As discussed in our previous bulletin, Malaysia is anticipating the new corporate liability provision, i.e. Section 17A of the Malaysian Anti-Corruption Commission Act 2009 (“MACC Act”) to take effect on 1 June 2020. The new corporate offence under Section 17A of the MACC Act is applicable to the broadly defined “commercial organisation”, which not only includes Malaysia incorporated companies but also commercial organisations incorporated outside Malaysia that carry on business or any part of a business in Malaysia. Hence, companies with headquarters and offices overseas may potentially be caught by Section 17A should there be any part of its business operating in Malaysia.
Section 17A creates a new strict liability offence for a commercial organisation and the only line of defence is to ensure that adequate procedures are in place to foster a business environment free of corruption.
The Prime Minister's Department has issued the “Guidelines on Adequate Procedures” (“Guidelines”), which largely mirror the guidance issued by the UK Ministry of Justice for the UK Bribery Act 2010, to assist commercial organisations to put in place the necessary procedures to prevent the occurrence of corrupt practices.
The TRUST principle
We set out below a brief summary of the TRUST principles and some commentary based on our experience dealing with the UK Bribery Act.
The Guidelines lay out the principles through the acronym “T.R.U.S.T.” that can be applied by corporations to try to ensure that they have a defence in the event an offence is committed. For each of the principles, the Guidelines provide a list of recommended ‘to-dos’ which commercial organisation should adhere to
Principle 1: Top Level Commitment
The first principle highlights the necessity for top level management to seek to ensure full-compliance with the applicable laws and regulations regarding anti-corruption, and to establish the ‘tone from the top’ against any corrupt practices. Some examples of practical application of this principle include the establishment of clear policies to address corruption risks and proper reporting channels for any suspected and/or real corruption incidents.
Top-level commitment is likely to include the communication (both internally and externally) of the organisation's anti-bribery stance and an appropriate degree of involvement in developing anti-bribery procedures. In a small organisation, this may require top-level managers to be directly involved in developing and implementing policies and procedures and, in larger organisations, the board may be responsible for setting policies and delegating to lower levels of management to operate and monitor these policies. Top-level management should be informed of any breaches of procedure and receive feedback on levels of compliance. Medium and large organisations need to give careful consideration as to how and what information needs to be reported back to the Board for them to monitor levels of compliance.
Principle 2: Risk Assessment
It is essential for a corporation to conduct intermittent risk assessments to identify and address potential risks and mitigate these risks. Although the Guidelines do not specify the frequency of these assessments, it would be prudent for a corporation to conduct them on a frequent basis especially to accommodate the rapidly growing nature of businesses in this age of technology.
The first step in developing adequate anti-bribery policies and procedures is to carry out a risk assessment. This step is essential. Procedures should then be developed which are a "practical and realistic" means of achieving the anti-bribery policy objectives. The Guidelines provide an indicative but non-exhaustive list of the areas which policies may cover. It is recognised that it is difficult to apply procedures retrospectively to associated persons, and this should be done over time on a risk-based approach.
Principle 3: Undertake Control Measures
Control measures to address any identified risks ought to be reasonable and proportionate to the nature and size of the corporation in order to properly tackle these risks. These measures should include appropriate due diligence and proper reporting channels.
These procedures should be proportionate to the risk inherent in the particular relationship. Due diligence should not only include measures carried out prior to entering into a relationship but may also involve continued monitoring of associated persons with, in general, more information being required from incorporated entities than individuals.
Principle 4: Systematic Review, Monitoring and Enforcement
Regular reviews by top level management are necessary to monitor the efficiency and effectiveness of an established anti-corruption programme. Not only will these reviews help to improve a programme, but also ensure that there is proper enforcement.
This may include both regular monitoring of the effectiveness of bribery policies and procedures and periodic reviews in response to other stimuli such as governmental changes in relevant jurisdictions or incidents of bribery. External verification or assistance may be of assistance for higher risk and larger organisations.
Principle 5: Training and Communication
It will be a futile effort if the efforts by top level management in combating corrupt practices are not properly communicated to the rest of the organisation. Training, both internal and external, is vital to ensure that policies and procedures can be implemented to ensure that policies are understood and applied by employees within the company.
Communications should include both: (i) internal communications focusing on implementation of particular policies and procedures and the establishment of a means for employees and third parties to raise bribery concerns; and (ii) external communications such as a code of conduct provided to associated persons and, if appropriate and proportionate, to the general public.
Companies should consider whether to provide specific tailored training to employees in particular roles and whether it is appropriate to require associated persons to undergo training.
Conclusion
As the enforcement date of section 17A draws near, if not already done, corporations should take immediate steps to address any risks or misgivings in their organisations and businesses in order to steer clear of any possible liability for corrupt practices. For multinational corporations, there may already be a set of compliance policies and procedures in place, but an assessment should be carried to ensure that the existing procedures satisfy the TRUST principles.
If you would like to discuss any of the above, please do not hesitate to contact the authors or your usual Herbert Smith Freehills contacts.
Disclaimer
The articles published on this website, current at the dates of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action.