If the Department of Justice is evaluating your compliance program as part of an investigation into your company, it expects you to produce communications from third-party messaging apps so it can evaluate your policy for managing them, Assistant Attorney General Kenneth Polite, Jr., said last week.
The messaging apps have been top of mind among regulators and others in law enforcement, because as their use has expanded, so has the ease with which employees have been by-passing recordkeeping requirements and eluding document production in investigations.
For that reason, the department expects companies to come prepared with an explanation of how they manage these communications.
“If a company has not produced communications from these third-party messaging applications, our prosecutors will not accept that at face value,” Polite said at a white collar crime conference hosted by the American Bar Association in Miami on Friday. “They’ll ask about the company’s ability to access such communications [and] whether they are stored on corporate devices or servers.”
Individualized evaluations
Because companies differ on the role of the messaging apps in their business, there’s no hard rule on what is and isn’t an acceptable way to manage them, Polite said. But that doesn’t impede the department’s ability to evaluate the company’s effectiveness at it.
“We will consider how policies governing these messaging applications should be tailored to the corporation’s risk profile and specific business needs and ensure that, as appropriate, business-related electronic data and communications can be preserved and accessed,” he said.
In addition to having an appropriate policy, the company has to make sure its employees are familiar with it and take it seriously.
“Our prosecutors will … consider how companies communicate the policies to employees, and whether they enforce them on a consistent basis,” he said.
In a recent high-profile case in which the use of self-deleting messages was a problem, the federal judge looking at the financial debacle of the FTX cryptocurrency exchange charged the company’s CEO with breaching the rules of his bail package by communicating on the encrypted messaging app Signal.
At a bail hearing last month for Sam Bankman-Fried, Judge Lewis Kaplan of the U.S. District Court of the Southern District of New York said he wanted defense counsel to give him more information on how they can assure the former FTX CEO’s communications are preserved while he prepares for trial on his role in the crypto exchange’s collapse.
In another recent case, the Securities and Exchange Commission fined a dozen banks tens of millions of dollars each, and in some cases as much as $200 million each, for letting their employees discuss securities trading on messaging apps.
The banks hit with the largest penalties later sought to recoup the amounts from their employees.
Compensation policies
Polite doubled down on a message from Deputy Attorney General Lisa Monaco at the same conference that the department wants to see more companies do what the banks did. Although neither Polite nor Monaco referenced the banks, they made it clear they want to see companies use clawback policies like the banks used to go after the compensation of employees who side-step rules, including rules governing the use of messaging apps.
“The criminal division is launching a pilot program … to offer fine reductions for companies that seek to clawback compensation in appropriate cases,” Polite said.
The clawbacks are one part of a two-part policy to tie compliance performance to compensation. The second part provides a pathway for companies to get penalties lowered if they create a process for lowering executive compensation if compliance performance measures aren’t met.
“Our goal is to ensure that the company uses compliance-related criteria to reward ethical behavior and punish and deter misconduct,” he said.
Other recent changes to the way the department approaches its enforcement efforts include incentives for companies to self-report misconduct when they come across it. Monaco said last week that the department would essentially guarantee it wouldn't seek a guilty plea from a company if it came forward with a problem rather than wait until DOJ discovers it.
Polite said self-reporting carries as much weight as it does because it tells employees the company is serious about holding itself to a high standard.
“Companies that self-report their misconduct set the right tone for their employees and lead by example,” he said. It shows “with actions that criminal conduct will not be tolerated and will be reported to the authorities. Those are the companies that ‘walk the walk’ when it comes to culture and tone at the top.”