Regulatory Compliance Report 2014: Untapped market
Though awareness among clients about the need for compliance is growing, the level of ignorance about the issue is still high
While big multinational companies are well aware of the requirements set out in legislation such as the US´ Foreign Corrupt Practices Act and the UK´s Bribery Act, many small and medium-size enterprises (SMEs) in Spain and Portugal seem content to carry on their business without giving compliance much thought. However, experts in the field argue that SMEs that are not compliant are sitting on a ticking time-bomb.
The consequences of non-compliance can be extremely damaging to a business – it could result in being denied access to finance, losing lucrative supply chain contracts, or worse still, a prison sentence for a director of the company. It is this last threat – a spell behind bars – that is starting to awaken business owners to the need for a robust compliance programme. Meanwhile, at the other end of the scale, large multinationals – wary of the threat of criminal sanctions for non-compliance – are hunting for criminal lawyers to join their compliance teams.
“Criminal and competition issues are now our clients’ main concerns regarding compliance,” says Antonio Pino, partner at CMS Albiñana & Suárez de Lezo. He adds that his firm started dealing with compliance programmes as a way to mitigate the punitive impact of competition law and criminal law. Consequently his firm´s expertise in this area has been developed by the competition and criminal law departments, but progressively other departments have been incorporated into the compliance practice, including labour and corporate, for example. “You need to offer tailored solutions for each company,” Pino says.
The complexity of regulations produces an increasing need for compliance among clients, according to KPMG partner Alain Casanovas. “Levels of awareness are growing because of changes to the Spanish Criminal Code, for example.” However, Casanovas says that clients are now realising that they could potentially suffer consequences other than sanctions if they do not have a compliance programme in place, such as being denied finance or being challenged by the proxy advisors. That said, he says that compared to larger companies, smaller companies are generally not aware of the need for compliance.
How do you sleep at night?
Enrique Luzón, senior associate at Gómez-Acebo & Pombo, says the criminal law department at his firm leads on compliance with the support of other practice areas. “Compliance is very focused on criminal laws – we have detected concern among clients, especially those that need to improve their internal procedures.” Santiago Garrido, partner specialising in regulatory law at Hogan Lovells, echoes the point about increasing concern among clients about compliance. “Clients are watching out for the amendments to the Criminal Code, but there is already a concern about, for example, competition issues,” he says. “Clients want to avoid liabilities – such as infringements of environmental laws or money laundering – they want to sleep well at night.” Garrido adds that clients that are compliant are usually more efficient.
Pino says “anti-bribery and corruption legislation is another client concern. A recent amendment to the Spanish legislation on universal justice has created serious concerns as it declares that a company shall be the criminally liable in Spain for crimes committed abroad by its officers, employees, representatives or collaborators if the company is legally domiciled in Spain.” He adds: “At the same time the proposed amendments to the Spanish Criminal Code and Spanish Companies Act are going to intensify the liability of directors, so we are focused on preparing compliance programmes to prevent, control, monitor and cover the risks and liabilities associated with directors and officers”.
Juan Pablo Regojo, a senior associate in the litigation and arbitration department at Garrigues, says there has been a “huge increase in workload” with regard to compliance in the last 12 months. “The future amendment to the Criminal Code – that is being discussed by parliament – has alerted corporations,” he says. “Big companies´ compliance departments have intensified their activity in relation to the prevention of criminal risks.” Regojo adds that SMEs often contact their legal advisers to ask: “What is criminal liability of legal entities [in relation to the Spanish Criminal Code after its 2010 amendment], what are the implications for our day-to-day activity and how can I protect myself?” With regard to major international companies, Regojo says that one of their main concerns is whether the compliance procedures they have already put in place are sufficient to protect them in Spain and, if not, how they must be adapted to ensure that they are. He adds that other concerns include establishing whistle-blowing systems and how to manage internal investigations, for example, are companies able to inspect the professional email accounts of employees and, if so, under what conditions? Or, should they go to the public prosecutions service to self-report possible offences detected within the company?
To illustrate how compliance has developed as a practice area over the last decade, Alfredo Domínguez, partner at Cuatrecasas, Gonçalves Pereira, says that back in 2003, the tax department began giving advice to clients on tax compliance, but now compliance-related advice is given in relation to a range of issues such as anti-money laundering, anti-corruption, the environment and data protection. Now clients contact the relevant department depending on the aspect of compliance in question, Domínguez says. “For example, if it´s about the new Criminal Code, clients call the criminal law department.”
All aspects of business affected
Cecilia Pastor, partner at Baker & McKenzie Madrid and head of the corporate compliance department, says the Madrid office has put together a multi-disciplinary compliance task force that includes lawyers covering a range of areas including IT, tax, corporate, commercial, public and criminal law. “Compliance is an issue all over companies and requires input from all areas of expertise,” she says, before adding that the firm is in the process of developing specific tools to help clients – for example, Baker & McKenzie´s BakerPro service has developed software to assist in forensic IT investigations. She also says clients key concerns include their potential exposure to compliance-related matters. Pastor says: “Clients will ask ´do I have a problem? Or ´can you review my compliance programme?´”
Allen & Overy partner Salvador Ruiz Bachs says the most promising opportunities for law firms include the legal framework related to capital requirements of credit institutions, Solvency II affecting insurance undertakings, new Spanish anti-money laundering regulations and practice, the implementation of the Alternative Investment Fund Manager´s Directive in Spain, the project reform of the Spanish settlement and clearing system, and the MIFID2/MIFIR legal framework for EU regulated markets.
María José Menéndez, partner at Ashurst, says financial regulatory compliance offers potential for growth. She adds: “There are obvious links between the financial regulatory environment and the securities market, in which most large corporations are active domestically or internationally.” Meanwhile, Iria Calviño, of counsel at Herbert Smith Freehills says renewable energy, the financial sector and industries that have an environmental impact are the major growth areas in compliance, “because all endure constant legislative reform and are therefore required to adapt their business structures quickly to comply with new regulations”.
Client concerns
Adriana de Buerba, partner at Pérez-Llorca, says: “As of 2013 most of our clients have already implemented internal corporate compliance procedures. Therefore, clients’ main concern is twofold: their compliance officers often need external support to transmit the importance of compliance to their governing bodies and staff; and they also want to ensure compliance programs are updated in line with the frequent legislative changes.”
According to Freshfields Bruckhaus Deringer partner Rafael Murillo, companies now face a raft of regulation that didn’t exist 10 years ago. “One of our clients’ main concerns is to have an internal compliance programme implemented that will contribute to create a culture of compliance within their organisations – another concern is the serious consequences of not complying with regulation and the potential increase in fines that they face, not only as organisations but also at an individual level.”
Luzón says Spanish clients are largely reactive on the issue of compliance. “They are waiting to hear about amendments or real cases,” he adds. Domínguez says that it is only when company directors realise that they could be held personally liable for compliance breaches that they truly wake up to the issue. “Directors are generally not worried about their companies receiving fines, but when they realise they could be punished personally then they say ´let´s work on compliance´”.
Regojo says that small and medium-sized companies have had significant problems implementing criminal compliance programmes due to the economic crisis and the inability to assign the necessary financial resources. He adds that, as the economy improves, there has been an increase in the demand for legal advice on this issue.
Luzón says that all companies do not face the same risks when it comes to compliance. “Major international companies involved in a criminal investigation seem to be more worried about having to face immediate reputational problems, whereas smaller companies would be more worried about having to face the payment of fines that could be imposed at the end of the criminal process,” he says. However, Casanovas argues that small and medium-sized companies do face significant risks. “If a small or medium-sized company in a supply chain is facing a criminal investigation, clients – who may be big entities – may discontinue their relationship with them.” Pastor says: “Big companies will require third party intermediaries to have compliance programmes as well.”
Sense of perspective
Regojo adds that the bill of amendment for the Criminal Code will take into consideration the size of the company when determining what compliance requirements are necessary – for instance, a big company will require an independent control body to oversee implementation and conformity, while these duties can be performed directly by the managing body in a smaller company.
Araoz & Rueda partner Ainhoa Veiga says clients main concerns include having to “harmonise compliance in various jurisdictions”. He adds: “For instance, it’s not easy at all for our multinational clients to produce an effective uniform compliance programme.” According to Pastor, the Spanish courts will expect big companies to have their own Spanish compliance advisory body
One problem highlighted by Casanovas is that the Spanish Criminal Code is not fully aligned with international compliance standards. He adds: “The Criminal Code should be risk-based in order to avoid requesting certain measures that imply costs without having a positive impact in terms of crime prevention or detection.” In this sense, a proper compliance risk assessment is the “cornerstone of any compliance system”, Casanovas says. “The system should be risk-based.” Meanwhile, Casanovas points out that people other than directors could be criminally liable. “There have been judgments in other countries where the responsibility has been put on compliance officers,” he says.
Luzón highlights the widely-publicised case of Siemens, which was fined $800m by US authorities in a bribery and corruption case in 2008. “In response, Siemens hired, as chief compliance officer, a criminal professor who acts as a sort of internal prosecutor who deals with internal investigations,” he says. Similarly, according to Regojo, large companies are now looking for criminal lawyers to be their compliance officers and/or their criminal law internal counsel, in addition to being in charge of managing any criminal litigation involving the company – “they now want criminal lawyers within the legal or compliance teams of companies”. Casanovas says: “In quoted companies, the compliance officers usually come from a split from their law departments or their internal control departments, but compliance departments should be independent to properly perform their duties. Because of the complexity of regulations, what makes sense is to have a compliance body, but some small companies do not have enough people and the compliance function is then developed jointly with other functions.” Casanovas adds that, under the US system, compliance officers in quoted companies are obliged to eventually go outside the company if there is a problem. “They are obliged to go to the regulatory authorities,” he says.
Still ignorant
Alejandro Touriño, partner at Ecija, remarks that his firm´s TMT expertise has highlighted opportunities to advise on the establishment within companies of frameworks of Governance, Risk and Compliance (GRC), which enable companies to “improve their efficiency and strengthen the decision-making processes”. Ecix Group managing partner Álvaro Écija says attitudes to compliance vary widely from company to company: “Some mature organisations have metrics and indicators to know what they’re complying with. That said, there are still many companies that don’t know what compliance is.”
Murray Grainger, managing director of compliance consultancy Impact on Integrity, says: “Enforcement is on the rise globally, with plenty of governments keen to impose penalties to boost their international credentials and their own coffers.” Kennedys partner Jesús Vélez says the firm´s clients are currently asking about how to adapt to EU regulations. He adds: “The insurance market has a great amount of legislation in that regard.”
Osborne Clarke partner Silvia Steiner believes that one of clients´ key concerns is their employees´ interaction with public officials, which could, if illegitimate, “not only harm the company’s reputation, but also give rise to investigations and sanctions”. According to Patricia Manca Díaz, partner at Landwell PwC Tax and Legal Services, some of the main challenges companies are facing is the need for transparency with regard to “how directors align corporate governance with their business”. Meanwhile, Roca Junyent partner Natalia Martí Picó, says it is important that law firms have an intimate understanding of their clients business – as well as regulations in other countries – when it comes to compliance. “For example, new services or products such as crowdfunding or invoice payment platforms, do not yet have regulation in Spain, and nor in the European community.” 
Portugal: Burden of compliance
From a Portuguese perspective, Daniel Reis, partner at PLMJ, says compliance is one of the “few growth areas” at present. However he adds that, as it is more sensible to divide compliance expertise into industry groups, it can be difficult to leverage this expertise unless you are serving several clients in the same sector. Magda Cocco, partner at Vieira De Almeida, says that clients “tended to see compliance as a burden because it doesn´t contribute to the business”. However, she adds that this trend is changing and more clients are aware of the “compliance dividend”, that is the business case for compliance. But Cocco warns that there should be greater consideration given to the regulatory impact on EBITDA (earnings before interest, taxes, depreciation and amortisation) of companies as it can ultimately “kill business” if there is no practical market oriented approach to its application.
André Fernandes Bento, senior associate at Campos Ferreira Sá Carneiro & Associados, says in the last 12 months, financial institutions have been asking for more assistance on compliance policies. Issues of concern to clients include the new Bank of Portugal regulations relating to money laundering, the European Banking Authority’s guidelines on the assessment of the suitability of directors and key function holders, and the legislation implementing the UCITS IV Directive. Bento says that most compliance matters are still treated internally by the relevant institutions, but in-house teams are beginning to become overwhelmed with the new legislation and regulations that has been enacted since the start of the financial crisis.
Morais Leitão, Galvão Teles, Soares Da Silva & Associados senior associate Tiago Félix da Costa observes that there has been an increase in demand from clients for advice in relation to data protection compliance, as well as with regard to business in Africa. He adds that general counsel are increasingly aware of the issue of compliance.
Francisco Brito e Abreu, partner at Uría Menéndez – Proença de Carvalho in Lisbon, says banking and financial services, corporate governance, life sciences, data protection and e-commerce are the business areas that present the most promising opportunities for law firms from a compliance perspective. “These are areas subject to either complex or recent regulation that keeps evolving,” he says. “Regulatory authorities in some of the indicated areas are also playing an important role as they have increased their inspection and monitoring activities, thus imposing higher compliance standards on the market.”
More assertive enforcement
Nuno Carrolo dos Santos, associate at Abreu Advogados, says the financial crisis exposed existing regulatory failure within companies as well as an “enforcement and advocacy deficit from regulators”. He adds: “New regulations have been adopted very quickly and this has caused doubt for clients.” Garrigues partner João Paulo Teixeira de Matos says that there is now an increased demand from clients for compliance advice because there is a feeling that the economy is recovering so now businesses are concerned with other issues. Meanwhile, Cocco says some companies do not perceive the value of effective compliance programmes in some specific fields because they are not aware of the consequences that some practices may have – the area of data protection being a good example of this. Carrolo dos Santos agrees that there “needs to be assertive enforcement” on the part of regulators. Caiado Guerreiro & Associados partner Tânia Pinheiro observes that the Portuguese tax authorities are getting more aggressive, and therefore “tax and legal due diligence proceedings are mandatory to evaluate the possible risks of a transaction”.
Maria João Ricou, managing partner at Cuatrecasas, Gonçalves Pereira in Lisbon, says multinationals as a rule are at a “different stage” when it comes to compliance. “You don´t need to ´sell´ [compliance] for instance to a US multinational, but with domestic companies, while some are already sensible to compliance matters and want to prevent the associated reputational and cost contingencies, some are less so, so you have to be more proactive with these.” Ricou adds that clients should realise that it is “much wiser and much cheaper to take measures to prevent any compliance-related problems arising, rather than trying to tackle a problem after it has occurred”.
Paulo Costa Martins, senior associate at Cuatrecasas, Gonçalves Pereira in Lisbon says that, in Portugal and around the world, the number of regulatory requirements in the financial sector is continuing to increase and multinationals are very keen to identify on a regular basis the resulting gaps between their internal policies and Portuguese legislation. Meanwhile, Dos Santos says: “There are companies that want to understand their compliance obligations in order to manage risk but not necessarily to implement full compliance immediately.”
Outsourcing
Reis says that if a client has in-house lawyers, they generally give external legal advisers more work. “Not having an internal lawyer, can make it challenging for external lawyers,” he adds. Reis says that companies often ask external lawyers to effectively give a “quality seal” to their compliance programmes. He adds that in the banking and pharmaceutical sector most clients have compliance officers, but says this is a lot less common in retail where there may be issues relating to cost and capacity. Another lawyer comments: “I´ve worked in-house in the past and have been instructed to pass on the responsibility for compliance.” Meanwhile Costa Martins adds that, in some credit institutions, the compliance officer is obliged to outsource all compliance work.
Da Costa says there is an increase in demand for high-profile compliance work. “Significant investors are contacting lawyers to get advice on compliance in Portugal – we might find a need to set up a dedicated compliance team.” Bento adds that, for some clients in the financial sector, compliance matters are a significant part of the work carried out by seconded lawyers. For some clients, a secondment is a cheaper option for dealing with their compliance needs, one associate says.
A Lisbon-based partner says that medium-sized and boutique law firms in Portugal may not have the resources to provide sufficient compliance support for a mid-sized client. This can result in mid-sized law firms referring compliance work to larger firms, but often smaller law firms are extremely reluctant to refer work because they fear losing the client, according to another partner at a Lisbon firm.
Albuquerque & Associados partner Antonio Mendonça Raimundo highlights data protection and anti-bribery as growth areas. He adds: “Many Portuguese companies have not yet implemented codes of conduct, and so this is an area of opportunity.” Meanwhile, Cláudia Amorim, senior associate at Sérvulo & Associados, says there has been a “significant increase of cases where we have been representing directors of public entities before the Court of Auditors on procedures regarding financial and ´sanctionatory´ liability.
António Vicente Marques, founding partner at AVM Advogados, says, given that the UK Bribery Act allows the prosecution of an individual or company with links to the UK, regardless of where the crime occurred, clients are gradually becoming more concerned about adopting “effective internal measures and procedures to prevent corruption, fraud, bribery and other unlawful practices in their companies”. Miranda partner Luis MS Oliveira says key client concerns relating to compliance have included: traders’ and charterers’ environmental liability from oil spills at sea; environmental compliance issues relating to oil and gas and to mining; Equator Principles-type compliance for international financing; and soil groundwater contamination. Meanwhile, PBBR & Associados, Sociedade de Advogados partner César Bessa Monteiro says he believes the areas where compliance offers the biggest opportunities for law firms are data protection, consumer protection and environment-related issues. Unlike many other firms, Raposo Bernardo has taken the decision to create a dedicated and specialised compliance team. Partner Sofia Ferreira Enriquez says: “Regulatory compliance is one of the most important and challenging areas for a law firm, considering the constant increase in regulatory action and the high risk involved.”
Rogério Fernandes Ferreira, founding partner of RFF & Associados, says there has been an increase in companies needing advice on tax compliance matters as there has been an increase in reporting obligations as well as greater demand from high net worth individuals that are restructuring their assets.
Therefore compliance is one of the few areas of practice that is currently offering law firms the opportunity for significant growth. And that trend is set to continue. With SMEs still lacking knowledge of this issue, compliance lawyers appear to be operating in what is still a largely untapped market.
