It’s the final countdown... for self-disclosure under DOJ’s amended Corporate Enforcement Policy

As of August 1, 2024, a company that voluntarily self-discloses misconduct within 120 days of receiving an internal whistleblower report, and before DOJ reaches out to the company, will be eligible for a presumption of declination under the amended CEP.1 This applies even if the whistleblower had already submitted a report to DOJ. As Principal Deputy Assistant Attorney General Nicole M. Argentieri recently stated, DOJ is “offering this benefit to encourage companies to invest in robust internal reporting structures and to incentivize voluntary self-disclosures.”2

DOJ previously required a timely self-disclosure but did not specify a set time period. As before, a company must also fully cooperate, fully and timely remediate, and disgorge/forfeit ill-gotten gains.

DOJ announced the amendment simultaneously with its new Corporate Whistleblower Awards Pilot Program, which seeks to increase reporting on potential corporate misconduct by offering monetary incentives to whistleblowers.³ Almost two months into the program’s implementation, DOJ has received “well in excess of” 100 tips, according to Brent Wible, DOJ Criminal Division Chief Counsellor, who noted that DOJ is “getting good tips.”4

Earlier in 2024, DOJ and nine U.S. Attorney Offices (USAOs) implemented programs for individuals to resolve their participation in corporate misconduct with non-prosecution agreements.5

Together, the DOJ program, USAOs’ programs, and the CEP amendment are intended to “create a multiplier effect” that encourages companies and individuals to race to be the first to disclose to DOJ.6

Navigating timing constraints

Legal and compliance teams should consider how they are to make informed decisions on self-disclosing whistleblower reports within 120 days, while recognizing that investigative efforts may well extend past the 120-day period.

The teams should carefully assess whether they can promptly initiate an internal investigation, particularly when a whistleblower report may be vague or factually inaccurate. Does the reporting channel enable two-way communication, especially when the whistleblower remains anonymous? Did the whistleblower provide any documents or other information that corroborate the allegations? Do intake and triage protocols ensure a quick, thorough, and prioritized review? Are legal and compliance involved in the initial assessment? And, does legal have sufficient oversight to confer privilege protections where applicable?

Legal and compliance should consider which processes can be implemented proactively rather than after allegations are received. How can companies promptly and efficiently preserve, collect, review, analyze, and produce data? What would a plan for systematic device collections that allows efficient review of the data look like? Has a practicable and enforceable mobile device policy been adopted? Are there any data protection measures that must be implemented ahead of time to support the timely data transfers? What internal stakeholders must be informed of the initiation and progress of the internal investigation? What are the employment implications for current employees?

If a whistleblower report concerns evidence that lies with a third party, legal and compliance teams should have a playbook to evaluate whether they can quickly retrieve it. Should for-cause compliance audit plans be drafted ahead of time and initiated when a report is received? Can deep-dive due diligence, including discreet on-the-ground inquiries, be completed and assessed under time constraints? Do existing compliance terms allow the company to ringfence the business activities of the third party in question?

Once questions such as these are answered and corresponding measures implemented, legal and compliance should undergo training to ensure that their protocols work. Crisis management and dawn raid training have been an integral part of compliance programs for several years and can form the basis for whistleblower response training.

Planning for forfeiture and disgorgement

FCPA enforcement trends from 2020 to the present demonstrate that on average, corporate defendants with criminal resolutions paid tens or hundreds of millions of dollars in forfeiture or disgorgement plus prejudgment interest. In contrast, the average forfeiture or disgorgement in cases that DOJ declined to prosecute under the CEP was only around a quarter of that amount.

These numbers suggest that the CEP presumption of declination can be the more reasonable option. But, these numbers are not the full story; forfeiture and disgorgement are heavily fact-dependent. The amount of forfeiture or disgorgement itself may be substantial, especially if the financials of the company have considerably changed. Ancillary costs required to satisfy the CEP requirements are significant. Data and system limitations may make extraction of information time-consuming. And reputational impacts and the possibility of shareholder class actions and shareholder derivative lawsuits can drive up litigation costs.

Legal, e-discovery, due diligence, and forensic accounting fees to identify the disgoregeable amount can snowball. Although skewed by the impact of the largest FCPA investigations on the overall statistics, Stanford University Law School estimates that the average FCPA investigation takes 39 months and costs on average US$1.6 million dollars per month alone.7

To proactively minimize the cost of calculating disgorgement, companies can develop tools to capture, filter, and visualize the performance of particular business units, subsidiaries, and third parties on an ongoing and dynamic basis. These capabilities typically streamline the disgorgement analysis and provide operational insights that the company can leverage for broader compliance and business purposes.

These capabilities can also provide another important data point for the self-disclosure decision because they enable the company to estimate what disgorgement may look like.

Uncertainty is the norm

Companies and counsel should become comfortable that they may have to self-disclose under the amended CEP with an imperfect record and a degree of uncertainty. The CEP promises a presumption of declination, no criminal fine, and no compliance monitor, which are significant benefits. To reap them, companies must accept that they will have to pay tens of millions of dollars into ancillary costs and disgorgement when they contact DOJ, even if the facts may continue to develop in the investigation.

Many companies may choose to remediate misconduct internally without self-disclosing. The considerable cost of a government investigation today may seem less appealing than a potential future cost, even if the future cost may be higher. If DOJ ever contacts the companies, they can still satisfy the requirements of the CEP for fine reduction instead of declination.8

Costs of internal investigations and remediation are typically much lower compared to government investigations. Companies typically incur actual internal costs and opportunity costs in connection with the legal and compliance team’s workload. They also sustain external costs by engaging outside compliance advisors and counsel, but these costs are normally limited compared to government investigations. The absence of disgorgement-related costs may allow the companies to dedicate more resources toward remediation and compliance enhancements.

Charting the course

Only time will tell whether the amended CEP is a step in the right direction or if the 120-day timeline will prove too constraining.

Perhaps DOJ should have infused some flexibility in the temporary amendment to the CEP similar to the M&A Due Diligence and Remediation safe harbor policy, which is also part of the CEP.9 The amendment could have retained the term “timely” and explained that it generally means within 120 days of the receipt of the internal report to the company.

Given the specific 120-day timeline, enhancing compliance programs to provide complete, current, and dynamic information to make informed self-disclosure decisions is more critical than ever.

When specific allegations are received, consulting with U.S. and local counsel with experience navigating fast-paced investigations, self-disclosure, and government negotiation can position a company well to assess whistleblower reports within the 120-day timeline. Counsel with such experience can guide the company to self-disclose only when reports appear credible and corroborated by independent evidence, and the company can make an informed decision about the costs and benefits of self-disclosure.

Authored by Peter Spivack, Nikolaos Doukellis, Paget Barranco, and Wintana Yohannes.