On January 8, 2021, the SEC issued a cease-and-desist order, Release No., 90875 (available here), formally resolving proceedings against Deutsche Bank AG.  Deutsche Bank agreed to pay over $125 million as part of a global resolution of allegations that it violated the Foreign Corrupt Practices Act of 1977 (FCPA), in connection with its use of third-party intermediaries, business development consultants, and finders engaged to advance Deutsche Bank’s global business development efforts.  The terms of Deutsche Bank’s universal settlement with the SEC and the U.S. Department of Justice included payment of more than $120 million, $43 million of that to resolve charges brought by the SEC, and the remainder in the form of criminal penalties paid to the Department of Justice.

The SEC initially charged Deutsche Bank, Germany’s largest lending institution, with failure to implement sufficient safeguards and steps to mitigate the risk of illegal bribes in connection with various types of business development and consulting (BDC) arrangements.  The suspect transactions included, among others, the engagement in multiple jurisdictions, of foreign officials and/or their relatives and associates, for the benefit of the Bank.

Specifically, the SEC faulted Deutsche Bank for having deficient internal accounting controls that ultimately led to the inaccurate reporting of more than $7 million in payments to these politically connected intermediaries as legitimate business expenses.  Such failed oversight, the SEC alleged, resulted in violations of both the and books and records (Section 13(b)(2)(A)) and internal accounting (Section 13(b)(2)(B)) provisions of the Securities Exchange Act of 1934. 15 U.S.C. §78m(b)(2)(A)-(B).

Notably, the SEC found that Deutsche Bank actually had several existing policies intended to prevent the payment of bribes to obtain improper business advantages, but delegated policy implementation to persons who failed to follow them, and otherwise failed to properly vet potential third-party intermediaries.  In addition to a comprehensive “Anti-Corruption Policy” that laid out the specific circumstances under which third-party representatives could be engaged to perform work on behalf of the Bank, Deutsche Bank maintained a separate global “Business Development Consultants Policy” (BDC Policy), governing and mandating additional tiers of due diligence when the Bank retained development consultants and finders in international markets.

The additional checks and approvals required under Deutsche Bank’s BDC Policy included: a) requiring prospective third parties to have necessary expertise and qualifications; b) targeted review of prospects for potentially improper familial and/or associate connections with government officials; c) assessment of the proportionality of payments made to actual services rendered, as documented through detailed invoicing; and d) other legal and senior management approvals.

The gaps in compliance with Deutsche Bank’s formalized checks on third-party engagements arose through its delegation of managing engagements to employees serving as “business sponsors.”  In that role, Bank personnel were tasked with—and compensated based upon—generating business and, ultimately, revenue, through the BDC engagements, indirectly incentivizing them to skirt the Bank’s robust vetting process.

Another critical failure the SEC identified on the part of Deutsche Bank was its delay in remediating known internal accounting failures for more than six years after they were first identified.  In a 2009 internal report, Bank personnel with auditing responsibilities identified concerns regarding, and raised to senior management, the need to revise Deutsche Bank’s BDC Policy and internal accounting controls, specifically the need to centralize and enhance due diligence performed on BDC engagements.  Again in 2011, similar issues were raised internally, along with additional recommendations that training and diligence procedures remained defective.  This report drew attention to the purported failures on the part of the “business sponsors” to comply with Bank policies and effectively mitigate corruption and bribery risks.

Thereafter and until 2016, Deutsche Bank nonetheless continued to engage certain BDCs that fell woefully short of the requirements set forth in its compliance policies for engaging such third parties.  Ultimately, payments were made to some BDCs based on insufficient invoices or, in some cases, in excess of what was actually invoiced.  Still further, payments were sometimes made, despite lacking supporting invoices.

The SEC settlement details four specific improper relationships and payments: a clean energy investment fund in China serving as senior advisor to the regional Chinese government; a consultant with ties to a sovereign wealth fund in Abu Dhabi; a regional tax judge in Italy; and a general manager and financial advisor to a Middle Eastern Royal Family (located in Saudi Arabia).  In each instance, the retention of these connected individuals resulted in payments unjustly enriching Deutsche Bank, to a combined total of approximately $35 million.

Ultimately, Deutsche Bank has agreed to pay $35 million in disgorgement of allegedly improper payments, along with $8 million in prejudgment interest to the SEC.  Deutsche Bank will pay an additional $79 million as a criminal penalty to the DOJ pursuant to a three-year Deferred Prosecution Agreement resolving the alleged criminal misconduct. The SEC waived payment of a civil penalty, given the sizeable criminal penalty imposed.  The SEC also considered and credited Deutsche Bank’s cooperation and remedial efforts, which included prompt responses to government requests, regular updates to the SEC concerning factual findings from and throughout the Bank’s own internal investigation, and cooperation in providing the SEC access to witnesses and documents of interest to its investigation.  Deutsche Bank was also noted to have separated certain involved employees from the Bank’s employ, remediated a number of existing procedures, policies, and controls, and increased both compliance staffing and training.  In total, Deutsche Bank is reported to have spent over $1 billion on improving its controls and training as remediation for this and other alleged violations of securities and corruption laws occurring between 2008 and 2017.  See e.g., SEC Press Release No. 17-007, and accompanying settlement (announcing $7.2 billion settlement in connection with allegations the Bank misled investors in the sale of residential mortgage-backed securities); CFTC Release No. 7682-18, and accompanying order (settling, through payment of a $30 million civil penalty, charges that the Bank allegedly manipulated the price of precious metals futures through spoofing and other means).

This case is a reminder that having written policies is insufficient.  They must be implemented and enforced to serve as an effective bulwark against legal violations.