DOJ Issues First Department-Wide Corporate Enforcement Policy: New Corporate Enforcement and Voluntary Self-Disclosure Policy Standardizes Outcomes Across DOJ

Key Takeaways

• DOJ has issued its first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”), creating a unified framework across DOJ divisions and U.S. Attorneys’ Offices for resolving corporate criminal investigations.
• Companies that voluntarily self-disclose misconduct, fully cooperate with investigations, and remediate compliance failures may qualify for declinations or significant penalty reductions under a new three-tiered resolution structure.
• The policy expands key enforcement concepts, including broader recidivism analysis and refined whistleblower timing rules, raising the stakes for rapid internal investigations and early disclosure decisions.
• Corporate boards, general counsel, and compliance leaders should reassess internal investigation protocols and compliance governance to ensure they can meet DOJ’s heightened expectations for timely disclosure, cooperation, and remediation.

---

On March 10, 2026, the U.S. Department of Justice released its first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy, known as the CEP. With antitrust matters carved out for the Antitrust Division’s separate program, the CEP now functions as DOJ’s central corporate enforcement playbook across DOJ Divisions and U.S. Attorney’s Offices, replacing a mix of overlapping, office-specific approaches, including the May 2025 Criminal Division policy, 2023 U.S. Attorneys’ Office and National Security Division policies, and recent Southern District of New York guidance, among others.

While this consolidation promises greater predictability, it also raises transitional questions for companies that have already self-disclosed under prior frameworks. For those in-flight matters, DOJ has not yet spelled out how it will balance expectations shaped by older policies with the standards and incentives now set out in the CEP, particularly in close cases involving potential “near-miss” disclosures or borderline aggravating factors.

How DOJ’s 2026 Corporate Enforcement Policy Determines Corporate Resolutions

The CEP establishes clear incentives for companies to voluntarily self-disclose misconduct, cooperate fully with DOJ investigations, hold individuals accountable, and implement effective remediation. Deputy Attorney General Todd Blanche described the policy as demonstrating DOJ’s commitment to “transparency and fairness,” noting that “[w]ell-intentioned businesses know that, across the Department, they will be rewarded when they self-disclose wrongdoing, cooperate with [DOJ] investigations, and remediate the misconduct.” Assistant Attorney General A. Tysen Duva of the Criminal Division emphasized that the policy builds on a “long and storied history of corporate enforcement,” and “takes the principles the Division has long promoted — disclosure, cooperation, and remediation — and applies them uniformly across the Department.”

The CEP organizes potential outcomes into three distinct paths, creating a predictable framework for prosecutors and companies alike.

Part I, the “Declination Path,” requires DOJ to decline to prosecute a company when four conditions are satisfied. First, the company must voluntarily self-disclose the misconduct to an appropriate DOJ criminal component. Second, the company must fully cooperate with DOJ’s investigation. Third, the company must timely and appropriately remediate the misconduct. Fourth, no aggravating circumstances may be present relating to the nature and seriousness of the offense, the egregiousness or pervasiveness of the misconduct within the company, the severity of harm caused, or corporate recidivism.

The CEP defines recidivism broadly to include any criminal adjudication or resolution within the last five years, or any other prior similar misconduct by the same entity regardless of when it occurred. Even when aggravating circumstances exist, prosecutors retain discretion to recommend a CEP declination after weighing the severity of those circumstances against the strength of the company’s disclosure, cooperation, and remediation efforts. Companies receiving CEP declinations will pay no federal criminal fines but must pay all disgorgement, forfeiture, restitution, or victim compensation arising from the misconduct. All such declinations will be publicly announced.

For companies that meet most but not all Part I criteria, Part II addresses cases where the company fully cooperates and appropriately remediates but falls short of declination eligibility, either because their good-faith self-report is a “near miss” that does not qualify as a “voluntary self-disclosure,” or because aggravating factors warrant a criminal resolution. Absent particularly egregious or multiple aggravating circumstances, DOJ will provide a non-prosecution agreement with significant benefits: a term of fewer than three years, no independent compliance monitor requirement, and a penalty reduction of at least 50% but not more than 75% off the low end of the U.S. Sentencing Guidelines fine range.

For companies that don’t qualify for Parts I or II benefits, Part III covers cases where prosecutors exercise full discretion regarding the form of resolution, term length, compliance obligations (including potential monitorships), and monetary penalties. DOJ will not recommend reductions exceeding 50% off the Guidelines fine range, with a presumption that qualifying cooperative and remedial companies receive reductions calculated from the low end of the range. In exercising discretion, prosecutors must consider factors set forth in section 8C.2.8 of the U.S. Sentencing Guidelines, including the company’s history and compliance program effectiveness and potential collateral consequences of a conviction.

What Companies Must Do to Qualify for CEP Benefits

The CEP provides detailed definitions that companies must satisfy to access these benefits.

Voluntary Self-Disclosure

Voluntary self-disclosure requires a good-faith disclosure to an appropriate DOJ criminal office about conduct that was not already known to DOJ, made without any preexisting duty to report, before the government is on the brink of discovering the issue, and within a reasonably prompt period after the company learns of the misconduct. The company bears the burden of showing that its disclosure was timely. Disclosures made only to regulators, other government authorities, or civil enforcement bodies generally will not qualify on their own, though DOJ may, in some circumstances and based on the specific facts, take good‑faith reports to those bodies into account when assessing a company’s cooperation and remediation.

The policy includes a critical exception tied to DOJ’s Corporate Whistleblower Awards Pilot Program. If a whistleblower reports misconduct internally and also to DOJ before the company self-discloses, the company can still qualify for a declination by self-reporting as soon as reasonably practicable, and no later than 120 days after receiving the internal whistleblower report, provided it meets all other CEP requirements.

Full Cooperation

Full cooperation demands that companies timely, truthfully, accurately, and proactively disclose all relevant facts and non-privileged evidence, including evidence about all individuals substantially involved in the misconduct regardless of their role, rank, location, or current employment status. Companies must provide source attribution for facts rather than generalized narratives, make rolling disclosures during internal investigations, and proactively identify relevant evidence and investigative leads even when not specifically requested.

Additional requirements include preserving, collecting, and producing relevant documents with provenance information; disclosing the location and custodians of overseas documents; facilitating third-party document production; and providing translations of foreign-language materials when requested. Companies must de-conflict their internal investigations with DOJ efforts and make relevant personnel available for interviews, subject to individual constitutional rights.

Cooperation credit begins at zero and must be earned based on the scope, quantity, quality, impact, and timing of cooperation. Prosecutors must consider the company’s size, sophistication, and financial condition, and resolution documents should explain the rationale for the cooperation credit awarded.

Timely and Appropriate Remediation

Remediation requires thorough root-cause analysis with targeted fixes, implementation of an effective compliance and ethics program tailored to the company’s risks and resources, appropriate discipline of responsible employees including supervisors who failed in oversight, robust business records retention, and controls over personal and ephemeral messaging applications. DOJ evaluates compliance programs based on leadership commitment to ethical culture, resource allocation, compliance personnel qualifications and independence, risk assessment quality, governance integration, and program testing effectiveness.

How the CEP Differs From Prior DOJ Guidance

The CEP largely preserves the substance of the Criminal Division’s prior framework while introducing several important modifications that reflect lessons learned and address prior inconsistencies.

Most significantly, the CEP achieves true department-wide uniformity by applying to all DOJ components and U.S. Attorneys’ Offices handling corporate criminal matters, explicitly superseding the patchwork of component-specific policies that created variability in enforcement approaches. This consolidation should give companies greater confidence that similar facts will receive consistent treatment regardless of which DOJ office leads the investigation.

The policy also expands the recidivism aggravating factor beyond the prior five-year lookback period for similar criminal resolutions. The CEP now encompasses similar misconduct at any time, without the previous policy’s express guidance according lesser weight to older conduct. This change aligns with but arguably extends the case-by-case analysis encouraged by then-Deputy Attorney General Lisa Monaco’s September 2022 memorandum.

Whistleblower timing requirements have been refined. Previous guidance offered a presumption of declination for self-reporting within 120 days of an internal whistleblower complaint. The CEP eliminates the “presumption” language and instead requires reporting “as soon as reasonably practicable” with the 120-day outside limit preserved for the whistleblower program exception, emphasizing the need for rapid internal response.

The near-miss penalty structure provides prosecutors expanded flexibility, shifting from a rigid 75% reduction off the low end of the Guidelines range to a discretionary 50-75% range for qualifying non-prosecution agreements. The CEP also formalizes expectations around de-confliction when companies face competing legal obligations and requires resolution documents to explain cooperation credit allocations, promoting greater transparency.

Finally, the cooperation framework simplifies financial condition considerations by directing prosecutors to account for company size, sophistication, and financial status without the prior policy’s formal burden-shifting mechanism requiring companies to provide financial hardship claims.

What the CEP Means for Corporate Compliance Programs

The CEP delivers DOJ’s clearest guidance yet: companies identifying significant potential misconduct should prioritize rapid, well-coordinated investigations, internal escalation, and where appropriate, voluntary self-disclosure to the correct DOJ component. Corporate boards, general counsel, and chief compliance officers should immediately assess whether existing incident response protocols enable “reasonably prompt” triage and investigation of serious allegations. Companies must ensure they can generate the detailed, individual-focused, and non-privileged factual record DOJ expects while carefully preserving privilege over legal advice and strategy.

Compliance Program Expectations Under the New Policy

Importantly, compliance programs also warrant attention. The CEP emphasizes program elements frequently absent or underdeveloped in enforcement actions: compliance function independence and board access, risk-tailored assessments, experienced personnel, rigorous testing, and controls over ephemeral messaging that could compromise record retention obligations.

Implications for Internal Investigations

The CEP also signals that prosecutors should, where possible, reach and communicate CEP eligibility decisions on a reasonably prompt timeline, and that written resolutions should explain how cooperation credit was determined. That expectation gives companies more insight into how DOJ evaluates their self-disclosure, cooperation, and remediation efforts, which in turn can inform how they structure future internal investigations and presentations.

The clarified “near-miss” framework offers valuable optionality for complex situations involving legacy conduct, partial prior knowledge by regulators, or borderline aggravating factors. Companies facing such scenarios can pursue defined NPA outcomes through strong cooperation and remediation, avoiding the uncertainty of fully discretionary resolutions.

The broadened recidivism standard also makes prior resolutions more consequential. Companies with enforcement history should maintain comprehensive documentation of sustained compliance improvements, particularly in previously problematic business lines, geographies, or risk areas. DOJ will scrutinize whether root causes from earlier matters have been meaningfully addressed through cultural, governance, and control enhancements.

Implications for M&A Due Diligence

For M&A activity, the CEP operates alongside DOJ’s separate merger and acquisition disclosure policy. Companies uncovering potential issues during diligence or post-closing integration should document investigative steps and remedial measures, positioning themselves to leverage CEP benefits if matters escalate.

Looking Ahead: Strategic Compliance

In summary, the CEP heightens both the costs of delay or inaction and the rewards for proactive engagement. Companies that view robust compliance not merely as risk avoidance but as a means to shape enforcement outcomes will find the policy’s transparent incentives particularly valuable. Those that fail to adapt risk operating at a structural disadvantage in DOJ’s increasingly uniform enforcement environment.

For assistance with these issues, please contact AGG partners Gabe Scannapieco or Aaron Danzig or another member of the Government Investigations team.