On January 11, Law No. 13.608 was published, which establishes the authority of the country's territorial entities (states, federal districts and municipalities) to set up special hotlines to receive reports from the public, including on corruption violations they have observed. Non-profit non-governmental organizations that have entered into a special agreement will also be able to receive complaints in this way.

The Law also provides for the need to encourage the participation of civil society in exposing wrongdoing, including through the introduction of rewards for reporting information that contributes to the prevention, suppression or investigation of crimes and administrative offenses. The decision to introduce such incentives for complainants is left to the authorities of the territorial entity.

It is too early to talk about the results of this innovation: its relevance and effectiveness will become clear over time, when the relevant practice is developed. However, some experts have already expressed concern about the attempt to introduce in Brazil this kind of tools that are successfully used in foreign countries (e.g., the U.S.). The concern, first of all, is the possibility of an increase in the number of unfounded accusations of offenses, the purpose of which will be to obtain benefits or to satisfy the desire to vilify the "criminal", rather than the actual violation of the law.

The second regulation is Law No. 6.112, published on February 6 and coming into force on March 4, 2018, which provides for the introduction of the obligation to adopt compliance programs for entities that interact "with the public administration of all branches of government" (Administração Pública do Distrito Federal, em todas as esferas de Poder), whereby the interaction means the conclusion of a contract, partnership, agreement, concession agreement or public-private partnership, the amount of which is equal to or exceeds the tendered price and is valued at 80,000 or more.

Article 6 of the Law establishes requirements to the compliance program of the organization. They include 16 points:

1. The need to involve the organization's management, providing support for the implementation of the compliance program;
2. development of standards of official behavior, code of ethics, implementation of policies and procedures aimed at creating a culture of integrity applicable to all employees and managers, regardless of their position;
3. applying, where appropriate, the standards of conduct, code of ethics, integrity policies and procedures to counterparties (suppliers, contractors, intermediaries and partners);
4. Conducting periodic training on compliance with the compliance program requirements;
5. Conducting periodic risk assessments for timely adjustments to the compliance program;
6. Maintaining records that fully and accurately reflect all company transactions;
7. internal controls to ensure the prompt preparation and reliability of the company's financial statements and financial documents;
8. introducing special procedures to prevent fraud and illegal acts within the bidding procedure when executing public contracts or in any other interaction with the public sector, including through third parties, such as paying taxes, conducting audits, obtaining accreditations, licenses, permits and certificates;
9. establishing an independent unit responsible for the implementation and monitoring of the compliance program, defining its structure and authority;
10. creation of open channels for reporting observed violations, informing the organization's employees and counterparties about them, formation of mechanisms to ensure protection of bona fide complainants;
11. development of a system of disciplinary measures of responsibility for violation of the compliance program;
12. development of procedures to ensure timely detection of violations and elimination of their consequences;
13. introducing a due diligence procedure in the awarding of contracts and, if necessary, in the exercise of control functions, with respect to third parties (suppliers, contractors, intermediaries and partners);
14. conducting audits in cases of mergers, acquisitions, restructuring, to check for irregularities or illegal activities or to identify vulnerabilities in the legal entities involved;
15. carrying out continuous monitoring of the compliance program aimed at improving it in order to prevent, detect and combat the harmful acts provided for in Article 5 of Law No. 12.846 of August 1, 2013;
16. taking measures to encourage the dissemination of the principles of ethical behavior and integrity through lectures, seminars, meetings, debates and other activities of this kind.

The listed requirements actually repeat those established by Decree No. 8.420 of March 18, 2015 "On the Specifics of the Application of the Clean Company Law with regard to the administrative liability of legal entities for committing acts against the population, national or foreign administration and other measures" (with the exception of paragraph 16).

An important observation is the necessity established in Article 4 of the Law to develop, use and update the compliance program "in accordance with the current characteristics and risks of the activity of each legal entity". That is, the compliance program of the organization should be regularly improved and adapted in accordance with the ongoing changes, and its development and updating should be based on the assessment of corruption risks.

When assessing the completeness of a company's adoption of a compliance program, the peculiarities of a particular organization are taken into account, including:

• number of employees;
• complexity of the organizational structure;
• involvement of intermediaries as consultants or commercial representatives;
• the market sector in which the company operates;
• the areas in which the company operates directly or indirectly;
• the degree of interaction with the public sector and the significance for the company of accreditations, licenses and state permits;
• the number and location of other legal entities in the economic group;
• whether the company is a micro-enterprise or a small business (for such enterprises, paragraphs 3, 9, 12 and 14 of the compliance program requirements set forth in Article 6 of the Law do not automatically apply).

The requirements stipulated by the Law also apply to existing contracts with a term of more than 12 months, in which case companies are given 180 days to adapt to the rules of the Law.

In case of non-compliance with the requirements established by the Law, the company is charged a fine of 0.1% per day based on the updated value of the contract.

It is also important to note that the requirements of the Law apply to all types of organizations, including foreign companies whose headquarters, branches or representative offices are located in Brazil, formed in fact or by law, including temporarily. This circumstance may become significant for foreign companies doing business in this country.

It should be reminded that earlier Brazilian federal legislation did not require organizations to adopt compliance programs. However, their presence was taken into account when determining the amount of sanctions in case an organization was held liable for corruption violations. In November 2017, Rio de Janeiro enacted Law No. 7.753, which provides for mandatory compliance programs for organizations that enter into contracts with the local administration, which became the basis for the development of the relevant federal law.