SAP Resolution of FCPA Matter Provides Early Test of DOJ Leniency Policies

A recent criminal resolution between SAP SE (SAP) and the Department of Justice (DOJ) shows that recently revised leniency policies can provide a path to a favorable resolution, even where a company has a recent record of criminal conduct and fails to self-disclose. This outcome may provide companies and counsel with greater comfort as they consider whether to cooperate with the Government once wrongdoing is discovered.

SAP SE, a multinational software company, recently entered into a deferred prosecution agreement (DPA) with the DOJ to resolve purported violations of the Foreign Corrupt Practices Act (FCPA). SAP will pay over $220 million as part of the resolution but, critically, will not be required to enter a guilty plea and will not be required to submit to the appointment of a compliance monitor, despite the fact that SAP entered into a non-prosecution agreement with the DOJ less than three years ago for violating sanctions prohibiting doing business in Iran.

This relatively lenient penalty illustrates the real potential for companies to benefit from the DOJ’s revised Corporate Enforcement and Voluntary Self-Disclosure Policy. Prior to the Government’s recent revision to these policies, which we discussed in previous posts¹, it would have been nearly impossible for a company with such a significant and recent criminal violation to avoid a guilty plea as part of a subsequent separate resolution. This is especially the case where, as here, the company did not self-report the wrongdoing at issue. Because companies that had violated the law in the past were unlikely avoid a guilty plea in any subsequent investigation, they were therefore not incentivized to self-report later violations and cooperate with Government investigators.

In 2023, the DOJ revised its policy to permit recidivists (companies that had violated the law in the past) or other companies whose particular circumstances may have triggered stiffer penalties, to enter into more favorable resolutions with the Government based on those companies’ cooperation with the Government’s investigation.    

While past performance does not guarantee future results, SAP’s experience shows that companies that remediate wrongdoing and cooperate with the government can resolve even serious allegations of wrongdoing without a guilty plea. Companies in a similar position would be wise to consider SAP’s results when evaluating how to respond when potential violations of the law are discovered.

DOJ Policy Revisions

In 2023, the DOJ rolled out a series of revisions to its Corporate Enforcement and Voluntary Self-Disclosure Policy designed to broaden the pool of companies that would be eligible for cooperation credit in order to incentivize additional companies to cooperate with DOJ investigations.

While the changes to the policy were extensive, several are relevant to SAP’s resolution:

• The DOJ could accord as much as a 75% reduction in fines for companies depending on their (a) voluntary self-disclosure, (b) cooperation, and (c) remediation of the corporate misconduct. As under prior guidance, the DOJ could also decline to seek a guilty plea.
• If a company did not voluntarily self-disclose, but fully cooperated and timely and appropriately remediated, the company could receive up to a 50% reduction of the low end of the fine range.
• If the company was a criminal recidivist, the reduction would likely not be off of the low end of the range, and prosecutors would have discretion to determine the starting point within the range and the appropriate reduction.

In March 2023, the DOJ also announced a pilot program in which a company coopering with a DOJ investigation may receive an additional fine reduction if the company has implemented a program to recoup, or clawback, compensation from culpable employees — the Compensation Incentives and Clawbacks Pilot Program.

The SAP resolution provides an interesting case study of the application of these policy revisions.

SAP Deferred Prosecution Agreement

SAP entered into a three-year DPA with the DOJ in connection with alleged schemes to pay bribes to government officials in South Africa and Indonesia to obtain government business that spanned from 2013 through 2018.

Here, SAP was a recidivist, having entered into a non-prosecution agreement with the DOJ’s National Security Division in 2021, and a resolution in 2016 with the Securities and Exchange Commission related to FCPA violations in Panama. Nor did SAP voluntarily self-disclose the instant misconduct. Nevertheless, due to SAP’s extraordinary cooperation and remediation, and consistent with revised DOJ guidelines, the DOJ and SAP agreed to a relatively lenient punishment, including a DPA.

The DOJ noted that SAP had provided “substantial cooperation” by:

• Immediately beginning to cooperate once misconduct became public, and provided regular periodic factual updates to the Government as SAP’s own internal investigation uncovered information;
• Expeditiously producing relevant documents and information located overseas, while navigating the data privacy laws of foreign jurisdictions, as well as analyzing and organizing voluminous and complex information;
• Making officers and employees available for interviews;
• Translating voluminous foreign language documents for the Government; and
• Imaging the phones of relevant custodians at the beginning of the investigation, ensuring that relevant and probative communications were preserved.

SAP also engaged in timely remedial measures by, among other things:

• Undertaking a root cause analysis and comprehensive risk assessment around payment processes;
• Eliminating its third-party sales commission model and enhancing its code of conduct and policies regarding gifts, hospitality, and use of third parties;
• Increasing resources devoted to compliance and restructuring its compliance function, including enhancing compliance monitoring and audit programs and broadening its data analytics capabilities;
• Adjusting compensation policies to incentivize compliance; and
• Promptly disciplining all employees involved in the misconduct.

As a result of this cooperation and remediation, SAP received a criminal penalty that reflected a 40% reduction off of the tenth percentile of the applicable sentencing guidelines. This is despite SAP’s prior corporate misconduct and its failure to self-report the illegal conduct at issue.

SAP also received a $109,141 credit under the Criminal Division’s March 2023 Compensation Incentives and Clawbacks Pilot Program, which we discussed in the past. This represents the amount of bonuses SAP withheld during the course of its internal investigation from culpable or supervisory employees. The DOJ points out that SAP engaged in “substantial” litigation to defend this withholding.

Because SAP undertook substantial remediation steps, including the enhancement of its compliance program, and agreed to undertake certain reporting requirements, the Government determined that it was not necessary to require the appointment of an independent compliance monitor.

Key Takeaways

• Prior to the 2023 revisions to the DOJ policies, the DOJ believed that companies with prior criminal resolutions, or that did not self-disclose misconduct, were not sufficiently incentivized to cooperate.
• The DOJ’s policy revisions sought to address that issue by announcing, in part, that such companies could still be eligible for significant fine reductions and avoidance of guilty pleas, as long as those companies undertook significant cooperation and remediation obligations.
• The SAP resolution represents one of the most prominent applications of the DOJ’s new policy. SAP’s penalty was significantly reduced even though SAP had a recent resolution with the DOJ and did not self-report. 
• As the SAP resolution demonstrates, cooperation with a DOJ FCPA investigation is incredibly burdensome. In addition, companies undertake such cooperation and remedial measures with no guarantee that the DOJ will consider those steps sufficient or agree to a reasonable resolution. This presents a significant risk that companies need to weigh when considering whether to contest the DOJ’s allegations or commit to cooperating.  

As the DOJ ramps up corporate pleas, companies should continue to devote resources to maintaining a robust compliance program and should consider the factors that the DOJ has emphasized: voluntary self-disclosure, complete cooperation, and swift remedial measures. Buchanan’s white collar defense, compliance and investigations attorneys are available to guide companies through this new DOJ corporate enforcement era.