Special report: legal risk
Top
ten legal risks | Keep
your company on side with the law | The
regulators: who's who | NatWest
Three: could you be next? | What's
my liability as a company director? | Get
ready to be raided | Defective
documentation | Survive
an FSA investigation | Employers
watch out
1. Competition
2007 was a record-smashing year for competition regulators. In February, the
cartel busters at the European Commission imposed the highest ever fine of
€992 million on elevator manufacturers for bid rigging. In August, the OFT
broke its former record by levying a £121.5 million fine on British Airways
for colluding on the price of long-haul passenger surcharges. These fines,
which can reach a legal maximum of 10 per cent of annual turnover, are the
regulators’ primary weapons to punish violations of the two major
prohibitions laid down by antitrust laws in the UK and Europe.
The first prohibition targets anti-competitive agreements between companies
and covers a broad spectrum of arrangements from exclusive purchasing,
supply or distribution agreements (which in some circumstances are
unlawful), to “hard core” infringements such as price fixing and market
sharing (which are always unlawful and are generally typified by secret
cartels). The European Commission, which takes the lead on antitrust cases
where trade between EU member states is affected, has been on a crusade
against cartels both by imposing severe penalties and encouraging
whistle-blowers to report their fellow cartelists in return for leniency and
reduced fines. The Office of Fair Trading mirrors this approach at domestic
level through its enforcement of the Competition Act 1998 and has a similar
leniency regime to encourage whistle-blowing.
he second primary antitrust prohibition is designed to counter the abusive use
of market power by companies, including monopolies, through, for example,
predatory (below cost) pricing, tying of goods and refusals to supply. The
long-running Microsoft case falls into this category and, as shown by the
€497 million fine imposed on Microsoft, and upheld on 17 September of this
year by a European court, penalties can be just as severe for abuses of a
dominant market position.
Unlike many other European countries, domestic law in the UK also targets
individuals responsible for competition violations. Under the “cartel
offence”, laid down by the Enterprise Act 2002, company employees may face
up to five years in prison and/or an unlimited fine if they dishonestly
agree to engage in prohibited cartel activities. Also, directors run the
risk of being disqualified for up to 15 years. Both the OFT and the European
Commission have (and regularly exercise) the power to raid the offices of
companies they suspect of being involved in breaches of competition law. Add
to that the real possibility of company executives being extradited to
another country for prosecution under local competition laws, and the
conclusion has to be that gambling with competition rules in the UK and the
EU is riskier than ever before.
In light of the serious consequences of antitrust violations, it is important
that a competition compliance culture be instilled from the company board
downwards. To minimise falling foul of the competition regime companies
should establish meaningful and comprehensive training concerning these
issues throughout their organisations. Clearly, basic risk management must
include a well-prepared and implemented compliance programme but the real
challenge for senior executives will be to foster a compliance culture
throughout their organisations. In many instances, the reputation of
businesses and individuals (including potentially their liberty and their
ability to act as directors) may hinge on adherence to that culture.
2. Data protection
Any business that processes “personal data” has to comply with data protection
law. As a result, almost every business has to register with the office of
the regulator, the Information Commissioner. The fee is just £35 but failure
to register is a criminal offence.
Company directors must ensure that any personal information obtained is used
lawfully. Whether obtained for the latest marketing campaign, the
introduction of CCTV or phone call recording, new security measures or
disposing of those dusty old files in the basement, companies will need to
comply with the eight data protection principles of the Data Protection Act
1998.
The Information Commissioner can (and increasingly does) bring criminal
actions for persistent breaches of the law, or for unlawfully obtaining or
disclosing personal information. The first step is usually the issuance of
an enforcement (or ‘stop now’) notice and while no fine will be imposed at
this stage, the reputational damage can be significant. In the last 12
months alone, Phones 4U, Littlewoods and Orange have all been required to
sign undertakings as to their future conduct following investigations or
complaints.
An internal audit of what personal information your business holds and how it
processes it is the best way to achieve compliance. Further, companies
should ensure all employees are given a copy of the company’s data
protection policy. Businesses should also review the security of their IT
systems and premises regularly. For more help, the website of the
Information Commissioner (www.ico.gov.uk)
has a host of practical guidance notes for businesses including guidance on
self-auditing.
3. Copyright infringement
According to the Business Software Alliance (BSA), one quarter of the computer
software used in UK businesses is unlicensed, representing some £800 million
in lost revenues for software providers each year.
While some suggest that the industry-backed BSA exaggerates the extent of the
problem, recent events suggest that UK businesses face an ever-increasing
risk of a costly visit by the BSA or the UK-based Federation Against
Software Theft (FAST). In June this year, an unnamed UK firm agreed to pay
£250,000 to settle its licensing shortfalls and soon after this UK record
was dwarfed by the $3.5 million settlement agreed earlier this month by an
unnamed US-based international media firm.
The BSA and FAST rely heavily on tips from the public to identify potential
wrongdoers. In the business context, information received from disgruntled
IT personnel has been particularly helpful. Conducting regular software
licence audits and reviews is the best way to minimise the risk of
attracting the BSA’s or FAST’s attention; the prudent course after being
approached by either of these organisations is to first audit the situation
internally to understand whether or not there is any exposure.
Although the BSA and FAST do not have official powers of investigation they
will likely refuse to take no for an answer and they often have legal
leverage through audit clauses in software licences. While approaches by the
BSA or FAST rarely end in court actions, they do often lead to payments
which are generally based on the unpaid licence revenues, plus interest.
FAST is currently lobbying the government to make punitive damages available,
a legal reform that would make a letter from the BSA or FAST all the more
costly to UK businesses.
4. Product recall
Toys, chocolate, laptop batteries and a multitude of foodstuffs contaminated
with illegal Sudan I dye . . . it has been a record few years for product
recalls. In large part, this new watchfulness on the part of both industry
and regulators stems from changes to the EU’s regulatory regime since 2004.
Directive 2001/95, which deals with the safety of consumer products, and
Regulation 178/2002, which imposed new rules on food safety as from January
1, 2005, now require producers and distributors to notify national
authorities immediately upon discovering a consumer safety issue and to take
appropriate corrective action, including recall.
The increasing harmonisation of national regimes and better coordination between
EU regulators (both internally and with the consumer product safety
authorities in the USA and China), have led to the increasing
internationalisation of product crises. Navigating the remaining divergences
of national law and regulatory attitudes to risk in a cross-border recall is
no easy task and demands a high degree of preparedness.
Consumer products companies should be dusting off their incident management
policies, checking their insurance coverage, monitoring customer
satisfaction and verifying that their quality management procedures comply
with best practice. Only then can they be confident in their ability to deal
promptly and effectively with an issue that could put their consumers and
their brands at risk.
5. Health and safety
Whether you are operating a nuclear reactor, manning a cashier desk besieged
by bank customers bent on withdrawal or glued daily to an office VDU, all UK
workers have a right to work in places where risks to their health and
safety are properly controlled.
Employers have primary responsibility and the Health and Safety Executive
(HSE) is only too happy to hold them to account, wielding increasingly heavy
fines, including possibly fines and even imprisonment for individual
directors, as a deterrent.
Work-related health and safety risks are regulated through a single legal
framework under the Health and Safety at Work Act 1974 and the Management of
Health and Safety at Work Regulations 1999. Under this regime, companies,
directors and managers must champion the health and safety of employees and
non-employees alike and assess, plan, monitor and audit arrangements under
the umbrella of a watertight health and safety policy. Ongoing training,
consultation and reporting are also high on HSE’s list.
Looking ahead, companies must also await the effect of the Corporate
Manslaughter and Corporate Homicide Act 2007, under which organisations
whose gross negligence leads to death will face prosecution for
manslaughter, with those found guilty liable for unlimited fines. The
prosecution must prove that the breach was due to a large extent to the way
in which senior management organised or managed the organisation’s
activities. Boards must now, therefore, more than ever, embrace their
overall responsibilities and ensure the implementation of a robust
operational framework founded on a "cradle to grave" mentality
towards health and safety.
6. Accounts
The Financial Reporting Review Panel reviews the accounts of public and large
private companies, including directors’ reports and business reviews, for
compliance with the Companies Act requirements and applicable accounting
standards. As well as developing its own risk model to identify cases where
accounting problems are more likely, the panel investigates topical
accounting issues and responds to complaints from the public, the press and
the City. The panel’s priority sectors for investigation in 2007-08 are
travel and leisure, retail, utilities, telecommunications and media.
Following the panel’s reviews, directors may be asked to explain apparent
departures from the requirements and, if it is not satisfied, the panel may
seek to persuade the directors to adopt a more appropriate accounting
treatment. In the year to March 31, 2007 the panel reviewed 311 sets of
accounts and 94 companies undertook to reflect its comments in future
accounts. To date the panel has resolved all cases brought to its attention
without having to apply for a court order.
7. Tax
Revenue and Customs' extensive powers allow it to enquire into tax returns,
undertake wider tax investigations, compel disclosure of documents or
information, carry out VAT, PAYE and NICs inspections on company premises
and raid premises to make arrests and seize material for prosecutions.
The Revenue targets for investigation companies it assesses as a high risk
(such as companies with a low effective tax rate, or those involved in
perceived tax avoidance or cross-border transfer pricing). The taxman deals
with most suspected tax frauds under its Civil Investigation of Fraud
procedure, which requires companies to cooperate fully and pay all taxes
due, plus penalties and interest.
A few cases are selected for prosecution when the Revenue wants to send a
strong deterrent message, for instance where it believes there is
concealment, deception or corruption, and unresolved disputes may be
referred to appeal tribunals. The Revenue and other regulators (both in the
UK and overseas) may share confidential information relating to a company.
Targeted companies may suffer reputational damage, disruptive investigations,
litigation, prosecution and penalties. Companies can minimise these risks by
maintaining good relationships with the Revenue, having effective document
retention policies, limiting “high risk” tax activity and, if subjected to
an investigation, early voluntary cooperation.
8. Financial Services Authority
The Financial Services Authority (FSA) regulates firms in the financial
industry such as banks, brokers and insurance companies. It has broad
responsibilities to protect consumers and to ensure fair play in the
financial markets. To assist in that work, the FSA publishes detailed
regulations for firms in the financial services industry governing
everything from mortgage sales to money-laundering checks. It also has
far-reaching investigatory powers and can launch criminal investigations, as
well as publicly censure companies and impose limitless fines.
Although most of the fines imposed on firms by the FSA for wrongdoing have
been below £1 million, there have been multi-million pound fines (the
highest being £17 million) and the general trend is upwards. Significantly,
individuals are not beyond the FSA’s reach as evidenced by hedge fund
manager Philippe Jabre’s fine of £750,000 last year for market abuse.
The true cost to firms found to have breached regulatory requirements is the
significant reputational damage that can ensue, together with the cost of
consumer compensation required in many cases. In the past, fines of £1
million to £2 million have been dwarfed by associated compensation costs of
many times that figure.
Firms can reduce the risk of FSA action by paying close attention to their
internal systems and controls and also by instilling a “compliance culture”
within the business, as is encouraged by the FSA. While an independent
tribunal exists for companies who disagree with the FSA’s findings, its
public nature and the uncertainty surrounding principles-based enforcement
often make firms less confident in challenging the FSA. As a result, many
who have experienced the FSA enforcement process feel that the balance of
power is tilted too far towards the regulator.
9. Money laundering
The breadth of UK anti-money laundering legislation is an unwelcome surprise
for the uninitiated. While the expression is associated with hardcore
criminality such as bank robbery or drug related crimes, any involvement,
even tangentially, with cartel activity, IP rights infringement or tax
evasion could easily bring a business person in to contact with money that
is classed as the "proceeds of crime".
The Proceeds of Crime Act 2002 (POCA) deliberately casts a wide net and is
intended to catch any profit from any criminal activity, no matter how
limited the crime or inconsequential the profit. The regime is backed up by
stringent penalties regarding participation in, or the failure to report,
money laundering of up to 14 years.
Thankfully businesses can largely mitigate the risks with simple steps:
adequate staff screening and a good corporate ethics policy backed up by
regular training. Company directors are also advised to take a prudent
approach to acquisitions and joint ventures, factoring in any particular
risks associated with the activities and location of the counterparty.
10. Extradition
The extradition of the Natwest Three and the ongoing attempts to extradite Ian
Norris to face cartel charges in the US (now going to the House of Lords)
recently heightened boardroom concern over the risks of extradition.
The Extradition Act 2003 governs the extradition of individuals present in the
UK. It creates two different frameworks, depending on the territory making
the request. Provisions relating to so-called Category 1 territories are
designed primarily to give effect to the European Arrest Warrant Scheme, a
simplified procedure applying, at present, to all EU Member States. Category
2 territories include countries with which the UK has a mutual extradition
arrangement, such as the US.
The Extradition Act generally permits extradition where dual criminality is
satisfied; that is, the offence is an offence under both the law of the UK
and the requesting territory, and is punishable in both jurisdictions by a
custodial sentence of at least one year. The increased use of criminal
sanctions in relation to corporate activity in the UK and abroad (such as
antitrust law, overseas corruption, misrepresentation and fraud) may
increase the scope (although not necessarily the actual number) of
extradition requests against executives.
Although the risks for executives are obviously difficult to manage, companies
must remain vigilant and ensure that internal policies and procedures comply
internationally and that good governance by such international standards
exists. Once a criminal investigation commences, a proactive and, sometimes
co-operative, strategy with the prosecutor is usually a prudent step,
together with ensuring that all potentially relevant documents and emails
are preserved.
In addition to the complex regulatory regimes that directors must comply with,
they also have to get to grips with the Companies Act 2006. Its far-reaching
provisions cannot be ignored. The largest UK statute ever passed, the new
Act replaces the Companies Act 1985 and represents the most significant
change to company law in over 20 years. Directors must bear these changes in
mind while ensuring compliance with the maze of legal regimes affecting
their business – not least the newly codified directors duties which they
owe to the company, which came into force on October 1, 2007.
John Blain is partner at Freshfields Bruckhaus Deringer. Ebrahim Ali, Karen
Crozier, Vanessa Knapp, Stuart Goldberg, Mark Parsons, Charles Goode, Ben
Roe, Matt Bruce, Andrew Austin, James Bourke and Jonathan Kembery also
contributed to this article
You didnt mention market conduct or should I say misconduct - the sector the funds sector will soon face for selling unfair contracts, previously known as intentional fraud, but that has gone by the way now FSA like to smack their hand only.
Rob, Auckland, NZ