Government Regulatory Compliance: How to Stay Compliant and Push Back

A company that receives an adverse regulatory determination has the right to challenge that determination through the administrative appeal process and, if necessary, through federal court review under the APA, and administrative law counsel advising on a regulatory challenge must evaluate whether the agency's action is supported by substantial evidence in the administrative record, whether the agency followed the notice-and-comment procedures required for significant regulatory changes, and whether the agency's interpretation of its own statutory authority is entitled to judicial deference or can be challenged as contrary to the plain meaning of the statute.

A company that identifies a proposed regulation that will significantly affect its operations has the right to submit comments during the rulemaking process, and those comments can form the foundation of a subsequent legal challenge if the agency fails to respond adequately to the concerns raised, and administrative hearings counsel advising on the rulemaking process must evaluate whether the company's comments accurately describe the regulation's likely costs and benefits and whether the company's participation is coordinated with industry associations filing parallel comments.

A government regulatory compliance program that satisfies the guidelines issued by the DOJ, the SEC, and other enforcement agencies must include written policies and procedures, regular training, an effective reporting mechanism, and a process for investigating and remediating potential violations, and expert compliance program design counsel designing or evaluating a government regulatory compliance program must evaluate whether the program is adequately resourced and supported by senior management and whether the compliance function has sufficient independence to investigate potential violations involving senior employees.

A company that uses automated systems to monitor its government regulatory compliance obligations must ensure that those systems generate records that accurately reflect the company's compliance status and that can be produced in regulatory examinations as evidence of the company's good faith efforts, and compliance audit counsel evaluating a RegTech implementation must evaluate whether the system's outputs accurately reflect the regulatory requirements it is designed to monitor and whether any errors or limitations in the system's regulatory mapping have been documented and disclosed to the board and senior management.

A company operating in a highly regulated industry must maintain every license, permit, and registration required for its business and must notify the relevant regulatory authority when any of the circumstances that triggered the original license application change materially, and licensing counsel advising on regulatory compliance for a licensed business must evaluate whether the company's licensing documentation is current and reflects the actual scope of its operations and whether the company's procedures for conducting regulatory examinations ensure that examiners are provided with accurate information without creating unnecessary admissions.

A company whose business model relies on technology or processes that are not yet addressed by existing regulation may be eligible to participate in a regulatory sandbox program that allows it to test its products and services under modified regulatory requirements, and regulatory compliance counsel advising on sandbox participation must evaluate whether the company's application demonstrates a clear public benefit that justifies the regulatory exemptions being sought and whether the terms of the sandbox approval contain any provisions that could be used against the company if the agency later determines that the program has not met its objectives.

A company that is subject to a regulatory examination or investigation must immediately implement a litigation hold, designate a single point of contact for communications with the agency, and ensure that its responses to information requests are accurate and complete without volunteering information that the agency has not requested, and corporate compliance and risk management counsel managing a government regulatory compliance investigation must evaluate whether the scope of the agency's information requests is consistent with its statutory authority and whether any of the requested information is protected by the attorney-client privilege or the work product doctrine.

A company that has been unable to resolve a regulatory investigation through negotiation may face the choice between entering a consent decree and contesting the agency's charges through formal adjudication, and consent decrees counsel advising on the resolution of a government regulatory compliance enforcement matter must evaluate whether the factual and legal record supports the agency's theory of liability and whether the operational restrictions proposed in the consent decree are workable given the company's business model.