When businesses complain about the unfairness of the FCPA, the Nature’s Sunshine case is often cited as an example of SEC overreaching. Businesses may have a legitimate complaint.

In July 2009, the SEC filed a settled enforcement against Nature’s Sunshine Products, Inc. and its CEO and former CFO. The SEC did not allege that the officers were involved in or even aware of the alleged misconduct of the company’s Brazilian subsidiary. Rather, the officers were charged with violating the FCPA’s books and records and internal controls provisions based on their roles as “control persons” under Section 20(a) of the Securities Exchange Act of 1934.

The SEC alleged that the two officers had overall responsibility for the international operations of the company and that the people who would know about the relevant issues were under their control.

Between 2000 and 2001, Nature Sunshine’s Brazilian subsidiary made over $1million in cash payments to customs brokers, some of which were later passed on to Brazilian customs officials. The payments were recorded as “importation advances.” Nature Sunshine’s subsidiary paid the bribes to facilitate the illegal importation of its products which had rapidly declined because of re-classification of its products under Brazilian customs regulations.

The COO and CFO of Nature Sunshine were accused of failing to adequately supervise the subsidiary personnel (i) to make and keep books and records at the subsidiary in reasonable detail and (ii) in devising and maintaining a system of internal controls to provide reasonable assurance that the registration of the subsidiary’s products sold in Brazil was adequately monitored. The complaint did not allege any personal knowledge or participation in any of improper payments on behalf of the two officers. Nature Sunshine self-reported the violations as a result of an internal investigation and “fully cooperated in the government investigations.”

This was the first time the SEC imposed liability on individuals under a theory of “control person” liability in an FCPA case. In practice, this theory of liability operates as “strict liability” for violations of the books and records provisions. While there is legislative history to support this reading of the law, in practice it strikes some as unfair to hold officers liable for misconduct at a subsidiary which is unknown to the parent officers.

Interestingly, the Justice Department and the SEC have not taken the position — but seem close to doing so –, that a similar strict liability theory can be applied to violations of the anti-bribery prohibition – that is a much greater stretch under the law since there is no comparable “control person” statute applicable to the anti-bribery law, or any legislative history to support such an interpretation.