Service by U.S. citizens on foreign boards of directors has been a topic of intense national interest recently. Beyond recent headlines, service on a foreign board can be rewarding and important—helping foreign companies access U.S. markets and capital, improving operational efficiencies, and adding technical and financial expertise. However, it can also bring challenges. For one, foreign-based companies remain a target of U.S. prosecutors and regulators. Indeed, some of the most notable civil enforcement actions and prosecutions in recent years have involved foreign-based entities. In 2017, for example, a Swedish company, Telia AB, paid almost a billion dollars to the Department of Justice and the SEC to settle charges under the Foreign Corrupt Practices Act. The U.S. Attorney's Office for the Southern District of New York recently brought criminal charges against a Turkish bank for violating U.S. sanctions laws. And earlier this year, in separate cases, the SEC charged both a Japanese (Nissan) and a German (Volkswagen) car manufacturer with violating the anti-fraud provisions of the U.S. securities laws.

Here, in part one of a two-part series, we outline four areas in which U.S. enforcement authorities have been particularly active in recent years and suggest questions that potential or serving US directors should consider asking.

The Foreign Corrupt Practices Act

While the Foreign Corrupt Practices Act has been a focus of DOJ and SEC enforcement efforts for many years, recent actions make clear that its reach can extend to activities having little, if any, contact with the United States.

The FCPA contains both anti-bribery provisions and accounting provisions. The anti-bribery provisions prohibit the making of payments intended to induce or influence foreign officials, political parties, or certain other persons to use their position "in order to assist … in obtaining or retaining business for or with, or directing business to, any person."

The anti-bribery provisions apply to U.S. persons and businesses (called "domestic concerns" under the statute); U.S. and foreign public companies that are either listed on a U.S. exchange or that are required to file reports with the SEC (called "issuers" under the statute); and certain foreign persons or businesses taking actions within the United States.

The FCPA's accounting provisions require "issuers" to make and keep accurate books and records (the books and records provision) and to establish and maintain appropriate internal accounting controls (the internal controls provision) and prohibit individuals and businesses from falsifying books and records or knowingly circumventing or failing to implement a system of internal controls.

The SEC can bring civil FCPA enforcement actions against issuers and their officers, directors, employees and agents. The DOJ has authority to bring criminal actions against issuers and their officers, directors, employees and agents for FCPA violations, as well as criminal and civil actions against domestic concerns and against foreign businesses and persons for acts that occurred in the United States for violations of the anti-bribery provisions.

It bears emphasizing that the definition of issuer—a type of entity subject to both the anti-bribery and accounting provisions—can include foreign-based companies. The FCPA defines an issuer as an entity that has "a class of securities registered pursuant to Section 78l of this title or [are] required to file reports under Section 78o(d)." Under this definition, "issuers" can include foreign companies with automatic depositary receipts (ADRs) or automatic depositary shares (ADSs) listed or traded on a U.S. exchange.

For example, in January 2017, a Chilean mining company, Socieded Quimca y Mintera de Chile, S.A., entered into a settlement with the SEC and a deferred prosecution agreement with the DOJ, resolving allegations that it violated the FCPA's accounting provisions by making payments to Chilean political figures and their associates. Although the relevant conduct appears to have occurred entirely outside the United States, both the DOJ and SEC asserted jurisdiction over the company because its ADRs traded on the New York Stock Exchange.

Similarly, the definition of "domestic concern" covers any U.S. citizen, even, for example, someone acting as a director, officer or employee of an entity that is not an issuer. Recently, for example, the DOJ filed criminal FCPA charges against a Texas woman—i.e., a "domestic concern" for statutory purposes—based on payments she made to Ugandan officials to facilitate the adoptions of Ugandan children. See press release, "Texas Woman Pleads Guilty to Conspiracy to Facilitate Adoptions from Uganda Through Bribery and Fraud," (last visited Nov. 11, 2019); Information, United States v. Longoria, No. 19 Cr. 482 (N.D. Ohio Aug. 12, 2019) (noting the defendant was a "domestic concern").

Further, with respect to the anti-bribery provisions, the FCPA prohibits payments to, among other things, "foreign officials"—a term that extends well beyond individuals wearing a government uniform or carrying a badge. The FCPA itself defines "foreign official" to include employees and officers of "departments, agencies, or instrumentalities" of foreign governments," and at least one federal court of appeals has broadly defined "instrumentality" for FCPA purposes as including any entity "controlled by the government of a foreign country that performs a function the controlling government treats as its own," see United States v. Esquenazi, 752 F.3d 912, 925 (11th Cir. 2014), cert. denied 135 S. Ct. 239 (2014). Esquenazi's broad definition of "instrumentality" heightens the FCPA risks for companies operating countries with a large number of state-owned enterprises.

In short, the FCPA's potential reach extends well beyond U.S.-based, publicly traded companies and well beyond interactions with individuals directly employed by a foreign government. As discussed below, U.S. nationals serving as, or considering serving as, directors of foreign companies would be well-served to conduct reasonable diligence into their company's FCPA compliance practices.

Registration Requirement for Foreign Agents

The registration of "agents of a foreign principal" is another area that has garnered increased attention in recent years, in part because of the prosecutions of Michael Flynn, Paul Manafort and Richard Gates under the Foreign Agents Registration Act (FARA).

FARA requires "agents of a foreign principal" conducting activities in the United States to register with the National Security Division (NSD) of the Department of Justice. FARA provides for criminal penalties for a person's willful failure to register and/or for making false statements in connection with the registration process. See 22 U.S.C. Section 618(a). FARA also contains a civil enforcement provision, allowing DOJ to enjoin any person or agency who the attorney general determines is about to violate the statute or its implementing regulations.

Although FARA was originally enacted in 1938, the DOJ prosecuted only seven FARA cases between 1966 and 2015. Following a 2016 DOJ Office of Inspector General Report recommending a more comprehensive FARA enforcement strategy, DOJ has brought numerous FARA cases, including the high-profile matters referenced above.

Much like the definition of "issuer" under the FCPA, the term "agent of a foreign principal" applies in settings well beyond what may first come to mind when one thinks of a James Bond-like "foreign agent." The definition of "foreign principal" itself includes not only foreign governments and political parties, but any "person outside of the United States" and "a partnership, association, corporation, organization, or other combination of persons organized under the laws of or having its principal place of business in a foreign country."

The definition of "agent of a foreign principal" is similarly broad. It includes, somewhat circularly, "any person who agrees, consents, assumes or purports to act as" such. It also includes, for example, people who act in the United States "in political activities for or in the interest of a foreign principal," undertake public relations activities for the foreign principal in the United States, represent "interests of the foreign principal before" the U.S. government, or "solicit … things of value for or the interest of the foreign principal."

Notably, FARA contains a number of exemptions to the registration requirement. These include a "commercial exemption," which exempts "private and nonpolitical activities in furtherance of the bona fide trade or commerce" of a foreign principal. Nonetheless, the exemptions themselves are vaguely worded, there is a dearth of case law interpreting them, and although NSD now publishes advisory opinions as to whether certain activities require registration, these opinions are of limited precedential value.

OFAC/Sanctions Risk

U.S. sanctions law and regulations are another area both that has seen increased enforcement activity in recent years and that is of particular relevance to U.S. directors and officers of foreign companies.

The International Emergency Economic Powers Act of 1977 (IEEPA) affords the executive branch of the U.S. government broad authority to impose economic sanctions on foreign governments and other groups and individuals. The Office of Foreign Assets Control (OFAC) of the Department of the Treasury is charged with enforcing most U.S. economic and trade sanctions programs. OFAC can pursue civil remedies against individuals or entities that violate sanctions, even unwittingly, and the DOJ can bring criminal charges for "willful" sanctions violations. OFAC also issues licenses to allow activity that would otherwise be prohibited under sanctions programs.

Significantly, sanctions prohibit not only dealing with the governments of a particular country, but also dealing with specific named individuals and entities designated by OFAC as "specially designated nationals and blocked persons" (SDNs). U.S persons and companies are prohibited from transacting business with an SDN and are required to block any assets of an SDN that come into their possession.

In 2018, for example, OFAC designated 38 Russian parties as SDNs, including seven Russian "oligarchs," 12 companies they owned or controlled, a Russian-stated owned bank, and several Russian government officials, based on allegedly close ties between these parties and the Putin regime, including its activities in Syria and Ukraine. OFAC's SDN list, which is publicly available on its website, includes approximately 6,400 companies and individuals designated as SDNs.

Moreover, any legal entity which is more than 50% owned by an SDN (or multiple SDNs) is also subject to these prohibitions, even if not on the SDN List.

For U.S. directors of foreign companies, there are two types of sanctions to be aware of. First, "primary sanctions" restrict companies and individuals that have sufficient ties to the United States—including U.S. citizens—from engaging in transactions with persons or entities in (or associated with) a sanctioned country. Individuals who commit primary sanctions violations can face civil and criminal penalties. Once again, as with FARA and the FCPA, the regulators (here OFAC) broadly construe the concept of sufficient ties to the United States. To give one example, in 2017, a Singaporean company, agreed to pay OFAC a $12 million penalty based on fund transfers it had made and received in connection with project to deliver and install telecommunications equipment in Iran. The only apparent U.S. nexus was that some of the fund transfers were in U.S. dollars and (as such) were processed through the United States. Moreover, U.S. directors should be aware that their own involvement in a deal or transaction may supply a sufficient U.S. nexus such that the transaction violates U.S. sanctions and exposes the foreign entity (and the directors themselves) to potential civil and criminal penalties.

Second, "secondary sanctions" do not require any U.S. nexus and instead allow OFAC to sanction non-U.S. persons or entities, typically by cutting off their access to U.S. financial institutions. For example, a 2017 law requires the imposition of secondary sanctions with anyone who engages in a "significant transaction" with the Russian defense or intelligence sectors. Notably, however, even attempting to avoid secondary sanctions may carry significant punitive risks: in 2018, a Turkish banker was convicted of criminal charges in the Southern District of New York, for helping a structure transactions with Iranian entities, to avoid the imposition of secondary sanctions based on dealings with Iran. The conviction is currently being appealed, although in defending the conviction, the government has acknowledged that the prosecution conflicts with OFAC's "historical position that" punitive measures, such as a criminal prosecution, attach only after sanctions have been imposed.

Securities Laws

Certain foreign-based companies, and their directors, may also face liability under the U.S. securities laws, even if their securities are not traded on U.S. exchange. Even after the U.S. Supreme Court's 2010 decision in Morrison v. National Australia Bank, 561 U.S. 247, which limited the extraterritorial reach of the anti-fraud provisions of the U.S. securities laws, the applicability of these laws is not limited to U.S. public issuers.

For example, hundreds of foreign issuers currently have automatic depository receipts (ADR) traded on U.S. exchanges. ADRs are issued to investors by U.S. financial institutions and represent beneficial ownership of shares of the foreign issuer, which are held by the financial institutions. There are three levels of ADRs (Levels I, II and III), each with correspondingly different levels of regulatory requirements, on the one hand and access to U.S. markets, on the other. Certain ADRs can be "unsponsored," meaning that they can be created by a U.S. depositary institution without the formal participation of the foreign company. Despite this, at least one U.S. court of appeals has indicated that foreign issuers could be liable under the U.S. securities laws for misstatements or material omissions in connection with the purchase or sale of unsponsored ADRs. See Stoyas v. Toshiba, 896 F.3d 933 (9th Cir. 2018), cert denied 139 S. Ct. 2766 (2019).

Nor do the U.S. anti-fraud provisions of the U.S. securities laws apply only to publicly traded companies. For example, in announcing charges against Silicon Valley-based private company Theranos, Inc. in March 2018, the SEC's co-director of enforcement noted that the charges made "clear that there is no exemption from the anti-fraud provisions of the federal securities laws simply because a company is nonpublic, development-stage, or the subject of exuberant media attention." The basis for the SEC's jurisdiction was Theranos' use "of the means and instrumentalities of interstate commerce or the mails in connection with the" activities described in the SEC's complaint. As such, even private foreign companies can draw scrutiny from U.S. securities regulators if, for example, they undertake significant capital-raising efforts within, or directed toward, the United States.

In part two of this series, the authors will highlight key takeaways U.S. citizens should consider when looking into involvement in foreign companies.

Brendan Quigley is a partner in Baker Botts' New York office. He represents organizations and individuals in matters relating to government and internal investigations, white-collar and regulatory defense and complex civil litigation.

Andrew Lankler is a partner in the firm's New York office. Lankler is an experienced litigator who has extensive trial experience in white-collar criminal, regulatory and complex civil matters at federal, state attorney general, and local levels.

Danny David is a partner in the firm's Houston office. He is co-chair of the firm's litigation department. He has experience trying across a wide range of securities and shareholder cases in Texas, Delaware and across the United States.