In January, a unit of Alcoa pled guilty to violating the anti-bribery provisions of the Foreign Corrupt Practices Act (FCPA). In one of the ten most costly FCPA settlements to date, Alcoa agreed to pay a total of $384 million to resolve DOJ criminal charges and SEC civil charges. Given the DOJ’s and SEC’s continued, aggressive enforcement of the FCPA, there is little doubt that Alcoa’s settlement was but the first of many FCPA mega-settlements to come in 2014.

Although it is impossible to know how many more companies will pay large FCPA settlements in 2014, it is quite clear that no corporate executive or director wants to incur FCPA liability. Accordingly, U.S. companies with significant FCPA risks are turning to in-house and outside counsel to conduct international internal investigations to evaluate and mitigate FCPA risks. Although potentially quite beneficial, such investigations are not easy. FCPA internal investigations are complex and require counsel to overcome special challenges and avoid common pitfalls.

Obtaining and moving information across borders

Internal investigators generally have little difficulty obtaining or reviewing company-owned information within the United States. However, FCPA investigations often require attorneys to work with corporate information located in a foreign jurisdiction with laws that restrict data collection and transfer.

For example, Directive 95/46/EC, the European Union’s primary data privacy law, broadly defines “personal information” as any information “relating to” a natural person “who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.” Information included within this generous definition may not be collected or disseminated without the subject’s “unambiguous[]”consent, except in certain circumstances. The subject also has the right to access the data and to “rectif[y]” data that are “incomplete or inaccurate.” Investigations that extend to the EU must make accommodations for these broad privacy protections. Other countries’ privacy laws may present similar obstacles.

Companies seeking to transfer information across international borders may have to contend with other types of laws as well. Many countries have “blocking statutes,” which impose sanctions on a party that provides information in response to a discovery request from another country without going through The Hague Convention’s formal “letter of request” process. If a company transfers information from a foreign jurisdiction with a blocking statute to the United States for review, the company later may be forced to produce that information in discovery in an American court and thus be exposed to sanctions in the country where the information originated.

Another restriction on information transfers is China’s state secrets law, which imposes stiff penalties — including potential criminal sanctions — when information deemed a “state secret” is transferred abroad. The definition of “state secrets” under the law is extremely broad, and it is possible for information to be categorized as a state secret retroactively. If a company’s internal investigation will touch on a Chinese company owned by the government, it may be prudent for investigators to keep all relevant documents within China.

Attorney-client privilege

Another consideration in an internal investigation is the extent to which information gathered by the investigating counsel is covered by the attorney-client privilege. It has long been clear that such communications are privileged under U.S. law. But a 2010 decision of the European Court of Justice suggested that under EU law, the privilege may not apply to outside counsel who are not licensed to practice in the EU. The Court of Justice and a number of EU member states also have declined to apply the attorney-client privilege to in-house counsel. Likewise, other countries’ privilege laws may offer less protection than the American privilege. Counsel should seek guidance on local law and consider the issue carefully when deciding who will participate in an investigation.

A privilege issue also can arise if a company’s outside auditors later demand copies of an internal investigation report — which auditors have been increasingly likely to do since the corporate scandals of the 2000s. Providing investigation materials to an auditor may be deemed a waiver of the attorney-client privilege in certain jurisdictions. Given the difficulty of predicting whether a company might be sued in a jurisdiction that would treat such a disclosure as a waiver, companies must weigh the risks of turning over investigation reports and related documents to auditors.

Disclosures to authorities

Cooperation with U.S. or foreign authorities is often an attractive option for companies, as it can be a means of avoiding FCPA or bribery charges. But disclosing wrongdoing to government entities can also create new risks. Many countries have mutual legal assistance treaties (MLATs) or memoranda of understanding (MOUs) with the United States that permit regulators or prosecutors in one signatory country to obtain evidence from their counterparts in the other. A company that reveals a bribery violation to cooperate with a foreign government may inadvertently create a basis for an FCPA investigation in the United States, and vice versa. Companies should take this prospect into account before disclosing any information to the authorities. On the other hand, in some countries, such as Slovakia, the law requires companies that discover wrongdoing to disclose it. In these jurisdictions, it is important to be aware that the law imposes this requirement so that the company can ensure compliance.

Interviewing employees

Employee interviews are often an important means of gathering information in an investigation, but companies should be aware that such interviews can be significantly more difficult to conduct in foreign jurisdictions. In the United States, where at-will employment is the norm, employees who do not cooperate with an investigation can be terminated, but the labor and privacy laws of other countries are often more protective and may allow employees to decline to answer any questions from investigators. Employees in certain countries also may be permitted to have their own counsel, or a union representative, present when they are questioned. Companies should seek guidance on local law in this area and prepare accordingly.


FCPA cross-border internal investigations are challenging, but it is possible for a company to navigate this minefield successfully. To minimize risk in the process, companies should have an investigations protocol in place ahead of time and, once an investigation is underway, they should be careful to evaluate the collateral consequences of every step of the investigation under foreign law before acting. Being prepared for the many difficulties that a cross-border investigation can present is the best way to ensure a successful outcome.