10.4 Voluntary Self-Disclosure Frameworks: DOJ Corporate Enforcement Policy, Cooperation Credit, and Safe Harbors

10.4 Voluntary Self-Disclosure Frameworks: DOJ Corporate Enforcement Policy, Cooperation Credit, and Safe Harbors

When an internal investigation substantiates serious criminal wrongdoing—such as foreign bribery under the Foreign Corrupt Practices Act (FCPA), systemic False Claims Act healthcare fraud, sanctions violations, or executive accounting fraud—the Board of Directors and executive leadership face a monumental strategic decision: whether to voluntarily self-disclose the misconduct to government enforcement authorities.

Over the past decade the Department of Justice (DOJ) has repeatedly reshaped corporate criminal enforcement, and in 2026 it consolidated that framework. The controlling document is now the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (the "CEP"), issued March 10, 2026 — the first single, unified corporate enforcement policy in the Department's history. It supersedes all component-specific and U.S. Attorney's Office-specific corporate enforcement policies, with the sole exception of the Antitrust Division's leniency program, and it applies to every corporate criminal matter across the Department.

Read alongside it are the M&A Safe Harbor Policy (October 2023, still in force and expressly cross-referenced by the CEP) and the DOJ Evaluation of Corporate Compliance Programs (ECCP, September 2024 revision), which prosecutors use to judge whether the compliance program is well designed, adequately resourced, and working in practice.

Why the 2026 consolidation matters on the exam. Before March 2026 a company that uncovered misconduct touching several DOJ components could not be sure which policy governed its disclosure: the Criminal Division had its own Corporate Enforcement Policy (last revised May 2025), the National Security Division had another, and individual U.S. Attorney's Offices had their own programs. Deputy Attorney General Todd Blanche cited exactly that uncertainty — plus uneven outcomes, protracted investigations, and overuse of monitors — when announcing the unified policy. A CCEP scenario that turns on "which DOJ policy applies" now has one answer for criminal matters: the Department-wide CEP.

---

1. Historical Lineage & Evolution of DOJ Enforcement Policy

The modern DOJ corporate enforcement framework is the product of evolutionary policy directives codifying the principles of corporate accountability, voluntary self-reporting, and individual responsibility.

Evolutionary Lineage of DOJ Corporate Enforcement Policy:
├── Holder Memo (1999): First formalization of corporate charging factors
├── Thompson & Filip Memos (2003/2008): Codified cooperation principles and restricted privilege waiver demands
├── Yates Memo (2015): Individual Accountability Mandate (corporations must identify culpable individuals)
├── Monaco Memo (2022): Comprehensive revisions (prior misconduct history, compensation clawbacks, monitorship standards)
├── Criminal Division CEP (rev. May 2025): Three-path resolution framework; whistleblower 120-day timing exception
├── M&A Safe Harbor Policy (October 2023, still in force): 6-month disclosure / 1-year remediation safe harbor for acquirers
└── DOJ ECCP (5th revision, Sept. 23, 2024): AI-risk governance, ephemeral messaging/personal-device preservation, whistleblower encouragement

The Three-Part Resolution Ladder

The CEP sets out three tiers, with progressively defined benefits:

Part I — Declination. The Department will decline to prosecute a company that meets all four conditions:

1. it voluntarily self-disclosed the misconduct to an appropriate DOJ criminal component;
2. it fully cooperated with the investigation;
3. it timely and appropriately remediated; and
4. there are no aggravating circumstances.

Two details candidates miss: every CEP declination is made public, and a declination is not free — the company must still pay all disgorgement, forfeiture, and victim restitution.

Part II — "Near-Miss" Resolutions. A company that fully cooperated and timely remediated but does not qualify for a declination — either because a good-faith self-report missed a technical element of the VSD definition, or because aggravating factors warrant a criminal resolution — receives a Non-Prosecution Agreement (absent particularly egregious or multiple aggravating circumstances), a term of fewer than three years, no independent compliance monitor, and a fine reduction of at least 50% but not more than 75% off the low end of the U.S. Sentencing Guidelines fine range.

Part III — Other Resolutions. Everyone else. Prosecutors retain full discretion over the form of resolution, term, compliance obligations, and penalty, and the fine reduction is capped at 50% off the Guidelines range. There is a presumption that the reduction runs from the low end for companies that fully cooperate and remediate, though recidivism can move the starting point.

CEP Resolution Ladder (March 10, 2026):
├── Part I   Declination            VSD + full cooperation + timely remediation + no aggravators
│                                   → public declination; pay disgorgement, forfeiture, restitution
├── Part II  "Near-Miss" NPA        Cooperation + remediation, but VSD technically incomplete
│                                   → NPA, term < 3 years, NO monitor, 50–75% off the low end
└── Part III Other Resolutions      Prosecutorial discretion; fine reduction capped at 50%

Aggravating Circumstances Disqualifying Declinations

Even if a company self-discloses, the DOJ retains discretion to seek a guilty plea or a Deferred Prosecution Agreement (DPA) if severe aggravating circumstances exist:

• Executive Involvement: Active participation or direction of the criminal scheme by the CEO, CFO, General Counsel, or Board members.
• Corporate Recidivism: A criminal adjudication or resolution within the last five years, or one based on similar prior misconduct by the entity engaged in the current conduct.
• Egregious National Security or Public Safety Harm: Misconduct causing catastrophic harm to national defense, public health, or critical infrastructure.
• Significant Illicit Profit: The criminal gain represents a substantial portion of the entire enterprise's revenue.

Note: Aggravating circumstances are not an automatic bar. Prosecutors retain discretion to recommend a declination anyway after weighing those factors against the company's disclosure, cooperation, and remediation. Where they do not, a self-disclosing company that fully cooperated and remediated still lands in Part II: an NPA with a term under three years, no monitor, and a 50% to 75% reduction off the low end of the Guidelines fine range.

2. The Three Pillars of Voluntary Self-Disclosure & Cooperation Credit

Pillar 1: The Five-Element Definition of Voluntary Self-Disclosure

The CEP defines "voluntary self-disclosure" precisely. All five elements must hold:

1. Good-faith disclosure of the misconduct to the appropriate DOJ component.
2. Not previously known to the Department. (See the whistleblower exception below — it is the only carve-out.)
3. No preexisting obligation to disclose the misconduct to DOJ. Disclosures compelled by law, regulation, or a prior settlement — FAR mandatory disclosure, an SEC filing obligation, a DPA reporting term — are not voluntary.
4. Before an imminent threat of disclosure or government investigation, and before public exposure.
5. Within a reasonably prompt time after becoming aware of the misconduct, with the burden of proving timeliness on the company.

The Policy explicitly encourages disclosure at the earliest possible time, even before the internal investigation is complete. Waiting to assemble a finished report is a classic way to lose the "reasonably prompt" element.

The 120-day whistleblower timing exception — know this cold. Under the CEP, if a whistleblower files both an internal report with the company and a submission to the Department, the company can still qualify for a declination even though DOJ learned of the conduct first. To preserve eligibility it must self-report as soon as reasonably practicable and in no event later than 120 days after receiving the whistleblower's internal report, and satisfy every other VSD and declination requirement.

This is why the older advice — "if a whistleblower beats you to DOJ, self-disclosure credit is gone forever" — is now wrong, and why intake-to-escalation speed is a board-level metric. A 120-day clock starts the moment an internal report lands, not the moment the investigation concludes.

Note one narrow flexibility: disclosures made only to federal regulators, state or local governments, or civil enforcement agencies generally do not earn VSD credit, but the CEP allows that good-faith disclosures to such entities "may qualify if appropriate under the circumstances."

Pillar 2: Full Extraordinary Cooperation (Yates & Monaco Directives)

Full cooperation requires proactive assistance beyond ordinary legal compliance:

1. Individual Accountability (The Yates Memo Mandate): The corporation must identify all individuals involved in or responsible for the criminal conduct, producing all non-privileged relevant facts regarding their actions.
2. Proactive, Attributed Evidence Production: Disclosing all relevant non-privileged facts with attribution to specific sources rather than a general narrative, and volunteering evidence leads rather than waiting for a subpoena. Companies must also de-conflict their internal investigative steps with the government’s investigation.
3. Cross-Border Evidence Navigation: Producing overseas documents and data. Where the company claims foreign law bars disclosure, the burden is on the company to establish the restriction and to propose reasonable alternatives — asserting a blocking statute without more forfeits cooperation credit.
4. BYOD & Ephemeral Messaging Compliance: Preserving and producing business-related communications conducted on personal devices (BYOD) and messaging platforms (WhatsApp, WeChat), as mandated by the DOJ ECCP.
5. Witness Availability: Making corporate officers, employees, and foreign personnel available for government interviews and depositions.

Pillar 3: Timely and Appropriate Remediation

Under FSGO §8B2.1(b)(7) and the DOJ ECCP, remediation must be comprehensive and institutionalized:

• Root Cause Remediation: Addressing the underlying control breakdowns, supervisory lapses, and corporate culture deficiencies that enabled the misconduct.
• Disciplinary Accountability: Imposing consistent, progressive discipline up to and including termination for wrongdoers and supervisors who failed to provide oversight.
• Executive Compensation Clawbacks: Enforcing clawback provisions to recoup incentive compensation, bonuses, and severance from culpable executives and supervisors.
• Compliance Program Enhancements: Upgrading the compliance management architecture, increasing resources, and testing internal controls to prevent recurrence.
• Records Retention and Messaging Controls: Retaining business records properly and implementing controls on personal communications and ephemeral messaging platforms that would otherwise undermine retention. The 2026 CEP elevates this from an ECCP factor prosecutors may weigh into a threshold expectation for favorable treatment — a written messaging policy that is not actually enforced will not satisfy it.

---

3. The DOJ Mergers & Acquisitions (M&A) Safe Harbor Policy

In October 2023, Deputy Attorney General Lisa Monaco announced the DOJ M&A Safe Harbor Policy, creating a formal safe harbor for acquirers that discover misconduct during a transaction. It survived the 2026 consolidation intact: the Department-wide CEP expressly cross-references it, and the Criminal Division applied it for the first time in the White Deer Management resolution in June 2025.

DOJ M&A Safe Harbor Policy Parameters:
├── Disclosure Window: Disclose criminal misconduct within SIX (6) MONTHS of transaction closing
├── Remediation Window: Fully remediate all misconduct within ONE (1) YEAR of transaction closing
├── Scope: Applies across all DOJ criminal components (FCPA, Antitrust, Sanctions, Health Care)
└── Result: Acquirer earns a complete PRESUMPTION OF DECLINATION of criminal prosecution

Strategic Benefits of the M&A Safe Harbor

• Protects Clean Acquirers: Prevents acquiring companies from incurring successor criminal liability for pre-existing, historic violations of the target entity uncovered during pre- or post-acquisition due diligence.
• Aggravators at the Target Do Not Bind the Acquirer: Aggravating circumstances at the acquired company do not defeat the acquirer’s eligibility for the presumption of declination — a deliberate design choice so that clean buyers are not punished for what they find and report.
• Encourages Rigorous Due Diligence: Incentivizes corporate boards to invest heavily in post-merger compliance integration, forensic auditing, and rapid remediation.

---

4. Modern Financial Pilot Programs & Regulatory Regimes

Compensation Incentives and Clawbacks Pilot Program

This program is specific to the Criminal Division (it began March 2023), but any company under DOJ investigation should assume similar compensation structures strengthen its remediation position under the Department-wide CEP:

• Mandatory Policy Requirement: A company resolving with the Criminal Division must build compliance-related criteria into its compensation and bonus system and report annually on them during the resolution term.
• Credit for Money Actually Recovered: The criminal fine is reduced by an amount equal to the compensation successfully clawed back — a dollar-for-dollar offset.
• Good-Faith Effort Credit: Where the company pursued recoupment in good faith but failed — protracted litigation, foreign labor-law barriers — prosecutors have discretion to award a reduction of up to 25% of the amount the company was unsuccessful in clawing back. It is 25% of the unrecovered compensation, not 50%, and not a reimbursement of legal fees.

DOJ Corporate Whistleblower Awards Pilot Program (2024, expanded 2025)

Launched in August 2024, this program pays individual whistleblowers who are not involved in the misconduct a portion of any monetary recovery obtained through forfeiture. Its original focus was foreign corruption, health care fraud, and financial crimes; a May 2025 expansion added procurement fraud, trade and tariff fraud, sanctions violations, and material support of foreign terrorist organizations and cartels.

The strategic pressure it creates is real but is often overstated. A corporate insider who reports to DOJ before the company does does not permanently destroy the company's self-disclosure credit — the CEP's 120-day timing exception was designed to work in tandem with this program, giving the company a defined window to investigate an internal report and still come forward. What the program does is compress the timeline: intake triage, preliminary credibility assessment, and the disclosure decision must all fit inside 120 days of the internal report.

Comparative Resolution Matrix

---