Best Practices To Ensure DPA Compliance After Ericsson

In November 2019, Ericsson resolved the FCPA enforcement action by entering into a DPA with the DOJ and the U.S. Securities and Exchange Commission.³

In the DPA, Ericsson agreed to pay $1.06 billion in fines and penalties and, among other things, admitted that it made approximately $2.1 million in bribe payments to government officials in Djibouti to obtain a contract with the state-owned telecommunications company to modernize Djibouti's mobile network infrastructure.⁴

Ericsson further admitted that, to carry out the scheme, it entered into a sham contract with a consulting company and approved fake invoices to conceal bribe payments.⁵

Under a DPA, the DOJ commences a criminal case by filing a charging document with the court and simultaneously asking the court to defer prosecution while the charged company is given the opportunity to demonstrate good conduct and meet certain conditions for a set period of time.

At the end of the DPA term, the criminal case is dismissed and the charges are dropped. In its DPA, which has a three-year term, Ericsson agreed to the imposition of a compliance monitor and to cooperate in ongoing investigations.⁶

As with all DPAs, failure to cooperate in ongoing investigations constitutes a breach of the agreement,⁷ and the DOJ has the sole discretion to determine whether a breach occurred.

A breach of the DPA means that the government could choose to prosecute Ericsson in a jury trial using the admissions it made in the DPA against the company at trial.⁹

Since the entry of the DPA, officials in Sweden and the U.S. have initiated prosecutions against former Ericsson employees involved in the bribing of government officials. In May 2021, Swedish prosecutors charged four former Ericsson employees with bribing government officials in Djibouti.⁹

Most recently, on Sept. 8, an unsealed federal indictment was filed in the U.S. District Court for the Southern District of New York, charging Afework Bereket, a former Ericsson account manager working in East Africa, for his role in paying bribes to high-level government officials in Djibouti and for conspiring to launder funds to promote the scheme.¹⁰

On Oct. 21, Ericsson said that it received correspondence from the DOJ that Ericsson breached its DPA by failing to provide certain documents and factual information to the department.¹¹

In its press release,¹² the company stated that it intends to respond to the DOJ and to continue its cooperation with the department pursuant to the terms of the DPA — presumably by supplying witnesses and evidence to assist the DOJ in its ongoing prosecution of Bereket and possibly others.

Five Best Practices To Ensure Compliance With DPA Obligations

When a company is bound by the terms of a DPA or another similar instrument resolving an enforcement action, it would be well served to implement the following steps to ensure ongoing compliance and to avoid a dispute with the regulator regarding the quality or efficacy of the company's compliance with the settlement terms:

1. Appoint a point person responsible for ongoing cooperation with the government.

The company should designate one or more employees, preferably from the legal or compliance department, to respond to the government's requests related to ongoing cooperation.

Typically, the DOJ is seeking the production of documents or witnesses to testify at trial in related proceedings. Having an internal point person to whom the government can direct its requests should enable the company to respond more quickly and more fulsomely to such requests.

2. Appoint a point person responsible for implementing corporate governance reforms and compliance program enhancements.

Most negotiated resolutions with regulators require the company to make a number of corporate governance reforms and compliance program enhancements. The company should designate one or more employees, again preferably from the legal or compliance department, to be responsible for ensuring that all the agreed-upon corporate changes are timely and fully implemented.

3. Document corporate governance reforms and compliance program enhancements.

Following the timely and complete implementation of the corporate governance reforms and compliance program enhancements, the company's compliance department should confirm that the relevant policies, procedures, internal controls and employee training materials are updated.

4. Train employees to avoid recidivism.

Conduct regular companywide training tailored to the specific roles and responsibilities of different employee groups to educate the company's employees as to the company's policies, procedures and compliance expectations in order to prevent corporate recidivism.

5. Implement self-testing and ongoing monitoring.

The company's compliance department and internal audit function should test the new policies, procedures and internal controls to confirm that the company has satisfied any obligations imposed on it by the terms of the case resolution documents with the regulator. The results of that testing should be shared with various stakeholders, including the chief compliance officer and the board of directors.

Reprinted with permission from the November 8, 2021, issue of Law360. © 2021 Portfolio Media, Inc. All Rights Reserved.