 2016.
Based on the same core conduct alleged in the prior Garcia action, SAP, without admitting or denying the SEC’s finding’s in an administrative order, agreed to pay approximately $3.9 million.
In summary fashion, the order states:
“This matter concerns violations of the books and records and internal controls provisions of the FCPA by SAP SE (“SAP”), a European Union corporation headquartered in Waldorf, Germany. The violations occurred due to deficient internal controls, which allowed SAP’s former Vice-President of Global and Strategic Accounts, Vicente E. Garcia, to discount the software price to a former SAP local partner at a level sufficient to permit Garcia and the local partner to pay $145,000 in bribes to one senior Panamanian government official, and offer bribes to two others. Through these bribes, Garcia secured government sales contracts of approximately $3.7 million for SAP, and also self-profited through kickbacks. By excessively discounting the SAP software, Garcia created a slush fund that the partner used to pay the bribes and kickbacks. Garcia concealed his scheme from others at SAP, circumvented SAP’s internal controls, and justified the excessive discounts by falsifying SAP’s internal approval forms.”
“The deep discounts that Garcia used to create the slush fund were falsely recorded as legitimate discounts on the books of SAP’s Mexican subsidiary, which were subsequently consolidated into SAP’s financial statements. In addition, SAP failed to devise and maintain an adequate system of internal accounting controls sufficient to provide reasonable assurances that these improper payments to government officials did not occur.”
According to the order:
“Garcia, as a senior vice-president of SAP responsible for sales in Latin America, used his knowledge of the availability of discounts to push through large discounts in order to create a slush fund from which the local partner was able to pay the bribes. SAP routinely provides large discounts to local partners for legitimate reasons that Garcia used to justify the illegitimate discounts. Once Garcia obtained approval of the discounts based on his falsified justification forms, the bribes were then paid from the local partner.”
[…]
As a result of Garcia’s conduct in the bribery scheme, SAP, with its local partner, was able to sell software to the Panamanian government through four contracts from 2010 to 2013. These contracts generated revenues of approximately $3.7 million to SAP.
The deep discounts that Garcia used to create the slush fund were falsely recorded as legitimate discounts on the books of SAP Mexico, which were subsequently consolidated into SAP’s financial statements.”
Under the heading “SAP’s Insufficient Internal Controls,” the order states:
“SAP lacked adequate internal controls to ensure that discounts to local partners were not improperly used. SAP’s system required employees to electronically submit requests within SAP to obtain approval of discounts to local partners. SAP employees, however, had wide latitude in seeking and approving discounts to local partners, and employees’ explanations for the discounts were accepted without verification. There were also no requirements for heightened anti-corruption scrutiny for large discounts. Garcia was therefore able to evade the basic approval procedures by taking advantage of his position and his knowledge of how discounts were approved. Furthermore, the nature of Garcia’s reporting structure made it easy for him to implement the bribery scheme. Although Garcia was located in Miami and employed by SAPI, he variously reported to supervisors employed by other regional subsidiaries and used employees from other subsidiaries such as SAP Mexico to execute the sales to the Panamanian government. This indirect reporting structure at SAP created gaps in supervising Garcia that provided him the opportunity to use the large discounts for creating a slush fund for bribes. Because of the deficient controls, Garcia was able to provide the partner with deep enough discounts to enable him to implement the bribery scheme, which continued unabated for over four years.”
Based on the above findings, the order finds that SAP violated the FCPA’s books and records and internal controls provisions.
Without admitting or denying the SEC’s findings, SAP agreed to pay disgorgement of $3.7 million “representing ill-gotten gains received in connection with the bribery scheme” and prejudgment interest of $188,896.
Under the heading “SAP’s Cooperation and Remediation,” the order states:
“When SAP learned of the conduct as a result of the SEC’s inquiry, SAP conducted a thorough internal investigation and extensively cooperated with the SEC’s investigation by, among other things: (i) conducting an internal investigation; (ii) voluntarily producing approximately 500,000 pages of documents and other information quickly, identifying significant documents and translating documents from Spanish; (iii) conducting witness interviews, sharing Power-Point presentations and timelines; (iv) facilitating an interview of Garcia at work at SAPI offices in Miami without alerting him to the investigation into his conduct; and (v) initiating a third party audit of the local partner.
After being alerted to Garcia’s misconduct, SAP terminated Garcia and undertook remediation efforts to uncover any other possible misconduct and to improve its FCPA compliance. Specifically, SAP audited all recent public sector Latin American transactions, regardless of Garcia’s involvement, to analyze partner profit margin data especially in comparison to discounts so that any trends could be spotted and high profit margin transactions could be identified for further investigation and audit. SAP also implemented new policies and procedures to detect and prevent similar issues from recurring in the future. For example, SAP elevated the status of its Chief Compliance Officer (“CCO”) by having that person now report directly to the CFO, who is a member of the Executive Board, and gave the CCO authority to independently terminate employees and partner contracts. SAP conducted, and continues to conduct, regular anti-corruption training, as well as anti-corruption audits through its internal audit function.
In determining to accept the Offer, the Commission considered remedial acts undertaken by Respondent and cooperation afforded the Commission staff.”
In this release, Kara Brockmeyer (Chief of the SEC’s FCPA Unit) stated: “SAP’s internal controls failed to flag Garcia’s misconduct as he easily falsified internal approval forms and disguised his bribes as discounts.”
According to reports, SAP was represented by Patrick Robbins (Shearman & Sterling).
DOJ / SEC Bring FCPA Enforcement Action Against Former SAP Sales Exec
Yesterday the DOJ and SEC announced (see here and here) a rare joint Foreign Corrupt Practices Act enforcement action against an individual – Vicente Garcia (a U.S. citizen and former head of Latin American sales for SAP – see here for Garcia’s SAP biography).
SEC Action
The SEC brought this administrative cease and desist order against Garcia.
In summary fashion, the order states:
“This matter concerns violations of the anti-bribery, books and records and internal controls provisions of the Foreign Corrupt Practices Act of 1977 (“FCPA”) by Vicente E. Garcia (“Garcia”), a U.S. citizen and the head of Latin American sales for SAP SE (“SAP”), a European Union corporation headquartered in Waldorf, Germany. SAP provides technology solutions and services in approximately 188 countries and has more than 68,000 employees. Garcia and others offered to pay bribes to two government officials, and paid bribes of at least $145,000 to another senior government official of the Republic of Panama in order to secure software license sales of approximately $3.7 million to various government agencies; the sales were recorded initially in the books and records of SAP Mexico and subsequently consolidated into the financial statements of SAP. Garcia circumvented SAP’s internal controls by falsely justifying the discount amount offered to its local partner. In doing so Garcia helped to facilitate the local partner’s ability to generate excess earnings on the final, end-user sale, which earnings were then used to create a slush fund to finance the bribes paid to government officials.”
The order finds as follows.
“From at least June 2009 through November 2013, Garcia, along with others, planned and executed a scheme to offer and pay bribes to three senior government officials of the Republic of Panama in order to obtain approximately $3.7 million worth of software sales by SAP to the Panamanian government. Garcia, in concert with others, paid bribes to one Panamanian government official in the amount of $145,000, and promised to pay bribes to two other government officials, all in contravention of the Foreign Corrupt Practices Act of 1977 (the “FCPA”).
Garcia was SAP’s Vice-President of Global and Strategic Accounts, responsible for sales in Latin America from February 2008 until April 2014, when SAP requested that he resign for his misconduct discussed herein. Garcia was employed by SAPI and worked on large deals all over Latin America using resources and personnel from other SAP subsidiaries including SAP Mexico.
SAP, through its 272 subsidiaries, sells software licenses and related services to 263,000 customers in 188 countries. SAP’s global business is directed and operated from its headquarters in Waldorf, Germany and executed through its numerous subsidiaries. Approximately 15% of SAP’s sales are directly to the customer. The remainder of SAP’s business is conducted through a network of more than 11,500 partners worldwide that provide an additional workforce of 380,000 individuals skilled in SAP software solutions and technology. SAP’s sales using a partner can be either (i) a direct sale to a customer with a sales commission paid to a partner that provides assistance, (ii) an indirect sale through a partner that purchases the software license and resells it to a customer at an independently determined increased price, or (iii) a direct sale to the partner, which acts as a distributor and independently resells the software licenses to customers in the future.
In June 2009, Garcia’s business associate, a Panamanian lobbyist (the “Lobbyist”), informed Garcia about potential software sales opportunities with the government of Panama and that he had an existing relationship with the newly elected government, including a high ranking Government Official A, who was tasked with improving technology solutions across multiple government agencies in Panama and had significant influence over Panama’s software purchasing decisions. Thereafter, SAP began investigating possible software sales to the Panamanian government. Initially this endeavor was led by local SAP sales employees in Mexico. Garcia, however, took over the business opportunity by recommending that SAP designate the Panama government as part of the Premier Customer Network – a group of large, strategically important, regional customers – which Garcia headed.
On February 9, 2010, Government Official A asked in an e-mail whether SAP could send him a letter inviting him to Mexico for “some fictional meetings in order to justify a trip there on Monday and Tuesday of Carnival.” The same day, Garcia acceded to the request and sent an e-mail to Government Official A with an attached fictitious letter on SAP letterhead inviting him “to Mexico City so that you can directly and personally evaluate the benefits that the Government of Mexico has obtained by adopting our products and services.” The letter also included a fictitious itinerary of proposed meetings that never occurred. The next day, on February 10, Garcia sent an e-mail from his personal Yahoo! e-mail account inquiring about possible business opportunities from Government Official A stating: “Any news . . . ? Was the document OK for him? Can you ask him to finalize a deal for us in Feb-March, I need between $5 and $10 million.”
In late February 2010, Garcia and another SAP employee traveled from Miami, Florida to Panama and met with Government Official A and others to discuss business opportunities. Thereafter, in April 2010, Garcia began preparing a proposal to sell approximately $29 million worth of software licenses to the Panamanian social security agency, anticipating that this sale would be the first of multiple deals with various ministries and agencies of the Panamanian government totaling over $100 million. Ultimately, some of these additional sales never materialized and others were smaller than expected.
Garcia and others were informed by the Lobbyist that in order to obtain these contracts from the government of Panama, they needed to bribe three Panamanian government officials that had significant influence in the Panamanian government’s award of contracts to purchase software.
In anticipation of the sales to the government of Panama, Garcia and others began planning the details of the bribery scheme. On June 9 and 10, 2010, Garcia discussed with others, including via e-mail, their plans to pay bribes to Government Official A (2% of the value of the contract) and Government Official B (10%), and receive kickbacks for themselves (2%). Also, on October 26, 2010, e-mails were exchanged with two attached spreadsheets referencing planned payments to Government Officials A and C of approximately $100,000 and $300,000, respectively.
To facilitate payments to Government Official B, the Lobbyist proposed using a sham contract for fictitious services to be provided by Government Official B’s brother-in-law’s company. On June 17, 2010, Government Official A received two draft sham contracts with the stated purpose of having these two back-to-back contracts so that “no trace remains if SAP conducts an audit . . . . I made it as simple as possible and made it look like a real contract.” On June 18, 2010, the Lobbyist e-mailed Garcia an unsigned corrected copy of the proposed consulting agreement, which provided that Government Official B’s brother-in-law’s company would receive “10% (ten percent) for performance of its Services and Consulting duties” relating to all “business opportunities” with the Panamanian government.
On October 19, 2011, the Lobbyist e-mailed a spreadsheet to Government Official C indicating that they would share $274,000 in 2011 and $226,000 in 2012. On January 9, 2013, another business associate of Garcia e-mailed Government Official A stating that Garcia and his business associate had agreed to give Government Official A some of their kickback so that Government Official A could receive a larger “commission” of $150,000. In addition, the business associate confirmed that Government Official A already had been paid $45,000 and acknowledged that $105,000 was still outstanding.
As a result of Garcia’s conduct in the bribery scheme, SAP, with its local partner, was able to sell software to the Panamanian government through four contracts from 2010 to 2013. These contracts generated revenues of $3.7 million to SAP.
One of the four contracts was a software license sale to the Panamanian social security agency, which was initially proposed to be a direct sale with the assistance of local partners. In order to facilitate the bribery scheme, the existing partners were replaced with a new local Panamanian partner. Because SAP refused to pay additional commission to this new Panamanian company, Garcia and others began looking for other ways to advance the bribery scheme. Finally, in the fall of 2010, Garcia finalized an indirect sale of the software license to the agency through the local partner, which, with Garcia’s assistance, ultimately sought and obtained an 82% discount on the sale price. Garcia caused various approval forms to be submitted that misstated the reasons for the large discount. Garcia stated that the discounts were necessary to compete with other software companies in establishing a relationship with the government of Panama when, in fact, the discounts were necessary to pay bribes to government officials. Garcia and others planned to sell SAP software to the intermediary at an 82% discount, who in turn would sell them at significantly higher prices to the Panamanian government and use part of the profits from the sale to pay bribes.
SAP agreed to sell the software licenses for the Panamanian social security agency to the local partner for approximately $2.1 million. In November 2010, the local partner successfully bid $14.5 million for the contract, which was awarded by the Panamanian government on January 31, 2011. Garcia, along with others, planned to pay bribes to Panamanian government officials from the proceeds of the software sale to the government of Panama.
Thereafter, as noted above, between June 2012 and December 2013, the Panamanian government awarded three additional contracts that included SAP software products valued at approximately $13.5 million, which were also sold at deep discounts by SAP to its local partner. For these contracts also, Garcia and others agreed to pay bribes to Panamanian officials from the proceeds of the software sales.
Between April 11, 2012 and August 13, 2013, Garcia and his business associate paid at least $145,000 in bribes to Government Official A. Between December 27, 2011 and October 29, 2012, another Garcia business associate paid Garcia a kickback of approximately $85,965 in his bank account in Florida from the proceeds of the sale of SAP software licenses to the Panamanian government. Thus, Garcia, with the assistance of others, bribed one government official and promised to pay bribes to two other government officials to obtain contracts to sell software to Panamanian government, all in violation of the FCPA.”
Based on the above, the order finds:
“By engaging in the conduct described above, Garcia, as an agent of SAP, violated [the anti-bribery provisions] in connection with the sale of software licenses and other related services to the government of Panama. On behalf of SAP, Garcia participated in structuring the deal as an indirect sale through the local partner, with the understanding that it would act as a conduit to send corrupt payments to several government officials. Garcia, along with others, promised to make bribe payments to two senior government officials and made bribe payments to another government official, all in violation of the FCPA. Garcia used the mails and other means and instrumentalities of interstate commerce to bribe government officials. Garcia used his SAP email account and his personal Yahoo! e-mail account to plan and execute the bribery scheme. In addition, as part of the bribery scheme, Garcia flew from Miami to Panama to meet with government officials and others, and Garcia received $85,965 in “kickbacks” into his bank account in Florida.”
“Garcia knowingly falsified SAP Mexico’s books and records by engaging in a scheme to create a slush fund at the local partner, which was used to pay bribes to Panamanian government officials. Garcia also knowingly circumvented the company’s internal controls to change the sale of the software licenses from a direct sale to the government of Panama to an indirect sale through intermediaries at deep discounts in order to facilitate payments to government officials. Specifically, Garcia justified the deep discounts by falsely claiming in approval forms that the discounts were necessary to beat competitors and obtain entry into the Panamanian market when, in fact, the discounts were necessary to generate funds to pay bribes to government officials. With respect to the leisure trip for Government Official A, Garcia prepared a fictitious letter and itinerary, and even used a personal e-mail account to avoid detection of his corrupt activities. Finally, despite signing SAP’s Code of Conduct prohibiting bribery, he engaged in an elaborate bribery scheme. Accordingly, Garcia violated Section 13(b)(5) of the Exchange Act, and Rule 13b2-1.”
In the SEC release, Kara Brockmeyer (Chief of the SEC’s FCPA Unit) stated: “Garcia attempted to avoid detection by arranging large, illegitimate discounts to a corporate partner in order to generate a cash pot to bribe government officials and win business for SAP.”
As noted in the SEC’s release, the order “finds that Garcia violated the anti-bribery and internal controls provisions of the Securities Exchange Act of 1934. Garcia consented to the entry of the cease-and-desist order and agreed to pay disgorgement of $85,965, which is the total amount of kickbacks he received, plus prejudgment interest of $6,430 for a total of $92,395.”
DOJ Action
Based on the same core conduct described above, in July the DOJ filed this criminal information against Garcia charging conspiracy to violate the FCPA’s anti-bribery provisions. As noted in the DOJ’s release, Garcia pleaded guilty and sentencing is to occur on Dec. 16, 2015.
Note – the plea agreement was filed with the court yesterday but is not publicly available. This post will be updated when the plea agreement is made public.