DOJ unveils “significant change” in ECCP approach to communication platforms
“Significant changes” have been made to the DOJ's ECCP (Evaluation of Corporate Compliance Programs) with a focus on the use of personal devices.
In December 2022, the Department of Justice’s (DOJ) Nicole Argentieri suggested that the DOJ was looking into new guidance for companies surrounding recordkeeping obligations for communications on personal devices, apps, and ephemeral messaging. In a speech to the International Conference on the Foreign Corrupt Practices Act, the Acting Principal Deputy Assistant Attorney General said that the DOJ was “examining whether additional guidance is necessary”.
Three months later and, true to its word, the DOJ has unveiled “significant changes” to its Evaluation of Corporate Compliance Programs (ECCP). These changes focus predominantly on how the DOJ will consider a corporation’s approach to “the use of personal devices as well as various communications platforms and messaging applications” when conducting criminal investigations.
What are the changes to the DOJ’s ECCP?
A proactive approach to e-communication, from both sides
Broadly speaking, the DOJ’s ECCP is being adjusted so that, in the course of criminal investigations, it will consider how an organization has tailored their policies to govern the use of messaging applications in a way that is specific to its “risk profile and specific business needs”.
The DOJ will also be looking to see that business-related electronic data and communications “can be preserved and accessed” as appropriate, as well as asking about the use of any ‘bring your own device’ (BYOD) program.
These changes are not purely administrative, however. The DOJ also wants to see that – beyond the adaptation of policies – firms are being proactive in the communication and execution of those policies. Specifically, it will consider how well companies are communicating their e-communication policies to employees, and whether they are enforcing them consistently.
For the DOJ, proactivity is not a one-sided expectation. In his most recent speech on March 3, Assistant Attorney General Kenneth Polite JR. added that the Department will no longer be conducting investigations “at face value”. For instance, where a company does not produce communications from third-party messaging applications, DOJ prosecutors will dig deeper and ask probing questions, including whether the company is able to access third-party communications, where these communications are stored, and whether they meet applicable privacy and local laws.
Polite noted that, when investigating potential criminal activity, the DOJ does not just want to understand what happened but why it happened, and whether it will happen again.
The DOJ’s ECCP will now assess how compensation systems contribute to compliance
Within his speech, Polite highlighted individual accountability as “one of the most pressing challenges we face”. With that in mind, and with a view to tangibly hold individuals to account for their action – or inaction – the DOJ’s Criminal Division has updated its policies for corporate compensation systems.
Moving forward under the revised ECCP, DOJ prosecutors will be carefully exploring how a firm’s compensation structure and consequence management “contributes to the presence – or lack – of an effective compliance program”. Polite noted that there have been “substantial revisions to the ECCP about clawbacks and the use of personal devices and other communication platforms”, which look to recognize their importance and also provide transparency around how prosecutors will consider them within investigations.
A new pilot program for corporate compliance programs
The Assistant Attorney General used his speech as a springboard in which to launch a three-year pilot program for organizations surrounding compensation for corporate compliance. The program has two main factors:
1. It requires that, as part of a criminal resolution, corporate compliance programs should include compensation-related criteria; and
2. It introduces fine reductions for companies that seek to clawback compensation in appropriate cases.
In essence, the DOJ will reward organizations who actively tackle and enforce their corporate compliance policies through punitive remedial measures. The goal of the new pilot is “to ensure that the company uses compliance-related criteria to reward ethical behavior and punish and deter misconduct.”
Companies that cooperate with DOJ investigations in a timely manner may receive further fine reductions where they have implemented a “program to recoup compensation and uses that program.” This program expands not only to those who perpetrate wrongdoing, but to those responsible for the supervision of such activities who either knew, or were “willfully blind” to misconduct.
After three years, the DOJ will consider the effectiveness of the pilot and how to move forward.
Incidentally, perhaps, the DOJ’s revised approach to compensation structures concerning illicit comms directly mirrors recent news that financial institutions are capping bonuses where staff do not comply with e-communication policies.
Act now, not later for the DOJ’s ECCP
Given the already-turbulent regulatory landscape, and in the midst of a maelstrom of regulatory enforcement surrounding illicit communications, Polite acknowledged that some may ask why the DOJ is making these “significant changes” now. His response is that “there is no better time”, adding:
“Are we to shy away from the problems posed by the increased use of new ways to communicate in our personal and professional lives? Are we to ignore the problems posed by companies that fail to recognize the clear connection between compensation and compliance?”
In essence, Polite says that there is no time like the present. Acting now means that firms will start to revise their policies sooner, or that whistleblowers may feel empowered to report wrongdoing, or compliance professionals may feel better equipped to advocate for more resource. If the DOJ acts now, wrongdoing may be prevented – or remedied – faster.
Finally, Polite issued a call to action for all facets of legal and compliance:
“Craft and implement effective compliance programs that can detect misconduct. Push to create a culture of compliance. Empower ethical employees.”
Imagine, he asks, if “instead of focusing on the end result of criminality” the industry “engaged more at the root cause, and became more proactive to prevent it in the very first place”. The DOJ doesn’t want to see wrongdoing remediated, it wants to see an active approach to compliant communications that weeds out wrongdoing at the root, and prevents it from ever being able to flourish.
If you’re looking for a proactive solution to compliant communication, from SMS to WhatsApp, Global Relay has the solution.
