In the United States, when violations of the export rules are discovered, exporters have the option to prepare and submit Voluntary Self-Disclosures to the U.S. export agencies in exchange for reduced penalties. These VSDs are formal statements containing a description of the violation and a promise to remedy the conduct that led to it.
Unfortunately, companies do not always follow through with the full implementation of the promised corrective measures, in some cases discontinuing the remedial process measures altogether. That is a mistake: it takes very little effort for an agency to follow-up with the disclosing company, say six months, one year, or even three or more years after submission of the VSD, to verify that the promised changes have been implemented and fully integrated into the company's export compliance framework.
That's why a thorough review of a potential violation is only the first step in the VSD investigation. It's equally essential to identify and implement remedial practices and procedures, especially when statutory requirements for submitting VSDs can require companies to describe the corrective measures that they plan to implement.
Failure to Follow Through Can Be Costly
In many situations, the disclosing company starts off on the right foot by submitting a VSD, but the race is only half-run if the company does not implement a compliance program or other corrective measures to prevent the original violations from recurring.
Lessons abound for compliance professionals desperately seeking resources that will allow them to finish promised actions to ensure compliance in the form of high-profile examples where companies fail to follow-through with various assurances and become subject to penalties (or additional penalties).
A prime example is FLIR System, a company that submitted 18 VSDs between 2008 and 2017 to disclose various violations of International Traffic in Arms Regulations (ITAR), including unauthorized provision of defense articles to proscribed destinations and violations of terms and provisos of export licenses.
By regularly disclosing potential violations, FLIR appeared to be complying with the export regulations, even if it was having an extremely difficult time to solve the issues. But in its 2018 proposed Charging Letter, the Directorate of Defense Trade Controls (DDTC) found, among other issues, that FLIR had failed to implement remedial compliance measures that were promised in its VSDs.
As a result, FLIR was required to enter into a consent agreement with DDTC that required FLIR to pay a civil penalty of $30 million. (See our analysis of the FLIR consent agreement from our Spring 2018 newsletter, FLIR Enters Into Consent Agreement with DDTC.)
In some ways, the submission of a VSD acts as an informal bargain between the disclosing company and the receiving agency. The disclosing company admits to wrongdoing, determines how to prevent the same issues from happening again, and implements procedures to prevent a similar situation in the future. In exchange for the peace of mind that a once non-compliant company has become compliant, the export agency is less likely to issue penalties if it believes that the disclosing company has cleaned up its operations. In FLIR's case, the disclosing company failed to uphold its end of the bargain, so DDTC imposed stiff penalties.
In another high-profile case, on June 7, 2018, the Bureau of Industry and Security (BIS) issued a second $1 billion penalty to Chinese telecommunications company ZTE Corporation for failing to adhere to requirements of a previous settlement with BIS. (For background on the original 2017 ZTE settlement, see our previous article, From A to ZTE: A Review of Lessons Learned from the ZTE Case.)
In its first settlement with BIS, ZTE informed the agency that it would or had disciplined numerous employees responsible for the violations. Rather than punishing their employees, however, ZTE rewarded them with bonuses.
Once BIS learned of ZTE's utter failure in following through with promised remedial measures, BIS doubled down on its punishment of ZTE, specifically citing the company's failure to act as promised. Although the ZTE case is in the context of a settlement agreement rather than a VSD, it still reinforces the fact that the export agencies punish companies for a failure to implement promised corrective measures.
Disclose and Promise, But Do Not Forget
In ZTE's case the conduct was willful and deceiving; the company never actually tried to adhere to the export regulations and promised remedial actions. But similar situations can arise through sheer forgetfulness (read: negligence), too.
Submitting a VSD may be one of the few instances where a company's export compliance officer or department has the full attention of company management when leadership is eager to do "whatever will make us look best" in the eyes of the export control agency. After submission, however, the frenzied activity around and attention given to investigating violations and preparing the submission can suddenly dry up, even when everyone involved fully intends to proactively pursue the remedies outlined in the VSD.
If you are an employee of a company that has submitted a VSD at any point in the past several years, you should review the full disclosure in detail to identify all assurances of corrective action so that you can follow up on progress. Have you maintained that yearly audit program you mentioned in your VSD from 2016? Did you hire an export compliance manager by the second quarter of 2018 as disclosed? If DDTC asks to see the Technology Control Plan that you prepared and submitted pursuant to a "deemed export" VSD, would you be able to show proof that the TCP has actually been implemented? If the BIS Office of Export Enforcement agents visit your facility, will they be subject to the visitor requirements and security procedures described in your past VSDs? Have you maintained your classification database and kept all required export records?
You should be able to clearly chart progress toward the remedies proposed in your VSD. If you cannot—if company export compliance procedures are essentially the same as they were before the VSD was submitted—then you must develop a plan for getting back on track, before BIS or DDTC follow up with your company.
Again, it takes very little effort for the agencies to ask simple follow-up questions that undo all the work that went into a VSD simply because the disclosing company has neglected to put its promised corrective measures into action.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.