Lead Article: What Corporations Need to Know About the DOJ’s Changing Criminal Enforcement Policies

The U.S. Department of Justice (“DOJ”) has recently issued an unusually large number of policy revisions regarding corporate prosecutions, impacting the DOJ’s approach to voluntary self-disclosure, corporate cooperation and compliance, and the prosecution of individual corporate employees. These revisions arise from and elaborate on Deputy Attorney General Lisa Monaco’s September 2022 memorandum (the “Monaco Memo”), which directed DOJ divisions to implement policies encouraging corporations voluntarily to self-disclose misconduct, cooperate fully with investigations, adopt compensation systems that deter wrongdoing, and enact policies that regulate the use of personal devices and third-party messaging applications to conduct business.

In January 2023, Assistant Attorney General Kenneth A. Polite, Jr. (“AAG Polite”) announced that the DOJ Criminal Division would revise its Corporate Enforcement Policy (“CEP”) for the first time since 2017. Subsequently, in March 2023, AAG Polite announced that the Criminal Division would revise its Evaluation of Corporate Compliance Programs policy (“ECCP Policy”) to encourage corporations to adopt compensation systems that deter misconduct and regulate the use of certain electronic communications and devices. The Deputy Attorney General also approved the U.S. Attorney’s Offices (“USAO”) Voluntary Self-Disclosure Policy (“VSD Policy”) for corporate misconduct. Additionally, the DOJ Civil Division’s Consumer Protection Branch (“CPB”), which also has criminal jurisdiction, announced its new Voluntary Self-Disclosure Policy (“CPB VSD Policy”) for corporate criminal misconduct related to various consumer protection statutes that the CPB enforces. This article summarizes these policy changes and assesses what they mean for corporations. 

Corporate Enforcement Policy (“CEP”) Revisions

The Criminal Division’s January 2023 revisions to the CEP attempt to create more uniformity in how the Division oversees corporate criminal matters and provide incentives for corporations to self-disclose corporate misconduct. Although the Division previously maintained policies for enforcement in matters involving corporate misconduct, those policies applied only to Foreign Corrupt Practices Act matters (“FCPA Policy”). The FCPA Policy established criteria for a corporation to receive credit for voluntarily self-disclosing misconduct, but the Division strictly applied the Policy and did not formally provide corporations with opportunities to receive credit if they only satisfied some of the criteria. The revised CEP—which applies to all corporate criminal matters—builds upon the Criminal Division’s narrower policy for FCPA matters and establishes more pathways for a corporation to avoid prosecution or obtain a reduction in criminal penalties.

Much like the FCPA Policy, the CEP creates a presumption that the DOJ will decline to prosecute corporate criminal misconduct, if: (1) the corporation voluntarily self-discloses misconduct to the Division; (2) the corporation fully cooperates with the Division’s investigation of the matter; (3) the corporation timely and appropriately remediates all relevant misconduct; and (4) there are no aggravating circumstances related to the misconduct at issue. Further, the corporation must agree to pay all disgorgement, forfeiture, and/or restitution obligations resulting from the misconduct.

The CEP has not materially altered how a corporation satisfies each of these prongs:

• Voluntary self-disclosure: The corporation must disclose misconduct to the Criminal Division within a reasonably prompt time after becoming aware of it and, in accordance with U.S. Sentencing Guidelines (“USSG”), prior to an imminent threat of disclosure or a government investigation. The corporation must disclose all relevant, non-privileged facts and evidence about the misconduct, including, but not limited to, information about any individuals known to be involved in or responsible for the misconduct. A corporation has not voluntarily self-disclosed if an agreement (g., non-prosecution agreement) imposed a preexisting obligation on the corporation to disclose the misconduct at issue.
• Full cooperation: The corporation must timely disclose all non-privileged facts relevant to the misconduct at issue, proactively cooperate with any investigation (such as by disclosing all relevant facts, even if not required), and timely and voluntarily collect, preserve, and disclose all relevant documents and information related to the misconduct. The corporation must also take measures to prevent a corporation’s internal investigation of misconduct from conflicting or interfering with a corresponding DOJ investigation and make employees and officers who possess relevant information available for interviews with the Criminal Division, to the extent permitted under the Fifth Amendment. These requirements mirror that of the FCPA Policy.

• Timely and appropriate remediation: The corporation must identify and remediate the root causes of the misconduct, implement an effective compliance and ethics program, appropriately discipline employees responsible for the misconduct, and retain business records and prohibit their improper deletion or destruction (including by implementing controls regulating the use of personal communications and third-party messaging applications to conduct business). The nature, resources, and size of the corporation govern what criteria it must follow to implement an effective compliance and ethics program. The corporation must also show that it took other measures demonstrating that it understands the seriousness of the misconduct, accepts responsibility, and has implemented safeguards to avoid repeating the misconduct.
  
  
• Aggravating circumstances: The presence of an aggravated circumstance generally precludes the presumption of a declination of prosecution. Aggravated circumstances include, but are not limited to: (1) the involvement of corporate executive management in the misconduct; (2) misconduct causing the corporation to make a significant profit relative to its overall profits; (3) egregious or pervasive misconduct; and (4) criminal recidivism. The FCPA Policy prescribed the same aggravated circumstances.

Unlike its predecessor, the CEP creates multiple pathways for a corporation engaged in misconduct to obtain a reduction in criminal penalties. Under the FCPA Policy, a corporation’s voluntary self-disclosure, full cooperation, and timely and appropriate remediation would lead to a reduction in criminal penalties, even when the DOJ determined that aggravating circumstances were present and a criminal resolution was warranted. In such instances, the FCPA Policy directed prosecutors to agree to or recommend to a sentencing court a 50% reduction off of the low end of the USSG’s fine range. Additionally, the FCPA Policy directed prosecutors to absolve cooperating corporations of any duty to appoint an independent monitor. Outside of this scenario, the FCPA Policy broadly afforded prosecutors’ discretion to “assess the scope, quantity, quality, and timing of [a corporation’s] cooperation based on the circumstances of each case,” but did not prescribe specific criteria for alternative remedies.

The CEP has made four significant changes to this enforcement paradigm to encourage more corporations to voluntarily self-disclose misconduct and cooperate with DOJ investigations. First, the CEP has increased the recommended reduction in criminal penalties from 50% to between 50 and 75%. Second, the CEP has directed prosecutors not to require cooperating corporations to enter guilty pleas, unless aggravating circumstances are particularly numerous or egregious. Third, even when the presence of an aggravated circumstance precludes the presumption of a declination, a prosecutor may nonetheless decline to prosecute if the corporation:

• Immediately and voluntarily self-disclosed misconduct after becoming aware of it;
• Maintained an effective compliance program and system of internal accounting controls at the time when the misconduct and the disclosure occurred; and
• Undertook extraordinary measures to cooperate with the DOJ’s investigation and remediate misconduct.

According to AAG Polite, prosecutors consider “immediacy, consistency, degree, and impact” to determine whether measures to cooperate and remediate are extraordinary. AAG Polite said that the Criminal Division values when an individual or corporation: (1) “begins to cooperate immediately, and consistently tells the truth”; (2) “allow[s] [the Division] to obtain evidence [it] otherwise couldn’t get, like quickly obtaining and imaging their electronic devices, or having recorded conversations”; and (3) cooperates in a manner that “produces results, like testifying at a trial or providing information that leads to additional convictions.”

Fourth, under the CEP, the absence of a voluntary self-disclosure is no longer necessarily a bar to a reduction in criminal penalties. A corporation that initially failed to self-disclose misconduct voluntarily, but later fully cooperated and timely and appropriately remediated, is now entitled to a reduction of up to 50% off of the low end of the USSG’s fine range.

Evaluation of Corporate Compliance Programs (“ECCP”) Policy Revisions

For years, the Criminal Division’s ECCP Policy has operated to help prosecutors assess the adequacy of a corporation’s compliance program when deciding whether and how to prosecute misconduct. Under the ECCP Policy, prosecutors must ascertain: (1) whether the corporation’s compliance program is “well designed”; (2) whether the program has been implemented “earnestly and in good faith”; and (3) whether the program “work[s] in practice.”

In March 2023, AAG Polite announced changes to the ECCP Policy to implement the Monaco Memo’s directives. These changes seek to incentivize corporations to: (1) enact and enforce policies that regulate how their employees may use personal devices and/or third-party messaging applications to conduct business; and (2) adopt compensation systems that deter wrongdoing. The ECCP Policy encourages prosecutors to reduce criminal penalties when a corporation—prior to engaging in the misconduct at issue—adopted internal protocols and systems that deter wrongdoing and promote compliance.

Policies governing the use of personal devices. Under the revised ECCP Policy, a prosecutor evaluating the efficacy of a corporate compliance program must now consider:

• The methods of electronic communication that the corporation permits its employees to use to conduct business, including any third-party messaging applications with automatically-disappearing or self-destructing messages;
• Whether and how the corporation permits employees to use their own personal electronic devices to conduct business, such as through a ‘bring-your-own-device’ program;
• Whether and how the corporation enforces preservation and deletion protocols; and
• How the corporation has communicated these policies and procedures to their employees.

Importantly, if a corporation fails to produce communications from a third-party messaging application as part of a DOJ investigation, the revised ECCP Policy directs prosecutors to consider whether a corporation has access to such communications.

Compensation systems. The revised ECCP Policy also directs prosecutors to consider a corporation’s compensation system in deciding whether and how to prosecute misconduct. Specifically, prosecutors must evaluate whether a corporation’s compensation system has been designed to defer, escrow, or recoup compensation if an employee engages in misconduct.

After announcing changes to the ECCP Policy, AAG Polite also revealed that the Criminal Division has launched the three-year Pilot Program Regarding Compensation Incentives and Clawbacks (“Pilot Program”). According to AAG Polite, the Pilot Program intends to “reward corporations that develop solutions to incentivize better compliance through their compensation systems, including [through] the use of clawback policies.” Under the Pilot Program, any corporation that enters into a criminal resolution with the Division must implement compliance-related criteria in their compensation and bonus systems and report periodically to the Division about their progress.  Compliance-related criteria include, but are not limited to: (1) a prohibition on bonuses for employees who fail to satisfy compliance performance requirements; (2) disciplinary measures for employees who violate applicable laws and policies; and (3) incentives for employees who are fully committed to compliance processes.

The Pilot Program also directs prosecutors to consider reducing criminal penalties for corporations with “clawback” policies that recoup compensation from a culpable employee who: (1) maintained supervisory authority over an employee or business area engaged in the misconduct; and (2) who knew of, or who was willfully blind to, the misconduct.

If a corporation fully cooperates with an investigation, timely and appropriately remediates misconduct, and establishes that it has implemented compliance-related criteria in accordance with the ECCP Policy, the Pilot Program allows the Criminal Division to reduce applicable fines by 100% of any compensation that has been recouped during the criminal resolution period. Ultimately, if a company’s good-faith efforts to recoup any such compensation are unsuccessful, prosecutors have the discretion to reduce the fine by up to 25% of the amount of compensation that the company attempted to recoup. 

The USAO’s Voluntary Self-Disclosure Policy (“USAO VSD Policy”)

In late February 2023, the Office of the Deputy Attorney General approved the USAO VSD Policy, which applies to all U.S. Attorney’s Offices. Breon Peace, the U.S. Attorney for the Eastern District of New York, and Damian Williams, the U.S. Attorney for the Southern District of New York, jointly announced the USAO VSD Policy after developing it in conjunction with the White Collar Fraud Subcommittee of the Attorney General’s Advisory Committee. U.S. Attorney Peace stated that the USAO VSD Policy offers a “standard for how U.S. Attorney’s Offices will determine whether a company has made a voluntary self-disclosure, and makes transparent the specific, tangible benefits to a company for [doing so] . . . . [and] [a]s a result, no matter where in the country a company operates, it can rely on receiving the same treatment and benefits for voluntarily self-disclosing criminal conduct to a U.S. Attorney’s Office.”

The USAO VSD Policy definitively states that, unless aggravating factors are present, the USAO will not seek a guilty plea against any corporation that voluntarily self-discloses misconduct, fully cooperates, timely and appropriately remediates, and agrees to pay all disgorgement, forfeiture, and restitution resulting from the misconduct at issue. Additionally, the USAO will not require the appointment of an independent monitor, so long as the corporation has implemented and tested an “effective” compliance program at the time of the criminal resolution. Finally, the USAO will decide on a case-by-case basis whether to reduce any applicable criminal penalties by up to 50% off of the low end of the USSG’s fine range.

The USAO VSD Policy largely adopts definitions set forth in the CEP. However, under the USAO VSD Policy, aggravating factors that may warrant a guilty plea include: (1) misconduct posing a grave threat to national security, public health, or the environment; (2) deeply pervasive misconduct; or (3) misconduct involving a corporation’s current executive management.  Additionally, the USAO VSD Policy states that when a prosecutor decides whether to require the appointment of an independent monitor, they should rely on the Monaco Memo, the ECCP Policy, and other guidance promulgated by DOJ divisions. “Decisions about the need for a monitor will be made on a case-by-case basis and at the sole discretion of the USAO.”

Ultimately, if an aggravating factor is present and the USAO requires a guilty plea, but the corporation otherwise voluntarily self-disclosed, fully cooperated, and timely and appropriately remediated, the USAO will: (1) agree to or recommend to a sentencing court a 50 to 75% reduction off of the low end of the USSG’s fine range; and (2) absolve the corporation of any duty to appoint a monitor, so long as the corporation has implemented and tested an effective compliance program.

The CPB’s Voluntary Self-Disclosure Policy (“CPB VSD Policy”)

In early-March 2023, the DOJ Civil Division’s Consumer Protection Branch announced its new CPB VSD Policy, governing how corporations may voluntarily self-disclose misconduct related to the criminal provisions of the consumer health, safety, economic security, data privacy, and fraud statutes that the CPB enforces. Much like the USAO VSD Policy, the CPB has adopted definitions set forth by the Criminal Division in devising the CEP.

The CPB VSD Policy provides that, unless aggravating factors are present, the CPB will not seek a guilty plea against a corporation that voluntarily self-discloses misconduct, fully cooperates, and timely and appropriately remediates. Beyond measures contemplated by the CEP, remediation also includes “providing restitution to identifiable victims and improving [corporate] compliance program[s] to mitigate the risk of engaging in future illegal activity.” Additionally, the CPB will not require the appointment of an independent monitor, so long as the corporation has implemented and tested an “effective” compliance program at the time of the criminal resolution.

Aggravating factors that may lead CPB prosecutors to pursue a “more stringent” criminal resolution against a corporation include, but are not limited to: (1) misconduct that intentionally or willfully places consumers at significant risk of death or serious bodily injury; (2) misconduct that intentionally or willfully targets vulnerable victims, such as older adults, immigrants, veterans, and servicemembers; (3) deeply pervasive misconduct; or (4) upper management’s knowing involvement in the misconduct. Although the USAO has detailed specific reductions in criminal penalties to which cooperating corporations are entitled, the CPB VSD Policy mentions only that corporations are entitled to “receive credit” for voluntarily self-disclosing misconduct. 

Takeaways

Through their articulation of these new policies and incentive structures, the DOJ and its divisions have attempted to establish more uniformity as to how prosecutors should investigate and prosecute corporate criminal misconduct, while affording corporations more flexibility in self-disclosing and remediating misconduct. Corporations should take proactive steps to implement new policies and audit existing policies to account for these revisions. 

But unsurprisingly, neither the Monaco Memo nor any subsequent policy revision establishes bright-line rules for voluntary self-disclosure. Given that few instances of corporate misconduct are so similar that they produce identical outcomes, prosecutorial discretion will still be a driving force in the DOJ’s decision-making processes regarding how to handle allegations that a corporation engaged in misconduct, and whether that corporation has satisfied the requirements necessary to avoid prosecution or obtain a reduction in criminal penalties. However, to the extent that corporations can articulate the manner in which they have complied with recent DOJ policy pronouncements, they will maximize their chances of benefitting from the incentive structures that the DOJ and its divisions have announced.