Latin America has been especially hard hit in recent months by the ongoing COVID-19 pandemic, as described in WilmerHale’s recent client alert here. The resulting travel restrictions, physical safety precautions and public health concerns have created uncertainty for many companies confronting the need to conduct cross-border Foreign Corrupt Practices Act (FCPA) investigations in the region, where some countries are currently difficult—or impossible—to access.¹  

Despite these challenges, effective internal investigations remain central to a robust FCPA compliance program, as underscored by the recently released FCPA 2020 Resource Guide, summarized by WilmerHale here. The Department of Justice (DOJ) has announced that it does not expect any slowdown in its FCPA enforcement actions during the pandemic.² Moreover, the goals of an internal investigation go beyond satisfying the requirements of government authorities. Conducting a thorough, reliable and effective FCPA investigation is in the best business interests of the company itself.

With this difficult environment in mind, this client alert sets out 10 key tips for conducting effective Latin America-focused FCPA investigations under pandemic conditions.

1. Frame the Investigation: What’s the Issue, Who’s the Client and What’s the Form of the Investigation?

The first step in any internal investigation is important: frame the investigation. Ask the following questions, which can be especially important and complex during the pandemic:³  

• What entity is being investigated? A US company with a local subsidiary headquartered in Latin America? A Latin American company with a US branch? A joint venture between a US company and a Latin American company?

• To the extent that the investigation involves a customer or third party, does the government have an interest in that entity? (State ownership of companies can be quite common in Latin American markets.) 

• Is the company public or private? Are there any reporting obligations that might stem from the investigation? What other implications does the company structure have for the investigation?

• Who is managing the investigation? Company management? The company board of directors? A board committee? 

• What is the goal of the investigation? Internal fact finding? Responding to a government subpoena? 

• How deep should the investigation go? Remember to consider vertical inquiries (how far up the chain of the command) and horizonal inquiries (how widespread across areas of the company and regions of operations).

2. Get the Right Team in Place.

In any Latin American FCPA investigation, having a well-organized team in place is critical—even more so during the current crisis. While the pandemic restricts travel, an investigation may rely even more heavily on local resources to stand up, carry out and manage the investigation.⁴ 

A combination of local and international expertise is essential. Be sure to consider the language skills of these team members and to structure any engagement so that their work enjoys applicable attorney-client privilege and/or work product privilege protections. The team should include:

• Skilled and experienced US counsel with expertise in FCPA investigations;

• Local counsel in the country where the conduct occurred;

• Forensic accountants to help with collection remotely and/or to serve as collection “boots on the ground” (when such collection is or becomes possible);

• Document review specialists who speak the relevant local language(s); and

• Security and information technology (IT) experts to secure physical evidence in person (when possible) and virtual documents remotely.

3. Understand and Guard Legal Privilege, as Applied in the Relevant Jurisdiction(s).

A crucial consideration for assembling a team is understanding how legal privilege will apply. Failing to understand how privilege applies—or doesn’t—in the country where the investigation is taking place can be a major and potentially fatal pitfall. Because many Latin American countries are civil law jurisdictions, their legal privilege protections operate in a manner fundamentally different from those familiar to US lawyers.⁵ 

For example, only in fall 2019 did Mexico’s antitrust authority, the Federal Economic Competition Commission (COFECE, as abbreviated in Spanish), issue guidelines for recognizing attorney-client communication protections in connection with antitrust investigations.⁶ Although Mexican law does generally prohibit the disclosure of client information, it does not include broad legal protection from government seizure. This risks sensitive disclosure to government authorities if not handled correctly. Recent case law suggests that these protections may be expanding, but the current legal landscape presents more questions than answers.⁷ 

Companies should be vigilant in maintaining and protecting privileged material during the course of a Latin America FCPA investigation. This may prove even more important during the pandemic, when coordinating is more likely to be done via email, text and other written means—means that government authorities may try to collect and over which companies may not have as much control as in non-pandemic conditions.

4. Promptly Preserve and Collect Documents. 

Even prior to the pandemic, preserving, archiving and collecting local documents and evidence for investigations in Latin America could prove challenging. Today, in the midst of COVID-19, those challenges have multiplied. Working swiftly and coordinating with the on-the-ground team will be critically important.

Prompt document preservation is the most important first step to ensure a complete investigation. Of course, relying on individuals themselves for preservation and collection while working remotely raises its own issues. When planning out the document preservation and collection process, consider how to stage processes and requests to minimize the possibility of spoliation. A truly bad actor may be willing to destroy evidence at the first sign of an investigation, so to the extent practical, IT should take steps to preserve evidence (such as by remote back up and capture of data) before preservation notices are sent.

Once those key preservation steps have been taken, another important step is sending a preservation notice to individuals who are likely to have relevant evidence. The preservation notice directs these individuals not to delete or destroy material relevant to the investigation.⁸ In Latin America, even in companies where employees are expected to have a working knowledge of English, providing translations of this notice—in Spanish, Portuguese and/or any other relevant languages—will be critical to ensuring compliance. In addition, employees who receive a preservation notice should be required to acknowledge receipt via email or other written means, and IT experts should track this acknowledgment information.⁹ 

The pandemic will likely also make traditional in-person collection efforts difficult if not impossible to complete, so creativity will be required. Obviously, where employees’ cell phones or laptops can be imaged remotely, such imaging is a key first step. In addition, identifying and collecting text messages, chats and conversations through applications such as WhatsApp (widely used for business in Latin America) is essential.¹⁰ You may also consider collecting from personal accounts or personal devices, especially if individuals indicate that they used personal accounts for business-related communications and data storage—which is likely happening more often with people working more from home. But when doing so, pay particular attention to the limits local privacy law and regulation may place on those efforts, as discussed next.

5. Understand and Comply With Local Privacy and Data Protection Laws.

The process of preserving and collecting relevant data and documents is made more complex by Latin America’s patchwork of data privacy protections, which can complicate even the most straightforward FCPA investigation. This is especially true if an investigation might attract the interest of enforcement authorities in the United States or Europe. Add to this the specific challenges presented by the pandemic, and the risks can seem dizzying. Local counsel or US counsel with links to trusted local practitioners will be invaluable in navigating Latin America’s complex and ever-changing data privacy regimes.

Many Latin American countries have been heavily influenced by the European Union’s General Data Protection Regulation. But countries in the region also have adopted a special emphasis on consent for processing data and for legitimizing transfers to “inadequate” countries (though it is rarely clear which outside countries are deemed adequate).¹¹ Each country also presents unique data protection rules and investigation challenges, which require country-specific legal analysis. For more discussion on privacy laws in Latin America, see WilmerHale’s detailed analysis here. 

Not surprisingly, the pandemic itself now shapes and tests the region’s maintenance of these privacy rules. In Brazil and Panama, for example, the implementation of recently enacted privacy laws will likely be postponed in response to the pandemic.¹² On the other hand, COVID-19 and the response to it have complicated some of the commonly used approaches to comply with foreign data privacy laws. In some cases, investigation teams have deployed US counsel to review data within the jurisdiction; that is difficult now, if not impossible, in many jurisdictions due to travel restrictions. 

With this complicated and ever-changing set of data privacy protections across Latin America—many of which are not intuitive to counsel trained in the United States, Europe or elsewhere—companies conducting FCPA investigations in Latin America should engage local experts to ensure that an investigation does not run afoul of local data privacy laws. 

6. Understand Local Labor and Employment Law That May Impact Interviews and Discipline. 

In addition, local labor and employment law may impact when, how and whether employee interviews may take place in an FCPA investigation as well as what the scope of permissible employee discipline may be. A discussion of employment law across Latin America is beyond the scope of this alert. The complexity of local employment law, like privacy law, underscores the importance of considering at the outset of an FCPA investigation whether and how to engage experienced local counsel in the jurisdiction at issue.¹³  

7. Consider Local Enforcement Authorities and Local Anti-Corruption Laws and Requirements.

As WilmerHale described in its 2019 FCPA Year in Review, local enforcement authorities in Latin America have continued recently to investigate alleged corruption within their borders—with or without US authorities’ cooperation. 

For example, Brazil’s President Jair Bolsonaro initiated his administration in January 2019 with a promise to stamp out corruption in Brazil. President Bolsonaro has introduced broad anti-corruption legislation¹⁴ and Brazilian prosecutors have been active over the past few years in tackling deep-rooted corruption in the country. However, the pandemic—and the Bolsonaro administration’s own corruption scandals—present fundamental challenges to these goals, including the Brazilian government’s diversion of resources that had been dedicated to investigating and prosecuting COVID-19-related corruption.¹⁵ 

In Mexico, President Andrés Manuel López Obrador also campaigned on an anti-corruption platform and took actions at the outset of his administration to combat graft. For example, his administration has gone after the country’s national oil company, Pemex, including charging and even arresting former Pemex executives living abroad.¹⁶ In 2019, President Obrador appointed the country’s first chief anticorruption prosecutor, Luz Mijangos Borja, who was reported to have initiated 680 investigative cases in the first eight months of her term.¹⁷ 

Given this and similar recent investigation activity,¹⁸ local enforcement interests have always been an important consideration in FCPA investigations. But during the pandemic, local authorities enjoy greater access to documents and individuals on the ground than do US officials. The importance of expecting and planning for potential local investigations is only heightened as a result.

8. Where Appropriate, Communicate With Outside Auditors and Enforcement Authorities About Challenges Faced in the Investigation Due to the Pandemic.

Communication with relevant outside stakeholders in an FCPA investigation, including, where relevant, enforcement authorities and external auditors, has always been critically important. 

The pandemic has only underscored this need for communication—DOJ and Securities and Exchange Commission (SEC) officials have recently highlighted the importance of communicating COVID-19 challenges to enforcement authorities, and they have signaled that these agencies will work with companies to address investigatory issues presented by the pandemic. For example, in April, officials from the DOJ and SEC FCPA units explained that they “are trying very hard to be sensitive to the realities of what everybody is dealing with.”¹⁹ A few weeks thereafter, in mid-May, DOJ and SEC officials shared that their foreign bribery units were experiencing pandemic-related challenges but were in no way “hitting the pause button” on their investigations.²⁰  

Similar considerations also apply to communicating with external auditors. In certain instances, a company may be required to inform its regular outside auditor of an FCPA investigation.²¹ In those cases, pandemic-related challenges that affect the inquiry’s timing, scope and action plan should be communicated to external auditors sooner rather than later.

9. Use Technology to Your Advantage.

Although the pandemic presents challenges to Latin America FCPA investigations for companies and regulators alike, it has also presented opportunities to take advantage of new technologies and creative strategies. For example, firms might cut significant costs by standing up remote document review platforms via remote secure workspaces—of course, ensuring compliance with local privacy laws.²² For further discussion of such technology and strategies in the investigations and strategic response context, see WilmerHale’s analysis here. (WilmerHale also releases CLE credit webinars about cutting-edge investigation strategies during COVID-19, as here, so please feel free to subscribe to the latest news and events from the firm.)

In the current environment, conducting interviews virtually where possible under local law and investigation circumstances has become a common approach.²³ Video interviews, of course, pose their own challenges and limitations. It is important to be realistic about how long participants can be engaged during a videoconference;²⁴ it may be better to break interviews into two half-day sessions rather than one full day. Finally, in the interest of maintaining the confidentiality of the investigation, counsel should attempt to avoid sending documents to the interviewee—particularly one who is not employed by the client or its subsidiary—but rather should try to share documents on screen during the interview, in real time.

When relying on new technologies, hope for the best but plan for the worst. For example, if you are conducting a videoconference, have a backup telephone line. If conducting remote document review, make sure to build in time for technical difficulties and system shutdowns.

10. Expect Changes as the COVID-19 Landscape Continues to Evolve in Latin America—Be Creative, Flexible and Ready to Adapt. 

Finally, the most important tip for conducting an FCPA investigation in Latin America during the pandemic: be flexible. Companies, individuals and regulators are all working to continue their lives and livelihoods during this global health emergency. Even the most seasoned investigators should be prepared for both the challenges and the opportunities presented by the pandemic, as outlined in each of the tips above.

WilmerHale, too, remains abreast of the latest developments in FCPA enforcement, Latin America COVID-19 response (for example, see WilmerHale’s latest client alert on COVID-19 response in Latin America) and other legal issues around the globe. We are available to provide timely guidance for our clients and partners.

WilmerHale has strong relationships with a wide range of local consultants and local counsel throughout Latin America. In certain countries, we have connections with multiple firms that might be considered collaborative partners, depending on the nature of the matter. The firm also taps its alumni network where useful in pursuit of our clients’ legal and business objectives. These resources—employed in concert with WilmerHale’s FCPA investigation expertise—have helped countless firms navigate complicated and high-stakes issues in cross-border investigation and litigation, including some of the most common complications discussed in this alert.