DOJ Releases First-Ever Department-Wide Corporate Enforcement Policy For All Criminal Matters

On March 10, 2026, the US Department of Justice (DOJ) released a department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (the “CEP” or the “Policy”), marking the first time the Department has adopted a single, unified framework governing corporate criminal enforcement across all of its components. Notably, the Policy supersedes all component-specific and US Attorney’s Office-specific corporate enforcement policies currently in effect, including potentially the US Attorney’s Office for the Southern District of New York’s (“SDNY”) recently announced Corporate Enforcement and Voluntary Self-Disclosure Program for Financial Crimes (which we discussed in a March Legal Update), with the sole exception of the Antitrust Division’s leniency program. In this Legal Update, we review the key features of the new Policy, compare it to the Criminal Division’s most recent CEP revisions issued in May 2025 (which we covered in a 2025 Legal Update), assess how it interacts with the SDNY’s new policy, and consider the practical implications for companies navigating the current enforcement landscape.

Background and Context

The release of a unified CEP was widely anticipated. In December 2025, Deputy Attorney General Todd Blanche announced that the Department intended to issue a single corporate enforcement policy, identifying several challenges with the existing decentralized approach, including: (1) uncertainty about which policy applies when a disclosure implicates more than one component; (2) perceived unevenness in outcomes depending on which office handled a matter; (3) unnecessarily protracted investigations; and (4) the Department’s overuse of compliance monitors.

In announcing the new Policy, Blanche emphasized that it is intended to provide transparency, fairness, and predictability, and to align incentives so that companies that self-disclose, cooperate, and remediate are rewarded, while those that do not will face aggressive enforcement. For practitioners, the new CEP largely formalizes and extends the Criminal Division’s existing framework to the entire Department. But several features—including the treatment of “near-miss” disclosures, the whistleblower timing exception, and the detailed remediation expectations—merit attention.

The CEP appears designed to serve the Department’s stated primary objective of prosecuting individual wrongdoers. By incentivizing companies to self-disclose and cooperate, the Policy is intended to accelerate the government’s ability to identify and pursue culpable individuals. As Blanche stated, the Department’s goal is “individual accountability,” not merely drawn-out corporate negotiations resulting in large fines. Companies considering self-disclosure should therefore expect that cooperation will include providing information about the conduct of specific individuals, regardless of their seniority.

Three-Part Resolution Framework

The Policy establishes three tiers of potential resolution, each with increasingly defined benefits depending on a company’s conduct. The structure closely mirrors the Criminal Division’s May 2025 revisions, but now applies department-wide.

Part I: Declination: The Department will decline to prosecute a company that meets all four of the following conditions: (1) the company voluntarily self-disclosed the misconduct to an appropriate DOJ criminal component; (2) it fully cooperated with the Department’s investigation; (3) it timely and appropriately remediated the misconduct; and (4) there are no aggravating circumstances related to the nature, seriousness, egregiousness, or pervasiveness of the misconduct, the severity of harm, or the company’s history of recidivism (defined as a criminal adjudication or resolution within the last five years or based on similar prior misconduct). Importantly, even where aggravating circumstances exist, prosecutors retain discretion to recommend a declination after weighing those factors against the company’s disclosure, cooperation, and remediation. All declinations under the CEP will be made public, and the company must pay all disgorgement, forfeiture, and victim restitution.

Part II: “Near-Miss” Resolutions: Where a company fully cooperated and timely remediated but does not qualify for a declination—either because its self-report was made in good faith but did not meet all of the technical requirements for a “voluntary self-disclosure,” or because aggravating factors warrant a criminal resolution—the Department will provide a Non-Prosecution Agreement (absent particularly egregious or multiple aggravating circumstances), allow a term of fewer than three years, not require an independent compliance monitor, and apply a fine reduction of at least 50% but not more than 75% off the low end of the US Sentencing Guidelines fine range.

Part III: Other Resolutions: Where a company does not qualify under Part I or Part II, prosecutors retain full discretion over the form of resolution, term length, compliance obligations, and monetary penalty. The maximum fine reduction is capped at 50% off the Sentencing Guidelines fine range. There is a presumption that the reduction will be calculated from the low end of the range for companies that fully cooperate and remediate, but prosecutors may adjust the starting point based on the specific facts, including recidivism.

Definition of Voluntary Self-Disclosure

The Policy defines “voluntary self-disclosure” precisely. To qualify, a company must satisfy five requirements: (1) the company must make a good faith disclosure of the misconduct to the appropriate DOJ component; (2) the misconduct must not have been previously known to the Department; (3) the company must have no preexisting obligation to disclose the misconduct to DOJ; (4) the disclosure must occur before an imminent threat of disclosure or government investigation; and (5) the company must disclose the conduct within a reasonably prompt time after becoming aware of it, with the burden of demonstrating timeliness falling on the company. The Policy encourages companies to self-disclose at the earliest possible time, even before completing an internal investigation.

The Whistleblower Timing Exception

The CEP also incorporates the whistleblower timing exception from the Criminal Division’s policy. Under this provision, if a whistleblower files both an internal report with a company and a submission to the Department, the company can still qualify for a declination even if the whistleblower’s submission reaches DOJ before the company’s own self-disclosure. To preserve eligibility, however, the company must self-report the conduct as soon as reasonably practicable, and in no event later than 120 days after receiving the whistleblower’s internal report, and must meet all other requirements for voluntary self-disclosure and a declination. This provision creates a time-limited window for companies to investigate whistleblower reports and come forward without losing the benefits of self-disclosure.

Full Cooperation Requirements

The Policy sets forth detailed expectations for what constitutes “full cooperation.” Companies must proactively disclose all relevant non-privileged facts and evidence, with attribution to specific sources rather than a general narrative, and must identify all responsible individuals regardless of seniority. The Policy places particular emphasis on the handling of overseas documents: where a company claims that foreign law restricts disclosure, the burden falls on the company to establish the restriction and propose reasonable alternatives. Companies must also de-conflict their internal investigative steps with the Department’s investigation and make personnel available for government interviews.

Timely and Appropriate Remediation

The remediation requirements are extensive. Companies must conduct a thorough root cause analysis, implement an effective compliance and ethics program (the Policy sets out detailed criteria for effectiveness), appropriately discipline responsible employees, and retain business records properly. Of particular note, the Policy explicitly requires companies to implement controls on the use of personal communications and ephemeral messaging platforms that may undermine document retention, signaling the Department’s continuing focus on messaging applications and the risks they pose to corporate accountability.

The emphasis on ephemeral messaging controls builds on the DOJ Criminal Division’s September 2024 update to its Evaluation of Corporate Compliance Programs (ECCP), which, for the first time, directed prosecutors to assess whether companies have policies governing the use of personal devices and messaging platforms, including preservation and deletion settings. The CEP effectively elevates those ECCP considerations from factors prosecutors may weigh in evaluating a compliance program to a threshold requirement for favorable treatment under the Policy, so companies that have adopted messaging policies on paper should ensure they can demonstrate real implementation and enforcement in relation to ephemeral messaging.

Integration with Related Programs

The new CEP does not operate in isolation. It sits alongside several related DOJ programs that companies should consider as part of any disclosure or compliance strategy.

The Department-wide M&A Safe Harbor Policy, first announced in October 2023, continues to apply to misconduct uncovered through pre- or post-acquisition due diligence. The CEP expressly cross-references this policy. Under the M&A framework, acquiring entities that voluntarily disclose criminal misconduct discovered at an acquired company within six months of closing, fully remediate within one year, fully cooperate, and pay restitution and disgorgement will receive a presumption of declination. Notably, aggravating factors at the acquired company do not affect the acquirer’s eligibility. The Criminal Division applied this provision for the first time in the White Deer Management resolution in June 2025, providing a concrete precedent for companies engaged in M&A activity.

The Corporate Whistleblower Awards Pilot Program, which was expanded in May 2025 to cover priority areas of the current administration, also interacts with the CEP. That program incentivizes insiders not involved in misconduct to report it, offering eligible whistleblowers a portion of any monetary recovery through forfeiture. Its expanded priority areas now include procurement fraud, trade and tariff fraud, sanctions violations, and material support of foreign terrorist organizations and cartels. The 120-day timing exception in the CEP is designed to work in tandem with this program, giving companies a defined window to self-report after receiving an internal whistleblower complaint.

Finally, the Compensation Incentives and Clawbacks Pilot Program requires companies resolving matters with the Criminal Division to build compliance-related criteria into their compensation and bonus structures, and provides fine reductions for companies that claw back or withhold compensation from wrongdoers. Although this program is specific to the Criminal Division, companies subject to any DOJ investigation should consider whether implementing similar compensation structures could strengthen their remediation position under the department-wide CEP.

Comparison: New CEP vs. Criminal Division May 2025 Policy

The most significant difference between the two frameworks is one of scope rather than substance. The new CEP extends to all DOJ components what was previously available only through the Criminal Division’s policy. In terms of the specific benefits, the Part II fine reduction range is the principal area of divergence: the Criminal Division’s May 2025 revisions provided a fixed 75% reduction, while the new department-wide Policy sets a range of 50% to 75%. This may reflect an effort to provide prosecutors across different components with additional flexibility, but it also introduces a degree of uncertainty that the Criminal Division’s fixed figure had eliminated.

The whistleblower 120-day timing exception and the detailed cooperation and remediation definitions are substantively the same as those in the Criminal Division’s policy. The key change is that these provisions now bind every DOJ component (other than Antitrust), including all 93 US Attorney’s Offices.

Interaction with the SDNY Program

Just two weeks before the department-wide CEP was released, SDNY announced its own Corporate Enforcement and Voluntary Self-Disclosure Program for Financial Crimes. As we discussed in our prior Legal Update, the SDNY Program offers several distinctive features, including a two-stage conditional declination process (with an initial conditional declination letter expected within two to three weeks of self-reporting), an elimination of criminal fines for qualifying companies (rather than the CEP’s requirement to pay disgorgement and forfeiture), and a narrower set of automatically disqualifying aggravating circumstances.

The new department-wide CEP expressly supersedes all component-specific and US Attorney’s Office-specific policies. The question this raises is whether the SDNY Program survives in its current form. The DOJ press release states that the CEP “superced[es] all component-specific or US Attorney’s Office-specific corporate enforcement policies currently in effect.” On its face, this language would appear to encompass the SDNY Program. It remains to be seen whether SDNY will maintain elements of its program that are consistent with—but go beyond—the CEP, or whether the department-wide Policy will operate as the exclusive framework. Companies considering self-disclosure to SDNY should consult with counsel to assess the current status of the SDNY Program and any additional benefits it may still provide.

Practical Considerations

The new department-wide CEP has several implications for companies and their counsel.

Greater predictability across components

One of the principal challenges under the prior regime was the uncertainty created by overlapping, sometimes inconsistent policies. A company making a VSD often could not be sure which component’s policy would apply, particularly in multi-jurisdictional matters. The unified Policy addresses this concern directly, providing a single set of rules and incentives that apply regardless of which DOJ component handles the matter. This should reduce the strategic complexity of VSD decisions and promote more consistent treatment of similarly situated companies. The CEP also will reduce forum shopping by companies seeking out better terms where conduct involves multiple jurisdictions.

Strengthened incentives for early disclosure

The Policy’s clear articulation of the benefits available at each tier, combined with the commitment to make all declinations public, should strengthen the case for early voluntary self-disclosure. The 120-day whistleblower timing provision, now applicable department-wide, adds further urgency: companies that receive internal whistleblower reports must be prepared to make disclosure decisions promptly. The 120-day time period remains fairly limited given the amount of time a complex internal investigation could take, and increases pressure on companies to quicky assess the facts, potential risk exposure, and determine if voluntary self-disclosure is beneficial. Organizations should review and, if necessary, enhance their internal triage and escalation protocols to ensure they can meet these timelines, and have a detailed process in place for conducting efficient internal investigations, as discussed below.

Investigation readiness is critical

The cooperation requirements underscore the need for companies to be prepared to respond swiftly. The expectation that companies will proactively disclose relevant facts, attribute those facts to specific sources, and provide rolling updates places a premium on well-developed internal investigation capabilities. Companies that have invested in robust investigation protocols, document preservation systems, and clear lines of authority for managing government inquiries will be better positioned to earn full cooperation credit under the Policy.

Remediation expectations continue to rise

The detailed remediation criteria in the Policy reflect an ongoing trend toward expecting companies to demonstrate not just that they have a compliance program, but that the program is effective, well resourced, and subject to regular testing. The explicit reference to controls on ephemeral messaging platforms highlights a specific area of regulatory focus. Companies should ensure that their compliance programs address the management of personal communication channels and that their document retention policies account for these technologies.

Monitor use should continue to decline

The Policy’s express provision that Part II resolutions will not require an independent compliance monitor reinforces the Department’s recent trend of limiting monitorships. This is consistent with the Criminal Division’s May 2025 monitor selection policy revisions, and Deputy Attorney General Blanche’s stated view that monitors have become, in many cases, overly expensive and insufficiently tailored. While monitors remain available in Part III resolutions, companies that meet the standards for Part I or Part II should expect to avoid them entirely.

Open questions remain

Several aspects of the new Policy will require further clarification as it is implemented. It is unclear, for example, how the Policy will interact with the various compliance evaluation frameworks maintained by individual components, such as the Criminal Division’s Evaluation of Corporate Compliance Programs or the Antitrust Division’s counterpart. The relationship between the CEP and existing whistleblower programs, including the Corporate Whistleblower Awards Pilot Program, will also need to be worked out in practice. And while the Policy provides that cooperation credit should be documented in resolution agreements, it will take time to develop a body of precedent that enables companies and their counsel to calibrate their expectations. Companies should monitor these developments closely, and be prepared to adjust their compliance and disclosure strategies as the Policy is applied and interpreted.

Conclusion

The new department-wide CEP represents a meaningful step toward the consistency and predictability that both the government and practitioners have long sought. Companies should treat it as a prompt to reassess their compliance, investigation, and disclosure capabilities, and those that invest in readiness now will be best positioned to take advantage of the incentives the Policy provides.