Deputy Attorney General Lisa Monaco’s (“Monaco”) recent remarks at Oxford University shed light on the evolving intersection of artificial intelligence (“AI”) and the criminal enforcement landscape and its profound implications for the United States Department of Justice and beyond. As the Chief Operating Officer of the Department of Justice, Monaco’s insights underscore the critical importance of understanding and navigating the complex relationship between AI and criminal defense, particularly in the realm of white collar crime.
The rules on reporting cybersecurity risks and incidents pose many challenges for companies. Those challenges can be even more difficult when the cybersecurity incident affects third-party systems. With no exceptions for third-party cybersecurity incidents under the new cybersecurity reporting regulations, companies should take proactive steps to assess and respond appropriately to third-party cybersecurity incidents.
The SEC’s New Cyber Risk Regulations
In July 2023, the U.S. Securities and Exchange Commission (“SEC”) promulgated new regulations (“Cyber Risk Regulations”) that, among other things, require public companies to report cybersecurity incidents within four business days of a materiality determination via Item 1.05(a) on Form 8-K. See SEC Adopts Final Cybersecurity Risk Management and Incident Disclosure Regulations, from our colleagues at Privacy World.
Please join us on Tuesday, January 30 for a discussion about “the most consequential anti-foreign-bribery law passed in almost 50 years”: the Foreign Extortion Prevention Act (FEPA).
FEPA allows the DOJ to prosecute foreign officials who demand or accept a bribe from a U.S. citizen or company. Our seasoned team of three former Department of Justice (DOJ) prosecutors – including Tom Firestone, a key player in drafting the legislation, Kathleen McGovern, former senior deputy chief of the Fraud Section supervising FCPA Unit and former FCPA prosecutor, and Jerrob Duffy, former chief of the DOJ Fraud Section’s Litigation Unit and senior FCPA prosecutor – will discuss the Act and its implications for US companies.
Between October 25 and October 27, 2023, the Financial Action Task Force (“FATF”), an international policy-making and standard-setting body dedicated to combating money laundering and terrorist financing, held its third plenary meeting of the year (the “October Plenary”), at which it made important updates to its list of jurisdictions under increased monitoring, often externally referred to as the “Grey List,” adding Bulgaria and removing Albania, the Cayman Islands, Jordan, and Panama. These developments are testament to the significant progress the four delisted countries have made in enhancing their anti-money laundering (“AML”), combating the financing of terrorism (“CFT”), and counter proliferation financing frameworks, but point to strategic deficiencies in the current Bulgarian regime. FATF also determined in the October Plenary that no changes to its list of high-risk jurisdictions subject to a call for action, often externally referred to as FATF’s “Black List,” were warranted.[1]
On December 22, 2023, President Biden signed into law the Foreign Extortion Prevention Act (hereinafter “FEPA” or the “Act”) which was passed by the US Congress as part of the Fiscal Year 2024 National Defense Authorization Act. The Act aligns with the current administration’s national security agenda in that it broadens the scope and reach of US anti-bribery and corruption laws.
The second half of 2023 saw eight enforcement actions from the Department of the Treasury’s Office of Foreign Assets Control (“OFAC”). These actions reflect a range of penalties, industries, sanctions programs, conduct, and lessons learned. Below are some highlights from OFAC’s enforcement releases and settlement agreements.
Penalties
OFAC imposed a total of $984,851,289.90 in penalties during the second half of the year, ranging from $31,867.90 against New York-based Emigrant Bank (“Emigrant”) to $968,618,825 against Binance Holdings, Ltd. (“Binance”), a Cayman Islands virtual currency exchange with affiliates around the world. In one settlement, for $1,207,830 with CoinList Markets LLC (“CLM”), a California-based virtual currency exchange, OFAC suspended $300,000 of the settlement amount considering “the individual facts of this case, including CLM’s financial circumstances.” This amount is suspended pending satisfactory completion of CLM’s compliance commitments as agreed to in the settlement. Additionally, as partial satisfaction of the settlement amount, CLM agreed to invest $300,000 in additional sanctions compliance controls.
France’s Sapin II Law was created in 2016 to address corporate corruption and implement antibribery measures. The legislation took effect in 2017, marking a significant shift in the country’s regulatory compliance landscape. The law, which tracks closely with similar laws in the US, UK, and other EU countries, requires large companies [1] to implement a robust compliance program, including anti-corruption policies, monitoring procedures, and accounting controls. The law also significantly changes the government’s prosecution strategies for white collar crime, particularly in light of guidelines issued in 2023 and discussed below. For large entities operating in France, understanding these changes and their impact is critical to business continuity.
International authorities: collaboration on the rise
Courts around the country continue to disagree on the causation standard to be applied in False Claims Act cases based on alleged Anti-Kickback Statute violations. Two recent federal district court decisions out of the District of Massachusetts add to differing conclusions on what the causation standard should be, i.e., “but-for,” “exposure,” or some other, less demanding standard. In United States v. Regeneron Pharms., Inc., No. 20-11217-FDS, 2023 WL 7016900 (D. Mass. Oct. 25, 2023), the district court adopted the Sixth and Eighth Circuits’ “but for” causation standard. See United States ex rel. Martin v. Hathaway, 63 F.4th 1043 (6th Cir. 2023), and United States ex rel. Cairns v. D.S. Med. LLC, 42 F.4th 828 (8th Cir. 2022). In United States v. Teva Pharmaceuticals USA, Inc., No. 20-11548-NMG, 2023 WL 4565105 (D. Mass. July 14, 2023), a different judge of the same court adopted the Third Circuit’s “exposure” standard. See United States ex rel. Greenfield v. Medco Health Sols., Inc., 880 F.3d 89, 96-98 (3d Cir. 2018). Both judges certified their decisions for immediate appeal to the United States Court of Appeals for the First Circuit. In short, anticipate the First Circuit adding its view to the mix soon.
In September, a class action lawsuit (Mannacio v. Discover Financial Services, et al., No. 23-cv-06788 (N.D. Ill.)) was filed against Discover Financial Services (“Discover”) alleging Discover and certain current and/or former executives violated the Securities Exchange Act of 1934. Specifically, the class action complaint alleged that the defendants made false and/or misleading statements and/or failed to disclose that: (i) Discover maintained deficient risk management and compliance procedures; (ii) as a result, Discover, among other things, failed to comply with applicable student loan servicing standards, misclassified certain credit card accounts, overcharged customers, and failed to stem its ballooning credit card delinquency rate; and (iii) when these issues became known, they subjected Discover to significant financial exposure, regulatory scrutiny, and reputational harm.
We have been tracking and reporting on the U.S. Department of Justice’s Civil Cyber-Fraud Initiative (“CCF Initiative”), which U.S. Deputy Attorney General Lisa O. Monaco announced in October 2021. The CCF Initiative employs the powerful False Claims Act (“FCA”) in an effort to “hold accountable entities or individuals that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols or knowingly violating obligations to monitor and report cybersecurity incidents and breaches.” We previously offered insight into the first two FCA enforcement actions brought under this initiative. There was a third. And now, there’s a fourth.
