Legal status of compliance officers – open issues

2.    Who must set up the compliance system?

Only some joint-stock companies must set up a compliance system on the EU level. An example would be companies which conduct investment services under the application of MIFID regime (MIFID I in article 13/2,

MIFID II in article 16/2). From the American perspective, the compliance function is developing ad hoc , primarily due to criminal prosecutions for the companies and their officers (Baer, 2009, p. 964). Compliance was, for the first time, anchored in the USA legislation with the introduction of the Federal Sentencing Guidelines revision in 1991, which prescribed the possibility of imposing a milder sentence if the board of directors could prove the existence of a corporate compliance program. These guidelines expressly provided for the function of a “Chief Ethics Officer” or “Chief Compliance Officer”. According to the US understanding, a CO was, therefore, a mandatory element of a compliance organization (Langenhahn, 2012, p. 28). Still, although it is never wrong to set up a compliance function, it is also not clear for the prevailing number of companies which must set up a compliance function. The answer can further depend on the applicable national law and the type of business activities of the company.

Who must set up the compliance system within the company? There is no explicit obligation for the managers to form a compliance system within the company. Still, there is a growing opinion in theory and practice that managers in two-tier and directors in one-tier board system could be held responsible for the organization of an adequate compliance system in order to ensure the legality of the company’s actions, both with third parties and within the companies among various stakeholders (Fleischer, 2014, p. 322). In that regard, it has been argued that the compliance functions for managers and directors stem from their organizational duties towards the company (Hopt, 2023, p. 1).

From the American perspective, the crucial case was the Caremark case in 1996.1 Under the Caremark case, it was found that directors have fiduciary duty to ensure that the company established a system in order to ensure the compliance with the law. Caremark case discussed some significant issues that continue to have an influence and significance in a contemporary law, among other things, how much to spend on compliance, and also the manner and time of drawing the management’s attention to certain compliance issues (Langevoort, 2018, p. 730). Following the Caremark case, scholars debate that the task of board of directors is not only to ensure the existence of the compliance function, but also to ensure that it is actually performed functionally and successfully (Baer, 2021, p. 339).

Management board must make all fundamental decisions on the establishmentof organizational compliance and regularlyverifyitseffectiveness (organizational, systemic and supervisory responsibility) (Fleischer, 2014, p. 323). Apart from the management being able to decide on the internal division of tasks and work and to assign primary responsibility for the compliance task to a particular member, it may appoint a CO who establishes and further develops the compliance system (Hess, 2019, p. 8). It is the management’s discretionary right to appoint a CO, but such organizational measures do not exempt him from overall supervision, which is especially actualized when he becomes aware of violations of the law and deficiencies in the compliance organization (Fleischer, 2014, p. 323–324). Also, it should be noted that the German Corporate Governance Code also sets the basis for the management board to ensure that the company is in compliance with all provisions of law and internal policies of the company (The German Corporate Governance Code, 2022, Principle 5).

From the Croatian perspective, the relevant norms for determining who must set up a compliance system would be Article 240 and Article 252 of the Croatian Companies Act (Grgić, 2014, p. 47), as the counterparts of the §76 and §93 of the German Stock Corporation Act. As in the German role model, the Croatian Companies Act in these articles sets the standard of due care that management board members must apply in managing the company. The same reasoning can be applied to Croatian joint-stock companies as in German scholarly writings, where compliance functions for managers stem from their organizational duties towards the company. Thus, the management board has a task to carefully select, instruct and supervise the compliance system and the COs, to ensure that the delegation of authority is carried out adequately (Grgić, 2014, p. 42). As in Germany, the authors support the same conclusion for Croatian companies, that the liability for company compliance ultimately rests with the company’s management board (Derenčinović Ruk, 2015, p. 739). However, such a conclusion does not exclude potential CO’s civil and criminal liability, which shall be further elaborated.

3.    Legal status of Compliance Officers

Generally, corporate statutory law is a primary source for analysing the status and liability of various company stakeholders. Companies increasingly employ COs in all business areas. However, corporate laws do not regulate compliance functions or CO. Thus, the legal status of COs is an open issue. The authors shall find an answer to COs’ status and consequent liability in analysing applicable national laws, primarily corporate and labour law, by comparing American law on the one hand with German and Croatian laws on the other.

• 3.1.    The US perspective

Delaware, as the leading state for corporate law, has introduced one-tier board system having board of directors to manage and supervise company’s business (8 Del. C. § 141.). According to Delaware Code, titles and duties of “officers” are left to bylaws and resolution of the board of directors (8 Del. C. § 142.). In practice, this positions could be, for example Chief Executive Officer (CEO) and Chief Compliance Officer. Thus, when a CO is recognised as an officer by the company’s bylaws or resolutions of the board of directors, his/her position should be analysed as the position of the corporate officers, which enjoy a special legal status.

Generally, the status of non-director corporate officers in American law is somewhat unclear. It has been considered that those who hold the position

LAW - Theory and Practice No. 1 / 2024 of corporate officers are accountable for a higher degree of duty towards the company than those who are employees only. In fact, it has been repeated that the officers owe the corporation the same fiduciary duties as directors (Sparks & Hamermesh, 1992, p. 217). This is due to the change in corporate governance of US companies where the board of directors, once considered to have the ultimate control and to act as the management body, transformed their position into a more supervisory body that constantly delegates more powers to various corporate officers (Shaner, 2014, p. 286). Corporate officers become the most important figures for the company’s proper functioning, as they have the best access to relevant information and the power to act on them (Eisenberg, 1990, p. 949). Thus, it is no surprise that the same mechanism for control over directors is being introduced for control over officers – imposing fiduciary duties on officers that should ensure they conform with their duties towards the company (Johnson & Ricca, 2007, p. 665). However, surprisingly, only a few cases deal with the officer’s fiduciary duties and liabilities. Consequently, the exact nature of their fiduciary duties and liability remains unclear.

The US gave birth to a corporate compliance function, so it is no surprise that we find the US at the head of possible change for the status of COs within the corporations. On January 25, 2023, the Delaware Court of Chancery delivered a ruling In re McDonald’s case.3 In that case, the defendant was a corporate officer with the title “Global chief People Officer”. The plaintiffs allege that the defendant breached his duty of oversight by ignoring red flags about sexual harassment among the staff working in the company. It is crucial to note that in this case, the judge discussed corporate officers’ status and duties, such as the company’s CO and Human Resources Officer. The judge held that corporate officers owe the same fiduciary duties as directors, which includes a duty of oversight (McDonald’s case, 2023, p. 2). It further explained that the difference between officers and directors is in the scope of the duty of oversight, where the director should have a significantly broader scope than officers in charge of a particular part of the company’s business and organisation.

Such a decision could have a fundamental impact on the position of CO and other officers in the company as it is the first time that the judicial practice considered that the CO and Human Resources officers have a fiducial duty of oversight, al pari with the directors, although with different scope.

However, there are serious objections from the COs to hold them liable for company supervision. The prevailing standpoint taken by the COs is that they should encourage the company and its employees to conform with the law and behave ethically, but without having the liability for supervising others (Martin, 2015, p. 192). Such a standpoint was in accordance with Caremark case, under which the board of directors remain liable for establishing and for the efficacy of the compliance function in the company (DeMott, 2013, p. 64). It is yet to be seen how shall McDonald case shake these presumptions.

The liability of corporate officers, which stems from their fiduciary duties, shall be evaluated through the law of negligence (Eisenberg, 1990, p. 948). In other words, CO’s liability shall depend on whether he/she acted negligently coupled with the requested degree of negligence (simple or gross negligence or intent) to trigger their liability towards stakeholders. The COs advocate that they should not bear liability for simple negligence but solely for gross negligence or intent (Pacella, 2020, p. 25). However, the issue remains unsettled in the US.

An additional challenge is how to determine criteria for CO’s duties as compliance functions remain an unregulated profession. The consequence is that the lines are often blurred between compliance and other important functions in the company (Pacella, 2020, p. 25). After the McDonald case, authors argue that the question shall arise as to who is liable for supervising the company – directors or the COs? One thing is clear, the position of CO is getting more precarious as we witness the broadening of their duties and consequent liabilities.

• 3.2.    German and Croatian perspective

There is a significant difference in the term “officer” meaning between American and German corporate law. Opposite to the American perspective, German corporate law does not recognize “officers”. Germany has introduced a two-tier board system which distinguishes management and supervisory board and their members (§ 76 and § 95 Stock Corporation Act). The legal status of the members of these boards is heavily regulated and discussed. However, no one is designated as the “officer” within or outside these boards. Thus, German corporate law does not recognize “officers”, so officers have no special legal status within the company.

Croatian corporate law differs from its German role model in the regard that the Croatian Companies Act allows the choice between two-tier (Management and Supervisory Board – Articles 239 and Article 254 of the

Croatian Companies Act) and one-tier board system (Board of Directors – Article 272a of the Croatian Companies Act) for managing the joint-stock companies. According to the one-tier board system, within the board of directors, the law recognizes the difference between the non-executive and executive directors (Article 272.l of the Croatian Companies Act), where the latter could be translated from the Croatian term „izvršni direktor” to American term “Chief Executive Officer” (CEO). The Croatian Companies Act regulates the legal status of the Croatian CEO. Still, the notion of CEO cannot be equalled with the term “officer”, as the Croatian corporate law leaves no room for establishing any other “officer” within the corporate structure of the joint-stock company. Thus, although Croatian corporate law has some elements of the American approach, regarding the possible legal status of COs, the conclusion aligns with German corporate law. More precisely, the CO cannot enjoy a special legal status within the company, as can the “officers” in American law.

In cases where the employment contract provides no answer on the duties and liability of COs, as both German and Croatian corporate laws do not regulate COs, the authors argue that general labour law provisions should apply. The main issue is whether COs enjoy the same privilege as other employees of limiting their liability for performing duties towards the employer/company. Under German law, a person who intentionally or negligently infringes his obligations is liable for damages (§ 823 of the Civil Code). However, within the labour law, the court practice has developed a limited liability regime for employees, where the employees are liable for the entire damage only in cases of gross negligence and intent (Giesen, 2009, p. 103). On the other hand, they cannot be held liable for simple negligence in performing their job. The same solution is adopted in Croatian labour law (Article 107/1 of the Labour Act). However, in both legal systems, it is often hard to qualify in which category of negligence particular employees’ actions fall in.

(ESMA Guidelines, 2021, p. 19). From this, one could conclude that even if the COs have a high degree of independence from the management boards in performing the compliance function, the management board retains the liability towards the company regarding the compliance function. However, an open issue remains how to recognise the level of independence of the CO in a particular case and the criteria for assessing if he/she applied an adequate duty of care.

As it has been repeatedly stated, the relevant source of COs duties and possible liabilities is a contract, usually an employment contract, concluded between the CO as an employee, and the company, as the employer. We can argue that CO might have civil or criminal liability depending on the contract’s wording. Thus, the authors strongly recommend that both companies and COs carefully draft their contracts, with a special focus on the exact duties of COs and protocols towards managing bodies of the company for reporting any questionable activity.

4.    Conclusion

There are crucial differences regarding the legal status of COs in American law on the one hand from German and Croatian corporate law on the other. Under American law, led by Delaware corporate law, if a CO has the status of a corporate officer under the company’s bylaws or resolutions of the board of directors, the CO has a distinguished role in the company. Its duties and liability surpass that of the employee, and it has been confirmed in court practice that the officer has fiduciary duties towards the company, as do the directors. After the McDonald case from January 2023, corporate officers, which includes COs, have the duty of oversight al pari with the directors, solely in a narrower scope depending on the particular organisation of the company. On the other hand, from German and Croatian perspectives, COs are primarily seen as the company’s employees. COs do not have a special status within the company, as the term officer does not have a meaning within corporate law as it has under American law. However, although there are fundamental differences regarding the legal status of COs, all legislations in question face the same challenge – how to determine the exact duties of the COs within the company’s organisation and how to set criteria for what should constitute negligent behaviour. The practice constantly highlights that the number of COs in companies rises in divergent business areas. Still, they are not recognised as a profession, so their role in the companies is often blurred and intertwined with other important functions. It leaves COs in a precarious position. The authors are of the opinion that the contract concluded between the CO and the company is a focal point for determining CO’s position within the company. In that contract, it is strongly advisable that the COs negotiate the inclusion of clauses which limit their liability or the obligation to pay damages, such as indemnification clauses (Braut Filipović, 2022, p. 215). Also, the contract should clearly state their duties within the company, including their relationship with the management and supervisory board or with the board of directors. Such a clause should determine especially the duties of COs to inform directors/managers of information relevant to the company’s lawful conduct. Likewise, for further liability issues, it is crucial to determine the level of independence of COs regarding managers/directors in the company’s day-to-day business. To conclude, the authors consider that corporate law witnesses a shift in corporate governance, where various officers in the company, besides managers and directors, are gaining more power. It calls for rethinking the traditional management and supervision structure in the companies. If the time came to introduce new factors into the corporate governance structures, authors argue that their role and consequent liability should be further analysed and discussed. The goal of this article was to highlight current challenges in the change of this paradigm on the example of COs, where on one hand, the issue of COs exposure becomes worrying, while on the other hand, the shift of power questions the adequacy of current control mechanisms in the companies.

Braut Filipović Mihaela

Univerzitet u Rijeci, Pravni fakultet, Rijeka, Hrvatska

Madžarov Matijević Sara

Univerzitet u Rijeci, Pravni fakultet, Rijeka, Hrvatska