Regulatory Compliance Report 2013: A ticking time bomb

The crisis has prompted a run of ever-changing regulations across Iberia, bringing to the forefront the increasing need for legal services on compliance. But more recently, it is the costs of non-compliance that are grabbing the headlines. Cases involving fines, reputational damage and even potential jail terms are highlighting the risk companies take if they do not make compliance a priority.

Iberian companies are entering a new era where compliance is seen as a ‘must have’ rather than a ‘nice to have’. Until recently, it was only the large multinationals that had it at the top of their agendas, while the small and medium-sized (SMEs) were far more concerned with surviving the crisis.
But the consequences of non-compliance are hitting the headlines, with corruption and fraud cases on the rise. And what is grabbing companies’ attention is not only the reputational and economic damage, but the personal liability of company employees that could result in a jail term if convicted.  
SMEs are therefore waking up to the need for internal programmes, policies and compliance officers, and to do so before any problems arise. With compliance, prevention is always better than cure.
“While perceived by some companies as a necessary burden, others believe that there is a compliance dividend – a business case for investing in proactive compliance programmes,” says Magda Cocco, a Partner and Co-Head of the TMT, Privacy & Data Protection, IT & Outsourcing practice group at Vieira de Almeida.
Clients therefore want law firms that offer teams with specific industry knowledge, tackling compliance from both a legal and economic perspective, and anticipating changing legal frameworks.  And there is no doubt that compliance is now top of the priority list, say lawyers, as the penalties for not doing so could potentially devastate a business.

What is ‘compliance’?
The concept of compliance is a huge challenge, with many different variants on its exact meaning. The problem is that it touches so many areas, and the regulations are hugely varied depending on sector.
But there is a common methodology across the board, agree lawyers – the need for a company to understand and comply with a set of rules to be able to work in their domestic market and also to enter and do business in international ones. “And some clients are at the forefront of compliance,” explains Cecilia Pastor, Corporate Partner and Head of Compliance at Baker & McKenzie in Spain. “They have taught us what compliance is and how to live with it.”
Risk management is a key concern at the moment, at both strategic and operational levels. Organisations are therefore increasingly placing greater emphasis on compliance and governance issues, says Iria Calviño, Co-Head of Public law & Regulatory practice of Herbert Smith Freehills Spain.
However, one complaint from lawyers and clients alike is that Iberian regulations are not clear when compared to the transparency of the US and UK systems, for example. “The real question is what we understand by the term ‘compliance’,” says Alejandro Touriño, IT and Compliance Partner at Ecija. “Since our regulations are at such an early stage, we can decide what they should cover and what we mean by ‘compliance’ in Spain.”
Portugal is also learning how to play the game of regulatory law, says Gonçalo Anastácio, Head of Competition at SRS Advogados. “Many stakeholders don’t want to understand the regulation that is needed in our new liberalised economy. But as this is changing, it is becoming increasingly necessary to have proper regulatory tools.” One of the major problems, say lawyers, lies with the regulators themselves. “Clients tell us that they don’t know how to act or how to comply because some regulators do not issue guidelines or reply in time to questions,” explains João Paulo Teixeira de Matos, a Partner at Garrigues in Portugal.  
Maybe one good thing to come out of the crisis is that the country has become more exposed to, and scrutinised by, the international community. For Portuguese companies to do business abroad, and also for the domestic economy to attract much-needed investment, there has to be transparency when it comes to compliance. But compliance is still very much an elitist concept in Portugal, summarises Daniel Reis, TMT Partner at PLMJ: “It is a rich man’s game.”

The client perspective
Clients are becoming increasingly aware of the consequences of non-compliance, especially given the increased risk of high fines, the lack of an efficient judicial control, and, more importantly, the potential for individual criminal liability and potential jail terms.
But the meaning and awareness of compliance also depends very much on the sector and nationality of the client. According to Irene Martínez Saltó, a lawyer in the Corporate Compliance Department at Cuatrecasas, Gonçalves Pereira in Spain, there are two types of client – Spanish companies with no experience in corporate compliance or how to deal with criminal liability issues, and multinational companies with subsidiaries in Spain that need to adapt, expand and harmonise their procedures to the Spanish legal requirements.
Lawyers across Iberia agree that international companies are those more open to the issue. “Foreign clients often come to you asking for advice on compliance,” says Santiago Garrido, Head of Regulatory at Hogan Lovells in Spain, “but with Spanish clients, sometimes you have to sell the concept to them.”
Spanish companies don’t yet understand that the most important point for any compliance programme is evaluating risk, says Bernardo del Rosal, Of Counsel at Clifford Chance in Spain. “Preventing risk is the best guarantee at avoiding problems in the future. But we need a big example case in the courts before companies will take note.” Pescanova and Caja Madrid are two very recent examples, and lawyers believe there are many more to come.
However, many clients feel that because they already have a compliance programme they are covered. But it is not a question of having one, but of whether it actually works and deals with the question of liability.
In Spain, SMEs and foreign-owned subsidiaries are those with increasing compliance needs, says Rocio Merlino Sanchez-Elvira, a Partner at Islaw Abogados in Spain. Medium-sized enterprises that are expanding require the most support when it comes to compliance, because as a consequence of growth, they usually have to adapt their structures and capacities to new tax obligations, for example. “In those cases, they often rely on the use of external advice services,” says Carlos Diéguez, Head of Tax at Broseta, “accompanying them in the process of the implementation of new tax management procedures.”
Over the past months, major amendments affecting entities doing business in Spain have been introduced, mainly related to corporate income tax and new reporting duties. These entities should therefore pay special attention to tax compliance, says Pablo Wesolowski, Senior Partner at DAC Beachcroft  in Spain, in order to avoid unexpected risks and subsequent penalties.
Compliance, however, is not necessarily a current priority for a number of SMEs, as they are focusing on overcoming the difficult market situation.  But more and more mid-sized enterprises are seeing that compliance is not just an issue for big companies or multinationals, and recognising that the financial and criminals risks of non-compliance can be life-threatening. “On the other hand, clients see that meeting their compliance commitments not only helps to avoid risks but also brings financial added-value,” says Sönke Lund, a Partner at Monereo Meyer Marinel-lo Abogados. “Lots of their business partners demand proof of compliance by the company, and this development will be even stronger in the future.”
A criminal necessity
Amendments to the Spanish Criminal Code mean that the prevention of company and individual criminal liability, including directors and employees, is a key area where clients are asking for assistance, according to Estibaliz Aranburu, a Partner at Gómez-Acebo & Pombo. And when defending against allegations of personal liability, if the company can show that they have an established compliance programme in operation, then it may help to mitigate the charges, says Jesús Santos, Head of White Collar Crime at Baker & McKenzie in Spain.
But this poses a number of difficulties because there are no guidelines on how to shape compliance programmes, and what specific measures, structures or procedures must be implemented by a company to prevent bribery and other criminal conduct, says Juan Jiménez-Laiglesia, Co-Managing Partner at DLA Piper Spain.  Nor are there guidelines on how to develop effective corporate anti-corruption policies, which makes it difficult to analyse compliance in the context of corporate criminal liability arising from bribery offences.
However, the Ministry of Justice has recently submitted a draft amending the Spanish Criminal Code to the Council of State to tackle these very issues and more. Described by lawyers as a potential “breakthrough” in the compliance arena, the draft still has to go through the legislative process before things can really begin to move forwards.

Spanish demands
The financial sector is in turmoil, and, as a consequence of the crisis, recent years have seen an rise in the amount of regulation. The Spanish authorities have also been increasing the pressure for information in the financial sector, and the costs of compliance have never been higher, say lawyers. Furthermore, says Natalia Martí Picó, Corporate Partner at Roca Junyent, the complexity and the technicality of some areas, such as derivatives and securitisations among others, as well as the effects of this complexity and the technicality on the market, have produced in regulatory rules in these areas.
Since the onset of the crisis, there has also been a very noticeable upturn in the number of investigations conducted by the Tax Authorities, says Adolf Rousaud, Managing Partner and Head of Corporate at Rousaud Costas Duran in Barcelona. And this has increased further as the economic situation has deteriorated.
Key areas of client concern include the review of compliance programmes and general policies of the company and the implementation of whistle blowing channels, according to Miguel Bermúdez De Castro, Corporate and Finance Partner at Jones Day in Spain, as well as assistance in antitrust dawn-raids and cartel investigations, and the drafting of guidelines for competition inspections.
Advice on and implementation of the US Foreign Corrupt Practices Act (FCPA) and other anti-bribery regulations is also very much in demand. And practical advice is also needed on corporate governance, risk management and other areas, says Jesús Vélez Partner, Insurance/Reinsurance Partner at Kennedys Abogados, which are key to clients operating successfully in their respective regulated environments.
The Spanish energy sector, in particular, has suffered the consequences of the Government’s attempts to reduce the ‘tariff deficit’ and to re-establish the balance between the costs and revenue within the Sector. “There have been several regulatory changes during 2012, so the demand of legal compliance services has significantly increased,” says Antonio Morales, a Partner at Latham & Watkins in Spain. In particular, renewable energies are facing permanent legislative changes, according to Juan Rodríguez Cárcamo, a Public Law Partner at Pérez-Llorca.
And changes in metals prices, and the prospect of shale gas production activity in Spain, are increasing the activity of junior mining and oil and gas companies. Accordingly, their compliance needs are also growing due to new and stricter regulations, as well as due to community concerns and social pressure by ecological organisations on the Administration, says Antonio García Muñoz, Head of Public, Regulatory, Environmental and Competition at Lener.

Portuguese necessities
Portugal also suffers in the energy sector, most notably due to the legislative and regulatory changes impacting it over the last year as a result of the MoU signed with the Troika. Furthermore the water and waste management sectors, particularly on environmental matters, are high on agendas. Complying with environmental law is always something to which clients ask for a ‘high level’ of attention. The requirements have been increased in the last years, says Rita Santinho Martins in Administrative, Regulatory and Environmental at Gómez Acebo & Pombo in Portugal, and the regulatory authorities are increasingly demanding.
In addition to the banking, finance and insurance sectors that were directly impacted by new regulations as a result of the crisis and increasing levels of accountability, other sectors have been targeted by increased compliance requirements, says António Vicente Marques, Founding Partner of AVM Advogados. “Pharmaceutical, healthcare, telecoms and activities impacting on environment are some of the sectors affected by this new wave of compliance requirements.”
And medium-sized companies in the technology and scientific sectors are increasing their activity in Portugal, adds Cláudia Amorim, Senior Associate in Corporate Crime and Regulatory Compliance at Sérvulo & Associados, and trying to take their first steps towards risk management.
In tax in particular, increasing pressure from the Authorities has been felt in recent years in relation to the assessment and collection of taxes. Accordingly, two big trends have emerged in tax compliance lately.
The first is an increasing demand from high-net-worth individuals to restructure their assets to comply with the applicable regulations, avoiding any future additional assessments, says Rogério Fernandes Ferreira, Founding Partner at tax boutique RFF & Associados. “And companies continue needing judicial assistance in tax litigation as there have been, on several matters, administrative instructions which, despite being in breach of the applicable legislation, are put in place to raise the tax revenue.”

Crossing the border
Doing business in general is becoming more and more complex. Business is increasingly done on a worldwide, basis, which, according to Sofia Ferreira Enriquez, Head of Regulatory and Compliance at Raposo Bernardo, means that more laws and regulations apply. Generally speaking, the failure of a company to comply with the local law of a given jurisdiction may mean failing to gain international visibility, and therefore competitiveness, says Tânia Pinheiro, a Partner in Tax, Restructuring, Administrative and Judicial Tax Litigation at Caiado Guerreiro.
With the crisis increasing the need for internationalisation, clients are facing complex regulatory frameworks worldwide. “The potential risks of ineffective global governance and compliance systems for multinational companies are often not recognised until failure occurs,” says Patricia Manca, Regulatory and Corporate Compliance Partner PwC Tax & Legal Services in Spain. “One of the major challenges that multinationals entities are facing is the need for the implementation of internal controls to ensure effective control of legal entities on a global basis.”
Internationalisation is therefore an important question, as it can, and in fact very often does, present serious compliance issues, says Antonio Mendonça Raimundo, a Partner at Albuquerque & Associados, especially relating to specific geographical areas where the harmonisation of laws, regulations and practices does not exist or is scarce.
For Spanish companies with an international presence, the way to address compliance matters is to apply the strictest and most advanced laws, rules and regulations to all their worldwide operations. “The aim is to apply a sole set of policies and procedures to the holding company and all its worldwide subsidiaries,” explains Silvia Steiner, Commercial, Competition & Anticorruption Compliance Partner at Osborne Clarke in Spain. This will not only assure the company being legally compliant but also allows for more effective control and follow-up in the implementation of policies and procedures.
While the international law firms can rely on their own offices worldwide, many domestic firms tackle the issue of cross border advice by using international networks and alliances to allow them to provide a more complete and global approach to compliance. But a challenge that both frequently face is having to explain to clients that they have to comply with certain rules that don’t exist in their domestic legal systems, adds Reis at PLMJ.
Consequently, export compliance is becoming an increasing problem for Spanish companies, particularly those working in the Middle East, and similar jurisdictions, says Manuel López, Regulatory Finance Partner at Ashurst in Spain, as they are now realising the problems that they might have. When foreign clients are acquiring Iberian companies that are trading internationally, for example, they always question whether these companies are complying with all the necessary rules and regulations worldwide – something that could prove to be a deal breaker.
The money and risks involved can be tremendous, as it has the potential to affect the companies, third-parties, exporters, and even banks and insurance companies. Therefore foreign clients are taking compliance very seriously, say lawyers, and domestic companies have to act quickly to ensure they are fully compliant, or risk losing foreign clients.

Good business sense
The bottom line seems to be that if a client’s core business is affected, then they will pay attention to compliance. Lawyers see that unless clients see an example of the repercussions of non-compliance then many don’t understand why they need to invest. “Portuguese companies don’t want to spend money, and when it comes to compliance they feel that lawyers are selling them things they don’t need,” says Tiago Félix da Costa, a Litigation and Arbitration Lawyer at Morais Leitão, Galvã Teles, Soares da Silva. “What we need is one big example case and then everyone will understand the consequences of not paying attention.”
Furthermore, the size of a company is not a defining factor when it comes to the importance of compliance, but sustainability is, says Armando Martins Ferreira, a Partner at Abreu Advogados. Companies need to be compliance-oriented to be successful in the long run, and better prepared to overcome market stress caused by the pressure of regulators, competitors and clients, and to face new external market opportunities.
With increasingly complex regulatory regimes worldwide, and businesses internationalising to mitigate their inactivity domestic markets, clients can no longer take a mostly reactive approach, and must proactively embrace a preventative one.
“You need to be compliant by law,” says João Mattamouros Resende, a Corporate/Commercial Partner at Cuatrecasas, Gonçalves Pereira in Portugal, “but there is also a commercial need for it. Compliance just makes good business sense.”
Therefore, the rise in reported corruption and fraud cases, and the headline grabbing criminal sanctions currently being faced by directors and employees, means that companies can no longer ignore the issue of compliance.

Spanish style

When it comes to having a compliance department, it is the international firms and Big Four auditors that lead the way in Spain. This is due to their US or Anglo Saxon influences – jurisdictions that have a more advanced compliance approach than their Iberian counterparts.
Baker McKenzie, for example, is divided into international groups with global and regional steering committees, and a dedicated team in Madrid. While at BDO, they have a strong Anglo-Saxon influence so compliance is in their culture, according to Paula Álvarez-Ossorio, Director of the Legal Department at BDO in Spain.
At Jones Day, the Madrid office has a multidisciplinary team that coordinates with other worldwide offices of the network, if needs be, on cross-border matters. DLA Piper Spain also has an internal Risk Management and Compliance Helpdesk.
The domestic firms, however, adopt a more varied approach. At Pérez Llorca, for example, they have a compliance department with members from different teams, while at Monereo Meyer Marinel-lo Abogados, the Compliance Department is embedded in their Corporate and Business Transactions Practice Group. Since the end of 2010, Cuatrecasas, Gonçalves Pereira has had a corporate compliance team, while Ecija has a dedicated compliance team within its Information Technology department.  And at Garrigues, compliance advice is implemented by multidisciplinary teams led by the criminal law, corporate governance and sustainability departments, explains Jesús de la Morena, a Partner at Garrigues in Spain.
Lupicinio Abogados, however, takes another approach, with a mix of an internal department with an external alliance – Informa Consulting, a firm of compliance services. “The team is formed by lawyers, auditors and consultants providing an interdisciplinary perspective to our services,” says Sergio Salcines Gasquet, Head of their Compliance.

Portuguese practice

Most law firms agree that due to the size of the Portuguese market, and the considerable amount of national and EU industry regulations, it is very difficult to set up a ‘one size fits all’ team.
Different business areas have different compliance needs, says Bruno Azevedo Rodrigues, a Partner at ABBC, and while a ‘preventive’ approach may be common, the issues that each sector faces, the clients’ obligations and the measures and remedies to adopt are quite diversified. As a result they have dedicated teams advising on regulatory matters, including compliance, on a sector-basis.
Pbbr also has a team specialised in compliance issues, says César Bessa Monteiro, an IP and TMT Partner, made up of a specific group of lawyers, one from each area of specialisation. While AVM Advogados forms multi-jurisdictional teams gathering experts from the relevant jurisdictions.
At Miranda Correia Amendoeira & Associates, they have implemented a multi-tiered approach to regulatory compliance, says Luis MS Oliveira, Head of Public and Regulatory, organising teams on the basis of clients’ needs for legal assistance on compliance, with rules that are specific to each of the various regulated industries, and also common cross-industry compliance rules.
At Gómez-Acebo & Pombo in Lisbon, their tailor-made team approach is led by a lawyer in regulatory compliance, part of the public department, and in charge of organising specific task force teams according to the practice areas and sectors involved.
While this trend of an ‘ad hoc’ method of providing compliance services isn’t likely to be changing anytime soon, say lawyers, this doesn’t mean it won’t eventually have to happen.
Many believe that in the future Portuguese law firms will have to have dedicated compliance departments, although this may take a while to materialise.