On 7 January 2009, the Financial Services Authority (“FSA”) imposed a £5.25m fine on insurance broking giant Aon Limited (“Aon”) for deficiencies in its systems and controls, which failed to detect certain suspicious payments made to overseas third parties.[1] This follows a spate of recent activity by UK prosecuting authorities aimed at tackling serious fraud and crime amid growing criticism of the lack of convictions secured by the UK prosecuting authorities for overseas bribery and corruption offences. Apart from the recent FSA action, notable recent developments include the following:

• in June 2008, the de Grazia report criticised the SFO for its low conviction rate and urged the SFO to introduce a chief counsel;[2]
• also in June 2008, the inter-governmental body, the Organisation for Economic Co-operation and Development ("OCED") wrote to the UK government criticising the UK’s failure to prosecute a single overseas bribery case. The OECD also raised concerns over the SFO’s commitment to fighting corporate foreign bribery;[3]
• in September 2008, the Overseas Anti-Corruption Unit of the City of London Police announced that an employee of security consulting firm CBRN UK Team Ltd and a Ugandan public official pled guilty to bribery charges related to a scheme in which CBRN had made payments to the Ugandan official to receive a contract to advise the Ugandan Presidential Guard. The employee received a suspended sentence and the Ugandan official received a 12-month prison sentence;[4]
• in October 2008, the Serious Fraud Office (“SFO”) announced that it had reached a £2.25m (US$3.9m) settlement with major construction firm Balfour Beatty plc for alleged unlawful accounting in connection with certain “payment irregularities” which Balfour Beatty self-reported. While the SFO acknowledged that there were no grounds for criminal prosecution of either the company or any individual, this marked the first time a company has reached this type of civil settlement as part of a foreign bribery investigation and came only six months after the SFO was given the powers to make a civil recovery of the proceeds of crime;[5]
• in November 2008, the Law Commission published its proposed reforms of the English law of bribery, which it described as “out-dated” and “unfit for purpose”. Among the recommendations was the introduction of a new criminal offence applicable to companies and limited liability partnerships of negligently failing to prevent bribery committed by a person performing services on behalf of the organisation in question;
• in December 2008, the SFO posted a special form on the SFO website inviting City workers to report suspicious practices within the financial services sector; and
• in January 2009, the SFO appointed criminal barrister and fraud specialist Vivian Robinson QC to the post of general counsel, the first ever such appointment at the SFO.

The FSA’s action against Aon

The FSA’s action against Aon follows on from its letter to the insurance industry in 2007 which reminded regulated firms of their obligations to counter bribery and corruption risks and, in this context, notified them of the launch of a “thematic review” by the FSA into the adequacy of the systems and controls of a number of commercial insurance intermediary firms.

This case represents an important regulatory outcome for the FSA. It found that between January 2005 and September 2007, Aon had failed to take reasonable care to establish and maintain effective systems and controls to counter the risk of and prevent and detect illicit payments to overseas third parties, some of whom were state-owned entities or had government connections.

The FSA concluded that this gave rise to an unacceptable risk that Aon could become involved in corrupt payments to win or retain business and that Aon had made “suspicious payments” of around US$7m to various overseas firms and individuals as a result of a “weak control environment”. While the FSA did not consider that Aon had been deliberate or reckless in relation to the failings in its systems or controls or the making of suspicious payments, it said that Aon ought to have been aware that there was a “significant risk” that an overseas third party might bribe the insured, the insurer or a public official or that payments might be made for no genuine commercial purpose.

In those circumstances, the FSA decided that Aon was in breach of Principle 3 of the FSA’s Principles for Business, which requires all regulated firms to take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk management systems.

The size of the fine is significant, as the largest financial crime related fine ever imposed by the FSA, the sixth-largest fine levied by the FSA for any breach of its rules and the largest for a breach of this kind.[6]

Regulatory breaches highlighted by the FSA

In its Final Notice to Aon,[7] the FSA acknowledged a number of deficiencies in Aon’s systems and controls which it concluded had created an inadequate environment for controlling payments to overseas third parties. Other firms and businesses may recognise some of these issues as particularly challenging in terms of risk management. They include:

• failure properly to assess, review and change systems and controls relating to payments to overseas third parties (this was viewed as particularly serious in this case in light of previous enforcement action taken by the Disciplinary Board of Lloyds’ of London against two of Aon’s predecessor firms for similar systems and controls breaches, and two internal investigations into suspicious payments, which failed to translate into a comprehensive assessment of the firm’s systems and controls);
• inadequate due diligence, authorisation and payment procedures;
• no ongoing monitoring of relationships with overseas third parties. In particular, there was no internal requirement to carry out ongoing checks or periodic reviews of overseas individuals, companies or payments and limited monitoring by Aon’s compliance function or under their internal audit procedures;
• inadequate training and guidance, particularly of lower level staff;
• lack of oversight by management. The FSA found that Aon’s board and risk management committees failed to exercise sufficient oversight in respect of the transacting of business with or through overseas third parties.

Mitigating factors

The steps taken by Aon to mitigate the seriousness of these failings are instructive and it is clear that the FSA put great store in the way that Aon addressed the issues at senior level and introduced remedial procedures. The FSA acknowledged that Aon had taken a number of mitigating steps at significant cost, both financially and in terms of management time, and these were taken into account in setting the level of the fine imposed. These included:

• prompt reporting of suspicious payments to the relevant authorities (in this case the Serious Organised Crime Agency (“SOCA”) and the FSA);
• full co-operation by Aon senior management with the FSA’s investigation, which the FSA cited as “a model of best practice for other firms” and which enabled the firm to come to a settlement with the FSA which qualified them for a 30% discount in the fine levied – Aon would otherwise have been fined £7.5m;
• instructing forensic accountants to review Aon’s systems and controls relating to overseas payments and implementing the majority of their suggestions, in some cases going beyond them;
• instructing forensic accountants to carry out a thorough review of past payments made between January 2002 and December 2007, and instructing external lawyers to investigate and report on the circumstances surrounding any suspicious payments identified by this review;
• putting in place a global anti-corruption programme, which limits the instruction of third parties and the circumstances in which payments can be made to overseas third parties, particularly in high risk jurisdictions. This includes a working group at senior management level, and further regional working groups, to ensure that relationships with overseas third parties are subject to appropriate review;
• introducing comprehensive “risk-based” training by external law firms on the risks of overseas payments, particularly for staff exposed to overseas third party relationships, and customised on-line training for all staff, including case studies based on the issues arising out of Aon’s investigations;
• engendering cultural change within the organisation e.g. by making assessments of compliance with corporate anti-corruption policies part of staff evaluations, and instigating disciplinary action where necessary.

Conclusion and lessons to be learnt

A number of observations can be made in relation to the FSA’s action against Aon:

• while the Serious Fraud Office has traditionally taken the lead on tackling bribery and corruption, the regulatory penalty levied by the FSA against Aon sends out a clear signal that in the current financial climate the FSA has the means and the will to take tough enforcement action against regulated firms in order to deter overseas bribery and corruption, and firms should be wary of the FSA flexing its muscle in this way again;
• the FSA itself has stated that in handing out its largest financial crime-related fine to date, it has sent out “a clear message to the UK financial services industry that it is completely unacceptable for firms to conduct business overseas without having in place appropriate anti-bribery and corruption systems and controls” and reiterated that “the involvement of UK financial institutions in corrupt or potentially corrupt practices overseas undermines the integrity of the UK financial services sector”;
• large or prominent businesses should be particularly wary of being held up as an example by the FSA. In Aon’s case, the FSA took the view that it was necessary for the fine to reflect Aon’s position as one of the largest insurance and reinsurance brokerage and risk management firms in the UK, whose practices would be followed by other participants and customers in the insurance market;
• against the background of the criminal law reforms proposed by the Law Commission in November 2008, it is notable that the FSA has been able to levy a regulatory penalty against a financial services firm as a means of deterring potentially corrupt activities. At least for the financial services sector, this indicates that the FSA has the resources and appetite to bring enforcement action against regulated firms in respect of suspect activities and suggests that the FSA’s drive to deter bribery and corruption in the financial services sector need not wait for a change in the criminal law;
• it appears from the FSA’s Final Notice that the enforcement action taken by the FSA followed enquiries made by “overseas enforcement agencies” into suspicious payments made by Aon, and the FSA said that it had worked closely with other law enforcement agencies. These included the US Securities and Exchange Commission and the US Department of Justice, who had initiated investigations of their own under the US Foreign Corrupt Practices Act. In this case, however, the US authorities appear to have deferred to the FSA in terms of taking enforcement action. Generally speaking, firms should assume that enforcement agencies, whether domestic or overseas, may well be communicating and co-operating with each other and what may begin as an enquiry by one agency could well result in enforcement action being taken by another;
• regulated firms should pay close attention to the failings identified in Aon’s systems and controls and the mitigating factors that the FSA took into account in deciding on the enforcement action to be taken in this case. These contain important lessons for firms, both in terms of knowing what kinds of measures the FSA expects them to take to prevent, detect and respond to bribery and corruption, and identifying ways in which firms may seek to mitigate the damage that can arise from a regulatory investigation.

More generally, recent enforcement actions taken by the City of London police, the Crown Prosecution Service, the SFO and the FSA point to a multi-organisational approach in the UK to combatting financial crime and leave little doubt that the UK authorities are serious about tackling overseas bribery and corruption. It also comes at a time when there have been warnings of an impending increase in financial crime and the detection of financial crime in the current worsening economy.[8] In this climate, firms should consider carefully what they need to do to protect themselves by reviewing their risk management and compliance processes and, if necessary, taking appropriate advice at an early stage to ensure they are in a position to address potential issues that may arise.

This article was prepared by Chris Warren-Smith (cwarren-smith@fulbright.com or +44 0 20 7832 3604), a partner in the London office of Fulbright & Jaworski International LLP and Head of Fulbright’s International Financial Services Disputes Practice, Co-Chair of Fulbright’s Global Litigation Practice Group and Fulbright’s Class Action, Antitrust and Competition and Subprime Practice Groups; Alex H. Rene (arene@fulbright.com or +44 0 20 7832 3663), a partner in the Washington D.C. office of Fulbright & Jaworski L.L.P. and currently practising in the London office of the firm (and a former trial attorney in the Department of Justice’s Criminal Division, Fraud Section); Jehan-Philippe Wood  (jpwood@fulbright.com or +44 0 20 7832 3629), Senior Associate in the Disputes Practice at Fulbright & Jaworski International LLP and Ian Pegram (ipegram@fulbright.com or +44 0 20 7832 3645), a professional support lawyer in the Disputes Practice at Fulbright & Jaworski International LLP. Further information on Fulbright's White Collar Crime Practice Group is available here.