Several lessons can be drawn from this fine which commodity firms can, where appropriate, leverage within their own Compliance Functions.
[1] Code of Conduct Policy Review + Updated Training to Staff
Trafigura provides a copy of its Code of Conduct Policy (drafted as of Oct 2022 - click here) on its public website. It is not clear whether this policy is an up to date policy or will be updated in due course as a result of the fine.
Nonetheless, given the significant fines issued to Glencore, Vitol, and Trafigura in recent times, commodity firms may use this opportunity to perform a self-initiated review of their current Code of Conduct policies to ensure they are up to date. In addition, firms have the opportunity to deliver updated training to staff of said policies in part to emphasise the seriousness of violating such policies.
The following employee obligation themes are included in the Code of Conduct and provide a foundation for other firms to compare and contrast against.
- Political contributions and activities
- Charitable donations
- Engaging with the media
- Proprietary and confidential information
- Money laundering and terrorist financing
- Sanctions and trade restrictions
- Bribery and corruption including gifts, hospitality and entertainment and use of consultants and intermediaries
- Anti-trust and competition law compliance
- Market behaviour: business communications and conflicts of interests including personal account dealing, conflicts of interest, business communications, and communicating with exchanges, price reporting agencies and regulators
- True and accurate records
- Reporting violations and raising concerns
- Protection for those who follow the Code
[2] Anti-Corruption Compliance Programme enhancements.
Based on the recent spate of fines issued by the DOJ to commodity firms, Compliance teams have the opportunity to review their anti-corruption programmes. Below are several observations for firms, where appropriate, to:
- Conduct a self-review of operations associated with high-risk commodity trading activities.
- Review current third-party intermediaries.
- Develop and implement appropriate monitoring, testing, and review procedures for high-risk third-party business transactions.
- Analyse all payments made to high-risk third parties and document justification for such payments.
- Build robust monitoring review and testing procedures (post onboarding) to identify those third parties that require additional scrutiny.
- Ensure Compliance follows up with inquiries to third parties in a timely manner. Should there be delays in receiving information from third parties in a timely manner, include a policy that allows Compliance to potentially halt business activity.
[3] Third-Party Management – DOJ expectations.
It is clear that third parties played a significant role in several of the FCPA enforcement actions and this area represents a key risk for firms. In March 2023 the DOJ issued an updated guidance note ‘Evaluation of Corporate Compliance Programs’ (ECCP) (click here) which is intended to assist prosecutors in making informed decisions as to whether, and to what extent, a corporation’s compliance programme was effective at the time of the offence, and is effective at the time of a charging decision or resolution, for the purposes of determining any prosecution and related monetary penalty.
Within the document, the DOJ provides guidance for managing third party risks. Below is a high-level summary and checklist which firms can use to benchmark against their current policies and controls and which the DOJ expects firms to have in place.
- Company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.
- Company knows the business rationale for needing the third party in the transaction, and the risks posed by third-party partners, including the third-party partners’ reputations and relationships, if any, with foreign officials.
- Company ensures that contract terms with third parties specifically describe the services to be performed, that the third party is actually performing the work, and that its compensation is commensurate with the work being provided in that industry and geographical region.
- Company engages in ongoing monitoring of the third-party relationships, be it through updated due diligence, training, audits, and/or annual compliance certifications by the third party.
In addition, the DOJ provides a set of themes/questions firms can benchmark when developing / reviewing their current third-party risk management programmes as follows:
[A] Risk-Based and Integrated Processes
- How has the company’s third-party management process corresponded to the nature and level of the enterprise risk identified by the company?
- How has this process been integrated into the relevant procurement and vendor management processes?
[B] Appropriate Controls
- How does the company ensure there is an appropriate business rationale for the use of third parties?
- If third parties were involved in the underlying misconduct, what was the business rationale for using those third parties?
- What mechanisms exist to ensure that the contract terms specifically describe the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered?
[C] Management of Relationships
- How has the company considered and analysed the compensation and incentive structures for third parties against compliance risks?
- How does the company monitor its third parties?
- Does the company have audit rights to analyse the books and accounts of third parties, and has the company exercised those rights in the past?
- How does the company train its third-party relationship managers about compliance risks and how to manage them?
- How does the company incentivize compliance and ethical behaviour by third parties?
- Does the company engage in risk management of third parties throughout the lifespan of the relationship, or primarily during the onboarding process?
[D] Real Actions and Consequences
- Does the company track red flags that are identified from due diligence of third parties and how those red flags are addressed?
- Does the company keep track of third parties that do not pass the company’s due diligence or that are terminated, and does the company take steps to ensure that those third parties are not hired or re-hired at a later date?
- If third parties were involved in the misconduct at issue in the investigation, were red flags identified from the due diligence or after hiring the third party, and how were they resolved?
- Has a similar third party been suspended, terminated, or audited as a result of compliance issues?