Question: In the current environment, when is conducting a due diligence exercise prudent and what factors should be considered when conducting DD, especially in difficult jurisdictions?

Alexa Lam

The issue, when is it prudent to conduct a due diligence exercise, belies the more fundamental question of what form and nature of DD should one conduct at different stages of the journey towards an acquisition or business relationship. The textbook approach is to commence DD after signing a heads of agreement and a non-disclosure agreement, typically through one’s legal/banking/accounting advisers, sometimes also enlisting the help of firms with investigatory expertise. Yet, in transactions and relationships involving major or long-term undertakings or otherwise having potentially significant impact to one’s reputation or business prospects, discreet inquiries should be conducted at an earlier stage, certainly before signing of the heads of agreement and absolutely if the intention to commence negotiation towards a binding contract were to be made public.

When doing due diligence in difficult jurisdictions, one needs to approach all records, including public/official records, with a heavy dose of robust scepticism. Independent verification should be obtained. In a case involving falsified information in an IPO prospectus, investigations revealed that a company had fabricated forestry rights certificates, logging permits and quota certificates. During the DD exercise, the company even produced what appeared to be insurance policies covering its forests, and a written confirmation by local forestry bureaus confirming that the company’s logging activities were in compliance with all laws and regulations. In another court case brought by the Securities and Futures Commission against a HK-listed company, the company had systematically over a period of six years generated fake customers, suppliers and some 1,200 bills of lading. The SFC’s investigations discovered that the containers and vessels shown in the B/Ls were neither sailing on the routes claimed nor on the dates shown. Further, while suppliers and customers on the company’s invoices answered phone calls and confirmed transactions, investigators who visited their premises discovered that they did not exist. We often hear stories about how factories, production lines and even staff were temporarily “hired” to satisfy DD visits. In one investigation the team visited a busy factory in full operation, but continuous monitoring through satellite images showed that other than the days of the visits, there was no activity at the factory site. These cases may be outliers, but it pays to be cautious and ensure sufficient DD is conducted at the appropriate time.

Alexa Lam is a solicitor in Hong Kong and a Fellow in the Department of Law of The University of Hong Kong. She was most recently the CEO APAC of ICI Global, which is the international platform of the Investment Company Institute, a trade association headquartered in Washington for global investment funds. Alexa has over 16 years of experience in securities market regulation and global reform and previously was the Deputy CEO of the Hong Kong Securities and Futures Commission.

Jasmine Tam

The ongoing situation in the world is making due diligence valuable, especially in identifying sanctioned companies and individuals. Some companies might use a murky organization structure to hide their ultimate beneficial owners, but a thorough DD check can often pierce the veil and allow clients to make more informed decisions. DD is not only useful in finding suspicious links, but also in unravelling the truth behind an overly rosy picture. We recently encountered a case in which a client’s potential partner had a seemingly perfect background and CV. Subsequent research revealed that he had changed one character of his Chinese name to conceal he was once jailed for fraud. False positives are common in open-source research but factors such as timeline of events and comparison of records can help determine the real positives. Time is a factor and DD may have to be repeated or updated when dealing with subjects who have an incentive to shift or hide assets. We have seen subjects, after DD was conducted, who subsequently created new entities and moved cash flow generating businesses, effectively stripping out core assets to the detriment of investors, partners or creditors.

A challenge in some jurisdictions is strict privacy rules that restrict the availability of public information. Social media can be useful as it gives insight into an individual’s background and social status, which often yields useful intel. For example, a client met an individual online who advised him to invest large sums via a fake investment platform. Searches of databases and news returned nothing derogatory regarding the individual. However, social media searches found that the individual stole the identity/photos of a former beauty pageant winner to communicate with our client. In recent years, we’ve seen a rise in the number of similar online scams. We can learn much through open-source checks but often we need human sources to fill in information gaps. Source intelligence comes with its own challenges and judgment is important. Often there is no clear “truth”, and it can come down to a balance of probabilities. If 10 out of 12 sources are consistent that is a good sign but there could be important clues in the 2 dissenting sources. Ultimately, DD is about judgement and experience and there are no shortcuts to doing it properly.

Steve Kwok

For companies considering a major corporate transaction, it is critical to conduct adequate due diligence to identify potential compliance risks and, where applicable, implement enhancement measures. Companies hoping to become a publicly-listed company should prepare for the enhanced regulatory oversight they will likely face after obtaining their public listing. Investors acquiring a target business also need to fully assess the risks associated with the transaction to avoid undertaking any successor liability and mitigating any such risks. In particular, companies or transactions with a U.S. nexus need to be closely reviewed for their compliance with a range of U.S. laws and regulations (e.g. FCPA, AML, sanctions) that may be applicable—even minimal or fleeting contacts with the United States may suffice for U.S. jurisdiction. Transactions that involve businesses in the emerging economies also warrant close scrutiny, because businesses in the emerging markets may be subject to heightened risks of corruption, and compliance controls may be less developed than those in more advanced economies.

Although there is no one-size-fits-all approach to conducting due diligence, a number of considerations usually apply. First, the due diligence process should be tailored to the characteristics of the particular region or business sector and follow a risk-based approach. Second, companies should be mindful of any local data privacy or national security laws that may restrict information access in the due diligence process and take these limitations into account in assessing risks and developing remediation plans. Third, if any misconduct or compliance breaches are identified in the due diligence, companies should carefully consider the pros and cons of self-reporting with advice from competent counsel. Fourth, companies should take care to preserve privilege to safeguard the fruits of the due diligence process from compelled production or discovery by regulators or civil plaintiffs. Finally, companies should ensure that the remediation plan is fully implemented, as companies that have been made aware of compliance issues but failed to undertake adequate remediation measures may expose themselves and their executives to allegations of intentional misconduct or worse. In sum, in the context of conducting deal-related due diligence, companies would be well served to remember that an ounce of prevention is worth a pound of cure.

Steve Kwok is a partner at Skadden, Arps, Slate, Meagher & Flom LLP where he heads the Firm’s white collar and U.S. litigation practice in Asia. Prior to joining Skadden, from 2007 to 2013, Steve served as an Assistant U.S. Attorney at the U.S. Attorney’s Office for the Southern District of New York and, from 2013 to 2016, as the U.S. Department of Justice’s Resident Legal Advisor at the U.S. Embassy in Beijing, China.  

Shannon Argetsinger

Most people have a profound misunderstanding of what due diligence is and when to employ it. According to The Grammarist, “the phrase due diligence is a combination of the words due, derived from the Latin word debere which means to owe, and diligence, derived from the Latin word diligentia, which means carefulness or attentiveness.” Due diligence is often associated with M&A buy side opportunities or regulatory compliance practices. For example, in March 2022, FinCEN and the OCC levied a USD 140 million fine against USAA, in part for failing to conduct appropriate customer due diligence (“CDD”) leading to inaccurate, and ineffective, AML risk ranking practices. Additionally, Forbes, March 18, 2022, told the story of startup NS8 (a fraud prevention software company) and the fraud that was committed by its CEO Adam Rogas. To boost the company’s image to its investors, Rogas fraudulently reported the company’s financial position to stakeholders while pocketing millions. In September 2020, the FBI arrested Rogas, and he is now facing twenty years in prison. One of the takeaways was that a lack of due diligence contributed to the inability of the board/investors to timely identify the problem and prevent the fraud that took place.

Due diligence exercises can assess more than criminal histories and risk. Proper, thorough, due diligence has the potential to assess decision making and motivation, and it goes beyond P&L sheets and financial audits. Moreover, relevant due diligence can illuminate the often overlooked cultural fit between interested parties on the front end of a transaction. Rick Hall from Entrepreneur (March 2022) said “For companies looking to build synergies that can underpin lasting growth, it’s critical to account for cultural fit in the financial models used to inform an M&A decision. That might seem simplistic, but in today’s business environment, leaders who value an asset without conducting full due diligence often find themselves needing to reassess the transaction after a deal is complete.” Regardless of the intent, or the relationship between parties, due diligence is critically important in today’s environment and conducting periodic, or refreshed, due diligence will mitigate emerging or overlooked risk. The fact is, simple and enhanced “owed attentiveness” produces informational granularity that cultivates sound decisions leading to less risk and the need to reassess transactions after the fact.

Andrew Kan and Tavis MacLean

Due diligence exercises (“DD”) can be regarded as the verification process by which an investor or contracting party collects and confirms information pertaining to associated risks before making the investment or executing the contract. It must be able to answer the questions: can the investment still go ahead, and whether the risks uncovered are manageable. The quality of the information collected determines the quality and outcome of DD and so, even when accessing regulatory and corporate filing information, care must be taken to assess the quality of that information. For example, most jurisdictions have their own specific systems verifying items such as the registration of businesses, and assets including automobiles, land and properties, and these are frequently available online. Although digitalization of registration records minimises the cost to investigators and helps to retrieve records by online searches, it aggravates the vulnerabilities of digital records by hacking, with the resultant risk that the records may be unreliable. There is another problem that registries do not necessarily verify the information supplied, but accept the filings as stated. In certain jurisdictions, privacy laws limit access to registration records beyond the reach of those without requisite authorisation.

Given the above, the completeness and reliability of information can be questionable when extracted from the registration records. Importantly, investigators who need to obtain official registration records to complete their DD should closely monitor the continuous changing policies on information disclosure. Very often either only limited information is made available, or only summary-level information is provided in public searches. Authorities tend to allow full access to the registration records to enforcement agencies, lawyers and parties that possess relevant court orders. Specifically in relation to China, there are administrative measures in place by the regulatory authorities controlling the level of disclosure in response to enquiries, and these can complicate the execution of DD. Lastly, it is important to understand what information is required, whether this is available from public searches, and how reliable recovered information may be. As part of the exercise, the acquirer may require reviewing the relevant contracts and tax records to verify the ownership of assets in concern.

Andrew Kan is a Director of Forensic Services at Perun Consultants. He has been engaged in a number of major fraud investigations of listed companies including asset misappropriation and L/C fraud in the Asian region. Andrew also has extensive experience providing litigation support services to law-enforcement agencies and the Hong Kong Department of Justice.

Tavish MacLean is a Senior Manager at Perun Consultants. He has completed numerous civil and criminal litigation support and forensic accounting assignments relating to asset-tracing, commercial fraud, employee fraud, anti-money laundering and terrorist financing, organised and serious crimes, internal audit, damages claims and shareholders disputes.

If you or your company has a due diligence matter or other investigation requirements, please contact us at info@kalavinkaadvisors.com or +852 2196 2727