Last week, the Justice Department and the SEC finally brought to a close the Sons and Daughters or Princelings investigation. Pending investigations against four other companies still remain to be resolved.

For months (and even years), we have followed this investigation and its twists and turns. Several years ago, press reports revealed an interesting piece of evidence discovered during the investigation – a spreadsheet kept track of JP Morgan hiring of children of Chinese government officials and related business opportunities linked to specific contracts.

For prosecutors, the spreadsheet was the tip of an iceberg of evidence against JP Morgan confirming that it hired children of foreign government officials in exchange for award of valuable business contracts with Chinese government officials. According to prosecutors, over a seven-year period, JP Morgan hired approximately 100 interns and full-time employees at the request of foreign government officials, and secured approximately $100 million in valuable contracts.

The Justice and Department and the SEC unveiled a comprehensive enforcement action against JP Morgan that included a non-prosecution agreement with the Justice Department coupled with the payment of a $72 million penalty; a cease and desist order with the SEC coupled with a payment of $130.5 million in disgorgement; and a cease and desist order with the Federal Reserve and a $61.9 million penalty.

JP Morgan’s Asia Pacific subsidiary admitted to a wide-ranging effort to win lucrative banking deals by hiring relatives and friends of Chinese government officials. Beginning in 2006, JP Morgan established a client referral program, referred to as the “Sons and Daughters Program,” top influence government officials to award investment deals to JP Morgan. Three years later, JP Morgan revamped the program to prioritize hires to seek direct linkage to business.

The detailed factual recitations surrounding various examples of the Sons and Daughters Program established that JP Morgan hired unqualified relatives and children of various Chinese state-owned company officials to secure valuable investment banking opportunities, including lucrative roles in IPOs. These arrangements were typically discussed openly in email communications, and often detailed how the proposed candidate was either incompetent or at least unqualified for the highly competitive positions at JP Morgan. The candidates who were hired were paid at the same salary level of those more qualified employees.

JP Morgan designed compliance controls surrounding the program, recognizing that the program created real and significant FCPA risks. In particular, JP Morgan’s internal training program and controls recognized that the hiring of unqualified relatives and children of foreign officials constituted a violation of the FCPA if done with the intent to secure lucrative investment contracts.

JP Morgan’s settlement raises a number of important issues and underscores a number of compliance reminders:

Compliance Verification: JP Morgan employees circumvented compliance controls by providing false information on questionnaires required for the hiring of any relative or child of a foreign government official. JP Morgan legal and compliance officials never discovered these false entries or that employees were providing rote answers to important questions. There is no evidence that anyone ever audited the program, the questionnaires or attempted to verify the accuracy of the information provided by JP Morgan employees.

JP Morgan’s failure to catch this elaborate false reporting scheme underscores the important principle that a compliance control – e.g. hiring of relatives, due diligence – is only as good as the information supplied by employees and potential candidates. When forms appear to be copied and contain little specific information, the risk to legal and compliance rises significantly. Again, this set of facts reminds every compliance practitioner to audit, monitor and keep close track of important compliance controls.

Remediation: DOJ and the SEC are increasingly pressuring companies to engage in aggressive remediation to response to FCPA violations. JP Morgan terminated 6 employees, disciplined 23 employees that failed to supervise the program; and penalized employees by withholding bonuses and compensation totaling approximately $18.3 million. JP Morgan’s aggressive remediation was critical to JP Morgan’s resolution of a NPA as opposed to a deferred prosecution agreement or guilty plea.

Navigating Data Privacy Laws: JP Morgan produced documents from foreign jurisdictions without implicating foreign data privacy laws. With the increasing regulation of data privacy, conducting global internal investigations has become more complex. DOJ and the SEC are used to hearing about the difficulties in producing foreign documents but it appears that JP Morgan effectively navigated this issue to produce documents needed by DOJ and the SEC.