In early December 2016, the Sapin II law was enacted in France. The law, which is meant to promote transparency, fight against bribery, and modernize the economy, was pushed for two years by Transparency International. Corruption has long been criminally punishable under French law, so the main purpose of the new law was to issue more clear rules to prevent and detect bribery.
Company Obligations
Companies that exceed certain thresholds (and their executives) are required to adopt an anti-bribery compliance program that satisfies a variety of specific requirements set out in the law. The obligation to implement internal procedures applies to: (1) companies with their registered office in France (including French overseas territories, i.e., French Guiana, French Polynesia) that employ more than 500 employees and realize at least €100 million in revenue and (2) groups of companies that employ more than 500 employees with revenue or consolidated revenue exceeding €100 million, where the holding company has its registered office in France. In the second instance, the obligations detailed in Sapin II lie on the holding company itself, but also on subsidiaries or controlled companies, including those outside of France.
Sapin II Obligations
Companies that exceed the aforementioned thresholds have until June 1, 2017, to:
- Adopt a code of conduct, describing the behaviors likely to constitute bribery acts. This code should give clear and practical guidance tools to employees;
- Set up a whistleblowing system allowing employees to report behaviors or situations breaching the internal code of conduct. This whistleblowing system should define the process for investigating complaints in a confidential way. Sapin II also provides for certain protections for such whistle-blowers;
- Create a risk map, ranking and classifying the company’s risks of exposure to corruption, by sector and geographical area and taking into account the company’s major clients, suppliers or intermediaries;
- Run due diligence on the company’s major clients, suppliers and intermediaries;
- Implement internal or external accounting auditing processes to make sure that accounting books are not used to conceal corruption or influence peddling acts;
- Train the employees that are more at risk;
- Set up a disciplinary process that enables punishment for employees that breach the code of conduct; and
- Set up an internal process to control and evaluate the measures implemented.
Sanctions for Breach
To ensure compliance with these rules, Sapin II provides serious financial sanctions for those who do not comply. In fact, a new authority, the National Agency for Prevention and Detection of Bribery, has been established to enforce Sapin II. The Agency can issue an injunction to comply with the law as well as order the payment of fines by both the legal representative of the company (up to €200,000) and the company itself (up to €1 Million).
Non-compliance with Sapin II also carries significant reputational risk: the decision by the Anti-Corruption Agency issuing an injunction or imposing a fine can be made public under ‘name and shame’ powers.
Sapin II Brings Changes
While Sapin II does not significantly interfere with existing laws and sentencing guidelines on corruption, it does actually greatly change things in France. For one, it expanded extra-territorial reach for French prosecutors by allowing investigations into foreign companies with even a footprint in France.
The eight mandatory measures for a corruption prevention program have an effect on companies that are already complying with current French laws (they will need to consult with their employee representative organizations prior to integrating the code of conduct into internal regulations) and companies that are already complying with UK and US standards should consider how the such an obligation affects their existing framework.
Additionally, by compelling all companies with more than 50 employees to establish a whistleblower mechanism and providing “protection against retaliation” and guaranteeing confidentiality to whistleblowers, Sapin II introduces one of the strongest protection frameworks for whistleblowers.
There are a few things that differentiate the whistleblower regime from its UK and US counterparts. First, the regime applies only to disinterested parties: the law does not protect or incentivize whistleblowing by implicated parties, i.e. those who have the closest visibility of the facts. Second, the whistleblower must have firsthand knowledge of the facts. Third, with very few exceptions, whistleblowers receive immunity from criminal prosecution. Fourth, the law affords protection to those alleged to be involved by guaranteeing anonymity to named accused persons in a report until the facts are proven. Finally, unlike in the US, whistleblowers may be provided with financial support in an amount to be determined by an existing independent authority, but not rewarded.
However, whistleblower activity may be hampered by the hierarchical reporting process: whistleblowers must first use internal whistleblowing channels before blowing the whistle to the relevant regulator and finally to the press. In line with the preventive policy directive behind the law, this is designed to enable companies to react quickly to allegations.
How Can Companies Prepare?
Companies that fall under the scope of Sapin II will need to ensure that they can demonstrate that they comply with each of the eight measures listed above. Compliance is recommended to be such that an investigation by the newly-created Agency would come up clean.
Companies that do not fall under the Sapin II requirements would also do well to comply, as they can minimize the risk of bribery and, in the event of actual bribery, to mitigate their liability under separate bribery offences and/or to being able to negotiate the level of fine for such offences under the procedure of the Deferred Prosecution Agreement.