On 10 March, the US Department of Justice (DOJ) published the first agency-wide policy on corporate enforcement. The new Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”) is intended to ensure that white-collar crimes are prosecuted in a predictable and fair manner across all DOJ units, in accordance with the same rules.
Far-reaching changes to the CEP, as well as a realignment of the White-Collar Enforcement Plan of the DOJ’s Criminal Division, had already been implemented in 2023 and 2025. However, the latest development and update to the CEP differs fundamentally from previous changes in that it applies uniformly across the entire DOJ. The new CEP thus supersedes all previous guidelines issued by individual DOJ units (Criminal Division, Fraud Section, FCPA Unit, U.S. Attorney’s Office, etc.). It focuses on procedural consistency rather than substantive enforcement priorities. An exception to this are criminal antitrust cases, to which the new CEP does not apply.
I. Key points of the new DOJ policy
The new DOJ policy shifts the focus of corporate criminal prosecution towards greater transparency, consistency and incentive-based approaches. It clearly defines how companies must behave in order to receive benefits – for example, in the calculation of fines – thereby creating a predictable and fair standard for all parties involved.
The overarching purpose: to detect white-collar crime more quickly, prosecute it more effectively, and motivate companies to make integrity the foundation of their conduct.
II. The three scenarios
Under the CEP, three possible scenarios are defined which, depending on the company’s cooperation, transparency and remediation efforts, can range from various forms of penalty reduction to an official waiver of prosecution (declination). These scenarios apply uniformly to all divisions of the DOJ under the new DOJ guidelines.
1. Scenario 1 – Declination (official decision not to prosecute)
Under the new CEP, a decision not to prosecute is made where all specified requirements are fully met. These include:
- The company voluntarily and promptly reported the violation to a competent criminal enforcement unit of the DOJ.
- The company has cooperated fully during the DOJ’s investigation.
- The company has taken prompt, appropriate and effective remediation measures.
- There are no aggravating circumstances. These include, amongst others:
- the severity or frequency of the misconduct within the company,
- the extent of the damage caused,
- the existence of similar violations in the past as well as criminal proceedings within the last 5 years.
As a result of these factors being fully met, the DOJ refrains from criminal prosecution. This decision is published. Remaining potential consequences of the breach include the forfeiture of unlawfully obtained profits and the payment of damages.
2. Scenario 2 – The ‘near miss’ scenario: significant benefits despite minor shortcomings
Scenario 2 is possible if, although the company cooperates fully during the investigations and subsequently takes appropriate and effective remediation measures, the self-disclosure is not deemed to be voluntary or timely. This is also possible where aggravating circumstances exist, provided these are not particularly serious or occur repeatedly.
Under scenario 2, there is likewise no criminal prosecution. The company and the DOJ agree, within the framework of a Non-Prosecution Agreement (“NPA”), on specific obligations to be implemented and fulfilled by the company over a defined period but not exceeding three years. The NPA further provides for the waiver of the appointment of a monitor, as well as a reduction in the fine of at least 50% and up to 75% of the lower end of the fine range in accordance with the U.S. Sentencing Guidelines.
A typical case for scenario 2 is a voluntary self-disclosure where the DOJ has already been informed of the facts by other means (exception: whistleblower report). The voluntary disclosure is consequently not considered voluntary, meaning that the requirements of scenario 1 are not met. In this case, the company does not qualify for a full waiver of criminal prosecution but may still receive the benefits of the mitigating obligations described above under the NPA.
3. Scenario 3 – Standard route: standard prosecution with limited relief
If the company does not meet the requirements for scenario 1 or scenario 2, the public prosecutor’s office has full discretion regarding the form and duration of the compliance obligations and the level of penalties. For companies that nevertheless cooperate fully and subsequently implement appropriate and effective remediation measures, a reduction of up to 50% of the lower end of the fine range is possible in accordance with the U.S. Sentencing Guidelines.
III. The key requirements in detail
In addition to the three scenarios, the DOJ also defines the conditions for meeting the three requirements: voluntary self-disclosure, full cooperation, and timely and appropriate remediation measures.
1. Voluntary Self-Disclosure
The company must voluntarily and in a timely manner report the violation to a competent criminal enforcement unit of the DOJ. Specifically, the following conditions apply:
- The company must disclose the misconduct in good faith to the relevant unit of the DOJ within a reasonably short period after becoming aware of it.
- The violation must not have been previously known to the DOJ, and disclosure must take place before the DOJ learns of it by other means.
- The company must not have had any existing legal obligations to disclose the misconduct to the DOJ.
A special feature here is the whistleblower report. Even if a whistleblower first reports a relevant matter to the DOJ, the company can still meet the requirements if it submits a voluntary disclosure to the DOJ within 120 days.
2. Full Cooperation
For a company’s cooperation to be considered full, the following criteria must be met:
- The company proactively collects and discloses all facts and information relevant to the matter voluntarily, in a timely manner, truthfully and in full.
- The company avoids conflicts with DOJ investigations and, upon request, temporarily suspends its own investigative steps.
- The company makes all relevant employees available for investigative measures (including, where legally possible, abroad).
However, fulfilment of these criteria is not always assessed in the same way. A company’s cooperation is assessed based on scope, quality, timing, impact and relevance. Depending on the company’s conduct and willingness to cooperate, it may earn cooperation points, which form the basis for the final assessment of the company’s cooperation.
3. Timely and Appropriate Remediation
The company has taken timely, appropriate and effective remediation measures. These include the following measures:
- Conducting a root-cause analysis of the facts,
- Implementing or improving the compliance programme,
- Taking appropriate disciplinary action against those responsible,
- Properly retaining documents and communications, and
- Measures demonstrating that the company is credibly improving.
IV. Conclusion
One thing is certain regarding the requirements of the new Corporate Enforcement Policy, which applies uniformly across the DOJ for the first time: anyone wishing to comply with it requires a robust, effective and actively implemented compliance management system. The benefits of voluntary self-disclosure are primarily available to those companies that have functioning whistleblowing channels, robust internal control mechanisms and professional investigation structures, and are able to realistically assess the effectiveness of their compliance programme. The new CEP is thus not only an enforcement tool but also a catalyst for self-reflection: it offers companies an opportunity to put their systems to the test and improve existing processes so that, in the event of an emergency, they can react ‘in a timely manner’ and ‘cooperate fully’. Only companies with reliable structures are able to meet the DOJ’s high expectations regarding transparency, documentation and willingness to cooperate.
Even though the CEP is not directly applicable in Germany, it sends a clear message to German companies: good compliance pays off. Companies should therefore seize the opportunity to further develop their compliance governance, internal control systems and investigation structures in a professional manner. We regularly assist organisations with the introduction, review and optimisation of their compliance programmes and associated processes and are happy to support you with our experience in dealing with US law enforcement agencies.
Please feel free to contact us at any time.