1. Compliance due diligence in M&A transactions
31 March 2017
Compliance due diligence in M&A transactions
Richard van Staden ten Brink

2. Outline 16 november 2015 Non-compliance risks – highlights
What does compliance have to do with M&A?
Compliance and M&A deal structure
Compliance risks in M&As
Compliance risks – mitigation steps
Risk assessment
Scope and depth
Process and challenges
Due diligence
Business decision
Contractual measures
Post-transaction implementation
Follow-ups

3. Introduction: non-compliance risks
16 november 2015
Introduction: non-compliance risks
Globalisation of enhanced enforcement
Extraterritorial application of laws (e.g., bribery/corruption, export controls regulations, money laundering)
Global regulatory cooperation (e.g., 2015 EU – China merger control cooperation agreement)
Multiple parallel/subsequent investigations (e.g., Halliburton, Total)
Tougher enforcement
Substantial fines and sanctions
Focus on individuals and executives (e.g., Yates memo)
Increasing power of regulators (e.g., EU Commission consultation on improving NCA's toolbox)
Long-lasting, thorough and damaging investigations

4. Introduction: what does compliance have to do with M&A?
16 november 2015
Introduction: what does compliance have to do with M&A?
Buyers'
viewpoint
Assessment of target's (real) value
Ongoing / expected legal proceedings
Deals / distribution channels / clients at risk
Reputational risks – acquiring a target involved in misconduct may damage the purchaser's reputation
Successor liability – purchasers may inherent the target's liability
"buying a violation" (e.g., Halliburton, Tyco)
However: successor liability does not create FCPA liability where it did not exist before (DOJ opinion - November 7, 2014)
Impact on transaction – e.g., representations / warranties / indemnifications
Preparation for post-closing integration

5. Introduction: what does compliance have to do with M&A?
16 november 2015
Introduction: what does compliance have to do with M&A?
Sellers'
viewpoint
Loss of deal/value – high compliance risks may affect purchaser's willingness to pay
Encourage deal-opponents to speak-up – e.g., employees, distributors, competitors may challenge the transaction by disclosing non-compliance
Block the deal – non-compliance may be discovered by potential buyers in pre-transaction due diligence
Impact on transaction – e.g., demanding reps / warranties; asset deal rather than share deal
Post-transaction disclosure – the buyer may be motivated to detect and self-report even post-transaction

6. Compliance and M&A deal structure
16 november 2015
Compliance and M&A deal structure
Deal structure
Share deal
Comprehensive asset deal
Pure asset deal
The purchaser assumes all liabilities of the seller
Contractual assumption of liability?
Fraud (escaping creditors)?
"Cover" for share deal?
The purchaser can limit the liabilities purchased with the asset

7. Compliance risk – mitigation steps
16 november 2015
Compliance risk – mitigation steps
Compliance due diligence
Violation records
Current compliance issues
Key compliance risks
Assessing compliance program
Transaction testing
Contractual risk mitigation
Resolving identified issues
Spin-offs / separate sales
Indemnification
Determining transaction structure
Representations/ warranties
Post-transaction implementation
Completing remaining due diligence actions
Applying purchaser's compliance program
Trainings
Review of strategic relations
Compliance audit
Review post-transaction implementation plan
Addressing outstanding issues
Risk mitigation steps
Proper
documentation
Proper
documentation
Proper
documentation
Proper
documentation

8. Compliance due diligence – what is it all about?
16 november 2015
Compliance due diligence – what is it all about?
Assessment of the target's non-compliance risks:
Likelihood
What is the probability of non-compliance by the target / related persons?
Enforcement records
Actual violations
Inherent risk
Risk mitigation
Control risk
Residual risk
Significance
How would a post-transaction detection of non-compliance affect the target?
How robust is the target without the violations?
Cost of remediating the target's compliance program
Impact of enforcement on the target

9. Compliance due diligence - process
16 november 2015
Compliance due diligence - process
Gather information
Assess likelihood
Assess significance
Determine measures
Process
overview
Step 1: Compliance risk assessment and planning
Initial assessment
Due diligence planning
Step 2: Desktop review
Review of public and available information
Step 3: Information acquisition
Information request
Questionnaires
Interviews
Site-visit
Step 4: Verification
Transaction testing
Independent sources

10. Compliance due diligence (Step 1) – risk assessment
16 november 2015
Compliance due diligence (Step 1) – risk assessment
Considerations in assessing the risk
Perceived local risk
Emphasis on developing markets
Country of operation
Industry specific regulation
Government regulation and oversight
Perceived corruption / AML sectorial risks
Industry & sector
Business model (B2B / B2C / B2G)
Market conditions, market share
Compensation structure
Nature of activity
Governmental involvement
Third-parties’ involvement
External relations
Tendering processes
Minority / controlling shareholding
Transactional risk
What are key risk factors of the target?

11. Compliance due diligence (step 1) – risk assessment
16 november 2015
Compliance due diligence (step 1) – risk assessment
Ranking of risks - transaction-specific
Hypothetical example:
Bribery & corruption
Competition / antitrust
Trade restrictions (Economic Sanctions / export controls)
Health & safety
Discrimination
Insider trading
Conflict of interest
Money laundering
Data protection and privacy

12. Compliance due diligence (step 1) – planning & scoping
16 november 2015
Compliance due diligence (step 1) – planning & scoping
How much? How deep? How far?
The degree of appropriate due diligence may vary on the risks involved
The higher the risk, the greater the degree of scrutiny required
Risk assessment
Determine high, medium, or low-risk
The degree of due diligence is determined
Planning
Steps, roles and responsibilities
Scope: e.g., periods and countries
Timelines and deliverables
Communications with M&A team

13. Compliance due diligence (step 1) – challenges
16 november 2015
Compliance due diligence (step 1) – challenges
Challenges
Information (un)availability
Target's multinational operations
Target's (un)willingness to cooperate
Lack of senior management support (budget, support)
Limited access to information (e.g., privileged information)
Time pressure
Confidentiality (limited number of employees "in the know") …
999. …

14. Compliance due diligence (step 2) – desktop review
16 november 2015
Compliance due diligence (step 2) – desktop review
Initial review of available information
Documents made available by the target (e.g., VDR)
Publicly available information:
Online search, including in local language
Media reports, annual statements
Databases: enforcement, sanction lists, watch lists
Scope of information, e.g.:
Target, subsidiaries, executives, JV and JV partners, key business alliances
Ownerships, operations, governance structure
Incidents, litigation, investigations, allegations, other concerns
Risk indications: PEP, donations, operations in sanctioned countries, dominant position
Code of conduct, policies, sustainability reports, internal controls

15. Compliance due diligence (step 3) – information acquisition
16 november 2015
Compliance due diligence (step 3) – information acquisition
Targeted information
Information request
Questionnaires
Interviews: CCO, CFO, Sales, Procurement
Site visit
Scope of information, e.g.:
Key documents: compliance charter, policies, risk assessment and audit reports
Addressing risk indications: e.g., sanctioned countries, intermediates
Vendors & suppliers agreement: e.g., obligation to compliance, audit rights
Distribution agreements: e.g., competition clauses, fee arrangements
Consultancy agreements: e.g., description of services, contacts with government

16. Compliance due diligence (step 4) – verification
16 november 2015
Compliance due diligence (step 4) – verification
Verifying target's information
The data gathered needs to be verified through:
Supplementary information requests: e.g., financial data
Independent sources: e.g., formal certificates such as registration certificate, criminal records
Targeted search: e.g., bankruptcy check, litigation check
Transaction testing: e.g., identifying suspected payment or accounting and records weaknesses
Gaps and inconsistencies = red flags
Further investigation
Request for clarification
Sources of information
It is important to ensure the due diligence stays within legal boundaries:
Keep local privacy laws in mind
Ensure all information is gathered legitimately and ethically

17. Follow-ups: Business decision
16 november 2015
Follow-ups: Business decision
Evaluation of findings
Evaluation of all information gathered – identification of red flags
Assessing the risk and the possibility to mitigate it
Go/No go decision
How likely and significant are the risks?
To what extent can the risks be mitigated?
Should there be pre-conditions for the transaction?
Further investigate red flags?
Self-reporting?
Spin-off?

18. Follow-ups: contractual measures
16 november 2015
Follow-ups: contractual measures
Commercial arrangements, e.g.:
Price adjustment to account for compliance risk
Spin-off of a business unit
Termination of business relations with JV or third-parties
Representations and warranties, e.g.:
Material compliance with applicable laws
Effective compliance program in place
Books and records are accurate and complete
Indemnification and remedial clauses, e.g.:
Compensation arrangement regarding issues identified
Termination of contract in the absence of timely resolution [Lockheed Martin - Titan]

19. Follow ups: post transaction integration
16 november 2015
Follow ups: post transaction integration
Supplementing due diligence
Code of conduct and implementation of policies
Roles and responsibilities across the group companies
Training, education
Managing relationships with third-parties
Specific AB&C audit
Accounting and recordkeeping controls (formalise and align)
Follow up on specific red flags/investigations
Helpline and whistleblowing systems
Compliance audit