News

Compliance in Russia: Recommendations during the coronavirus crisis

09.04.2020

With discussions to lift the coronavirus lockdown beginning, compliance considerations are becoming more important again. Below we have summarised what companies operating in Russia can do to manage some of the additional compliance risks caused by the coronavirus crisis:

Cautious approach to procurement procedures. To procure the equipment which is urgently needed to fight the coronavirus, the Federal Antimonopoly Service (FAS) has relaxed state procurement rules. In particular, such equipment can be procured from a single supplier if the usually required tender procedure would be time-consuming and unsuitable in the current situation[1]. In these cases, time pressure and vague requirements significantly increase the risk of violations of the law. There are already first reports of prohibited arrangements between suppliers of medical equipment[2]. Should there be mounting evidence of such violations, a wave of post-crisis investigations by the authorities is to be expected. Companies would therefore be well advised to perform at least brief compliance checks of sales under the simplified procurement procedures.

Carry out omitted KYC due diligence. Already prior to the coronavirus crisis, KYC checks of Russian companies were a time-consuming exercise, for example due to the regularly used offshore holding structures and the restriction of access to information relating to persons on the US or EU sanctions lists[3]. In many cases where companies had been forced to enter swiftly into agreements with new partners (e.g. to maintain a supply chain) KYC due diligence, in Russian practice widely regarded as a box-ticking exercise, may have been omitted. Omitted or incomplete KYC checks should be conducted now and properly documented. If results are unsatisfactory, measures to mitigate the risks for the company should be taken on a case-by-case basis.

Instruct home office employees. After the Russian President declared the time period from 30 March 2020 as non-working days[4] and now that restrictive measures have been imposed at regional level[5], many employees in Russia can only work from home. The working processes in Russia, which are typically based on strict control of employees and compliance with formal requirements, are not designed for remote work. Working from home creates new leeway which may not only affect efficiency but also considerably increase the risk of compliance violations. To address this risk, companies should expressly instruct their employees to comply with all compliance requirements when working from home. In addition, crucial control elements of the compliance management system (e.g. the issue of documents based on the four-eyes principle) should be adjusted to the new conditions.

Update employment documentation. Neither Russian labour law with its focus on compliance with formal requirements nor typical Russian employment agreements provide for the option of temporarily working from home[6]. In many cases, the current practice of working from home therefore violates mandatory Russian labour law. Such legal considerations may not have been top priority during the hectic shift to working from home at the beginning of the lockdown. Now, however, employment documentation should, to the extent possible, be brought in line with applicable law following the recently issued recommendations of the Russian Labour Ministry[7] (adopting regulation for working from home, amending employment agreements etc.). Otherwise, a company may not be able to take appropriate disciplinary measures should employees working from home commit violations.

Prepare for whistleblower activity. Even though the Russian authorities have threatened to punish employers for salary cuts and redundancies during the coronavirus crisis[8], the upcoming recession[9] may force companies on the ground to take such measures. Since, based on our experience, such measures are often the main trigger for Russian employees to report violations[10], the number of whistleblower reports will likely increase. The Russian authorities have reporting channels in place to receive such information[11] and have been authorised to pay whistleblower rewards[12]. Companies should try to receive these whistleblower reports themselves through internal reporting channels. Cross-border reporting channels should be set-up in compliance with the Russian data localisation rules as the fines for violations of these rules have been significantly increased recently[13].

Conduct urgent investigations. Currently, it cannot be predicted how long office premises in Russia will be closed due to non-working days and restrictive measures. Therefore, the question arises of to what extent internal investigations in Russian companies which are urgent can also be conducted remotely. The need for urgency may arise, for example, from Russian labour law which requires companies to take disciplinary measures against their employees within a certain time period after becoming aware of the violation[14]. Most of the typically required investigation steps, such as data collection, e-searches, interviews etc., can probably be conducted remotely, even though they may involve practical difficulties. Problems can be caused by Russian data protection law, according to which in certain cases the employee’s consent to the processing of his or her personal data must be issued in writing (ink on paper).