DOJ's Ramped Up Corporate Enforcement Keeps Companies Engaged, On Alert

Looking back on a year full of policy pronouncements and changes, and announcing even further policy changes, U.S. Deputy Attorney General Lisa Monaco recently proclaimed that "corporate enforcement is in an era of expansion and innovation." The Department, she noted, has adopted new tools to induce corporate compliance - tools that are meant to help general counsels and chief compliance officers "make the business case for responsible corporate behavior." This article collects and discusses the biggest policy changes in corporate enforcement announced by DOJ this year and looks forward to what we can expect in 2024.

1. Corporate Criminal Enforcement and Voluntary Self-Disclosure Policy - January/February, 2023.

DOJ started the new year by announcing incentives for companies to voluntarily self-disclose misconduct to the Criminal Division. Per the new policy, companies that voluntarily self-disclose misconduct to DOJ, "fully cooperate," and "timely and appropriately remediate[]" "will receive a declination," i.e., a commitment not to prosecute, absent aggravating circumstances, such as involvement of executive management in wrongdoing, pervasiveness of the misconduct, or criminal recidivism. The Department announced that companies seeking to qualify under the policy would be required to pay all disgorgement, forfeiture, and/or restitution resulting from the misconduct at issue.

While the presence of aggravating circumstances would disqualify a company from a "presumption of a declination" under the policy, the Department could still choose to decline prosecution if the company self-disclosed "immediately," had an "effective compliance program and system of internal controls" that alerted to the misconduct, and provided "extraordinary cooperation" and undertook "extraordinary remediation."

What is more, DOJ announced that even where a declination was not appropriate, companies could earn significant benefits from voluntarily self-disclosing, cooperating, and remediating, including recommendations from DOJ to the Court to reduce fines below applicable U.S. Sentencing Guidelines ranges and not require the imposition of a corporate monitor.

Finally, the policy announced that non-recidivist companies that did not self-disclose could still earn credit from DOJ if they later cooperated and timely and appropriately remediated.

The following month, DOJ announced a separate voluntary self-disclosure policy that applied specifically to United States Attorney's Offices, which emphasized the need to self-disclose in a "reasonably prompt" way and before the misconduct is known to DOJ. In addition, the USAO policy noted that disclosures must include "all relevant facts" about the misconduct that are known at the time. Companies meeting the requirements of the USAO self-disclosure policy could obtain significant benefits, including non-prosecution or, where prosecution is appropriate, recommendations for highly-reduced criminal fines.

2. Compensation and Clawback Pilot Program - March, 2023.

In March, DOJ announced additional carrots and sticks to incentivize good corporate conduct. Building on a prior memo from 2022, the Department announced that it was initiating a three-year Compensation Incentives and Clawbacks Pilot Program. Under the program, DOJ requires companies entering into criminal resolutions with the Department to adopt and implement compliance-related criteria into their compensation and bonus systems, and to report to the Criminal Division about the implementation of these systems during the term of the resolution. While DOJ did not spell out specific requirements, the Policy noted that compliance-related criteria "may include" a prohibition on bonuses for employees who do not satisfy their compliance performance requirements, disciplinary measures for employees who violate the law, and incentives for employees who demonstrate a "full commitment" to the compliance process.

The Program also directs prosecutors to consider potential fine reductions for companies that seek to recoup compensation from culpable employees.

3. Revised Memorandum on Corporate Monitors in Criminal Cases - March, 2023.

At the same time, DOJ issued a revised memorandum on selection of corporate monitors. The memorandum updated guidance in four areas. First, in a break from the prior administration, the memo directed prosecutors not to apply a presumption against corporate monitors and instead assess the need for a monitor based on the "facts and circumstances of the particular case." Second, the memo made clear that certain requirements that are applicable to corporate monitors individually (including conflicts provisions) apply to the entire Monitor Team. Third, the memo noted that monitor selections are and will be made in accordance with DOJ's commitment to diversity, equity, and inclusion. And fourth, the memo extended the cooling off period (the period in which the relevant company may not employ or be affiliated with their former monitor or their firm) from two to three years.

The memorandum set forth a non-exhaustive list of ten factors that prosecutors "should consider" in assessing the need and potential benefits of a corporate monitor, including the existence and effectiveness of the company's compliance program and internal controls, the company's history and risk profile (including the region(s) in which the company operates and its clientele), and the extent to which the company is already subject to oversight from other regulators. The memorandum states that DOJ should "favor the imposition of a monitor where there is a demonstrated need for, and clear benefit to be derived from, a monitorship." At the same time, the memo made clear that the scope of any monitorship should be "appropriately tailored to address the specific issues and concerns that created the need for the monitor."

4. Revised Evaluation of Corporate Compliance Programs - March, 2023.

DOJ kept up the drumbeat of corporate enforcement policy-making in March by releasing new guidance on evaluating corporate compliance programs. DOJ has long asked three fundamental questions in assessing a company's corporate compliance program: 1) Is the program well-designed? 2) Is the program being applied honestly, and in good faith? And, 3) Does the compliance program work in practice? Those three questions, and much of DOJ's past guidance, still pertain. However, DOJ's new guidance places a heavy emphasis on the carrots and sticks within the program. The guidance directs prosecutors to consider whether "consequence management procedures" have been put in place to deter bad acts, and ask whether the company is incentivizing good (i.e., compliant) behavior through its compensation and bonus structures. For example, the guidance directs prosecutors to consider whether a company has incentivized compliance by designing compensation systems that "defer or escrow certain compensation tied to conduct consistent with the company's values and policies," or whether the company maintains "provisions for recoupment or reduction of compensation due to compliance violations or misconduct[.]"

In addition, the revised guidance from DOJ included entirely new sections on the importance of tracking compliance through data and keeping complete and accurate records. Most notably, the new guidance directed prosecutors considering a corporation's policies to consider "policies and procedures governing the use of personal devices, communications platforms, and messaging applications, including ephemeral messaging applications." According to DOJ, policies governing this kind of electronic data should be "tailored to the corporation's risk profile and specific business needs and ensure that ... business-related electronic data and communications are accessible and amenable to preservation by the company." Specifically, the guidance directed prosecutors to consider whether a company with a "bring your own device (BYOD)" program maintains policies governing preservation of and access to corporate data and communications stored on those devices.

5. Safe-Harbor Self-Reporting Policy for M&A Transactions - October, 2023.

The government's most recent initiative to encourage companies to self-disclose came in October, when DAG Monaco announced a "safe harbor" policy for companies that voluntarily self-disclose criminal misconduct discovered in connection with mergers and acquisitions. Under the policy, DOJ will decline to prosecute "acquiring companies that promptly and voluntarily disclose criminal misconduct within the Safe Harbor period, ... cooperate with the ensuing investigation, and engage in requisite, timely and appropriate remediation, restitution, and disgorgement[.]" Moreover, any misconduct disclosed under the Safe Harbor Policy will not be factored into future recidivist analysis for the acquiring company. Companies seeking to benefit from the policy must disclose within six months after the merger/acquisition and must "fully" remediate within one year. Failure to perform effective due diligence or self-disclose misconduct of an acquired

entity will subject an acquiring company to "full successor liability," according to Monaco.

What Comes Next?

Over the past year, DOJ has ushered in a number of policy changes aimed at improving corporate compliance and inducing the disclosure of corporate wrongdoing. The Department's leaders have demonstrated that they want and are willing to utilize all of the tools available to them to make that happen. DAG Monaco has stated that the Department will continue to extend "corporate enforcement policies" across the Department, beyond the Criminal Division and into civil and national security realms. The Department's leaders have made clear that we can expect DOJ to focus on cybersecurity, national security, and sanctions ("the new FCPA") in the coming year. Undoubtedly the Department, under its current leadership, will continue its efforts to bring companies into the fold as "allies in the fight against crime[.]"

Eddie A. Jauregui is a partner and co-chair of White Collar Defense & Investigations Team at Holland & Knight LLP.