Washington, D.C. partner George Hazel and Houston partner Gregg Costa, both former judges, are joined by the Hon. Nancy Gertner, who in 1994 was appointed by President Clinton to the U.S. District Court in Massachusetts, where she served until retiring in 2011 to teach at Harvard Law School. Judge Gertner is the author of several books, including her autobiography, In Defense of Women: Memoirs of an Unrepentant Advocate, and Incomplete Sentences, about the men she sentenced during her years as a federal judge. She is also the recipient of numerous awards, among them the Thurgood Marshall Award from the American Bar Association, Section of Individual Rights and Responsibilities, which she received in 2008—only the second woman to do so (Justice Ruth Bader Ginsburg was the first). She also currently serves as an on-air legal commentator for MSNBC and CNN.

The three former judges engage in a far-ranging discussion about sentencing guidelines and the issue of sentencing considerations, including “uncharged conduct” and “acquitted conduct”; mitigating versus aggravating circumstances; age, trauma, addiction, adverse family circumstances, and other distinguishing characteristics; plea deals; and the importance of individual stories.

Previous Episode | Next Episode


HOSTS:

Gregg Costa is co-chair of the firm’s Trials Practice Group.  Gregg offers clients a unique perspective as a former federal trial and appellate judge. His broad experience—having handled complex civil and criminal matters, at trial and on appeal, as advocate and judge—allows him to offer invaluable skills and strategic insights for both trials and investigations.

George Hazel is a partner in the Washington office of Gibson, Dunn & Crutcher and a member of the firm’s Litigation and White Collar Defense and Investigations Practice Groups.  A former federal trial judge and criminal prosecutor, Mr. Hazel brings a broad range of trial experience, having presided over approximately 50 jury trials in federal court and handled 20 jury trials and 30 bench trials as an attorney in federal and state court.  Since his return to private practice, Lawdragon  has named him one of the “500 Leading Global Litigators” of 2024.

Join our panelists from Gibson Dunn’s Environmental Litigation and Mass Tort practice group and Environmental, Social, and Governance (ESG) practice area as they discuss significant developments in federal and California environmental law and forecast what to expect for 2024. This webcast covers a range of topics of significant interest to regulated industries, including ongoing and anticipated rulemakings, federal enforcement targets and initiatives, and the evolving ESG landscape.



PANELISTS:

David Fotouhi is a partner in the Washington, D.C. office of Gibson, Dunn & Crutcher. He practices in the firm’s Litigation Department and is a member of the firm’s Environmental Litigation and Mass Tort practice group. David previously served as Acting General Counsel and Principal Deputy General Counsel at the U.S. Environmental Protection Agency (EPA). David has been recognized as a leading environmental lawyer in the District of Columbia by Chambers USA, a “Trailblazer” in environmental and energy law by National Law Journal, and a “Rising Star” in environmental law by Law360 for his work “on game-changing regulations and litigation.” Prior to entering private practice, David served as a law clerk to the Honorable Raymond W. Gruender of the United States Court of Appeals for the Eighth Circuit.

Stacie B. Fletcher is a litigation partner in the Washington, D.C. office of Gibson, Dunn & Crutcher and is co-chair of the Environmental Litigation and Mass Tort Practice Group. Stacie has handled a wide variety of cases under federal and state environmental statutes, including serving as lead counsel on numerous high-profile enforcement defense matters with U.S. EPA and state agencies. Stacie has been recognized by Chambers USA as a leading environmental lawyer in the District of Columbia each year since 2021 and was named as a Law360 2023 “Environmental MVP.”

Rachel Levick is a partner in the Washington, D.C. office of Gibson, Dunn & Crutcher. She practices in the firm’s Litigation Department and is a member of the Environmental Litigation and Mass Tort and Environmental, Social and Governance (ESG) Practice Groups. Rachel represents clients in a wide range of federal and state litigation, agency enforcement actions, cost recovery cases, and administrative rulemaking proceedings. She was named by Law360 as a 2023 Environmental “Rising Star,” which recognizes “attorneys under 40 whose legal accomplishments belie their age.” Rachel was also named by Best Lawyers as “One to Watch” in Environmental Litigation in 2022 and 2023.

Abbey Hudson is a partner in Gibson, Dunn & Crutcher’s Los Angeles office. Her practice focuses on environmental matters and complex trial litigation. She devotes a significant portion of her time to helping clients navigate environmental and emerging regulations and related governmental investigations. She has provided counseling and advice on environmental and regulatory compliance to clients on a wide range of issues, including supply chain transparency requirements, comments on pending regulatory developments, and enforcement counseling. The Legal 500 United States named Abbey a Next Generation Lawyer in the category of Industry Focus – Environment – Litigation.

Michael Murphy is a partner in Gibson, Dunn & Crutcher’s Washington, D.C. office. He is a leader of the firm’s Environmental, Social and Governance (ESG) practice area, and is a member of the firm’s Environmental Litigation and Mass Tort, and Administrative Law and Regulatory Practice Groups. Michael counsels clients on environmental and ESG issues related to corporate transactions and compliance. He also represents clients in a wide variety of investigation and litigation matters. Michael has been recognized as a Law360 Rising Star and, most recently, by Lawdragon as one of the Green 500: Leaders in Environmental Law for 2023.


MCLE CREDIT INFORMATION:

This program has been approved for credit in accordance with the requirements of the New York State Continuing Legal Education Board for a maximum of 1.0 credit hour, of which 1.0 credit hour may be applied toward the areas of professional practice requirement. This course is approved for transitional/non-transitional credit.

Attorneys seeking New York credit must obtain an Affirmation Form prior to watching the archived version of this webcast. Please contact [email protected] to request the MCLE form.

Gibson, Dunn & Crutcher LLP certifies that this activity has been approved for MCLE credit by the State Bar of California in the amount of 1.0 hour.

California attorneys may claim “self-study” credit for viewing the archived version of this webcast. No certificate of attendance is required for California “self-study” credit.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

FAQs about Government Shutdowns

The U.S. Government is rapidly approaching a partial shutdown this week, which can be averted only if Congress passes funding legislation by Friday, March 1.  If it fails to pass funding legislation by March 8, the government will go into a full shutdown.  After a meeting between congressional leadership and the President today, House Speaker Mike Johnson (R-LA) said he was committed to avoiding a shutdown, but no details have emerged as to how Congress will accomplish that.  Gibson Dunn’s Public Policy Practice Group is closely monitoring the funding negotiations and their potential effects on our clients.  Here, we address the questions our clients have been asking us most frequently.

  1. Which agencies would be affected by a shutdown and when?

In January, Congress passed a “laddered” continuing resolution (“CR”), which broke apart the 12 government funding divisions into two units.  Congress provided funding for one unit until March 1, and the other until March 8.  Pub. Law No. 118-35.

On March 1, funding will expire for the Departments of Agriculture, Energy, Veterans Affairs, Transportation, and Housing & Urban Development; the Food & Drug Administration; the Commodity Futures Trading Commission; and military construction.  Id.

On March 8, all of the other agencies’ funding will expire, including the Departments of Justice, Treasury, Commerce, Labor, Defense, Homeland Security, State, Education, Interior, and Health & Human Services; the Environmental Protection Agency; the Social Security Administration; many independent agencies (e.g., the Securities and Exchange Commission, Federal Election Commission, Federal Trade Commission); and the judicial and legislative branches.  Id.

  1. What will happen if there is a shutdown?

Each agency has different procedures in the event of a shutdown, but generally, all non-essential government functions will cease.  Essential functions will continue—but the personnel performing them will be working without pay, which can cause morale to suffer and employees to skip work.  All federal government employees will receive backpay once Congress breaks its impasse, but federal contractors likely will not.

Essential functions—many of which relate to safety—include:

  • Air traffic control and inspections
    • Note that during previous shutdowns, air travel became challenging because some TSA workers and air traffic controllers did not report to work: plan for long lines.
  • Food safety inspections
  • Veterans’ health care workers
  • Functions related to nuclear reactors
  • Law enforcement
  • Power grid maintenance
  • Essential IRS operations
    • During a previous shutdown, 14,000 IRS workers did not show up when they were recalled to work; this could present a challenge for the ongoing U.S. tax season should this scenario repeat itself. Refund delays would be likely.

Mandatory spending for Social Security, Medicare, and Medicaid also will continue.

Non-essential functions that will cease include things like:

  • Agency rulemaking
  • Consideration of applications for various permits or approvals
    • This includes everything from Committee on Foreign Investment in the United States (“CFIUS”) reviews to passport renewals.
  • Many judicial processes
    • Civil cases may be postponed, but criminal case likely will proceed.
    • If a government attorney who has been furloughed is involved in the case, however, hearing and filing dates may be postponed.
  • Issuing new loans or grants
    • Distribution of funds under major programs like the CHIPS and Science for America Act will be impeded.
  • The running of national parks

Many government subsidy programs will run out of funds (although some, such as SNAP food stamp benefits, have enough funding to continue through March).

  1. What are the chances of a shutdown?

This is the fourth time in four months that we have come close to a federal government shutdown.  Congress has averted the previous ones by passing short-term CRs, which keep funding levels the same as the previous year (as opposed to passing the 12 individual appropriations bills that would change funding levels).

Today, President Biden, House Speaker Mike Johnson (R-LA), Senate Majority Leader Chuck Schumer (D-NY), House Minority Leader Hakeem Jeffries (D-NY), and Senate Minority Leader Mitch McConnell (R-KY) met.  Speaker Johnson said he was committed to avoiding a shutdown, but the challenge will be finding a path forward that appeases both Democrats and the far right members of the Republican caucus.

The options for keeping the government open now include passing a short-term CR to allow for further negotiations, a long-term CR to finish out the fiscal year, or a combination of some portion of the 12 spending bills for some agencies, and a CR for the remainder.  The current political dynamics, however, are making it increasingly difficult for Congress to pass any funding legislation.  Republicans are willing to consider a long-term CR because if there is no new budget by April 30, it will trigger a government-wide 1% spending cut negotiated in last year’s debt-ceiling agreement.  That makes Democrats equally unwilling to consider a long-term CR.  But Speaker Johnson working with the Democrats to pass a short-term CR that would allow additional time for negotiations is anathema to House Republicans, who have already proven themselves willing to jettison a speaker over a spending deal they don’t like.

Although today’s meeting signals hope that congressional leaders are committed to avoiding a shutdown, until a specific deal emerges, the near-term future of government funding will be uncertain.

On March 13, at 12:00PM EDT, the Public Policy Practice Group will present a webcast on the federal legislative and policy outlook for 2024.  Register here.


The following Gibson Dunn lawyers assisted in preparing this update: Michael Bopp, Roscoe Jones, Jr., Amanda Neely, and Daniel Smith.

Gibson Dunn’s Public Policy Practice Group is available to assist clients as they navigate the uncertain and rapidly changing dynamics of a potential partial or full government shutdown.  Our practice group members provide strategic counseling; real-time intelligence gathering; development and enhancement of policy positions; legislative text drafting; and lobbying services.  Please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Public Policy practice group, or the following:

Michael D. Bopp – Co-Chair, Washington, D.C. (+1 202.955.8256, [email protected])
Mylan L. Denerstein – Co-Chair, New York (+1 212.351.3850, [email protected])
Roscoe Jones, Jr. – Co-Chair, Washington, D.C. (+1 202.887.3530, [email protected])
Amanda H. Neely – Washington, D.C. (+1 202.777.9566, [email protected])
Daniel P. Smith – Washington, D.C. (+1 202.777.9549, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

This update highlights steps taken by the Food and Drug Administration to implement the Modernization of Cosmetics Regulation Act since its enactment in 2022 as well as actions expected in the cosmetics space this year.

In December 2022, Congress passed the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), which overhauled the Food and Drug Administration (FDA) framework for the regulation of cosmetics. MoCRA granted FDA new authorities and imposed a series of new requirements on the cosmetics industry, including with respect to adverse event recordkeeping and reporting, facility registration and product listing, good manufacturing practices (GMPs), safety substantiation, fragrance allergen labeling, facility suspension, records access, and mandatory recall authority.

FDA is required to develop multiple regulations and guidances to implement the new law, a number of which issued in 2023 and are expected to issue in 2024, with opportunities for stakeholder comment and feedback.

This client alert highlights three steps FDA has taken to implement MoCRA since its enactment and eight actions to expect from FDA on cosmetics in 2024.

In 2023, FDA took several measures to implement its new authorities under MoCRA, most notably:

  1. Moving the regulation of cosmetics out of the Center for Food Science and Nutrition (CFSAN) and into the Office of Chief Scientist (OCS). This shift out of CFSAN and into OCS, with the Chief Scientist publicly leading MoCRA’s implementation, signals that, post-enactment of MoCRA, the regulation of cosmetics is now a higher priority for the agency. In addition, FDA has explained that moving cosmetics regulation to the Office of the Commissioner will leverage FDA’s areas of expertise across the agency as it works to implement its new authorities.
  2. Holding a public listening session and seeking written comments on GMPs for cosmetic products. Under MoCRA, FDA is required to issue regulations establishing GMPs for facilities that manufacture cosmetic products. While, as discussed below, it is doubtful that FDA will meet its statutory deadlines for issuance of the proposed and final GMP regulations (December 2024 and December 2025, respectively), the listening session is a critical first step in their development.
  3. Issuing guidance on cosmetic product facility registration and cosmetic product listing. Under MoCRA, for the first time, FDA has the authority to require the registration of facilities where cosmetic products are manufactured and the submission of cosmetic product listings, including a list of ingredients used in the products. In December 2023, FDA issued guidance detailing who is responsible for making the registration and listing submissions and what, where, when, and how to submit the information. FDA also announced that it will not enforce the registration and listing requirements until July 1, 2024.

In 2024, FDA will continue to ramp up implementation of MoCRA, including by issuing guidance for industry, launching new systems for submission of information to FDA, and taking steps to enforce new requirements. Look for FDA to take the following actions in the cosmetics space in 2024:

  1. Focusing on microbiological contamination in cosmetic products. FDA has long expressed concerns about the risks of contamination of cosmetic products with microorganisms and has expressed a renewed focus on the issue post-enactment of MoCRA. In June 2023, FDA issued a draft guidance for industry on insanitary conditions in the preparation, packing and holding of tattoo inks and the risk of microbial contamination. Over the course of 2023, the agency also added makeup products from three firms from China to an import alert due to microbiological contamination. In addition, FDA highlighted in a new cosmetics fact sheet for small businesses the importance of conducting testing to determine the safety of each ingredient, including microbiological safety. Expect FDA to take further action, including finalizing the tattoo ink guidance and possibly issuing untitled or warning letters, to address issues of microbiological contamination in cosmetic products over the coming year.
  2. Enforcing registration and listing requirements. As noted above, FDA has announced that it will not take action to enforce cosmetic product facility registration and listing requirements until July 1, 2024. In advance of that date, FDA has issued guidance to industry on compliance with these requirements, as well as tools and options for making electronic submissions. FDA likely will give industry, especially smaller businesses, an additional, unofficial buffer to allow for industry (and agency) adjustment to the reporting requirements but, by the fall, will expect compliance with the new requirements. If and when FDA decides to enforce these requirements, consistent with its approach in other product areas, the agency is likely to prioritize companies whose products it believes pose a risk to the public health, such as manufacturers of contaminated, unsafe, or otherwise adulterated cosmetic products.
  3. Issuing guidance for industry on records access and mandatory recalls. The Office of the Chief Scientist has announced that, by the end of 2024, FDA expects to develop, in conjunction with the Office of Regulatory Affairs, two key guidances for industry on the circumstances in which FDA can exercise new authorities granted by MoCRA: accessing and copying records relating to a cosmetic product and ordering a person to cease the distribution of and recall a cosmetic product. Industry will be particularly interested FDA’s interpretation of its records access authority under the new statute, given the potential scope of the authority and FDA’s previous lack of access to cosmetic product records. Interested stakeholders should consider participating in FDA’s guidance development process by submitting comments on key concerns and issues.
  4. Standing up a system for the electronic submission of serious adverse event reports. MoCRA imposes a new requirement that industry submit serious adverse event reports associated with the use of cosmetic products to FDA. As of December 2023, FDA has modified the current FDA paper form (Form MedWatch3500A) to make it easier for the cosmetics industry to complete the form. Last month, FDA announced that, over the course of the next several months, the agency will have an electronic means for submission of the reports.
  5. Conducting research on per- and polyfluoroalkyl substances (PFAS) in cosmetics. Under MoCRA, by December 2025, FDA is required to issue a report summarizing the results of an assessment of the use of PFAS in cosmetic products and the evidence regarding the safety of such use, including any risks associated with their use. FDA has said that there is not much published data available on PFAS in cosmetics. Last month, FDA announced that it be working to fill certain scientific gaps through its own research, which can be expected to begin this year. Of note, this work comes as a bipartisan bill to ban PFAS in cosmetics has been introduced in the House, although its chances of passage are slim, given the limited amount of time for bill passage given this year’s longer, election-year recess, Republican control of the House, and a lack of a companion bill in the Senate. In addition, on the state side, multiple state legislatures have taken, and are taking, steps to ban PFAS in cosmetic products.
  6. Issuing a proposed rule on testing methods for talc in cosmetics. MoCRA required that FDA issue a proposed rule on testing methods for detecting and identifying asbestos in talc-containing cosmetic products by December 29, 2023. According to the Office of Management and Budget (OMB) website, OMB received the proposed rule from FDA for review on January 2, 2024. With eight FDA rules currently under review with OMB as of February 27, 2024, there is some likelihood that the talc proposed rule will not issue this year, especially given the timing of the mandatory 60-day Congressional review period for rules under the Congressional Review Act, combined with the longer, election-year recess starting in August. Nonetheless, because the proposed rule is being issued pursuant to a statutory mandate, there is a chance that OMB will complete its review in time for it to publish at some point this spring.
  7. Developing implementation and strategic workforce plans for MoCRA implementation. In December 2023, the Government Accountability Office (GAO) issued a report entitled Cosmetic Safety: Better Planning Would Enhance FDA Efforts to Implement New Law. The report’s recommendations centered around FDA’s lack of organizational changes necessary to implement MoCRA. Within the next few months, FDA likely will respond to the recommendations in that report by developing implementation and strategic workforce plans, as called for by GAO.
  8. Hiring a new MoCRA lead? Last, but not least, over the course of 2023, Dr. Namandje Bumpus, as FDA’s Chief Scientist, made several public appearances and statements about her work and priorities as the agency lead on MoCRA’s implementation. Earlier this month, Dr. Bumpus moved to her new role as Principal Deputy Commissioner. FDA is now looking for a new Chief Scientist to take Dr. Bumpus’s place. She is continuing to hold the cosmetics portfolio for the moment, but, once hired, the new Chief Scientist is expected to take over the implementation of MoCRA. It remains to be seen whether her replacement will be hired within this calendar year and, if so, what priorities the new hire will have in the area of cosmetics regulation.

Finally, this year, there are several regulations that FDA is required to issue under MoCRA, or has indicated it is seeking to issue, that likely will not publish before the end of the year. In 2024, do not expect to see FDA regulations on:

  1. Cosmetics GMPs and fragrance allergen labeling. MoCRA requires FDA to issue proposed rules regarding GMPs for cosmetics and fragrance allergen labeling by December 29, 2024, and June 29, 2024, respectively. Neither of these proposed rules appeared in the most recent editions of the Unified Agenda, the compilation of information about regulations under development by federal agencies, which means there is little chance they will issue in 2024, especially given competing priorities for the agency.
  2. Use of formaldehyde as an ingredient in certain hair products. In 2023, FDA announced its intention to publish a proposed rule on the use of formaldehyde and formaldehyde-releasing chemicals as an ingredient in hair smoothing or hair straightening products. Dr. Bumpus emphasized the importance of the proposed rule to the agency in multiple postings to her official Twitter feed. Although FDA has given a target date of July 2024 for issuance of the rule, given the number of high priority regulations FDA has said it will issue by this spring, most if not all of which require review by OMB, as well as the 60-day review period mandated by the Congressional Review Act, it is unlikely that the formaldehyde proposed rule will publish this year.

The following Gibson Dunn lawyers assisted in preparing this update: Katlin McKelvie and Carlo Felizardo.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s FDA and Health Care practice group:

Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, [email protected])
Katlin McKelvie – Washington, D.C. (+1 202.955.8526, [email protected])
John D. W. Partridge – Denver (+1 303.298.5931, [email protected])
Jonathan M. Phillips – Washington, D.C. (+1 202.887.3546, [email protected])
Carlo Felizardo – Washington, D.C. (+1 202.955.8278, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

In re Illinois Nat’l Ins. Co., No. 22-0872 – Decided February 23, 2024

On February 23, the Texas Supreme Court unanimously held that an insured suffers a “loss”—and a claimant can sue the insurers directly—when the claimant and the insured settle, and the claimant agrees to look solely to the liability insurance policy for any recovery. But, because the insured doesn’t face liability beyond the insurance proceeds, the insurer isn’t bound by the settlement agreement during the subsequent coverage litigation.

“Because the settlement agreement establishes that [the insured] is legally obligated to pay and is ‘in fact liable’ to [the claimant] for any recoverable insurance benefits, [the claimant] has suffered a ‘loss’ under the policies and the no-direct-action rule does not prevent [the claimant] from suing the Insurers directly.”

Justice Boyd, writing for the Court

Background:

A group of investors (GAMCO) brought a securities class action against Cobalt International Energy—an oil-and-gas exploration company—after the SEC announced an investigation into Cobalt. Cobalt’s insurers denied coverage and defense costs. After Cobalt filed for bankruptcy, it settled with GAMCO for $220 million—which the parties believed to be the maximum coverage available under Cobalt’s liability insurance policies. GAMCO agreed to look solely to Cobalt’s insurers to recover the $220 million; Cobalt agreed to allow GAMCO to control the coverage litigation but didn’t assign its policies or coverage claims. Both parties denied any fault or liability. The bankruptcy court and U.S. district court presiding over the GAMCO-Cobalt suit approved the settlement.

GAMCO then intervened in Cobalt’s ongoing contract suit against its insurers. The trial court denied the insurers’ jurisdictional pleas and summary judgment motions, holding that (1) Cobalt’s defense costs and the settlement amount are covered “losses” under the policies; (2) GAMCO can sue the insurers directly; and (3) the settlement agreement is admissible in the coverage litigation, not subject to collateral attack, and could be used to establish the amount of Cobalt’s loss. The Fourteenth Court denied mandamus relief.

Issues:

(1) Does an insured suffer a “loss” under a liability policy when its settlement agreement with the claimant doesn’t require the insured to pay money and limits the claimant’s recovery to any liability coverage available under the policy?

(2) Can a claimant that agrees in a settlement agreement to look only to the insured’s insurance policies for recovery sue the insurers directly for insurance benefits?

(3) Is the insured-claimant settlement agreement binding on the insurer or admissible as evidence to establish coverage or the amount of loss?

Court’s Holdings:

(1) Yes. The insured suffered a covered “loss” because the settlement agreement legally obligated the insured to pay the claimant any insurance benefits it receives in its coverage dispute with the insurers. The insurance policies are assets that belong to the insured, and liability policies like those at issue here require the insurers to pay benefits on behalf of the insured regardless of whether the insured actually pays. In so holding, the Texas Supreme Court rejected the notion that the claimant’s covenant not to execute on the judgment prevents the insured from having a legal obligation to pay under the settlement agreement.

(2) Yes. Because the settlement agreement established that the insured had a legal obligation to pay its insurance benefits to the claimant, the claimant can sue the insurers directly to recover under the policies. Although the “no direct action” rule generally bars claimants from suing a defendant’s insurer directly, it doesn’t apply once the insured’s legal obligation to pay the claimant is established by judgment or settlement.

(3) No. Because the settlement agreement didn’t result from a “fully adversarial proceeding,” it isn’t binding against the insurers or admissible to establish coverage or the amount of the insured’s loss.

What It Means:

  • The Court confirmed that, in the subsequent coverage litigation against the insurer, a settlement agreement between the insured and the claimant—which protects the insured “against any ‘actual risk of liability’ beyond its obligation to pay insurance benefits it may or may not receive”—would be neither binding nor admissible because it didn’t “result from a fully adversarial proceeding.”
  • Although mandamus is generally “unavailable when a trial court denies summary judgment, no matter how meritorious the motion,” the Court held that the insurers had no adequate remedy by appeal because the trial—at which the insurers wouldn’t be able to challenge their liability for the full amount of the settlement agreement—would’ve been “a complete waste of the courts’ and parties’ resources.”

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Texas Supreme Court. Please feel free to contact the following practice leaders:

Appellate and Constitutional Law Practice

Thomas H. Dupree Jr.
+1 202.955.8547
[email protected]
Allyson N. Ho
+1 214.698.3233
[email protected]
Julian W. Poon
+1 213.229.7758
[email protected]
Brad G. Hubbard
+1 214.698.3326
[email protected]

Insurance and Reinsurance

Geoffrey Sigler
+1 202.887.3752
[email protected]
Deborah L. Stein
+1 213.229.7164
[email protected]

Related Practice: Texas Litigation

Trey Cox
+1 214.698.3256
[email protected]
Collin Cox
+1 346.718.6604
[email protected]
Andrew LeGrand
+1 214.698.3405
[email protected]
Russ Falconer
+1 346.718.3170
[email protected]

This alert was prepared by Texas associates Elizabeth Kiernan, Stephen Hammer, and Bryston Gallegos.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

From the Derivatives Practice Group: The CFTC issued a no-action letter, approved three proposed rules and extended the comment period on a fourth this week.

New Developments

  • CFTC Staff Issues No-Action Letter Regarding Pre-Trade Mid-Market Mark for Certain Interest Rate Swaps Referencing SOFR. On February 22, the CFTC’s Market Participants Division (MPD) issued a no-action letter applicable to all registered swap entities in relation to the requirement in Regulation 23.431 that swap dealers and major swap participants (swap entities) disclose to certain counterparties the Pre-Trade Mid-Market Mark (PTMMM) of a swap. The no-action letter states that MPD will not recommend the CFTC take an enforcement action against a registered swap entity for its failure to disclose the PTMMM to a counterparty in certain interest rate swaps referencing the Secured Overnight Financing Rate that are identified in the no-action letter, provided that: (1) real-time tradeable bid and offer prices for the swap are available electronically, in the marketplace, to the counterparty; and (2) the counterparty to the swap agrees in advance, in writing, that the registered swap entity need not disclose a PTMMM for the swap. According to the CFTC, the no-action letter provides a similar no-action position as that in CFTC Staff Letter No. 12-58 for certain interest rate swaps referencing the London Interbank Offered Rate. CFTC Commissioner Christy Goldsmith Romero objected to the no-action letter, arguing that it inappropriately shifts the burden of understanding swap dealer’s conflicts and incentives back onto counterparties, upending the Dodd-Frank Act’s intent. [NEW]
  • CFTC Approves Three Proposed Rules and Other Commission Business. On February 20, the CFTC approved three proposed rules through its seriatim process: (1) Regulations to Address Margin Adequacy and to Account for the Treatment of Separate Accounts by Futures Commission Merchants; (2) Foreign Boards of Trade; and (3) Requirements for Designated Contract Markets and Swap Execution Facilities Regarding Governance and the Mitigation of Conflicts of Interest Impacting Market Regulation Functions. All three proposals have a comment deadline of April 22, 2024. Additionally, the CFTC issued an order of exemption from registration as a derivatives clearing organization (DCO) to Taiwan Futures Exchange Corporation and approved an amended order of registration for ICE NGX Canada, Inc., adding environmental contracts to the scope of contracts it is eligible to clear as a DCO. [NEW]
  • CFTC Extends Comment Period on Proposed Rules for Operational Resilience Frameworks. On February 20, the CFTC extended the comment period on its proposed rules implementing requirements for operational resilience frameworks for futures commission merchants, swap dealers and major swap participants. The new deadline is April 1, 2024. [NEW]
  • CFTC GMAC to Meet March 6. The CFTC’s Global Markets Advisory Committee (GMAC) will meet on Wednesday, March 6 at 10am ET. The GMAC will hear presentations from its Global Market Structure Subcommittee, Technical Issues Subcommittee and Digital Asset Markets Subcommittee, and consider their recommendations. [NEW]
  • SEC Adopts Rule to Expand Definitions of “Dealers” and “Government Securities Dealers.” On February 6, the SEC adopted a rule that requires market participants to register as “dealers” or “government securities dealers” for the first time and become members of a self-regulatory organization (SRO). The final rule, codified in Exchange Act Rules 3a5-4 and 3a44-2, purports to define the phrase “as a part of a regular business” in Sections 3(a)(5) and 3(a)(44) of the Securities Exchange Act of 1934 to identify certain activities that would cause persons engaging in such activities to be “dealers” or “government securities dealers” and be subject to the registration requirements of Sections 15 and 15C of the Act, respectively. Under the final rule, any person that engages in activities as described in the rule is a “dealer” or “government securities dealer” and, absent an exception or exemption, required to: register with the SEC under Section 15(a) or Section 15C, as applicable; become a member of an SRO; and be subject to applicable SRO and Treasury rules and requirements. Notably, the rule is non-exclusive, meaning that even if a firm does not meet any of the criteria in the rule, the SEC claims that the firm could still be a dealer anyway depending on the “facts and circumstances.”
  • SEC and CFTC Adopt Amendments to Enhance Private Fund Reporting. On February 8, the SEC adopted amendments to Form PF, the confidential reporting form for certain SEC-registered investment advisers to private funds, including those that also are registered with the CFTC as commodity pool operators or commodity trading advisers. According to the SEC, the amendments, which the CFTC concurrently adopted, are designed to enhance the ability of the Financial Stability Oversight Council (FSOC) to monitor and assess systemic risk and to bolster the SEC’s oversight of private fund advisers and the agency’s investor protection efforts. The SEC and CFTC also agreed to a memorandum of understanding related to the sharing of Form PF data. The SEC stated that, among other things, the amendments to Form PF will enhance how large hedge fund advisers report investment exposures, borrowing and counterparty exposure, market factor effects, currency exposure, turnover, country and industry exposure, central clearing counterparty reporting, risk metrics, investment performance by strategy, portfolio liquidity, and financing and investor liquidity in an effort to provide better insight into the operations and strategies of these funds and their advisers and improve data quality and comparability. Further, the amendments will require additional basic information about advisers and the private funds they advise, including identifying information, assets under management, withdrawal and redemption rights, gross asset value and net asset value, inflows and outflows, base currency, borrowings and types of creditors, fair value hierarchy, beneficial ownership, and fund performance, which, according to the SEC, will provide greater insight into private funds’ operations and strategies, assist in identifying trends, including those that could create systemic risk, improve data quality and comparability, and reduce reporting errors. The amendments will also require more detailed information about the investment strategies, counterparty exposures, and trading and clearing mechanisms employed by hedge funds, while also removing duplicative questions.
  • CFTC Global Markets Advisory Committee Advances Key Recommendations. On February 8, the CFTC’s Global Markets Advisory Committee (GMAC), sponsored by Commissioner Caroline D. Pham, formally advanced eight recommendations to the CFTC that are intended to enhance the resiliency and efficiency of global markets, including U.S. Treasury markets, repo and funding markets, and commodity markets. To date, this is the largest number of recommendations advanced by a CFTC Advisory Committee in a single meeting. The GMAC’s Global Market Structure Subcommittee prepared four recommendations: (1) appropriately calibrated block and cap sizes under CFTC Part 43 swap data reporting rules, intended to enhance market liquidity and financial stability; (2) addition of certain central counterparties (CCPs) as permitted counterparties under CFTC Rule 1.25(d), intended to promote the well-functioning of the repo market; (3) expansion of cross-margining between the CME Group and the Fixed Income Clearing Corporation, intended to support greater efficiency in the U.S. Treasury markets; and (4) best practices for exchange volatility control mechanisms, intended to address market stress and market dislocation during periods of high volatility. The GMAC’s Technical Issues Subcommittee prepared four additional recommendations, as follows: (5) adoption of lessons learned from a global default simulation across CCPs, intended to address systemic risk and promote financial stability; (6) harmonization of the treatment of money market funds as eligible collateral, intended to improve market liquidity; (7) improvement of trade reporting for market oversight, intended to ensure international standardization and global aggregation and analysis of data to address systemic risk; and (8) improvement of trade reporting for market oversight, intended to facilitate data sharing across jurisdictions for systemic risk analysis.
  • CFTC Customer Advisory Alerts App and Social Media Users to Financial Romance Fraud. On February 7, the CFTC’s Office of Customer Education and Outreach (OCEO) issued a customer advisory alerting dating/messaging app and social media users to a scam asking for financial support or giving investment advice using the platforms. The Customer Advisory: Six Warning Signs of Online Financial Romance Frauds, reminds app and social media users to be wary of texts and messages from strangers that promote cryptocurrency investments. According to the OCEO, the text could actually be from international criminal organizations that trick victims into investing money in cryptocurrency or foreign currency scams only to defraud them. The OCEO stated that the scam can take advantage of even the savviest of investors because fraudsters develop relationships with their victims through weeks of seemingly authentic text messaging conversations, a practice known as “grooming.” The advisory points out several warning signs of a financial grooming fraud, which include fraudsters attempting to move conversations from a dating or social media platform to a private messaging app, as well as their claims of wealth from cryptocurrency or foreign currency trading due to insider information. The advisory also includes steps users can take to avoid financial grooming frauds.

New Developments Outside the U.S.

  • HKMA Sets Out Expectations on Tokenized Product Offerings. On February 20, the Hong Kong Monetary Authority (HKMA) published a circular covering the sale and distribution of tokenized products. According to the HKMA, the prevailing supervisory requirements and consumer/investor protection measures for the sale and distribution of a product are also applicable to its tokenized form as it has terms, features and risks similar to those of the underlying product. The HKMA clarified that authorized institutions should conduct adequate due diligence and fully understand the tokenized products before offering them to customers and on a continuous basis at appropriate intervals. Authorized institutions are also expected to act in the best interest of their customers and make adequate disclosure of the relevant material information about a tokenized product, including its key terms, features and risks. Finally, the HKMA indicated that authorized institutions should put in place proper policies, procedures, systems and controls to identify and mitigate the risks arising from tokenized product-related activities. [NEW]
  • HKMA Sets Standards for Digital Asset Custodial Services. On February 20, the HKMA issued guidance for authorized institutions interested in offering custody services for digital assets. The HKMA expects authorized institutions to undertake a comprehensive risk assessment followed by the implementation of appropriate policies to manage identified risks. The entire process should be overseen by the board and senior management. The HKMA also requires authorized institutions to conduct independent systems audits, store a substantial portion of client digital assets in cold storage, ensure that private keys are secured within Hong Kong and provide all records to HKMA whenever requested. Authorized institutions should notify the HKMA and confirm that they meet the expected standards in the guidance within 6 months from the date of the guidance (i.e. February 20, 2024). [NEW]
  • ASIC Publishes Third Consultation Paper on OTC Derivatives Reporting. On February 15, the Australian Securities and Investments Commission (ASIC) published Consultation Paper (CP) 375: Proposed changes to the ASIC Derivatives Transaction Rules (Reporting): Third consultation. CP 375 proposes the following changes to ASIC Derivative Transaction Rules (Reporting) 2024: simplify the exclusion of exchange-traded derivatives; simplify the scope of foreign entity reporting; remove the alternative reporting provisions; clarify the exclusion of FX securities conversion transactions; and add additional allowable values for two data elements. Additionally, CP 375 proposes minor changes to ASIC Derivative Transaction Rules (Clearing) 2015: simplify and align the exclusion of exchange-traded derivatives with the 2024 reporting rules and make minor updates to re-reference certain definitions to their changed location in the Corporations Act 2001. The proposed changes would commence on October 21, 2024, except for the changes to the scope of foreign entity reporting and the removal of alternative reporting provisions, which would commence on April 1, 2025. ASIC indicated that it does not expect most reporting entities to face any material additional compliance burden upon implementation of the proposed changes. However, a small number of international reporting entities and some small-scale exempt reporting entities may be impacted, according to ASIC. The consultation period will run until March 28, 2024. [NEW]
  • Council of the EU Ratifies EMIR 3 Agreement at Ambassador Level. On February 14, the European Market Infrastructure Regulation 3 (EMIR 3) package (regulation and directive), as negotiated in the trilogues, was approved at ambassador level. The texts are available here. According to ISDA, the final text maintains the Council of the EU’s less punitive approach of an operational active account with representativeness. It also introduces a requirement for financial counterparties and non-financial counterparties above certain de minimis thresholds to hold an active account at an EU CCP and to clear a number of representative trades in that account. The directive amending the Capital Requirement Regulation is intended to provide more specific tools and powers under Pillar 2 in the context of excessive concentration to CCPs. [NEW]
  • CPMI, IOSCO Publish Paper on Streamlining VM in Centrally Cleared Markets. On February 14, the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published a discussion paper on streamlining variation margin (VM) in centrally cleared markets. The discussion paper follows the review of margining practices, published in 2022 by the Basel Committee on Banking Supervision, the CPMI and IOSCO. The discussion paper sets out eight effective practices, covering intraday VM call scheduling and frequency, treatment of excess collateral, the pass-through of VM by CCPs and transparency between CCPs, clearing members and their clients. The deadline for comment is April 14.
  • ESMA Withdraws Euronext Authorization as a Data Reporting Service Provider Under MIFIR Upon the Entity’s Request. On February 13, ESMA withdrew the authorization of Euronext Paris SA (Euronext) as a Data Reporting Service Provider (DRSP) under the Markets in Financial Instruments Regulation (MiFIR). Euronext was authorized as both an Approved Reporting Mechanism and an Approved Publication Arrangement under MiFIR since January 3, 2018. MiFIR provides that ESMA shall withdraw the authorization of a DRSP where the DRSP expressly renounces its authorization. ESMA’s withdrawal decision follows the notification by Euronext of its intention to renounce its authorization under the conditions set out in Article 27e(a) of MIFIR.
  • ESMA Publishes Latest Edition of its Newsletter. On February 13, ESMA published  its latest edition of the Spotlight on Markets Newsletter. The newsletter focused on the last ESMA consultation package related to the Markets in Crypto Assets Regulation (MiCA). ESMA invited stakeholders to send their feedback on reverse solicitation and classification of crypto assets as financial instruments by April 29, 2024. The newsletter also launched a call for candidates for ESMA’s Securities Markets Stakeholder Group and called interested parties who can give a strong voice to consumers, industry, users of financial services, employees in the financial sector, SMEs as well as academics to apply by March 18.
  • Hong Kong Government Launches Consultation on Regulating OTC Trading of Virtual Assets. On February 8, the Hong Kong government launched a public consultation on legislative proposals to introduce a licensing regime for providers of over-the-counter trading services of virtual assets (VAs). Under the proposed licensing regime, any person who conducts a business in providing spot trading services of VAs-for-money or money-for-VAs will be required to be licensed by the Commissioner of Customs and Excise, irrespective of whether the services are provided through a physical outlet and/or digital platforms. Licensees will be required to comply with AML/CFT requirements and other regulatory requirements. The public consultation period ends on April 12, 2024.
  • HKMA Consults on Capital Treatment of Cryptoasset Exposures. On February 7, the Hong Kong Monetary Authority (HKMA) published a Consultation Paper on CP24.01 Cryptoasset Exposures setting out a proposal for implementing new regulations on the prudential treatment of cryptoasset exposures based on the Basel Committee on Banking Supervision’s Prudential treatment of cryptoasset exposures standard. According to the consultation paper, for the purpose of the prudential treatment of cryptoasset exposures, cryptoassets will be defined as private digital assets that depend on cryptography and distributed ledger technologies or similar technologies. The HKMA has scheduled a preliminary consultation on the proposed amendments to the rules in the second half of 2024 and aims to put new standards into effect no earlier than July 1, 2025.
  • EU Co-Legislators Reach Provisional Agreement on EMIR 3. On February 6, the EU co-legislators reached a provisional political trilogue agreement on the EMIR 3. On the issue of an active account requirement, while the agreement is based on the less punitive operational active account with representativeness approach proposed by the Council of the EU, the European Parliament has proposed that counterparties should clear at least five trades through an EU CCP in each of the most relevant subcategories. The original approach proposed by the council only required one trade per relevant subcategory. On the topic of supervision, the agreement includes a new role for the European Securities and Markets Authority (ESMA) as co-chair of CCP supervisory colleges alongside national competent authorities and a coordinating role in an emergency.
  • ESA’s Joint Board of Appeal Confirms ESMA’s Decision to Withdraw the Recognition of Dubai Commodities Clearing Corporation. On February 6, the Joint Board of Appeal of the European Supervisory Authorities (the ESAs) unanimously decided to dismiss the appeal brought by Dubai Commodities Clearing Corporation (DCCC) against ESMA and to therefore confirm the ESMA decision to withdraw its recognition. The application was brought in relation to ESMA’s Decision, adopted under Article 25p of Regulation (EU) No 648/2012 (EMIR), to withdraw the recognition of DCCC as a Tier 1 third-country CCP. The decision is a consequence of the United Arab Emirates (UAE) being included by the European Commission on the list of high-risk third countries presenting strategic deficiencies in their national anti-money laundering and counter financing of terrorism (AML/CFT) regime, provided for in the Commission Delegated Regulation (EU) 2016/1675. The Joint Board of Appeal of the ESAs had decided to suspend the ESMA decision in October 2023 until the outcome of the appeal was concluded. With today’s publication, the suspension has expired and the ESMA decision has become fully operational.

New Industry-Led Developments

  • ISDA Responds to FCA on Commodity Derivatives. On February 15, ISDA and the Association for Financial Markets in Europe (AFME) submitted a joint response to the UK Financial Conduct Authority (FCA) consultation on the reform of the UK commodity derivatives regulatory framework. The consultation sought to remove unnecessary burdens on firms and strengthen the supervision of the UK’s commodity derivatives markets. The associations indicated that they strong support the FCA’s proposal to apply a narrower position limits regime that it views as more proportionate to the risks associated with certain commodity derivatives contracts. However, the associations expressed concern over the proposed approaches for setting position limits and adding additional reporting obligations. They noted that the complex and burdensome frameworks proposed can, in their view, discourage participation in UK trading venues by non-UK participants and may have a negative impact on the competitiveness of UK markets. The response also recommends a longer implementation period of at least 24 months, based on the association’s perception of the scale of the operational and technical changes required. [NEW]
  • ISDA Responds to Australian Treasury on Financial Market Infrastructure Reforms. On February 9, ISDA and the Futures Industry Association submitted a joint response to the Australian Treasury’s draft financial market infrastructure reform package. In the response, the associations considered the proposed crisis resolution regime, which would provide the Reserve Bank of Australia (RBA) with powers to step in and resolve a crisis affecting a domestic CCP, with the aim of ensuring the continuity of critical clearing functions and maintaining financial stability in Australia. The associations expressed concerns with some of the provisions contemplated in the draft regime and asked if the issues highlighted in the response (such as the ability of the RBA or statutory manager to direct and make changes to the operating rules, the lack of explicit definitions of and safeguards on resolution powers and the interaction with close-out netting) could be addressed.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (+1 212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The revised Notice introduces new chapters on market definition in specific circumstances, notably markets characterized by significant R&D, multi-sided platforms, and digital ecosystems.

On 8 February 2024, the European Commission (“Commission”) updated its Market Definition Notice (“Notice”) for the first time since its initial publication in 1997. The revised guidance softens the rigidity of the Commission’s earlier approach and grants it more flexibility in competition assessments – particularly in relation to digital and R&D intensive markets. Companies active in these sectors should see the update as a tool to support the Commission’s stricter enforcement agenda.

A.   Background

  • The 1997 Notice

The original Notice was published over 25 years ago. It aimed to provide companies with official guidance on how the Commission applies the concepts of relevant product and geographic market in its enforcement of EU competition law. To this day, market definition plays a pivotal role in competition enforcement. Competition authorities define the relevant market as a first step in both behavioral cases and merger control. It provides a framework for analyzing the competitive situation and identifying potential competitive constraints.

  • Commission’s evaluation of the 1997 Notice

The Commission acknowledged that, since publication of the 1997 Notice, there have been significant societal and technological changes, including the rise of digitalization. These changes, in conjunction with developments in EU case law and the Commission’s decisional practice, warranted re-evaluation of the Market Definition Notice.

The results of the evaluation were published in July 2021:

  • Despite calls from stakeholders for a more progressive approach, the Commission confirmed that, in general, market definition (and the principles on which it rests) will remain of central importance going forward.
  • Nevertheless, the Commission recognized the need for changes in, or additions to, individual areas, notably: digitalization, innovation, geographic market definition, and quantitative techniques. This largely follows the direction of EU court case law and the Commission’s own practice.

A revised draft of the Notice was published for consultation in November 2022. More than 100 stakeholders responded. On 8 February 2024, the final version was adopted.

B.   Key takeaways of the revised Notice

While the Commission’s fundamental approach to market definition remains the same (i.e., examining demand- and supply-side substitution, product and geographical market), the revised Notice introduces the following key changes:

  • Relevance of non-price comparators. While the 1997 Notice focused on price as the main parameter of competition for market definition, the revised Notice adopts a broader approach. For example, it considers that the SSNIP test[1] may be ill-suited to cases where undertakings compete on parameters other than price.[2] In such instances, non-price factors such as product characteristics (including product quality or level of innovation), functionalities and intended use, might be more determinative for demand substitution.[3] This might be particularly relevant in situations involving multi-sided platforms.[4] In such cases, the Commission suggests analyzing switching behavior of customers in response to a Small but Significant Non-transitory Decrease of Quality (“SSNDQ”).[5]
  • Forward-looking assessment to capture market dynamics. The revised Notice states that, in markets undergoing structural transition (such as regulatory or technological changes) or where a forward-looking assessment may be appropriate, future market shares may be estimated to reflect those expected changes.[6] This chimes with the Commission’s recent merger control practice. Notably, the revised Notice states that internal ordinary course documents or independent industry reports may be particularly relevant for conducting a forward-looking assessment.[7]

Along with general guidance, the revised Notice also provides specific direction on the Commission’s approach to market definition in cases where there is: (i) significant differentiation, (ii) discrimination between customers or customer groups, (iii) significant R&D, (iv) multi-sided platforms, (v) after-markets, bundles and (digital) ecosystems.

We consider the Commission’s guidance on (iii)-(v) in more detail below.

  • Market definition in specific circumstances

(1) Market definition in the presence of significant R&D

Examples of industries characterized by significant R&D include pharmaceuticals, chemicals, electrical equipment, and hardware technology. The Commission explains that, while the specificities of highly innovative industries are usually taken into account during the competitive assessment, they may also be relevant for market definition. In particular, the Commission may factor in various potential outcomes of innovation efforts in its assessment of market definition.

For ‘pipeline’ products (where products are not yet available to customers), the Commission notes that there may be sufficient visibility to establish which other products are likely to be substitutable with the pipeline product. In such cases, the Commission can conclude on whether the pipeline products belong to an existing product market or a new product market.[8] However, where an R&D project is in the early stages of development,[9] the Commission concedes that it may be difficult to identify a relevant product market. However, it may still be possible to delineate the boundaries within which companies compete in early innovation efforts.[10] Factors that may be taken into account include the nature and scope of innovation efforts, the objectives of the research, and the specialization of the teams involved.

(2) Market definition in the presence of multi-sided platforms

The Commission uses the term multi-sided to refer to platforms which support interactions between different groups of users. It considers that often, demand from one group of users will have an influence on demand from others i.e., indirect network effects. Examples include payment card systems, online marketplaces, advertising-sponsored platforms, social networking services, and general search services.

The revised Notice is intended to afford the Commission with the flexibility to define a relevant product market in a way that encompasses all (or multiple) user groups, or to define separate relevant markets for the products offered on each side of the platform.[11] This will depend on factors such as the nature of the platform, the degree of product differentiation on each side, and the behavior of each user group (such as multi-homing i.e., using multiple platforms in parallel), among other things.

The Commission explains that multi-sided platforms often supply products at a monetary price of zero, a fact that it considers will render application of the SSNIP test more challenging. It also highlights that, when a product is supplied at a monetary price of zero, non-price elements become more relevant as does evidence on hypothetical substitution, and barriers or costs of switching such as interoperability.[12]

(3) Market definition in the presence of after-markets, bundles and digital
ecosystems

The Notice defines an after-market as a market where customers who buy a primary product are likely to buy a connected or complementary follow-on (secondary) product. Examples include cars and auto parts/repair services, printers and ink cartridges, etc.[13] In these circumstances, the Commission will also consider the competitive constraints imposed by market conditions in the respective connected markets when defining the relevant market(s).

The Commission lists three possible ways to define relevant product markets in the case of primary and secondary products: (i) as a system market comprising both the primary and the secondary product, (ii) as multiple markets, namely a market for the primary product and separate markets for the secondary products associated with each brand of the primary product, and (iii) as two markets, namely the market for the primary product on the one hand and the market for the secondary product on the other hand.

The Notice also makes reference to digital ecosystems.[14] This section of the revised Notice is likely to play a significant role in the coming years, considering the Commission’s increased scrutiny on interoperability in its recent decisional practice.[15]

C.  Conclusion

How markets are defined will continue to play a central role in competition assessments. Market definition will remain the first step in the Commission’s analysis of any proposed transaction and any potential behavioral case. How the Commission views the relevant markets will lay the groundwork for all subsequent analysis, including on the existence of a dominant position and potential anticompetitive effects.

The revised Notice introduces new chapters on market definition in specific circumstances, notably markets characterized by significant R&D, multi-sided platforms, and digital ecosystems. The Notice leaves many questions open and seeks to allow for a less rigorous and more speculative assessment in order for the Commission to enjoy greater flexibility to pursue stricter enforcement in digital and R&D-intensive markets. Time will tell if such speculative analysis will withstand scrutiny from the Courts.

__________

[1] “Small but Significant and Non-transitory Increase in Price”.

[2] Revised Market Definition Notice, para. 30.

[3] Revised Market Definition Notice, para. 48.

[4] Revised Market Definition Notice, para. 98.

[5] At footnote 54 of the Notice, the Commission refers to case AT.40099 Google Android as an example of a case in which it used the SSNDQ test to determine the boundaries of the relevant market.

[6] Revised Market Definition Notice, para. 113.

[7] Revised Market Definition Notice, para. 77.

[8] At footnotes 121 and 122 of the Notice, the Commission refers to i) case M.7275 Novartis/GlaxoSmithKline Oncology Business as an example of a case in which it included pipeline products still under development in an existing relevant market, alongside products that were already marketed; and, conversely, ii) case M9461 AbbVie/Allergan as an example of a case in which it identified a new relevant market limited to a specific type of inhibitor for the treatment of ulcerative colitis and Crohn’s disease, even though no such inhibitor was, at the time, marketed by any supplier.

[9] The Commission makes clear at footnote 9 of the Notice that the term “product” also covers technologies.

[10] At footnote 125 of the Notice, the Commission refers to case M.7932 Dow/DuPont as an example of a case in which it applied the concept of innovation space to determine that the merging parties were involved in innovation competition.

[11] At footnote 129, the Commission refers to case M.8124 Microsoft/LinkedIn as an example of a case in which it defined a single market which included user groups on either side of the platform.

[12] See for instance Cases M.7217 Facebook/Whatsapp, AT.39740 Google Search (Shopping), M.8124 Microsoft/LinkedIn, AT.40099 Google Android.

[13] OECD, Competition issues in aftermarkets, June 2017 available here.

[14] At footnotes 142 and 143, the Commission refers to i) the judgment in Google and Alphabet v Commission T-604/18, where the General Court defined a digital ecosystem and noted the complementarity/interoperability of the products which would form such an ecosystem, highlighting the potential competitive constraints which such a system may give rise to; and ii) case AT.40099 Google Android as an example of a case where the conditions necessary to give rise to an ecosystem comprising app stores and smartphone operating systems were not present.

[15] E.g., European Commission, Mergers: Commission clears acquisition of VMware by Broadcom, subject to conditions, July 2023 available here.


The following Gibson Dunn attorneys prepared this update: Christian Riis-Madsen, Nicholas Banasevic, Katherine Nobbs, Hayley Smith, Jonas Jousma, and Alex O’Donnell*.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Antitrust and Competition, Mergers and Acquisitions, Private Equity or Technology Transactions practice groups:

Antitrust and Competition:
Nicholas Banasevic* – Managing Director, Brussels (+32 2 554 72 40, [email protected])
Rachel S. Brass – San Francisco (+1 415.393.8293, [email protected])
Ali Nikpay – London (+44 20 7071 4273, [email protected])
Cynthia Richman – Washington, D.C. (+1 202.955.8234, [email protected])
Christian Riis-Madsen – Brussels (+32 2 554 72 05, [email protected])
Stephen Weissman – Washington, D.C. (+1 202.955.8678, [email protected])

Mergers and Acquisitions:
Robert B. Little – Dallas (+1 214.698.3260, [email protected])
Saee Muzumdar – New York (+1 212.351.3966, [email protected])

Private Equity:
Richard J. Birns – New York (+1 212.351.4032, [email protected])
Wim De Vlieger – London (+44 20 7071 4279, [email protected])
Federico Fruhbeck – London (+44 20 7071 4230, [email protected])
Scott Jalowayski – Hong Kong (+852 2214 3727, [email protected])
Ari Lanin – Los Angeles (+1 310.552.8581, [email protected])
Michael Piazza – Houston (+1 346.718.6670, [email protected])
John M. Pollack – New York (+1 212.351.3903, [email protected])

Technology Transactions:
Daniel Angel – New York (+1 212.351.2329, [email protected])
Carrie M. LeRoy – New York (+1 650.849.5337, [email protected])

*Nicholas Banasevic, Managing Director in the firm’s Brussels office and an economist by background, is not admitted to practice law.

*Alex O’Donnell, a legal trainee in the Brussels office, is not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The SEC Staff advises that private fund sponsors that wish to exclude the impact of subscription credit facilities when showing a gross internal rate of return in their performance track records also must exclude such impact when showing the corresponding net internal rate of return.

On February 6, 2024, the staff of the U.S. Securities and Exchange Commission (the “SEC Staff”) updated its Marketing Compliance Frequently Asked Questions with respect to the Advisers Act Marketing Rule[1] (the “Marketing Rule”) to issue new interpretive guidance (the “FAQ”) regarding the presentation of investment performance for private investment funds that utilize fund-level subscription credit facilities.[2]

In particular, the SEC Staff advised that private fund sponsors that wish to exclude the impact of subscription credit facilities when showing a gross internal rate of return (“Gross IRR”) in their performance track records must also exclude such impact when showing the corresponding net internal rate of return (“Net IRR”).  According to the SEC Staff, doing otherwise would violate the Marketing Rule’s requirement that any presentation of Gross IRR must be accompanied by Net IRR that has been calculated over the same time period and uses the same type of return and methodology as the gross performance.

In addition, the SEC Staff also took the position that it would be impermissible under the general prohibitions set forth in the Marketing Rule[3] for a private fund sponsor to use performance presentation that shows only a Net IRR that includes the impact of a fund-level subscription credit facility without also including (i) a Net IRR that does not include the impact of such facility or (ii) “appropriate disclosures”[4] describing such facility’s impact on the provided net performance.[5]

In light of the FAQ, we advise that all private fund sponsors promptly review their PPMs, pitchbooks, and related marketing materials for compliance with the new interpretive guidance summarized above.

__________

[1] Rule 206(4)-1 under the Investment Advisers Act of 1940, as amended.

[2] “Subscription credit facilities” broadly include any borrowing secured by the unfunded capital commitments of a fund’s investors, such as subscription line financings, capital call facilities, and bridge lines.

[3] Rule 206(4)-1(a).

[4] The FAQ does not clarify what would constitute an “appropriate disclosure” in this context, though we believe it would include, at minimum, a clear statement that the Net IRR takes into account leverage, which may make the returns higher than what they would have been without the use of such leverage.

[5] A sponsor that complies with this requirement would not also need to show a corresponding gross figure, as the Marketing Rule does not generally require the inclusion of gross performance any time net performance is shown.


The following Gibson Dunn lawyers assisted in preparing this update: Kevin Bettsteller, Greg Merz, Shannon Errico, and Robert Harrington.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding the issues and considerations discussed above. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Investment Funds practice group:

Jennifer Bellah Maguire – Los Angeles (+1 213.229.7986, [email protected])
Kevin Bettsteller – Los Angeles (+1 310.552.8566, [email protected])
Albert S. Cho – Hong Kong (+852 2214 3811, [email protected])
Candice S. Choh – Los Angeles (+1 310.552.8658, [email protected])
John Fadely – Singapore (+65 6507 3688, [email protected])
A.J. Frey – Washington, D.C./New York (+1 202.887.3793, [email protected])
Shukie Grossman – New York (+1 212.351.2369, [email protected])
James M. Hays – Houston (+1 346.718.6642, [email protected])
Kira Idoko – New York (+1 212.351.3951, [email protected])
Gregory Merz – Washington, D.C. (+1 202.887.3637, [email protected])
Eve Mrozek – New York (+1 212.351.4053, [email protected])
Roger D. Singer – New York (+1 212.351.3888, [email protected])
Edward D. Sopher – New York (+1 212.351.3918, [email protected])
William Thomas, Jr. – Washington, D.C. (+1 202.887.3735, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

An overview of recent developments, including a U.S. Supreme Court case addressing Item 303 of Regulation S-K; significant Delaware corporate law cases; recent decisions involving special purpose acquisition companies; securities litigation involving ESG-related allegations; notable cryptocurrency cases; and other matters. 

This update provides an overview of the major developments in federal and state securities litigation since our 2023 Mid-Year Securities Litigation Update:

  • We discuss a major addition to the Supreme Court’s October Term, in which the Court will address the extent to which Item 303 of Regulation S-K can subject a filing company to private shareholder suits. We also discuss a lower-court development calling attention to a circuit split that may end up before the Supreme Court.
  • We review significant developments in Delaware corporate law, including those related to the high pleading bar plaintiffs must clear to successfully bring a duty of oversight (or Caremark) claim, advance notice bylaws, lost merger-premium provisions, books and records demands, and identity-based allocations of voting power. We also discuss a case with potentially significant implications for transactions involving controlling stockholders.
  • We review developments in federal securities litigation involving special purpose acquisition companies (“SPACs”), including two recent decisions addressing scienter in the SPAC context.
  • We examine several developments in securities litigation involving environmental, social, and corporate governance-related allegations.
  • We survey notable developments in cryptocurrency litigation and regulation and address certain technological developments in the industry as well.
  • We continue to monitor developments regarding the Supreme Court’s 2019 decision Lorenzo v. SEC, in which the Court expanded the scope of scheme liability by finding that even if the disseminator of a false statement did not “make” that false statement within the meaning of Rule 10b-5(b), they may still be liable under Rule 10b-5(a) and (c) if they disseminate a false statement with intent to defraud. As discussed in our prior updates, following Lorenzo, lower courts continue to grapple with what conduct is sufficient to maintain a scheme liability claim.
  • We provide an update on the long-running class certification dispute in Arkansas Teacher Retirement System v. Goldman Sachs Group, Inc. and discuss how district courts are applying the Supreme Court’s guidance.
  • Finally, we address several other notable developments including: Omnicare developments out of the Third and Second Circuits; the Second Circuit and the Southern District of New York declining to enforce control share acquisition provisions; the Ninth Circuit ruling that SEC Rule 16b-3 does not require purpose-specific board approval of transactions; and updates in the cybersecurity litigation arena.

I. FILING AND SETTLEMENT TRENDS

Data from a recent NERA Economic Consulting (“NERA”) study illustrates several trend changes.  Federal securities litigation filings in 2023 increased compared to filings in 2022 and 2021.  At the same time, “Health and Technology Services” and “Electronic Technology and Technology Services” filings—which represented over 50% of filings last year—decreased significantly on a relative basis.  Cryptocurrency filings also decreased, from 26 filings in 2022 to 16 filings in 2023.  Meanwhile, “Finance” sector filings increased to 18%, and “Producer and other Manufacturing” sector filings doubled on a relative basis.  Settlement values—excluding merger-objection cases, crypto unregistered securities cases, and cases settling for more than $1 billion or $0 to the class—stayed relatively consistent.  The average settlement value decreased from $37 million to $34 million, while the median settlement value increased from $13 million to $14 million.

A. Filing Trends

Figure 1 below reflects the federal filing rates from 1996 through 2023 (all charts courtesy of NERA).  228 federal cases were filed in the past year.  This is a slight increase in filings compared to 2022 and 2021, but still nowhere near the number of filings in the peak years of 2017-2019.  Note, however, that this figure does not include class action suits filed in state court or state court derivative suits, including those in the Delaware Court of Chancery.

Figure 1:

B. Mix Of Cases Filed In 2023

1. Filings By Industry Sector

The distribution of non-merger objections and non-crypto unregistered securities filings, as shown in Figure 2 below, had some slight variations this year compared to previous years.  Notably, the “Health and Technology Services” sector percentage was the lowest it has been in the last five years, dropping from 27% to 19% in the past year.  “Electronic Technology and Technology Services” filings also decreased compared with the two prior years.  Thus, while “Health and Technology Services” and “Electronic Technology and Technology Services” filings accounted for over 50% of filings in both 2021 and 2022, that total decreased to 41% this year.  Meanwhile, “Finance” sector filings increased steeply on a relative basis, from 8% to 18%, and filings related to the “Producer and Other Manufacturing” sector doubled on a relative basis from 3% to 6%.

Figure 2:

 

2. Merger Cases

As shown in Figure 3 below, there were seven merger-objection cases filed in federal court in 2023.  This continues the downward trend of merger objection filings, beginning in 2020.

Figure 3:

 

3. Cryptocurrency Cases

Figure 4 below illustrates the trends in cryptocurrency filings in federal court from 2016 through 2023.  This past year, there were 11 crypto unregistered securities filings and five crypto shareholder filings, matching the numbers for 2018.  The number of both types of crypto filings decreased from 2022, with the number of crypto shareholder filings cut in half and the number of crypto unregistered securities filings decreasing by 31%.

Figure 4:

C. Settlement Trends

As reflected in Figure 5 below, the average settlement value in 2023 reached $34 million, dropping compared to the average value in 2022 of $37 million.  (Note that the average settlement value excludes merger-objection cases, crypto unregistered securities cases, and cases settling for more than $1 billion or $0 to the class.)

Figure 5:

As for median settlement value, Figure 6 shows that the value remained relatively even for 2023 at $14 million.  This median value has been consistent over the past 5 years, excluding the low outlier in 2021.  (Note that median settlement value excludes settlements over $1 billion, merger objection cases, crypto unregistered securities cases, and zero-dollar settlements.)

Figure 6:

Figure 7:

Finally, as shown in Figure 7, Median NERA-Defined Investor Losses decreased slightly in 2023 to $923 million from $984 million in 2022.  This remains relatively high compared to prior years.  The Median Ratio of Settlement to Investor Losses continued to hold steady at 1.8% for the third straight year.

II. WHAT TO WATCH FOR IN THE SUPREME COURT

A. Pending Before The Supreme Court: Macquarie Infrastructure Corp. v. Moab Partners, L.P. – Private Actions Based On Violations Of Item 303

On January 16, 2024, the Supreme Court heard argument in Macquarie Infrastructure Corp. v. Moab Partners, L.P., a case with significant implications for securities class actions.  The petition in that case presented one question for the Court’s review:  whether a failure to make a disclosure required under Item 303 of SEC Regulation S-K can support a private claim under Section 10(b) of the Exchange Act and Rule 10b-5 promulgated thereunder, even in the absence of an otherwise-misleading statement.  Petition for a Writ of Certiorari at i, 1, Macquarie Infrastructure Corp. v. Moab Partners, L.P., No. 22-1165 (May 30, 2023).

As background, Item 303 is an SEC regulation that requires public companies to disclose in their filings with the SEC any “known trends or uncertainties that have had or that are reasonably likely to have a material favorable or unfavorable impact” on the company’s financial condition.  17 C.F.R. § 229.303(b)(2)(ii).  Although at least some courts have indicated that a violation of Item 303 does not give rise to a direct private right of action, see Carvelli v. Ocwen Fin. Corp., 934 F.3d 1307, 1330 (11th Cir. 2019), plaintiffs in this case pursued their Item 303 claim under Section 10(b) of the Exchange Act and Rule 10b-5.  Under those provisions, investors may bring a private action against a company to recover losses caused by, among other things, a the company’s material misrepresentations or omissions.  City of Riviera Beach Gen. Emps. Ret. Sys. v. Macquarie Infrastructure Corp., 2021 WL 4084572, at *6-7 (S.D.N.Y. Sept. 7, 2021).

Plaintiffs alleged that defendant Macquarie Infrastructure and related parties violated Section 10(b) and Rule 10b-5 by virtue of a “host of . . . misstatements and omissions” about a then-anticipated marine fuel regulation that could affect Macquarie’s financial condition.  Id. at *2, *6-7.  Specific allegations included that defendants were required under Item 303 to disclose some uncertainty regarding the pending regulation, and that the failure to disclose any uncertainty was a materially misleading omission actionable under Rule 10b-5.  See id. at *10.

On September 7, 2021, a district judge in the Southern District of New York dismissed plaintiffs’ case in its entirety.  Id. at *13.  As to plaintiffs’ theory of omissions under Item 303, the district court found that plaintiffs had not alleged any “uncertainty that should have been disclosed”; “in what SEC filing or filings Defendants were supposed to disclose it”; that any uncertainty was material enough that it needed to be disclosed under Item 303; or the time at which “Defendants ‘actually kn[ew]’” of any uncertainty that should have been disclosed earlier than February 2018.  Id. at *4, *10.  But on appeal, the Second Circuit vacated the district court’s dismissal.  Moab Partners, L.P. v. Macquarie Infrastructure Corp., 2022 WL 17815767, at *2 (2d Cir. Dec. 20, 2022).  It explained that “[t]he failure to make a material disclosure required by Item 303 can serve as the basis for . . . a claim under Section 10(b) if the other elements have been sufficiently pleaded” and held that plaintiffs had met that pleading standard.  Id.

The Second Circuit’s ruling in Macquarie raised an opportunity for the Supreme Court to review an apparent split between the Second Circuit’s approach and that of the Third, Ninth, and Eleventh Circuits.  Those courts held that, because Item 303 relies on a different disclosure standard than Rule 10b-5, an Item 303 violation does not, on its own, constitute an actionable omission under Rule 10b-5.  See Carvelli, 934 F.3d at 1331; In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1056 (9th Cir. 2014); Oran v. Stafford, 226 F.3d 275, 288 (3d Cir. 2000).  The Court had granted certiorari in an earlier case presenting this issue, but the parties in that case, Leidos, Inc. v. Indiana Public Retirement System, No. 16-581, agreed to a settlement before the Court heard oral argument.  See Petition for a Writ of Certiorari at 1, Macquarie Infrastructure Corp. (citing Leidos); Gibson Dunn Client Alert (Apr. 3, 2017)Macquarie, now fully briefed and argued, is thus expected to bring clarity to this area.

B. Lower Court Development: SEC v. Govil Deepens Circuit Split

On October 31, 2023, the Second Circuit issued its opinion in SEC v. Govil, highlighting a circuit split between the Second and Fifth Circuits on the nature of the disgorgement remedy available under the Exchange Act.  86 F.4th 89 (2d Cir. 2023).  For a more detailed discussion of the facts and holding of Govil, please see our November 16, 2023 Client Alert.

The split arises from the courts’ different interpretations of the Supreme Court’s 2020 decision in SEC v. Liu and Congress’ subsequent amendment of the Exchange Act.  591 U.S. ___, 140 S. Ct. 1936 (2020); 15 U.S.C. §§ 78u(d)(5) & 78u(d)(7).  In Liu, the Supreme Court interpreted the term “equitable relief” in 15 U.S.C. § 78u(d)(5), which since 2002 had been recognized as expressly authorizing disgorgement as a remedy for violations of securities law.  Liu, 140 S. Ct. at 1940; see also Govil, 86 F.4th at 99.  The Court in Liu held that certain equitable limits apply to this disgorgement remedy, including that a proper disgorgement award must be “awarded for victims” and must not “exceed a wrongdoer’s net profits.”  Liu, 140 S. Ct. at 1940, 1947.  Then, six months after Liu was decided, Congress enacted 15 U.S.C. § 78u(d)(7), which expressly permits the SEC to “seek,” and federal courts to “order,” the remedy of “disgorgement.”

Before Govil, the Second and Fifth Circuit reached competing views of the effect of that statutory amendment.  First, in SEC v. Hallam, the Fifth Circuit held that § 78u(d)(7) did not codify Liu’s more stringent evidentiary and procedural requirements; instead, Congress’ action was “consistent with a desire to curtail” Liu’s impact, so that the SEC could seek “disgorgement in a legal—not equitable—sense” under § 78u(d)(7), as it could before Liu.  42 F.4th 316, 334-35, 338-41 (5th Cir. 2022).  The following year, in SEC v. Ahmed, the Second Circuit interpreted “disgorgement” under § 78u(d)(7) to be subject to the same limitations that Liu imposed on “equitable relief” under § 78u(d)(5).  72 F.4th 379, 296 (2d Cir. 2023).  In doing so, the Second Circuit expressly disagreed with the Fifth Circuit’s approach in HallamSee id. at 395 & n.7.

In Govil, the Second Circuit followed Ahmed, applying § 78u(d)(7) as cabined by LiuGovil, 86 F.4th at 101-02.  Govil thus held that, before ordering disgorgement, the district court was required to find that investors defrauded by a defendant’s actions had suffered pecuniary harm.  Id. at 94, 105.  In the absence of a finding of harm, the Second Circuit held that the district court abused its discretion by ordering disgorgement as a remedy.  Id.  Further, even if investors were found to have been harmed, the district court also erred by not “undertaking a valuation” of the securities defendant had already surrendered to the company.  Id. at 110-11.  In issuing the disgorgement order without valuing the assets already turned over to potential victims, the district court order risked “forcing [the] defendant to pay disgorgement twice,” which would “amount[] to a penalty” impermissible under LiuId. at 107.  Accordingly, the Second Circuit vacated the district court’s judgment and remanded with instructions to find whether “the defrauded investors suffered pecuniary harm.” Id. at 111.

In reaching this decision, the court explicitly noted the circuit split, reviewing the Hallam decision and recognizing that the Fifth Circuit’s reasoning had relied on “familiar principles of statutory interpretation.”  Id. at 100-02.  The court also noted that the split could be outcome-determinative in cases like Govil because the Hallam rule “might authorize disgorgement” on Govil’s facts, even without a finding that affected investors were “victims” who had suffered pecuniary loss.  Id. at 102 n.13.

Although it follows Second Circuit precedent in recognizing a narrower path for the SEC to seek—and courts to grant—disgorgement, Govil highlights both the existence of the post-Liu circuit split on disgorgement and its potential stakes for defendants.

III. DELAWARE DEVELOPMENTS

Delaware law has continued to develop apace over the last six months, and significant new developments are expected in the year ahead.  In December 2023, the Delaware Supreme Court heard oral argument in a case that could substantially alter the landscape for transactions involving a controlling stockholder.  Delaware courts also continued issuing decisions in the wake of the SEC’s Universal Proxy rule, which we discussed in our 2023 Mid-Year Securities Litigation Update; so far, Delaware courts have taken a measured approach.  Courts continue to confront Caremark claims and reiterate the relatively narrow circumstances in which such claims arise.  Other recent decisions applied traditional Delaware law principles to emerging dynamics—e.g., the application of case law regarding books and records demands when the demand is by a potential activist investor, and the application of Sections 151(a) and 212(a) to a certificate of incorporation that provides greater voting power to a subset of entities and individuals than to other stockholders.  Finally, the Delaware Court of Chancery recently narrowed the enforceability of a “Con Ed” provision allowing a target company to seek lost stockholder premium as damages resulting from an acquiror’s breach in a failed merger.

A. The Delaware Supreme Court Considers Burdens In Conflicted Controller Transactions

In December 2023, the Delaware Supreme Court heard oral argument in In re Match Group, Inc. Derivative Litigation, a case that could clarify when burdens of proof and standards of review shift in allegedly conflicted controller transactions.

At issue in In re Match Group, Inc. Derivative Litigation is a “multi-step reverse spinoff initiated by a controller.”  2022 WL 3970159, at *1 (Del. Ch. Sept. 1, 2022). After concluding that “the process as pled satisfied MFW,” the Court of Chancery applied the deferential business judgment standard and dismissed the case.  Id.  MFW, which involved a squeeze-out merger, provided that, “in controller buyouts, the business judgment standard of review w[ould] be applied if and only if” several factors were met.  Kahn v. M & F Worldwide Corp., 88 A.3d 635, 645 (Del. 2014).  Among them is the requirement that a controller “condition[] the procession of the transaction on the approval of both a Special Committee and a majority of the minority stockholders.”  Id.

Plaintiffs then appealed to the Delaware Supreme Court.  Relevant here, they argued that the Court of Chancery erred in concluding that MFW can be satisfied when less than the entire special committee is independent.  Appellants’ Opening Brief at 18-22, In re Match, 2022 WL 3970159, Dkt. 24 (Dec. 2, 2022).

In response, a group of defendants argued that plaintiffs should carry the burden when something less than MFW is satisfied in conflicted controller transactions outside the merger squeeze-out context.  See, e.g., Corrected Answering Brief of IAC Defendants at 8-10, In re Match, 2022 WL 3970159, Dkt. 57 (Jan 12, 2023).  In their view, the Supreme Court should put an end to “MFW creep”—i.e., the gradual “expan[sion of] MFW’s scope.”  Id. at 1-2.

After the initial round of briefing, the Delaware Supreme Court requested supplemental briefing on the issue.  See Supplemental Briefing Order, In re Match Grp., Inc. Deriv. Litig. at 3, No. 368, 2022 (Del.), Dkt. 58  (requesting briefing on “whether the Court of Chancery judgement should be affirmed because [the at-issue] [t]ransactions were approved by either (a) [a special committee] or (b) a majority of the minority stockholder vote?”).

Affirming on the basis that the transactions were approved by either a special committee or a majority of the minority stockholder vote in the context of a conflicted controller transaction other than a squeeze-out merger would indicate that plaintiffs bear the burden when something less than MFW is satisfied.  But whichever path it takes—confining MFW to controller squeeze-out mergers or endorsing its application to other contexts—the Supreme Court’s opinion, should it rule on this basis, could alter the playing field considerably.

B. Delaware Courts Begin Addressing Advance Notice Bylaws In The Wake Of The SEC’s Universal Proxy Rule

Since the Universal Proxy rule—discussed in our 2023 Mid-Year Update—took effect, the Delaware Court of Chancery “has only begun to hear disputes involving the wave of new and amended advance notice bylaws.”  Kellner v. AIM Immunotech Inc., — A.3d —, 2023 WL 9002424, at *15 (Del. Ch. Dec. 5, 2023).  Although early days, the decision discussed below indicates that Delaware courts are taking a measured approach.  See, e.g., id. at *15 (“[I]t is apparent that the court must—more than ever—carefully balance the competing interests at play.”).

In Kellner v. AIM Immunotech Inc., the Court of Chancery reviewed a set of bylaws prompted, in part, by prior “activist activity.”  2023 WL 9002424, at *9.  According to counsel for AIM, the group of activists had “engag[ed] in efforts to conceal who was supporting and who was funding the nomination efforts and to conceal the group’s plans for the Company.”  Id.  This decision arises out of a “renewed nomination attempt” made by a similar group, albeit one described as “smarter” “in many ways” “than the preceding effort.”  Id. at *1.

In the end, the decision “is a tale of wins and losses on both sides.”  Id.  For plaintiff, for example, the court concluded that his notice “contravened valid bylaws” and “suffer[ed] from the same primary defect as his predecessor’s: it obscure[d] obvious arrangements or understandings pertaining to the nomination.”  Id.

For defendants, certain bylaws were held invalid “because they inequitably imperil[ed] the stockholder franchise to no legitimate end.”  Id. at *1, *16.  To that end, the court reviewed the bylaws under enhanced scrutiny, asking first “whether the board faced a threat to an important corporate interest or to the achievement of a significant corporate benefit,” and, second, “whether the board’s response to the threat was reasonable in relation to the threat posed and was not preclusive or coercive to the stockholder franchise.” Id. at *17 (citation and quotation marks omitted).

After concluding that the Board’s response was objectively reasonable at step one, the court found that the Board “failed to show that certain of the provisions [we]re proportionate in relation to [the Board’s] objectives.”  Id.  For example, one provision generally required “the disclosure of all arrangements, agreements, or understandings [“AAUs”] ‘whether written or oral, and including promises,’ relating to a Board nomination.”  Id. at *19.  In addition, the provision contained a “a bespoke 24-month lookback provision” and required “a nominating stockholder to disclose AAUs both with persons acting in concert with the stockholder and any”—broadly defined—”‘Stockholder Associated Person’ (or ‘SAP’).”  Id. at *20-21.  This latter requirement was where the provision went “off the rails,” as it created “an ill-defined web of disclosure requirements” more “akin to a tripwire than an information gathering tool.”  Id. at *22.  In short, it “render[ed] the AAU Provision overbroad, unworkable, and ripe for subjective interpretation by the Board.” Id.  In addition, the Board “presented no evidence to suggest that” it was “proportionate to its objective of preventing stockholders from misconstruing and evading the Amended Bylaws’ disclosure requirements.”  Id

As another example, the bylaws required “the nominator and nominees to list all known supporters.”  Id. at *23.  AIM argued that the bylaw was consistent with a prior decision, Rosenbaum v. CytoDyn, Inc., 2021 WL 4775140 (Del. Ch. Oct. 13, 2021).  (Discussed in our 2021 Year-End Update.)  The court disagreed, noting the provision went “farther than what the precedent supports.”  Kellner, 2023 WL 9002424, at *23.  Whereas, the court explained, CytoDyn concerned a bylaw mandating the disclosure of known financial supports, the bylaw at issue in AIM “s[ought] disclosure of any sort of support whatsoever, including that of other stockholders known by SAPs to support the nomination.” Id.  As a result, its “limits . . . [we]re ambiguous—both in the terms of the types of support and supporters one must disclose.”  Id.  Accordingly, it “impede[d] the stockholder franchise while exceeding any reasonable approach to ensuring thorough disclosure.”  Id.

This decision “hints at what coming activism disputes may bring,” id. at *1, and Gibson Dunn will follow future developments.

C. Delaware Courts Reiterate The Requirements For Pleading Caremark Claims

In In re ProAssurance Corp. Stockholder Derivative Litigation, the court dismissed duty of oversight—i.e., Caremark—and disclosure claims brought against the officers and directors of ProAssurance, a healthcare professional liability insurance provider.  2023 WL 6426294, at *1 (Del. Ch. Oct. 2, 2023).  In doing so, the court emphasized that Caremark claims are “reserved for extreme events.”  Id.  By contrast, the events underlying the litigation “quite obviously[] involve[d] a commercial decision that went poorly—the stuff that business judgment is made of.”  Id.  Together with Segway, discussed below, ProAssurance reaffirms the high pleading bar set by Caremark and its progeny.

Starting around 2015, the healthcare professional liability insurance “competitive marketplace shifted toward underwriting policies for larger physician groups, hospitals, and major national healthcare provider entities.”  Id. at *2.  Concomitantly, ProAssurance began to consider following—and ultimately did follow—that trend, which presented business risks and opportunities.  See, e.g., id. at *3-4.  Recognizing as much, ProAssurance focused on potential risks and worked with third parties to assess the same.  Id. at *3.  Indeed, the court found, ProAssurance’s “Board was consistently—even painfully—involved in monitoring the Company’s underwriting and reserves.”  Id. at *10.  Meanwhile, “[t]he Company. . . attest[ed] to the conservative nature of its loss reserves practices.”  Id. at *6.  Over time, however, claims grew, and in early 2020, ProAssurance publicly announced “adverse development[s]” related to “large national healthcare account.”  Id. at *9.

In dismissing the complaint on demand futility grounds, the court explained, among other things, that plaintiffs’ allegations fell far short of pleading either of the two “necessary conditions predicate for director oversight liability:  (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations.” Id. at *12. Among other things, the court highlighted that, in addition to failing to allege illegality or bad faith, the pleadings “detail[ed] the engagement of auditors and actuarial advisors, oversight of management charged with the Company’s underwriting functions, meetings to discuss severity trends and reserves, and Board-level updates on large accounts.”  Id. at *13.  As for plaintiffs’ disclosure claims, they were dismissed due to a lack of “any particularized allegations of scienter.”  Id. at 16.

In Segway Inc., v. Cai, the court dismissed at the pleading stage a Caremark claim brought against the former president and “in-house accountant” of Segway Inc., related to Segway’s “declining sales . . . and increased accounts receivable.”  2023 WL 8643017, at *1 (Del. Ch. Dec. 14, 2023).  The complaint alleged that the former president “knew or should have known that there were potential issues” with “some of [Segway’s] customers, which caused [Segway’s] accounts receivable to continuously rise.”  Id. at *3.  Thus, plaintiffs claimed, the former president “breached her fiduciary duties as an officer of Segway by ‘continuously ignoring’ these ‘issues (and the resulting impact on [Segway’s] profitability), fail[ing] to take any action to address them . . . and/or fail[ing] to advise [Segway’s] board.’”  Id. (alterations in original).

In dismissing Segway’s Caremark claim, the court took pains to correct a “distressing reading of” Delaware law—i.e., that “the high bar to plead a Caremark claim is lowered when the claim is brought against an officer.”  Id. at *1.  “[B]ad faith remains a necessary predicate to any Caremark claim,” the court explained, and “[l]iability can only attach in the rare case where fiduciaries knowingly disregard this oversight obligation and trauma ensues.”  Id.  Emphasizing that the Caremark doctrine is “not a tool to hold fiduciaries liable for everyday business problems,” the court dismissed Segway’s claims because they failed to adequately plead bad faith or illegality.  Id. at *5.

Both Segway and ProAssurance reinforce that, “[i]rrespective of the defendant’s corporate title, a Caremark claim is ‘possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment.’”  Id. at *5 (quoting In re Caremark Int’l Inc. Deriv. Litig., 698 A.2d 959, 967 (Del. Ch. 1996)).

D. Section 220 Demands In The Context Of Potential Stockholder Activism

In Greenlight Capital Offshore Partners, Ltd. v Brighthouse Financial, Inc., the court ruled largely in defendant’s favor in a case concerning a books and records demand under Section 220 of the DGCL.  2023 WL 8009057, at *1 (Del. Ch. 2023).  Although concluding that plaintiff Greenlight Capital’s purpose for the demand was proper, the court nonetheless found that Greenlight had “only proven that a narrow subset of the materials it request[ed] [we]re necessary and essential to its valuation purpose.”  Id. at *1, *8.

Greenlight, a hedge fund, owned shares of defendant Brighthouse Financial, Inc.  Id.  Brighthouse Financial, Inc. “is a public holding company that sells insurance products through private subsidiaries.”  Id.  “In 2020 and 2021, Brighthouse’s stock price jumped after [a subsidiary] . . . issued extraordinary dividends with the approval of the Delaware Department of Insurance.”  Id.  Those dividends, in turn, aroused Greenlight’s interest in that subsidiary and prompted Greenlight to “‘consider activism’ towards Brighthouse.” Id. at *1, *6.

After its FOIA request failed, Greenlight turned to a books and records demand with the stated purpose of “‘more accurately determin[ing] the value’ of its Brighthouse shares;” “[i]t sought, ‘[i]n particular[,] . . . to determine the true financial impact of [the dividend-issuing subsidiary] . . . on the value of’ the shares.”  Id. at *4.  To that end, Greenlight requested several categories of documents spanning a number of years.  Id.  Brighthouse rejected Greenlight’s demand for several reasons, including that they were overbroad, it could glean the information it sought from public filings, and its stated purpose was neither its real purpose nor, possibly, a proper purpose.  Id.

Greenlight then filed suit.  Id. To prevail on a Section 220 claim, a party must, among other things, offer a proper purpose for its request and demonstrate that the requested materials are “essential to accomplish[] the . . . articulated purpose.”  Id. at *5.

After trial, the court found that Greenlight’s stated purpose was “a proper purpose” under “settled law in Delaware” and rejected Brighthouse’s contention that Greenlight’s stated purpose was merely “a pretext [for] activism.”  Id. at *5-6.  The court explained that “[activism] is not . . . a purpose unto itself,” and because Greenlight demonstrated a proper primary purpose, any additional motivations were irrelevant.  Id. at *7.

Turning to Greenlight’s specific requests, the court found that it had “only proven that a narrow subset of the materials it request[ed] [we]re necessary and essential to its valuation purpose.”  Id. at *8.  This was partly due to Brighthouse’s and its subsidiary’s public filings and partly due to Greenlight’s requests seeking either stale information or information pertaining to “future potential dividend capacity”—both of which were “too attenuated from Greenlight’s purpose of more accurately determining the current value of its Brighthouse shares.”  Id. at *8-9.

E. Court Of Chancery Upholds Differential Voting Power Based On Identity

In Colon v. Bumble, Inc., the Delaware Court of Chancery upheld the validity of provisions that resulted in all shares of Bumble stock carrying one vote unless held by a “Principal Stockholder.”  — A.3d —-, 2023 WL 5920100, at *2-4, *9 (Del. Ch. Sept. 12, 2023).  Principal Stockholders (who are party to a separate, publicly disclosed stockholder agreement) are, by contrast, entitled to 10 votes per share.  Id. at *3-4.

Plaintiff claimed that the provisions giving rise to that dynamic violated Sections 151(a) and 212(a) of the DGCL.  Id. at *4.  In rejecting plaintiff’s challenge and concluding that it “is permissible” to “hav[e] the level of voting power turn on the identity of the owner,” id. at *9, the court explained that Delaware precedent already concluded that formula-based allocations of voting power are consistent with Delaware law, and the DGCL expressly permits voting power to “depend on facts ascertainable outside of the certificate of incorporation.”  Id. at *8.

As to Section 212(a), the court disagreed with plaintiff’s assertion—based not on Section 212(a)’s text but on an earlier Delaware Supreme Court opinion—that “a corporation cannot create a mechanism in which shares of the same class differ in their share-based voting power depending on who holds them.”  Id. at *9.  Among other things, it explained that despite the Supreme Court’s somewhat “puzzl[ing]” reasoning, it approved of provisions that are relevantly similar to the ones before the court.  Id. at *9-15.

As to Section 151(a), the court rejected the assertion that it requires “a class of stock [to] assign the same voting rights to all shares.”  Id. at *15.  Section 151(a), the court explained, does not require either that a formula “generate the same result for all shares,” or that different results can flow from the formula “but it must be a formula that gives any holder an opportunity to gain” its benefits.  Id.  Section 151(a) only requires that “the method”—”not the outcome”—”be identical across all shares in [a] class.”  Id. at *10 (“Section 151(a) expressly permits the use of formulas and procedures that apply across all shares but which can generate different results for different shares based on facts ascertainable outside of the charter (such as the identity of the holder).”).

F. Court Of Chancery Limits The Options For “Con Ed” Provisions

In October 2023, the court in Crispo v. Musk held that a so-called “Con Ed” provision in a merger agreement between Elon Musk and Twitter, Inc., which “purport[ed] to define a target company’s damages to include lost-premium damages,” was an unenforceable contract penalty.  304 A.3d 567, 584 (Del. Ch. 2023).  In this decision on plaintiff’s mootness fee petition, the court found that plaintiff lacked standing because the merger agreement did not confer third-party beneficiary status to stockholders and Twitter’s pursuit of a claim for specific performance of the merger agreement negated plaintiff’s ability to pursue damages under a theory that Lost-Premium Provision provided plaintiff with implicit third-party status.  Id. at 578.  In the course of determining the viability of plaintiff’s claim, the court also held that a Lost-Premium Provision that defines lost-premium damages as exclusive to the target, a damages-definition “Con-Ed” provision, is unenforceable as an unlawful contract penalty under Delaware Law.  Id. at 584.  We discussed this decision in greater detail in our November 8, 2023 Client Alert.

G. Court Of Chancery Invalides $55.8 Billion Equity Compensation Package

In Tornetta v. Musk, a court ruled in favor of Tesla stockholders who brought a derivative lawsuit challenging the multiyear compensation arrangement awarded to Tesla CEO Elon Musk.  — A.3d —, 2024 WL 343699, at *1 (Del. Ch. Jan. 30, 2024).  For more information, please see our February 5, 2024 Client Alert.

IV. FEDERAL SPAC LITIGATION

In 2023, the number of SPAC IPOs again declined, continuing a trend noted in our 2022 and 2023 Mid-Year Securities Litigation Updates.  Between January and November 2023, there were 28 SPAC IPOs, compared to 86 in 2022 and 613 in 2021.  2023 saw a corresponding decline in SPAC-related securities suits, with just 18 new SPAC-related federal securities complaints filed in 2023, down from 29 in 2022.

Although the filing of SPAC-related litigation has slowed, existing cases continue to make their way through the courts.  In September 2023, a pair of district courts considered whether allegations of scienter based on general incentives present in de-SPAC transactions were sufficient and found that they were not.

Phoenix Insurance Company, Ltd. v. ATI Physical Therapy, Inc., 2023 WL 5748359 (N.D. Ill. Sept. 6, 2023):  Investors brought a putative class action alleging securities fraud claims against a physical therapy services company that went public via a de-SPAC, the company’s former CEO and CFO, and the former CEO of the SPAC.  Id. at *1.  Plaintiffs alleged that defendants made misleading statements and omissions in proxy statements issued before the merger relating to the attrition rate of the company’s physical therapists.  Id. at *4, *8.  Investors alleged that the former CEO of the SPAC, who was also the former CEO of the target, acted with scienter based in part on the theory that officers of a SPAC have incentives to “present a target company in a misleadingly favorable light to ensure the company is acquired,” allowing the officers of the SPAC to “gain favorable employment in the post-merger company rather than returning the funds to the investors.”  Id. at *2, *15 (internal quotations omitted).

The court found that these “exceedingly generic” motive allegations did “not contribute much to a strong inference of scienter” because they said “nothing about the motivations, circumstances, and factors particular to” the former SPAC CEO.  Id. (emphasis in original).  Ultimately, the court dismissed the claims against the former CEO of the SPAC, finding plaintiffs fell “far short of pleading a strong inference of scienter.”  Id. at *20.  The claims against the company and its former executives survived.

In re Danimer Scientific, Inc. Securities Litigation, 2023 WL 6385642 (E.D.N.Y. Sept. 30, 2023):  We first reported on this case in our 2022 Year-End Securities Litigation Update.  Danimer, a bioplastics company, went public in 2020 via a de-SPAC merger.  Id. at *1-2.  Danimer stockholders brought a class action asserting securities fraud claims against the company and several of its directors and officers, including one director who was previously the CEO of the SPAC.  Id.  During the period between announcing the merger agreement and the shareholder vote, defendants made allegedly misleading statements in investor presentations and press releases regarding the biodegradability of Danimer’s products, production capacity, product demand, and managerial success of Danimer’s CEO.  Id. at *4-5.

The court granted defendants’ motion to dismiss because plaintiffs failed adequately to allege scienter.  Id. at *1, *10-12.  Plaintiffs asserted that, given the limited lifespan of a SPAC, Danimer’s former CEO was incentivized to complete the de-SPAC merger to avoid returning the money the SPAC had raised from its investors.  Id. at *11.  The court characterized what it described as plaintiffs’ “bet the company theory” of scienter as “still far too generalized . . . to allege the proper concrete and personal benefit required” under Second Circuit precedent, rejecting the idea that “the SPAC model of taking a company public puts unique pressures on . . . management to complete a bad deal[.]”  Id. (internal citation omitted).  Plaintiffs further asserted that the company and two of its directors were motivated to close the de-SPAC merger because it would provide the only available means of funding Danimer’s plans to expand its facilities.  Id. at *11.  Plaintiffs’ scienter allegations fell short there as well, the court explained, as defendants shared “a goal possessed by virtually all corporate insiders[,]” which “remains true even if a company decides to raise capital through merging with another company.”  Id. (internal citations omitted).  Thus, plaintiffs failed to meet the PSLRA’s scienter pleading standards because they invoked only “incentives supposedly faced by SPACs generally.”  Id. (citing Phoenix Ins., 2023 WL 5748359, at *15).

Gibson Dunn represents defendants in this action.

V. ESG CIVIL LITIGATION

A growing number of lawsuits have been filed challenging public companies’ environmental, social, and governance (“ESG”) disclosures and policies.  The following section surveys notable developments in pending cases that involve ESG allegations.

A. Environmental Litigation

In re Danimer Scientific, Inc. Securities Litigation, 2023 WL 6385642 (E.D.N.Y. Sept. 30, 2023):  As noted above, plaintiffs in this action alleged that defendants made misleading statements in investor presentations and press releases regarding, among other things, the biodegradability of Danimer’s products.  ECF No. 44 at 2-3.  They further alleged that when an article published in The Wall Street Journal claimed that the timing in which the company’s product would biodegrade was more variable than suggested, the company’s stock price allegedly dropped.  Id. at 11-13.  As noted, the court concluded that plaintiffs had not adequately alleged scienter and entered an order dismissing the complaint with prejudice on September 30, 2023.  In re Danimer Sci., Inc. Sec. Litig., 2023 WL 6385642 (E.D.N.Y. Sept. 30, 2023).  Gibson Dunn represents the defendants in this action.

General Retirement System of the City of Detroit v. Verizon Communications Inc., No. 23-cv-05218 (D.N.J. Aug. 18, 2023):  In this case, plaintiffs allege that Verizon made false or misleading statements regarding its responsibility for “an extensive network of lead cables . . . around the country, causing harm and posing the risk of further harm to the environment, Company employees, and surrounding communities.”  ECF No. 1, at 5.  The amended complaint alleges that Verizon’s stock price dropped after The Wall Street Journal released an article profiling workers who claimed they were sick from lead exposure.  Id. at 35-39.  A motion to dismiss the amended complaint is due by February 27, 2024.  ECF No. 34. A similar case was filed in the Western District of Pennsylvania on August 1, 2023, and was voluntarily dismissed on October 27, 2023.  See Meehan v. Verizon Commc’ns, Inc., No.  23-cv-01375 (W. D. Pa. Aug. 1, 2023).

Brazinsky v. AT&T Inc., No. 23-cv-04064 (D.N.J. July 28, 2023):  In this case, plaintiff alleged that AT&T misled investors by failing to disclose ownership of lead cables around the United States, which pose risks of environmental harm.  ECF No. 1, at 9.  AT&T has neither answered nor moved to dismiss this complaint.  AT&T filed a motion to transfer the case to the Northern District of Texas, which remains pending before the court.  ECF. No. 43.

In re Oatly Group AB Securities Litigation, No. 21-cv-06360 (S.D.N.Y. July 26, 2021):  A putative class action complaint has been filed against Oatly Group AB, the world’s largest oat milk company, and several of its officers and directors.  Plaintiffs allege that Oatly made false or misleading statements related to the sustainability of its product.  ECF No. 91, at 29-34.  More specifically, plaintiffs allege that Oatly overstated its substantiality practices and minimized its environmental impact, which led to an inflated share price.  Id.  Oatly has not answered or filed a motion to dismiss the complaint.  On November 3, 2023, the parties disclosed an intent to settle the litigation.  ECF No. 95.  On February 16, 2024, plaintiffs moved for preliminary approval of settlement, and the parties are scheduled to appear before the court to discuss the settlement on February 21, 2024.  ECF No. 99, at 1-2.

City of St. Clair Shores Police and Fire Retirement System v. Unilever PLC, No. 22-cv-05011 (S.D.N.Y. June 15, 2022):  We reported on this case in our 2022 Year-End Securities Litigation Update and our 2023 Mid-Year Securities Litigation Update.  The allegations against Unilever arose from a proposed Ben & Jerry’s board resolution purporting to end the sale of Ben & Jerry’s products in areas deemed “to be Palestinian territories illegally occupied by Israel.”  ECF No. 1, at 6.  Plaintiffs alleged that Ben & Jerry’s parent company made misleading statements to investors by failing to adequately disclose the business risks associated with the resolution.  Id. at 10-18.  Defendants in Unilever filed a motion to dismiss these allegations.  ECF No. 31.  The court granted the motion to dismiss, holding plaintiffs failed to plead scienter because the complaint lacked plausible allegations that defendants knew implementation of the board resolution “was a certainty or at least probable.”  City of St. Clair Shores Police and Fire Ret. Sys. v. Unilever PLC, 2023 WL 5578090, at *3-5 (S.D.N.Y. Aug. 29, 2023).

Wong v. New York City Employee Retirement System, No. 652297/2023 (N.Y. Sup. Ct., N.Y. Cnty. May 11, 2023):  We first reported on this case in our 2023 Mid-Year Securities Litigation Update.  Plaintiffs in this case filed breach of fiduciary duty claims against three New York City pension funds that divested approximately $4 billion in fossil fuel investments.  NYSCEF No. 2.  The divestment allegedly caused the pension fund to lose out on the energy’s sector significant growth, and therefore lucrative returns, over the past few years and was undertaken for political reasons unrelated to the retirement interests of plan participants.  Id. at 19.  Plaintiffs seek an injunction, requiring the pension fund to cease the ongoing divestment and make decisions regarding fuel-related and other potential investments “exclusively on relevant risk-return factors.”  Id. at 25.  Defendants filed a motion to dismiss the complaint, arguing that the plaintiffs lack standing and fail to state a claim because the complaint does not contain any allegations showing that the funds’ trustees acted disloyally or carelessly and the decision to divest was made based on relevant financial considerations.  NYSCEF No. 20, at 6-7.  The motion to dismiss is pending before the court.  Gibson Dunn represents plaintiffs in this case.

Exxon Mobile Corp. v. Arjuna Capital, No. 24-cv-00069 (N.D. Tex. Jan. 21, 2024):  ExxonMobil filed a complaint seeking a declaratory judgment that it may exclude activist investors’ shareholder proposal from Exxon’s 2024 proxy statement.  ECF No. 1, at 25.  The complaint alleges that defendants’ proposal, requesting Exxon to accelerate greenhouse gas emissions reductions, “does not seek to improve ExxonMobil’s economic performance or create shareholder value.”  Id. at 3-4.  Exxon asserts that it may properly exclude defendants’ proposal under the ordinary business (Rule 14a-8(i)(7)) and resubmission exclusions ((i)(12)).  Defendants responded to the complaint by withdrawing their proposal and agreeing not to propose it again in the future.  The litigation is continuing.  Gibson Dunn represents plaintiff in this action.

Securities Industry & Financial Markets Association v. Ashcroft, No. 23-cv-04154 (W.D. Mo. Aug. 10, 2023):  In June 2023, the Missouri Securities Division adopted new rules requiring investment professionals to obtain client signatures before providing advice that “incorporates a social objective or other nonfinancial objective.”  ECF No. 24, at 22-33.  In August 2023, plaintiff filed a lawsuit challenging these rules.  ECF No. 1, at 41.  Plaintiff alleges that the rules are preempted by the National Securities Markets Improvement Act of 1996 and the Employee Retirement Income Security Act, violate the First Amendment, and are unconstitutionally vague.  ECF No. 24, at 33-42.  On January 5, 2024, the court denied defendant’s motion to dismiss, allowing this matter to proceed to discovery.  ECF No. 39.

B. Diversity And Inclusion

Ardalan v. Wells Fargo & Co., No. 22-cv-03811 (N.D. Cal. July 28, 2022):  We first reported on this case in our 2023 Mid-Year Securities Litigation Update.  After the district court dismissed the initial complaint, ECF Nos. 112, at 15, plaintiffs filed an amended complaint.  ECF No. 116.  In the amended complaint, plaintiffs allege that Wells Fargo conducted interviews for positions that had already been filled to comply with its disclosed intent that 50 percent of interviewees be diverse for most roles above a certain salary threshold.  ECF No. 116, at 9-10.  In particular, the amended complaint alleges that diverse interviewees either did not have a legitimate chance to obtain the job for which they were interviewing or were interviewing for roles already filled.  Id. at 44-48.  Defendants filed a motion to dismiss the amended complaint, which is fully briefed and pending before the court.

National Center for Public Policy Research v. Schultz, 2023 WL 5945958 (E.D. Wa. Sept. 11, 2023):  In this derivative action, plaintiff alleged that directors and officers of Starbucks breached their fiduciary duties by rejecting a proposal (that plaintiff itself filed) challenging Starbucks’ diversity, equity, and inclusion (“DEI”) initiatives.  ECF No. 1-2, at 33-35.  Defendants filed a motion to dismiss the complaint, arguing that plaintiff does not fairly and adequately represent the interest of shareholders.  ECF No. 19, at 12-21.  The court granted defendants’ motions to dismiss, holding that plaintiff had filed this action “to advance its own political and public policy agenda” and failed to allege that the board’s rejection of its demand to retract the DEI initiatives was wrongful.  Nat’l Ctr. for Pub. Pol’y Rsch. v. Schultz, 2023 WL 5945958, at *3-4 (E.D. Wa. Sept. 11, 2023).

VI. CRYPTOCURRENCY LITIGATION

A. Class Actions

Risley v. Universal Navigation Inc., 2023 WL 5609200 (S.D.N.Y. Aug. 29, 2023):  On August 29, 2023, a U.S. District Judge dismissed a putative class action complaint against the developers of and investors in the Uniswap Protocol trading platform, a decentralized cryptocurrency exchange.  Id. at *1.  Plaintiffs, a class made up of individuals who each purchased certain of the tokens that were issued and traded on this exchange, brought claims under Section 12(a)(1) of the Securities Act and Section 29(b) of the Securities Exchange Act, alleging that they lost money after investing in what turned out to be “scam tokens.”  Id. at *1, *11.  The District Judge, in assuming (but not confirming) that the tokens were securities, dismissed the complaint in full, emphasizing that the identity of the issuers of the tokens was largely unknown both to plaintiffs and defendants due to the decentralized nature of the exchange.  Id. at *11.  The District Judge observed that plaintiffs are “looking for a scapegoat for their claims because defendants they truly seek are unidentifiable” and opined that whether “this anonymity is troublesome enough to merit regulation is not for the court to decide, but for Congress.”  Id. at *19.  This case is currently on appeal to the Second Circuit.  Risley v. Universal Navigation Inc., 2023 WL 5609200 (S.D.N.Y. Aug. 29, 2023), appeal docketed, No. 23-1340 (2d Cir. Sept. 28, 2023).

Ohman J:or Fonder AB v. NVIDIA Corp., 81 F.4th 918 (9th Cir. 2023): On August 25, 2023, the Ninth Circuit partially revived a putative class’s securities fraud claims against NVIDIA and its officers. In this case, the putative class of shareholders alleged that defendants knowingly or recklessly made materially “misleading and false statements regarding the impact of cryptocurrency sales on NVIDIA’s financial performance” in order to conceal the extent to which NVIDIA’s revenue growth depended on the demand for cryptocurrency, in violation of Sections 10(b) and 20(a) of the Exchange Act and Rule.  Id. at 923.  The U.S. District Court for the Northern District of California initially dismissed the amended complaint in its entirety.  However, on appeal, the Ninth Circuit, in a split opinion, reversed in part and remanded for further proceedings, finding that plaintiffs had stated claims against NVIDIA and its cofounder, President, and CEO, but not against the other officers.  Id. at 947.  The appellate court concluded that the complaint sufficiently alleged that the cofounder, President, and CEO knowingly or recklessly made false or misleading statements about the degree to which NVIDIA’s revenues were dependent on sales of GeForce GPUs to crypto miners, based on his repeated statements to investors and analysts throughout 2017 and 2018 downplaying the degree of such dependency.  Id. at 933-34, 937, 940.  Judge Gabriel Sanchez dissented, concluding that the complaint was entirely based on a post hoc, unreliable analysis done by an outside expert and that it did not allege with sufficient particularity information that would have put NVIDIA’s executives on notice that their public statements were false or misleading when made.  Id. at 947.  The petition for rehearing en banc was denied.  See E. Ohman J.:or Fonder AB v. Nvidia Corp., 2023 WL 7984780, at *1 (9th Cir. Nov. 15, 2023).  On December 5, 2023, the Ninth Circuit granted defendants’ motion to stay the mandate for ninety days.  See Order, E. Ohman J. or Fonder AB v. NVIDIA Corp., No. 21-15604 (9th Cir. Dec. 5, 2023).

B. Regulatory Lawsuits

SEC v. Binance Holdings Ltd., No. 23-cv-01599 (D.D.C. June 5, 2023):  As reported in our Securities Litigation 2023 Mid-Year Update, on June 5, 2023, the SEC filed a 13-claim complaint against Binance Holdings Limited, BAM Trading Services Inc., BAM Management Holdings Inc. and Changpeng Zhao in D.C. federal court, alleging defendants engaged in unregistered offers and sales of crypto asset securities.  ECF No. 1.  On June 13, 2023, consistent with the arguments set forth in defendants’ briefing, the government admitted that it had no evidence that customer assets have been misused or dissipated and, as a result, defendants successfully prevented the SEC from obtaining the extensive relief it sought.  Instead, at the court’s direction, Binance, the SEC, and the other defendants in the action negotiated a consent order that will remain in place while the action is pending.  ECF No. 71.  After the entry of the Consent Order, defendants filed motions to dismiss.  ECF No. 114.  Primarily, defendants argued that the cryptocurrencies at issue are not “investment contracts” under SEC v. W.J. Howey Co., 328 U.S. 293 (1946) (“Howey”) and that the major-questions doctrine bars the SEC from unilaterally deciding it can regulate the burgeoning cryptocurrency industry.  ECF Nos. 117-1, 118.  Judge Amy Berman Jackson heard oral argument on the pending motions to dismiss on January 22, 2024.

In the backdrop of this ongoing SEC litigation, Binance and related entities entered into settlements with the DOJ and CFTC.  On November 21, 2023, Binance and its CEO entered a guilty plea to resolve its outstanding DOJ litigation.  See Binance and CEO Plead Guilty to Federal Charges in $4B Resolution, Dep’t of Just. (Nov. 21, 2023).  Subsequently, on December 18, 2023, a federal court approved a separate settlement with the CFTC.  See Federal Court Enters Order Against Binance and Former CEO, Zhao, Concluding CFTC Enforcement Action, Commodities Futures Trading Comm’n (Dec. 18, 2023).

Gibson Dunn represents Binance Holdings Limited.

SEC v. Schueler, No. 23-cv-05749 (E.D.N.Y. July 31, 2023):  On July 31, 2023, the SEC charged Richard Schueler (otherwise known as “Richard Heart”) and three affiliated companies for the unregistered offer and sale of securities as well as the misappropriation of investor assets.  According to the SEC’s complaint, Heart created and marketed his “Hex” token to investors, promising them a 38% annual return on investment in the form of future Hex tokens if they “staked,” or locked up, their existing Hex tokens.  ECF No. 1, at 7.  Through the “staking” process, Heart purportedly hoped to inflate the price of Hex tokens.  Id.  The SEC also alleged that Heart developed Pulsechain and PulseX, a blockchain and crypto token, that each raised hundreds of millions of dollars from investors.  Id. at 16-18, 21.  Heart allegedly misappropriated at least 12.1 million dollars of investor assets in order to purchase luxury goods, including a 555-carat black diamond.  Id. at 19-20.  Accordingly, the SEC charged Heart both with fraud under Sections 10(b), 17(a)(1), and 17(a)(3) of the Exchange Act, as well as with failure to comply with the registration provisions of Section 5 of the Securities Act.  Id. at 4.  Defendants’ motion to dismiss is due by April 8, 2024 with Judge Carol Bagley Amon set to hear oral arguments on October 24, 2024.  Scheduling Order, SEC v. Schueler, No. 23-cv-05749 (E.D.N.Y. Jan. 18, 2024).

SEC v. Payward, Inc. and Payward Ventures, Inc., No. 23-cv-06003 (N. D. Cal. Nov. 20, 2023):  On November 20, 2023, the SEC filed a three-count complaint against Payward Ventures and Payward Trading, Ltd. (also known as “Kraken”) in the United States District Court for the Northern District of California for violations of Sections 5, 15(a), and 17A(b) of the Exchange Act.  ECF No. 1, at 4.  In its complaint, the SEC alleged that 11 assets that Kraken traded were “investment contracts represented by the underlying crypto asset” and that they are therefore subject to the Exchange Act’s regulations.  Id. at 15.  In addition to claiming that Kraken’s traded assets should have been registered, the SEC also alleged that the online trading platform acted as an exchange, broker, dealer, and clearing agency for crypto assets without first registering with the agency.  Id. at 18-35.  Further, the SEC alleged that Kraken’s failure to register enabled it to commingle its customers’ crypto assets along with fiat in its custodial accounts without ever disclosing that fact to customers.  Id. at 39.  Accordingly, the SEC seeks injunctive relief, disgorgement of gains with interest, and civil money penalties.  Id. at 4.  Defendants’ motion to dismiss is due on February 22, 2024.  ECF No. 21, at 1.

People v. Mek Global Ltd., d/b/a/ KuCoin, Index No. 450703/2023 (Sup. Ct. N.Y. Cnty. Dec. 12, 2023):  In March 2023, the New York Attorney General’s Office brought claims against the Seychelles-based crypto exchange KuCoin, alleging that KuCoin violated New York securities laws by unlawfully offering and selling cryptocurrency and by unlawfully representing itself as an “exchange.”  Stipulation and Consent Order at 1, People v. Mek Global Ltd., d/b/a/ KuCoin, Index No. 450703/2023 (Sup. Ct. N.Y. Cnty. Dec. 12, 2023).  On December 12, 2023, KuCoin agreed to return $16.7 million dollars to New York investors, pay $5.3 million in fines, take steps to close New York accounts within 120 days, and preclude the creation of new New York-based accounts.  Id. at 3-4.  KuCoin also admitted that it falsely represented itself as a registered exchange and that it operated in New York as an unregistered securities or commodities broker-dealer.  Id. at 2-3.  As a part of the consent order, KuCoin must update the Office of the Attorney General (“OAG”) on the number of New York customers that have withdrawn money and also provide the Office with detailed information on New York customers who have had an open account at KuCoin.  Id. at 10-11.  The consent order resolves the OAG’s claims against KuCoin.  Id. at 2.

SEC v. Terraform Labs Pte. Ltd., 2023 WL 8944860 (S.D.N.Y. Dec. 28, 2023):  As reported in our 2023 Mid-Year Litigation Update, the SEC brought an enforcement action early last year alleging that Terraform Labs and its founder perpetrated a multibillion dollar crypto asset securities fraud scheme by offering and selling crypto asset securities in unregistered transactions and misleading investors about the Terraform blockchain and its crypto assets.  On July 31, 2023, U.S. District Judge Jed S. Rakoff denied defendants’ motion to dismiss.  On December 28, 2023, Judge Rakoff granted summary judgment for the SEC, finding that Terraform’s crypto assets—UST, LUNA, wLUNA, and MIR—are securities because they are investment contracts under Howey, and that defendants offered and sold LUNA and MIR in unregistered transactions in violation of the federal securities laws.  2023 WL 8944860, at *12-16.  Judge Rakoff further held that defendants offered unregistered security-based swaps to non-eligible contract participants and effected transactions in security-based swaps with non-eligible contract participants in violation of the federal securities laws.  Id. at *17.  Trial on the remaining fraud claims is scheduled for late March of 2024.

C. Other Developments

1. SEC Grants Approval For Certain ETFs To Track Bitcoin

On January 10, 2024, the SEC granted approval for the first U.S.-listed exchange-traded funds (“ETFs”) to track bitcoin.  SEC, Statement on the Approval of Spot Bitcoin Exchange-Traded Products (Jan. 10, 2024).  The approval includes applications from 11 major entities like BlackRock, Ark Investments/21Shares, Fidelity, Invesco, and VanEck.  This marks a potentially significant development for Bitcoin as the world’s largest cryptocurrency and for the broader crypto industry.  Some consider the ETFs a pivotal development for Bitcoin, offering investors exposure to the cryptocurrency without directly holding it.  Analysts predict significant inflows, with estimates ranging from $50 billion to $100 billion this year alone.

This move marks a change for the SEC, which had previously rejected bitcoin ETFs.  Hannah Lang & Suzanne McGee, US SEC Approves Bitcoin ETFs in Watershed for Crypto Market, Reuters (Jan. 11, 2024).  However, SEC Chair Gary Gensler suggested that the approval was partly in response to a circuit court ruling that the SEC wrongly denied an application from Grayscale Investments to convert its existing Grayscale Bitcoin Trust into an ETF.  See SEC, Statement on the Approval of Spot Bitcoin Exchange-Traded Products (Jan. 10, 2024) (citing Grayscale Investments, LLC v. SEC, 82 F.4th 1239 (D.C. Cir. 2023)).  Gensler also emphasized that the action would not change the SEC’s enforcement of “non-compliance of certain crypto asset market participants with the federal securities laws,” nor does the SEC “approve or endorse crypto trading platforms or intermediaries, which, for the most part, are non-compliant with the federal securities laws and often have conflicts of interest.”  SEC, Statement on the Approval of Spot Bitcoin Exchange-Traded Products (Jan. 10, 2024).

2. Coinbase Petition For Rulemaking

On July 21, 2022, Coinbase filed a petition for rulemaking with the SEC seeking “new rules facilitating the use” of digital asset securities.  See Letter from Paul Grewal, Chief Legal Officer, Coinbase Glob., Inc., to Vanessa A. Countryman, Sec’y, SEC (July 21, 2022).  On December 15, 2023, in a 3-2 decision, the Commission denied Coinbase’s petition.  See Letter from Vanessa A. Countryman, Sec’y, SEC, to Paul Grewal, Chief Legal Officer, Coinbase Glob., Inc. (Dec. 15, 2023).  In its ruling, the Commission stated that it disagreed with the “assertion that application of existing securities statutes and regulations to crypto asset securities, issuers of those securities, and intermediaries in the trading, settlement, and custody of those securities is unworkable.”  Id.  In a statement supporting this decision, Chairman Gensler reaffirmed the SEC’s approach stating that “existing laws and regulations apply to the crypto securities markets.”  See Statement on the Denial of a Rulemaking Petition Submitted on behalf of Coinbase Global, Inc. (Dec. 15, 2023).

On December 15, 2023, Coinbase filed a petition for review with the U.S. Court of Appeals for the Third Circuit regarding the SEC’s order.  See Coinbase Inc. v. SEC, No. 23-3202 (3d Cir. Dec. 15, 2023), ECF No. 1.

Gibson Dunn represents Coinbase in its petition for review.

3. Non-fungible Tokens (NFTs)

Recent SEC enforcement actions indicate that NFTs may become part of the SEC’s increasing crypto asset enforcement efforts.  See, e.g., Press Release, SEC Charges Creator of Stoner Cats Web Series for Unregistered Offerings of NFTs (Sept. 13, 2023) (charging a company with conducting an $8 million unregistered offering in the form of NFTs); Press Release, SEC Charges LA-Based Media and Entertainment Co. Impact Theory for Unregistered Offering of NFT (Aug. 28, 2023) (settling with a company for conducting an unregistered offering of crypto asset securities).  In these cases, the SEC has generally relied on the Supreme Court’s test in Howey to contend that the NFTs that companies like Impact Theory sell are investment contracts, offered to investors with the process of “tremendous” future value.  See Order Instituting Cease and Desist Proceedings, In re Impact Theory, No. 3-21585 (Aug. 28, 2023).  The Commission’s position on NFT regulation is still unsettled with at least some commissioners objecting to the regulation of NFTs under Howey given that “NFTs were not shares of a company and did not generate any type of dividend for the purchasers.”  NFTs & SEC: Statement on Impact Theory, LLC (Aug. 28, 2023).

VII. LORENZO DISSEMINATOR LIABILITY

As previously discussed in our 2019, 2022, and 2023 Mid-Year Updates, in Lorenzo, the Supreme Court expanded the scope of scheme liability to include individuals who disseminate false or misleading information, but do not make misstatement(s), to potential investors with the intent to defraud.  139 S. Ct. 1094 (2019).  As a result, individuals who do not make false or misleading statements may nevertheless be subject to “scheme liability” under Rules 10b-5(a) and 10b-5(c) for disseminating the alleged misstatement(s) of another if plaintiff can show that the individual knew the alleged misstatement(s) contained false or misleading information.  Following Lorenzo, the Second Circuit found that defendants must do “something beyond” making material misstatements or omissions, such as disseminating the alleged misstatements, to be subject to scheme liability under Rules 10b-5(a) and (c).  SEC v. Rio Tinto plc, 41 F.4th 47, 54 (2d Cir. 2022); see also Client Alert (Gibson Dunn represents Rio Tinto in this litigation).

Although the Supreme Court and most circuit courts have not directly addressed the requirements for scheme liability after Lorenzo, several recent district court decisions have added to the debate.

In SEC v. Hwang, a case involving market manipulation claims against the CFO and principal of a family office stemming from alleged misrepresentations to counterparties in swap transactions, the Southern District of New York dismissed the scheme liability claims against the CFO while upholding the scheme liability claims against the principal.  2023 WL 6124041, at *5, *7-8, *18 (S.D.N.Y. Sept. 19, 2023).  In applying the Rio Tinto “something beyond” standard, the court dismissed the scheme liability claims against the CFO because he merely directed his subordinates to craft the alleged misrepresentations and he did not participate in the dissemination of the misrepresentations himself.  Id. at *8.  Unlike the claims against the CFO, the court upheld scheme liability claims against the principal because the court accepted the SEC’s allegations that the principal “directed Archego’s staff to trade in a manner that would artificially inflate the price of [his company’s] holdings.”  Id. at *9.

In another case in the Southern District of New York, SEC v. Farnsworth, the court sustained scheme liability claims against former executives of MoviePass, Farnsworth and Lowe, for making public statements that MoviePass was seeing a natural drop off in users, when MoviePass was allegedly manufacturing a decrease in users by artificially interfering with its own users’ ability to take full advantage of the services MoviePass offered.  2023 WL 5977240, at *1-2, *18 (S.D.N.Y. Sept. 14, 2023).  Specifically, the court found that allegedly resetting customers’ passwords or subjecting them to ticket-verification procedures to discourage usage of the subscription service was sufficient additional conduct to sustain scheme liability claims under Lorenzo and Rio Tinto.  Id. at *18.

In a case from the United States District Court for the District of Columbia, In re Bed Bath & Beyond Corporation Securities Litigation, the court cited positively to Rio Tinto, although it did not explicitly adopt the Second Circuit’s “something beyond” standard.  2023 WL 4824734, at *12 (D.D.C. July 27, 2023).  In that case, the court sustained scheme liability claims against Bed Bath & Beyond for allegedly delaying its SEC filings to stimulate trading of its stock to piggyback off the alleged misstatements of an activist investor.

In a recent case from the Northern District Court of Texas, the Court found that the allegedly inflated valuations contained in internal planning documents were sufficient to sustain a scheme liability claim.  Yoshikawa v. Exxon Mobil Corporation, 2023 WL 5489054, at *8-9 (N.D. Tex. Aug. 24, 2023).  Plaintiffs alleged that an employee instructed her team to manipulate internal valuations of certain assets to support the company’s allegedly prior misleading public statements regarding the growth potential of certain assets to investors.  Id. at *4-5, *8-9.  Defendants argued that plaintiffs failed to plead deceptive conduct beyond misstatements and omissions, but, citing to Rio Tinto, the Court disagreed and denied the motion to dismiss with respect to the scheme liability claim.  Id. at *9.  The Court otherwise dismissed 10b-5(b) misstatement and omissions claims in their entirety for failure to adequately plead scienter with respect to the challenged statements.  Id. at *10.

In another case from the Northern District Court of Texas, Linenweber v. Southwest Airlines Co., the court, citing Rio Tinto, granted defendants’ motion to dismiss, concluding that “misstatements and omissions alone do not suffice for scheme liability.”  2023 WL 6149106, at *14 (N.D. Tex. Sept. 19, 2023) (quoting SEC v. Rio Tinto plc, 41 F.4th 47, 48 (2d Cir. 2022)).  In the case, plaintiffs claimed that defendants’ scheme was “portraying Southwest’s aircraft as safe and compliant while concealing a wide-range of safety hazards and regulatory non-compliance issues.”  Id. at *14.  The court dismissed plaintiffs’ scheme liability claims because plaintiffs failed to identify any fraudulent or deceptive acts beyond the misleading statements portraying Southwest’s aircraft as safe while allegedly concealing other safety hazards.  Id.

VIII. MARKET EFFICIENCY AND “PRICE IMPACT” CASES

As discussed in our Client Alert and Mid-Year Update, the long-running class certification dispute in Arkansas Teacher Retirement System v. Goldman Sachs Group, Inc., 77 F.4th 74, 105 (2d Cir. 2023) (“ATRS”), ended this year, with the Second Circuit reversing the class certification order and remanding with instructions to decertify the class.  Following the class decertification—and more than a decade after the case was initially filed—the parties stipulated to a voluntary dismissal with prejudice.

The Second Circuit’s decision to decertify was based on guidance from the Supreme Court’s 2021 decision in Goldman Sachs Group, Inc. v. Arkansas Teacher Retirement System, 141 S. Ct. 1951 (2021) (“Goldman”), which we previously detailed in our 2021 Mid-Year Securities Litigation Update.  In Goldman, the Supreme Court held that courts analyzing whether to grant class certification should consider evidence, including expert evidence, of whether the alleged misstatements were too generic to affect the price of securities, even though that same evidence could be relevant to whether the alleged misstatements were material.  Goldman, 141 S. Ct. at 1960-61.  The Supreme Court also held that if a plaintiffs’ price impact theory is based on “inflation maintenance” (meaning the alleged misstatement did not cause the stock price to increase but instead prevented the price from dropping), then any mismatch between the generic nature of the challenged statements and the specificity of the alleged corrective disclosures is critical in determining whether defendants have rebutted the Basic presumption of class-wide reliance.  Id.

In ATRS, the Second Circuit considered—again—whether this class of investors was properly certified.  ATRS, 77 F.4th at 80-81.  Applying the Supreme Court’s “mismatch framework,” the Second Circuit held that when plaintiffs rely on the inflation-maintenance theory—like plaintiffs in ATRS did—they cannot simply “identify a specific back-end, price-dropping event” and match it to “a front-end disclosure bearing on the same subject” unless “the front-end disclosure is sufficiently detailed in the first place.”  Id. at 81, 102.  After examining the evidence in the case, the Second Circuit ultimately concluded that the mismatch between the generic nature of the alleged misstatements and the specificity of the alleged corrective disclosure was sufficient to “sever the link” between the statements and the stock price drop.  Id. at 104.

Following Goldman and ATRS, lower court decisions are engaging in a more searching analysis of all evidence of price impact, including scrutiny regarding whether the alleged corrective disclosure sufficiently matches the challenged statement.  See e.g., Ramirez v. Exxon Mobil Corp., 2023 WL 5415315, at *11-21 (N.D. Tex. Aug. 21, 2023); Del. Cnty. Emp. Ret. Sys. v. Cabot Oil & Gas Corp., 2023 WL 6300569, at *10-13 (S.D. Tex. Sept. 27, 2023); Hall v. Johnson & Johnson, 2023 WL 9017023, at *10-15 (D.N.J. Dec. 29, 2023).

In Ramirez, for example, a U.S. District Judge in the Northern District of Texas rejected six out of seven of plaintiffs’ alleged corrective disclosures for various reasons.  These reasons included that the experts found no statistically significant price change, Ramirez, 2023 WL 5415315, at *15, *17, *20, *21; there was a lack of analyst commentary about the alleged corrective disclosures, id. at *15-16; the negative price reaction was not properly attributable to the alleged corrective disclosures, id. at *16; and one of the alleged corrective disclosures did not offer any new corrective information, id. at *20.  The court held that the sole remaining alleged corrective disclosure sufficiently illustrated price impact but only in connection with some of the alleged misrepresentations.  Id. at *20.  Based on this analysis, the court certified a class covering a limited period and as to only a subset of challenged statements.  Id. at *22.

We will continue to monitor developments in this area.

IX. OTHER NOTABLE DEVELOPMENTS

A. Circuit Developments In Omnicare Cases

As noted in prior updates, in the nearly nine years since the Supreme Court issued its seminal decision concerning opinion statements in Omnicare, Inc. v. Laborers District Council Construction Industry Pension Fund, 575 U.S. 175 (2015), courts have regularly applied Omnicare, which was decided in the context of a Section 11 claim, to claims brought under the Exchange Act.

In a June 2023 decision, the Third Circuit joined the trend of applying Omnicare to claims brought under the Exchange Act, holding that Omnicare’s opinion-falsity framework applies to claims for violations of Rule 10b-5.  City of Warren Police and Fire Retirement Sys. v. Prudential Fin., Inc., 70 F.4th 668, 685 (3d Cir. 2023).  Plaintiff’s claims stemmed from announcements made by the publicly traded life insurance company, Prudential Financial, Inc. (“Prudential”), that it would need to increase its reserves by $208 million and that its earnings would be reduced by $25 million per quarter for the foreseeable future.  Id. at 676.  Plaintiff, a municipal retirement system and investor in Prudential, alleged that the company knew about problems with its reserves and misled investors about those issues.  Id.  The district court granted Prudential’s motion to dismiss the case for failure to state a claim, reasoning that plaintiff did not adequately plead falsity.  Id.

On appeal, plaintiff argued that four sets of statements were pleaded with particularity and were plausibly false or misleading.  Id. at 681.  The Third Circuit remanded one set of statements to the district court and affirmed the district court’s dismissal of the remaining three sets of statements.  Id. at 676-77.  In affirming the dismissal of claims related to one set of statements, the Third Circuit applied, for the first time, Omnicare’s bases of liability to a claim brought under Section 10(b).  In its ruling, the Third Circuit noted that “every other Court of Appeals to encounter the issue has applied the Omnicare framework for opinion falsity to claims for Rule 10b-5 violations.”  Id. at 685.  The Third Circuit ultimately held that defendant’s representations about the adequacy of its reserve were non-actionable opinions because plaintiff had failed to allege any of the three Omnicare situations in which a statement of opinion could form the basis for liability.  Id. at 686-87.

In an August 2023 decision, the Second Circuit held that a statement of opinion that reflects some subjective judgment must have a sufficient evidentiary basis in order to be non-actionable under OmnicareNew Eng. Carpenters Guaranteed Annuity & Pension Funds v. DeCarlo, 80 F.4th 158, 174 (2d Cir. 2023).  Plaintiffs’ claims stemmed from restatements made by the publicly traded property and casual insurance company, AmTrust Financial Services (“AmTrust”), of five years of financial results to correct “significant errors in its annual and quarterly reports.”  Id. at 165.  Specifically, AmTrust disclosed that it had improperly accounted for certain extended-warranty contracts and certain discretionary employee bonuses.  Id.  In response to the restatements, plaintiffs brought claims against AmTrust for allegedly misstating the company’s financial condition and results in violation of Sections 11, 12, and 15 of the Securities Act, Sections 10(b) and 20(a) of the Exchange Act, and Rule 10b-5.  Id.  The district court dismissed all claims as non-actionable statements of opinion.  Id.

On appeal, the Second Circuit affirmed the district court’s dismissal of plaintiffs’ Section 10(b) and Rule 10b-5 claims against AmTrust for failure to raise a strong inference of scienter.  Id. at 178-79. But the Second Circuit vacated the district court’s dismissal of (1) plaintiffs’ Section 11 claims related to AmTrust’s accounting for certain extended-warranty contracts and (2) plaintiffs’ Section 11 and Section 12(a)(2) claims related to AmTrust’s accounting of discretionary employee bonuses.  Id. at 172, 174-76.

First, the Second Circuit held that plaintiffs sufficiently alleged that AmTrust omitted material facts such that its financial statements related to warranty-contract revenue were misleading and reversed the district court’s dismissal of plaintiffs’ Section 11 claims arising from these statements.  Id. at 174 (citing Omnicare, 575 U.S. at 192).  The court rejected the argument that the accounting decision was a “judgment call” and thus non-actionable, reasoning that subjective judgments presume some historical evidence, and GAAP allows time-of-sale recognition only if evidence justifies doing so.  Id.

Second, the Second Circuit held that plaintiffs plausibly alleged that AmTrust’s statements regarding bonuses not being “probable” lacked sufficient evidentiary basis and reversed the district court’s dismissal of plaintiffs’ related Section 11 and Section 12(a)(2) claims.  Id. at 175 (citing Omnicare, 575 U.S. at 188-89).  In so doing, the Second Circuit noted that the district court should, at the pleading stage, accept plaintiffs’ claim that AmTrust had a practice of paying earned bonuses and that there was no reason to believe continued payment was not “probable.”  Id.

The Second Circuit did affirm the district court’s dismissal of plaintiffs’ Section 11 claims concerning certifications signed by AmTrust’s officers.  Id. at 176.  The court held that the certifications were opinions explicitly based on the officer’s knowledge and that plaintiffs failed to allege the officers had knowledge of the financial reporting’s alleged inaccuracy.  Id.  Specifically, the Second Circuit held that plaintiffs failed to establish a lack of a meaningful inquiry in order to create liability and further stated that opinions that “turned out to be wrong” are not necessarily actionable.  Id. (citing Omnicare, 575 U.S. at 186, 188).

B. Courts Decline To Enforce Control Share Acquisition Provisions

In 2023, two courts declined to enforce state control share acquisition statutes due to the statutes’ conflict with the guarantee of “one share, one vote” found in Section 18(i) of the Investment Company Act of 1940.  Section 18(i) requires that every share of stock “be a voting stock and have equal voting rights with every other outstanding voting stock.”  15 U.S.C. § 80a-18(i).  In contrast, control share acquisition statutes typically allow companies to alter or remove voting rights when a person acquires a certain minimum percentage of the company’s shares, with such minimum being determined by the specific state control share acquisition statute.  Generally, control share acquisition statutes apply exclusively to closed-end funds.  SEC, Control Share Acquisition Statutes, Staff Statement (May 27, 2020).  Roughly half of all states have corporate control share acquisition statutes in effect.  Id.

This past year, Saba Capital Management, LP and its affiliates (together, “Saba”) successfully challenged the enforceability of closed-ended funds’ and business trusts’ control share acquisition provisions on the grounds that they violate Section 18(i).  See Saba Cap. CEF Opportunities 1, Ltd. v. Nuveen Floating Rate Income Fund, 88 F.4th 103, 114 (2d Cir. 2023); Saba Cap. Master Fund, Ltd. v. BlackRock Mun. Income Fund, Inc., 2024 WL 43344, at *6 (S.D.N.Y. Jan. 4, 2024).  The Nuveen defendants were Massachusetts closed-ended investment funds; the BlackRock defendants were Maryland closed-ended mutual funds and individual trustees.  Defendants in both cases enacted bylaws which restricted the voting power of any person holding 10% or more of the funds’ shares.  Nuveen, 88 F.4th at 109; BlackRock, 2024 WL 43344, at *1.  Saba sued, claiming that these provisions violated Section 18(i)’s guarantee of “one share, one vote.”  Nuveen, 88 F.4th at 115; BlackRock, 2024 WL 43344, at *1.

In Nuveen and BlackRock, the Second Circuit affirmed a grant of summary judgment, and a district court in the Southern District of New York granted summary judgment, respectively, for Saba against the defendant funds.  In Nuveen, the Second Circuit rejected defendants’ contention that the provision restricted the shareholder, not the shares.  Nuveen, 88 F.4th at 11820.  In BlackRock, the district court rejected defendants’ argument that the control share resolutions fell under an exception Section 18(i) for provisions that are “otherwise required by law” because such provisions were authorized by Maryland’s Control Share Acquisition Act.  BlackRock, 2024 WL 43344, at *6.  The court did not find this argument persuasive, ruling that “[t]he fact that Maryland law allows funds to adopt such control share resolutions does not in any way mean that Maryland law requires as much.”  Id.  Furthermore, both courts noted that the Investment Company Act of 1940 defines “voting security” as “any security presently entitling the owner or holder thereof to vote for the election of directors of a company.”  Nuveen, 88 F.4th at 117; BlackRock, 2024 WL 43344, at *6 (emphasis added).  Consequently, the courts held that the restrictions denied shareholders the right to presently vote their shares, thus violating Section 18(i).  Nuveen, 88 F.4th at 11921; BlackRock, 2024 WL 43344, at *67.

Though other circuits have yet to test the conflict between state control share acquisition statutes and Section 18(i), these decisions suggests courts may be hesitant to allow voting restrictions placed on certain shares held by large shareholders.

C. Ninth Circuit Holds That SEC Rule 16b-3 Does Not Require Purpose-Specific Board Approval of Transactions

In a case of first impression, the Ninth Circuit held that SEC Rule 16b-3, which exempts from Section 16(b) liability transactions between an issuer and a director where the issuer’s board approves the transaction, does not require the board to approve the transaction for the “specific purpose” of exempting it from Section 16(b) liability.  Roth v. Foris Ventures, LLC, 86 F.4th 832, 835, 837 (9th Cir. 2023).  Roth reached the Ninth Circuit on a “rare” interlocutory appeal under 28 U.S.C. § 1292 after the district court denied defendants’ motion to dismiss the plaintiff’s claims under Section 16(b).  Id. at 836.

The Ninth Circuit reversed the district court’s ruling on the issue of board approval and held that Rule 16b-3(d) does not require purpose-specific approval of a transaction.  Id. at 837.  The court analyzed the plain text of the rule and explained that the only relevant question was whether the transaction was “approved by the board of directors of the issuer.” Id. at 836.  The court found that there was no indication in the rule that “the board must approve the transaction for the specific purpose of exempting it from Section 16(b) liability.”  Id. at 836-37.  In analyzing this issue, the Ninth Circuit reached the same conclusion as the Second Circuit did when presented with a similar question.  See Gryl v. Shire Pharms. Grp. PLC, 298 F.3d 136, 146 (2d Cir. 2002) (holding that “a securities transaction need not receive purpose-specific approval in order to qualify for the Board Approval Exemption of Rule 16b-3(d)(1)”).

The Ninth Circuit’s ruling clarifies a developing area of securities law concerning the scope of exemptions for “short-swing” stock trades by officers, directors and other corporate insiders.

D. Sixth Circuit Grants Interlocutory Appeal Of Class Certification Decision On Affiliated Ute/Comcast Issues

In November, the Sixth Circuit granted utility company FirstEnergy’s petition for interlocutory review of a class certification.  Order, In re FirstEnergy Corp., Nos. 23-0303/0304/0305/0306/0307 (6th Cir. Nov. 16, 2023).  The complaint alleged a large corruption and bribery scheme purportedly carried out by FirstEnergy in which the company paid out millions to various politicians in exchange for a bailout of its nuclear power plants.  In re FirstEnergy Corp. Sec. Litig., 2023 WL 2709373, at *2 (S.D. Ohio 2023).  The complaint further alleged that FirstEnergy made both affirmative misrepresentations (when it represented that it complied with all lobbying registration and disclosure requirements despite purportedly making clandestine contributions to state representatives) and fraudulent omissions (when it failed to disclose the purported scheme in its SEC registration statements).  Id. at *3, *5.  The district court certified a class under the Affiliated Ute presumption of reliance—which provides a mechanism for plaintiffs in cases involving omissions to show reliance on a class-wide basis—ruling that plaintiffs are entitled to the Affiliated Ute presumption so long as a court finds that defendants made any omissions of material fact.  Id. at *16-17, *19-20.  The court also held that predominance was satisfied because damages could be calculated via a statutory formula, thus satisfying Comcast Corp. v. Behrend, 569 U.S. 27 (2013), which requires plaintiffs to offer a class-wide model for calculating damages that “measure[s] only the damages attributable to [a] [p]laintiffs’ theory of liability.”  Id. at *15-16.

In its brief for petition for review of the class certification order, FirstEnergy first argued that the Sixth Circuit should clarify that the Affiliated Ute standard applies only where plaintiffs’ case primarily involves omissions and is inapplicable to cases that have a mix of both omissions and misrepresentations.  Reply Brief of Defendants at 3, In re FirstEnergy Corporation Securities Litigation, No. 23-0303 (6th Cir. May 2, 2023).  FirstEnergy also argued that the district court’s ruling contradicted Comcast by certifying plaintiffs’ Exchange Act class based on a damages methodology that was inconsistent with their theory of liability.  Id. at 6.

E. Companies Continue To Face Exposure For Alleged Misrepresentations Related To Purported Cybersecurity Vulnerabilities

Cybersecurity and data privacy concerns continue to be an area of activity for shareholders and the SEC.  In April 2023, a shareholder derivative suit was filed involving Okta, Inc., a cloud-based software company alleging that the company’s directors permitted Okta to issue misleading risk disclosures contained in its March 2022 Form 10-K.  Complaint, Buono v. McKinnon, 23-cv-00413 (D. Del. Apr. 14, 2023), ECF No. 1.  Plaintiff alleged that the warnings about cybersecurity incidents were misleading because they failed to disclose that the company was “susceptible and vulnerable to security breaches,” including one the company later disclosed.  Id. at 31-32, 35-36, 40.  The lawsuit, which is stayed by agreement of the parties, adopts allegations from a separate securities class action lawsuit in which the court dismissed securities fraud claims based on the same theory.  In re Okta, Inc. Sec. Litig., No. 22-cv-02990 (N.D. Cal. Mar. 17, 2023), ECF No. 73.

In the enforcement space, the SEC filed a cybersecurity-related complaint against SolarWinds Corporation and its chief information security officer in October 2023.  Complaint, SEC v. SolarWinds Corporation, No. 23-cv-9518 (S.D.N.Y. Oct. 30, 2023).  The complaint alleged that SolarWinds knew since 2018 that it had major cybersecurity deficiencies after internal assessments concluded that the company’s remote access virtual private network was “not very secure” and that the vulnerability, if exploited, would let someone “basically do whatever without [SolarWinds] detecting it until it’s too late.”  Id. at 5.  Between January 2019 and December 2020, SolarWinds suffered a cyberattack that compromised its flagship product and impacted thousands of its customers.  Id. at 2, 7.  The SEC alleged that SolarWinds therefore misled investors in its filings by disclosing only generic and hypothetical risks when in reality it knew the true extent of its own cybersecurity vulnerabilities and the increased risks the company faced.  Id. at 39.  In a press release related to the enforcement action, the SEC cautioned issuers to “implement strong [cyber] controls calibrated to your risk environments and level with investors about known concerns.”  Press Release, SEC, SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures (Oct. 30, 2023).

The SEC’s enforcement action against SolarWinds followed the implementation of new cybersecurity risk management rules that the SEC adopted in late July, which require companies to disclose (1) material cybersecurity incidents within four business days of the company’s determination that the cybersecurity incident is material and (2) the company’s “cybersecurity risk management, strategy, and governance.”  Press Release, SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (July 26, 2023).  For additional details on these new rules, please see the Gibson Dunn update published after the rules were adopted.


The following Gibson Dunn lawyers participated in preparing this update: Monica K. Loseman, Brian M. Lutz, Craig Varnen, Jefferson E. Bell, Christopher D. Belelieu, Michael D. Celio, Mary Beth Maloney, Lissa M. Percopo, Jessica Valenzuela, Allison K. Kostecka, Mark H. Mixon, Jr., Chase Weidner, Luke A. Dougherty, Tim Kolesk, Chase Beauclair, Trevor Gopnik, Lydia Lulkin, Dillon M. Westfall, Megan R. Murphy, Sophia Amir, Eitan Arom, Maura Carey*, Tawkir Chowdhury, Angela A. Coco, Dasha Dubinsky, Mason Gauch, John Harrison, Mary Karapogosian, Suzi Kondic, Neel Lakhanpal*, Ahin Lee*, Connor Leydecker, Daniel Liu, Riley Majeune, Zachary Montgomery, Narayan Narasimhan, Kate Oh, Ty Shockley, Alon H. Sugarman, and Hayato Watanabe.

Gibson Dunn lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Securities Litigation practice group:

Christopher D. Belelieu – New York (+1 212.351.3801, [email protected])
Jefferson Bell – New York (+1 212.351.2395, [email protected])
Michael D. Celio – Palo Alto (+1 650.849.5326, [email protected])
Jonathan D. Fortney – New York (+1 212.351.2386, [email protected])
Monica K. Loseman – Co-Chair, Denver (+1 303.298.5784, [email protected])
Brian M. Lutz – Co-Chair, San Francisco (+1 415.393.8379, [email protected])
Mary Beth Maloney – New York (+1 212.351.2315, [email protected])
Jason J. Mendro – Washington, D.C. (+1 202.887.3726, [email protected])
Alex Mircheff – Los Angeles (+1 213.229.7307, [email protected])
Lissa M. Percopo – Washington, D.C. (+1 202.887.3770, [email protected])
Jessica Valenzuela – Palo Alto (+1 650.849.5282, [email protected])
Craig Varnen – Co-Chair, Los Angeles (+1 213.229.7922, [email protected])
Allison K. Kostecka – Denver (+1 303.298.5718, [email protected])
Mark H. Mixon, Jr. – New York (+1 212.351.2394, [email protected])

*Maura Carey, a recent law graduate in the Palo Alto office, and Neel Lakhanpal and Ahin Lee, recent law graduates in the New York office, are not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The proposed information sharing system will help to bring Hong Kong in line with global trends and enhance the effectiveness of its mechanisms to combat fraud, money laundering and terrorist financing. 

On January 23, 2024, the Hong Kong Monetary Authority (“HKMA”) published the “Public Consultation on a Proposal for Information Sharing Among Authorized Institutions to Aid in Prevention or Detection of Crime” (“Consultation Paper”).[1] In short, the Consultation Paper proposes to facilitate information sharing among Authorized Institutions (“AIs”) in respect of personal bank accounts for the purpose of preventing or detecting fraud or money laundering and terrorist financing (“ML/TF”).  The proposal also considers the introduction of legislative amendments to provide “safe harbor” protection to AIs which share information for the purposes of preventing or detecting fraud or ML/TF, provided the AIs comply with appropriate safeguards.

I. Why encouraging information sharing between AIs?

While information sharing among AIs and law enforcement agencies has been successful in combatting a wide range of financial crimes, the HKMA recognizes that such arrangements may not, by themselves, be sufficient to fully address the risk of ML/TF via networks of accounts maintained or controlled by criminals (commonly referred to as “mule account networks”), since information might not be shared quickly enough to intercept illicit funds.  Delays in information sharing provides an opportunity for criminals to exploit information gaps between AIs to rapidly move and conceal illicit funds.  For example, by the time one AI has frozen the accounts maintained or controlled by criminals, those responsible may have already succeeded in moving their illicit funds to their mule accounts in another AI, which the first AI may not be able to quickly alert.

Therefore there has been a global trend towards encouraging information sharing among financial institutions  to combat crime and related ML/TF.  In Hong Kong, participating AIs can share information on corporate accounts with one another through the Financial Intelligence Evaluation Sharing Tool (“FINEST”) launched in June 2023.  However FINEST currently does not support information sharing on personal accounts due to concerns over data privacy.  The Consultation Paper points out that FINEST’s ability to prevent and detect crime would be enhanced if information sharing were extended to personal accounts because a significant portion of mule account networks involve bank accounts held by individuals.  As such, the importance of safeguarding data privacy and customer confidentiality should be balanced against the need for information sharing among AIs to detect or prevent crime and facilitate the interception of illicit funds.

II. What is the effect of the “safe harbor”?

The HKMA proposes to introduce legislative amendments to provide “safe harbor” protection to AIs which share information on personal accounts with other AIs solely for the purposes of preventing or detecting fraud or ML/TF.  The “safe harbor” would provide AIs with legal protection from breach of legal, contractual or other restrictions on disclosure of information, and AIs also will not be held liable for claimed loss arising out of disclosures made.  However the “safe harbor” will only apply if the AI complies with the safeguards discussed below.

III. What is the scope of information that could be shared between AIs?

While the scope of information to be shared will vary on a case-by-case basis, the Consultation Paper proposes that it could generally include:

  • Bank account numbers;
  • Personal data (e.g. name, date of birth, identity card number) of a customer or counterparty who is a natural person;
  • Personal data of any beneficial owners or connected party (e.g. a director, partner, or trustee, as applicable) of a customer who is a legal person, a trust, or a legal arrangement similar to a trust;
  • Personal data of any person purporting to act on behalf of a customer (e.g. acting under power of attorney, or an account signatory);
  • Details of relevant transactions including counterparties;
  • Reasons why the transactions or activity may be involved in fraud or ML/TF.

IV. Is information sharing mandatory or voluntary?

Under the proposed system, information sharing by AIs will be made by participating AIs on a voluntary basis.

V. Will changes be made to the STR regime?

The HKMA proposes to introduce a legislative provision that will make clear for the avoidance of doubt that information sharing among AIs under the proposed arrangements will not constitute the offence of “tipping off” under the Organized and Serious Crimes Ordinance (Cap. 455) (“OSCO”) and the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405) (“DTROP”).[2]  The obligation to file STRs will remain unchanged.

VI. What safeguards will be implemented?

The HKMA recognizes the importance of protecting the data privacy and customer confidentiality of legitimate customers.  The HKMA therefore proposes that the “safe harbor” should only apply where appropriate safeguards are complied with, as summarized below:

  • The information is shared solely for the purpose of detecting or preventing financial crime;
  • AIs receiving information are required to treat it in the same manner, and to the same standards of confidentiality, as other confirmation information;
  • Onward sharing of information received by an AI to another AI is only permitted if is for the purpose of detecting or preventing financial crime, and subject to the same requirements regarding confidentiality;
  • Information sharing will only be permitted via secure channels such as FINEST (and AIs will need to demonstrate that they are technically and operationally ready and have implemented appropriate systems and controls in order to be permitted to access such platforms);
  • An AI should only request for information from another AI where the requesting AI has reasonable grounds to believe that the other AI is able to provide information which will assist with preventing or detecting financial crime (including in deciding whether to file an STR);
  • To prevent “fishing expeditions,” requests for information must be specific and identify the subject of the request, relevant transactions and reasons for suspecting that an activity is connected with financial crime;
  • Sharing of information will be on a need-to-know basis, i.e. an AI will only be permitted to request or disclose information where they have observed suspicious activity that may indicate that a person, account or transaction may be involved in fraud or ML/TF;
  • AIs need to adopt a risk-based approach with respect to information shared under the “safe harbor”, e.g. AIs should not terminate a customer relationship merely because the customer is included in information shared or requested (instead, an AI should always conduct its own risk assessment before deciding on the appropriate action to take).

The HKMA proposes to set out the specific requirements in the legislative amendments and the HKMA will also issue statutory guidance setting out its expectations on complying with the relevant requirements.  The information sharing mechanism would be supervised by the HKMA, and the HKMA proposes to have the power to impose penalties on AIs that fail to comply with the relevant requirements.

VII. Conclusion

The proposed information sharing system will help to bring Hong Kong in line with global trends and enhance the effectiveness of its mechanisms to combat fraud and ML/TF.  The HKMA notes that the United States, United Kingdom and Singapore have already introduced legislation to allow financial institutions to share information concerning individuals and entities where financial crime is suspected.  While the specific requirements under each jurisdiction differs, they all provide a safe harbor for financial institutions which disclose information where financial crime is suspected.

The HKMA aims to issue its consultation conclusions and prepare the necessary legislative amendments in the second half of 2024.  Interested parties are encouraged to provide feedback by March 29, 2024.

__________

[1] Available at: https://www.hkma.gov.hk/media/eng/regulatory-resources/consultations/Consultation_on_AI-AI_info_sharing_en.pdf.

[2] Under section 25A(5) of OSCO and DTROP, a person commits an offence if, knowing or suspecting that an STR has been filed, the person discloses to another person any matter which is likely to prejudice any investigation which might be conducted following the filing of the STR.


The following Gibson Dunn lawyers prepared this client alert: William Hallatt, Arnold Pun, and Jane Lu*.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact any member of Gibson Dunn’s Global Financial Regulatory team, including the following members in Hong Kong and Singapore:

William R. Hallatt – Hong Kong (+852 2214 3836, [email protected])
Grace Chong – Singapore (+65 6507 3608, [email protected])
Emily Rumble – Hong Kong (+852 2214 3839, [email protected])
Arnold Pun – Hong Kong (+852 2214 3838, [email protected])
Becky Chung – Hong Kong (+852 2214 3837, [email protected])

*Jane Lu is a paralegal (pending admission) in the firm’s Hong Kong office who is not yet admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

We are pleased to provide you with Gibson Dunn’s Accounting Firm Quarterly Update for Q4 2023. The Update is available in .pdf format at the below link, and addresses news on the following topics that we hope are of interest to you:

  • 2023: The Audit Enforcement Year in Review
  • PCAOB Publishes Enforcement Orders Against China-Based Firms, Even as Congress Contemplates Further Action
  • SEC Cybersecurity Disclosure Rules Go into Effect
  • SEC Approves 2024 PCAOB Budget
  • SEC Chief Accountant Issues Statements on Cash Flow Reporting and Professional Skepticism
  • Second Circuit Limits SEC’s Ability to Seek Disgorgement
  • Canadian Public Accountability Board Provides Insights on 2023 Audit Quality Assessment Results
  • UK Economic Crime and Corporate Transparency Act 2023 Goes into Effect While FRC Revises Corporate Governance Code
  • PCAOB Makes Personnel Changes
  • PCAOB Announces Staff Priorities for 2024 Inspections and Interactions with Audit Committees
  • FinCEN Corporate Transparency Reporting Goes into Effect
  • Other Recent SEC and PCAOB Enforcement and Regulatory Developments

Please let us know if there are topics that you would be interested in seeing covered in future editions of the Update.

Read More


Accounting Firm Advisory and Defense Group:

James J. Farrell – Co-Chair, New York (+1 212-351-5326, [email protected])

Monica K. Loseman – Co-Chair, Denver (+1 303-298-5784, [email protected])

Michael Scanlon – Co-Chair, Washington, D.C.(+1 202-887-3668, [email protected])

In addition to the Accounting Firm Advisory and Defense Practice Group Chairs listed above, this Update was prepared by David Ware, Timothy Zimmerman, Benjamin Belair, Adrienne Tarver, Monica Limeng Woolley, Douglas Colby, John Harrison, and Nicholas Whetstone.

© 2023 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

From the Derivatives Practice Group: This week, ISDA, ESMA, and the CPMI published reports on various derivatives initiatives and reforms.

New Developments

  • SEC Adopts Rule to Expand Definitions of “Dealers” and “Government Securities Dealers.” On February 6, the SEC adopted a rule that requires market participants to register as “dealers” or “government securities dealers” for the first time and become members of a self-regulatory organization (SRO). The final rule, codified in Exchange Act Rules 3a5-4 and 3a44-2, purports to define the phrase “as a part of a regular business” in Sections 3(a)(5) and 3(a)(44) of the Securities Exchange Act of 1934 to identify certain activities that would cause persons engaging in such activities to be “dealers” or “government securities dealers” and be subject to the registration requirements of Sections 15 and 15C of the Act, respectively. Under the final rule, any person that engages in activities as described in the rule is a “dealer” or “government securities dealer” and, absent an exception or exemption, required to: register with the SEC under Section 15(a) or Section 15C, as applicable; become a member of an SRO; and be subject to applicable SRO and Treasury rules and requirements. Notably, the rule is non-exclusive, meaning that even if a firm does not meet any of the criteria in the rule, the SEC claims that the firm could still be a dealer anyway depending on the “facts and circumstances.”
  • SEC and CFTC Adopt Amendments to Enhance Private Fund Reporting. On February 8, the SEC adopted amendments to Form PF, the confidential reporting form for certain SEC-registered investment advisers to private funds, including those that also are registered with the CFTC as commodity pool operators or commodity trading advisers. According to the SEC, the amendments, which the CFTC concurrently adopted, are designed to enhance the ability of the Financial Stability Oversight Council (FSOC) to monitor and assess systemic risk and to bolster the SEC’s oversight of private fund advisers and the agency’s investor protection efforts. The SEC and CFTC also agreed to a memorandum of understanding related to the sharing of Form PF data. The SEC stated that, among other things, the amendments to Form PF will enhance how large hedge fund advisers report investment exposures, borrowing and counterparty exposure, market factor effects, currency exposure, turnover, country and industry exposure, central clearing counterparty reporting, risk metrics, investment performance by strategy, portfolio liquidity, and financing and investor liquidity in an effort to provide better insight into the operations and strategies of these funds and their advisers and improve data quality and comparability. Further, the amendments will require additional basic information about advisers and the private funds they advise, including identifying information, assets under management, withdrawal and redemption rights, gross asset value and net asset value, inflows and outflows, base currency, borrowings and types of creditors, fair value hierarchy, beneficial ownership, and fund performance, which, according to the SEC, will provide greater insight into private funds’ operations and strategies, assist in identifying trends, including those that could create systemic risk, improve data quality and comparability, and reduce reporting errors. The amendments will also require more detailed information about the investment strategies, counterparty exposures, and trading and clearing mechanisms employed by hedge funds, while also removing duplicative questions.
  • CFTC Global Markets Advisory Committee Advances Key Recommendations. On February 8, the CFTC’s Global Markets Advisory Committee (GMAC), sponsored by Commissioner Caroline D. Pham, formally advanced eight recommendations to the CFTC that are intended to enhance the resiliency and efficiency of global markets, including U.S. Treasury markets, repo and funding markets, and commodity markets. To date, this is the largest number of recommendations advanced by a CFTC Advisory Committee in a single meeting. The GMAC’s Global Market Structure Subcommittee prepared four recommendations: (1) appropriately calibrated block and cap sizes under CFTC Part 43 swap data reporting rules, intended to enhance market liquidity and financial stability; (2) addition of certain central counterparties (CCPs) as permitted counterparties under CFTC Rule 1.25(d), intended to promote the well-functioning of the repo market; (3) expansion of cross-margining between the CME Group and the Fixed Income Clearing Corporation, intended to support greater efficiency in the U.S. Treasury markets; and (4) best practices for exchange volatility control mechanisms, intended to address market stress and market dislocation during periods of high volatility. The GMAC’s Technical Issues Subcommittee prepared four additional recommendations, as follows: (5) adoption of lessons learned from a global default simulation across CCPs, intended to address systemic risk and promote financial stability; (6) harmonization of the treatment of money market funds as eligible collateral, intended to improve market liquidity; (7) improvement of trade reporting for market oversight, intended to ensure international standardization and global aggregation and analysis of data to address systemic risk; and (8) improvement of trade reporting for market oversight, intended to facilitate data sharing across jurisdictions for systemic risk analysis.
  • CFTC Customer Advisory Alerts App and Social Media Users to Financial Romance Fraud. On February 7, the CFTC’s Office of Customer Education and Outreach (OCEO) issued a customer advisory alerting dating/messaging app and social media users to a scam asking for financial support or giving investment advice using the platforms. The Customer Advisory: Six Warning Signs of Online Financial Romance Frauds, reminds app and social media users to be wary of texts and messages from strangers that promote cryptocurrency investments. According to the OCEO, the text could actually be from international criminal organizations that trick victims into investing money in cryptocurrency or foreign currency scams only to defraud them. The OCEO stated that the scam can take advantage of even the savviest of investors because fraudsters develop relationships with their victims through weeks of seemingly authentic text messaging conversations, a practice known as “grooming.” The advisory points out several warning signs of a financial grooming fraud, which include fraudsters attempting to move conversations from a dating or social media platform to a private messaging app, as well as their claims of wealth from cryptocurrency or foreign currency trading due to insider information. The advisory also includes steps users can take to avoid financial grooming frauds.
  • CFTC Extends Public Comment Period on Proposed Rule on Protection of Clearing Member Funds. On February 2, the CFTC extended the deadline for the public comment period on a proposed rule to address protecting clearing member funds held by derivatives clearing organizations. The deadline is being extended to March 18, 2024. The CFTC stated that it provided the extension in response to a request by a commenter.
  • Commissioner Pham Announces Additional Executive Staff Appointments. CFTC Commissioner Caroline D. Pham announced new executive staff appointments in her Washington, D.C. office on February 1. Taylor Foy joins Commissioner Pham’s team as a Senior Advisor and Nicholas Elliot has joined as a Confidential Assistant and Policy Advisor.

New Developments Outside the U.S.

  • CPMI, IOSCO Publish Paper on Streamlining VM in Centrally Cleared Markets. On February 14, the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published a discussion paper on streamlining variation margin (VM) in centrally cleared markets. The discussion paper follows the review of margining practices, published in 2022 by the Basel Committee on Banking Supervision, the CPMI and IOSCO. The discussion paper sets out eight effective practices, covering intraday VM call scheduling and frequency, treatment of excess collateral, the pass-through of VM by central counterparties (CCPs) and transparency between CCPs, clearing members and their clients. The deadline for comment is April 14. [NEW]
  • ESMA Withdraws Euronext Authorization as a Data Reporting Service Provider Under MIFIR Upon the Entity’s Request. On February 13, ESMA withdrew the authorization of Euronext Paris SA (Euronext) as a Data Reporting Service Provider (DRSP) under the Markets in Financial Instruments Regulation (MiFIR). Euronext was authorized as both an Approved Reporting Mechanism and an Approved Publication Arrangement under MiFIR since January 3, 2018. MiFIR provides that ESMA shall withdraw the authorization of a DRSP where the DRSP expressly renounces its authorization. ESMA’s withdrawal decision follows the notification by Euronext of its intention to renounce its authorization under the conditions set out in Article 27e(a) of MIFIR. [NEW]
  • ESMA Publishes Latest Edition of its Newsletter. On February 13, ESMA published  its latest edition of the Spotlight on Markets Newsletter. The newsletter focused on the last ESMA consultation package related to the Markets in Crypto Assets Regulation (MiCA). ESMA invited stakeholders to send their feedback on reverse solicitation and classification of crypto assets as financial instruments by April 29, 2024. The newsletter also launched a call for candidates for ESMA’s Securities Markets Stakeholder Group and called interested parties who can give a strong voice to consumers, industry, users of financial services, employees in the financial sector, SMEs as well as academics to apply by March 18. [NEW]
  • Hong Kong Government Launches Consultation on Regulating OTC Trading of Virtual Assets. On February 8, the Hong Kong government launched a public consultation on legislative proposals to introduce a licensing regime for providers of over-the-counter trading services of virtual assets (VAs). Under the proposed licensing regime, any person who conducts a business in providing spot trading services of VAs-for-money or money-for-VAs will be required to be licensed by the Commissioner of Customs and Excise, irrespective of whether the services are provided through a physical outlet and/or digital platforms. Licensees will be required to comply with AML/CFT requirements and other regulatory requirements. The public consultation period ends on April 12, 2024.
  • HKMA Consults on Capital Treatment of Cryptoasset Exposures. On February 7, the Hong Kong Monetary Authority (HKMA) published a Consultation Paper on CP24.01 Cryptoasset Exposures setting out a proposal for implementing new regulations on the prudential treatment of cryptoasset exposures based on the Basel Committee on Banking Supervision’s Prudential treatment of cryptoasset exposures standard. According to the consultation paper, for the purpose of the prudential treatment of cryptoasset exposures, cryptoassets will be defined as private digital assets that depend on cryptography and distributed ledger technologies or similar technologies. The HKMA has scheduled a preliminary consultation on the proposed amendments to the rules in the second half of 2024 and aims to put new standards into effect no earlier than July 1, 2025.
  • EU Co-Legislators Reach Provisional Agreement on EMIR 3. On February 6, the EU co-legislators reached a provisional political trilogue agreement on the European Market Infrastructure Regulation 3. On the issue of an active account requirement, while the agreement is based on the less punitive operational active account with representativeness approach proposed by the Council of the EU, the European Parliament has proposed that counterparties should clear at least five trades through an EU CCP in each of the most relevant subcategories. The original approach proposed by the council only required one trade per relevant subcategory. On the topic of supervision, the agreement includes a new role for the European Securities and Markets Authority (ESMA) as co-chair of CCP supervisory colleges alongside national competent authorities and a coordinating role in an emergency.
  • ESA’s Joint Board of Appeal Confirms ESMA’s Decision to Withdraw the Recognition of Dubai Commodities Clearing Corporation. On February 6, the Joint Board of Appeal of the European Supervisory Authorities (the ESAs) unanimously decided to dismiss the appeal brought by Dubai Commodities Clearing Corporation (DCCC) against ESMA and to therefore confirm the ESMA decision to withdraw its recognition. The application was brought in relation to ESMA’s Decision, adopted under Article 25p of Regulation (EU) No 648/2012 (EMIR), to withdraw the recognition of DCCC as a Tier 1 third-country CCP. The decision is a consequence of the United Arab Emirates (UAE) being included by the European Commission on the list of high-risk third countries presenting strategic deficiencies in their national anti-money laundering and counter financing of terrorism (AML/CFT) regime, provided for in the Commission Delegated Regulation (EU) 2016/1675. The Joint Board of Appeal of the ESAs had decided to suspend the ESMA decision in October 2023 until the outcome of the appeal was concluded. With today’s publication, the suspension has expired and the ESMA decision has become fully operational.
  • ESMA Publishes Guidelines on CCP Recovery and Resolution. On February 2, ESMA published two sets of guidelines relating to the EU CCP Recovery and Resolution Regulation. The first set of guidelines provides EU authorities with guidance on the provisions that should be included in cooperation arrangements with third-country authorities, on matters such as the exchange of information for the preparation and maintenance of resolution plans, and on the mechanisms for prompt informing to parties before any early intervention power or resolution action. The second set of guidelines provides EU authorities with guidance on practical arrangements for the establishment and functioning of the resolution college for EU CCPs, and to facilitate the effective operation of the college.
  • ESAs Recommend Steps to Enhance the Monitoring of BigTechs’ Financial Services Activities. On February 1, the ESAs published a Report setting out the results of a stock take of BigTech direct financial services provision in the EU. The Report identifies the types of financial services currently carried out by BigTechs in the EU pursuant to EU licenses and highlights inherent opportunities, risks, regulatory and supervisory challenges. The stock take showed that BigTech subsidiary companies currently licensed to provide financial services pursuant to EU law mainly provide services in the payments, e-money and insurance sectors and, in limited cases, the banking sector. However, the ESAs have yet to observe their presence in the market for securities services. To further strengthen the cross-sectoral mapping of BigTechs’ presence and relevance to the EU’s financial sector, the ESAs propose to set-up a data mapping tool. The ESAs explained that this tool is intended to provide a framework that supervisors from the National Competent Authorities would be able to use to monitor on an ongoing and dynamic basis the BigTech companies’ direct and indirect relevance to the EU financial sector.

New Industry-Led Developments

  • ISDA Response to Australian Treasury on Financial Market Infrastructure Reforms. On February 9, ISDA and the Futures Industry Association submitted a joint response to the Australian Treasury’s draft financial market infrastructure reform package. In the response, the associations considered the proposed crisis resolution regime, which would provide the Reserve Bank of Australia (RBA) with powers to step in and resolve a crisis affecting a domestic central counterparty (CCP), with the aim of ensuring the continuity of critical clearing functions and maintaining financial stability in Australia. The associations expressed concerns with some of the provisions contemplated in the draft regime and asked if the issues highlighted in the response (such as the ability of the RBA or statutory manager to direct and make changes to the operating rules, the lack of explicit definitions of and safeguards on resolution powers and the interaction with close-out netting) could be addressed. [NEW]
  • ISDA Response on Anti-Greenwashing Rules. On January 26, ISDA submitted a response to the UK Financial Conduct Authority’s consultation on GC23/3: Guidance on the Anti-Greenwashing Rule. In the response, ISDA highlights that actual or perceived misrepresentation of sustainability features may have a detrimental impact on investor and consumer perceptions of sustainable finance products, and ISDA supports efforts to enhance trust in the market. ISDA considers that sustainability-linked derivatives, environmental, social and governance derivatives and voluntary carbon credits fall within the scope of the rule.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (+1 212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

For the sixth consecutive year, and following the publication of Gibson Dunn’s annual U.S. Cybersecurity and Data Privacy Outlook and Review in 2024, we offer this separate International Outlook and Review.

As every year, this Outlook and Review provides an overview of past and upcoming developments related to global privacy and cybersecurity laws.

In 2023, data protection laws continued to be adopted across numerous international jurisdictions. Switzerland, the United Kingdom, India, Vietnam and Saudi Arabia, among others, passed new laws, amendments or implementing regulations paving the way for a new round of significant data privacy regimes. It is expected that authorities will make full use of their powers in order to apply and enforce their respective data protection legislation in the near future.

In the European Union (“EU”), EU supervisory authorities continued to apply and enforce the General Data Protection Regulation (“GDPR”) vigorously while the European Data Protection Board (“EDPB”) issued and updated various guidelines providing useful interpretation of the GDPR.

Finally, we noted a significant number of developments in the European digital regulatory landscape.

We cover these topics and many more in this year’s International Cybersecurity and Data Privacy Outlook and Review.

I.  European Union

A.  EU-U.S. Data Privacy Framework

As we indicated in the 2023 International Outlook and Review, the EU-U.S. Privacy Shield was struck down on 16 July 2020, by the Schrems II ruling of the Court of Justice of the European Union (“CJEU”).[1] In order to replace the Privacy Shield and to safeguard cross-border data flows, the European Commission had launched the process to adopt an adequacy decision for the transfer of personal data between the EU and the U.S. (the “EU-U.S. Data Privacy Framework”). On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. This decision concludes that the United States ensures an adequate level of protection – comparable to that of the EU – for personal data transferred from the EU to U.S. companies under the new framework. The EU-U.S. Data Privacy Framework introduces new binding safeguards to address all the concerns raised by the CJEU, including limiting access to EU data by U.S. intelligence services to what is necessary and proportionate, and establishing a Data Protection Review Court (“DPRC”), to which EU individuals will have access.

U.S. companies are able to join the EU-U.S. Data Privacy Framework by committing to comply with a detailed set of privacy obligations.

B.  Network Information Security Directive

The Directive (EU) on measures for a high common level of cybersecurity across the Union 2022/2555[2] (“NIS 2 Directive”) entered into force on 16 January 2023 and replaced the Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (“Network Information Security” or “NIS”).

The NIS 2 Directive sets the baseline for cybersecurity risk management measures, and reporting obligations across all sectors that are covered by the Directive, such as energy, transport, health and digital infrastructure (e.g., cloud computing service providers, data center service providers, providers of public electronic communications networks or services) and digital providers (e.g., providers of online marketplaces, providers of social networking services platforms).

In addition, the NIS 2 Directive sets the baseline for reporting obligations. In particular, if an incident has a significant impact on the provision of services covered by the Directive, an authority must be notified without undue delay.

The Member States will have to adopt and publish the measures necessary to comply with the NIS 2 Directive by 17 October 2024.[3]

C.  Data Governance Act

The Regulation (EU) 2022/868 on European data governance of 30 May 2022 (“Data Governance Act”)[4], entered into force on 24 September 2023. The Regulation seeks to increase trust in data sharing, strengthen mechanisms to increase data availability and overcome technical obstacles to the reuse of data, notably with public actors. In particular, the Data Governance Act allows new data intermediaries to act as trustworthy actors in the data economy and lays down rules to enable data altruism.

D.  The Digital Operational Resilience Act

The Regulation (EU) 2022/2554 of 14 December 2022 on  digital operational resilience for the financial sector, (“Digital Operational Resilience Act” or “DORA”),[5] which focuses on preventing and mitigating cyber threats, entered into force on 16 January 2023 and will apply from 17 January 2025 to financial entities (including credit and payment institutions, electronic money institutions, crypto-asset service providers), as well as information and communication technology (“ICT”) third-party service providers.

In particular, financial entities’ management body will be responsible to define, approve and oversee the management of ICT risks. Financial entities will also have requirements on reporting major ICT-related incidents to the competent authorities. In addition, DORA contains requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities.

E.  Data Act

On 22 December 2023, the Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data[6] was published in the Official Journal of the European Union. Most of the provisions of the Data Act will be applicable on 12 September 2025 but some will be applicable from 12 September 2026 and 12 September 2027.

Among the key measures of the Data Act, the Regulation imposes obligations on manufacturers and service providers to let their users (companies or individuals) access and reuse the data generated by the use of their products or related services. In addition, the Data Act aims at easing the sharing of user data to third parties and the switching between providers (portability). Finally, the Regulation prohibits unfair contractual terms in data sharing.

F.   Cyber Resilience Act

The proposal for a Regulation on cybersecurity requirements for products with digital elements of 15 September 2022 (“Cyber Resilience Act” Proposal) aims at protecting both consumers and businesses from products with inadequate security features and thereby ensure a better level of cybersecurity.

In particular, the Proposal introduces mandatory cybersecurity requirements and obligations for manufacturers as well as importers and distributors of products with digital elements within the EU. Any vulnerability contained in the product or any incident impacting its security will have to be reported by the manufacturer to the EU Agency for Cybersecurity (“ENISA”). The “critical products” (e.g., operating systems, firewalls or network interfaces) would be subject to a specific compliance procedure.

This Proposal, if adopted, will be directly applicable in all Member States. Sanctions for violation will depend on the concerned breach (up to €15 million or 2.5% of the company’s total worldwide annual turnover of the preceding financial year, whichever is higher).

On 30 November 2023, the Council and the European Parliament reached a provisional agreement on the proposed Regulation. The agreement reached is now subject to formal approval by both the European Parliament and the Council. Once adopted, companies will have two years to adapt to the new requirements.

G. EDPB Guidance

The EDPB updated its existing guidelines on various topics, including:

i.         Guidelines 04/2022 on the calculation of administrative fines under the GDPR,[7] which aim to provide a clear and transparent basis for the supervisory authorities’ setting of fines.

ii.         Guidelines 03/2021 on the application of Article 65(1)(a) GDPR,[8] which aim to clarify the applicable legal framework and main stages of the procedure, in accordance with the relevant provisions of the Charter of Fundamental Rights of the European Union, the GDPR and EDPB Rules of Procedure.

iii.         Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement,[9] which aim to inform about certain properties of facial recognition technology and the applicable legal framework in the context of law enforcement (in particular the Law Enforcement Directive).

iv.         Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority,[10] which aim to update the previous version of these guidelines since there was a need for further clarifications, specifically regarding the notion of main establishment in the context of joint controllership and taking into account the EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR.

v.         Guidelines 01/2022 on data subject rights – Right of access,[11] which aim to provide guidance on how the right of access has to be implemented in practice.

vi.         Guidelines 9/2022 on personal data breach notification under the GDPR,[12] which aim to update the previous version of these guidelines since there was a need to clarify the notification requirements concerning personal data breaches in non-EU establishments.

vii.         Guidelines 07/2022 on certification as a tool for transfer,[13] which aim to provide guidance as to the application of Article 46 (2) (f) of the GDPR on transfers of personal data to third countries or to international organisations on the basis of certification.

viii.         Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR,[14] which aim to clarify the scenarios for which the EDPB considers that the requirements of Chapter V should be applied. To that end, the EDPB has identified three cumulative criteria to qualify a processing operation as a transfer.

ix.         Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them,[15] which aim to offer practical recommendations to social media providers as controllers of social media, designers and users of social media platforms on how to assess and avoid so-called “deceptive design patterns” in social media interfaces that infringe on GDPR requirements.

The EDPB also issued guidelines for public consultation, including:

i.         Guidelines 2/2023 on Technical scope of Article 5(3) of ePrivacy Directive[16] which aim at conducting a technical analysis on the scope of application of Article 5(3) ePrivacy Directive, namely to clarify what is covered by the phrase ‘to store information or to gain access to information stored in the terminal equipment of a subscriber or user’.

ii.         Guidelines 01/2023 on Article 37 Law Enforcement Directive[17], which aim at providing guidance as to the application of Article 37 of the Law Enforcement Directive on transfers of personal data by competent authorities of EU Member States to third country authorities or international organisations competent in the field of law enforcement.

II.  Enforcement by Supervisory Authorities

In 2023, the GDPR and the Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (“e-Privacy Directive”)[18] continued to be applied and enforced by Member States’ supervisory authorities which imposed substantial fines. We have gathered below a list of important fines published in 2023:

  • On 15 June 2023, the French Supervisory Authority imposed a €40 million fine on a global adtech giant for a multitude of GDPR violations related to its targeted advertising practices.[19] The company specializes in “behavioural retargeting”, which consists of tracking the navigation of Internet users in order to display personalized advertisements. In particular, the Authority considered that the advertising company had failed to demonstrate that the data subjects gave their consent.
  • On 28 September 2023, the Italian Supervisory Authority imposed a fine of €10 million on an electricity and gas supplier, for the activation of unsolicited contracts in the free market through the processing of inaccurate and out-of-date customer data.[20] The Authority also ordered corrective actions, such as implementing a contract accuracy verification system, alert systems to identify improper data acquisition, and enhancing audit procedures against sales agencies.
  • On 13 April 2023, the Italian Supervisory Authority fined a telecommunications giant €7.6 million for unlawful processing of millions of individuals’ data for marketing purposes (namely calls without any consent or in spite of the called individuals being on a public opt-out register).[21]
  • On 5 October 2023, the Croatian Supervisory Authority fined a debt collection company €5.47 million for lack of appropriate technical measures to protect personal data, lack of legal basis and failure to inform data subjects about the processing of their health data and telephone records.[22]
  • The French Supervisory Authority published a decision issued on 17 April 2023, imposing a €5,2 million fine on a facial recognition company, for failing to comply with the injunction issued in its October 2022 sanction decision. Back in October 2022, the Authority had fined the company €20 million and enjoined the company to refrain from collecting and processing the data of individuals in France without a legal basis, and to delete the data of these individuals after responding to requests for access. The injunction was accompanied by a penalty of 100,000 euros per day of delay at the end of the two-month period. The Authority considered that the company had not complied with the order and imposed an overdue penalty payment[23].
  • On 12 June 2023, the Swedish Supervisory Authority imposed a SEK58 million fine (approx. €4,9 million) fine on a company providing an audio streaming service for shortcomings regarding the right of access.[24] The Authority considered that the company does not provide information about how it uses the personal data upon a request of access of individuals and specifies that this information must be easy to understand. In addition, personal data that is difficult to understand, such as those of a technical nature, may need to be explained not only in English but in the individual’s own native language. The Authority has further found that the company had failed in its handling of requests for access related to two out of three of the complaints examined.
  • On 28 August 2023, the Swedish Supervisory Authority fined an insurer SEK35 million (approx. €3 million) for exposing on its online portal sensitive data belonging to hundreds of thousands of customers.[25]
  • On 28 July 2023, the Spanish Data Supervisory Authority issued a €2,5 million fine on a banking institution for not complying with the data protection by design and by default requirements and for not implementing appropriate security measures to address potential risks.[26]
  • On 4 May 2023, the Croatian Supervisory Authority imposed a €2.26 million fine on a debt collection agency. The investigation revealed three violations of the GDPR, namely failure to inform data subjects about data processing activities, failure to have a data processing agreement with a processor and failure to implement appropriate technical and organisational measures.[27]
  •  On 27 November 2023, the Norwegian Supervisory Authority announced a NOK20 million (approx. €1.7 million) fine issued to the Norwegian public welfare agency because the safeguarding of confidentiality in the IT systems of the agency was unsatisfactory.[28]
  • On 27 June 2023, the Swedish Supervisory Authority fined a mass media company SEK13 million (approx. €1 million) for profiling customers and website visitors without consent (unlawfully trying to rely on legitimate interest).[29]
  • On 22 June 2023, the Italian Supervisory Authority announced that a  company in the motorway business was fined €1 million for violating the GDPR. In this ruling, the Authority considered that the company violated the principles of accuracy and transparency, given the failure to provide adequate information in relation to the processing, as well as the misclassification of the GDPR status.[30]

 III.  Developments in Other European Jurisdictions: UK, Switzerland and Turkey

A.  UK

1.  Online Safety Act

The Online Safety Bill received Royal Assent on 26 October 2023, becoming the Online Safety Act 2023. The Act introduces new obligations on the design, operation and moderation of platforms. The UK Office of Communications (“Ofcom”) will enforce the Act’s requirements on platforms and will release its plan to implement online safety laws into practice in the following three phases[31]: (i) illegal content; (ii) child safety, pornography, and protecting women and girls; and (iii) additional duties for categorised services. On 9 November 2023, Ofcom released its first guidance and draft code of practice under the Act that covers illegal content such as terrorism and child abuse material. Ofcom is currently “consulting on these detailed documents, hearing from industry and a range of experts as [Ofcom] develop[s] long-term, final versions that [Ofcom] intend[s] to publish in autumn [2024]”[32]. Responses to the consultation can be submitted until 23 February 2024.[33]

2.  Data Protection and Digital Information Bill No.2

The Data Protection and Digital Information Bill was first introduced in July 2022 and paused in September 2022 so that ministers could engage in a co-design process with business leaders and data experts.[34] The Data Protection and Digital Information (No. 2) Bill[35] (the “DPDI Bill”) was introduced on 8 March 2023 and aims to introduce a business-friendly framework[36], cut down paperwork for businesses and reduce unnecessary cookie pop-ups. The Information Commissioner’s Office (the “ICO”) responded to the DPDI Bill in May 2023, setting out general comments (such as welcoming the UK Government’s decisions that maintain the ICO’s high standards for the protection of individuals’ rights and freedoms), as well as targeted comments on specific clauses of the DPDI Bill.[37] The DPDI Bill is currently at the Committee stage in the House of Lords.

3.  UK-U.S. Data Bridge

On September 21, 2023 the UK Secretary of State for Science, Innovation and Technology laid regulations in the UK Parliament to give effect to the decision to establish a UK-U.S. Data Bridge. The decision was based on her determination that the UK-U.S. Data Bridge “maintains high standards of privacy for UK personal data”[38]. The UK-U.S. Data Bridge came into effect on 12 October 2023 and permits organizations in the UK to transfer personal data to U.S. organizations certified to the “UK Extension to the EU-U.S. Data Privacy Framework” without the need for further safeguards, such as international data transfer agreements (the UK version of the EU’s standard contractual clauses). There are requirements for both UK and U.S. organizations in order to implement the Data Bridge, such as updating privacy policies and certifying to the Data Privacy Framework List[39].

4.  AI and Data Protection

On 15 March 2023, the ICO announced that it had updated its guidance on artificial intelligence (“AI”) and data protection.[40] The ICO provides detailed guidance on how to apply the principles of the UK GDPR. The ICO indicates that the changes respond to requests from UK industry to clarify requirements for fairness in AI, and provides updated guidance in the areas of accountability and governance, transparency, lawfulness, accuracy, and fairness. The ICO also provides a toolkit regarding AI and data protection (that is designed to provide practical support to reduce risks to individuals’ rights and freedoms caused by an organisation’s own AI systems)[41] and a data analytics toolkit (to assist organisations to recognise the rights and freedoms of individuals created by the use of data analytics)[42].

5.  Data Scraping

On 24 August 2023, the ICO released a joint statement on data scraping and the protection of privacy with data protection and privacy authorities from Australia, Canada, Hong Kong, Switzerland, Norway, New Zealand, Columbia, Jersey, Morocco, Argentina and Mexico.[43] The statement calls for the protection of people’s personal data from unlawful data scraping taking place on social media sites. It also sets expectations for how social media companies should protect individuals’ data from unlawful data scraping.

6.  Direct Marketing and Regulatory Communications Guidance for Regulated Private Companies

In March 2023, the ICO issued guidance to businesses operating in regulated private sectors (i.e., “sectors where a statutory regulator has oversight”[44] such as the finance, pension, communications and energy sectors) on direct marketing and regulatory communications. The guidance aims to help businesses identify when a regulatory communication message might count as direct marketing. It also covers what businesses need to do to comply with data protection and ePrivacy law in sending messages that qualify as direct marketing.

B.  Switzerland

On 1 September 2023, the Federal Act on Data Protection 2020 (“FADP”)[45] and the Ordinance on the Federal Act on Data Protection (“FODP”)[46] entered into force. Following this new regulation, the Federal Data Protection and Information Commissioner (“FDPIC”) introduced a “DataBreach Portal” designed for reporting security vulnerabilities, an online registration system for the contact details of DPOs and a portal for Federal bodies to report their data processing activities to the FDPIC.[47]

On 4 April 2023, the FDPIC issued a statement on the use of ChatGPT and comparable artificial intelligence supported apps. In particular, the FDPIC recognised the opportunities of using AI-supported applications such as ChatGPT for society and the economy. However, it emphasises that the processing of personal data using these new technologies also entails risks for privacy and informational self-determination.[48]

In Switzerland, the Federal Administration is evaluating various approaches to regulating AI by the end of 2024.

Finally, the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) was adopted in July 2023 so that participating US organisations will be deemed to provide adequate privacy protection as required for receiving personal data from Switzerland under the FADP. However; to date, personal data from Switzerland cannot be transferred to U.S. organisations in reliance on the Swiss-U.S. DPF until the Swiss Federal Administration issues an adequacy decision recognizing that the Swiss-U.S. DPF ensures data protection consistent with Swiss law.

C.  Turkey

On 13 October 2023, the Personal Data Protection Authority (“KVKK”) published guidelines on considerations in the processing of genetic data. In particular, the KVKK provides guidance for controllers to process personal data based on correct legal basis and to fulfil their obligations in accordance with the regulation.[49]

On 26 October 2023, the KVKK announced that it signed a cooperation and information sharing protocol with the Competition Authority. In particular, the KVKK considered that the increasing processing of personal data through big data technologies may raise significant concerns in terms of competition and the protection of personal data, making cooperation between the relevant authorities inevitable.[50]

IV.  Developments in Asia-Pacific

A.  Australia

As explained in previous editions of the International Outlook and Review, the Australian Government commenced a wholesale review of the Privacy Act 1988 (“Privacy Act”) in 2020, with a view to implementing significant reforms to the country’s privacy regime. After nearly three years and multiple rounds of consultation, the Attorney-General released the final report on 16 February 2023 (“Privacy Act Review Report”).[51] The Government subsequently considered the Privacy Act Review Report and released its proposed response on 28 September 2023.[52]

The Privacy Act Review Report puts forward 116 proposals, aimed at clarifying the scope of the Privacy Act, uplifting protections for individuals, providing clarity for regulated entities and enhancing enforcement mechanisms. In its response, the Government agreed to 38 of those proposals, agreed in-principle to a further 68 and noted the remaining 10. Where the Government “agreed in-principle” with a proposal, it has indicated that its agreement is subject to further engagement with industry and a comprehensive impact analysis to strike a balance between the protection of individual privacy and the resulting cost to businesses. What this means in practice remains to be seen.

Key reforms that the Government has agreed or agreed in-principle to include:

  • expanding the definition of personal information to include inferred or generated information, and clarifying that de-identification is a process rather than an outcome;
  • introducing a new definition of sensitive information that includes genomic information, and requiring explicit consent for its collection, use and disclosure;
  • strengthening the consent requirements by making consent clear, specific, informed, unambiguous, freely given and easy to withdraw;
  • creating new rights for individuals, such as the right to access and correct their personal information, the right to delete their personal information, the right to data portability and the right to object to certain processing activities;
  • enhancing the obligations for entities, such as requiring them to conduct privacy impact assessments for high-risk practices, to implement privacy by design and default principles and to adopt data minimisation and retention policies;
  • increasing the enforcement and oversight powers of the regulator, including by enabling it to issue infringement notices, civil penalties, enforceable undertakings, injunctions and compensation orders; and
  • establishing a mechanism to recognise countries and certification schemes that provide adequate or comparable protection to personal information transferred from Australia, and developing standard contractual clauses for cross-border data flows.

The Attorney-General will lead the next stage of reform required to implement the proposals in the Privacy Act Review Report, including the following:

  • developing legislative proposals which are ‘agreed’ and conducting further targeted consultation with entities on proposals which are ‘agreed in-principle’ to explore whether and how they could be implemented so as to proportionately balance privacy safeguards with the corresponding regulatory burdens;
  • developing a detailed impact analysis, to determine potential compliance costs for industry and other potential economic costs or benefits of the revised regime (including for consumers); and
  • progressing further advice to Government in 2024, including outcomes of additional consultation and legislative proposals.

The Government has indicated that it will consider appropriate transition periods as part of the development of legislation as well as appropriate guidance and other supports which could be developed to help entities understand their compliance requirements. Legislative reforms to the Privacy Act will also be complimented by other reforms that are being progressed by the Government, including the Digital ID, the National Strategy for Identity Resilience and Supporting Responsible AI in Australia.

In this context, the Government released the 2023-2030 Australian Cyber Security Strategy and Action Plan on 22 November 2023.[53] The Strategy and Action Plan set out a vision for Australia to become a world leader in cyber security by 2030. As part of this, the Government has proposed key legislative reforms, including:

  • introduction of a no-fault, no-liability ransomware reporting regime for businesses;
  • amendments to the existing data retention requirements in Australia, with a focus on non-personal data;
  • amendments to the Security of Critical Infrastructure Act 2018 (Cth) to extend its application to data storage systems and business critical data, increase Government management, review and remedy powers and impose more onerous cyber obligations and reporting requirements on entities operating certain critical infrastructure;
  • introduction of a limited use obligation for cyber incident information provided to the Australian Signals Directorate (ASD) and the National Cyber Security Coordinator, restricting how such information can be used by other Government entities (including regulators);
  • establishment of a Cyber Incident Review Board to conduct no-fault incident reviews and share findings with the Australian public; and
  • introduction of mandatory secure-by-design standards for Internet of Things (IoT) devices, a voluntary labelling scheme for consumer-grade smart devices and a voluntary code of practice for app stores and app developers.

The Government has committed $586.9 million to the Strategy. In December 2023, the Department of Home Affairs released a Consultation Paper providing further detail with respect to certain proposed legislative reforms contemplated in the Action Plan.[54] The Consultation Paper is open for public consultation and submissions will close on 1 March 2024.

B.  China

China’s Personal Information Protection Law (“PIPL”) continued to take shape in 2023 as the Cyberspace Administration of China (“CAC”) issued further implementing regulations and guidelines in both draft and final form. Notable regulations and guidelines that were issued include the following:

  • Measures on the Standard Contract for the Export of Personal Information – In February 2023, the CAC released the final version of the Measures on the Standard Contract for the Export of Personal Information[55] along with the Standard Contract for the export of personal information.[56]
    • The Measures and Standard Contract supplement Article 38(3) of the PIPL and establish requirements for Chinese controllers and foreign recipients in relation to the export of personal information from China. While the new requirements came into effect on 1 June 2023, controllers had a six-month grace period (which expired on 30 November 2023) to ensure compliance.
    • Controllers are only permitted to utilise the Measures where they are not a critical information infrastructure operator (“CIIO”) and do not otherwise meet certain volume thresholds with respect to their data processing or exports. Prior to relying on the Measures, eligible controllers must also undertake the following:
      • confirm that they are eligible to utilise the Standard Contract (i.e., do not meet the prescribed thresholds);
      • conduct and complete a personal information protection impact assessment (“PIPIA”);
      • negotiate and execute the Standard Contract with the foreign recipient based on the template issued by the CAC; and
      • file the completed PIPIA report along with the executed Standard Contract with the CAC.
  • Guidelines for the filing of Standard Contracts for Exporting Personal Information – In May 2023, the CAC published new Guidelines for the filing of Standard Contracts for Exporting Personal Information.[57] These guidelines echo the filing requirements set out in the Measures described above and provide an outline of the filing process that controllers are required to undertake pursuant to the Measures.
  • Draft Administrative Measures for Compliance Audit of Personal Information Protection – In August 2023, the CAC published the draft Administrative Measures for Compliance Audit of Personal Information Protection for public comment.[58] The draft Measures set out requirements for compliance audits under Articles 54 and 64 of the PIPL, which stipulate that controllers must regularly conduct compliance audits to ensure compliance with the PRC’s laws and administrative regulations and otherwise authorise responsible authorities to mandate compliance audits.
  • Draft Provisions on Regulating and Promoting Cross-Border Data Transfers – In October 2023, the CAC published draft Provisions on Regulating and Promoting Cross-Border Data Transfers.[59] These Provisions appear to be an attempt by CAC to reassure foreign businesses regarding compliance with the onerous data export restrictions imposed by those Measures implementing Article 38 of the PIPL.
    • The draft Provisions contemplate the following:
      • introduction of a potential waiver (exercisable by CAC) of the requirement to conduct a Security Assessment for controllers that export the personal information of more than 100,000 but less than 1 million people;
      • clarification that data will only be regarded as “important data” if it is explicitly designated as such by regulators or local authorities; and
      • exemption of specified cross-border data transfers from the transfer mechanisms set out in Article 38, including (i) for personal information that is not collected or generated within the PRC; (ii) where it is necessary for the performance of a contract to which the data subject is a party to; (iii) employee data cross-border transfers that are necessary for HR management in accordance with legally formulated labour policies or collective employment contracts; (iv) cross-border data transfers by controllers that expect to transfer the personal information of less than 10,000 individuals out of the PRC within a year; and (v) cross-border data transfers falling outside the negative list to be formulated by Free Trade Zones.
    • Public comment on the draft Provisions ended on 15 October 2023, however, the CAC has not yet issued a final version of the Provisions.
  • Practical Guidelines on Cross-border Personal Information Protection Requirements – In November 2023, China’s National Information Security Standardisation Technical Committee (“TC260”) published the draft Practical Guidelines on Cross-border Personal Information Protection Requirements in the Guangdong-Hong Kong-Macau Greater Bay Area (“Draft GBA Guidelines”).[60] The Draft GBA Guidelines propose a certification regime for cross-border data transfers within the GBA (i.e., cities in the Guangdong province and Hong Kong). Further details and the implications of the Draft GBA Guidelines outside of China are described in the Hong Kong summary below.

C.  India

After several years and multiple proposed bills, the Indian Government finally enacted a comprehensive data protection law in 2023. The Digital Personal Data Protection Act, 2023 (the “DPDP Act”) received royal assent on 11 August 2023 and will come into force in phases (on dates to be notified), effecting wholesale changes to the processing and protection of personal data in the world’s most populated country.[61]

The DPDP Act represents a more streamlined and focused approach to data protection regulation than prior iterations, departing from the 2022 draft which was criticised as being overly prescriptive and compliance-heavy, and for providing undue access to data by state and law enforcement agencies. While the DPDP Act sets out a framework for India’s new data protection regime, many of the details are pending the release of implementing regulations which the Government plans to finalise in due course.

Key features of the DPDP Act include the following:

  • Extraterritorial application – the DPDP Act will apply to processing conducted outside of India if performed in connection with offering goods or services to data subjects in India (referred to as “data principals”).[62] Unlike equivalent foreign data protection regimes (such as the GDPR and CCPA), the DPDP Act does not also apply extraterritorially to processing conducted to monitor the behaviour of data subjects located in India. Further, in light of India’s substantial inbound outsourcing industry, the provisions of the DPDP Act setting out the obligations of controllers (referred to as “data fiduciaries”), rights of data subjects and restrictions on data exports for processing will not apply to the processing of foreign individuals’ personal data carried out in India pursuant to a contract between a controller and a person located outside of India.[63]
  • Sensitive personal data – the DPDP Act does not contain any supplemental obligations with regard to the processing of specific types of data (e.g., what would be considered “special category personal data” under the GDPR or “sensitive personal information” under the CCPA). Despite this, the DPDP Act requires that controllers obtain consent from a parent or lawful guardian when processing the personal data of children (being those under the age of 18) or persons with disabilities.[64]
  • Consent to processing – the DPDP Act imposes a notice and consent regime for the processing of personal data.[65] Consent must be free, specific, informed, unconditional and unambiguous, and should be given through clear affirmative action. When obtaining consent, controllers must provide a clear and plainly worded privacy notice to data subjects stating (i) the type of personal data being processed; (ii) the purpose of the processing; and (iii) how data subjects can exercise certain rights under the DPDP Act, including to withdraw their consent and file a complaint with the regulator. Consent is not required in certain prescribed circumstances, including when processing is necessary to undertake a merger or similar corporate action.
  • Grounds for processing – the DPDP Act provides a limited set of legitimate grounds for processing in the absence of consent,[66] including: (i) for fulfilling any obligation under law; (ii) in order to respond to a medical emergency; and (iii) where the data subject has voluntarily provided their personal data to the controller and has not indicated an objection to the use of their personal data. Notably, the reasonable purposes and public interests grounds contained in the 2022 draft were excluded from the final version of the DPDP Act.
  • Obligations of controllers – the DPDP Act imposes broad obligations on controllers,[67] including to (i) ensure processors’ compliance with the act; (ii) establish a mechanism for addressing data subject complaints; (iii) ensure the accuracy and completeness of data; and (iv) delete data if the data subject has withdrawn consent or if it is reasonable to assume that the purpose for processing is not or no longer being served. Controllers designated as “Significant Data Fiduciaries” by the Government (on the basis of factors such as the volume or sensitivity of personal data processed) are also required to (i) appoint a data protection officer and an independent data auditor; and (ii) conduct periodic audits and data protection impact assessments.[68]
  • Cross-border transfers and data localisation – the DPDP Act permits cross-border transfers of personal data to any country unless specifically restricted by the Indian Government.[69] This departs from the 2022 draft, which contemplated a whitelist for this purpose. The DPDP Act also excludes data storage and localisation requirements contained in the 2022 draft that were heavily criticised by commentators and industry groups.
  • Penalties for non-compliance and enforcement – the DPDP Act imposes penalties for non-compliance depending on the type and nature of breach up to a maximum of 250 crore rupees (~USD 30 million).[70] The newly formed Data Protection Board (“DPB”) is responsible for enforcement of the DPDP Act, although its composition and functioning remains subject to the Government’s release of implementing legislation.
  • Government blocking powers – the DPDP Act permits the Government to block public access to a controller’s platform on the recommendation of the DPB, provided that doing so is necessary or expedient in the interests of the public and the controller has had an opportunity to respond.

D.  Indonesia

As explained in the 2023 International Outlook and Review, 2022 was a landmark year for data protection in Indonesia in light of the enactment of Law No.27 of 2022 on Personal Data Protection (“PDP Law”). While the reform agenda in 2023 was necessarily more muted, the Ministry of Communications and Informatics (“MOCI”) publicly released the draft Government Regulation on the Implementation of the Personal Data Protection Law (“Draft Regulation”) on 31 August 2023.[71] Public consultation on the Draft Regulation closed on 14 September 2023 and the Government is expected to release a final version prior to the PDP Law coming into effect later in October 2024.

The Draft Regulation further clarifies the provisions of the PDP Law, setting out binding obligations for covered entities in order to ensure their compliance. The Draft Regulation is extensive (arguably unnecessarily so, comprising 245 articles over 180 pages), however, notable provisions include the following:

  • Scope of personal data – the Draft Regulation provides the MOCI with the discretion to designate certain data as “specific personal data” if the processing of such data has the potential to have a harmful impact on data subjects, potentially widening the scope of the PDP Law in the future.
  • PDP Agency – the Draft Regulation specifies the detailed responsibilities of the PDP Agency, which will supervise the implementation of the PDP Law. These responsibilities include supervising the compliance of covered entities with the PDP Law and its regulations, investigating and tracking alleged violations and imposing administrative sanctions against covered entities where violations are found to have occurred. Despite its extensive mandate, the Government has yet to formally establish the PDP Agency.
  • Consent to processing – the Draft Regulation clarifies that where processing is undertaken on the basis of consent, data subjects must have been provided with a privacy notice and given their explicit lawful consent (including the consent of a parent or lawful guardian where the processing is in relation to personal data of children or persons with disabilities).
  • Grounds for processing – the Draft Regulation provides that controllers intending to undertake processing of personal data on the basis of legitimate interest (as provided for in the PDP Law) must first conduct a legitimate interest assessment to assess the balance between its own interests and the rights of data subjects. Despite this, the Draft Regulation does not provide further clarification or examples as to what would constitute a “legitimate interest” for the purposes of the PDP Law.
  • Data subject rights – the Draft Regulation further details the rights of data subjects contemplated in the PDP Law. The Draft Regulation also provides a short ‘3 x 24’ hour timeframe for controllers to respond to requests by data subjects to exercise their rights.
  • Appointment of a data protection officer (DPO) – the Draft Regulation requires appointment of a DPO where a controller or processor: (i) processes personal data for public service purposes; (ii) engages in core activities that involve regular and large-scale systematic monitoring of personal data; and (iii) conducts large-scale processing of personal data related to specific personal data and/or criminal offenses. Appointment of a DPO is otherwise not mandatory.
  • Cross-border transfers – the Draft Regulation specifies that the PDP Agency will issue a list of countries deemed to have equal or higher levels of personal data protection than those under the PDP Law (thereby permitting offshore data transfers from Indonesia to those countries without obtaining consent from data subjects or otherwise requiring the recipient of the data to implement adequate and binding personal data protection measures). The Draft Regulation also clarifies that controllers may only rely on consent as a basis for cross-border transfers in limited circumstances, including that the transfer is not recurring, involves a limited number of data subjects and the controller has informed the PDP Agency and data subject about the transfer and the legitimate interests of making it.
  • Data Protection Impact Assessments (DPIAs) – the Draft Regulation provides detailed guidance on the processing of high-risk personal data, including on the requirements for undertaking a DPIA. In particular, the Draft Regulation obligates controllers, as part of a DPIA, to systematically describe their personal data processing activities, assess the necessity and proportionality of the processing, conduct a risk assessment to safeguard the rights of data subjects and document the measures taken to protect data subjects from identified risks.

E.  Hong Kong

Hong Kong’s Personal Data (Privacy) Ordinance (“PDPO”) has not undergone any substantive amendment since changes were introduced in 2021 to combat doxxing acts which intrude on personal data privacy. Despite this, it is expected that the Hong Kong Government will – in coming years – seek to update the PDPO to bring it in line with more robust international privacy regimes such as the PIPL and GDPR.

On 29 June 2023, China’s CAC and Hong Kong’s Innovation, Technology and Industry Bureau (“ITIB”) signed a memorandum of understanding (“MoU”) for data transfers within the Great Bay Area (“GBA”, covering cities in the Guangdong province and Hong Kong). The contents of the MoU were not made public, however, in a press release, the ITIB indicated that it is intended to facilitate data flows between the PRC and Hong Kong and to provide a convenient channel for this purpose.[72]

Subsequent to agreement of the MoU – and as noted in the summary for China above – the National Information Security Standardization Technical Committee (“TC260”) published the Draft GBA Guidelines, proposing a draft certification regime for cross-border data transfers within the GBA.[73] The Draft GBA Guidelines ease certain PIPL requirements for cross-border data transfers, however go beyond those under the PDPO by requiring data exporters to enter into a legally binding agreement, comply with additional security and notification requirements and take substantive steps to prevent the onward transfer of data to third countries. In light of this, utilisation of the certification regime in its current form is likely to be limited to PRC-based data exporters with affiliates in Hong Kong – whereas Hong Kong-based data exporters with affiliates in the PRC will presumably eschew certification in favour of the less restrictive PDPO regime. In any event, the precise application of the regime proposed under the Draft GBA Guidelines remains to be seen, with details regarding the certification procedure and enforcement of the Draft GBA Guidelines yet to be published.

On the enforcement front, the Hong Kong Office of the Privacy Commissioner for Personal Data (“PCPD”) published its report on 1 June 2023 concerning the investigation of Softmedia Technology Company Limited for alleged failures to take adequate security measures to protect personal data stored in a credit reference platform. The PCPD found that Softmedia had breached Data Protection Principles 4 (Security) and 2(2) (Retention) by allowing access to credit data to at least eight lenders without obtaining evidence of the complainant data subject’s authorisation to do so and by retaining more than 50,000 credit records of borrowers who had completed their repayments over five years prior.[74] The PCPD’s findings clarify that:

  • “personal data” includes pseudonymised data for the purposes the PDPO;
  • Data Protection Principle 4 (Security) requires organisations to take active steps to secure personal data against unauthorised access where necessary (e.g., by restricting the frequency of access, requiring strong login passwords and/or imposing periodic password changes); and
  • Data Protection Principle 2(2) (Retention) places the onus on the controller and not data subjects to assess an appropriate data retention period (i.e., it was insufficient that Softmedia permitted data subjects to request removal of their credit from the platform from five years following repayment).

In response to the breaches, the PCPD issued an enforcement notice requiring Softmedia to take remedial and preventative actions, including deleting credit data in respect of which more than five years had elapsed and formulating policies and measures to restrict access to the credit reference platform.

F.   Japan

2023 saw limited domestic activity with regard to data protection in Japan.

In March, Japan’s Ministry of Internal Affairs and Communications sought public opinions on the revised draft of the Telecommunications Business Act. The draft changes to the law add guidelines to ensure the protection of personal information by telecommunications companies. Public consultation closed on 24 April 2023.[75]

Despite this, various joint initiatives between Japan and foreign governments and data protection authorities were announced in the second half of the year:

  • On 17 October 2023, Japan’s Personal Information Protection Commission and the UK’s Information Commissioner’s Office announced the signing of a Memorandum of Understanding (“MoU”) focused on data protection.[76] The MoU provides that the respective authorities will share certain information regarding investigations. The authorities will not share personal information under the MoU (other than in exceptional cases).
  • On 28 October 2023, Japan and the EU concluded a deal on cross-border data flows at the EU-Japan High Level Economic Dialogue.[77] Once ratified, the agreed provisions will be included in the EU-Japan Economic Partnership Agreement. The deal will allow both parties to “handle data efficiently without cumbersome administrative or storage requirements, and provide them with a predictable legal environment”. An important element of the deal is the removal of requirements for companies to physically store their data locally.
  • On 14 November 2023, the Japan-U.S. Economic Policy Consultative Committee released a joint statement indicating their joint desire to continue collaborating to facilitate cross-border data flows and effective data and privacy protections globally.[78] In support of their efforts to do so, the two nations plan to coordinate bilaterally and multilaterally on outreach to partners to promote expansion of the Global Cross-Border Privacy Rules (CBPR) Forum.

G. New Zealand

Following the recommendations of New Zealand’s Ministry of Justice in its 2022 consultation paper (summarised in the 2023 International Outlook and Review), the Government introduced a Privacy Amendment Bill into New Zealand Parliament in October 2023, proposing new notification requirements related to the indirect collection of personal data.[79]

If the Bill is passed, organisations will need to take reasonable steps to ensure that data subjects are aware of certain details regarding the indirect collection of their personal data, including that their personal data has been collected, why it has been collected, who it will be shared with and what their rights are. Organisations must take these steps as soon as is reasonably practicable after the indirect collection of the relevant personal data, unless the individual has already been made aware of the required matters (e.g., by the entity which performed the direct collection). The Bill also provides for exemptions in certain circumstances – for example, where non-compliance would not prejudice the interests of the individual, compliance would prejudice the purposes of the collection or compliance would not be reasonably practicable in the circumstances. If passed, the changes in the Bill will be subject to a grace period and will not apply to personal data collected before 1 June 2025. The Bill nonetheless remains subject to public comment, as well as the various steps of the New Zealand legislative process.

H.  Philippines

On 7 November 2023, the National Privacy Commission (“NPC”) issued Advisory No. 2023-01 (the “Advisory”), which provides further clarity on how personal information controllers (“PICs”) and personal information processors (“PIPs”) should avoid practices involving deceptive design patterns, which refer to “design techniques embedded on an analog or digital interface that aim to manipulate or deceive a data subject to perform a specific act”, in connection with the processing of personal data.[80] The Advisory reminds PICs and PIPs to abide by the principle of fairness, and to ensure that personal data is processed in a manner that is “neither manipulative nor unduly oppressive to a data subject”.

The Advisory covers best practices concerning both Appearance-Based and Content-Based Deceptive Designs, and provides a non-exhaustive list of prevalent deceptive design patterns to avoid, including, among others, purposely complicating or muddling a data subject’s choices relating to the processing of personal data and the use of ambiguous language to nudge data subjects into making a choice that is detrimental or violative of their rights as a data subject.

I.  Singapore

On 18 July 2023, Singapore’s Personal Data Protection Commission (“PDPC”) published draft Advisory Guidelines on the use of Personal Data in AI Recommendation and Decision Systems.[81] The Guidelines aim to clarify how the Personal Data Protection Act 2012 (“PDPA”) applies to the collection and use of personal data by organisations in order to develop and deploy systems that embed machine learning (“ML”) models which are then used to make decisions autonomously or to assist a human decision-maker through recommendations and predictions (“AI Systems”). The Guidelines are advisory in nature and are not legally binding, however provide a useful indication as to how the PDPC intends to interpret the PDPA in light of the increasingly important intersection between AI and data privacy.

The Guidelines clarify that where organisations intend to use personal data to develop, test or monitor AI Systems, they may be able to rely on either the business improvement and/or research exemptions under the PDPA in place of obtaining data subjects’ consent. The Guidelines set out relevant considerations for organisations intending to rely on either exception, but clarify that in doing so, organisations must nonetheless adopt appropriate technical, process and/or legal controls for data protection as required by the PDPA. The Guidelines also recommend that organisations deploying AI Systems should ensure that they provide individuals with information on how their personal data is used in deployed AI Systems.

In addition to the release of the Guidelines, enforcement decisions published by the PDPC in 2023 generated important takeaways in the context of the PDPA, including that:

  • organisations should implement multi-factor authentication for admin accounts with access to confidential or sensitive personal data or large volumes of personal;[82] and
  • broad catch all obligations to comply with data protection standards may not be a sufficient administrative protection in the context of engaging third-party vendors and organisations may need to include specific obligations as relevant to the individual engagement.[83]

Consistent with the global trend in uplifting online content and child safety regulations, Singapore’s Info-communications Media Development Authority (“IMDA”) released the final version of the Code of Practice for Online Safety on 17 July 2023.[84] The Code applies since 18 July 2023 to designated social media services. The Code imposes specific obligations on these social media services with respect to user safety, user reporting/resolution and accountability. The maximum penalty for non-compliance with the Code is SGD 1 million, however, it remains to be seen how the IMDA will enforce its provisions in practice other than via the online safety reports that covered providers are required to submit on an annual basis.

On 12 December 2023, the Cyber Security Agency of Singapore (“CSA”) announced a public consultation that ended on 15 January 2024 to seek views on its draft amendments to the Cybersecurity Act 2018, which is the legislative framework that governs the oversight and maintenance of national cybersecurity in Singapore.[85] Notably, these amendments extend the Commissioner of Cybersecurity’s oversight to include Foundational Digital Infrastructure (FDI) such as data centres, cloud computing providers and internet exchanges, and enhance its powers to authorise an onsite inspection to ascertain compliance. In addition, the CSA has sought to expand the scope of reportable incidents for providers to include incidents involving other computers or computer systems which are controlled by owners or providers of essential services, irrespective of whether such systems are interconnected to, or communicate with, critical information infrastructures.

J.   South Korea

Amendments and enforcement decrees to the Personal Information Protection Act (“PIPA”) came into force on 15 September 2023.[86]  The amendments are considered a major overhaul in Korea’s data protection law, and will notably “streamline inconsistencies in data processing standards disparately applied to online and offline businesses” to help prepare the industry for a “full-fledged digital transformation”.

Key amendments include the following:

  • Rights of Data Subjects – The Personal Information Protection Commission (“PIPC”) will implement more flexible data processing procedures where there is an urgent need to collect, use or provide personal data in order to protect data subjects from physical threats or to mitigate public health crises. Furthermore, privacy-related dispute resolution procedures have been revised to streamline the process of providing appropriate remedies to data subjects whose rights may have been infringed. Most notably, both public institutions and private companies are now mandated to participate in dispute resolution proceedings.
  • Regulations Governing Online and Offline Entities – The inconsistent standards which have been applied to online and offline businesses have been streamlined and are now subject to the same set of regulations, including (1) a reporting and notification timeline for data breaches, (2) a requirement to obtain consent from legal guardians for collection and use of personal data of children under 14 and (3) application of consistent criteria for imposing administrative sanctions.
  • Public Institutions Handling Large Data Sets – Data safety measures have been strengthened for operators of major public systems that handle large amounts of personal data of Korean citizens. Under the new measures, covered entities are required to: (1) conduct more robust analysis and inspection of access records, (2) designate a manager responsible for each system and (3) make notifications regarding incidents involving unauthorised access to personal data using public systems.
  • Cross-Border Data Transfers – The amendment addresses the conditions for cross-border data transfers and the penalties for the associated transgressions. The transfer of personal data to other countries is permitted if (1) the destination country provides the same level of data protection as Korea or (2) the transfer is made to “certain certified companies”. Concerning the associated penalties, the amendment changes the basis for calculating the maximum penalty from “total revenue related to the violation” to “total revenue minus the amount of revenue incurred from activities not related to the violation”. This amendment was introduced to prevent penalties from becoming excessive and beyond the scope of the associated transgression.

K.  Sri Lanka

The Sri Lankan Government continued to take steps to implement the Personal Data Protection Act No. 9 of 2022 – announcing plans in September 2023 to establish a Data Protection Authority and to finalise additional cybersecurity legislation.[87]

The Sri Lankan Government also commenced a unique identity card project in 2023, involving the collection of biographic and biometric information from citizens, including facial, iris and fingerprint data. According to Sri Lankan Government officials, the project is expected to store the personal data of all individuals in a centralised system for the purpose of issuing identification cards. India has provided aid of 450 million Indian rupees to fund the project.

L.  Thailand

On 25 December 2023, Thailand’s Personal Data Protection Committee (the “PDPC”) published two notifications, the Adequacy Country Notification and the Appropriate Safeguard Notification, which regulate cross-border transfers of personal data under Sections 28 and 29 of the Thailand’s Personal Data Protection Act (the “PDPA”).[88] The notifications are expected to take effect on 24 March 2024.

  • The Adequacy Country Notification establishes the rules for determining whether a destination country or other international organisation meets the minimum requirements for cross-border transfers. The assessment involves (1) assessment of the destination country’s legal safeguards against the PDPA, including in areas such as security, data subject rights and legal remedies, and (2) confirmation that a competent and independent regulatory body has been established in the destination country that is capable of enforcing relevant data protection laws. The PDPC also has the power to establish a whitelist of approved destination countries and retains the power to determine the adequacy of a destination country as a data transfer recipient.
  • The Appropriate Safeguard Notification serves as an exception to the Adequacy Country Notification, and allows for data transfers through Binding Corporate Rules (“BCRs”) in instances where the transferee is affiliated with the transferor. A covered entity must obtain the approval of PDPC to the terms of BCRs prior to adopting them. In instances where: (1) a destination country or other international organisation does not meet the minimum requirements for receiving personal data transfers; and (2) BCRs cannot be adopted, the Appropriate Safeguard Notification mandates the implementation of other safeguards before initiating any cross-border personal data transfers, such as by entering into standard contractual clauses.

On the enforcement front, multiple decisions by the Expert Committee (formed under the PDPA) in October and November 2023 indicate that the authority is likely to take a more proactive approach to enforcement going forward. The de facto grace period that followed the PDPA taking effect on 1 June 2022 now appears to be over and the Expert Committee may consider utilising its enforcement powers to impose administrative fines and penalties for non-compliance.

M.  Vietnam

As explained in the 2023 International Outlook and Review, the Vietnamese data protection framework has historically been fragmented across various different laws. In order to consolidate the obligations of covered entities into a single omnibus law, the Vietnamese Government issued the Decree on Personal Data Protection (“PDPD”) as Decree No. 13/2023/ND-CP on 17 April 2023.[89]  Notably, the PDPD will not replace but continue to exist concurrently with other existing laws.

Key features of the PDPD include the following.

  • Scope of the Law – The PDPD applies to Vietnamese individuals and organisations (including those operating offshore) and also to foreign entities operating in Vietnam, or directly engaging in or relating to personal data processing activities in Vietnam.
  • Classification of Personal Data – The PDPD classifies personal data into two groups of “basic personal data” and “sensitive personal data”. The list of sensitive personal data is broad and non-exhaustive, including any personal data associated with an individual’s privacy that, when infringed, directly affects their rights and interests.
  • Classification of Processing Entities – As implied under the draft Cybersecurity Administrative Sanctions Decree, the PDPD recognises the concepts of “personal data controller” and “personal data processor” which are broadly consistent with the equivalent terms under the GDPR. It also introduces the concept of “personal data controlling and processing entity” (which has the functions of both a controller and the processor).
  • Processing Principles – The PDPD introduces eight principles for the processing of personal data: lawfulness, transparency, purpose limitation, data minimisation, accuracy, integrity, confidentiality and security, storage limitation and accountability. While these principles are also enshrined in the GDPR, the PDPD departs from the EU model insofar as it does not recognise the principle of “legitimate interests”.
  • Consent – The PDPD adopts a consent-centric approach, requiring controllers to obtain consent to data subjects and to notify the data subject about the purpose, nature and scope of processing. A data subject must express their consent clearly and specifically in writing, by voice, by ticking a consent box, by text message, by selecting consent technical settings, or via another action which demonstrates the same. Processing of personal data without consent is nonetheless permissible in certain limited circumstances (e.g., where necessary to protect the life or health of the data subject, in accordance with law or to fulfil the contractual obligations of the data subject).
  • Cross-Border Data Transfers – The PDPD imposes new requirements for cross-border data transfers, including that the transferor must create a Dossier of Impact Assessment for the Cross-Border Transfer of Personal Data (“TIA Dossier”) before transferring personal data out of Vietnam. The TIA Dossier must contain the information prescribed by the PDPD and be made available at all times for the inspection and evaluation by the authority. In addition, the transferor must submit one original copy of the TIA Dossier to the Department of Cybersecurity and Hi-Tech Crime Prevention (“A05”), an authority under the Ministry of Public Security of Vietnam (“MPS”) within 60 days from the date of the personal data processing. Notably, the MPS has the power to halt cross-border data transfers if (i) the data is used for activities that violate the interests and national security of Vietnam; (ii) the transferor fails to complete or update the TIA Dossier; or (iii) the personal data of Vietnamese citizens is disclosed or lost.
  • Rights of Data Subjects – Eleven rights of the data subject are enshrined in the PDPD, including (i) the right to be informed, (ii) the right to consent, (iii) the right to access, (iv) the right to withdraw consent, (v) the right to delete data, (vi) the right to restrict data processing, (vii) the right to data provision, (viii) the right to object to data processing, (ix) the right to complain and denounce and/or initiate lawsuits, (x) the right to claim compensation for damages and (xi) the right to self-defence. Responses to requests for the exercise of the rights set out in (iii), (v), (vi), (vii) and (viii) are subject to a 72-hour deadline.

The PDPD took effect on 1 July 2023 without any grace period (other than a two-year grace period for the appointment of a data protection officer or department by small- and medium-sized enterprises). While it is uncertain whether the authorities will enforce the PDP’s requirements during the unavoidable transitional period following its implementation, covered entities should nonetheless begin preparing plans for compliance.

In this regard, the Vietnamese Government established the National Portal on Personal Data Protection, allowing entities to take streamlined measures for compliance with the new law, including online submission of data protection impact assessments and data breach notifications.[90]

V.  Developments in Africa

A.  Kenya

Following a petition to introduce a Bill on Robotics and AI on 29 November 2023, politicians and stakeholders are currently debating AI regulation in Kenya. The Bill foresees the creation of a professional regulating body overseeing the activities of AI practitioners and imposing license fees for those working in the sector, whilst guaranteeing government funding for AI research and development.[91]

B.  Nigeria

On 14 June 2023, the Nigerian Data Protection Bill 2023 (available here) entered into force. It sets out general principles for the processing of personal information, including the processing of sensitive information, controller obligations, such as breach notifications, Data Protection Impact Assessments and the appointment of a data protection officer (“DPO”). Furthermore, the Bill imposes restrictions on cross-border transfer of personal information and establishes data subject rights, namely, the right to object, withdraw consent, data portability and the right not to be subject to a decision based solely on the automated processing of personal data.

On 15 December 2023, the National Data Protection Bureau (“NDPB”) issued a code of conduct for data protection compliance organisations (“DPCO”). In particular, the code outlines registration requirements for DPCOs, personal and professional requirements of their DPOs.[92]

C.  Tanzania

On 1 May 2023, the Personal Data Protection Act 2022 entered into force.[93] Complementing that, the Ministry of Information, Communication and Information Technology published Regulations on the collection and processing of personal data and a complaints handling procedure.[94]

D.  Other African Jurisdictions

After its adoption by the African Union (“AU”) in 2014, the African Union Convention on Cyber Security and Personal Data Protection (also known as “Malabo Convention”) came into effect on 8 June 2023, after Mauritania was the 15th country to ratify it on 9 May 2023. To date, 15 of the AU’s 55 countries have signed and ratified the treaty, and 12 more have already signed it.[95]

In Algeria, the Law Relating to the Protection of Individuals in the Processing of Personal Data came into force on 11 August 2023, applying to the processing of personal data by public bodies or private individuals.[96]

In Malawi, the Parliament introduced Bill No. 22 for the Data Protection Act, 2023 on 7 December 2023, aiming to provide a comprehensive legal framework for the regulation of personal data.[97]

VI.  Other Developments in the Middle East

A.  Israel

Following last year’s review, Israeli privacy protection regulations on data transfers from the European Economic Area were published in their final form on 7 May 2023.[98] Furthermore, a corresponding Q&A has been issued.[99]

The Privacy Protection Authority (“PPA”) published a guidance paper on Internet of Things (“IoT”) products and smart homes. It requires companies to secure their databases in accordance with the requirements of the Protection of Privacy Regulations (Data Security) 5777-2017 (“Data Security Regulations”).[100]

Jointly, the Ministry of Innovation, Science, and Technology, the Office of Legal Counsel and Legislative Affairs at the Ministry of Justice published Israel’s recent policy on Artificial Intelligence Regulations and Ethics 2023, aiming to foster responsible innovation in the private sector.[101]

B.  Saudi Arabia

The Council of Ministers approved amendments to the data protection law, previously introduced by the Saudi Data and Artificial Intelligence Authority (“SDAIA”). These include the right to data portability, legitimate interests as a legal basis for processing in some particular circumstances, permitting the processing of personal data for marketing purposes where a clear mechanism is provided to allow the target recipients to request the cessation of the processing, permitting data transfers outside Saudi in specific circumstances and in accordance with certain conditions; and a requirement to keep records of the operations performed on personal data and set rules to restrict access to such data.[102]

On 14 September 2023, the Personal Data Protection Law (“PDPL”), the Regulations on Personal Data Transfers and several implementing regulations entered into force. Compliance will be mandatory one year later.[103]

On the same day, the SDAIA published their Artificial Intelligence Ethics Framework 2.0, focusing on helping companies develop responsible AI-based solutions and limiting negative implications of AI systems, while encouraging innovation.[104]

On 27 November 2023, the SDAIA announced the launch of various initiatives, including the National Data Governance Platform, serving to register entities falling under the scope of the PDPL.[105]

On 20 December 2023, the SDAIA announced the publication of a guide on generative AI in an effort to raise the level of awareness about the importance of AI technologies.[106]

C.  Other Middle East Jurisdictions

In several countries, various laws on digital regulation and data protection have been published, entered into force or are under review:

  • On 15 November 2023, the Abu Dhabi Global Market (“ADGM”) Office of Data Protection (“ODP”) issued and adopted an Addendum to the European Commission’s Standard Contractual Clauses (“EU SCCs”) for personal data transfers.[107] Companies who had already implemented the EU SCCs shall be able to use the Addendum as a data transfer mechanism to comply with the ADGM Data Protection Regulations 2021. In addition, the ODP also issued guidelines to support businesses in implementing the Addendum to their existing EU SCCs.[108]
  • Dubai International Financial Centre’s (“DIFC”) Regulation 10 on Processing Personal Data Through Autonomous and Semi-Autonomous Systems (amending the Data Protection Regulations 2020) entered into force on the date of its publication on 1 September 2023.[109] Additional guidance has been updated accordingly.[110]
  • Jordan finalised and published its Personal Data Protection Law in its Official Gazette on 17 September 2023. The law will enter into force six months after its publication.[111]
  • In Oman, the Data protection law entered into force on 13 February 2023, one year after its publication in the Official Gazette.[112]
  • The Qatar Financial Centre (“QFC”) issued a third version of the QFC Data Protection Rules on 10 December 2023.[113] Although broadly similar to the previous rules, the introduction of new requirements for the use of Corporate Rules for transfers of personal data outside the QFC constitutes a key change.

VII.  Developments in Latin America and in the Caribbean Area

A.  Argentina

On 5 April 2023, the Argentinian data protection authority (“AAIP”) published its 2022 management report, including a new Personal Data Protection Bill, largely in line with the draft bill released in November 2022. On 30 June 2023, the draft has been passed to Congress, where it may be subject to further changes.[114] Upon passing, according to the current draft, its provisions will enter into force 180 days after its publication in the Official Gazette, except for the section on administrative sanctions, which will enter into force once it has been published.

On 17 April 2023, the AAIP deposited the instruments of ratification of the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (also known as “Convention 108+”), strengthening individual data protection.[115]

On 26 September 2023, it was announced that the Uruguayan data protection authority had signed a cooperation agreement with the AAIP, including an exchange of investigation results. Furthermore, the agreement is aimed at coordinating strategies and activities to strengthen data protection in Uruguay and Argentina. Additionally, the agreement shall facilitate collaboration in various areas such as the preparation of recommendations, guides and other documents.[116]

On 18 October 2023, the AAIP published approved Standard Contractual Clauses (“SCCs”) for international data transfers, as proposed by the Ibero-American Network for the Protection of Personal Data (“RIPD”). These clauses are part of a guide for the implementation of model contractual clauses for the international transfer of personal data, facilitating the transfer of personal data from countries that are members of the RIPD to other jurisdictions.[117]

B.  Brazil

1.  AI Act (Brazil)

In December 2022, the Brazilian Senate’s Commission of Jurists approved a draft for the Brazilian AI Act, which was converted into Bill No. 2338/2023 in the beginning of 2023. The Brazil’s draft relies on a risk-based approach and has several points of interaction with the Brazilian General Data Protection Law (“LGPD”). Besides, it foresees specific rights to people affected by AI systems, including the right to be informed about interactions with AI systems, the right to contest decisions, the right to human participation and the right to explanation. If approved, the Brazilian AI Act will define sanctions for non-compliance with the law, such as a simple fine of up to BRL 50,000,000 (approx. USD 1 million) per violation – for private legal entities, of up to 2% of the total revenue its group or conglomerate in Brazil obtained in the previous fiscal year (excluding taxes) – as well as the temporary or permanent suspension (partial or total) of the development, supply or operation of AI systems, and a prohibition on processing related databases.[118]

For any regulatory and enforcement matters the National Data Protection Authority (“ANPD”) has already positioned itself offering to act as the key authority. On 3 October 2023, the ANPD also published a call for contributions on its regulatory sandbox pilot program, consisting of a controlled environment to test technologies associated with AI developed by participants.

Currently, the draft is being processed in the Federal Senate in an internal committee to resolve open questions.[119] Besides national efforts to regulate AI, the states Ceará in 2021 and Alagoas in November 2023 already passed first laws regulating AI.[120]

2.  Other Developments in Brazil

On 27 February 2023, the ANPD published its finalised resolution on the application of the administrative sanctioning system for violations of personal data law. It comprises a multi-layered system including warnings, simple fines, daily fines, the blocking and/or deletion of personal data relating to the offence, as well as partial or total bans on activities related to data processing. It also provides a tiered classification system and outlines various criteria and parameters that will be considered when imposing sanctions.[121]

Throughout the year, the ANPD issued various clarifications on debated topics, including inter alia:

  • The clarification that the LGPD only applies to the processing of personal data of living natural persons and that data relating to a deceased person does not constitute personal data and is therefore not subject to the LGPD’s protection; and[122]
  • Open questions on DPO compliance and performance under LGPD. The requirements associated with conducting Data Protection Impact Assessments (“DPIA”) were addressed too.[123]

C.  Chile

Chile’s regulation on the protection of privacy and personal data is currently under a lengthy reformation process, drawing inspiration from the EU GDPR. In 2023, the proposed new bill has been passed to the Senate, where it is now subject to further discussion. To date, the proposal has been referred to a Joint Committee at the beginning of January 2024 to resolve disagreement between the two Chambers over articles.[124]

D.  Colombia

On 6 July 2023, the Colombian data protection authority (“SIC”) announced its decision to fine a company COP 1,306,289,600 (approx. USD 336,000), which is the highest fine relating to the violation of data protection laws to date.[125] The SIC furthermore issued a corrective order for violation of general provisions protecting personal data. The fine was based on a failure to implement adequate and sufficient measures to obtain referral telephone numbers from its customers via a marketing campaign with prior, express and informed consent of the data subjects.

On 4 August 2023, the SIC also published its Official Guide to Personal Data Protection.[126]

On 31 August 2023, the Chamber of Representatives of Colombia initiated the legislative process to adopt a general regime for the protection of personal data (“Bill 156/2023C”). It shall further cover the protection of fundamental rights, including the fundamental right of personal data protection, under the terms described in Article 15 and Article 20 of the Colombian Constitution.[127]

E.  Mexico

On 7 February 2023, the National Institute for Access to Information and Protection of Personal Data (“INAI”) published its interpretation criteria for personal data law.[128]

In the course of the publication of its 2024 budget, the INAI also published plans to review and amend the Federal Law on Protection of Personal Data Held by Private Parties in light of the recent developments in generative AI.[129]

F.   Paraguay

On 29 August 2023, the Chamber of Deputies of Paraguay announced that the Commission of Industry, Commerce, Tourism, and Cooperativism issued a favourable opinion on the bill on the Protection of Personal Data of the Republic of Paraguay, which was presented first in 2021.[130]

G. Peru

The Ministry of Justice and Human Rights is currently conducting a review of the regulations of the law on transparency and access to public information, aiming to optimise the current regulation and integrate improvements to the procedure for access to information, as a comprehensive review of current regulations is deemed necessary.[131] Furthermore, it announced a draft for Law No. 29733 on Personal Data Protection. In particular, the draft aims to raise the regulatory standards for the protection of personal data compared to the previous regulations.[132]

H.  Uruguay

On 21 November 2023, the Uruguayan data protection authority (“URCDP”) published a favourable Adequacy Resolution No. 63/2023 on data protection for cross-border data transfers with South Korea and entities under the EU-U.S. Data Privacy Framework [133] . The adequacy decision from the URCDP followed similar decisions by the European Commission on data transfers between South Korea and the EU-U.S. Data Privacy Framework.

VIII.  Developments in Other Latin American and Caribbean Jurisdictions

A.  Bermuda

Following an announcement of the Bermuda Office of the Privacy Commissioner (“PrivCom”) in June 2023, the Personal Information Protection Act 2016 (“PIPA”) will be officially implemented on 1 January 2025. Entities operating in Bermuda were therefore given 18 months to prepare for the full implementation of PIPA.[134]

To strengthen its resources, PrivCom announced on 24 February 2023, that it had entered into international enforcement cooperation agreements with the Global Privacy Enforcement Network and the Global Privacy Assembly’s Enforcement Cooperation Arrangement.[135]

B.  Bolivia

The general regulation of data protection is currently subject of a fierce debate in Bolivia, which is currently lacking a comprehensive legal framework on this topic. In this debate, on 31 March 2023, the Agency of Electronic Government and Information and Communication Technologies presented a new data protection bill to the Bolivian Senate, seeking to introduce, inter alia, a new data protection agency.[136] Separately, a motion for the reintroduction in the Legislative Assembly of bill No. 349/2020-2021 for the protection of personal data was filed, on 3 March 2023.[137]

C.  Costa Rica

On 10 November 2023, the Ministry of Science, Technology and Telecommunications has published its national cybersecurity strategy.[138]

D.  Grenada

On 10 May 2023, the Grenada Data Protection Act, No. 1 of 2023 has been published in the Official Gazette. It covers, inter alia, the protection of personal data processed by public and private bodies, provides legal bases for processing personal data and sensitive personal data, as well as data protection principles and data subject rights and a penalty system.[139]

E.  Guatemala

On 28 April 2023, the President of the Transparency and Probity Commission issued their opinion on Bill No. 6105 of 23 June 2022, for the Approval of the Personal Data Protection Law. Following that, the bill has been returned to Congress and is now subject to further discussions.[140]

F.   Guyana

On 16 August 2023, the Data Protection Act No.18 of 2023 has been published in the Official Gazette of Guyana and received Presidential assent.[141]

G. Jamaica

After the Jamaican Data Protection Act entered into force on 1 December 2023, the Information Commissioner granted controllers a six-month grace period for registration under the Data Protection Act.[142]

__________

[1]         See http://curia.europa.eu/juris/document/document.jsf;jsessionid=2BDC80771D0FB7EA8B6F60B9A3C4F572?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=20032710.

[2] See https://eur-lex.europa.eu/eli/dir/2022/2555.

[3]  Id.

[4] See https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32022R0868.

[5] See https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554.

[6] See https://eur-lex.europa.eu/eli/reg/2023/2854.

[7] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042022-calculation-administrative-fines-under_en.

[8] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032021-application-article-651a-gdpr_en.

[9] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052022-use-facial-recognition-technology-area_en.

[10] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-82022-identifying-controller-or-processors-lead_en.

[11] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en.

[12] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en.

[13] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072022-certification-tool-transfers_en.

[14] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052021-interplay-between-application-article-3_en.

[15] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en.

[16] See https://edpb.europa.eu/our-work-tools/documents/public-consultations/2023/guidelines-22023-technical-scope-art-53-eprivacy_en

[17] See https://edpb.europa.eu/our-work-tools/documents/public-consultations/2023/guidelines-012023-article-37-law-enforcement_en

[18] See https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&from=FR.

[19] See https://www.cnil.fr/fr/publicite-personnalisee-criteo-sanctionne-dune-amende-de-40-millions-deuros.

[20] See https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9943230.

[21] See https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9895080.

[22] See https://azop.hr/debt-collection-agency-eos-matrix-d-o-o-imposed-with-administrative-fine-in-the-amount-of-5-47-million-euros/.

[23] See https://edpb.europa.eu/news/national-news/2023/facial-recognition-french-sa-imposes-penalty-payment-clearview-ai_en

[24] See https://www.imy.se/nyheter/sanktionsavgift-mot-spotify/.

[25] See https://www.imy.se/nyheter/sanktionsavgift-pa-35-miljoner-mot-trygg-hansa/.

[26] See https://www.aepd.es/documento/ps-00331-2022.pdf

[27] See https://edpb.europa.eu/news/national-news/2023/croatian-sa-imposed-administrative-fine-debt-collection-agency-b2-kapital_en.

[28] See https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-gebyr-og-palegg-til-nav/.

[29] See https://www.imy.se/nyheter/fel-anvanda-kunders-personuppgifter-for-profilering-utan-samtycke/.

[30] See https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9910120.

[31] See https://www.ofcom.org.uk/news-centre/2023/safer-life-online-for-people-in-uk.

[32]See https://www.ofcom.org.uk/news-centre/2023/tech-firms-must-clamp-down-on-illegal-online-materials?utm_source=tw_graphic&utm_medium=social_org&utm_campaign=onlinesafety23&utm_content=condoc1_press.

[33]See https://www.ofcom.org.uk/consultations-and-statements/category-1/protecting-people-from-illegal-content-online.

[34] See https://bills.parliament.uk/bills/3322.

[35]See https://bills.parliament.uk/bills/3430.

[36]See https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr.

[37]See https://ico.org.uk/media/about-the-ico/consultation-responses/4025316/response-to-dpdi-bill-20230530.pdf.

[38]See https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents/uk-us-data-bridge-explainer#:~:text=The%20US%20data%20bridge%20will,required%20to%20maintain%20those%20standards.

[39] See https://www.dataprivacyframework.gov/.

[40] See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/.

[41]See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/.

[42]See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/toolkit-for-organisations-considering-using-data-analytics/.

[43]See https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/08/joint-statement-on-data-scraping-and-data-protection/#:~:text=Scraping%20from%20social%20media%20creates,or%20used%20for%20identity%20fraud.

[44]See https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-and-regulatory-communications/#who.

[45] See https://www.fedlex.admin.ch/eli/cc/2022/491/en.

[46] See https://www.fedlex.admin.ch/eli/oc/2022/568/fr.

[47] See https://www.edoeb.admin.ch/edoeb/en/home/meldeportale.html.

[48] See https://www.edoeb.admin.ch/edoeb/de/home/kurzmeldungen/2023/20230404_chatgpt.html.

[49] See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/.

[50] See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/toolkit-for-organisations-considering-using-data-analytics/.

[51] https://www.ag.gov.au/sites/default/files/2023-02/privacy-act-review-report_0.pdf.

[52] https://www.ag.gov.au/sites/default/files/2023-09/government-response-privacy-act-review-report.PDF.

[53] https://www.homeaffairs.gov.au/cyber-security-subsite/files/2023-cyber-security-strategy.pdf.

[54] https://www.homeaffairs.gov.au/help-and-support/how-to-engage-us/consultations/cyber-security-legislative-reforms.

[55] http://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm (in Chinese only).

[56] http://www.cac.gov.cn/2023-02/24/c_1678884831596384.htm (in Chinese only).

[57] http://www.cac.gov.cn/2023-05/30/c_1687090906222927.htm (in Chinese only).

[58] http://www.cac.gov.cn/2023-08/03/c_1692628348448092.htm (in Chinese only).

[59] http://www.cac.gov.cn/2023-09/28/c_1697558914242877.htm (in Chinese only).

[60] https://www.tc260.org.cn/upload/2023-11-01/1698813097992054356.pdf (in Chinese only).

[61] https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf.

[62] See section 3, DPDP Act.

[63] See section 17(1)(d), DPDP Act.

[64] See section 9, DPDP Act.

[65] See sections 4-6, DPDP Act.

[66] See section 7, DPDP Act.

[67] See Chapter II, DPDP Act.

[68] See section 10, DPDP Act.

[69] See section 16, DPDP Act.

[70] See section 33 and Schedule, DPDP Act.

[71] https://pdp.id/rpp-ppdp/1 (in Bahasa only).

[72] https://www.info.gov.hk/gia/general/202306/30/P2023063000219.htm.

[73] https://www.tc260.org.cn/upload/2023-11-01/1698813097992054356.pdf (in Chinese only).

[74] https://www.pcpd.org.hk/english/enforcement/commissioners_findings/files/r23_21242_e.pdf.

[75] https://www.soumu.go.jp/menu_news/s-news/01kiban18_01000188.html (in Japanese only).

[76] https://www.ppc.go.jp/files/pdf/ico_moc.pdf.

[77] https://ec.europa.eu/commission/presscorner/detail/en/ip_23_5378.

[78] https://www.commerce.gov/news/press-releases/2023/11/joint-statement-japan-us-economic-policy-consultative-committee.

[79] https://www.justice.govt.nz/assets/Documents/Publications/Privacy-Amendment-Bill-2023-Approval-for-introduction_FINAL.pdf.

[80] https://privacy.gov.ph/wp-content/uploads/2023/11/NPC-Advisory-No.-2023-01-Guidelines-on-Deceptive-Design-Patterns_7Nov23.pdf.

[81] https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Legislation-and-Guidelines/Public-Consult-on-Proposed-AG-on-Use-of-PD-in-AI-Recommendation-and-Systems-2023-07-18-Draft-Advisory-Guidelines.pdf.

[82] In the matter of an investigation under section 50(1) of the Personal Data Protection Act 2012 and Tokyo Century Leasing (Singapore) Pte. Ltd. [2023] SGPDPC 9 (https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/GD_Tokyo_Century_Leasing_040923.pdf).

[83] In the matter of an investigation under section 50(1) of the Personal Data Protection Act 2012 and Ascentis Pte. Ltd. [2023] SGPDPC 10 (see https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/GD_Ascentis_12092023.pdf).

[84] https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2023/imdas-online-safety-code-comes-into-effect.

[85] https://www.reach.gov.sg/docs/default-source/participate/public-consultation/cyber-security-agency-of-singapore-(csa)/public-consultations-paper—cybersecurity-amendment-bill.pdf.

[86] See https://www.pipc.go.kr/eng/user/ltn/new/noticeDetail.do?bbsId=BBSMSTR_000000000001&nttId=2331.

[87] https://economynext.com/sri-lanka-says-measures-taken-to-ensure-digital-security-of-indian-funded-unique-id-project-130540/.

[88] See https://www.dataprotectionreport.com/2024/01/thailand-the-regulation-with-respect-to-cross-border-transfer-of-personal-data/.

[89] https://www.dataguidance.com/news/vietnam-decree-protection-personal-data-enters-force; https://thuvienphapluat.vn/van-ban/EN/Cong-nghe-thong-tin/Decree-No-13-2023-ND-CP-dated-April-17-2023-on-protection-of-personal-data/564343/tieng-anh.aspx.

[90] https://rouse.com/insights/news/2023/vietnam-government-launches-national-portal-on-personal-data-protection#:~:text=Vietnam%3A%20Government%20Launches%20National%20Portal%20on%20Personal%20Data%20Protection,-Published%20on%2018&text=In%20line%20with%20Article%2029.2,vn%2F%20(PDP%20Portal).

[91] See here (press release) or here (bill proposal).

[92] See here.

[93] See here (Swahili).

[94] See here and here (Swahili).

[95] See here for full text and status list.

[96] See here.

[97] See draft here.

[98] See here, in Hebrew and English.

[99] See here (Hebrew).

[100] See here (Hebrew).

[101] See here.

[102] See previous proposals here.

[103] See here for PDPL; here for the Implementing Regulation; here (Arabic) for the Regulations on Transferring Personal Data.

[104] See here.

[105] See here (press release, Arabic).

[106] See here (Arabic).

[107] See here.

[108] See here.

[109] See here (press release).

[110] See here, for example the updated DIFC EDMRI Guidance – December 2023.

[111] See here (Arabic).

[112] See here (Arabic).

[113] See here.

[114] See here.

[115] See here (press release).

[116] See here (Spanish).

[117] See here (Resolution, Spanish).

[118] For draft, see here (Portuguese).

[119] See here, for the status of the legislative progress (Portuguese).

[120] Lei 607/2023 (Alagoas) available here; Lei Nº 17.611, 11 de Agosto de 2021(Cearà) available here (Portuguese).

[121] See here (Portuguese).

[122] See here (Technical Note, Portuguese).

[123] See here (press release).

[124] See here (Spanish).

[125] See here (press release, Spanish).

[126] See here (Spanish).

[127] See here, available for download here (Spanish).

[128] Available for download here (Spanish).

[129] See here (Spanish).

[130] For legislative status, see here (Spanish).

[131] See here (Spanish).

[132] See here (Spanish).

[133] See here (Spanish).

[134] See here.

[135] See here.

[136] See here (press release, Spanish).

[137] See here (Spanish).

[138] See here.

[139] Available for download here.

[140] See here.

[141] Available for download here.

[142] See here (press release).


The following Gibson Dunn lawyers assisted in preparing this alert: Ahmed Baladi, Vera Lukic, Joel Harrison, Connell O’Neill, Clémence Pugnet, Thomas Baculard, Hermine Hubert, Sarah Villani, Anastasia Katsari, Marcus Seete*, Grace Chong, Nick Hay and QX Toh.

Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Privacy, Cybersecurity & Data Innovation practice group:

Europe:
Ahmed Baladi – Co-Chair, Paris (+33 (0) 1 56 43 13 00, [email protected])
Joel Harrison – Co-Chair, London (+44 20 7071 4289, [email protected])
Nicholas Banasevic* – Managing Director, Brussels (+32 2 554 72 40, [email protected])
Kai Gesing – Munich (+49 89 189 33-180, [email protected])
Vera Lukic – Paris (+33 (0) 1 56 43 13 00, [email protected])
Lars Petersen – Frankfurt/Riyadh (+49 69 247 411 525, [email protected])
Robert Spano – London/Paris (+44 20 7071 4000, [email protected])

Asia:
Connell O’Neill – Hong Kong (+852 2214 3812, [email protected])
Jai S. Pathak – Singapore (+65 6507 3683, [email protected])

United States:
S. Ashlie Beringer – Co-Chair, Palo Alto (+1 650.849.5327, [email protected])
Jane C. Horvath – Co-Chair, Washington, D.C. (+1 202.955.8505, [email protected])
Rosemarie T. Ring – Co-Chair, San Francisco (+1 415.393.8247, [email protected])
Ryan T. Bergsieker – Denver (+1 303.298.5774, [email protected])
Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, [email protected])
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650.849.5203, [email protected])
Svetlana S. Gans – Washington, D.C. (+1 202.955.8657, [email protected])
Lauren R. Goldman – New York (+1 212.351.2375, [email protected])
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, [email protected])
Natalie J. Hausknecht – Denver (+1 303.298.5783, [email protected])
Martie Kutscher Clark – Palo Alto (+1 650.849.5348, [email protected])
Kristin A. Linsley – San Francisco (+1 415.393.8395, [email protected])
Timothy W. Loose – Los Angeles (+1 213.229.7746, [email protected])
Vivek Mohan – Palo Alto (+1 650.849.5345, [email protected])
Ashley Rogers – Dallas (+1 214.698.3316, [email protected])
Alexander H. Southwell – New York (+1 212.351.3981, [email protected])
Eric D. Vandevelde – Los Angeles (+1 213.229.7186, [email protected])
Benjamin B. Wagner – Palo Alto (+1 650.849.5395, [email protected])
Debra Wong Yang – Los Angeles (+1 213.229.7472, [email protected])

*Nicholas Banasevic, Managing Director in the firm’s Brussels office and an economist by background, is not admitted to practice law.

*Marcus Seete, a legal trainee in the Brussels office, is not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

An overview of key FCPA and other domestic and international anti-corruption enforcement, litigation, and policy developments from 2023.

2023 was another dynamic year of international anti-corruption enforcement.  Although U.S. Foreign Corrupt Practice Act (“FCPA”) enforcement actions have remained moderate at each of the U.S. Department of Justice (“DOJ”) and Securities and Exchange Commission (“SEC”), we are seeing more enforcement activity and legal reform with a broader group of international enforcers in the global fight against cross-border corruption.  This past year also saw the passage of the first U.S. federal law to address international corruption in decades, as well as the implementation of numerous DOJ policies designed to drive change in companies and within C-Suites.  As the heft of this update will evidence, there are many FCPA and FCPA-related developments to discuss.

Gibson Dunn’s expertise in this area is a reflection of the complex, cutting-edge anti-corruption challenges we have the privilege of advising clients on every day, and we are honored to once again be ranked Number 1 in the Global Investigations Review “GIR 30” ranking of the world’s top investigations practices for the sixth consecutive year and eighth of the last nine years.

For further analysis on anti-corruption enforcement and related developments in 2023, we invite you to register and join us for our upcoming complimentary webcast presentation on February 29, 2024:  “2023 Year-End FCPA Update.”

FCPA OVERVIEW

The FCPA’s anti-bribery provisions make it illegal to offer or provide money or anything else of value to officials of foreign governments, foreign political parties, or public international organizations with corrupt intent, for the purpose of obtaining or retaining business.  These provisions apply to “issuers,” “domestic concerns,” and those acting on behalf of issuers and domestic concerns, as well as to “any person” who acts while in the territory of the United States.  The term “issuer” covers any business entity that is registered under 15 U.S.C. § 78l or that is required to file reports under 15 U.S.C. § 78o(d) (typically referring to companies whose shares are listed on a national exchange).  In this context, foreign issuers whose American Depositary Receipts (“ADRs”) or American Depositary Shares (“ADSs”) are also listed on a U.S. exchange are “issuers” for purposes of the FCPA.  The term “domestic concern” is even broader and includes any U.S. citizen, national, or resident, as well as any business entity that is organized under the laws of a U.S. state or that has its principal place of business in the United States.

In addition to the anti-bribery provisions, the FCPA also has “accounting provisions” that apply to issuers and those acting on their behalf, and that are comprised of two core components.  First, the books-and-records provision requires issuers to make and keep accurate books, records, and accounts that, in reasonable detail, accurately and fairly reflect the issuer’s transactions and disposition of assets.  Second, the FCPA’s internal accounting controls provision requires that issuers devise and maintain reasonable internal accounting controls aimed at preventing and detecting FCPA violations.  Prosecutors and regulators frequently invoke these latter two sections when they cannot establish the elements for an anti-bribery prosecution or as a mechanism for compromise in settlement negotiations.  Because there is no requirement that a false record or deficient control be linked to an improper payment, even a transaction that does not constitute a violation of the anti-bribery provisions can lead to prosecution under the accounting provisions if inaccurately recorded or attributable to an internal accounting controls deficiency.

International corruption also may implicate other U.S. criminal laws.  Frequently, prosecutors from the FCPA Unit of DOJ charge non-FCPA crimes such as money laundering, mail and wire fraud, Travel Act violations, tax violations, and even false statements, in addition to or instead of FCPA charges.  Without question, the most prevalent amongst these “FCPA-related” charges is money laundering—a generic term used as shorthand for statutory provisions, including 18 U.S.C. § 1956, that generally criminalize conducting or attempting to conduct a transaction involving proceeds of “specified unlawful activity” or transferring funds to or from the United States, in either case to promote the carrying on of specified unlawful activity; to conceal or disguise the nature, location, source, ownership or control of the proceeds; or to avoid a transaction reporting requirement.  “Specified unlawful activity” includes over 200 enumerated U.S. crimes and certain foreign crimes, including the FCPA, fraud, and corruption offenses under the laws of foreign nations.  Although this has not always been the case, in recent history DOJ has frequently deployed the money laundering statutes to charge “foreign officials” who are not themselves subject to the FCPA.  It is not unusual for DOJ to charge the alleged provider of a corrupt payment under the FCPA and the alleged recipient with money laundering violations, particularly if the recipient is employed by a state-owned enterprise.  Finally, as covered in greater detail below, 2023 saw the passage of the Foreign Extortion Prevention Act, which directly criminalizes the solicitation or receipt of bribes by foreign officials under the federal domestic bribery statute (18 U.S.C. § 201).

FCPA AND FCPA-RELATED ENFORCEMENT STATISTICS

The below table and graph detail the number of FCPA enforcement actions initiated by DOJ and the SEC, the statute’s dual enforcers, during the past 10 years.

But as our readers know, the number of enforcement actions predicated on substantive FCPA charges represents only a portion of the full scope of international anti-corruption enforcement efforts by DOJ. This publication has remarked on the increasing proportion of “FCPA-related” charges for years, which can sometimes equal or even exceed criminal FCPA charges, although the relative percentage of such cases brought in 2023 was less pronounced than in recent years. The past 10 years of FCPA plus FCPA-related enforcement activity is illustrated in the following table and graph.

2023 FCPA-RELATED ENFORCEMENT TRENDS

As our readers know, our year-end FCPA updates endeavor not only to describe the year’s FCPA enforcement actions, but also to explain the patterns and trends underlying this enforcement activity.  For 2023, we have identified five notable patterns from the year in FCPA enforcement, though whether they represent longer-term trends or only single-year aberrations varies by the pattern in question and may require additional time to determine:

  1. Tracking early returns in DOJ Corporate Enforcement Policy discounts;
  2. DOJ’s new forfeiture practice continues;
  3. A year of DOJ deferred and non-prosecution agreements;
  4. The FCPA’s dual enforcers largely go it alone; and
  5. LATAM continues to dominate FCPA-plus individual prosecutions.

1. Tracking Early Returns in DOJ Corporate Enforcement Policy Discounts

In a “bonus” supplement to our 2022 Year-End FCPA Update, accelerated for coverage there even though DOJ announced the policy on January 17, 2023, we covered the issuance of an updated Criminal Division Corporate Enforcement & Voluntary Self-Disclosure Policy (“Corporate Enforcement Policy”).  We refer our readers to that prior update for a more fulsome analysis of this important development.  But one key aspect that we have followed closely throughout the year 2023 for discussion here is DOJ’s ability to grant enhanced cooperation and remediation credit pursuant to the updated Corporate Enforcement Policy.

As covered in our 2022 Year-End FCPA Update, perhaps the most significant update to the Corporate Enforcement Policy was to substantially increase the discount from criminal penalties that companies can receive as credit for cooperating in DOJ investigations and remediating from prior compliance lapses.  Under the Corporate Enforcement Policy, DOJ can now grant up to a 75% discount in voluntary disclosure cases, and 50% in non-voluntary disclosure cases, up from 50% and 25%, respectively.  In most instances, this discount is applied from the bottom of the U.S. Sentencing Guidelines (“USSG” or “Guidelines”) range, although the Corporate Enforcement Policy includes enhanced guidance for increasing the point-of-departure for so-called “recidivists.”

An interesting thought exercise that becomes more and more relevant in an age of enhanced DOJ assertions of jurisdiction over even foreign-sited companies is how DOJ would treat a voluntary disclosure to a non-U.S. regulator with primary cognizance over the entity.  The Corporate Enforcement Policy states that although voluntary disclosures “must ordinarily be to the Criminal Division . . . , the Criminal Division will also apply the provisions of this Policy where a company made a good faith disclosure to another office or component of the Department of Justice.”  This leaves silent how DOJ would treat voluntary disclosure to a foreign regulator that only later comes to the attention of DOJ.

In 2023, there were five corporate FCPA enforcement actions resolved with criminal fines pursuant to DOJ’s Corporate Enforcement Policy.  None of the five cases involved “voluntary disclosures” eligible for the enhanced 75% discount (but see the Albemarle discussion below), and indeed typically such cases are resolved as “declinations with disgorgement” where there is no criminal fine as in the Corsa Coal and Lifecore Biomedical cases discussed separately herein.  In all five cases, the discount was applied from the bottom of the Guidelines range.  But consistent with DOJ’s prognostication in announcing the enhanced discounts, the maximum 50% credit available in non-disclosure cases has not become “the new norm”—indeed, there is yet to be a 50% credit granted under the Corporate Enforcement Policy.  The discounts awarded to date have ranged from a low of 15% to a high of 45% in corporate FCPA enforcement actions.  The average discount across the five FCPA cases is 28%, which translates to an average $25.9 million in savings to the five companies.

To explain the basis for its varied discounts, DOJ has taken in each case to including a detailed list of “Relevant Considerations.”  In all cases, this includes statements regarding the seriousness of the underlying offense, a recitation of the various ways in which the company cooperated, in which the company remediated, and the company’s criminal and regulatory history.  Standard cooperation comments common to the five corporate FCPA prosecutions of 2023 include, among others, that the defendant:

  • responded to DOJ requests;
  • made factual presentations to DOJ on the company’s internal investigation findings;
  • produced relevant documents (typically noting that the documents were produced from foreign jurisdictions in manner that complied with local data privacy laws, and frequently further noting that courtesy translations were provided); and
  • facilitated DOJ interviews of relevant employees (frequently noting the retention of separate counsel to represent these employees).

Standard remediation comments common to the resolutions include, among others, that the defendant:

  • conducted a root cause analysis of the illegal conduct identified during the investigation;
  • invested in improving its compliance program governance and resources;
  • took appropriate disciplinary action against employees found to have been involved in misconduct; and
  • committed to continue enhancing its compliance program and internal controls, consistent with the minimum elements set forth in the standard Attachment C (Corporate Compliance Program) to the resolution agreement.

Where companies appear to have distinguished themselves in this early set of cases is on the cooperation side by providing “proactive” updates to DOJ, especially where it enabled DOJ to preserve and collect further evidence on its own, and on the remediation side by terminating and/or withholding bonuses from numerous culpable employees, and also by restructuring the company’s go-to-market strategy to reduce reliance on third parties.  Below is a chart summarizing the Corporate Enforcement Policy discount details across the five DOJ corporate FCPA resolutions of 2023, followed by descriptions of the first two cases (with the remaining three covered in the following section):

Grupo Aval S.A.

In the first corporate criminal FCPA prosecution announced under the new Corporate Enforcement Policy, Colombian financial holding company and U.S. issuer Grupo Aval reached a joint FCPA resolution with DOJ and the SEC on August 10, 2023.  According to the charging documents, a senior executive of a minority-owned joint venture established by Grupo Aval to bid on the largest highway construction project in Colombia’s history (Ruta del Sol II) became aware of bribes that the majority joint venture partner agreed to pay government officials to obtain additional work in connection with the project.  In total, the executive caused the joint venture to pay more than $20 million in corrupt payments to Colombian officials between 2014 and 2016, funded through sham invoices.

To resolve the matter, Grupo Aval subsidiary Corficolombiana entered into a deferred prosecution agreement with DOJ charging a conspiracy to violate the FCPA’s anti-bribery provisions and agreed to pay a $40.6 million criminal penalty, which as noted above reflected a 30% Corporate Enforcement Policy discount from the bottom of the Guidelines range.  But DOJ agreed to credit up to half of that amount to a penalty imposed by Colombia’s Superintendencia de Industria y Comercio, so long as the subsidiary dropped its appeal of this penalty in Colombia, leading DOJ to proclaim this as the first coordinated anti-corruption resolution of its kind with Colombian authorities.  As part of the three-year agreement, Corficolombiana agreed to provide periodic reports to DOJ regarding its remedial efforts, but there was no compliance monitor imposed.  Simultaneously, Grupo Aval consented to an SEC order finding FCPA bribery and accounting violations and imposing more than $40.2 million in disgorgement plus prejudgment interest, bringing the combined financial resolution to greater than $80 million.  DOJ alleged that the majority joint venture partner who coordinated much of the alleged bribery was Brazilian construction company Odebrecht S.A., whose multi-country anti-corruption resolution covered in our 2016 Year-End FCPA Update continues to reverberate the better part of a decade later.

Albemarle Corporation

In the only other joint FCPA enforcement action of the year, on September 29, 2023 DOJ and the SEC announced FCPA resolutions with North Carolina-based specialty chemicals manufacturing company Albemarle.  The charging documents collectively allege that Albemarle engaged in a conspiracy to make millions of dollars in corrupt payments to government officials in India, Indonesia, and Vietnam between 2009 and 2017 to obtain business from state-owned entities in these countries, including by structuring tender requirements to favor Albemarle, providing confidential information about competitors, and to keep the company from being blacklisted.  The SEC then alone extended its allegations to contend that the company additionally engaged in private-sector bribery in India and failed to maintain adequate controls and accurate and complete records regarding third-party payments in China and the United Arab Emirates.

To resolve DOJ’s allegations of conspiracy to violate the FCPA’s anti-bribery provision, Albemarle entered into a three-year non-prosecution agreement and agreed to pay a criminal fine of $98.2 million plus forfeiture of $98.5 million, the former of which reflected a 45% Corporate Enforcement Policy discount from the bottom of the Guidelines range and the latter of which was substantially offset by the SEC disgorgement resolution.  To resolve the SEC’s charges of FCPA bribery and accounting violations, Albemarle consented to the filing of an administrative cease-and-desist proceeding and to pay $103.6 million in disgorgement plus prejudgment interest, with no penalty assessed in light of the DOJ criminal fine.  After offsets between the two resolutions, the total resolution amount was approximately $218 million.

Far and away the most controversial aspect of the Albemarle resolution was DOJ’s refusal to credit the company’s voluntary disclosure as such.  There was no dispute that Albemarle voluntarily disclosed the conduct to DOJ and the SEC prior to either agency being aware of it.  But DOJ took the position that the voluntary disclosure was not “reasonably prompt,” a prerequisite for getting voluntary disclosure treatment under the Corporate Enforcement Policy.  Specifically, DOJ alleged that Albemarle learned of the initial allegations in Vietnam 16 months prior to disclosure, and was able to confirm the conduct at least nine months prior to the disclosure.  The company then took remedial action and expanded the investigation to cover other geographies, but did not disclose the initial conduct in Vietnam until it disclosed four geographies all at once 16 months after the initial allegations.  Reminiscent of the ABB resolution covered in our 2022 Year-End FCPA Update—where DOJ refused to credit a disclosure as voluntary where counsel had contacted DOJ to schedule a disclosure meeting without naming the subject matter, and then after the initial contact but before the meeting the underlying allegations were reported in the press—DOJ refused to treat Albemarle’s disclosure as voluntary for purposes of the Corporate Enforcement Policy, which would have entitled the company to a presumption of a declination.  Nonetheless, DOJ did purport to give “significant weight” to the disclosure, including in determining the appropriate disposition (non-prosecution agreement) and Corporate Enforcement Policy discount (45% below the bottom of the Guidelines range), the latter of which is the highest figure granted to date under the Corporate Enforcement Policy and its predecessors.

Of final note from the Albemarle resolution is that it represented the first credit pursuant to Part II of the Criminal Division’s Compensation Incentives and Clawbacks Pilot Program from March 2023, discussed below.  Specifically, DOJ reduced Albemarle’s criminal fine by $763,453 as dollar-for-dollar credit in bonuses the company withheld from employees deemed by the company to be culpable for the misconduct.  These credits can under the right circumstances have a double impact, in that companies may both save the bonus (assuming litigation does not ensue and overtake the benefit) and get the reduction from their penalty.  But the fact that the credit amounts to a fraction of one percent of the overall resolution, or even just the criminal penalty, underscores the commentary that this program has received as not being meaningful in most cases.

2. DOJ’s New Forfeiture Practice Continues.

In our 2022 Mid-Year FCPA Update, we noted an unusual and even unprecedented aspect of the May 2022 Glencore FCPA enforcement action.  Specifically, Glencore was the first corporate defendant in the history of the FCPA (to our knowledge) to agree to pay a gain-based criminal forfeiture judgment on top of a criminal fine that was itself premised on gain.  To be sure, there have been many other examples of modest forfeiture components of FCPA corporate criminal enforcement actions, as well as certain DOJ components (e.g., the U.S. Attorney’s Office for the Southern District of New York) that have a history of imposing forfeiture on top of gain-based criminal fines in non-FCPA cases.  Further, our readers will be familiar with the fact that issuers have long been required to disgorge profits to the SEC on top of gain-based criminal fines imposed by DOJ in joint FCPA enforcement actions.  But our research shows that in the first 45 years of the FCPA—and across nearly 50 different cases against non-issuer companies pre-Glencore—DOJ did not impose gain-based forfeiture on top of a gain-based criminal fine.

At the time, Glencore was just a single example, and DOJ made no announcement to suggest it had changed its approach in FCPA cases.  Indeed, quite to the contrary as covered in these updates, DOJ’s corporate FCPA enforcement policy announcements of recent years had been heavily seasoned with the flavor of all the benefits companies may receive from disclosure, cooperation, and remediation.  But DOJ’s final three corporate FCPA prosecutions of 2023 (all against non-issuers) continued the “Glencore trend,” imposing sizeable gain-based forfeiture on top of sizeable criminal penalties.  And then finally, at the ACI FCPA Conference in November 2023, Acting Assistant Attorney General Nicole M. Argentieri confirmed the practice by stating that in non-issuer cases DOJ is now “requiring . . . that, in addition to paying any required criminal penalty, companies must pay appropriate forfeiture” such that “issuers and non-issuers [will be treated] alike” in “both pay[ing] applicable fines and forego[ing] the proceeds of their criminal activity.” DOJ has yet to issue an official policy to this effect, which stands in stark contrast to the proliferation of more “corporate-friendly” policies issued in 2023 as discussed herein, but clearly this appears to be DOJ’s position until it is challenged.

H.W. Wood Ltd. & Tysers Insurance Brokers Ltd.

On November 20, 2023, DOJ announced separate but related FCPA conspiracy charges against UK reinsurance brokers H.W. Wood and Tysers Insurance.  DOJ alleged that each company paid millions of dollars to an intermediary between 2013 and 2017 while knowing the intermediary would bribe various Ecuadorian government officials to secure insurance and reinsurance business with state-owned insurance companies Seguros Sucre S.A. and Seguros Rocafuerte S.A.

To resolve the charges, each company entered into a three-year deferred prosecution agreement.  H.W. Wood agreed to a criminal fine of $22.5 million and $2.3 million in forfeiture, but established an inability to pay under DOJ policy that reduced the financial penalty to only a $508,000 fine.  Tysers Insurance agreed to pay a criminal fine of $36 million plus approximately $10.5 million in forfeiture.  Both companies’ criminal fines reflected a 25% Corporate Enforcement Policy discount for cooperation and remediation, and neither company received a compliance monitor.

Both of these resolutions arise out of the same matter in which Gibson Dunn negotiated a “declination with disgorgement” resolution for Jardine Lloyd Thompson Group Holdings Ltd., as reported in our 2022 Year-End FCPA Update.  There and in prior updates we also covered separate criminal FCPA and money laundering charges brought against eight individual defendants, including the former chairman of Seguros Sucre and Seguros Rocafuerte who allegedly received the H.W. Wood and Tysers insurance bribes, as well as intermediary Esteban Merlo Hidalgo who allegedly paid them.

Freepoint Commodities LLC

In the final corporate FCPA enforcement action of the year, on December 14, 2023 DOJ and the Commodity Futures Trading Commission (“CFTC”) announced a joint resolution with Connecticut-based commodities trading company Freepoint Commodities arising out of allegations that it paid bribes to secure business with Brazilian state-owned oil company, Petróleo Brasileiro S.A. – Petrobras (“Petrobras”).  The government alleged that between 2012 and 2018, Freepoint made nearly $4 million in corrupt payments to Petrobras officials in exchange for confidential information about pricing and bids submitted to Petrobras by Freepoint’s competitors.

To resolve the corruption allegations, Freepoint entered into a deferred prosecution agreement with DOJ and agreed to pay a $68 million criminal fine, reflecting a 15% Corporate Enforcement Policy discount from the bottom of the Guidelines range, and additionally pay $30.5 million in criminal forfeiture.  In parallel, Freepoint also entered into a civil resolution with the CFTC agreeing to pay a $61 million civil penalty and $30.5 million in disgorgement, but the civil penalty was completely offset by the DOJ criminal fine and DOJ and the CFTC agreed to offsetting credits between the forfeiture and disgorgement such that 75% went to DOJ and 25% to the CFTC.  In total, Freepoint paid $98.5 million between the two U.S. settlements, and DOJ has provisioned for a credit of up to $22.4 million off of the criminal fine for a resolution with Brazilian authorities, although no such resolution has yet been announced.  The joint DOJ / CFTC corruption-related resolution in Freepoint—in which the corruption is charged by the latter as “manipulative and deceptive conduct” under the Commodity Exchange Act—is the third of its kind following Glencore (discussed in our 2022 Year-End FCPA Update) and Vitol (discussed in our 2020 Year-End FCPA Update).

Related to the Freepoint Commodities case, in 2023 DOJ announced criminal charges against three individual defendants:  Gary Oztemel, Glenn Oztemel, and Eduardo Innecco.  An indictment charging Freepoint trader Glenn Oztemel and third-party agent Innecco with FCPA and money laundering arising out of the alleged Petrobras corruption scheme was unsealed on February 17.  Glenn’s brother Gary Oztemel, who works at another oil trading company, was subsequently indicted on similar charges on August 29.  The two Oztemel brothers have been released on bail, pending a September 2024 trial date.  Innecco has yet to make an appearance and appears to be outside of the United States.  In a final case connection, it appears that one of the officials who allegedly received the corrupt payments was Rodrigo Berkowitz, who worked at Petrobras’ U.S. arm in Houston, Texas, and previously pleaded guilty to conspiracy to commit money laundering as covered in our 2020 Year-End FCPA Update.

3. A Year of DOJ Deferred and Non-Prosecution Agreements.

The careful reader of our Corporate Enforcement Policy chart in Section 1 above will note that all of the new corporate FCPA prosecutions of 2023 were resolved (at least at the top level) as deferred and non-prosecution agreements.  In a vacuum, this may seem in tension with pronouncements by DOJ officials purporting to scrutinize more carefully the grant of these so-called pretrial diversion agreements under the various memoranda issued by Deputy Attorney General Lisa O. Monaco discussed in our 2021 and 2022 year-end FCPA updates.  Time will tell whether 2023 was an aberration or the start of a more permissive trend in corporate enforcement.  But it is notable that the one parent-level guilty plea in an FCPA case from 2023 was a breach declaration from a 2019 deferred prosecution agreement.

We discuss this, and the two “declination with disgorgement” letters issued in 2023, below.

Telefonaktiebolaget LM Ericsson DPA Breach

On March 2, 2023, DOJ announced that Swedish multinational telecommunications company Ericsson had agreed to plead guilty in connection with its 2019 FCPA resolution following DOJ’s determination that the Company had breached its prior deferred prosecution agreement.  As covered in our 2019 Year-End FCPA Update, Ericsson entered into the earlier deferred prosecution agreement to resolve FCPA charges with DOJ arising out of alleged corruption in China, Djibouti, Indonesia, Kuwait, Saudi Arabia, and Vietnam. In 2023, DOJ revoked the 2019 deferred prosecution agreement and Ericsson agreed to plead guilty to the original criminal charges, pay a fine of $206,728,848, and agreed to extend its pre-existing monitorship and associated term of probation by one year, through June 2024.

The Ericsson breach declaration demonstrates DOJ’s focus on corporate compliance with post-resolution terms imposed by deferred prosecution and other “pretrial diversion” agreements.  Notably, DOJ does not charge or even allege new criminal conduct (which is why this case is not reflected in the 2023 statistics above).  Rather, DOJ asserts that Ericsson violated the cooperation and disclosure provisions of the 2019 agreement by failing to disclose promptly all evidence related to the previously charged conduct in Djibouti and China, as well as failing to disclose adequately certain other activities in Iraq.  Of further note, DOJ alleged that company leadership instructed its counsel to disclose to DOJ the conduct in Iraq, but that “prior outside counsel omitted material facts and information” in their reporting. DOJ credited Ericsson for “significantly enhanc[ing] its cooperation and information sharing efforts” after this matter came to light.  Gibson Dunn represented the company in the 2023 resolution (but was not “prior outside counsel”).

The Ericsson case is only one of two cases in which DOJ has revoked a deferred prosecution agreement and demanded a guilty plea in a corporate FCPA case.  As reported in our 2008 Year-End FCPA Update, in November 2008 DOJ alleged a breach of Aibel Group’s 2007 deferred prosecution agreement arising out of alleged corruption in Nigeria, after which Aibel Group pleaded guilty to the underlying charges.  Further, as discussed in our 2017 Mid-Year FCPA Update, DOJ once entered into a second deferred prosecution agreement based in part on allegations of breaches arising during the term of the first agreement in the January 2017 Zimmer Biomet case.

Corsa Coal Corp. Declination with Disgorgement

On March 8, 2023, DOJ issued its first “declination with disgorgement” letter of the year to Pennsylvania coal company Corsa Coal.  The letter alleges that between 2016 and 2020, Corsa Coal employees paid $4.8 million to a consultant while knowing that portions of those fees would be used to make corrupt payments to officials of an Egyptian state-owned coke and chemical production company, including its chairman.  Corsa Coal allegedly secured $143 million in contracts as a result of these payments, and earned $32.7 million in illicit profits.

In conjunction with DOJ’s declination, Corsa Coal agreed to pay $1.2 million in disgorgement, an amount substantially reduced from realized gains based on DOJ’s Inability-to-Pay Guidance and a determination that further payment would “substantially threaten” the company’s ongoing viability.  In declining to prosecute Corsa Coal, DOJ noted the company’s voluntary disclosure, cooperation, and remediation efforts.

We covered the guilty plea of former Corsa Coal International Sales Head Frederick Cushmore, Jr. and indictment of former Vice President Charles Hunter Hobson, respectively, in our 2021 Year-End and 2022 Mid-Year FCPA updates.  As of this writing, there is yet to be a trial date set in the Hobson case.

Lifecore Biomedical, Inc. Declination with Disgorgement

In the year’s second of two “declinations with disgorgement,” on November 16, 2023 DOJ announced that it was declining to prosecute Lifecore for allegedly corrupt payments made in 2018 and 2019 by a former subsidiary to Mexican government officials to secure a wastewater discharge permit and avoid various wastewater discharge expenses.  Notably, the alleged payments began prior to Lifecore’s acquisition of the subsidiary, were affirmatively hidden from Lifecore during due diligence, and then were discovered during post-acquisition integration as the payments continued under the ownership of Lifecore.  Relevant to the Albemarle disclosure discussion above, DOJ made a point of noting that Lifecore reported the matter to DOJ within three months of discovering the possible misconduct, and within hours of the internal investigation confirming the alleged corruption.  This was deemed to be a “reasonably prompt” report qualifying as a “voluntary disclosure” for purposes of the Corporate Enforcement Policy.

To resolve the matter, Lifecore agreed to DOJ’s statement of facts and consented to disgorge just over $400,000.  The disgorgement amount was set based on the costs Lifecore allegedly avoided having to pay to Mexican regulatory authorities through the purported corrupt payments, with credits for remediation costs Lifecore already had paid after discovering the misconduct.

4. The FCPA’s Dual Enforcers Largely Go it Alone in 2023.

Several of the principal authors of this update have been known to say on more than one occasion that DOJ and the SEC—the FCPA’s dual enforcers—”work hand in glove.”  The closeness of the working relationship between the specialized FCPA Units of each agency has historically been borne out in a heavy overlap in enforcement actions—especially corporate enforcement actions.  But that was not the case in 2023.

In 2023, only 2 of 14 corporate FCPA enforcement actions were dually brought by DOJ and the SEC.  That is substantially lower than historical averages, and indeed is the lowest percentage of overlap in corporate enforcement actions since 2015, where we also noted the lack of duality in our 2015 Year-End FCPA Update.  There will always be corporate cases that cannot, or should not, be brought jointly by both agencies, such as prosecutions against non-issuers or where the evidence of non-compliant conduct does not meet the higher standard required for criminal prosecution.  Nonetheless, those dynamics have been static over the years studied and the departure in 2023 enforcement numbers is noteworthy, though we expect more a blip than a trend.

A line graph summarizing the percentage of overlap in DOJ / SEC corporate FCPA enforcement actions over the past 10 years follows.  The two examples of joint actions in 2023 (Albemarle and Grupo Aval) are covered above, and the seven SEC-only actions are covered below the graph.  We will continue to study the degree of overlap in corporate FCPA enforcement in the year ahead to see if this is a blip or a trend.

Flutter Entertainment plc

The first SEC-only FCPA enforcement action of the year came on March 6, 2023, when Irish sports betting and gaming company Flutter resolved a corruption case arising out of Russia.  According to the SEC’s order, Flutter (then operating as The Stars Group, Inc.) paid nearly $9 million to Russian consultants between 2015 and 2020 in an apparently unsuccessful effort to legalize online poker in the country.  The SEC alleged that Flutter failed to perform risk-based diligence prior to hiring the consultants, entered into contracts that did not contain anti-corruption provisions, and failed to review expense reimbursements submitted by the consultants, which caused the company to reimburse expenses that did not comply with its own policies.

To resolve the FCPA books-and-records and internal controls charges, and without admitting or denying the findings, Flutter agreed to pay a $4 million civil penalty.  The SEC noted the company’s cooperation and remediation efforts, which included exiting the Russian market following Russia’s invasion of Ukraine, and did not require any further, forward-looking compliance undertakings.  The status of any DOJ investigation, if there is one, is not known.

Rio Tinto plc

Also on March 6, 2023, the SEC announced FCPA books-and-records and internal controls charges against global mining and metals company and ADS issuer Rio Tinto arising out of its iron ore operations in Guinea.  According to the SEC’s order, Rio Tinto hired a consultant who had no experience in the industry or country because he was a former classmate with close connections to a senior Guinean official who had influence over a disputed mining concession belonging to Rio Tinto.  Without substantial evidence of services performed, the company allegedly paid the consultant $10.5 million, several days after which the consultant attempted to transfer over $800,000 to a Hong Kong company purportedly owned by someone with ties to the senior government official and other Guinean officials.  The processing bank blocked that payment, but thereafter the same Hong Kong company allegedly commissioned $200,000 worth of t-shirts to support the senior Guinean official’s reelection campaign.

To resolve the charges, Rio Tinto agreed to pay a $15 million civil penalty.  There was no disgorgement because the company did not ultimately develop the mining concession.  The SEC credited Rio Tinto’s cooperation and remedial efforts, and did not require any further, forward-looking compliance undertakings.  There is no indication that DOJ will take separate action.  For its part, the UK Serious Fraud Office has announced the closure of its investigation, in part due to the company’s resolution with the SEC and a separate enforcement action described below against the consultant who allegedly made the payment to the senior Guinean official by the French National Financial Prosecutor’s Office.

Frank’s International N.V.

On April 26, 2023, the SEC announced a resolved FCPA enforcement action against Dutch oilfield services provider Frank’s International.  The SEC alleged that Frank’s International retained and paid substantial commissions to an agent while allegedly knowing the agent had close relationships with officials of Angola’s state-owned oil company Sonangol, and further that the agent did not have any relevant technical expertise.  Notably, the company retained the agent prior to listing on the New York Stock Exchange, but allegedly continued the commission payments after becoming an issuer.  The SEC also asserted that Frank’s International did not perform any due diligence on the agent, and only created a backdated agreement long after engaging the agent.

Without admitting or denying the SEC’s allegations, Frank’s International agreed to pay a $3 million civil penalty plus nearly $5 million in disgorgement and prejudgment interest.  The SEC acknowledged the company’s self-reporting and cooperation, which appear to have occurred after Frank’s was acquired by another company, and did not require any further, forward-looking compliance undertakings.  Frank’s International’s successor has reported that DOJ has closed its parallel investigation without charges against the company.

Koninklijke Philips N.V.

In another SEC-only FCPA enforcement action, on May 11, 2023, Dutch medical supplier Koninklijke Philips agreed to resolve books-and-records and internal controls charges arising from the company’s use of distributors in China.  According to the SEC’s order, between 2014 and 2019, Koninklijke Phillips subsidiaries in China provided special price discounts to distributors, which allegedly “created a corruption risk that the increased margins could be used to fund improper payments to employees of government-owned hospitals.”  The SEC further alleged that these subsidiaries engaged in improper bidding practices, such as influencing hospital officials to tailor specifications to favor the companies’ products and preparing false “complementary bids” to provide an inaccurate sense of competition.

To resolve the allegations, and without admitting or denying the SEC’s findings, Koninklijke Philips agreed to pay approximately $62.2 million, consisting of a $15 million civil penalty and the balance to disgorgement and prejudgment interest.  The company also agreed to self-report to the SEC on the status of its FCPA compliance program for a two-year period.  The SEC noted that it had previously charged Koninklijke Philips in 2013 for alleged FCPA misconduct in Poland, as covered in our 2013 Mid-Year FCPA Update.  The company announced that DOJ has closed its parallel investigation into the more recent matter without filing any charges.

Gartner, Inc.

On May 26, 2023, Connecticut-headquartered technological research and consulting company Gartner resolved FCPA bribery and accounting charges with the SEC.  The SEC’s order alleged that, from roughly December 2014 through August 2015, Gartner entered into subcontracts with a South African IT consulting company and subagents that allegedly had close ties to officials in the South Africa Revenue Service.  The SEC claimed that Gartner knew or consciously disregarded the risk that all or part of the money it paid to the consulting company would be used to bribe revenue officials to influence the award of sole-source contracts to Gartner, and that the justification for using this consultant was false because neither it nor its subagents qualified for the Broad-Based Black Economic Empowerment legislation that was the purported basis for the consultant’s retention.  The SEC further alleged that the company maintained false records and deficient controls relating to the retention of consultants.

Without admitting or denying the SEC’s findings, Gartner agreed to pay a $1.6 million civil penalty and pay $856,764 in disgorgement plus prejudgment interest.  The SEC recognized Gartner’s self-disclosure, following press reports in South Africa, as well as the company’s cooperation, and did not require any additional, forward-looking compliance undertakings.

U.S.-Based Multinational Company

On August 25, 2023, the SEC announced a settled FCPA resolution with a U.S.-based multinational conglomerate.  According to the SEC’s order, between approximately 2014 and 2018, employees of the company’s Chinese subsidiary allegedly arranged for influential Chinese healthcare officials from various state-owned entities to attend overseas conferences, healthcare facility visits, and other educational events, including to the United States.  The SEC suggested that the true purpose of the trips was to encourage the officials to purchase the company’s products, though it seemed unable to establish a quid pro quo connection between the trips and any business awarded to the entity.  Still, the SEC’s theory was that employees allegedly submitted one set of travel itineraries emphasizing the educational purposes of the trips for compliance review, while at the same time maintaining secret, alternate itineraries for the government officials that included tourism and entertainment activities unrelated to the company’s business operations, thus falsifying corporate books and records.  Finally, the SEC alleged that the employees submitted vaguely described payments to travel agencies to obtain reimbursement of otherwise non-reimbursable expenses associated with the trips.

To resolve the matter, and without admitting or denying the SEC’s allegations concerning FCPA books-and-records and internal controls charges, the company agreed to pay nearly $4.6 million in disgorgement and prejudgment interest, plus a $2 million civil penalty.  The SEC credited the company for its prompt and voluntary self-reporting and cooperation, as well as undertaking substantial remedial measures.  It appears that DOJ’s investigation into the matter has been closed.

Clear Channel Outdoor Holdings Inc.

In the year’s final SEC-only FCPA enforcement action, on September 28, 2023 Texas-based out-of-home advertising company Clear Channel agreed to resolve charges arising out of alleged corruption in China.  According to the SEC’s order, from 2012 to 2017, Clear Channel’s Chinese subsidiary made improper payments and gifts to Chinese government officials in an effort to obtain advertising display contracts with local Chinese government transport authorities.  These payments and other items of value were allegedly provided directly and by inflating third-party vendor contracts to maintain the outdoor advertising displays.  The subsidiary also allegedly created a so-called “off-book fund” by creating false invoices used to justify employee cash withdrawals that were then provided to un-diligenced third parties with whom the subsidiary had no contracts in order to facilitate business development activities.  Finally, the SEC alleged that these activities occurred at the subsidiary despite multiple internal audits flagging various bribery risks in China, and that the control deficiencies continued throughout 2019.

To resolve the matter, and without admitting or denying the allegations, Clear Channel consented to the filing of FCPA bribery and accounting charges and to pay a total of $26.2 million in penalties, disgorgement, and prejudgment interest.  Reportedly in part due to its inability to remediate the issues raised in the SEC order, Clear Channel divested its interest in the Chinese subsidiary in 2020.  The SEC credited Clear Channel’s cooperation with the SEC and remediation, and did not require any post-resolution reporting.  According to the company, DOJ has closed its investigation without filing any charges.

5. LATAM Continues to Dominate FCPA-Plus Individual Prosecutions.

Latin America collectively makes up about 5% of global gross domestic product, but many multiples of that as a percentage of criminal FCPA and related anti-corruption enforcement by DOJ.  This is particularly the case in individual prosecutions for which, in 2023, 80% of criminal FCPA and FCPA-related prosecutions arose out of fact patterns involving Latin American countries.  And this figure is not aberrant as compared to recent years in anti-corruption enforcement.  Over the past 10 years, nearly 65% of criminal FCPA and FCPA-related charges brought by DOJ had a nexus to conduct occurring in Latin American countries.

There are many reasons for this, and we do not count among them that Latin America is particularly corrupt as compared to other parts of the developing world—it is not.  One principal reason has to do with the degree of integration between the U.S. economy and those of its neighbors across the Americas.  This is true both because of the diaspora of immigrants who have set up businesses in the United States focused on their home countries, as well as a reflection of flight to the stability of the U.S. Dollar from markets with less stable currencies, of which there are several across Latin America.  Another principal reason has to do with the relationships that DOJ has established over the past decade with prosecutors across the region, starting in Brazil with the “Operation Car Wash” investigation, but also prominently with Colombian and several Central American enforcers.  Finally, there can be no escaping the unique significance of the collapse of the Venezuelan economy and the looting of state-owned oil company Petróleos de Venezuela, S.A. (“PDVSA”), among other corruption-related fact patterns that have found their way into U.S. court filings.

These factors influence corporate anti-corruption enforcement as well, particularly the second relating to DOJ’s cross-border partnerships with Latin American enforcement agencies.  But our experience shows that as a whole the above dynamics influence individual prosecutions to a much greater degree.  This is because individuals are far more likely than companies to press their cases to indictment and beyond, and when assessing the prospect of trial, a case that involves meetings in Miami and bank accounts in Houston is far more compelling than an Africa or Asian-based fact pattern where the only U.S. touchpoints are correspondent banking account transfers.  The greater degree of travel—both directly to the United States and indirectly to extradition-friendly countries—within the Americas also makes it far more likely that individuals within the region will be picked up on a warrant and have their indictment unsealed.

As noted above, 80% (12 of 15) individual FCPA enforcement actions in 2023 arose from Latin America-based fact patterns.  The Brazilian (Petrobras) case involving the Oztemel brothers and Innecco is covered above together with the corporate case of Freepoint , and the remainder follow.  Consistent with our standard practice, we discuss both actual FCPA charges and FCPA-related charges brought by DOJ’s FCPA Unit, most frequently under the money laundering statute as illustrated below.

Maikel Jose Moreno Perez (Venezuela)

The first FCPA-related case of 2023 was made public on January 26, when DOJ announced an indictment on money laundering charges returned against Maikel Jose Moreno Perez, a sitting justice on Venezuela’s Supreme Tribunal of Justice and former President of the Court.  The indictment, which tracks a criminal complaint filed in 2020, alleges that between 2014 and 2019 Moreno accepted more than $10 million in bribes for taking various actions in his role on the Court, including dismissing criminal charges or arrest warrants, sentencing defendants leniently, and even approving the judicial seizure of an auto plant owned by a U.S. car manufacturer.

Moreno, who also has been designated as a Specially Designated National by the Treasury Department’s Office of Foreign Asset Controls, has been declared a fugitive by the U.S. District Court for the Southern District of Florida.

George Walther-Meade & Juan Gonzalez Ruiz (Mexico)

In another FCPA-related case, on February 9, 2023, a grand jury sitting in the Southern District of California returned an indictment charging a former division manager of a U.S. defense contractor, George Walther-Meade, and third-party consultant Juan Gonzalez Ruiz, with wire fraud and money laundering arising out of an embezzlement scheme tied up in an FCPA investigation.  According to the indictment, Walther-Meade arranged for his employer to retain Gonzalez’s company as a subcontractor in Mexico and caused the defense contractor to pay the subcontractor more than $3 million between 2012 and 2021 for work that was never performed.  In return, Gonzalez allegedly kicked back portions of the defense contractor’s payments to Walther-Meade by, among other avenues, issuing credit cards to Walther-Meade and his family members that they used to pay for personal expenses.  Separate civil litigation between the defense contractor and Walther-Meade (which has since been stayed pending the criminal cases) makes clear that the matter is part of a broader FCPA investigation disclosed by the defense contractor, which also is consistent with the presence of DOJ FCPA Unit prosecutors on the docket sheet.

On June 15, 2023, Ruiz reached a plea agreement and entered a guilty plea to one count each of money laundering and wire fraud.  He was sentenced on December 22 to 314 days (time served) and ordered to make $3.2 million in restitution to the defense contractor.  Sadly, under the weight of the charges and prospect of a cooperating co-defendant, Walther-Meade reportedly took his own life on November 6, 2023.  This was tragically the second FCPA defendant to take their life in 2023, as in a heartbreaking scene Juan Manuel Gonzalez Testino (whose 2019 FCPA-related guilty plea was covered in our 2020 Year-End FCPA Update) was found shot to death together with his three-year-old son in their South Florida apartment in March, weeks before the father’s sentencing hearing, in what was reported as a murder-suicide.

Samuel Bankman-Fried (China)

The FCPA and crypto worlds collided for the first time on March 28, 2023, when DOJ unsealed a fifth superseding indictment adding an FCPA bribery conspiracy count to the blockbuster prosecution of disgraced cryptocurrency mogul Samuel Bankman-Fried.  The FCPA charge against the FTX.com and Alameda Research founder concerned an alleged bribe of approximately $40 million in cryptocurrency paid to a Chinese government official in November 2021 to unfreeze the trading accounts of Alameda Research, which contained over $1 billion in cryptocurrency and had been frozen in connection with an ongoing investigation by the Chinese government.

Bankman-Fried subsequently filed a motion to dismiss the FCPA charge, among others that were not filed prior to his extradition from the Bahamas in the underlying crypto fraud case, arguing that the “rule of specialty” prohibited the United States from extraditing a defendant on one set of charges only to subsequently indict the defendant on additional charges that were not approved in the extradition process.  Of potentially greater interest to FCPA enthusiasts, Bankman-Fried separately moved to dismiss the FCPA count on the ground that the indictment did not sufficiently allege the “obtain or retain business” element of the FCPA in that lobbying a government to unfreeze corporate assets is not sufficiently related to obtaining or retaining business from that government.  Finally, Bankman-Fried challenged venue for the FCPA charge in the Southern District of New York.  The Honorable Lewis A. Kaplan of the U.S. District Court for the Southern District of New York denied the motion in an omnibus order issued on June 29, 2023, finding in a brief analysis that the minimal requirements required at the indictment stage were met.

DOJ did agree, however, to sever the five new charges, including the FCPA bribery count, to allow more time for discussions with the Bahamian government regarding extradition, resulting in the severance of the new charges and a separate trial date in March 2024.  In the meantime, in November 2023 a jury found Bankman-Fried guilty of the original crypto-related market manipulation, wire fraud, and money laundering charges.  On December 29, 2023, DOJ filed a letter with the Court advising that it did not intend to proceed to trial on the severed counts, including the FCPA charge.  DOJ noted that The Bahamas still had not consented to the new charges, and that the delay required for a second trial would not be in the interests of justice given the interests in finality to the first verdict as well as, it contended, the ability of the Court to consider the additional charges as “relevant conduct” at sentencing for the first set of convictions.  Sentencing for the crypto fraud convictions is scheduled for March 2024.

Alvaro Ledo Nass (Venezuela)

On March 29, 2023, the former general counsel of Venezuela’s PDVSA, Alvaro Ledo Nass, pleaded guilty to one count of conspiracy to launder bribes linked to various foreign currency exchange schemes involving PDVSA loan contracts that we have been covering regularly since our 2018 Year-End FCPA Update.  According to Ledo’s factual proffer, between 2012 and 2017 he and a variety of previously-charged individuals exploited Venezuela’s fixed foreign currency exchange rate that artificially pegged the value of the bolivar above prevailing rates, selling the rights to exchange Venezuelan bolivars for U.S. dollars at inflated rates in exchange for bribes.  Ledo admitted personally to accepting more than $11.5 million in payments associated with corrupt currency schemes valued at more than $1 billion.

On June 12, 2023, the Honorable Kathleen M. Williams of the U.S. District Court for the Southern District of Florida sentenced Ledo to three years in prison, coupled with an order of forfeiture.

Carlo Alloni (Djibouti)

We frequently make the point that FCPA enforcement is greater than what is reported, as many cases are filed and remain under seal for years for a variety of reasons, ranging from ongoing cooperation to extradition efforts.  An excellent example of this phenomena is the case of former Ericsson regional manager Carlo Alloni, who pleaded guilty in 2018 to a single count of FCPA bribery conspiracy, had his case remain under seal until 2021 as he cooperated with the government, and then had the case publicized only with the appearance of an FCPA prosecutor in connection with his June 28, 2023 sentencing.

According to court documents, Alloni, an Italian citizen living in England who previously worked for Ericsson in Africa, was first approached by federal agents in 2017 when he landed at a U.S. airport.  Although he initially denied having knowledge of the alleged corruption, he subsequently approached prosecutors with counsel and agreed to cooperate in what would become the Djibouti allegations resolved by the company in 2019.  Because of “the substantial nature and significance of [his] cooperation,” at the June 28, 2023 sentencing the Honorable George B. Daniels of the U.S. District Court for the Southern District of New York sentenced Alloni to time served on probation pending sentencing, with no further sanction following the hearing.

Amadou Kane Diallo (Senegal)

On September 20, 2023, a grand jury in the Central District of California returned a superseding indictment against California businessman Amadou Kane Diallo, adding an FCPA charge to wire fraud and money laundering charges filed earlier in the year arising from an alleged investment fraud scheme.  According to the indictment, from 2015 to 2020 Diallo executed a scheme to defraud investors in two companies that he owned by using a false appearance of wealth to fraudulently solicit investments, then using those investments to further his appearance of wealth rather on the businesses as represented to prior investors.  But where this scheme took an FCPA turn is when Diallo allegedly attempted to corruptly obtain a land grant involved in the investment scheme from Senegalese government officials by providing or promising to provide them with gifts.  This included allegedly chartering a helicopter to take one Senegalese official to an NBA basketball game while the official was visiting the United States, and then offering to purchase five motor vehicles for a second official during a trip to Senegal to discuss the land grant.

Diallo, who has been detained pretrial, has pleaded not guilty to all charges and is currently facing a March 2024 trial date.

Christian Julian Cazarin Meza (Mexico)

On October 27, 2023, Mexican construction company owner Christian Julian Cazarin Meza pleaded guilty in the U.S. District Court for the Eastern District of New York to one count of conspiracy to violate the FCPA.  Cazarin admitted that between 2017 and 2020 he participated in a bribery scheme with former Vitol Group trader Javier Alejandro Aguilar Morales and others to provide more than $600,000 to Gonzalo Guzman Manzanilla and Carlos Espinosa Barba, both officials of the U.S. procurement subsidiary of Mexican state-owned oil company Petróleos Mexicanos (“PEMEX”), in exchange for confidential information that Vitol used to win contracts from the PEMEX subsidiary.  We last covered the charges against Cazarin’s co-defendants in the PEMEX scheme in our 2022 Mid-Year FCPA Update.

Cazarin is currently awaiting sentencing, which has not yet been scheduled.

Orlando Alfonso Contreras Saab (Venezuela)

On November 2, 2023, Venezuelan businessman Orlando Alfonso Contreras Saab pleaded guilty to a one-count information charging him with conspiracy to violate the FCPA.  According to the information, Contreras participated in a scheme to bribe the then-governor of the Venezuelan state of Táchira, Jose Gregorio Vielma Mora, in connection with Comité Local de Abastecimiento y Producción (“CLAP”), a Venezuelan food and medicine distribution program.  Between 2016 and 2019, Contreras allegedly took bribe payments from co-conspirator Alvaro Pulido Vargas associated with inflated food contracts received by Pulido’s company under CLAP and passed them on to Vielma, after keeping a cut for himself.  We previously reported on DOJ’s charges against Vielma, Pulido, and others, in our 2021 Year-End FCPA Update.

Contreras is scheduled to be sentenced in February 2024.  His co-conspirators have been designated fugitives by the U.S. District Court for the Southern District of Florida and are not before the Court.

Carl A. Zaglin, Francisco Roberto Cosenza Centeno, Aldo N. Marchena (Honduras)

The final FCPA case of 2023 was made public on December 22, when DOJ announced the unsealing of a five-count indictment charging Carl A. Zaglin, owner of a Georgia-based manufacturer of law enforcement uniforms and equipment, with bribing co-defendant Francisco Roberto Cosenza Centeno, the former director of a Honduran governmental entity known as “TASA” that procured goods for the Honduran National Police, through companies owned by Florida resident Aldo N. Marchena.  According to the indictment, Zaglin and Marchena conspired to pay more than $166,000 in bribes to Cosenza and other TASA officials to corruptly influence the award of more than $10 million in law enforcement equipment contracts to the Honduran National Police.

Zaglin and Marchena are charged with substantive FCPA and/or FCPA conspiracy offenses and all three defendants are charged with money laundering offenses.  According to recent court filings, only Zaglin is currently before the Court, but both Cosenza and Marchena are in custody and undergoing extradition proceedings, from Honduras and Colombia, respectively.  In the meantime, trial has been scheduled for November 2024.

2023 FCPA-RELATED ENFORCEMENT LITIGATION

As our readership knows, following the filing of FCPA or FCPA-related charges, criminal and civil enforcement proceedings can take years to wind their way through the courts.  The substantial number of enforcement cases from prior years, especially involving contested criminal indictments of individual defendants, has led to an active year in enforcement litigation beyond the cases initiated in 2023 as covered above.  A selection of key 2023 FCPA-related enforcement litigation developments follows.

DOJ Drops 2018 Money Laundering Charges Against Acosta y Lara

Although most indicted FCPA cases result in conviction, that is not always the case.  Occasionally criminal defendants prevail in convincing a jury to acquit at trial, a judge to dismiss the charges before, during, or after trial, and sometimes DOJ even seeks to dismiss the case itself.  That happened on November 22, 2023 to Uruguayan banker Marcello Federico Gutierrez Acosta y Lara, whose 2018 indictment on PDVSA-related money laundering charges was dismissed with prejudice by the Honorable Kathleen M. Williams of the U.S. District Court for the Southern District of Florida, on DOJ motion, on November 16, 2023.  DOJ gave no explanation on the reason for the requested dismissal in its one-sentence motion, but Acosta y Lara’s counsel told reporters at Global Investigations Review that the “case never should have been brought and the government had a moral responsibility to dismiss it” due to exculpatory evidence.

Fifth Circuit Affirms Dismissal of Casqueiro Murta PDVSA Bribery Charges

In our 2022 Year-End FCPA Update, we covered the Fifth Circuit’s February 2023 decision reversing the dismissal of PDVSA-related FCPA and money laundering charges against wealth management advisors Daisy Teresa Rafoi Bleuler and Paulo Jorge Da Costa Casqueiro Murta.  As is the typical practice, on remand the case was sent back to the judge who dismissed the indictments in the first place, which in this case was the Honorable Kenneth M. Hoyt of the U.S. District Court for the Southern District of Texas.

Post-remand proceedings as to Rafoi have been quiet, as she has yet to be extradited and make an appearance before the District Court.  But as to Casqueiro Murta, Judge Hoyt once again dismissed the case with prejudice on May 17, 2023, this time finding a violation of the defendant’s right to a speedy trial under both the Sixth Amendment and Speedy Trial Act.  In a subsequent memorandum and order issued on June 6, 2023, the Court found, among other things, that DOJ engaged in “intentional and protracted delay” in first bringing to the Court’s attention, and then failing to disclose details regarding, certain classified national security information that DOJ knew to be irrelevant to Casqueiro Murta in the first place.  Judge Hoyt concluded “that the government intentionally used non-discoverable, irrelevant material as a faux pas basis for delaying trial because it was unprepared.”  DOJ appealed and the Fifth Circuit expedited briefing.

On November 28, 2023, the Fifth Circuit affirmed the dismissal of charges against Casqueiro Murta on Speedy Trial Act grounds, but reversed the Sixth Amendment basis for dismissal as well as Judge Hoyt’s determination that the Speedy Trial Act dismissal should be with prejudice.  Then, on January 5, 2024, the Fifth Circuit retracted the original opinion and substituted a new opinion for the same holding.  In the substituted opinion, the Honorable Jacques L. Wiener, Jr. writing for the Fifth Circuit panel held that the District Court erred in its balancing of factors leading to the determination that the Speedy Trial Act violation weighed in favor of dismissal with prejudice.  Chief among the errors found was that the District Court in weighing the dismissal factors improperly elevated the interests of Portuguese citizens in potential charges against Casqueiro Murta in Portugal (which the District Court errantly referred to as actual charges, when in fact there was only an investigation) above the interests of the United States in charges here.  The Fifth Circuit likewise found in error the District Court’s Sixth Amendment basis for dismissal.

The Fifth Circuit remanded the case back to the District Court, but in an unusual move—premised on “the history of this case and some findings by the district judge not discussed” in the opinion—ordered that the case be reassigned to a different judge on remand.  On remand, Chief Judge Randy Crane assigned the case to himself and the matter is currently set for a March 2024 evidentiary hearing on whether the Speedy Trial Act violation merits dismissal with or without prejudice.

Saab Moran Granted Clemency in Prisoner Swap with Venezuela

As we first covered in our 2019 Year-End FCPA Update, joint Colombian and Venezuelan citizen Alex Nain Saab Moran was indicted on money laundering offenses in connection with an alleged $350 million construction-related bribery scheme in Venezuela.  After he was detained in the Republic of Cape Verde on a U.S. extradition request, Saab Moran filed a motion to enter a special appearance and challenge the indictment from abroad.  The motion was denied by the Honorable Robert N. Scola, Jr. of the U.S. District Court for the Southern District of Florida and Saab Moran’s appeal was dismissed as moot by the Eleventh Circuit after he was successfully extradited to the United States.  On December 23, 2022, Judge Scola denied the motion to dismiss the indictment, as we reported in our 2022 Year-End FCPA Update.

Saab Moran took another interlocutory appeal to the Eleventh Circuit from Judge Scola’s denial of the motion to dismiss, which was in the process of being briefed when on December 21, 2023, White House officials announced that Saab Moran had been granted clemency by President Biden.  Saab Moran was part of prisoner swap between the governments of the United States and Venezuela, in which he was sent back to Venezuela in exchange for the release of 10 U.S. citizens held in Venezuela plus infamous contractor fugitive Leonard Glenn Francis (“Fat Leonard”), the latter of whom had sought asylum in Venezuela after escaping home detention prior to reporting to prison after being convicted of non-FCPA-related bribery charges in the Southern District of California.  Following the inter-governmental deal, Saab Moran’s lawyer issued a statement that the swap “allows an innocent Venezuelan diplomat to return home after serving over three and a half years in custody.”

Chang Extradited; Motion to Dismiss Denied; Trial Scheduled for July 2024

In our 2019 Year-End FCPA Update, we covered the indictment of former Mozambique Minister of Finance Manuel Chang—along with seven other defendants—on FCPA-related wire fraud, securities fraud, and money laundering charges.  In what is known as the “Tuna Bonds” scandal, Chang allegedly signed guarantees on behalf of the Mozambique government falsely representing its financial solvency, which caused foreign banks to issue loans to Mozambique state-owned companies for maritime projects that ultimately failed, in exchange for receiving approximately $18 million in alleged kickbacks.  Chang was arrested in South Africa on a U.S. extradition request in December 2018, but extradition proceedings lasted four-and-one-half years—due in large part to a competing extradition request filed by the Government of Mozambique—and Chang was not extradited to the United States until July 2023.

On August 8, 2023, Chang filed a motion to dismiss the indictment on speedy trial grounds.  Co-defendant Najib Allam, an executive of the shipbuilding company that allegedly paid the bribes, followed with his own speedy trial motion to dismiss, even though he is still in Lebanon.  On December 21, 2023, the motions were denied by the Honorable Nicholas Garaufis of the U.S. District Court for the Eastern District of New York.  As to Chang, Judge Garaufis found that the defendant’s own actions in resisting extradition were responsible for the majority of the pretrial delay.  As to Allam, Judge Garaufis held that a defendant who stays in a country with no extradition treaty (such as Lebanon) cannot complain of the delay caused by his refusal to leave the country and face prosecution in the United States.

Trial for Chang is currently set to begin on July 29, 2024.

Schulman Motions to Dismiss Denied; Trial Scheduled for March 2024

In our 2020 Year-End FCPA Update, we reported on the FCPA-related bank, mail, and wire fraud and money laundering indictment of Maryland attorney Jeremy Wyeth Schulman arising from his alleged role in a six-year conspiracy to misappropriate $12.5 million in Somali sovereign assets frozen in U.S. financial institutions.  DOJ contends that Schulman forged paperwork purporting to show that he was acting on the authority of the Central Bank of Somalia in repatriating these assets, when in fact there reportedly was no such authorization.  Schulman, for his part, contends he was acting on the valid instruction of a client associated with a key member of the transitional Somali government, and notes that roughly three-quarters of the $12.5 million recovered was repatriated to the Central Bank of Somalia.  Pretrial litigation has been, to put it mildly, contentious.

On September 28, 2023, the Honorable Paula Xinis of the U.S. District Court for the District of Maryland denied four different motions to dismiss filed by Schulman in a 63-page memorandum opinion.  First, Judge Xinis denied the motion to dismiss for pre-indictment delay—even though she found that Schulman established prejudice based on witnesses who became unavailable with the passage of time—because the Court did not believe it appropriate to second-guess DOJ’s decision to wait up to six years to build its case before indicting, and found that ultimately DOJ acted diligently.  Second, Judge Xinis denied Schulman’s motion to dismiss pursuant to the “act of state doctrine,” finding that the true question for trial was not whether Schulman actually had authority to repatriate the assets under Somali law, but whether he believed he had authority.  Third, the Court denied Schulman’s “political question” motion to dismiss for similar reasons.  Finally, Judge Xinis denied Schulman’s motions to dismiss various counts of the indictment for failure to state a claim, as duplicitous, or barred by the applicable statute of limitations, finding that Schulman at most presented factual questions to be resolved by the jury.

Trial in Schulman’s case is presently scheduled to begin on March 4, 2024.  In the meantime, pre-trial motion practice continues apace as in early February Schulman filed yet another motion to dismiss the indictment based on allegedly exculpatory evidence withheld by DOJ.

Cognizant’s Outside Counsel Not a Government Actor for Garrity Purposes; Trial for Coburn & Schwartz Delayed Over Foreign Witness’s Availability

When we last checked in on the upcoming trial of former Cognizant Technology Solutions President Gordon Coburn and Chief Legal Officer Steven Schwartz, in our 2022 Mid-Year FCPA Update, the Honorable Kevin McNulty of the U.S. District Court for the District of New Jersey compelled the company to turn over materials associated with various internal investigation interviews, finding a waiver of privilege from the company disclosing aspects of those interviews to DOJ.  On July 20, 2023, Judge McNulty issued another important opinion on an oft-recurring issue in corporate internal investigations, this time denying a “Garrity” motion to suppress the defendants’ statements to corporate counsel based on a finding that counsel was not acting at DOJ’s behest.

In Garrity v. New Jersey, the U.S. Supreme Court held that prosecutors cannot use a compelled interview statement taken by a government employer in a subsequent criminal prosecution.  As we covered in our 2019 Year-End FCPA Update in connection with the momentous Connolly decision out of the U.S. District Court for the Southern District of New York, Garrity has in limited circumstances been extended to private employers “where the actions of [the] private employer in obtaining [the] statements are ‘fairly attributable to the government.’”

In this case, Judge McNulty agreed with defendants that the interviews conducted by outside counsel as part of the internal investigation were “compelled” due to the company’s policy requiring employees to cooperate in internal investigations or face disciplinary action and the fact that the defendants were specifically directed to attend the interviews in question.  But still the Court denied the defendants’ Garrity motion because of insufficient evidence that the company’s internal investigation, and interviews, were directed by DOJ.  Even though Judge McNulty observed that Cognizant was motivated by DOJ’s then-operative “FCPA Pilot Program,” pursuant to which the company did receive a “declination with disgorgement” as reported in our 2019 Year-End FCPA Update, he held that “[g]overnment policies alone do not entail that a company’s action in furtherance of such policies amounts to state action.”

Based on similar reasoning, the Court also denied defendants’ motion to require Cognizant to search its files for potential exculpatory evidence under Brady v. Maryland.  Because Judge McNulty found that “Cognizant did not act on behalf of or under the control of the Government,” he concluded that the company’s files were not in the “constructive possession” of DOJ.

The trial for Coburn and Schwartz was set to commence on October 2, 2023, but the week before DOJ notified the Court that an “essential witness” for the government, located in India, had been ordered to turn his passport over to Indian authorities in connection with their own investigation of the same conduct.  The issue was resolved, but not in time to hold the trial date, which now has been reset to May 6, 2024.  In the midst of the delay, presiding Judge McNulty announced his retirement, and the case has now been transferred for trial to the Honorable Michael E. Farbiarz.

Cherrez Miño Still a Fugitive; But $72 Million Sought in Civil Forfeiture

In our 2021 Year-End FCPA Update, we covered charges against three defendants for an alleged bribery scheme involving the Instituto de Seguridad Social de la Policia Nacional (“ISSPOL”), Ecuador’s public police pension fund, whereby investment advisor Jorge Cherrez Miño paid more than $2.6 million in bribes to ISSPOL officials, including John Luzuriaga Aguinaga, in exchange for the right to manage ISSPOL funds.  Luzuriaga pleaded guilty to money laundering charges, was originally sentenced to 58 months, but was then released early after serving only 40 months in November 2023 based on DOJ’s Rule 35 motion in light of his post-conviction cooperation.  (The other cooperating co-defendant, Luis Alvarez Villamar, has been sentenced to six months for his role in the money laundering scheme.)  But Cherrez Miño remains a fugitive outside of the United States.

One disadvantage of fugitive status is that it can prevent one’s ability to defend against the civil forfeiture of assets while a fugitive.  On September 29, 2023, DOJ filed an in rem forfeiture complaint in the U.S. District Court for the Southern District of Florida against $72 million in accounts held by or for the benefit of Cherrez Miño.  ISSPOL has since filed a statement of interest and a scheduling conference is scheduled for February 20, 2024.

Fifth Circuit Affirms Sealing of Ahsani Sentencing Documents

We covered the guilty pleas of Unaoil CEO and COO Cyrus and Saman Ahsani, as well as related cases associated with the sprawling corruption scheme that spanned over 15 years, dozens of companies, and close to 10 countries, in our 2019 Year-End FCPA Update.  Although the Ahsani brothers’ sentencing hearings were repeatedly delayed after their guilty pleas to account for their continued cooperation with the government, Saman’s hearing ultimately took place on January 30, 2023.  The Honorable Andrew Hanen of the U.S. District Court for the Southern District of Texas handed Saman a comparably favorable sentence of 12 months and one day, one year of supervised release, and $1.5 million in forfeiture.

The significance of the case, coupled with extensive sealing of proceedings before the district court, garnered the interest of media organizations The Financial Times, Global Investigations Review, and The Guardian, who, represented by The Reporters’ Committee for Freedom of the Press, jointly moved to intervene and unseal.  The court granted the press outlets intervenor status and unsealed much of record leading up to the sentencing.  But the sentencing memoranda and a portion of the sentencing hearing itself (taking place in chambers the morning of the public hearing) were not only sealed, but docketed only as “Sealed Events” such that the intervenors were unable effectively to challenge the court’s closure of proceedings.  Still, intervenors were able to garner enough information to challenge the sealings, which the district court denied on February 23, 2023.

On appeal, the Honorable Jerry E. Smith wrote for a unanimous panel of the U.S. Court of Appeals for the Fifth Circuit on August 4, 2023.  The Court was critical of the district court’s failure to create a record capable of scrutiny through more transparent docketing of the full sentencing proceedings, but ultimately affirmed the merits of the ruling to seal.  Specifically, Judge Smith agreed that the need to protect the defendants, their families, and the integrity of ongoing investigative activities by the government justified the sealing, even with the passage of time and fact that the defendants’ general cooperation was a matter of public knowledge.

Saman Ahsani’s case is now complete, but brother Cyrus’s sentencing is set for November 2024.

Aguilar Gets FCPA Count Severed; Now Faces Indictments in Two Districts

As we last covered in the 2022 Year-End FCPA Update, former Vitol Group oil trader Javier Alejandro Aguilar Morales was the subject of a superseding indictment in December 2022, which supplemented 2020 charges relating to alleged bribery in Ecuador with new charges that he allegedly bribed officials of Mexican state-owned oil company PEMEX.  (These charges are related to those against Christian Julian Cazarin Meza discussed above.)  On March 3 and April 27, 2023, Aguilar twice moved to sever and dismiss the PEMEX-related charges, arguing that venue for these charges did not lie in the Eastern District of New York, where the original and superseding indictments were returned.

On May 31, 2023, the Honorable Eric N. Vitaliano of the U.S. District Court for the Eastern District of New York dismissed the two FCPA counts (substantive and conspiracy) associated with the PEMEX scheme for lack of venue in that district, but without prejudice such that DOJ was authorized to refile the same charges in an appropriate district.  With respect to the money laundering conspiracy count, however, Judge Vitaliano declined to “splice” the conduct and observed that the indictment was sufficient on its face to allege a single scheme to launder funds associated with bribery in Ecuador and Mexico.  The Court thus denied Aguilar’s motion as to the money laundering conspiracy count without prejudice to refile at trial.

On August 3, 2023, a grand jury sitting in the Southern District of Texas returned a five-count indictment relating to the PEMEX corruption scheme, including FCPA bribery, conspiracy, money laundering and Travel Act counts.  In response to the Texas indictment, Aguilar again moved to dismiss the PEMEX-related aspects of the money laundering conspiracy count in the New York case as duplicitous.  On September 19, 2023, Judge Vitaliano denied the motion to dismiss, finding again that there was evidence to demonstrate that the money laundering conspiracy charge consisted of a single overarching conspiracy across both countries.

As we write, Aguilar is currently undergoing a lengthy trial in the Eastern District of New York, which began on January 3, 2024.  Trial in the Southern District of Texas is currently scheduled to begin on April 15, 2024.  We expect there will much to report on regarding this significant trial (or these trials) in our next update.

2023 FCPA-RELATED LEGISLATIVE DEVELOPMENTS

It has been years, if not decades, since there has been a consequential legislative development pertinent to the FCPA.  But that changed on December 22, 2023, when as part of the annual omnibus National Defense Authorization Act President Biden signed into law the Foreign Extortion Prevention Act (“FEPA”).

FEPA amends the federal domestic bribery statute (18 U.S.C. § 201) to prohibit “any foreign official or person selected to be a foreign official to corruptly demand, seek, receive, accept, or agree to accept, directly or indirectly, anything of value” from a “person” as defined under the FCPA, using the instrumentalities of interstate commerce, in exchange for “being influenced in the performance of any official act,” “being induced to do or omit to do any act in violation” of their duties, or “conferring any improper advantage” “in connection with obtaining or retaining business.”  Foreign officials who violate this provision face criminal penalties of up to 15 years in prison and fines of up to $250,000 and/or three times the monetary equivalent of the thing of value.

Now at first blush this may seem like a significant event, in that it criminalizes the “demand side” of bribery, which as interpreted by the courts the FCPA does not.  Indeed, Transparency International U.S. issued a statement upon the passage of FEPA, calling this “the most important foreign bribery law in half a century.”  But our readers will immediately recognize that years ago DOJ implemented a practice of charging government official bribe recipients in FCPA investigations under the existing money laundering laws, which criminalize engaging in monetary transactions through the U.S. financial system with the proceeds of various “specified unlawful activities,” which include violations of the FCPA and bribery under the laws of foreign countries.  We have been covering this development for years, and indeed you cannot have gotten to this point of our update without reading about several examples of such charges in 2023 alone.

The practical enforcement significance of FEPA remains to be seen.  Although the existing money laundering statutes are likely to cover many FEPA fact patterns, there are aspects of FEPA that are broader.  Most notably, FEPA covers solicitations and demands for bribes by foreign officials and expressly applies extraterritorially, meaning that even a refused bribe could be prosecuted, which is not true under the money laundering statute.  The same is true of bribes that are accepted abroad and not then laundered back through the U.S. financial system.  But keep in mind that there is a requirement that DOJ show use of the facilities of interstate commerce, which may be a limiting factor in wholly foreign conduct.  There are also diplomatic and political sensitivities involved with prosecuting a foreign government officials, and those sensitivities are likely to be enhanced the further DOJ stretches FEPA to its limits.

Because U.S. criminal laws apply only prospectively, and foreign corruption matters typically take years to investigate, it is likely to be some time before we get a sense of the practical import of FEPA.  But in the meantime, an interesting aspects of the statute is that it requires DOJ to file annual reports each December “focusing [] on demands by foreign officials for bribes from entities domiciled [] in the United States, “the efforts of foreign governments to prosecute such cases,” and U.S. “diplomatic efforts to protect [U.S. entities] from foreign bribery.”  We will follow these reports and other FEPA developments carefully and report back in the years to come.

2023 FCPA-RELATED POLICY DEVELOPMENTS

The issuance of DOJ’s updated Corporate Enforcement Policy on January 17, 2023 was undoubtedly the most consequential FCPA-related policy development of the year.  Because of its significance, we covered this already as a “bonus” feature of our 2022 Year-End FCPA Update and refer our readers there for our analysis.  But DOJ did not stop its important FCPA-related policy updates in January.

On March 3, 2023, DOJ issued a series of updates to its Evaluation of Corporate Compliance Programs and monitor selection guidance, as well as an entirely new policy encouraging companies to embed compliance principles in their employee compensation and clawback programs.  We discuss this trio of updates below, but also refer our readers to our separate client alert on the subject, “DOJ Updates Its Guidance on Corporate Compliance Programs.”  Also discussed below is an important speech setting forth DOJ policy on FCPA successor liability in voluntary disclosure cases.

Updated DOJ Memo re Evaluation of Corporate Compliance Programs

As discussed in our 2017 Mid-Year FCPA Update, in February 2017 DOJ published the initial version of a guidance document, “Evaluation of Corporate Compliance Programs,” setting forth a helpful insider’s view of how DOJ evaluates corporate compliance programs.  This guidance has been updated periodically over the years, most recently in March 2023.  The most significant changes in this year’s revision to DOJ’s guidance concern two points, both echoing the September 15, 2022 “Monaco Memorandum”:  (1) establishing compliance incentives within corporate compensation policies; and (2) corporate regulation of ephemeral messaging applications.

Regarding the first point, the updated evaluation guidance instructs prosecutors to consider in corporate charging decisions whether a company has positively incentivized compliance by designing compensation systems that defer or escrow discretionary compensation and tie it to compliance standards, as well as the company’s efforts to recoup compensation previously awarded to individuals who are responsible for corporate wrongdoing.  The guidance also encourages companies to establish career advancement opportunities for employees engaged in compliance roles.

Regarding the second point, the updated evaluation guidance instructs prosecutors to consider in corporate charging decisions how a company regulates (and then, importantly, enforces) limitations on the use of third-party messaging platforms for company-related communications.  As our readers know well, the use of third-party communications platforms—from WhatsApp to WeChat to many more—is ingrained in modern communication norms, especially in certain geographic regions and generational demographics.  The updated guidance does not call for an outright ban on such communications, but does encourage companies to create and then enforce policies governing their use.  The greatest challenge our clients typically face, and to the disappointment of many not addressed in this guidance, is the application of myriad privacy laws that vary from jurisdiction to jurisdiction and can render it very difficult to enforce compliance in the “Bring Your Own Device” culture that dominates multinational companies.

Revised DOJ Monitor Selection Process

As discussed in our 2018 Year-End FCPA Update, on October 12, 2018, then-Criminal Division Assistant Attorney General Brian A. Benczkowski issued a memorandum including guidance on the selection of monitors in Criminal Division matters.  This memorandum, in the tradition of DOJ guidance documents, became known as the “Benczkowski Memorandum,” and was itself an update on the so-called “Morford Memorandum” from a different Assistant Attorney General 10 years prior.  The latest iteration, announced in March 2023, is entitled “Revised Memorandum on Selection of Monitors in Criminal Division Matters.”  As with the corporate compliance program evaluation guidance above, much of this update was foretold in the 2022 Monaco Memorandum.

The updated monitor guidance makes clear that there is no presumption for or against the imposition of a compliance monitor in corporate criminal resolutions.  Instead, the memorandum directs prosecutors to consider 10 non-exhaustive factors, which may be summarized by noting that a monitorship is more likely to be recommended where the company’s compliance program and controls are deemed to be “untested, ineffective, inadequately resourced, or not fully implemented at the time of a resolution.”  The monitor memorandum further provides:  (1) the qualifications and conflict requirements for the named monitor also apply to others on the monitorship team; (2) monitor selections will be made with an eye toward diversity, equity, and inclusion; and (3) the cooling-off period for monitors is increased from two to three years from the date of the monitorship’s termination.

Pilot Program Regarding Compensation Incentives & Clawbacks

The third March 2023 DOJ compliance program update is the most novel of the trio.  Although the substantive guidance in this document substantially overlaps with the compliance program evaluation guidance in encouraging companies to consider compliance factors in incentive compensation structures, this memorandum establishes a clawback pilot program for the next three years in Criminal Division matters.  Specifically, the program allows companies facing a criminal resolution to reduce their fines dollar-for-dollar by “clawing back” past compensation paid to employees who engaged in the underlying misconduct, as well as the supervisors who failed adequately to supervise them.  Further, in a seeming nod to the labor law difficulties that may arise in the pursuit of clawbacks—especially outside of the United States—the policy allows for up to a 25% credit for amounts sought by the company in good faith but not successfully collected.

The pilot program also makes clear that the Criminal Division will require all companies resolving cases to “implement compliance-related compensation criteria in their [employee] compensation and bonus system.”  True to form, we saw the first instance of this new language embedded in Attachment C (Corporate Compliance Program) to the Grupo Aval subsidiary DPA described above, with a revised section and two new paragraphs describing DOJ’s “Compensation Structures and Consequence Management” requirements of creating incentives for compliant behavior and then disciplinary procedures for non-compliance.  The new language is enhanced especially on the incentives point, but not entirely new in kind from what was in the “Enforcement and Discipline” section previously.  The same requirements then appeared in the resolution documents for the Albemarle, H.W. Wood, Tysers, and Freepoint Commodities matters described above, reflecting that these new requirements are now standard practice in corporate FCPA resolutions.

As covered above, the Albemarle resolution included the first example of a company receiving “clawback credit” under the pilot program.  Albemarle received a credit of $763,453 on the resolution amount for withholding bonuses during the course of its internal investigation from employees it deemed culpable (either directly or through supervision) based on its investigation.  One can certainly imagine circumstances involving substantial recoveries from senior and highly compensated executives who have clawback language built into their employment agreements, as was recently required of Section 16 officers of U.S. issuers pursuant to a new SEC rule covered in our client alerts “SEC Releases Final Clawback Rules“ and “NYSE and Nasdaq Allow More Time for Companies to Adopt Rule 10D-1 Clawback Policies:  What to Do Now.”  But for the run-of-the-mill FCPA matter, in our experience, the misconduct (and even the supervision of the misconduct) is concentrated at lower levels of the organization involving more modestly-compensated individuals whose employment contracts are held by entities subject to protective labor law regimes.  Under such circumstances, “the juice may not be worth the squeeze.”  The Albemarle resolution crediting a fraction of one percent of the settlement amount underscores this point.  In any event, we will continue to monitor this program and report on developments.

“Safe Harbor Policy” for Voluntary Disclosures in Mergers & Acquisitions

When Deputy Attorney General Lisa O. Monaco spoke at the annual Compliance & Ethics Institute for the Society of Corporate Compliance and Ethics on October 4, 2023, her prepared remarks announced a new “Safe Harbor Policy for Voluntary Self-Disclosures Made in Connection with Mergers and Acquisitions.”  Stating that the “last thing the Department wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs,” Monaco announced the new policy to incentivize acquiring companies to disclose misconduct uncovered during the process of mergers and acquisitions.  In essence, Monaco stated that DOJ was seeking to codify as a broader policy the concepts set forth in the momentous FCPA Opinion Release 2008-02, covered in our 2008 Mid-Year FCPA Update.

Under the new “Safe Harbor Policy,” acquiring companies will have six months from the date of closing to report misconduct and still qualify for voluntary disclosure credit, which applies even to the acquired company, even if the conduct had been discovered pre-acquisition provided it was not public or otherwise known to DOJ.  The acquiror will then “have a baseline of one year from the date of closing to fully remediate” misconduct at the acquired company—though that timeline may be extended in the discretion of DOJ under the particular facts and circumstances of the transaction.  Finally, DOJ has made clear that the recidivism analysis will apply differently in the context of acquisitions, such that the misconduct of the acquired company will not be attributed to the acquiring company for future recidivism purposes.

There is, predictably, certain caveat language in the “Safe Harbor Policy.”  The transaction must, for example, be a “bona fide, arms-length M&A transaction[],” and DOJ emphasizes that to gain the benefit of the Policy, “Compliance must have a prominent seat that the deal table” and “perform effective due diligence.”  We will closely follow the implementation of this Policy in the years ahead, but the message for now is to underscore the critical importance of pre-acquisition anti-corruption due diligence and post-acquisition anti-corruption compliance integration.

2023 FCPA OPINION PROCEDURE RELEASES

By statute, DOJ is obligated to provide a written opinion on the request of an “issuer” or “domestic concern” concerning whether DOJ would prosecute the requestor under the FCPA’s anti-bribery provisions for prospective (not hypothetical) conduct that it is considering taking.  DOJ publishes these opinions on its FCPA website, which helpfully organizes the releases into 18 subject matter areas, from “Audit Rights” to the “Written Laws Affirmative Defense.”

Although only parties who join in the requests may authoritatively rely upon them, these releases provide valuable insights into how DOJ interprets the statute.  And although the SEC does not itself issue these releases, it has opted as a matter of policy not to prosecute issuers that obtain clean opinions from DOJ.

Usage of the opinion procedure release process waned notably in the 2010s, not coincidentally following publication of the comprehensive joint DOJ / SEC FCPA Resource Guide covered in our 2012 Year-End FCPA Update.  But recently we have started to see a modest trickle again, and 2023 saw the first two-opinion year in a decade, the 64th and 65th in the history of the statute.

FCPA Opinion Procedure Release Regarding Adoption Services (23-01)

On August 14, 2023, DOJ issued FCPA Opinion Procedure Release 23-01.  Here the requestor was a U.S.-based adoption service provider organizing travel for foreign officials from a country that required that its officials visit certain families that have adopted children from the country to ensure the success of the adoption.  The requestor represented, among other facts, that the officials would be chosen not by it but by the government agency, that the requestor had no non-routine business before the government agency, that travel and recreation costs would be limited and paid directly to the providers rather than paid by providing cash or stipends to the officials, and that the requestor would not host spouses or other family members of the officials.

Based on these representations, DOJ concluded that the proposed expenses “reflect no corrupt intent of the Requestor” and appear to be “reasonable and bona fide expenses” with a legitimate business purpose.  Although there are certain limiting circumstances underlying this opinion procedure release—namely, that the travel is required by the foreign country’s law and the requestor had no other business before the relevant government agency—DOJ’s analysis is nonetheless instructive for companies considering sponsoring travel for foreign officials under other circumstances.  Specifically, and consistent with prior opinion procedure releases, excluding spouses and family members, ensuring that costs that are reasonable and consistent with internal policies, and making payments directly to providers remain appropriate best practices.

FCPA Opinion Procedure Release Regarding Logistical Support for Foreign Government Officials (23-02)

On October 25, 2023, DOJ issued FCPA Opinion Procedure Release 23-02.  Here the requestor was a company in the business of providing training events and logistical support, which had been awarded a contract with a U.S. government agency to support training events that included foreign government officials.  Among other things, the requestor was required to provide stipend payments to the foreign officials for meals and transportation.  The requestor represented that they took various steps to mitigate potential anti-corruption risks, including:  making the stipend payments through a U.S. government official; calculating the stipends in accordance with U.S. Department of State guidelines in limited amounts of between $8 and $40 per day depending on the location; maintaining accounting records documenting the payments; and further represented that it was not made aware of the identities of the foreign officials at the time it bid for the contract.  The requestor also represented that the U.S. agency responsible for this project confirmed that the stipends were authorized by the Foreign Assistance Act of 1961.

In approving the payments, DOJ first reasoned that the facts and circumstances as represented by the requestor “reflect[ed] no corrupt intent” and indeed were authorized by U.S. law.  Secondly, DOJ explained that “the payments themselves do not appear to be for the purpose of assisting” the requestor obtaining and retaining business.  Although the specific facts of this release are rather bespoke, the release nonetheless offers useful guidance of mitigation measures companies can take to reduce anti-corruption risks associated with subsidizing foreign officials’ travel expenses.

2023 FCPA SPEAKER’S CORNER

Once again, U.S. government anti-corruption enforcement personnel were active on the speaking circuit in 2023, trumpeting their priorities and setting expectations for the companies that will appear before the agencies.  A selection of relevant speeches of note include the following.

DOJ Deputy Attorney General Lisa O. Monaco

At the same Society of Corporate Compliance and Ethics event at which she announced the “Mergers & Acquisitions Safe Harbor” policy described above, on October 4, 2023, Deputy Attorney General Monaco proclaimed that across its various recent policy and enforcement developments, DOJ is working to create an “enormous gulf between outcomes for companies that do the right thing – that step up and own up – and companies that do the opposite.”

DOJ Criminal Division, Acting Assistant Attorney General Nicole M. Argentieri

On November 29, 2023, during the same keynote address at the annual ACI Conference on the FCPA at which she made the comments on applying forfeiture against non-issuers as described above, Argentieri emphasized DOJ’s focus on bringing “high impact” cases.  Then turning to the updated Corporate Enforcement Policy, Argentieri made clear that companies start with zero credit and have to work their way up toward the maximum of 50%, and also encouraged companies not to forget that this credit is based on only on cooperation, but also remediation.  As to what sets companies apart within the range, Argentieri underscored that often it “is the speed of a company’s action.”  Finally, Argentieri promoted DOJ’s formation of the International Corporate Anti-Bribery Initiative (“ICAB”), pursuant to which the Department will assign three experienced prosecutors to focus on building new and improving existing bilateral and multilateral enforcement partnerships around the globe to develop new case referrals.

DOJ Criminal Division, Fraud Section Chief Glenn Leon

During a fireside chat at the Compliance Week National Conference on May 16, 2023, DOJ Fraud Section Chief Glenn Leon sent a sigh of relief throughout the audience by acknowledging that the recent Evaluation of Corporate Compliance Programs guidance does not require companies to outright ban the use of ephemeral messaging applications by employees.  Himself a former Chief Ethics & Compliance Officer of a major U.S. multinational, Leon acknowledged the complexity of the situation—including due to applicable data privacy regulations—and encouraged the audience members to work in good faith to design policies with care and the company’s specific risk profile in mind, and then apply them and adjust if needed.

2023 FCPA-RELATED PRIVATE CIVIL LITIGATION

As we have been reporting for years, although the FCPA does not provide for a private right of action, civil litigants employ various causes of action in connection with losses allegedly associated with FCPA-related conduct, often through shareholder litigation.  A selection of matters with material developments in 2023 follows.

Shareholder Lawsuits / Class Actions

  • Ericsson – On May 25, 2023, the Honorable William Kuntz of the U.S. District Court for the Eastern District of New York granted Ericsson’s motion to dismiss a putative shareholder class action suit filed against Ericsson and three top executives. The suit alleged that Ericsson’s public filings misrepresented growth in the company’s compliance program, as well as outstanding litigation risks, in view of the alleged misconduct in Iraq that led, in part, to the revocation of Ericsson’s 2019 DPA and guilty plea in March 2023 as described above.  But in dismissing the lawsuit, Judge Kuntz found that the company’s public statements were either immaterial as a matter of law or not false when they were made, and further that the company’s statements regarding DPA compliance included “ubiquitous warnings to investors regarding the possibility of future compliance failures and investigations.”  Plaintiffs have noted an appeal to the U.S. Court of Appeals for the Second Circuit.

Select Civil Fraud / RICO Actions

  • PDVSA v. Lukoil – On March 13, 2023, the U.S. Court of Appeals for the Eleventh Circuit affirmed the dismissal of a civil fraud lawsuit filed on behalf of PDVSA against Lukoil and other international oil companies and traders. PDVSA claimed that the defendants engaged in corrupt schemes with PDVSA employees to obtain insider information about PDVSA to the detriment of the Venezuelan state-owned oil company.  But the Honorable Darrin P. Gayles of the U.S. District Court for the Southern District of Florida dismissed the lawsuit under the political question doctrine.  Writing for the Eleventh Circuit, the Honorable William Pryor agreed, holding that the political question of who has the right to represent the Venezuelan government, in light of U.S. policy not to recognize the regime of President Nicolas Maduro, presents a nonjusticiable political question about which the federal courts may not inquire.  On October 30, 2023, the U.S. Supreme Court declined to take up PDVSA’s petition for certiorari.
  • Petrobras America v. Samsung Heavy IndustriesWe last checked in on a civil RICO and common law fraud lawsuit filed by Petrobras America against Samsung Heavy Industries in our 2021 Year-End FCPA Update, where the U.S. Court of Appeals for the Fifth Circuit revived the case after finding that Samsung Heavy Industries’ statute-of-limitations defense used to dismiss the case presented a question of fact. Back before the district court, the Petrobras affiliate continued to allege that Samsung Heavy Industries bribed Petrobras officials to secure a drilling services contract.  On August 11, 2023, the Honorable Lee H. Rosenthal of the U.S. District Court for the Southern District of Texas issued an opinion granting cross-motions for summary judgment filed by both sides, dismissing each party’s claims against the other.  Although the alleged corruption scheme resulted in a $200 million arbitral judgment against Samsung Heavy Industries and criminal convictions of the Petrobras employees who allegedly took the bribes, Judge Rosenthal ruled that Petrobras’s harm was too attenuated from the scheme to support a RICO claim under U.S. law.  The court also rejected Samsung Heavy Industries’ counterclaim, which argued that Petrobras America should pay a portion of the arbitration award.  Petrobras has once again appealed to the U.S. Court of Appeals for the Fifth Circuit.

2023 INTERNATIONAL ANTI-CORRUPTION DEVELOPMENTS

World Bank

As we frequently report in these updates, multilateral development banks (“MDBs”), most notably the World Bank, continue to be quite active in global anti-corruption enforcement as part of their wider mandate to investigate and take appropriate action vis-à-vis “sanctionable practices,” including investigating alleged improprieties associated with the procurement processes of Bank-funded projects and implementing debarments through internal proceedings.  Notably, the umbrella of sanctionable practices enforced by MDBs extends beyond corrupt or fraudulent practices to “coercive,” “collusive,” and “obstructive” practices, as those terms are defined in Bank Private Sector Anti-Corruption Guidelines.

Under the banner of this mandate, MDBs have increasingly scrutinized corporate compliance programs, as evidenced by the March 2023 release of “MDB General Principles for Business Integrity Programmes.”  Much like the DOJ and SEC FCPA Resource Guide, DOJ’s “Evaluation of Corporate Compliance Programs” memorandum, and other guidance on agency expectations for compliance programs, this joint guidance from several participating MDBs reflects the current MDB expectations for entities seeking to work on MDB-funded contracts.  Many of the controls principles covered in this guidance will be familiar to experienced practitioners, including regular risk assessments; the role of senior management in instilling a culture of compliance; robust due diligence regarding employees, business partners, and government interactions; close monitoring of gifts, hospitality and travel expenses, and charitable or political contributions; the maintenance of accurate books and records; and the establishment of sound reporting, investigation, remediation, and training procedures.

On the enforcement side, in 2023 the World Bank announced seven debarments resulting from agreements to settle allegations of “corrupt practices” in violation of the Bank’s Procurement Guidelines.  These cases illustrate a range of anti-corruption priorities, which range from addressing run-of-the-mill procurement fraud and bribery to incentivizing investigation cooperation and compliance with more complex disclosure requirements:

  • Bidding Process Fraud:  In March 2023, the World Bank announced a 24-month debarment of Kenyan engineering and construction company Burhani Engineers Ltd.  According to the settlement, the company made misrepresentations about its experience during the selection process for contracts related to a project in Uganda.  Similarly, in October 2023, the Bank debarred Vietnamese construction firm HTC Construction and Advanced Technology Joint Stock Company for 41 months for allegedly inflating the value of its past awards and misrepresenting its finances during the bidding process for multiple sustainable development and sanitation contracts in Vietnam.  Lastly, in December 2023, the World Bank debarred Botswana-based civil engineering company Multi-Tech Consult (PTY) Ltd. and its Managing Director Peter Lambileki for 42 months for allegedly misrepresenting the company’s prior experience in three bids for Bank projects.
  • Invoicing Fraud:  In March 2023, the World Bank announced a 15-month debarment of PCS Limited, a power and communication company based in Vanuatu, for alleged fraudulent practices in connection with a project in the South Pacific nation.  The Bank alleged that PCS claimed reimbursement for non-reimbursed items and “knowingly misled” the Project Implementation Unit to obtain a financial benefit.  A subsequent 22-month debarment in November 2023 of Bangladeshi engineering consulting company BETS Consulting Services Limited also involved invoicing a Bank project for expenses not incurred, but with a more direct corruption allegation as the Bank alleged BETS directed its lead consultant to bribe officials in return for their influence on contract decisions.
  • Disclosure Requirements:  In April 2023, the World Bank announced a 24-month debarment of Turkish national Selçuk Yorgancioğlu in connection with alleged fraudulent practices in an International Finance Corporation investment project in Turkey.  The Bank alleged that Yorgancioğlu failed to sufficiently disclose the financial condition of one of the investee companies involved in the project.  Six months later, in October 2023, the World Bank debarred Honduran engineering consulting firm Consultores en Ingeniería S.A. de C.V. for 18 months due to failure to disclose an actual conflict of interest.
  • Cooperation Requirements:  The World Bank emphasized in announcing the HTC debarment described above the company’s lack of cooperation with Bank investigators and its consistent refusal to submit to examinations by the Bank in accordance with its contractual inspection and audit rights.

The World Bank also publishes uncontested sanctions determinations entered by the Chief Suspension and Debarment Officer.  Uncontested determinations take place when the party against whom allegations are made does not engage with the World Bank sanctions process to resolve or contest the Bank’s allegations.  The following examples of uncontested sanctions determinations involve similar characteristics to debarments entered by the Bank, but resulted in more significant periods of debarment:

  • In April 2023, the World Bank entered a debarment of nearly nine years (six years from an earlier debarment imposed in 2021 plus an addition of nearly three years) against Getinsa Ingeniería Vietnam Co. Ltd., a Vietnamese company.  The Bank also entered into a nearly three-year debarment of Tran Thi Hoan, a Vietnamese national.  The Bank alleged that Getinsa Vietnam and Hoan engaged in “collusive or corrupt practices” in relation to a development project in Vietnam by coordinating with two other companies to manipulate the preparation of technical specifications for contracts and by negotiating a commission from one of the other companies in exchange for helping it win contracts.  The Bank also found the company liable for obstructive practices during the Bank’s subsequent efforts to audit the company’s records.
  • In October 2023, the World Bank entered a 43-month debarment of M/S Gul Construction Co., a Pakistani construction company.  The Bank alleged that the company bribed project officials and misrepresented a commitment not to pay commissions, its experience, and its financials by submitting falsified documents.

The contrast in consequences between companies that engage with the World Bank to enter into negotiated resolutions, on the one hand, and uncontested sanctions determinations, on the other, illustrate that companies electing to cooperate with the World Bank Integrity Vice Presidency and enter into settlement agreements—which typically include provisions regarding future cooperation and voluntary remedial actions, such as implementing compliance program enhancements—are more likely to receive reduced debarment periods and other benefits relative to those companies that decline to engage with the Bank’s sanctions process.

As we noted most recently in our 2022 Year-End FCPA Update, the consequences of sanctions imposed by the World Bank (or another MDB) can often be compounded by a cross-debarment—a tool of inter-MDB cooperation that allows one MDB to recognize and enforce sanctions imposed by another MDB.  Indeed, several of the longest World Bank debarment penalties assessed in 2023 were the result of another MDB’s sanctions proceedings.  Yet, the Bank recognized 32% fewer cross-debarments in FY 2023 (49 cross-debarments) than FY 2022 (72 cross-debarments).  Similarly, the number of World Bank debarments eligible for recognition by other MDBs declined 43% between FY 2022 (30 cross-debarments) and FY 2023 (17 cross-debarments).

United Kingdom

SFO Charges Three in Sierra Leone Mining Bribery Scheme

On June 16, 2023, the UK Serious Fraud Office (“SFO”) announced the filing of UK Bribery Act (“UKBA”) charges against Graeme Hossie and Rachel Rhodes, respectively the former CEO and CFO of collapsed mining company London Mining Plc, as well as Ariel Armon, a third-party agent utilized by the company.  The charges relate to two alleged schemes to bribe public officials in Sierra Leone, the first of which involved bribes allegedly paid to public officials in Sierra Leone between 2009 and 2012 to help secure a license for London Mining to operate an iron ore mine. The SFO also alleges Hossie and Rhodes retained Armon as their third-party “fixer” in connection with a second bribery scheme between 2010 and 2014 to obtain an additional environmental license for the mine, more land for the project, and access to local roads.

On October 6, 2023, all three individuals pleaded not guilty to the charges.  The next hearing in the case is scheduled for June 30, 2024, and the trial is scheduled for January 2025.

Charges Announced Regarding Gemstone Bribery Solicitation in Madagascar

On August 14, 2023, the UK National Crime Agency (“NCA”) announced the filing of UKBA  charges against Romy Andrianarisoa and Philippe Tabuteau, respectively the Chief of Staff to the President of Madagascar and her associate.  The NCA, in cooperation with the UK Crown Prosecution Service (“CPS”), alleges that the two attempted to secure a bribe from a UK-based gemstone mining and marketing company, in exchange for mining licenses to operate in Madagascar.  The NCA acknowledged the unnamed company’s prompt reporting of the bribe solicitation and cooperation with the ongoing investigation.

In a hearing in September 2023, Andrianarisoa pleaded not guilty to the charges, and Tabuteau did not enter a plea, but later pleaded guilty.  Andrianarisoa’s trial began in February 2024 and is underway as of this publication.

NCA Charges Three in Nigerian Oil Bribery Scheme

On August 22, 2023, the NCA announced UKBA charges against Diezani Alison-Madueke, Nigeria’s former Minister for Petroleum Resources and former president of the Organization of the Petroleum Exporting Countries.  Then, on October 2, 2023, charges were added against her brother Doyé Agama and Nigerian oil executive Olatimbo Ayinde.  The charges arise out of an alleged scheme in which Alison-Madueke purportedly steered oil and gas contracts valued in the billions of dollars in exchange for benefits that ranged from the use of a number of properties in London, £100,000 in cash, private jet flights, jewellery, and designer goods.  Agama allegedly accepted bribes to influence his sister’s conduct in her former role, and Ayinde allegedly bribed Alison-Madueke with luxury goods in an attempt to secure job opportunities for her husband.

All defendants have pleaded not guilty and trial has been adjourned to November 2025.

Indonesia to Challenge UK Settlement with Airbus

On September 25, 2023, the Republic of Indonesia announced that its planning to sue the UK to annul the UKBA settlement the SFO reached with Airbus SE in 2020.  As reported in our 2020 Mid-Year FCPA Update, Airbus reached a multi-billion-dollar coordinated resolution with authorities in France, the United Kingdom, and the United States regarding alleged improper payments to government officials in more than a dozen countries, including Indonesia, as well as export controls-related charges in the United States.  The allegations included kickbacks purportedly paid to executives at Indonesia’s state-owned airline, Garuda, to secure contracts.

In an interview, Indonesia’s Minister of Law and Human Rights said his country seeks to force a renegotiation to give Indonesia a share of the €991 million (~ $1.1 billion) portion of the global settlement paid to the SFO in recognition of Indonesia’s provision of “crucial evidence” to support the investigation.  However, as of this writing, it does not appear a formal claim has yet been filed.

Entain plc Reaches Deferred Prosecution Agreement for Failure to Prevent Bribery

On December 5, 2023, the CPS reached a £615 million (~ $787 million) resolution with sports betting and gambling company Entain to resolve an investigation by HM Revenue and Customs into failure to prevent bribery at a former Turkish subsidiary of the company between 2011 and 2017 in violation of UKBA Section 7.  Entain will pay a financial penalty of £465 million, £120 million in disgorgement of profits, and a further £10 million towards investigation costs.  The company will also make a £20 million donation to various charities.

Entain received a 50% discount in the penalty due to its significant cooperation and remediation, but still the deferred prosecution agreement is the second-largest corporate criminal settlement ever reached in the UK, second only to the 2020 Airbus agreement mentioned above.  It is also the first deferred prosecution agreement ever reached with the CPS.  In presiding over the settlement, the judge noted that a DPA was warranted in light of Entain’s significant and ongoing cooperation with the SFO investigation and the fact that Entain had welcomed a “wholesale change of senior management and approach” along with acknowledgement by the company of the need to “overhaul its culture and practices.”  The judge also cited the potential loss of thousands of jobs, as well as losses to shareholders, as a reason the deferred prosecution agreement was in the interests of justice.

Notable Forfeiture Actions

In addition to the above prosecutions, the SFO also seized several properties and other valuable assets in corruption-related proceedings in 2023, including:

  • On March 17, 2023, Westminster Magistrates’ Court approved the SFO’s seizure of almost $7.7 million from a UK bank account belonging to Mario Ildeu de Miranda, a former Petrobras employee, based on a finding that the funds were likely the proceeds of crime. Miranda was previously convicted in Brazil on 37 counts of money laundering for using a fake consultancy business to launder bribes to Petrobras officials on behalf of companies seeking to secure lucrative oil contracts with Petrobras, including Brazilian conglomerate Odebrecht.  On April 13, 2023, Miranda filed an appeal at Southwark Crown Court against the judgment.
  • On July 14, 2023, the High Court approved the SFO’s seizure of a property worth approximately £200,000 (~ $260,000), plus associated rental profits, allegedly linked to Guang Jiang, an agent whom the SFO contends facilitated the corrupt acts of Sarclad Ltd. leading to the company’s deferred prosecution agreement reported in our 2019 Year-End FCPA Update. Jiang reportedly fled to China in 2014 in alleged breach of his release conditions after being charged by UK prosecutors, but the SFO continues to pursue his assets in his absence.
  • On August 8, 2023, the High Court issued a preliminary order that paves the way for the SFO to seize multiple properties valued at approximately £34 million (~ $43 million) that belonged to Gulnara Karimova, the embattled daughter of the former president of Uzbekistan who herself is serving a prison sentence in Uzbekistan and has been indicted separately by U.S. prosecutors as reported in our 2020 Mid-Year and 2019 Year-End FCPA updates. The Court’s order focused on the fact that the British Virgin Islands companies that held title to the properties had been dissolved, which under UK law vests property with the Crown, but the underlying context of the proceedings arises from long-running efforts to identify and seize the proceeds of Karimova’s alleged corrupt dealings.

Economic Crime and Corporate Transparency Act

Although not solely relevant to anti-corruption enforcement, we note that on October 26, 2023, the Economic Crime and Corporate Transparency Act (“ECCTA”) received Royal Assent and passed into law.  Among several notable provisions is the creation of a new offense called “failure to prevent fraud” under Section 199 of the statute, which will allow large organizations to be held criminally liable if a member of staff commits fraud from which they intend the organization to benefit, following a structure akin to Section 7 of the UK Bribery Act’s “failure to prevent bribery” offense.  At present, this provision applies to eight types of fraud, including false representations, false accounting, false statements by company directors, and tax fraud, or aiding, abetting, counseling or procuring the commission of covered offenses.

The new offense will apply to large organizations satisfying two of three of the following criteria:  (1) annual turnover of more than £36 million; (2) total assets of more than £18 million; or (3) an average of more than 250 employees.  The statute, like the UKBA, allows covered organization to defend against charges with a showing that they had “reasonable procedures” in place at the time of the fraud to prevent fraud, or that it was not reasonable in the circumstances to expect such procedures to be in place.  On the other hand, amendments to the “identification doctrine,” a common law test for attributing actions of a natural person to an organization, seek to reduce the ability of large corporations to rely on the “directing mind and will” doctrine, under which corporations can only be held liable for the actions of an individual who was the “directing mind and will” of the corporation, and allow a company to be held culpable if one of its “senior managers” commits the offense while acting within the actual or apparent scope of their authority.  A “senior manager” is defined as an individual who plays a significant role in either (1) the making of decisions about how the whole or a substantial part of a covered organization’s activities will be managed or organized; or (2) the actual managing or organizing of all or a substantial part of the covered organization’s activities.

The amendments to the “identification doctrine,” which came into force on December 26, 2023, applies to all organisations, regardless of size, and could result in a significant increase in corporate prosecutions in the UK.  Initially, this amendment will only apply to selected “relevant offenses,” which includes offenses under Section 1 of the UKBA (bribing another person).  The ECCTA also extends the SFO’s power to compel the production of information before the launch of a formal investigation, previously limited to investigations involving potential bribery, to the types of fraud covered by the new Section 199.

Europe

European Union

On May 3, 2023, the European Commission released a proposal for a new directive on combating corruption at the European Union level, which endeavors to harmonize corruption offenses, sanctions, related prevention, and enforcement across EU member states.  The proposal includes so-called “minimum rules”—in other words, rules that, if adopted by the European Parliament and Council, member states would be required to implement into national law within 18 months, though member states may choose to adopt stricter anti-corruption rules than those set forth in the proposed directive.  Areas of harmonization covered by this proposed framework include the definitions of and penalties for active and passive bribery in both the public and private sectors, the circumstances pursuant to which an organization may be held liable for the acts of its officers, and mitigating circumstances that prosecutors would be required to consider, such as the company’s internal controls framework and cooperation.  For more detailed analysis of this important proposal, please see our separate client alert, “EU Commission Proposes Harmonized Framework to Combat Corruption.”

In another update that is not specific to anti-corruption enforcement, but given its multi-lateral enforcement nature may certainly influence it in the future, we draw attention to an important judgment of the European Court of Justice rendered on September 14, 2023.  In the case of Volkswagen Group Italia SpA and Volkswagen AG, the Court held in a preliminary ruling that the fundamental right of ne bis in idem (roughly equivalent to the common law doctrine of double jeopardy) precludes the Italian Competition and Markets Authority from imposing a fine on Volkswagen AG for conduct relating to the diesel emissions scandal in view of a €1 billion fine previously imposed by the Public Prosecutor’s Office of Braunschweig in Germany.  The Court held that the fine, although classified as an administrative penalty under national law, constituted a criminal penalty for the purposes of ne bis in idem as it had a punitive purpose as well as a high degree of severity.  Furthermore, the Court set out that duplicative proceedings or penalties concerning the same facts are permissible only if:  (i) such duplication does not represent an excessive burden for the person concerned, (ii) there are clear and precise rules making it possible to predict which acts or omissions are liable to be subject to a duplication, and (iii) the multiple proceedings in question have been conducted in a sufficiently coordinated manner and within a proximate timeframe.  We expect that the third requirement in particular will encourage member-state authorities to coordinate enforcement proceedings even more closely going forward to avoid running afoul of this new precedent.

Austria

On September 1, 2023, the Corruption Criminal Law Amendment Act 2023 came into force in Austria.  The law was passed in response to the so-called “Ibiza affair,” which was triggered by a video that showed Austria’s then-Vice Chancellor Heinz-Christian Strache seeming to offer to influence future state contracts in exchange for financial support ahead of the 2017 parliamentary elections and ultimately led to Strache’s resignation.  The Act introduces the new criminal offense of “mandate buying,” which criminalizes the provision of remuneration to representatives of a political party in exchange for influencing the placement of a candidate on that party’s slate of candidates, and also expands the scope of criminal liability to persons who aspire to become public officials, as well as incumbents, provided the candidates actually become a public official.  Finally, the Act increases the maximum penalties for individuals to up to 15 years imprisonment and for companies to a fine of up to €5.4 million, and sentences of greater than six months’ imprisonment also result in the temporary loss of eligibility to hold national or European public office.

Belgium

As reported in our 2022 Year-End FCPA Update, former Vice President of the European Parliament Eva Kaili was arrested by Belgian authorities on December 9, 2022, and charged with corruption and money laundering offenses, as well as participation in a criminal organization, for allegedly accepting corrupt payments in exchange for favorable treatment of a “gulf country” before the European Parliament.  Further arrests in the expanding investigation have since included Kaili’s life partner Francesco Giorgi, former member of the European Parliament Pier Antonio Panzeri, and two other members of the European Parliament, Marc Tarabella and Andrea Cozzolino.  The charges center around allegations that the nation states of Qatar and Morocco corruptly sought to influence votes and other official proceedings before the European Parliament, a charge that representatives of both countries have denied.  Investigators have seized more than €1.5 million in cash across a series of raids.  All three current members of the European Parliament have had their committee positions stripped away, but as of this writing remain sitting members of the legislative body, though Kaili’s lawyer announced in February 2024 that she would not seek reelection.

In response to the so-called “Qatargate” scandal, on September 13, 2023 the European Parliament approved a series of reforms of the Parliament’s internal rules aimed at promoting greater integrity, transparency, and accountability among Members of the European Parliament.  Among other things, the new rules reinforce a prohibition on engaging in activities that would constitute lobbying, require members to declare if their input to legislative initiatives is based on suggestions received from external actors, and introduce harsher penalties for breaches of the code of conduct.

France

On March 14, 2023, the Parquet National Financier (“PNF”) and the French Anti-Corruption Agency (“AFA”) published a guide on best practices in conducting internal investigations into corruption allegations.  The guide, which finalizes a draft version circulated for public comment in March 2022, carries no legal force, but nonetheless is a useful reference source for those handling matters before the PNF.  It discusses the conditions, structure, and manner in which anti-corruption investigations should be initiated and conducted.  Specific recommendations include that companies should draft and adopt an internal investigation protocol as part of their policies and procedures, assemble investigation teams that are free from conflicts of interest and then hire separate counsel to handle the criminal defense (a recommendation that is contrary to local bar guidance and for which the guide provides no explanation), adhere to EU data protection legislation as interpreted by French data protection law, and draft a comprehensive investigation report after concluding the investigation.

On June 28, 2023, a French court approved a corruption settlement between the PNF and two subsidiaries of UK oil and gas company TechnipFMC plc.  The subsidiaries will collectively pay nearly €209 million (~ $229 million) pursuant to a judicial public interest agreement (“CJIP”) to resolve allegations that between 2008 and 2012 the companies paid bribes to government officials in Equatorial Guinea and Ghana.  The agreements also resolve certain legacy allegations concerning the former parent company in Angola.  TechnipFMC and its predecessor companies previously entered into separate resolutions with the DOJ and Brazilian authorities in June 2019 related to activities in Brazil and Iraq (discussed in our 2019 Year-End FCPA Update) and a 2010 resolution with U.S. authorities arising from its involvement in the corruption scheme in Bonny Island, Nigeria (discussed in our 2010 Mid-Year FCPA Update).

Furthermore, in a 2022 development only reported publicly in August 2023 (with thanks to our friends at Global Investigations Review), we have learned that in April 2022, PNF secured the conviction on money laundering, tax evasion, and misuse of corporate assets charges of François Polge de Combret, the French banker who allegedly served as the intermediary to the senior Guinean official used by Rio Tinto as reflected in its SEC settlement discussed above.  Polge de Combret reportedly received a suspended prison sentence and was ordered to pay €1 million in confiscation after pleading guilty.  The PNF reportedly could not charge him with bribing a public official because French law did not contain such an offense when the consulting fee was paid.

Germany

On May 12, 2023, Germany passed the Whistleblower Protection Act to implement the Whistleblower Directive 2019/1937 of the European Union.  Although the law was passed later than the stipulated deadline of December 17, 2021, Germany (like many other EU member states) went beyond the minimum scope set forth in the directive by extending protected whistleblowing to cover any conduct punishable under the German penal code, administrative offenses concerning employees, and any other actions which, though not illegal, undermine the purpose of the legal provisions.  The Act sets forth three different channels for reporting potential violations:  internal reporting within an organization, external reporting to an appropriate government agency, or public disclosure.  Although, as mandated by the directive, the German law does not stipulate a clear priority amongst the three reporting channels, the law explicitly encourages employees to make use of internal reporting channels first, and directs companies with 50 or more employees in Germany to establish internal reporting mechanisms for whistleblowers and assign functions to review and address reports.  Finally, the law prohibits retaliation against whistleblowers acting in good faith, allows for damage claims by those claiming they experienced retaliation for reports, and even establishes a rebuttable presumption that adverse actions taken after a report are retaliatory in nature.  For additional details regarding this law, please consult our separate client alert, “German Whistleblower Protection Act Brings New Obligations for Companies.”

The Netherlands

On February 16, 2023, the Dutch Public Prosecution Service (“OM”) asked a court to levy fines of €15,000 and €50,000 against two unidentified employees of Dutch medical company DRC International B.V. for allegedly attempting to bribe a former World Bank consultant in order to obtain information about government contracts.  Prosecutors further sought a fine of €225,000 against DRC.  In a decision published in March 2023, the judge ordered much-reduced fines of €750 for each of the two employees and €4,000 for DRC.  The court ruled that the OM failed to specify whether the consultant who received the bribe acted in a position of a civil servant or as a non-civil servant employee of an international organization, and consequently dismissed the bribery charges.  The defendants were convicted of possessing false contracts, but acquitted of creating the false contracts due to insufficient evidence.

The DRC allegations concern World Bank consultant Wassim Tappuni, who, as reported in our 2017 Year-End FCPA Update, was sentenced to six years in prison after being found guilty of receiving €2 million worth of gifts in exchange for his assistance with contracts with medical equipment suppliers.  In 2016, two other unnamed DRC employees settled with the OM for fines of €5,000 and €20,000, and in 2020, the OM entered into settlement agreements with two other Dutch medical companies — Simed International and Dutchmed International—as well as with several of their employees for suspected involvement in the scheme. DRC, Simed, and Dutchmed also received debarments from the World Bank in 2014, 2015, and 2017, respectively.

On February 17, 2023, the OM confirmed a separate settlement with the Dutch member of the PwC global network, pursuant to which the auditor agreed to pay €150,000 to resolve allegations of misstated audits of Econosto Mideast, which itself entered into a 2021 resolution of foreign bribery in the Middle East and Asia.

Norway

In April 2023, the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (“Økokrim”) indicted the longtime former President of the International Biathlon Union, Anders Besseberg, on charges of aggravated corruption.  Økokrim issued a statement on April 17, 2023, saying that there was sufficient evidence to prove that from 2009 to 2018 Besseberg accepted bribes that included watches, hunting trips and trophies, prostitutes, and a leased BMW.  According to a separate External Review Commission report issued in November 2018 in response to the allegations, the alleged bribes were in return for favorable decisions toward Russia in the anti-doping context.

Poland

In September 2023, media reported that Polish consulate employees may have issued hundreds of thousands of temporary work visas to migrants from Asia and Africa since 2021 in return for bribes of several thousand dollars each.  After the European Commission asked the Polish government to comment on the allegations, Poland’s Prosecutor General admitted that an investigation by the Anti-Corruption Agency in Poland into this matter had been ongoing since July 2022, but that only one deputy foreign minister had been dismissed and seven people taken into custody for questioning.  The European Commission did not consider the answer to be sufficient and asked Poland for further clarification, but the status of the inquiry is unclear in the wake of Poland’s seismic parliamentary election resulting in a change of political power shortly thereafter.  (In January 2024, the Anti-Corruption Agency arrested the former deputy head of the Ministry of Foreign Affairs for his alleged role in the scheme, and we will follow-up on these developments in our next update.)

Portugal

On November 7, 2023, Portugal’s Prime Minister Antonio Costa resigned from his position after the Public Prosecutor’s Office announced it was investigating Costa and several members of his cabinet.  In connection with the inquiry, prosecutors detained Costa’s chief of staff, Vitor Escaria, and four other persons and also searched private residences and two governmental agencies.  This investigation concerns allegations of bribery and corruption in connection with lithium exploration concessions, a green hydrogen project, and a major data center investment.  While the authorities found tens of thousands of euros in envelopes in Escaria’s office, news outlets later reported that the only evidence linking Costa to the allegations—the transcript of a wiretapped telephone conversation—had reportedly been misinterpreted by prosecutors confusing the name of Prime Minister Antonio Costa with that of Economy Minister Antonio Costa Silva.

Switzerland

On March 28, 2023, the Swiss Court of Appeals in Geneva upheld a corruption verdict against Israeli mining magnate Beny Steinmetz and two other defendants for bribing foreign public officials in Guinea in order to obtain exploration permits for Guinea’s vast iron ore deposits.  As discussed in our 2021 Year-End FCPA Update, the 2021 verdict found that Steinmetz and the other defendants paid bribes to acquire mining permits for the world’s richest untapped deposits of iron ore in Guinea’s southeastern Simandou mountain range, and then forged documents to cover it up.  Although the bribery convictions of Steinmetz and his associates were upheld, the Court of Appeals overturned their forgery convictions.  The court also upheld the CHF 50 million (~ $56.5 million) fine against Steinmetz, but reduced his five-year prison sentence to three years—of which only 18 months must be served given the passage of time.  The sentences against the other two defendants were fully suspended.

On April 25, 2023, the Office of the Attorney General of Switzerland (“OAG”) announced the indictment of two unnamed executives of Saudi oil company PetroSaudi for conduct arising from the now-infamous 1MDB scandal.  The charges, covering alleged conduct from 2009 to 2015, include counts of commercial fraud, aggravated criminal mismanagement, and aggravated money laundering.  The two executives allegedly colluded with two senior managers from 1MDB as well as Jho Low, a confidant to the Malaysian Prime Minister and informal consultant to 1MDB, to have 1MDB pay $1 billion for purported PetroSaudi assets in Turkmenistan that did not actually exist, after which $700 million were allegedly transferred to an account that was beneficially owned by Low, who in turn diverted $85 million to the two defendants.

On April 27, 2023, OAG announced that it had ordered security ink company SICPA SA to pay CHF 81 million (~ $90.6 million) in connection with alleged acts of corruption in Brazil, Colombia, and Venezuela.  A former sales manager at SICPA was also found guilty of bribing high-ranking Colombian and Venezuelan officials between 2009 and 2011 and was sentenced to a conditional prison term of 170 days.  Proceedings were discontinued without charges against SICPA’s CEO and main shareholder, though the OAG ordered this individual to bear a portion of the costs of the proceedings.

On September 28, 2023, the OAG filed an indictment against Gulnara Karimova, daughter of Uzbekistan’s former president and a defendant in numerous other jurisdictions as reported in our 2020 Mid-Year and 2019 Year-End FCPA updates.  The instant Swiss charges accuse Karimova of participating in a criminal organization known as “The Office,” from which she allegedly engaged in money laundering, acceptance of bribes as foreign public official, and forgery of documents between 2001 and 2013.  Foreign companies allegedly paid bribes to “The Office” in exchange for access to the Uzbek telecommunications market.  Swiss authorities have seized assets totalling CHF 780 million (~ $857 million) and seek the forfeiture of additional assets valued at CHF 440 million (~ $497 million).

On December 6, 2023, the OAG announced that it had filed charges against the commodities trader Trafigura AG with the Federal Criminal Court in Belinzona for allegedly failing to take reasonable measures to prevent its employees from paying bribes.  Prosecutors allege that between April 2009 and October 2011 Trafigura employees paid approximately $5 million in bribes to the former CEO of a subsidiary of the Angolan state oil company in exchange for securing ship chartering and oil bunkering contracts worth $142.7 million.  OAG also charged Trafigura’s former Chief Operating Officer Mike Wainwright, the Angolan public official, and a former Trafigura intermediary for their involvement in the alleged bribe scheme.  Trafigura has stated that it will defend itself at court and present evidence regarding the strength of its internal control system.

Russia & Former CIS

Kazakhstan

In May 2023, the Anti-Corruption Agency of the Republic of Kazakhstan (“ANTIKOR”) announced that it had partnered with other anti-corruption services in Central Asia to create a regional platform to coordinate priorities and accelerate the mutual exchange of information and training, technical assistance, and knowledge management.  The fruits of this partnership appeared to be reflected in ANTIKOR’s November 2023 announcement that over the preceding 10 months it had recovered KZT 857 billion (~ $1.8 billion) in cash and assets derived from corruption schemes.  ANTIKOR also reported that 1,500 corruption crimes were registered during the same period, involving over 1,100 individuals, including former Minister of Justice Marat Beketaev, who was detained in October 2023 for alleged abuse of power in steering state contracts to a company with which he was affiliated and overseeing payouts for unnecessary services.

In another high-profile case, Kazakhstan’s former Prime Minister and former Head of the National Security Committee, Karim Masimov, was convicted of high treason, attempting to seize power by force, and abuse of office and power for his alleged role in the January 2022 Zhanaozen mass protests that left at least 238 people dead.  In April 2023, Masimov was sentenced to 18 years in prison for allegedly helping to orchestrate protests over a fuel price hike, which rapidly escalated to broader civil unrest against corruption and widespread injustice under the rule of former President Nursultan Nazarbaev.  On the same charges, the court also convicted Masimov’s deputies, Anuar Sadyqulov and Daulet Erghozhin, and sentenced them to 16 years and 15 years in prison, respectively.  In November 2023, the government announced additional charges against Masimov for allegedly laundering money and taking a bribe.

Russia

The Russian government has made a string of arrests and prosecutions of public officials this year on allegations of corruption, including:

  • Valery Serov, Mayor of the city of Pechora, was arrested in September 2023 and charged with allegedly accepting a bribe. According to investigators, Serov and his former First Deputy Andrey Kanishchev helped an entrepreneur obtain municipal construction contracts in return for RUB 4 million (~ $43,000); and
  • Andrey Boldorev, Head of Investment and Strategic Development at Federal State Unitary Enterprise “Rosmorport,” was also arrested in September 2023 for allegedly accepting bribes. According to the Investigation Department for Transport of the Investigative Committee of the Russian Federation, Boldorev accepted bribes in the form of wages for fictitious employment at a mining company.

On the legislative front, in July, the State Duma Committee on Security and Anti-Corruption introduced a bill to increase liability for petty public official bribery and petty commercial bribery involving less than RUB 10,000 (~ $108).  The bill would double the maximum penalty from one to two years of imprisonment, and it would further allow for a one-year sentence enhancement if certain criteria are met, such as the additional presence of extortion or a prior criminal history.

Ukraine

Although defending against and repelling Russia’s invasion remains the primary focus of lawmakers and law enforcement agencies alike, the Ukrainian government nonetheless has continued to take steps aimed at rooting out corruption on a national level.  One significant motivation behind these efforts is moving the country closer to European Union membership, as the preconditions to reaching that objective include meeting certain anti-corruption benchmarks.

To that end, Ukrainian President Volodymyr Zelenskyy’s administration dismissed several high-ranking officials amid a wave of corruption scandals in January 2023.  Following that flurry, President Zelenskyy appointed a new director for the country’s National Anti-Corruption Bureau—Semen Kryvonos—to address international corruption concerns.  Corruption related charges brought since have included:

  • President of the Ukrainian Supreme Court Vsevolod Kniaziev was arrested in May 2023 for allegedly accepting a bribe worth approximately UAH 99.2 million (~ $2.7 million);
  • Former judge of the Dnipro District Court in Kyiv Mykola Chaus was convicted and sentenced to 10 years in prison by the High Anti-Corruption Court in June 2023 for taking bribes in exchange for making favorable court decisions; and
  • Former Deputy Head of the Presidential Administration Kyrylo Tymoshenko had an administrative case opened against him in August 2023 for allegedly accepting gifts and engaging in other misuses of his public office, although these charges were quickly dismissed by a court in September 2023.

On the legislative front, the Ukrainian government has also made significant headway on President Zelenskyy’s anti-corruption agenda, including approving a draft law on the ratification of the country’s agreement with the OECD and a draft law that brings Ukrainian anti-money laundering legislation up to the standards set forth by the Financial Action Task Force  in September 2023.  Finally, in December 2023, Ukraine passed the four remaining legislation requirements necessary for the European Commission to make a final recommendation that the European Council begin accession negotiations, three of which relate to anti-corruption priorities.

The Americas

Brazil

On May 5, 2023, the Brazilian subsidiary of Swiss medical device company Medartis AG signed a leniency agreement with the municipality of São Paulo’s Office of the Comptroller General (“CGM”), pursuant to which it agreed to pay 10 million reais (~ $2 million) to resolve charges under Brazil’s Clean Company Act.  This is believed to be the first corporate settlement with a local government body under the 2013 statute.  The São Paulo CGM alleged that between 2011 and 2017 Medartis employees provided “undue advantages” to doctors of state-run hospitals to improperly influence them to purchase the company’s medical products.  The CGM confirmed that Medartis self-reported the conduct, actively cooperated with the investigation, and agreed to make further enhancements to its compliance program.  This first-of-its-kind resolution is indicative of the broadening range of agencies responsible for anti-corruption investigations and enforcement in jurisdictions around the world.

On July 21, 2023, the Office of the Comptroller General of Brazil (“CGU”) announced that it had settled a corruption case against the Brazilian subsidiary of German chemicals distribution company Helm AG.  The CGU alleged that between 2015 and 2017 the company made four payments to Brazilian officials totaling about 28,000 reais (~ $5,750) to buy confidential import and export data from Brazil’s federal revenue services.  The subsidiary agreed to pay 696,700 reais (~ $143,000), corresponding to 0.1% of Helm do Brasil’s revenue the year prior to the investigation.  The settlement took the form of a summary judgment, which under Brazilian law requires companies to admit their wrongdoing.  In announcing the enforcement action, the CGU said this is just one of more than 10 companies (though the first international company) to have been penalized so far in the alleged scheme to buy confidential import and export data.

On September 6, 2023, Judge Dias Toffoli of the Brazilian Federal Supreme Court ruled that evidence stemming from Odebrecht S.A.’s leniency agreement, part of its record-breaking 2016 anti-corruption resolution covered in our 2016 Year-End FCPA Update, is inadmissible in other proceedings.  The decision came as part of a 2020 lawsuit filed by Brazilian President Luiz Inácio Lula da Silva to obtain access to materials from the investigation into leaked messages between the lead prosecutor and judge overseeing the prolific Operation Car Wash investigation.  Writing for the Court, Judge José Antonio Dias Toffoli expressed concerns that public officials had “subverted evidence, acted with bias … and outside their sphere of competence,” and that prosecutors did not comply with chain of custody rules with respect to evidence collected as part of the leniency agreement.  Brazil’s National Association of Public Prosecutors appealed the decision to a broader panel of the Federal Supreme Court, which in February 2024 suspended the BRL 8.5 billion (~ $1.7 billion) fine imposed on Odebrecht. This decision generates substantial uncertainty regarding the consequences for the dozens of other corporate penalties and convictions based on evidence collected as part of Odebrecht’s leniency agreement, which we will continue to cover in our future updates.

Canada

Most recently in our 2022 Year-End FCPA Update we reported on the Canadian Corruption of Foreign Public Officials Act (“CFPOA”) prosecution of Ultra Electronics Forensic Technology Inc., along with four former executives—Robert Walsh, René Bélanger, Philip Heaney, and Michael McLean—on bribery and fraud charges associated with the alleged use of local agents in the Philippines to bribe foreign public officials in an effort to influence and expedite the award of a contract to supply a ballistic identification system to the national police force.  On May 17, 2023, the Public Prosecution Service of Canada announced that the Superior Court of Quebec had approved a four-year remediation agreement with the Ultra Electronics subsidiary, pursuant to which the company agreed to pay a penalty of CAD 6.6 million (~ $4.9 million) plus a CAD 659,000 (~ $484,700) victim “surcharge” and the disgorgement of CAD 3.3 million (~ $2.4 million).  The agreement also requires the company to implement an anti-bribery and anti-corruption compliance program “under the supervision of an external auditor.”

In another consequential CFPOA case, on January 16, 2023, the Ontario Supreme Court of Justice acquitted Damodar Arapakota, the former CEO of Toronto-based electronics company Imex Systems, finding him not guilty of charges associated with the sponsorship of a $40,000 trip from New York to Orlando for a Botswanan government official and his family.  Justice Rita-Jean Maxwell reasoned that the prosecution failed to show a “material economic advantage” to Imex and thus found the required quid pro quo lacking.  Although accepting that the payment of travel expenses for the Botswanan official and his family constituted an advantage for the official, the Court found that the fact that this benefit was conferred while Imex was in the process of attempting to secure a contract from the agency the official worked for did not, without more, meet the necessary mens rea required by the CPFOA.  On March 7, 2023, Arapakota successfully defended against the Crown Prosecution Service’s appeal, securing the first acquittal ever rendered in a case prosecuted under CPFOA.

Colombia

On July 30, 2023, Colombian authorities arrested Nicolas Petro, the eldest son of incumbent Colombian President Gustavo Petro, on charges of money laundering and illicit enrichment relating to his father’s 2022 presidential campaign.  Prosecutors allege that the younger Petro received money or properties valued at approximately $400,000 from, among others, persons convicted and extradited to the United States on drug trafficking charges, in exchange for participation in his father’s peace plans.  The younger Petro, a legislator in Colombia’s Atlantico province, resigned from his seat following his arrest, but despite pleading not guilty has signaled a willingness to cooperate.  His trial has been set for the end of April.  Colombian authorities also brought charges against Nicolas Petro’s ex-wife, Daysuris Vasquez, for her role in the alleged scheme.  In December 2023, the Commission of Accusations of Colombia’s House of Representative announced that it was opening an investigation against President Gustavo Petro arising out of the same investigation.

Ecuador

On February 22, 2023, the Attorney General of Ecuador announced that her office would bring corruption charges against 37 defendants, including former President Lenín Moreno and former Chinese Ambassador to Ecuador Cai Runguo, in connection with an alleged bribery scheme related to the construction of the $2.5 billion Coca Codo Sinclair hydroelectric dam.  The charges relate to an alleged scheme in which Chinese state-owned company Sinohydro purportedly paid $76 million in bribes to Ecuadorian public officials between 2009 and 2018, which Ecuador began investigating in 2019 after a leak of documents regarding the scheme, known as the “Ina Papers,” were published online.  The Attorney General explained that “[t]hose tens of millions of USD in bribes would have been delivered by Sinohydro and channeled through third parties, concealing the payments using a false image of consulting and representation services and paid through gifts, checks[,] and transfers.”  In addition to Moreno and Runguo, other parties to be charged include four of Sinohydro’s former “legal representatives” and four ex-directors at Comercial Recorsa, a local infrastructure company.

Separately, on May 15, 2023, the Office of the Attorney General announced that it had arrested Xavier Vera, the country’s former minister of energy and mines, as part of a corruption investigation.  Vera resigned his post in October 2022 amid an investigation into accusations that he had helped to arrange jobs at state oil company Petroecuador in exchange for bribes.

Middle East & Africa

South Africa

In September 2023, prosecutors from South Africa’s National Prosecuting Authority (“NPA”) blocked a request to obtain a copy of its corporate corruption settlement with ABB Ltd.  As we covered in the 2022 Year-End FCPA Update, in December 2022, ABB entered into a resolution with DOJ and the SEC as well as authorities in South Africa and Switzerland to resolve allegations of bribery in South Africa.  Following this resolution, Global Investigations Review and Corruption Watch requested access to the resolution documents pursuant to South Africa’s transparency laws.  The NPA refused the request, citing ABB’s withheld consent for the disclosure and the resolution’s inclusion of evidence relating to ongoing criminal proceedings.

On November 21, 2023, the Middleburg Specialised Commercial Crimes Court stuck the criminal corruption case against former acting Eskom CEO Matshela Koko and his co-defendants.  Koko was alleged to have received bribes as part of a corruption scheme involving ABB.  The Court determined there had been an “unreasonable delay” in the investigation and dismissed the case, finding that the defendants’ rights to a timely trial had been violated.  This loss on what the NPA had listed as one of its “seminal” state-capture cases follows acquittals in another recent corruption case and an unsuccessful extradition in 2022 discussed immediately below.  Nevertheless, the NPA prosecutors stated that they were confident that the case could be brought in the future or “re-enrolled, citing unanticipated complexities as the reason for the delay.

United Arab Emirates

In February 2023, Abu Dhabi’s government-owned International Petroleum Investment Company and a subsidiary agreed to pay $1.8 billion to the government of Malaysia to settle a lawsuit and related arbitration proceedings filed in the UK concerning their involvement with the massive 1MDB fraud scheme.  The settlement resolved Malaysia’s contention that an earlier, smaller settlement negotiated in 2017 with former Malaysian Prime Minister Najib Razak—who has since been convicted and sentenced to 12 years in prison on 1MDB-related corruption allegations as discussed below—was procured by fraud.

In April 2023, a court in Dubai informed South Africa of its denial of the latter’s request to extradite Atul Gupta and Rajesh Gupta, who were arrested in the UAE in June 2022, for charges of political corruption in connection to bribes allegedly paid to former South African President Jacob Zuma.  According to the response from the UAE to South Africa, the Dubai court ruled that the UAE also had jurisdiction to prosecute the alleged crimes because the Guptas were alleged to have engaged in money laundering activity in both the UAE and South Africa.  However, it is unclear whether the UAE intends to prosecute the Guptas, who were released after the court’s decision and whose present whereabouts are unknown.  The UAE has publicly claimed that the court denied the requests because they did not contain copies of current arrest warrants, as required under the extradition treaty between the UAE and South Africa.  The South African authorities have strongly criticized the Dubai court’s ruling, which they claim did not comply with the countries’ bilateral extradition treaty and has significantly hampered, if not eliminated, the country’s ability to bring two of its most notorious corruption suspects to justice.

Asia

China

In January 2023, the Central Commission for Discipline Inspection (“CCDI”) of the Chinese Communist Party held a plenary session during which President Xi Jinping reiterated the Party’s “zero tolerance” policy against corruption and the need to address “both the symptoms and the root causes” of corruption.  Subsequently, in March 2023, the CCDI launched another campaign to investigate dishonest and disloyal officials within its ranks.  As just one example of related enforcement, in April 2023 former Supreme Court Judge Meng Xiang was sentenced to 12 years in prison and fined RMB 2 million (~ $290,000) by the Zhengzhou City People’s Intermediate Court for accepting bribes totaling RMB 22.7 million (~ $3.3 million) between 2003 and 2020.  More recently, in November 2023, former vice-chairman of the Guizhou Provincial Committee of the Chinese People’s Political Consultative Conference, Li Zaiyong, was removed from public office after allegedly accepting banquets and travel arrangements, which enforcement authorities determined could compromise his impartiality when performing his official duties.  Further, Li was also found to have solicited bribes from others and improperly used his authority to influence the selection and appointment of Party and government cadres.

The financial sector remains a focus of China’s anti-corruption efforts.  In February 2023, the Supreme People’s Procuratorate charged Tian Huiyu, former President of the China Merchants Bank, with accepting bribe payments and engaging in insider trading.  A year later in February 2024, the Intermediate People’s Court of Changde issued a suspended death sentence to Tian, which may be commuted to a life imprisonment if he does not commit any serious crimes during the next two years.  Other investigations have been announced for senior officials of other Chinese banks, such as Wang Bin, the former chairman of China Life Insurance, who also received a suspended death sentence, by the Intermediate People’s Court of Jinan for receiving RMB 325 million (~ $44.6 million) in bribes between 1997 and 2021.

We also continue to see anti-corruption efforts and enforcement in China’s healthcare sector.  In May 2023, 14 Central Government ministries jointly issued the 2023 Key Tasks on Safeguarding the Integrity of Medical Procurement and Medical Services, which updated existing guidance originally issued in 2022 (as discussed in our 2022 Mid-Year FCPA Update).  The updated guidance directs local governments to combat all forms of bribery and kickbacks in the healthcare sector, such as bribes disguised as donations or academic conference fees.  This guidance echoes the themes found in recent anti-corruption enforcement actions in the healthcare sector, including the February 2023 prosecution of Tong Wei, the former Party Secretary of Nanxian People’s Hospital in Hunan Province, for allegedly favoring certain pharmaceutical companies and distributors in public procurement decisions in exchange for RMB 9.665 million (~ $1.359 million) in bribes.  On July 21, 2023, the National Health Commission, together with nine other government agencies, jointly held a conference to launch a one-year campaign targeting corruption issues in the healthcare industry.  One week later, the CCDI issued a statement of support, stating that the campaign will be a comprehensive and systematic approach that covers “all areas and all chains.”

Hong Kong

As reported in our 2022 Year-End FCPA Update, the Independent Commission Against Corruption (“ICAC”) commenced several enforcement actions connected to the construction of a runway at Hong Kong International Airport.  In February 2023, the ICAC charged eight persons for accepting, offering, and “handling” bribes totaling HKD 4.3 million (~ $550,000) from 2017 to 2022.  The defendants include Yin Kek-Kiong and Ricky Lee, respectively the former General Manager and former Principal Manager of the Airport Authority Hong Kong, who allegedly received corrupt payments from contractors Goldwave Steel Structure Engineering Limited, Carol Engineering Limited, and Joint Field Engineering Limited.  Lee’s wife, Diana Kok-tan Chan, is also charged with laundering criminal proceeds totaling HKD 6 million (~ $766,000), including the alleged bribes described above.  The other defendants worked for suppliers and sub-contractors of the airport project.

In September 2023, the ICAC charged 23 individuals for allegedly offering and accepting bribes totaling more than HKD 6.5 million (~ $832,000) in relation to building renovation contracts.  According to the ICAC, several middlemen conspired with project contractors to offer bribes to members of a building owners’ committee in exchange for renovation and project management contracts in the building.

India

India’s National Financial Reporting Authority (“NFRA”) has reiterated that statutory auditors of Indian companies are required to report instances of fraud and suspected fraud to the Government of India even if the fraud has already been reported to the government by the Company or another entity.  The NFRA circular clarifies an existing requirement that statutory auditors of Indian companies must report any instance of fraud, which involves or is expected to involve an amount of INR 10,000,000 (~ $120,000) or more, to the Indian Government.  Consistent with judicial precedents, the NFRA circular also notes that a statutory auditor cannot be absolved of its duty to report such fraud by resigning from its role as the statutory auditor.

Indonesia

As reported in our 2022 Year-End FCPA Update, the Corruption Eradication Commission (“KPK”) detained former Supreme Court judge Sudrajad Dimyati for allegedly accepting IDR 800 million (~ $53,000) in bribes in exchange for a favorable ruling for a lending cooperative.  On May 30, 2023, an Indonesian court found Dimyati guilty and sentenced him to eight years imprisonment, in addition to a fine of IDR 1 billion (~ $66,693).  Other corruption cases involving high-ranking government officials include a 15-year sentence issued by the Jakarta Corruption Crime Court against Johnny G. Plate, the Communications and Information Technology Minister, for corruption related to a telecommunications project, and Lukas Enembe, the former Governor of Papua, who was indicted for accepting bribes in relation to infrastructure projects.  Enembe was convicted and received an eight-year sentence, but passed away shortly thereafter.

Japan

As reported in our 2022 Year-End FCPA Update, the Tokyo District Public Prosecutors Office indicted a number of individuals in connection with the 2020 Olympic Games, including Olympic and Paralympic Organizing Committee Executive Board Member Haruyuki Takahashi, on charges that Takahashi accepted bribes in exchange for awarding sponsorship rights.  Takahashi pleaded not guilty in December 2023.  In related cases, Shinichi Ueno, former President of marketing and creative content company ADK Holdings Inc.; Taiji Sekiguchi, the former President of a stuffed-toy maker Sun Arrow Inc.; his father and also former Sun Arrow executive Yoshihiro Sekiguchi; and Toshiyuki Yoshihara, an executive at the Japanese publishing house Kadokawa, were all convicted and sentenced for providing Takahashi with bribes.

On September 7, 2023, Tokyo prosecutors arrested former parliamentary vice foreign minister and Liberal Democratic Party lawmaker Masatoshi Akimoto on suspicion of accepting bribes totaling JPY 61 million (~ $410,000) from a wind power company.  Akimoto allegedly received the funds in exchange for requesting the government to review assessment standards when awarding contracts for offshore wind power projects, which was in favor of the offshore wind power company as it was vying for offshore wind power projects in Aomori Prefecture and other areas.  Amidst the allegations, Akimoto departed from the ruling Liberal Democratic Party and stepped down from his role as parliamentary vice foreign minister.

Malaysia

As noted above and reported in our 2020 Year-End and 2022 Mid-Year FCPA updates, former Malaysian Prime Minister Najib Razak was sentenced to 12 years imprisonment in 2020 in connection with the 1MDB corruption scheme, which was upheld by Malaysia’s highest court in 2022.  On March 3, 2023, Razak was separately acquitted of charges related to tampering with an audit report to cover up misconduct.  On March 31, 2023, the court dismissed Najib’s bid to review his corruption-related convictions, effectively ending his avenues for appeal.  However, in February 2024, Malaysia’s pardons board reduced Razak’s sentence to 6 years.

On February 1, 2023, Malaysia’s Anti-Corruption Commission (“MACC”) confirmed that it had frozen two bank accounts held by the Parti Pribumi Bersatu Malaysia (“Bersatu”) political party.  In April 2023, the MACC confirmed that the accounts that were previously frozen had been seized.  These actions were taken in connection into a probe into whether Bersatu misappropriated public funds that had been earmarked to battle the COVID-19 pandemic.  In connection with the same investigation, the MACC arrested former Prime Minister Muhyiddin Yassin, the leader of Bersatu, on March 9, 2023, and charged him with corruption and money laundering.  Yassin has claimed that the prosecution was politically motivated and an attempt to discredit Bersatu ahead of elections in July 2023.  On August 15, 2023, the Malaysian high court overturned the charges for abuse of power, but Yassin still faces three charges of money laundering.

On July 12, 2023, the MACC announced the arrest of former 1MDB General Counsel Jasmine Loo Ai Swan on further charges arising from the 1MDB scandal.  Loo has been described as a close confidant of Jho Low, the fugitive businessman and alleged mastermind of the scam, leading some to speculate that Malaysian authorities are getting closer in their hunt for Low.

Singapore

On August 16, 2023, Singapore’s Corrupt Practices Investigations Bureau (“CPIB”) charged Balakrishnan A/L Govindasamy, a former commercial executive of oil rig construction company Sembcorp Marine, with 14 counts of corruption under the country’s Prevention of Corruption Act.  Govindasamy allegedly received (or sought to receive) cash bribes totaling at least S$202,877 (~ $150,000) from nine contractors between 2015 and 2021.  According to the CPIB, the contractors paid the bribes in exchange for contracts with a Sembcorp Marine subsidiary.  The Singapore investigation commenced in March 2023, following an investigation by Brazil’s CGM, and is reportedly an extension of Brazil’s long-running “Operation Car Wash” anti-corruption investigation.

South Korea

On December 27, 2022, President Suk-Yeol Yoon granted a presidential pardon to former President Myung-Bak Lee.  As reported in our 2018 Year-End FCPA Update, the Seoul Central District Court originally convicted Lee of bribery and embezzlement in 2018.  In 2020, the Supreme Court upheld a 17-year prison sentence and a KRW 13 billion (~ $10 million) fine for Lee.  The subsequent pardon in December 2022 voided 14.5 years of Lee’s prison term and his unpaid fine of KRW 8.2 billion (~ $6 million).  President Yoon also issued pardons to over 1,300 former civil servants, politicians, and public officials convicted of corruption, bribery, and other similar crimes.  Those receiving pardons include senior staff members of former President Geun-Hye Park’s administration.  The Yoon administration described the pardons as an effort to foster “national unity.”

Australia

On August 2, 2023, the High Court of Australia ruled that a 2020 penalty imposed upon an Australian engineering company for alleged corruption in the Philippines and Vietnam must be recalculated.  The Court upheld the prosecution’s appeal of the penalty, finding that “the value of the benefit” received for the alleged corrupt payments—which presents one measure of setting the maximum penalty—means the absolute value of the contracts received rather than the profits on those contracts.  The High Court said that the value of the benefit that a company obtains from bribes should amount to “no more and no less than the sum of the money in fact received” because the law offers “no hint” that the value should be calculated “by some specific process of valuation.”  This decision runs counter to sentencing practices in numerous other countries, including the United States.


The following Gibson Dunn lawyers participated in preparing this update: F. Joseph Warin, John Chesley, Patrick Stokes, Kelly Austin, Benno Schwarz, Bryan Parr, Alexander Moss, Allison Lewis, Michael Diamant, Patrick Doris, Katharina Humphrey, Vanessa Ludwig, Matthew Nunan, Oleh Vretsona, Oliver Welch, Finn Zeidler, Kathryn Harris Bloom, Ella Alves Capone, Felicia Chen, Josiah Clarke, Rommy Lorena Conklin, Andreas Dürr, Mary Aline Fertin, Kate Goldberg, John Harrison, Maximilian Kornwachs, Nicole Lee, Joshua Lim, Ramona Lin, Jane Lu, Lora MacDonald, José Madrid, Andrei Malikov, Shannon McAvoy, Jacob McGee, Megan Meagher, Su Moon, Jaclyn Neely, Ning Ning, Kyle Parrott, Marquan Robertson, Julian Reichert, Kelly Skowera, Pedro Soto, Laura Sturges, Karthik Ashwin Thiagarajan, Katherine Tomsett, Todd Truesdale, Alyse Ullery-Glod, Tim Velenchuk, Nicole Waddick*, Dillon Westfall, Edward Zhang, and Yan Zhao.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these issues. We have more than 110 attorneys with FCPA experience, including a number of former federal prosecutors and SEC officials, spread throughout the firm’s domestic and international offices. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Anti-Corruption & FCPA practice group:

Washington, D.C.
F. Joseph Warin (+1 202.887.3609, [email protected])
David P. Burns (+1 202.887.3786, [email protected])
Stephanie Brooker (+1 202.887.3502, [email protected])
Courtney M. Brown (+1 202.955.8685, [email protected])
John W.F. Chesley (+1 202.887.3788, [email protected])
Daniel P. Chung (+1 202.887.3729, [email protected])
M. Kendall Day (+1 202.955.8220, [email protected])
Michael S. Diamant (+1 202.887.3604, [email protected])
Melissa L. Farrar (+1 202.887.3579, [email protected])
Judith A. Lee (+1 202.887.3591, [email protected])
Adam M. Smith (+1 202.887.3547, [email protected])
Patrick F. Stokes (+1 202.955.8504, [email protected])
Oleh Vretsona (+1 202.887.3779, [email protected])
Ella Alves Capone (+1 202.887.3511, [email protected])
Lora Elizabeth MacDonald (+1 202.887.3738, [email protected])
Bryan Parr (+1 202.777.9560, [email protected])
Pedro G. Soto (+1 202.955.8661, [email protected])
Nicole Lee (+1 202.887.3717, [email protected])
Alexander “Sandy” Moss (+ 1 202.887.3615, [email protected])
Allison Lewis (+ 1 202.887.3693, [email protected])

New York
Zainab N. Ahmad (+1 212.351.2609, [email protected])
Lisa A. Alfaro (+55 11 3521 7160, [email protected])
Reed Brodsky (+1 212.351.5334, [email protected])
Karin Portlock (+1 212.351.2666, [email protected])
Alexander H. Southwell (+1 212.351.3981, [email protected])
Jaclyn Neely (+1 212.351.2692, [email protected])
M. Jonathan Seibald (+1 212.351.6216, [email protected])

Denver
Kelly Austin (+1 303.298.5980, [email protected])
Ryan T. Bergsieker (+1 303.298.5774, [email protected])
Robert C. Blume (+1 303.298.5758, [email protected])
John D.W. Partridge (+1 303.298.5931, [email protected])
Laura M. Sturges (+1 303.298.5929, [email protected])

Los Angeles
Michael M. Farhang (+1 213.229.7005, [email protected])
Douglas Fuchs (+1 213.229.7605, [email protected])
Nicola T. Hanna (+1 213.229.7269, [email protected])
Marcellus McRae (+1 213.229.7675, [email protected])
Debra Wong Yang (+1 213.229.7472, [email protected])
Poonam G. Kumar (+1 213.229.7554, [email protected])
Rommy L. Conklin (+1 213.229.7966, [email protected])
Chris R. Jones (+1 213.229.7786, [email protected])

San Francisco
Winston Y. Chan (+1 415.393.8362, [email protected])
Thad A. Davis (+1 415.393.8251, [email protected])
Charles J. Stevens (+1 415.393.8391, [email protected])
Zachariah J. Lloyd (+1 415.393.8319, [email protected])

Palo Alto
Benjamin Wagner (+1 650.849.5395, [email protected])

London
Patrick Doris (+44 20 7071 4276, [email protected])
Charlie Falconer (+44 20 7071 4270, [email protected])
Sacha Harber-Kelly (+44 20 7071 4205, [email protected])
Michelle Kirschner (+44 20 7071 4212, [email protected])
Matthew Nunan (+44 20 7071 4201, [email protected])
Philip Rocher (+44 20 7071 4202, [email protected])

Paris
Benoît Fleury (+33 1 56 43 13 00, [email protected])
Bernard Grinspan (+33 1 56 43 13 00, [email protected]

Munich
Katharina Humphrey (+49 89 189 33 155, [email protected])
Benno Schwarz (+49 89 189 33 110, [email protected])
Mariam Pathan (+49 89 189 33 228, [email protected])

Hong Kong
Kelly Austin (+1 303.298.5980, [email protected])
Oliver D. Welch (+852 2214 3716, [email protected])
Ning Ning (+852 2214 3763, [email protected])
Becky Chung (+ +852 2214 3837, [email protected])

Singapore
Oliver D. Welch (+852 2214 3716, [email protected])
Karthik Ashwin Thiagarajan (+65 6507 3636, [email protected])

*Nicole Waddick, a recent law graduate in the San Francisco office, is not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

We are pleased to provide you with Gibson Dunn’s ESG update covering the following key developments during January 2024. Please click on the links below for further details.

I. GLOBAL

  1. More than 300 companies to start reporting impact on nature

Over 300 companies and financial institutions pledged at Davos to disclose their impact on nature, aiming to mitigate global biodiversity loss. The disclosures, led by the G20-backed Taskforce on Nature-related Financial Disclosures (TNFD), aim to provide more information on the risks and opportunities related to interaction with the natural world. This initiative aligns with the COP15 biodiversity agreement.

TNFD’s framework, launched in 2023, aims to compel companies to assess and manage nature-related issues.

  1. S&P Dow Jones adds two SDG indices

S&P Dow Jones Indices has launched the S&P 500 SDG Index and the S&P Global LargeMidCap SDG Index, designed to provide equity exposure to companies aligned with the United Nations’ 17 Sustainable Development Goals (SDGs). These indices utilize data from Impact Cubed to measure external impacts on society and the environment, independent of financial materiality.

The indices leverage the S&P 500 and S&P Global Large MidCap indices for screening and selection, offering a different approach to tracking and measuring companies’ alignment with specific UN sustainability targets.

  1. ISS ESG Enhances Biodiversity Impact Assessment Tool with Portfolio Report

ISS ESG, the sustainable investment arm of ISS STOXX, launched the Biodiversity Impact Assessment Tool (BIAT) Portfolio Report, allowing investors to compare portfolios’ biodiversity risk and impact against benchmarks. The tool, part of the expanded BIAT solution covering 17,000+ companies, offers insights into impact per sector, country, and biodiversity drivers.

The tool also facilitates assessment of top and bottom holdings, economic activities’ impact, and ecosystem service dependencies, supporting regulatory compliance like the UN Convention on Biological Diversity and the Task Force on Nature-related Financial Disclosures. 

  1. IAIS Roadmap outlines key deliverables for 2024

The International Association of Insurance Supervisors (IAIS) has set out its key deliverables for 2024 in its updated Roadmap. In 2024, the IAIS will finalize the global Insurance Capital Standard (ICS) as a prescribed capital requirement for internationally active insurance groups. It will also focus on climate risk, as well as publish a comprehensive application paper addressing climate risk’s impact on insurers’ solvency.

The roadmap also maintains continuity from the current strategic plan, with emphasis on climate risk, digital innovation, diversity, financial inclusion, and cyber risk. Additionally, IAIS will shift focus towards implementing IAIS standards, preparing for a new strategic plan for 2025-2029.

  1. IESBA launches public consultation on new ethical benchmark for sustainability reporting and assurance

The International Ethics Standards Board for Accountants (IESBA) has released exposure drafts for global standards on ethical considerations in sustainability reporting and assurance to combat greenwashing and enhance the quality of sustainability information. Seeking feedback from various stakeholders, including accountants, regulators, and investors, the proposed rules aim to bolster confidence in sustainability reporting amid incoming mandatory disclosure requirements.

The drafts address ethics for sustainability assurance practitioners and accountants, emphasizing principles like integrity and professionalism. The consultation period ends in May, with the standards expected to align with global efforts to ensure the integrity of sustainability information.

  1. GRI launches updated biodiversity standards

The Global Reporting Initiative (GRI) has launched an updated Biodiversity Standard, GRI 101: Biodiversity 2024, to address the urgent need for transparency in biodiversity reporting amid increasing corporate and investor focus on the issue.

The standard, developed in consultation with stakeholders, aims to enhance disclosure on biodiversity impacts throughout the supply chain, including location-specific reporting and new disclosures on drivers of biodiversity loss. It aligns with global frameworks like the Taskforce on Nature-related Financial Disclosures (TNFD) and aims to bolster accountability for biodiversity impacts, with a formal implementation date set for January 2026.

  1. ISDA introduces sustainability-linked derivatives clause library

On January 17, 2024, the International Swaps and Derivatives Association (ISDA) has launched a clause library for sustainability-linked derivatives (SLDs) to streamline negotiations by providing standardized drafting options for market participants.

SLDs incorporate sustainability-linked cash flows in derivatives structures and employ key performance indicators to monitor adherence to ESG targets. The clause library offers standard-form options in areas such as evidence of sustainability performance, mechanisms for adjusting cash flows based on ESG target outcomes, and available options for counterparties during disruptions and review events.

II. UNITED KINGDOM

  1. UK to set out biggest nuclear power expansion in the last 70 years

On January 11, 2024, The Guardian reported that the UK government is considering a significant expansion of nuclear power, potentially Britain’s largest in 70 years, with plans to construct a fleet of reactors capable of generating 24GW of power within 26 years. This initiative aims to propel the UK towards achieving net zero emissions by 2050 in a gradual and sustainable manner, with aims that the government’s substantial investment will attract further private sector funding into the industry.

However, there are concerns regarding the project’s potential impact on the UK’s energy security, particularly given the existing uncertainties surrounding previous large-scale reactor projects such as Hinkley Point C and Sizewell C.

  1. UK announces changes to the Variable Monetary Penalties (VMPs) and introduces Unlimited Financial Penalties for Environmental Offences

On December 11, 2023, the UK government published a Press Release announcing that companies violating environmental permits and causing pollution may now face unlimited financial penalties. The scope of offences covered by Variable Monetary Penalties (VMPs) has been expanded, affecting firms with environmental permits, including those in water and waste, agriculture, and process industries. The immediate implementation of these changes aims to enforce stronger regulations, especially within the water system, as part of the UK Government’s Plan for Water.

The penalties, determined based on Sentencing Council guidelines, consider a company’s size and the nature of the environmental offence. The widened range of offences now subject to unlimited penalties includes breaches related to sewage treatment works, storm overflows, illegal discharges to water, illegal waste activities, and permit violations from manufacturing industries and power stations, all aimed at curbing pollution in both water and air. Serious breaches are still liable to criminal proceedings.

  1. FCA establishes working group to support financial advisers with product sustainability claims

On January 16, 2024, the Financial Conduct Authority (FCA) published a Press Release announcing its establishment of an industry-led working group for financial advisers, led by Daniel Godfrey as chair and Julia Dreblow as vice-chair. The group’s membership is intended to range across the advice sector to include players from both small and larger industries, and is for the benefit of both professional and institutional investors as well as retail investors.

The establishment of this working group comes in line with the FCA’s Policy Statement release in November 2023 containing its final rules and guidance on sustainability disclosure requirements (SDR) and investment labels. The purpose of the working group is to support the aims in the policy statement, which is to improve trust and transparency to the market for sustainable investment products and advise consumers on all products with sustainability-related claims.

  1. HM Treasury extends the mandate of the Transition Plan Taskforce

On January 24, 2024, the Transition Plan Taskforce (TPT), initially formed with a two-year mandate, revealed that it has received an extension of its mandate from HM Treasury until at least July 31, 2024, potentially extending to the end of October 2024.

This extension is aimed at supporting the Transition Finance Market Review (TFMR), initiated on January 22, 2024. The TPT’s mandate and timeline now align with the TFMR’s objectives, which involve assessing the measures required for the UK financial and professional services sector to become a leading hub for transition financial services. The focus of the TFMR is on facilitating transition-focused capital raising, maximizing opportunities for UK-based financial services, and positioning the UK’s professional services ecosystem as a global hub.

As of January 2024, the TPT reports significant progress in completing tasks outlined in its original terms of reference. This includes the release of the TPT Disclosure Framework, accompanied by implementation guidance and preliminary sector guidance. In the course of 2024, the TPT anticipates delivering its final outputs. These will consist of comprehensive sector guidance for asset owners, asset managers, banks, electric utilities & power generators, food & beverage, metals & mining, and oil & gas. Additionally, it will provide notes on adaptation, nature, just transition, emerging markets & developing economies, and SMEs. A forward pathway on transition plans will also be presented, incorporating considerations for maintaining a strong ecosystem around transition plans.

  1. UK Government Plans to Consult on Extending SDR Regime to Overseas Funds

On 31 January, it was announced that the UK government is consulting on expanding the Sustainable Disclosure Regulation (SDR) to cover overseas funds, following the Treasury’s equivalence for UCITS ETFs under the Overseas Fund Regime (OFR). The OFR, launching in April 2024, aims to facilitate EU-domiciled ETFs’ entry into the UK market.

This move aims to ease uncertainties for European asset managers in relation to the FCA’s SDR rules excluding overseas funds like those from Ireland and Luxembourg. Additionally, the government plans to extend the Temporary Permissions Regime (TPR) until the end of 2026 to aid the transition to the OFR.

III. EUROPE

  1. EU drafts plan to zero out industry’s carbon footprint by 2050

The European Union is drafting a currently uncompleted plan to capture and store hundreds of millions of tons of CO2 emissions by 2050, as revealed in a draft document. The plan envisions industries transitioning to green energy, as well as a focus on emissions-capturing for sectors with less technology.

The draft proposes the capture of up to 450 million tons of CO2 annually by 2050, with a focus on industries like cement and chemicals. The draft further suggests building carbon capture and storage infrastructure this decade, necessitating both EU and national funding.

  1. EU to create target to cut emissions by 90% by 2040

On 18 January 2024, Reuters reported that the European Commission is set to recommend a 90% reduction in the EU’s greenhouse gas emissions by 2040, compared to 1990 levels. This target aligns with recommendations from the bloc’s scientific advisory committee.

The plan aims to bridge the gap between the existing 2030 and 2050 goals. It involves significant changes, including decarbonizing the power sector, reducing oil imports, and altering dietary habits. The proposal awaits further assessment and negotiation before potentially becoming law after EU elections.

  1. EU freezes F-Gases, Paving Way for Cleaner Future

On January 16 2024, the European Parliament approved a deal to further reduce emissions from fluorinated gases (F-gases). The legislation outlines a complete phase-out of hydrofluorocarbons (HFCs) by 2050, including a trajectory for reducing EU consumption quotas between 2024-2049.

The law imposes strict regulations prohibiting F-gas-containing products in the EU market and establishes specific phase-out dates for F-gases in sectors where feasible alternatives exist, such as domestic refrigeration and air conditioning. Additionally, the parliament adopted measures to address emissions of ozone-depleting substances (ODS) during building renovations, emphasizing the recovery and recycling of such substances.

  1. European Banking Authority (EBA) is consulting on draft guidelines on the management of ESG risks

On January 18 2024, the European Banking Authority (EBA) initiated a public consultation on draft Guidelines regarding the management of Environmental, Social, and Governance (ESG) risks. The guidelines outline requirements for institutions in identifying, measuring, managing, and monitoring ESG risks, with a focus on addressing risks related to the transition to an EU climate-neutral economy. They aim to ensure the safety and soundness of institutions by setting requirements for internal processes and ESG risk management arrangements.

The consultation, running until April 18, 2024, emphasizes the impact of climate change, environmental issues, and social factors on the financial sector. The consultation process invites stakeholders to provide feedback, and a virtual public hearing is scheduled for February 28, 2024.

  1. European Sustainability Reporting Standards come into force

The European Sustainability Reporting Standards (ESRS), which were adopted by the European Commission In July 2023, have come into force. The standards mandate that large undertakings, SMEs with securities on EU regulated markets, and parent undertakings of large groups, report on sustainability impacts. Furthermore, the standards provide a comprehensive framework, including climate change, biodiversity, and human rights, enabling companies to showcase their efforts in line with the green deal agenda.

The phased implementation of reporting requirements will occur over time for different companies, and the standards form part of the larger timetable for the Corporate Sustainability Reporting Directive.

  1. Commission publishes guidance on reporting environmental performance under the EU taxonomy

On December 21st 2023, the European Commission released a Guidance Document addressing queries related to the Taxonomy Disclosures Delegated Act, aiming to enhance the usability of the sustainable finance framework.

The guidance covers reporting obligations for large financial entities and those trading on EU markets regarding their financing, investment, or insurance activities aligned with the taxonomy. It clarifies the scope of reporting obligations, taxonomy assessments for specific exposures, and rules related to verification and evidence of compliance with the EU taxonomy, with a focus on credit institutions, insurance firms, and asset managers.

  1. ECB Report finds 90% of EU Banks misaligned with Paris Agreement

On January 23rd 2024, the European Central Bank (ECB) disclosed in a report that a significant majority of major eurozone banks are financially supporting polluting companies not on track to align with the Paris Agreement over the next five years. This marks the first measurement by the European supervisor of the gap between bank credit portfolios and the Paris Agreement.

The ECB’s methodology identifies companies misaligned with the Paris Agreement by comparing their emissions intensity or technology deployment over a five-year timeframe to the requirements of a net-zero 2050 climate scenario. The study covers six carbon-intensive sectors—oil and gas, coal mining, power generation, automotive, steel, and cement—across 95 large EU banks and their clients.

The ECB also warned that about 70% of the assessed banks face “elevated” litigation and reputational risks for publicly committing to the Paris Agreement despite portfolio misalignment. EU banks will be required to report on the Paris alignment of exposures to aviation, maritime transport, and chemicals, in addition to the six sectors already analysed by the ECB.

  1. The EBA seeks inputs from credit institutions on the classification methodologies for exposures to ESG risks

On 29 January 2024, the European Banking Authority (EBA) initiated a voluntary survey under the Capital Requirements Regulation, seeking input from credit institutions on methodologies to classify ESG risks and the availability of relevant data. The survey, launched on January 29, 2024, aims to inform the EBA’s assessment on the feasibility of standardizing ESG risk identification.

Credit institutions are encouraged to participate in the survey, which is part of the EBA’s broader efforts to address ESG risks in the financial sector. The deadline for responses is March 29, 2024. The EBA may conduct an industry workshop for further discussion based on survey findings.

  1. ECB announces climate focus areas of its 2024 and 2025 work programme

On 30 January 2024, the European Central Bank (ECB) announced an expanded focus on climate change with a new Climate and Nature Plan 2024-2025. This initiative aims to address the increasing impact of climate change on the economy and financial system. It identifies three key areas: the green transition’s risks, physical climate change impact, and risks from nature loss. Concrete measures include analysing transition funding effects and integrating climate scenarios into macroeconomic projections. The ECB will also enhance its own operations’ environmental management.

IV. NORTH AMERICA

  1. U.S. Chamber of Commerce challenges California climate legislation

On January 30, 2024, the U.S. Chamber of Commerce, California Chamber of Commerce, and other business and trade organizations filed a complaint in California federal court challenging the Climate Corporate Data Accountability Act (Senate Bill No. 253) and Greenhouse Gases: Climate-Related Financial Risk Act (Senate Bill No. 261). As described in our September 2023 ESG alert, Senate Bill No. 253 requires U.S. business entities with revenues of more than $1 billion that do business in California to annually report their greenhouse gas emissions and the emissions of upstream and downstream entities with which they do business.  Senate Bill No. 261 requires entities with more than $500 million in revenue to bi-annually report their climate-related financial risks. The complaint challenges the laws as violating (i) the First Amendment of the U.S. Constitution by impermissibly compelling speech; (ii) the Supremacy Clause because they are preempted by the Clean Air Act; and (iii) constitutional limitations on extraterritorial regulation, namely by regulating interstate commerce in violation of the Dormant Commerce Clause.

  1. ExxonMobil sues activist investors to omit climate-related shareholder proposal

On January 21, 2024, ExxonMobil (“ExxonMobil”) filed suit in a federal district court in Texas seeking a declaratory judgment that ExxonMobil can exclude a shareholder proposal submitted by activist investor groups Arjuna Capital and Follow This from the company’s proxy materials for its 2024 annual meeting of shareholders.  The proposal asks ExxonMobil to go “beyond current plans, further accelerating the pace of emission reductions in the medium-term for its greenhouse gas (GHG) emissions across Scope 1, 2, and 3, and to summarize new plans, targets, and timetables.”  In its complaint, the company accuses the activists of being driven by an “extreme agenda,” states that the proposal “does not seek to improve ExxonMobil’s economic performance or create shareholder value,” and argues that the proposal is excludable under both the SEC’s ordinary business exception and the resubmission exception, the latter of which applies where a substantially similar proposal previously received a low level of shareholder support.  Bringing suit to exclude a shareholder proposal is unusual, as companies typically rely on informal guidance from SEC staff regarding whether proposals may be properly excluded from their proxy statements under SEC rules. ExxonMobil’s complaint also focuses on how the Staff applies Rule 14a-8, noting that changes in Staff interpretations have likely caused a significant increase in the number of proposals submitted and voted on in the last two years (an 18% increase generally from 2021 to 2023, and a 52% increase for environmental and social proposals over the same period), and that the costs of addressing a single shareholder proposal can be high (up to $150,000). Arjuna Capital and Follow This subsequently withdrew the proposal on February 2; however, ExxonMobil has indicated it will proceed with the suit.

  1. U.S. proposes fee on methane from big oil and gas producers

The U.S. Environmental Protection Agency (EPA) has proposed a methane emissions fee on major oil and gas producers that exceed established emissions thresholds. The Inflation Reduction Act (IRA) set the fee, which is applicable to new and existing facilities reporting methane emissions exceeding 25,000 metric tons of carbon dioxide equivalent annually and starts at $900 per metric ton in 2024 before reaching $1,200 in 2025, and $1,500 in 2026 and going forward.

The EPA’s methane fee is designed to target a significant portion of the sector’s emissions, which represent the largest industrial source of methane emissions in the United States according to the EPA. The EPA’s stated objective for this fee is to encourage implementation of emission reducing technology, offering compliance exemptions to facilities that demonstrate lowered emissions over time.

  1. Letter to Public Company Accounting Oversight Board (PCAOB) seeks standardized environmental attestation standards

On January 12, 2024, a group of over 25 “climate, environment, and consumer protection organizations” sent a letter to the PCAOB requesting updated attestation standards, guidance, and oversight for firms reviewing companies’ emissions- and climate-related disclosures. In particular, the letter highlighted that companies will soon be required under the California legislation discussed above (and the Securities and Exchange Commission’s proposed climate-related rules, if adopted as proposed) to publish audited climate-related disclosure at a limited and then reasonable assurance level, but that “[c]urrently, there is a lack of standardization around” what those assurance levels entail. The letter seeks a baseline from the PCAOB as to what these standards should entail to support consistency in practices and accurate information for investors.

  1. Judge’s ruling permits “carbon neutral” class action lawsuit to proceed against Danone

A New York judge, ruling on a motion to dismiss, will allow a class action to proceed against Danone challenging its “carbon neutral” claim on Evian bottles. Consumers allege they would not have purchased Evian if aware that Danone’s manufacturing process released net carbon dioxide into the atmosphere. Danone argued its use of “carbon neutral” is certified by the Carbon Trust, a global organization that provides carbon certification, but the judge found it plausible that “carbon neutral,” an “ambiguous term,” could “mislead a reasonable consumer” and that Danone “expects too much” for consumers to decipher it from Evian’s labels.

Plaintiffs can now pursue fraud, unjust enrichment, and breach of warranty claims under California and Massachusetts consumer protection laws. The ruling highlights the growing trend of class actions against consumer products disputing label accuracy and product “greenwashing.”

V. APAC

  1. A new partnership forms between the Voluntary Carbon Markets Integrity Initiative (VCMI) and the Carbon Markets Association of India (CMAI) aims to boost India’s participation in high-integrity international voluntary carbon markets (VCMs)

On January 4, 2024, The Voluntary Carbon Markets Integrity Initiative (VCMI) and The Carbon Markets Association of India (CMAI) announced a new partnership to enhance India’s involvement in international carbon markets with a focus on integrity. Some key objectives of the partnership include empowering Indian stakeholders to engage in high-integrity international carbon markets, enabling fair carbon finance flows to India, and leveraging networks to scale up carbon finance activities across priority sectors.

  1. Oman unveils new sustainable finance framework

On January 11, 2024, Oman introduced a sustainable finance framework aimed at reducing its dependency on fossil fuels and attracting Environmental, Social, and Governance (ESG) investors. The plan involves issuing various financial instruments, including green, social, and sustainability bonds, along with loans and sukuk compliant with Islamic law, to finance renewable energy projects.

  1. Australian regulator steps up enforcement on greenwashing claims

On January 7, 2024, the Financial Times reported that Australia’s corporate regulator, ASIC, remains vigilant in combatting deceptive environmental claims by investment funds, continuing its crackdown initiated in 2023 with legal action against three entities — Mercer Superannuation, Vanguard Investments Australia and Active Super.

Deputy Chair Sarah Court asserts ASIC’s firm stance against funds falsely marketing as “net zero” or “carbon neutral,” emphasizing the misleading nature of such practices. Notably, Mercer Superannuation faces a substantial penalty for allegedly misleading marketing of its Sustainable Plus fund, highlighting ASIC’s commitment to enforcing integrity in ethical investment promotions. Australia’s regulatory drive aligns with global efforts to address greenwashing, with financial authorities worldwide intensifying scrutiny to ensure compliance with ethical and environmental standards in investment marketing.

  1. China unveils comprehensive biodiversity strategy, proposing corporate disclosure and financial integration initiatives

On January 18, 2024, China’s Ministry of Ecology and Environment has unveiled its National Biodiversity Strategy and Action plan (NBSAP), outlining 27 priority actions. One particular action proposes the establishment of a corporate biodiversity disclosure framework, encouraging representative industry enterprises to identify and regularly monitor, assess, and disclose the risk, dependencies, and impact of their operations on biodiversity.

The NBSAP also encourages financial institutions to factor in biodiversity considerations into project investment and financing decisions. Other priorities include exploring a biodiversity impact index for key industries and establishing a multi-stakeholder industrial and commercial biodiversity protection alliance.

  1. China reboots voluntary carbon credit market

On 22 January, China restarted its voluntary carbon offset market, China Certified Emission Reduction (CCER), after a hiatus since 2017. The trading commenced in Beijing and reflects a strategic step in China’s environmental goals to finance economically viable and eco-friendly projects. The China Beijing Green Exchange serves as the trading platform, initially offering credits for pre-2017 projects, and is in addition to China’s national compliance carbon market. The CCER scheme will focus on four initial sectors: afforestation, solar power generation, offshore wind and mangrove planting.

The Chinese government plans to approve new project categories like solar thermal power and offshore wind energy, with the move seen as a key attempt to reduce emissions and reach renewable energy targets, allowing companies to trade carbon credits and offset their emissions.

  1. Taiwan proposes new internal control rules on ESG disclosure

On 16 January, Taiwan’s Financial Supervisory Commission (FSC) announced plans to amend internal control guidelines, making it mandatory for listed companies, securities and futures firms, and related service enterprises to include the management of ESG information in their internal control systems.

The proposed amendments aim to enhance the quality of ESG disclosure, improve companies’ ability to compile sustainable information, and include ESG management as a required audit item in annual internal audits. The FSC will provide a buffer period for companies to adjust, and the amendments are set to be effective shortly.

  1. Shenzhen and Abu Dhabi Stock Exchange sign a memorandum of cooperation

On 13 December, the Shenzhen Stock Exchange (SZSE) and the Abu Dhabi Securities Exchange (ADX) signed a memorandum of understanding (MoU) to expand cooperation and serve the integrated development of the capital markets in China and the United Arab Emirates.

The MoU aims to encourage market players from both sides to participate in cross-border index, fixed-income, and other investment product cooperation. The exchanges also agreed to jointly research the feasibility of an ETF product link and depository receipt mechanism to facilitate cross-border financing for listed companies in each other’s markets.

Please let us know if there are other topics that you would be interested in seeing covered in future editions of this update.

Warmest regards,

Susy Bullock
Elizabeth Ising
Perlette M. Jura
Ronald Kirk
Michael K. Murphy
Selina S. Sagayam

Chairs, Environmental, Social and Governance Practice Group, Gibson Dunn & Crutcher LLP


The following Gibson Dunn lawyers prepared this update: Lauren Assaf-Holmes, Elizabeth Ising, Lily Loeffler, Cynthia Mabry, Selina S. Sagayam, Saad Khan*, Yinn Lim*, and Daniel Szabo*.

Gibson Dunn lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Environmental, Social and Governance practice group:

Environmental, Social and Governance (ESG):
Susy Bullock – London (+44 (0) 20 7071 4283, [email protected])
Elizabeth Ising – Washington, D.C. (+1 202-955-8287, [email protected])
Perlette M. Jura – Los Angeles (+1 213-229-7121, [email protected])
Ronald Kirk – Dallas (+1 214-698-3295, [email protected])
Michael K. Murphy – Washington, D.C. (+1 202-955-8238, [email protected])
Patricia Tan Openshaw – Hong Kong (+852 2214-3868, [email protected])
Selina S. Sagayam – London (+44 (0) 20 7071 4263, [email protected])

*Yinn Lim, Daniel Szabo, and Saad Kahn, trainee solicitors in the London office, are not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

Amer Ahmed, Anne Champion, and Apratim Vidyarthi cover significant developments in First Amendment law, including issues taken up by the Supreme Court. They discuss the gag orders imposed on former President Trump; the survival of New York Times v. Sullivan; the First Amendment and Section 230 of the Communications Decency Act; NRA v. Vullo; and legal developments involving the First Amendment and social media. Gibson Dunn will do a follow up webcast in July analyzing newly-issued Supreme Court decisions involving the First Amendment.



PANELISTS:

Amer S. Ahmed is a partner in the New York office of Gibson, Dunn & Crutcher. He is a member of Gibson Dunn’s Litigation; Trials Practice; Appellate and Constitutional Law; and Media, Entertainment and Technology Practice Groups. Amer’s practice focuses on representing institutional and individual clients in a variety of high-profile litigation matters at the investigatory, trial, and appellate levels, ranging from witness preparation to product-liability actions, white-collar criminal defense, and commercial disputes. Amer has played a lead role in many First Amendment and defamation disputes. Among other matters, he has successfully defended The Washington Post against a libel lawsuit in federal court, won a complete dismissal of defamation claims against a leading social media company, advised technology companies on compliance issues under Section 230 of the Communications Decency Act, prosecuted defamation claims on behalf of a high-profile businessman based on a worldwide smear campaign, and is representing the online publication Media Matters for America in its defense of a defamation case lodged by X Corp. Amer authored the practice guide on Defamation and Reputation Management in the USA on Lexology. Amer graduated from Columbia Law School where he was named a Harlan Fiske Stone Scholar and served as an articles editor of the Columbia Law Review. He received his Bachelor of Arts in Human Biology, with distinction, from Stanford University, where he was a President’s Scholar and was elected to the Phi Beta Kappa Society.

He is admitted to practice in the State of New York and the District of Columbia, as well as in the Supreme Court of the United States; the United States Courts of Appeals for the District of Columbia Circuit, Second Circuit, and Fourth Circuit; the United States District Court for the District of Columbia; and the United States District Courts for the Southern and Eastern Districts of New York.

Anne M. Champion is a partner in the New York office of Gibson, Dunn & Crutcher. She is a member of the Transnational Litigation, Media Law, and International Arbitration practice groups. Anne has played a lead role in a wide range of high-stakes litigation matters, including several high profile First Amendment disputes. She represented CNN’s Jim Acosta and White House Correspondent Brian Karem in successful suits to reinstate their White House press passes, and Mary Trump in her defeat of an attempt to block publication of her best-selling book about the former President, Too Much and Never Enough: How My Family Created the World’s Most Dangerous Man, for which The American Lawyer recognized her along with Ted Boutrous and Matthew McGill as Litigators of the Week. She was previously recognized as Litigator of the Week for the successful defeat of a petition to confirm an $18 billion sham Egyptian arbitration award against Chevron Corporation and Chevron USA, Inc. She has been recognized by Lawdragon as among the “500 Leading Litigators in America,” by Chambers USA 2023 for General Commercial Litigation, and Benchmark Litigation, which named her to its 2022 list of the “Top 250 Women in Litigation.”

Anne is admitted to practice in the courts of the State of New York, the United States District Courts for the Southern, Eastern, and Northern Districts of New York, the Eastern District of Texas, and the United States Courts of Appeals for the Second Circuit, the D.C. Circuit, and the Federal Circuit.

Apratim Vidyarthi is a litigation associate in the New York office of Gibson, Dunn & Crutcher. His practice focuses on white collar, law firm defense, technology, and appellate and constitutional law, with a focus on First Amendment law. Apratim is involved in several First Amendment matters, including representing Media Matters for America in its defense against Twitter/X Corp’s defamation litigation(s), defending a former White House official’s public speech calling out social media platforms’ hosting of misinformation about covid vaccines, and defending a large technology company against a mandatory data-sharing bill. Apratim also maintains an active First Amendment pro bono docket, having recently filed amicus briefs in Gonzalez v. Trevino at the Supreme Court and in Pernell v. Lamb in the Eleventh Circuit, and defending a Jewish divorcee’s First Amendment rights to protest their ex-husbands’ refusals to grant permissions to divorce. Apratim graduated cum laude from the University of Pennsylvania Law School, where he served as Philanthropy Editor on the board of the University of Pennsylvania Law Review. He received a Master’s in Engineering from Carnegie Mellon and Bachelors degrees in Nuclear Engineering and Applied Mathematics from the University of California, Berkeley. He is admitted to practice in the State of New York.


MCLE CREDIT INFORMATION:

This program has been approved for credit in accordance with the requirements of the New York State Continuing Legal Education Board for a maximum of 1.0 credit hour, of which 1.0 credit hour may be applied toward the areas of professional practice requirement. This course is approved for transitional/non-transitional credit.

Gibson, Dunn & Crutcher LLP certifies that this activity has been approved for MCLE credit by the State Bar of California in the amount of 1.0 hour.

Gibson, Dunn & Crutcher LLP is authorized by the Solicitors Regulation Authority to provide in-house CPD training. This program is approved for CPD credit in the amount of 1.0 hour. Regulated by the Solicitors Regulation Authority (Number 324652).

Neither the Connecticut Judicial Branch nor the Commission on Minimum Continuing Legal Education approve or accredit CLE providers or activities. It is the opinion of this provider that this activity qualifies for up to 1 hour toward your annual CLE requirement in Connecticut, including 0 hour(s) of ethics/professionalism.

Application for approval is pending with the Colorado, Illinois, Texas, Virginia and Washington State Bars.

Gibson Dunn’s Workplace DEI Task Force aims to help our clients develop creative, practical, and lawful approaches to accomplish their DEI objectives following the Supreme Court’s decision in SFFA v. Harvard. Prior issues of our DEI Task Force Update can be found in our DEI Resource Center. Should you have questions about developments in this space or about your own DEI programs, please do not hesitate to reach out to any member of our DEI Task Force or the authors of this Update (listed below).

Key Developments:

On January 31, 2024, the American Alliance for Equal Rights (AAER) submitted a comment on the Department of Commerce’s proposed Business Diversity Principles (BDPs) calling for the BDPs to be scrapped. AAER took issue with four aspects of the BDPs (as it viewed them): (1) the awarding of networking opportunities, resource groups, and other benefits to “underserved communities,” including people of color; (2) the recommendation of strategies for increasing diversity in senior leadership; (3) the use of “demographic data” to assess diversity goals; and (4) the alleged lack of certain non-discrimination safeguards, such as a prohibition on quotas. AAER wrote that these principles violate the law and spirit of Section 1981, Title VII, and the SFFA decision in a way that “will likely increase, rather than diminish, discrimination in the workplace.” In a press conference on February 7, Edward Blum, the leader of AAER, said that any business that implements the BDPs “will find itself in violation of federal law—and in federal court.”

On February 2, 2024, the Supreme Court denied Students for Fair Admissions’ (SFFA) application for an emergency injunction pending appeal in Students for Fair Admissions Inc. v. U.S. Military Academy West Point, No. 7:23-cv-08262 (S.D.N.Y. 2023). SFFA sought to enjoin West Point from considering applicants’ race during the upcoming admissions cycle. On September 19, 2023, SFFA filed its initial challenge to the constitutionality of West Point’s race conscious admissions, arguing the academy should be subject to the same constitutional analysis as other schools, despite the Supreme Court’s statement in SFFA v. Harvard that the Court’s opinion did not address race-based admissions programs at the nation’s military academies “in light of the potentially distinct interests that military academies may present.” Following the district court’s denial of SFFA’s preliminary injunction on January 3, 2024, SFFA requested an emergency injunction from the Second Circuit and then the Supreme Court. In its denial, the Supreme Court reasoned that the record before the Court is “underdeveloped.” The Second Circuit, which also denied the requested injunction, concluded simply that “an injunction pending appeal is not warranted.” The case will now return to the Second Circuit for review of the district court’s denial of SFFA’s preliminary injunction.

On February 5, 2024, American Alliance for Equal Rights (AAER) filed a complaint and motion for a preliminary injunction against Hidden Star, a nonprofit organization that provides grants of $2,750 to “minority and low-income entrepreneurs” through its Galaxy of Stars grant program. The program also connects recipients to Hidden Star’s expertise and resources, including an online community. AAER claims that the program constitutes race discrimination in violation of Section 1981 because it allegedly limits eligibility for the grants to people who are a confirmable ethnic minority or female. AAER’s claims against Hidden Star echo those in its suit against Fearless Fund. Hidden Star has not yet responded to the complaint.

On February 6, 2024, America First Legal (AFL) sent a letter to the EEOC accusing the National Football League (NFL) of race and sex discrimination in violation of Title VII through its implementation of the Rooney Rule. The Rooney Rule, adopted by the NFL in 2003, initially required teams with head coach vacancies to interview at least one “diverse” candidate before making a new hire. Over the years, the Rooney Rule has been amended to include more specific requirements for minority candidates in other positions, with the goal of increasing diversity not only among head coaches, but also among general managers and executive positions. AFL’s complaint argues the NFL and its member teams “limit, segregate, or classify their employees or applicants for employment in ways that deprive at least some individuals of interview and employment opportunities specifically because of race, color, or sex.” On the same day the lawsuit was filed, AFL also sent a letter to the NFL Commissioner, demanding that appropriate measures be taken to address the alleged “assault on Constitutional equality.”

On February 7, Senators Ted Cruz (R–Texas) and John Kennedy (R–Louisiana) sent a letter to Chief Judge Diane S. Sykes of the Court of Appeals for the Seventh Circuit arguing that the courtroom policies of three active judges in the Southern District of Illinois are unethical and unconstitutional in light of SFFA. As discussed in our February 2, 2024 DEI Task Force Update, in 2020, Chief Judge Nancy J. Rosenstengel, Judge Staci M. Yandle, and Judge David W. Dugan issued standing orders announcing new procedures aimed at encouraging “newer, female, and minority attorneys” to participate in courtroom proceedings, and AFL filed a formal judicial complaint challenging those orders on January 25, 2024. Citing AFL’s complaint for support, Senators Cruz and Kennedy argue that the standing orders “discriminate on their face” and “suggest ongoing judicial race and sex discrimination.” The Senators’ letter asks the Chief Judge to respond to a series of questions regarding the number of oral arguments granted on the basis of sex, race, or experience rather than the merits of a case; a description of measures in place to screen discriminatory standing orders, empower individuals to raise concerns about discrimination, and initiate trainings in the wake of SFFA; and an explanation of the circumstances under which it would be “even theoretically inappropriate for a female or minority attorney to argue a motion.”

Media Coverage and Commentary:

Below is a selection of recent media coverage and commentary on these issues:

  • Law360, “Fla. Justices Tell State Bar To Eliminate Diversity Funding” (January 18): Law360’s Jack Karp reports on the Florida Supreme Court’s directive ordering the Florida Bar to stop funding diversity and inclusion initiatives. Karp says that the Bar intends to apply funds previously allocated to its Diversity and Inclusion Committee to a new Membership Outreach Committee, which will focus on increasing participation in the Florida Bar more generally. Karp notes that the court’s directive is consistent with an administrative order it issued in 2023 in which the court dissolved its own Standing Committee on Fairness and Diversity and eliminated a requirement that new judges attend a mandatory “fairness and diversity” training.
  • Law360, “3 Takeaways After EEOC Members Tackle DEI On Social Media” (February 2): Law360’s Vin Gurrieri reports that EEOC Commissioners are once again posting their views about DEI initiatives on X. The latest series of posts started when Commissioner Andrea Lucas told Mark Cuban he was “dead wrong” by suggesting that race and gender can be “part of the equation” in hiring decisions. EEOC Vice Chair Jocelyn Samuels responded in her own post that DEI was good for business and lawful, explaining that “reducing barriers to equal opportunity is not the same as unfairly putting a thumb on the scale.” Gurrieri explains that these social media posts “may mask [a] broader consensus” about legal requirements among the commissioners, and that “[a]ny daylight in the commissioners’ viewpoints lies more in exactly how DEI programs are crafted rather than disputes about the law.” Gurrieri also recommends that employers avoid relying on social media posts over available formal EEOC resources. He notes that some experts believe the Supreme Court may offer further insight on DEI “sooner rather than later,” highlighting related questioning by the Justices in the recent Muldrow v. City of St. Louis argument.
  • Wall Street Journal, “Corporate America Tweaks Diversity Initiatives Amid Pushback” (February 5): The Wall Street Journal’s Richard Vanderford examines the changing landscape among corporate America’s diversity initiatives. The article catalogs some of the diversity programs that many companies implemented following the death of George Floyd, some of which, according to Johnny Taylor Jr., the head of the Society for Human Resource Management, “were questionable.” Vanderford explains how a recent flurry of lawsuits and increased scrutiny of these programs, particularly those with quota-like targets, has forced corporations to pivot, restructuring their programs to accomplish the same goals without attracting attention from plaintiffs’ lawyers. While diversity initiatives are sure to exist into the foreseeable future, Vanderford notes that many advisers suggest focusing on inclusion to shield companies from unwanted attention.
  • Wall Street Journal, “The Case Against Bill Ackman and Elon Musk’s Anti-DEI Stance” (February 7): The Wall Street Journal’s Tali Arbel comments on a letter sent by a coalition of minority business owners to Fortune 500 CEOs. The letter, published on February 7, 2024, calls upon Fortune 500 CEOS to support DEI efforts despite opposition from a “vocal minority of ideologically motivated voices.” Arbel notes that the letter responds to billionaires Elon Musk and Bill Ackman’s recent criticism of DEI, as well as litigation efforts challenging pro-DEI corporate initiatives, saying that the opposition to DEI is “out of step with most business leaders.” The letter also provides evidence that pro-DEI efforts are both popular with the public and profitable. Cosigners of the letter include presidents and CEOs of organizations that advance the interests of racial minorities, women, veterans, and LGBT individuals.

Case Updates:

Below is a list of updates in new and pending cases:

1. Contracting claims under Section 1981, the U.S. Constitution, and other statutes:

  • Bradley, et al. v. Gannett Co. Inc., 1:23-cv-01100-RDA-WEF (E.D. Va. 2023): On August 18, 2023, white plaintiffs sued Gannett over its alleged “Reverse Race Discrimination Policy,” claiming Gannett’s expressed commitment to having its staff demographics reflect the communities it covers violates Section 1981. On November 24, Gannett moved to dismiss, arguing that the plaintiffs failed to plead specific facts connecting the allegedly discriminatory policy with plaintiffs’ own differential treatment on the basis of race. Gannett also moved to strike the plaintiffs’ class action allegations.
    • Latest update: On January 22, 2024, the plaintiffs filed their opposition to Gannett’s motion to dismiss, arguing that hiring demographics can only legally reflect the hiring pool—rather than the overall community—and specifying alleged instances of differential treatment. The plaintiffs also opposed Gannett’s motion to strike the class allegations, claiming that the proposed class is ascertainable and challenges to the class definition are premature. On January 29, 2024, Gannett filed its reply, arguing that without any factual allegations of harm, the plaintiffs’ complaint is properly construed as a facial challenge of Gannett’s policy, which is not a legally viable claim under Section 1981. Gannett also contended that the plaintiffs could not show that the policy was the but-for cause of any adverse employment actions. Finally, Gannett argued that the purported class of plaintiffs is insufficiently ascertainable to support a class action. On February 8, 2024, the plaintiffs moved for class certification and a preliminary injunction against Gannett’s policy, claiming that each passing day denies the proposed class the opportunity of equal employment, causing them irreparable harm. The court set a hearing for March 13, 2024.
  • Harker v. Meta Platforms, Inc. et al., No. 23-cv-07865-LTS (S.D.N.Y. 2023): A lighting technician who worked on a set where a Meta commercial was produced sued Meta and a film producers association, alleging that their diversity initiative Double the Line (“DTL”) violated Title VII, Sections 1981 and 1985, and New York law. The plaintiff also claimed that he was retaliated against after raising questions about the qualifications of a coworker hired under DTL. On December 19, 2023, the defendants filed their motions to dismiss the plaintiff’s first amended complaint.
    • Latest update: On January 25, 2024, the plaintiff filed his oppositions to the defendants’ motions to dismiss. The plaintiff argued that he was qualified for the program but excluded due to the defendants’ discriminatory conspiracy. He also argued that the defendants misconstrued his allegations as a failure-to-hire employment claim, rather than a claim of interference with his right to freely contract under Section 1981. He maintained that his complaint should survive regardless of whether the defendants interfered with his employment or right to contract, because under either theory, the defendants’ actions violated Section 1981.
  • Mid-America Milling Company v. U.S. Dep’t of Transportation, No. 3:23-cv-00072-GFVT (E.D. Ky. 2023): Two plaintiff construction companies sued the Department of Transportation, asking the court to enjoin the DOT’s Disadvantaged Business Enterprise Program (DBE), an affirmative action program that awards contracts to minority-owned and women‑owned small businesses in DOT-funded construction projects with the statutory aim of granting 10% of certain DOT-funded contracts to these businesses nationally. The plaintiffs alleged that the program constitutes unconstitutional race discrimination in violation of the Fifth Amendment. On December 15, 2023, the plaintiffs filed a motion for a preliminary injunction, requesting that the court prohibit the defendants from implementing or enforcing the DBE program’s race and gender requirements and its goals of minority participation. On January 16, 2024, the DOT filed its motion to dismiss the complaint.
    • Latest update: On January 26, 2024, the DOT filed its opposition to the plaintiffs’ motion for a preliminary injunction. The DOT first argued that the plaintiffs did not have a likelihood of success on the merits because they lack standing, but that even if they had standing, the DOT’s program would survive strict scrutiny. The DOT also argued that the plaintiffs are not at risk of irreparable harm because they have not identified current contracts that have race- or gender-based subcontracting goals under the program. Finally, the DOT argued that the balance of the equities weighed in favor of the government, which has an interest in remedying past and ongoing discrimination in the transportation industry.

2. Employment discrimination under Title VII and other statutory law:

  • Hoffman v. Bd. Of Regents of the Univ. of Wis. Sys., No. 23-cv-00853-SLC (W.D. Wis. 2023): On December 14, 2023, a white University of Wisconsin-Eau Claire employee sued the UW system, alleging that she was forced to resign from her role as interim director of the university’s Office of Multicultural Student Services due to her “race and color.” The employee claims that she was subjected to a hostile work environment on the basis of her race and that she experienced “constructive demotions” in violation of Title VII.
    • Latest update: Defendants’ response to the complaint is due on February 26, 2024.

3. Challenges to agency rules, laws, and regulatory decisions:

  • Valencia AG, LLC v. New York State Off. of Cannabis Mgmt. et al., No. 5:24-cv-00116-GTS-TWD (N.D.N.Y. 2024): On January 24, 2024, Valencia AG, a cannabis company owned by white men, sued the New York State Office of Cannabis Management for discrimination, alleging that New York’s Cannabis Law and implementing regulations favored minority-owned and women-owned businesses. The regulations include goals to promote “social & economic equity” (“SEE”) applicants, which the company claims violates the Equal Protection Clause and Section 1983.
    • Latest update: On February 7, 2024, the plaintiff filed a motion for a temporary restraining order and preliminary injunction, seeking to prohibit the defendants from implementing the regulations, charging SEE applicants reduced fees, or preferentially granting SEE applicants’ applications. The plaintiff argued it has a strong likelihood of success on the merits because race- and sex-based discrimination is presumptively invalid. The plaintiff asserted that it will suffer irreparable harm because earlier entrants to the market receive benefits like customer loyalty. The plaintiff also argued the balance of equities weighs in its favor because resolving a constitutional violation serves the interests of justice and dismantling the program now rather than after trial prevents a “chaotic mess.” Defendants’ response to the complaint is due on February 21, 2024.

4. Board of Director or stockholder actions:

  • Craig v. Target Corp., No. 2:23-cv-00599-JLB-KCD (M.D. Fl. 2023): America First Legal sued Target and certain Target officers on behalf of a stockholder, claiming the board falsely represented that it monitored social and political risk, when it allegedly focused only on risks associated with not achieving ESG and DEI goals. The plaintiffs claimed that this focus depressed Target’s stock price, alleging violations of Sections 10(b) and 14(a) of the Securities Exchange Act of 1934.
    • Latest update: On January 26, 2024, Target and its officers filed a motion to dismiss and a request to transfer venue to the District of Minnesota. In their motion to dismiss, the defendants emphasized that Target repeatedly warned investors of risks associated with its DEI and ESG initiatives, and that the plaintiffs have conceded that they were warned. The defendants also argued that the plaintiffs failed to plead sufficient facts showing that Target’s alleged misstatements were materially false or misleading, made with scienter, or caused plaintiffs to suffer losses. Finally, the defendants stressed that “disagreeing with Target’s business judgment does not give rise to an actionable claim under the securities laws.” In support of their motion to transfer to the District of Minnesota, where Target is headquartered, the defendants explained that transfer of venue serves justice and judicial economy because Minnesota is where the underlying decisions and events occurred and is home to the majority of key figures. Plaintiffs’ response to both motions is due March 1, 2024.

The following Gibson Dunn attorneys assisted in preparing this client update: Jason Schwartz, Mylan Denerstein, Blaine Evanson, Molly Senger, Zakiyyah Salim-Williams, Matt Gregory, Zoë Klein, Mollie Reiss, Alana Bevan, Marquan Robertson, Janice Jiang, Elizabeth Penava, Skylar Drefcinski, Mary Lindsay Krebs, and David Offit.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Labor and Employment practice group, or the following practice leaders and authors:

Jason C. Schwartz – Partner & Co-Chair, Labor & Employment Group
Washington, D.C. (+1 202-955-8242, [email protected])

Katherine V.A. Smith – Partner & Co-Chair, Labor & Employment Group
Los Angeles (+1 213-229-7107, [email protected])

Mylan L. Denerstein – Partner & Co-Chair, Public Policy Group
New York (+1 212-351-3850, [email protected])

Zakiyyah T. Salim-Williams – Partner & Chief Diversity Officer
Washington, D.C. (+1 202-955-8503, [email protected])

Molly T. Senger – Partner, Labor & Employment Group
Washington, D.C. (+1 202-955-8571, [email protected])

Blaine H. Evanson – Partner, Appellate & Constitutional Law Group
Orange County (+1 949-451-3805, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

We are pleased to provide you with the next edition of Gibson Dunn’s digital assets regular update. This update covers recent legal news regarding all types of digital assets, including cryptocurrencies, stablecoins, CBDCs, and NFTs, as well as other blockchain and Web3 technologies. Thank you for your interest.

ENFORCEMENT ACTIONS

UNITED STATES

  • SDNY Hears Coinbase Motion Seeking to End SEC Lawsuit
    On January 17, the United States District Court for the Southern District of New York heard arguments on Coinbase’s motion for judgment on the pleadings in the enforcement action that the SEC has brought against the crypto exchange. The SEC, which brought the action in June, contended that certain digital-asset transactions meet the Supreme Court’s four-part Howey test for establishing the existence of an investment-contract security. Key to the lawyers’ disagreement was whether token purchasers actually obtain a “contract” when they purchase digital assets. The SEC argued that purchasers buy into a “token ecosystem” that acts as a common enterprise, and that each transaction in that ecosystem operates as a contract. Counsel for Coinbase disagreed, stating that an investment contract requires “a statement that is meant to convey an enforceable promise” and that the difference between digital assets and securities is akin to “the difference between buying Beanie Babies Inc. and buying Beanie Babies.” Over four hours, Judge Katherine Polk Failla asked questions of both sides. She questioned the agency’s proposed legal standard, particularly whether it was “sweeping too broadly” and would raise the “specter of collectibles being regulated by the SEC.” Reuters, CoinDesk, WSJ, Yahoo Finance.
  • SDNY Rules that Terraform Labs Sold Unregistered Securities
    On December 28, the U.S. District Court for the Southern District of New York ruled that Terraform Labs, a blockchain developer, offered and sold unregistered securities. Applying the Supreme Court’s Howey test, Judge Jed Rakoff concluded that Terraform’s tokens, TERRA and LUNA, were investment-contract securities. While Judge Rakoff granted summary judgment on the question of whether Terraform sold unregistered securities, he dismissed the SEC’s fraud claims against Terraform. A civil trial over Terraform’s alleged securities violations is set to begin on March 25, 2024. Reuters; CoinDesk; Reuters.
  • Binance Seeks Dismissal of Claims in Dispute with SEC
    On January 22, Judge Amy Berman Jackson of the U.S. District Court for the District of Columbia heard argument on Binance Holding Limited’s and BAM Trading Services’s motions to dismiss a lawsuit brought by the SEC. The SEC has alleged, among other things, that Binance.com and Binance.US offered and sold unregistered securities and facilitated their trading without proper registration. Among other things, BHL and BAM contend that the crypto assets at issue are not securities and are therefore outside the scope of the securities laws, and that the SEC’s claims concerning transactions on Binance.com impermissibly seek to extend the securities laws beyond U.S. borders. During the motion-to-dismiss hearing, Judge Jackson questioned the SEC’s lawyers on the scope of the agency’s theories, remarking at one point that the agency’s arguments would seem to suggest that “all digital assets, at the end of the day, have the earmark of securities.” Judge Jackson also pushed the SEC on why the agency had taken so long to begin enforcement against digital asset companies. “[W]here has the agency been,” she asked, “if it’s so obvious that these are securities”? Reuters, Yahoo Finance, Law360.
  • FTX Abandons Efforts to Revive Defunct Crypto Exchange and Focuses on Repaying Customers
    On January 31, attorneys for the now-defunct cryptocurrency exchange FTX informed the United States Bankruptcy Court for the District of Delaware that FTX’s restructuring plans would focus on repaying customers in full but would not include a reboot of the trading platform. Counsel for FTX noted that the firm would “anticipate filing a disclosure statement in February describing how customers and general unsecured creditors will eventually be paid in full.” The statement comes after a December 2023 ruling that sided with FTX’s debtors, who proposed that claimants receive repayments based on the prices of crypto assets at the time of FTX’s bankruptcy. However, attorneys for FTX stated that “[t]he costs and risks of creating a viable exchange from what Mr. [Sam] Bankman-Fried left in a dumpster were simply too high.” Guardian; CoinDesk; Cointelegraph.
  • DOJ Charges Creator of BTC-e Crypto Exchange with Money Laundering
    In December 2023, Latvian authorities arrested Belarusian-Latvian entrepreneur Aliaksandr Klimenka at the behest of U.S. authorities. On January 30, 2024, the Department of Justice unsealed the indictment against Mr. Klimenka. The DOJ has charged Mr. Klimenka for allegedly laundering more than four billion dollars’ worth of proceeds from criminal activities from the now-defunct cryptocurrency exchange platform BTC-e from 2011 to 2017. The indictment further alleges that BTC-e was a cybercrime and money laundering entity that developed a reputation for criminal activity by facilitating crimes including hacking, fraud, identity theft, public corruption, and drug trafficking. The DOJ’s allegations in the indictment also include that BTC-e was not registered as a money services business with the Department of Treasury despite doing substantial business within the country. If convicted, Mr. Klimeka could face up to 25 years in prison. DOJ; CoinDesk.
  • DOJ Charges Three Individuals With Siphoning $400 Million from FTX in SIM-Swap Fraud
    On January 24, the DOJ charged three suspects with the high-profile theft of $400 million from FTX accounts on the day that the exchange filed for bankruptcy. In the indictment, prosecutors alleged that Robert Powell, Emily Hernandez, and Carter Rohn had used a fake ID with FTX employee credentials to transfer the employee’s mobile phone account to another SIM card, access authentication codes, and drain the exchange’s crypto wallets. The DOJ further alleges that the trio pulled off a number of other crypto heists, including a $1 million theft from another victim also in early November 2022. WSJ; Bloomberg.
  • FTX Customers File Suit Over Digital Asset Ownership
    On February 1, customers of the now-defunct cryptocurrency exchange FTX filed a Chapter 11 adversary suit in Delaware bankruptcy court. The plaintiffs argue that they own the digital assets that were held in their customer accounts and, consequently, that the customers should not be treated as secured creditors and that the digital assets in their accounts should not be considered as part of the bankruptcy estate. FTX filed for Chapter 11 protection in November 2022 after the exchange collapsed under a surge of customer withdrawals. Law360.
  • Prosecutors Decide Not to Proceed with Second Trial Against Sam Bankman-Fried
    On December 29, prosecutors informed a New York federal court that they would not pursue a second trial against FTX founder Sam Bankman-Fried. In November 2023, Mr. Bankman-Fried was convicted on seven counts concerning fraud and conspiracy against FTX customers and FTX’s sister hedge fund, Alameda Research. An additional trial was scheduled to begin in March 2024 concerning several more criminal counts on conspiracy and substantive securities and commodities fraud. But prosecutors dropped the charges, explaining that “a second trial would not affect the United States Sentencing Guidelines range for the defendant, because the court can already consider all of this conduct as relevant conduct when sentencing him for the counts that he was found guilty of at the initial trial.” Sentencing is scheduled for March 28, 2024. CNBC; Reuters.
  • BarnBridge DAO and SEC Reach Settlement
    On December 22, BarnBridge DAO, which runs a small DeFi protocol, reached a more than $1.7 million settlement with the SEC to settle charges for failing to register the offer and sale of cryptocurrency, and its two founders, Tyler Ward and Troy Murray, will each pay a civil penalty of $125,000. According to the SEC, the DAO’s SMART Yield bonds pooled cryptocurrencies deposited by investors and then used those assets to generate returns to pay investors, collecting at least $509 million from crypto investors, including some investors who reside in the U.S. According to the SEC, BarnBridge compared the SMART Yield bonds to asset-backed securities and marketed them to the public. In a press release regarding the settlement, Gurbir S. Grewal, director of the SEC’s Division of Enforcement, said that “[t]he use of blockchain technology for the unregistered offer and sale of structured finance products to retail investors runs afoul of the securities laws,” and further stated that “[t]his case serves as an important reminder that those laws apply to all who wish to access our capital markets, regardless of whether they are, or purport to be, incorporated, decentralized or autonomous.” BarnBridge agreed to shut down its SMART Yield bonds. SEC;The Block; CoinDesk; Cointelegraph.
  • SEC, Genesis Agree to $21 Million Settlement in Crypto Enforcement Action
    On February 1, the SEC and Genesis asked a New York judge to approve a settlement that would end the SEC’s enforcement action by granting the SEC a subordinated claim for a $21 million civil penalty. In January 2023, the SEC filed a civil action alleging that Genesis had engaged in the unregistered sale of securities. Law360.
  • Abra Settles with Texas State Securities Board
    On January 23, Crypto lender Abra resolved the Texas State Securities Board’s allegations that it offered unregistered investment contracts and failed to disclose its financial difficulties. Abra agreed to return $1.8 million to Texas investors and to pay an administrative fine that will be rescinded once the firm demonstrates that it has returned investors’ funds. The Texas State Securities Board chose not to pursue a monetary penalty against Abra because of the company’s potential insolvency. The investigation is part of a broader investigation by state securities regulators, and the settlement allows other states to participate under the same terms as Texas, paving the way for approximately 12,000 U.S. investors to claim approximately $13.6 million. Law360.
  • Department of Energy Seeks Information Regarding Cryptocurrency Mining Energy Consumption
    On January 31, the Energy Information Administration (EIA), a statistics agency under the Department of Energy (DOE), announced that it is initiating an emergency mandatory survey requiring information related to electricity consumption from cryptocurrency mining companies operating in the U.S. The survey, which will run from February through July 2024, will require companies to provide information on mining activities, quantity and type of chip use, electricity consumption, and the names of energy companies with which the miner has signed agreements, among other data collection. The EIA says that developing more information about cryptocurrency mining in the U.S. and its effects on electricity demand is important to provide context for energy policymakers, energy planners, and the general public. Some stakeholders have raised concerns that the mandatory survey represents a campaign against bitcoin mining, cryptocurrency, and U.S.-led innovation, and that the data collected could be used to pressure energy companies to cease working with crypto miners. EIA Statement; CoinDesk; CoinDesk; Smart Energy International.

INTERNATIONAL

  • Nexo’s Money Laundering Investigation in Bulgaria Closed Due to Lack of Evidence
    In January 2023, Bulgarian prosecutors launched an investigation into crypto lender Nexo and executives Kosta Kanchev, Antoni Trenchev, Trayan Nikolov, and Kalin Metodiev, for alleged money laundering, tax offenses, banking without a license, and computer fraud. However, on December 22, the Bulgarian Prosecutor’s Office closed its investigation due to lack of evidence of criminal activity, dropping all charges against Nexo and the executives. According to an official statement from the Prosecutor’s Office, the main reasoning behind the decision to drop all charges was that Nexo’s crypto assets are not considered financial instruments in the country and reside outside of laws for payment services and systems. “The dropping of all charges made against Nexo and its executives by the Bulgarian Prosecutor’s Office, with their confirmation that there were no crimes, unequivocally shows that the whole attack on Nexo was political and should not have happened in the first place,” Nexo co-founder and managing partner Antoni Trenchev said. CoinDesk; The Block; Cointelegraph.
  • Alberta Securities Commission Commences Investigation into Crypto Exchange Platform Catalyx After Catalyx Suspends Operations
    On December 28, Canadian crypto exchange platform Catalyx announced that its management had discovered a security breach that resulted in the loss of “a portion of crypto assets.” Following this announcement, Catalyx suspended its trading, deposits, and withdrawals. By ceasing trade on its site, Catalyx complied with an interim order from the Alberta Securities Commission (ASC) on December 21 that required the platform to cease trading for fifteen days. On January 5, the ASC filed an extended order prohibiting the platform and its CFO, Jae Ho Lee, from trading or purchasing securities and derivatives until January 2025. The ASC is also investigating whether Catalyx and Lee breached Alberta’s securities laws and whether the platform breached its responsibilities in its pre-registration undertaking. CoinDesk; Alberta Securities Commission.

REGULATION AND LEGISLATION

UNITED STATES

  • SEC Approves Spot Bitcoin ETPs
    On January 10, the SEC, finding sufficient means of preventing fraud and manipulation, approved the listing and trading of 11 spot bitcoin exchange-traded products (ETP). SEC Chair Gary Gensler stated that the Commission’s decisions were “the most sustainable path forward” in light of “changed” circumstances, notably the D.C. Circuit’s recent holding that the SEC failed to adequately explain its disapproval of Grayscale’s proposed ETP. Commissioner Hester Peirce celebrated the decision but criticized the Commission for having previously deprived “investors of the opportunity to gain exposure to bitcoin in a more convenient and investor-friendly way.” In their first week, the 11 approved spot ETPs saw a cumulative trading volume of $14 billion. The SEC requires that sponsors of bitcoin ETPs fully disclose their products in public registration statements and periodic filings. Notwithstanding the SECs approval of Bitcoin ETPs, the Commission is currently reviewing several other digital currency ETPs whose approval remains uncertain. Financial Times; Reuters; CoinDesk; Chair Statement; Commissioner Statement; ThinkAdvisor.
  • Receipts Depository Corporation to Issue Bitcoin-Based Depository Receipts
    On January 4, Receipts Depository Corporation (RDC) announced the launch of the first Bitcoin depository receipt. Depository Receipts are exempt from registration under the Securities Act of 1933 to Qualified Institutional Buyers. PR Newswire; The Block; Coin Market Cap.
  • IRS’s New Crypto Tax Reporting Laws Postponed
    On January 16, the IRS postponed a new requirement that businesses and professional traders receiving over $10,000 of cryptocurrencies report the transactions to the IRS. The IRS has been critiqued for not providing enough guidance as to what would qualify as a “trade or business” subject to the reporting requirements, and the announcement does not indicate when the IRS will publish additional guidance. The reporting requirements would include submitting the names, addresses, and Social Security number of the sender, as well as the date, amount and the nature of the transaction. It remains to be seen how a DAO would comply with these requirements. In June 2022, Coin Center filed suit against the Treasury Department, challenging the constitutionality of these reporting requirements. The case is still pending. Blockworks; Coin Center; Yahoo; JDSupra; IRS Announcement.
  • New York State Comptroller Issues Report on State Department of Financial Services Crypto Oversight
    The Office of the New York State Comptroller issued an audit report of the New York Department of Financial Services’ (DFS) oversight of virtual currency licensing. The report found that DFS lacked policies and procedures to provide assurance that the “oversight of the application, supervision and examination of BitLicensees was appropriate.” The report charges the agency, which is the only U.S. regulator with comprehensive rules for virtual assets, of falling short in several areas. DFS’s shortcomings included missing fingerprint data, unavailable information on applicants’ tax obligations, long gaps between risk assessments and applicant approvals, missing financial information and insufficient cybersecurity compliance from BitLicensees. CoinDesk; Audit Report.
  • Commodity Future Trading Commission (CFTC) Issues Report on Decentralized Finance
    On January 8, the CFTC’s Digital Assets and Blockchain Technology Subcommittee of the Technology Advisory Committee released a report entitled Decentralized Finance (DeFi). The report argues that DeFi’s benefits and risks depend on the design and features of specific systems. It emphasizes that DeFi systems lack clear lines of responsibility and accountability and that the inherent anonymity of the DeFi ecosystem opens the door to money laundering and terrorism financing. The report calls on policymakers to identify and prioritize projects based on the nature and scale of the risks arising in connection with DeFi and to focus on digital identity, know your customer (KYC), and anti-money laundering (AML) regimes as well as calibration of privacy in DeFi. CoinDesk; CFTC Commissioner Statement; Report.
  • The Financial Industry Regulatory Authority (FINRA) Adds Cryptocurrency Asset-related Activity to Its Annual Report
    On January 9, FINRA issued its annual regulatory oversight report that provides member brokerage firms and exchange markets with compliance and regulatory guidance. The report covers 26 topics and focuses on cybersecurity, cryptocurrency assets, and artificial intelligence’s potential impact on regulatory obligations. The report advises member firms seeking to engage in crypto asset-related activity to identify and address relevant regulatory and compliance challenges and risks. This includes reviewing and evaluating their supervisory programs and controls, their compliance policies and procedures in areas such as cybersecurity, AML compliance, communications with customers, manipulative trading, performing due diligence on crypto asset private placements, and supervising their associated persons’ involvement in crypto asset-related outside business activities and private securities transactions. Planadviser; FINRA Report.
  • FINRA Crypto Asset Sweep Finds False and Misleading Statements and Misrepresentations
    On January 23, FINRA published a report of crypto assets that found “potential substantive violations” in 70% of the materials that it reviewed. FINRA’s targeted crypto asset sweep, which began in November 2022, found numerous violations of Rule 2210, which requires fair and balanced communications from broker dealers. FINRA found instances in which firms failed to differentiate between crypto assets offered directly and those offered through affiliates, implications that crypto assets functioned like cash, and comparisons of crypto assets to stocks, and unclear and misleading explanations of how crypto assets work. Law360; FINRA Update.

INTERNATIONAL

  • Coinbase Approved as Virtual Asset Services Provider in France
    On December 12, Coinbase announced that it received registration as a Virtual Asset Services Provider (VASP) in France, allowing it to offer a “full suite of retail, institutional, and ecosystem products and services” in the country. In a statement, the company said: “Today we have reached a significant milestone in Coinbase’s continued international expansion journey . . . . This registration allows Coinbase to operate in France, continuing our plans to grow across Europe.” Registering as a VASP allows the exchange to offer custody of digital assets, buying and selling of digital assets for fiat currency and trading of digital assets. Coinbase; CoinDesk.
  • U.K. Issues Regulations for Digital Assets Sandbox
    On December 18, the U.K. introduced new regulations that allow the Financial Conduct Authority (FCA) and the Bank of England to operate the Digital Securities Sandbox (DSS) for tokenized securities. Since January 8, U.K.-based investment exchanges, recognized central counterparties, and central securities depositories and investment firms have been allowed to apply to participate in the sandbox to test new solutions and products under regulatory supervision. CoinDesk; Blockworks; U.K. Regulations.
  • Hong Kong Regulators Say They Are Ready to Consider Spot ETF Applications
    In a joint circular issued on December 22, Hong Kong’s Securities and Futures Commission (SFC) and Monetary Authority (HKMA) said that regulators are ready to consider applications for spot crypto exchange-traded funds (ETFs). In addition to existing crypto futures ETFs, the SFC said that it is “prepared to accept applications for the authorisation of other funds with exposure to virtual assets, including virtual asset spot exchange-traded funds (VA spot ETFs).” The SFC said that cryptocurrency transactions conducted by ETFs must occur through SFC-licensed crypto platforms or authorized financial institutions. In contrast to the widespread crackdown on cryptocurrency activities in mainland China, Hong Kong has been receptive to crypto firms over the past year, and its government has actively encouraged those firms to collaborate with banks. “The virtual asset landscape has evolved rapidly and begun to expand into mainstream finance,” the SFC and HKMA said in the joint statement, further noting that demand for such products has increased in Hong Kong. Cointelegraph; The Block; CoinDesk; Blockworks; Joint Circular.
  • Nigeria Lifts Restrictions on Bank Accounts for Crypto Firms
    In a circular sent to banks on December 22, the Central Bank of Nigeria (CBN) announced that it has lifted restrictions on Nigerian banks facilitating cryptocurrency transactions, stating that the increasing global demand and adoption of crypto has made it unjustifiable to maintain the country’s restrictions imposed on financial institutions in 2021. The 2021 order banned banks from crypto-related transactions. Now, the CBN has provided clear guidelines to banks supporting crypto, but with stringent KYC and AML checks. The guidelines aim to establish minimum standards and requirements for establishing banking relationships and opening accounts for virtual asset service providers (VASPs) in Nigeria. However, the statement emphasized that financial institutions are still prohibited from holding, trading, or conducting transactions in cryptocurrency using their own accounts. Further, VASPs in the country will need to be regulated by Nigeria’s SEC before being allowed to operate in the country, and must deposit at least 500 million Naira (~$550,000 USD) in a bank account in order to obtain a license. Nigeria, Africa’s most populous nation, has seen growing crypto adoption in recent years. Cointelegraph; The Block; Bloomberg; CBN Circular.
  • Japan’s Cabinet Proposes Scrapping Corporate Tax on Unrealized Crypto Gains
    On December 25, Japan’s cabinet approved a fiscal year 2024 tax regime revision that would exclude corporations from paying tax on unrealized crypto gains if they hold the assets longer term. The revision would be applied to companies that own cryptocurrencies issued by third parties. Currently, third-party-issued cryptocurrencies held by corporations are regarded as profits or losses based on the difference between market value and book value at the end of the fiscal year. The revision intends to stipulate that such mark-to-market valuation would no longer be applied if companies hold the assets for the long term, meaning companies would be taxed only on profits generated from the sale of cryptocurrency. However, the proposed revision still needs to be submitted for full legislative approval by the Diet, Japan’s parliament, which began an ordinary session on January 26 that is set to run through June 23. The Block; CoinDesk.
  • Argentinian President Milei Introduces Sweeping Crypto Asset Regularization Bill
    On December 27, newly elected President of Argentina, Javier Milei, introduced sweeping omnibus legislation that seeks to regularize the use of assets, including crypto holdings. Under President Milei’s proposed asset regularization program, Argentinian citizens who declare both foreign and domestic crypto assets before March 31, 2024, will receive a five-percent flat tax on those assets without providing additional documentation on the original source of those assets. Citizens who declare after March 31, 2024, will see that tax rate increase to as high as fifteen percent by November 30, 2024. The bill—which has faced strong public opposition—comes as part of President Milei’s promise to change or deregulate hundreds of economic regulations in order to revive the country’s struggling economy. CoinDesk; Yahoo Finance; Business Insider.
  • South Korea Proposes Ban on Credit Card Payments for Cryptocurrencies
    On January 3, South Korea’s Financial Services Commission (FSC) announced plans to prohibit local citizens from purchasing cryptocurrency with credit cards, citing risks about the illegal outflow of domestic funds overseas. Cointelegraph; CoinDesk; FSC Proposal.

CIVIL LITIGATION

UNITED STATES

  • Bankman-Fried Reaches Settlement With FTX Debtors Over Embed Deal
    On December 22, three debtors of bankrupt cryptocurrency exchange FTX—Alameda Research Ltd., West Realm Shires Inc., and West Realm Shires Services Inc.—announced that they had reached a settlement with convicted former chief executive Sam Bankman-Fried and two of his former associates, cofounder Gary Wang and former head of engineering Nishad Singh, resolving some claims over the 2022 acquisition of stock trading platform Embed. Under the deal, the FTX debtors will recover 100% of the value that Bankman-Fried, Wang, and Singh obtained in connection with the Embed acquisition, and also all assets held under the defendants’ names at Embed. The deal solely resolves one set of claims filed by the debtors related to the acquisition, accusing Bankman-Fried, Wang, and Singh of using $248 million of misappropriated FTX group funds and assets to pay for their shares of Embed. The debtors are seeking bankruptcy court approval of the settlement. Law360.
  • Celsius Exits Chapter 11 Bankruptcy and Begins Transition from Crypto Lender to Bitcoin Miner
    On January 31, Celsius Network announced that it had officially resolved its Chapter 11 bankruptcy and would start distributing over $3 billion to creditors. The United States Bankruptcy Court for the Southern District of New York approved Celsius Network’s bankruptcy plan on November 9, 2023, resolving a restructuring process that began over 18 months ago after Celsius filed for Chapter 11 bankruptcy in July 2022. Pursuant to the approved bankruptcy plan, Celsius’ creditors will receive cryptocurrency, fiat, and common stock in a new bitcoin mining company. Celsius will now begin to wind down its operations, including discontinuing their mobile and web applications. Reuters; The Block; Business Wire; CoinDesk.

SPEAKER’S CORNER

UNITED STATES

  • SEC Denies Coinbase Rulemaking Petition; Coinbase Sues
    On December 15, the SEC by a 3–2 vote denied Coinbase’s petition for rulemaking, which asked the agency to clarify its views on whether and how the securities laws apply to digital assets. The Commission said in a short letter denying the petition that it would not propose new rules because it disagreed that current regulations are “unworkable” for the digital asset industry. SEC Chair Gary Gensler issued a statement in support of the Commission’s denial. Commissioners Hester Peirce and Mark Uyeda issued a dissenting statement saying that Coinbase’s petition “raises issues presented by new technologies and other innovations, and addressing these important issues is a core part of being a responsible regulator.” Coinbase has filed a petition for review in the United States Court of Appeals for the Third Circuit challenging the SEC’s denial. Chair Statement; Peirce and Uyeda Statement; Reuters.
  • Donald Trump Opposes Creation of Central Bank Digital Currency (CBDC)
    In a New Hampshire campaign speech, former President Donald Trump promised to prevent the creation of a CBDC if reelected. On January 22, Trump called such a currency a “dangerous threat to freedom” that would give the federal government “absolute control over your money.” Trump joined other Republican presidential candidates in opposing a U.S. CBDC and credited former presidential candidate Vivek Ramaswamy for his position. Republican Majority Whip Tom Emmer praised Trump’s opposition to a CBDC and said that he looked forward to working with Trump “against the expanding government surveillance state.” Bloomberg; CoinDesk; CoinTelegraph.
  • Federal Reserve Publishes Paper Examining Impacts of CBDCs and Stablecoins on Monetary Policy Implementation
    On January 16, Federal Reserve economists published a paper examining the implications of introducing new types of “fixed-rate financial assets” in the financial system, including retail and wholesale CBDCs and stablecoins, on the Federal Reserve’s implementation of monetary policy. The paper is another in a series of papers issued by Federal Reserve staff that have explored CBDCs, stablecoins, blockchain technology, tokenization and other forms of financial innovation, and their impacts on the traditional banking sector and the Federal Reserve’s monetary policy toolkit. Release; Paper.

INTERNATIONAL

  • Chinese Central Bank Urges World to Jointly Regulate Crypto
    In its latest financial stability report published on December 22, the People’s Bank of China (PBoC) has addressed issues related to cryptocurrency regulation and decentralized finance, stressing the need for the industry to be regulated using joint efforts by different countries. The PBoC also reports that the cryptocurrency market accounts for 1% of the global financial system, and its connection with traditional finance is limited. The PBoC called on governments worldwide to apply the approach of “same business, same risks, same supervision” to avoid regulatory arbitrage, referring to vulnerabilities to hacker attacks, market manipulation, and concerns related to DeFi government mechanisms. The report is reportedly the first financial stability report of the PBoC that has devoted a separate section to crypto assets. Cointelegraph; Financial Stability Report.

OTHER NOTABLE NEWS

  • Arkon Energy Raises $110M to Grow U.S. Bitcoin Mining Capacity
    On December 22, Arkon Energy, an Australian data center infrastructure company, closed a $110 million private funding round to expand its operations in the U.S., just six months after first entering North America. The new sites are set to triple its capacity to 300 megawatts (MW). Arkon’s CEO Josh Payne said, “The U.S. is an attractive market for us in many ways, largely because of the enormous domestic customer demand, a mature and robust energy industry with several flexible and deregulated markets, political and regulatory stability, and attractiveness to institutional investors.” Payne continued, “The U.S. has an abundance of stranded, underutilized power generation assets that are connected to some of the lowest-cost electricity sources in the world, many of which are renewable.” $80 million of the funding round will go toward Arkon’s U.S. expansion, with the other $30 million earmarked for an artificial intelligence cloud service project at Arkon’s 30MW data center in Norway. TechCrunch; Blockworks.
  • Binance.US Hires New Chief Compliance Officer
    On January 4, Binance.US announced the hiring of Lesley O’Neill as their new Chief Compliance Officer. O’Neill joins from Prove Identity, a digital verification platform for banks, financial services companies, and e-commerce merchants, where O’Neill also served as Chief Compliance Officer. Binance; Law360; The Block.
  • Spain’s Central Bank, Banco de España, Selects Collaborators to Test Central Bank Digital Currency
    On January 3, Spain’s central bank, the Banco de España, selected three collaborators to participate in testing a central bank digital currency (CBDC). A year ago, Banco de España published an open call for partners; out of 24 applications received over the past year, the three collaborators chosen were Cecabank, Abanca, and Adhara. Banco de España; Cointelegraph.
  • Coinbase Set to Offer Crypto-Linked Derivatives in EU Markets
    On January 5, Coinbase announced plans to offer crypto-linked derivatives in the European Union (EU) market. Coinbase announced that they had entered into an agreement to purchase a holding company that holds a Markets in Financial Instruments Directive II (MiFiD II) license required to provide regulated derivatives, including futures and options. Coinbase; CNBC;Cryptonews.
  • DCG Repays More Than $1B in Debt to Creditors, Including Subsidiary Genesis
    On January 5, Digital Currency Group announced it had completed a payoff of all the short-term loans from subsidiary Genesis. To date, DCG’s total debt payment has surpassed $1 billion, with approximately $700 million paid to Genesis alone. X; Blockworks.

The following Gibson Dunn attorneys contributed to this issue: Jason Cabral, Kendall Day, Jeff Steiner, Sara Weed, Chris Jones, Jay Minga, Nick Harper, Jessica Howard, Justin duRivage, Henry Rittenberg, and Narayan Narasimhan.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s FinTech and Digital Assets practice group, or the following:

FinTech and Digital Assets Group:

Ashlie Beringer, Palo Alto (650.849.5327, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected]

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Ella Alves Capone, Washington, D.C. (202.887.3511, [email protected])

Grace Chong, Singapore (+65 6507 3608, [email protected])

M. Kendall Day, Washington, D.C. (202.955.8220, [email protected])

Michael J. Desmond, Los Angeles/Washington, D.C. (213.229.7531, [email protected])

Sébastien Evrard, Hong Kong (+852 2214 3798, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

Martin A. Hewett, Washington, D.C. (202.955.8207, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Stewart McDowell, San Francisco (415.393.8322, [email protected])

Mark K. Schonfeld, New York (212.351.2433, [email protected])

Orin Snyder, New York (212.351.2400, [email protected])

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Eric D. Vandevelde, Los Angeles (213.229.7186, [email protected])

Benjamin Wagner, Palo Alto (650.849.5395, [email protected])

Sara K. Weed, Washington, D.C. (202.955.8507, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

DATE AND TIME:

May 17, 2024, 11 a.m. ET

LOCATION:

Via Zoom (please contact [email protected] for more information)

DESCRIPTION:

This presentation will discuss developments in the False Claims Act and particularly how the False Claims Act applies to educational institutions.  We will cover the fundamentals of False Claims Act investigations and litigation, discuss recent key developments in the area, and examine how the False Claims Act has been applied to educational institutions.  Among other topics, we will discuss how the False Claims Act has been applied in the case law to educational institutions in connection with Title VI student financial aid funding, federal research grant programs, in the area of cybersecurity, and—for those educational institutions with medical facilities—in Medicare and other government funding of medical services.

PRESENTERS:

Winston Y. Chan is a litigation partner in Gibson, Dunn & Crutcher’s San Francisco office, and serves as co-chair of the firm’s White Collar Defense and Investigations practice group, and also its False Claims Act/Qui Tam Defense practice group.  He leads matters involving government enforcement defense, internal investigations and compliance counseling, and regularly represents clients before and in litigation against federal, state and local agencies, including the U.S. Department of Justice, Securities and Exchange Commission and State Attorneys General. He is admitted to practice in California.

Jonathan Phillips is a partner in the Washington, D.C. office of Gibson, Dunn & Crutcher, where he is a member of the firm’s litigation department and Co-Chair of the FDA and Health Care Practice Group and False Claims Act/Qui Tam Defense Practice Group. A former DOJ Trial Attorney, his practice focuses on FDA and health care enforcement, compliance, and litigation, as well as other white collar enforcement matters and related litigation. Mr. Phillips is ranked nationally as a leading False Claims Act practitioner by Chambers USA.

Mr. Phillips received his law and undergraduate degrees from the University of Pennsylvania. He is a member of the bars of the State of Maryland and the District of Columbia.

Jim Zelenay is a partner in the Los Angeles office of Gibson, Dunn & Crutcher where he practices in the firm’s Litigation Department.  Jim has extensive experience in defending clients involved in white collar investigations, assisting clients in responding to government subpoenas, and in government civil fraud litigation.

Jim has been named as one of the Top 50 Litigators in Los Angeles by the Los Angeles Business Journal (2018), a list that highlights “50 of the very best litigators in the business.” He was selected by Super Lawyers  as a “Rising Star” in the area of Business Litigation (2013-2018).  Jim is also a recipient of the prestigious Burton Award for Distinguished Legal Writing and has written extensively on the False Claims Act. Jim is a member of the California Bar.

MCLE CREDIT INFORMATION:

This program has been approved for credit in accordance with the requirements of the New York State Continuing Legal Education Board for a maximum of 1.0 credit hour, of which 1.0 credit hours may be applied toward the areas of professional practice requirement. This course is approved for transitional/non-transitional credit.

Gibson, Dunn & Crutcher LLP certifies that this activity has been approved for MCLE credit by the State Bar of California in the amount of 1.0 hour.

Application for approval is pending with the North Carolina State Bar.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

 

 

From the Derivatives Practice Group: The SEC expanded the definitions of “Dealers” and “Government Securities Dealers” this week and Hong Kong weighed in on crypto and virtual asset regulation.

New Developments

  • SEC Adopts Rule to Expand Definitions of “Dealers” and “Government Securities Dealers.” On February 6, the SEC adopted a rule that requires market participants to register as “dealers” or “government securities dealers” for the first time and become members of a self-regulatory organization (SRO). The final rule, codified in Exchange Act Rules 3a5-4 and 3a44-2, purports to define the phrase “as a part of a regular business” in Sections 3(a)(5) and 3(a)(44) of the Securities Exchange Act of 1934 to identify certain activities that would cause persons engaging in such activities to be “dealers” or “government securities dealers” and be subject to the registration requirements of Sections 15 and 15C of the Act, respectively. Under the final rule, any person that engages in activities as described in the rule is a “dealer” or “government securities dealer” and, absent an exception or exemption, required to: register with the SEC under Section 15(a) or Section 15C, as applicable; become a member of an SRO; and be subject to applicable SRO and Treasury rules and requirements. Notably, the rule is non-exclusive, meaning that even if a firm does not meet any of the criteria in the rule, the SEC claims that the firm could still be a dealer anyway depending on the “facts and circumstances.” [NEW]
  • SEC and CFTC Adopt Amendments to Enhance Private Fund Reporting. On February 8, the SEC adopted amendments to Form PF, the confidential reporting form for certain SEC-registered investment advisers to private funds, including those that also are registered with the CFTC as commodity pool operators or commodity trading advisers. According to the SEC, the amendments, which the CFTC concurrently adopted, are designed to enhance the ability of the Financial Stability Oversight Council (FSOC) to monitor and assess systemic risk and to bolster the SEC’s oversight of private fund advisers and the agency’s investor protection efforts. The SEC and CFTC also agreed to a memorandum of understanding related to the sharing of Form PF data. The SEC stated that, among other things, the amendments to Form PF will enhance how large hedge fund advisers report investment exposures, borrowing and counterparty exposure, market factor effects, currency exposure, turnover, country and industry exposure, central clearing counterparty reporting, risk metrics, investment performance by strategy, portfolio liquidity, and financing and investor liquidity in an effort to provide better insight into the operations and strategies of these funds and their advisers and improve data quality and comparability. Further, the amendments will require additional basic information about advisers and the private funds they advise, including identifying information, assets under management, withdrawal and redemption rights, gross asset value and net asset value, inflows and outflows, base currency, borrowings and types of creditors, fair value hierarchy, beneficial ownership, and fund performance, which, according to the SEC, will provide greater insight into private funds’ operations and strategies, assist in identifying trends, including those that could create systemic risk, improve data quality and comparability, and reduce reporting errors. The amendments will also require more detailed information about the investment strategies, counterparty exposures, and trading and clearing mechanisms employed by hedge funds, while also removing duplicative questions. [NEW]
  • CFTC Global Markets Advisory Committee Advances Key Recommendations. On February 8, the CFTC’s Global Markets Advisory Committee (GMAC), sponsored by Commissioner Caroline D. Pham, formally advanced eight recommendations to the CFTC that are intended to enhance the resiliency and efficiency of global markets, including U.S. Treasury markets, repo and funding markets, and commodity markets. To date, this is the largest number of recommendations advanced by a CFTC Advisory Committee in a single meeting. The GMAC’s Global Market Structure Subcommittee prepared four recommendations: (1) appropriately calibrated block and cap sizes under CFTC Part 43 swap data reporting rules, intended to enhance market liquidity and financial stability; (2) addition of certain central counterparties (CCPs) as permitted counterparties under CFTC Rule 1.25(d), intended to promote the well-functioning of the repo market; (3) expansion of cross-margining between the CME Group and the Fixed Income Clearing Corporation, intended to support greater efficiency in the U.S. Treasury markets; and (4) best practices for exchange volatility control mechanisms, intended to address market stress and market dislocation during periods of high volatility. The GMAC’s Technical Issues Subcommittee prepared four additional recommendations, as follows: (5) adoption of lessons learned from a global default simulation across CCPs, intended to address systemic risk and promote financial stability; (6) harmonization of the treatment of money market funds as eligible collateral, intended to improve market liquidity; (7) improvement of trade reporting for market oversight, intended to ensure international standardization and global aggregation and analysis of data to address systemic risk; and (8) improvement of trade reporting for market oversight, intended to facilitate data sharing across jurisdictions for systemic risk analysis. [NEW]
  • CFTC Customer Advisory Alerts App and Social Media Users to Financial Romance Fraud. On February 7, the CFTC’s Office of Customer Education and Outreach (OCEO) issued a customer advisory alerting dating/messaging app and social media users to a scam asking for financial support or giving investment advice using the platforms. The Customer Advisory: Six Warning Signs of Online Financial Romance Frauds, reminds app and social media users to be wary of texts and messages from strangers that promote cryptocurrency investments. According to the OCEO, the text could actually be from international criminal organizations that trick victims into investing money in cryptocurrency or foreign currency scams only to defraud them. The OCEO stated that the scam can take advantage of even the savviest of investors because fraudsters develop relationships with their victims through weeks of seemingly authentic text messaging conversations, a practice known as “grooming.” The advisory points out several warning signs of a financial grooming fraud, which include fraudsters attempting to move conversations from a dating or social media platform to a private messaging app, as well as their claims of wealth from cryptocurrency or foreign currency trading due to insider information. The advisory also includes steps users can take to avoid financial grooming frauds. [NEW]
  • CFTC Extends Public Comment Period on Proposed Rule on Protection of Clearing Member Funds. On February 2, the CFTC extended the deadline for the public comment period on a proposed rule to address protecting clearing member funds held by derivatives clearing organizations. The deadline is being extended to March 18, 2024. The CFTC stated that it provided the extension in response to a request by a commenter. [NEW]
  • Commissioner Pham Announces Additional Executive Staff Appointments. CFTC Commissioner Caroline D. Pham announced new executive staff appointments in her Washington, D.C. office on February 1. Taylor Foy joins Commissioner Pham’s team as a Senior Advisor and Nicholas Elliot has joined as a Confidential Assistant and Policy Advisor. [NEW]
  • CFTC’s Energy and Environmental Markets Advisory Committee to Meet February 13. On January 30, 2024, CFTC Commissioner Summer K. Mersinger, sponsor of the Energy and Environmental Markets Advisory Committee (EEMAC) announced the EEMAC will hold a public meeting from 9:00 a.m. to 11:30 a.m. (MST) on Tuesday, February 13 at the Colorado School of Mines in Golden, Colorado. The CFTC stated that at this meeting, the EEMAC will explore the role of rare earth minerals in transitional energy and electrification, including the potential development of derivatives products to offer price discovery and hedging opportunities in these markets. Additionally, the meeting will include a presentation and discussion on the federal prudential financial regulators proposed rules implementing Basel III and the implications for and impact on the derivatives market. Finally, the two EEMAC subcommittees will offer an update on their continued work related to traditional energy infrastructure and metals markets.
  • CFTC Cautions the Public to Beware of Artificial Intelligence Scams. On January 25, the CFTC’s OCEO issued a customer advisory warning the public about Artificial Intelligence (AI) scams. Customer Advisory: AI Won’t Turn Trading Bots into Money Machines explains how the scams use the potential of AI technology to defraud investors with false claims that entice them to hand over their money or other assets to fraudsters who misappropriate the funds and deceive investors. The advisory warns investors that claims of high or guaranteed returns are red flags of fraud and that strangers promoting these claims online should be ignored. The CFTC stated that the advisory is intended to help investors identify and avoid potential scams and includes a reminder that AI technology cannot predict the future. It also lists four items investors may consider to avoid such scams: researching the background of a company or trader, researching the history of the trading website, getting a second opinion, and knowing the risks associated with the underlying assets.
  • CFTC Staff Releases Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets. On January 25, the CFTC’s Divisions of Market Oversight, Clearing and Risk, Market Participants, and Data and the Office of Technology Innovation issued a request for comment (RFC) in an effort to better inform them on the current and potential uses and risks of AI in the derivatives markets that the CFTC regulates. The RFC seeks comment on the definition of AI and its applications, including its use in trading, risk management, compliance, cybersecurity, recordkeeping, data processing and analytics, and customer interactions. The RFC also seeks comment on the risks of AI, including risks related to market manipulation and fraud, governance, explainability, data quality, concentration, bias, privacy and confidentiality and customer protection. The CFTC indicated that staff will consider the responses to the RFC in analyzing possible future actions by the CFTC, such as new or amended guidance, interpretations, policy statements, or regulations. Comments will be accepted until April 24, 2024.
  • CFTC Seeks Public Comment on Proposed Capital Comparability Determination for Swap Dealers Subject to Supervision by the UK Prudential Regulation Authority. On January 24, the CFTC solicited public comment on a substituted compliance application requesting that the CFTC determine that certain CFTC-registered nonbank swap dealers located in the United Kingdom may satisfy certain Commodity Exchange Act capital and financial reporting requirements by being subject to, and complying with, comparable capital and financial reporting requirements under UK laws and regulations. The Institute of International Bankers, the International Swaps and Derivatives Association, and the Securities Industry and Financial Markets Association submitted the application. In connection with the application, the CFTC also solicited public comment on a proposed comparability determination and related order providing for the conditional availability of substituted compliance to CFTC-registered nonbank swap dealers under the UK Prudential Regulation Authority’s prudential supervision. The comment period will be open until March 24, 2024.
  • BGC Group Announces Approval for FMX Futures Exchange. On January 22, BGC Group, Inc. (BGC) announced that its FMX Futures Exchange (FMX) received approval from the CFTC to operate an exchange for U.S. Treasury and SOFR futures. BGC will combine their Fenics UST cash Treasury platform and FMX to work across the CME’s U.S. interest rate complex. FMX is party to a clearing agreement with LCH SwapClear, a holder of interest rate collateral, which it indicated will allow for portfolio margining across rates of risk and provide for margin efficiencies and effective risk management.

New Developments Outside the U.S.

  • Hong Kong Government Launches Consultation on Regulating OTC Trading of Virtual Assets. On February 8, the Hong Kong government launched a public consultation on legislative proposals to introduce a licensing regime for providers of over-the-counter trading services of virtual assets (VAs). Under the proposed licensing regime, any person who conducts a business in providing spot trading services of VAs-for-money or money-for-VAs will be required to be licensed by the Commissioner of Customs and Excise, irrespective of whether the services are provided through a physical outlet and/or digital platforms. Licensees will be required to comply with AML/CFT requirements and other regulatory requirements. The public consultation period ends on April 12, 2024. [NEW]
  • HKMA Consults on Capital Treatment of Cryptoasset Exposures. On February 7, the Hong Kong Monetary Authority (HKMA) published a Consultation Paper on CP24.01 Cryptoasset Exposures setting out a proposal for implementing new regulations on the prudential treatment of cryptoasset exposures based on the Basel Committee on Banking Supervision’s Prudential treatment of cryptoasset exposures standard. According to the consultation paper, for the purpose of the prudential treatment of cryptoasset exposures, cryptoassets will be defined as private digital assets that depend on cryptography and distributed ledger technologies or similar technologies. The HKMA has scheduled a preliminary consultation on the proposed amendments to the rules in the second half of 2024 and aims to put new standards into effect no earlier than July 1, 2025. [NEW]
  • EU Co-Legislators Reach Provisional Agreement on EMIR 3. On February 6, the EU co-legislators reached a provisional political trilogue agreement on the European Market Infrastructure Regulation 3. On the issue of an active account requirement, while the agreement is based on the less punitive operational active account with representativeness approach proposed by the Council of the EU, the European Parliament has proposed that counterparties should clear at least five trades through an EU CCP in each of the most relevant subcategories. The original approach proposed by the council only required one trade per relevant subcategory. On the topic of supervision, the agreement includes a new role for the European Securities and Markets Authority (ESMA) as co-chair of CCP supervisory colleges alongside national competent authorities and a coordinating role in an emergency. [NEW]
  • ESA’s Joint Board of Appeal Confirms ESMA’s Decision to Withdraw the Recognition of Dubai Commodities Clearing Corporation. On February 6, the Joint Board of Appeal of the European Supervisory Authorities (the ESAs) unanimously decided to dismiss the appeal brought by Dubai Commodities Clearing Corporation (DCCC) against ESMA and to therefore confirm the ESMA decision to withdraw its recognition. The application was brought in relation to ESMA’s Decision, adopted under Article 25p of Regulation (EU) No 648/2012 (EMIR), to withdraw the recognition of DCCC as a Tier 1 third-country CCP. The decision is a consequence of the United Arab Emirates (UAE) being included by the European Commission on the list of high-risk third countries presenting strategic deficiencies in their national anti-money laundering and counter financing of terrorism (AML/CFT) regime, provided for in the Commission Delegated Regulation (EU) 2016/1675. The Joint Board of Appeal of the ESAs had decided to suspend the ESMA decision in October 2023 until the outcome of the appeal was concluded. With today’s publication, the suspension has expired and the ESMA decision has become fully operational. [NEW]
  • ESMA Publishes Guidelines on CCP Recovery and Resolution. On February 2, ESMA published two sets of guidelines relating to the EU CCP Recovery and Resolution Regulation. The first set of guidelines provides EU authorities with guidance on the provisions that should be included in cooperation arrangements with third-country authorities, on matters such as the exchange of information for the preparation and maintenance of resolution plans, and on the mechanisms for prompt informing to parties before any early intervention power or resolution action. The second set of guidelines provides EU authorities with guidance on practical arrangements for the establishment and functioning of the resolution college for EU CCPs, and to facilitate the effective operation of the college. [NEW]
  • ESAs Recommend Steps to Enhance the Monitoring of BigTechs’ Financial Services Activities. On February 1, the ESAs published a Report setting out the results of a stock take of BigTech direct financial services provision in the EU. The Report identifies the types of financial services currently carried out by BigTechs in the EU pursuant to EU licenses and highlights inherent opportunities, risks, regulatory and supervisory challenges. The stock take showed that BigTech subsidiary companies currently licensed to provide financial services pursuant to EU law mainly provide services in the payments, e-money and insurance sectors and, in limited cases, the banking sector. However, the ESAs have yet to observe their presence in the market for securities services. To further strengthen the cross-sectoral mapping of BigTechs’ presence and relevance to the EU’s financial sector, the ESAs propose to set-up a data mapping tool. The ESAs explained that this tool is intended to provide a framework that supervisors from the National Competent Authorities would be able to use to monitor on an ongoing and dynamic basis the BigTech companies’ direct and indirect relevance to the EU financial sector.
  • ESMA Publishes Risk Monitoring Report. On January 31, the ESMA published its first risk monitoring report of 2024, where it sets out the key risk drivers currently facing financial markets. Beyond the risk drivers, ESMA’s report provides an update on structural developments and the status of key sectors of financial markets, during the second half of 2023. The report considers structural developments in various areas, including market-based finance, sustainable finance, securities markets, and asset management.
  • ESMA Consults on Reverse Solicitation and Classification of Crypto Assets as Financial Instruments Under MiCA. On January 29, ESMA, published two Consultations Papers on guidelines under Markets in Crypto Assets Regulation (MiCA), one on reverse solicitation and one on the classification of crypto-assets as financial instruments. ESMA is seeking input on proposed guidance relating to the conditions of application of the reverse solicitation exemption and the supervision practices that National Competent Authorities may take to prevent its circumvention. ESMA is also seeking input on establishing clear conditions and criteria for the qualification of crypto-assets as financial instruments.

New Industry-Led Developments

  • ISDA Response on Anti-Greenwashing Rules. On January 26, ISDA submitted a response to the UK Financial Conduct Authority’s consultation on GC23/3: Guidance on the Anti-Greenwashing Rule. In the response, ISDA highlights that actual or perceived misrepresentation of sustainability features may have a detrimental impact on investor and consumer perceptions of sustainable finance products, and ISDA supports efforts to enhance trust in the market. ISDA considers that sustainability-linked derivatives, environmental, social and governance derivatives and voluntary carbon credits fall within the scope of the rule.
  • Joint Response to EC on BMR. On January 23, ISDA, the Global Financial Markets Association and the Futures Industry Association (FIA) submitted a joint response to the EC call for feedback on the review of the scope and regime for non-EU benchmarks. The response sets out the associations’ comments on the EC’s proposal, along with potential draft amendments and additional revisions that were considered to support the EC’s aims. In the response, the associations welcome the EC’s recognition of the problems caused by the current drafting of the Benchmark Regulation (BMR). The associations support the aim of establishing a third-country regime that is sustainable in the long term once the current transitional regime expires, and overall consider that the proposal will result in a more proportionate regime for users and administrators of benchmarks.
  • ISDA, FIA Respond to MAS Consultation on Amendments to the Capital Framework for Approved Exchanges and Clearing Houses. On January 22, ISDA and the FIA jointly responded to the consultation from the Monetary Authority of Singapore (MAS) on proposed amendments to the capital framework for approved exchanges and approved clearing houses. The scope of the response is limited to the capital framework for approved clearing houses. The associations stated that they welcomed the introduction of a separate liquidity requirement and proposed that MAS consider a more conservative minimum threshold of at least 12 months of operating expenses. They also agreed with the proposed amendments that capital components should only include equity instruments and exclude an approved clearing house’s skin-in-the-game. For total risk requirement, the response suggests the alignment of the operational risk component with the liquidity risk requirement and the inclusion of some clarifications on the investment risk and general counterparty risk components.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (+1 212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.