Contributors

The U.S. Department of Justice (“DOJ”) recently announced a single Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”), formalizing a uniform framework that now applies across all DOJ divisions handling corporate criminal matters.  The CEP is intended to incentivize early voluntary self-disclosure, meaningful cooperation, and timely remediation by providing greater transparency and consistency in how DOJ evaluates corporate misconduct and determines resolutions.

Overview of the CEP

Under the CEP, DOJ encourages responsible corporate behavior by offering concrete and predictable benefits to companies that:

  • Voluntarily self-disclose potential criminal misconduct;
  • Fully cooperate with DOJ investigations; and
  • Timely and appropriately remediate underlying issues.

The CEP applies broadly to all corporate criminal matters handled by DOJ, subject to limited statutory exceptions, and is designed to promote consistency across DOJ while preserving prosecutorial discretion.  All resolutions under the CEP require senior-level DOJ approval in accordance with the Justice Manual.

Resolution Pathways under the CEP

The CEP outlines three paths to resolution, depending on the company’s conduct and the presence of aggravating factors.  Specifically, DOJ instructs prosecutors to assess eligibility for benefits under Path 1 and Path 2 of the CEP, informing companies, where appropriate, “as soon as practicable” of their status under the CEP.

Path 1: CEP Declination

DOJ will decline to prosecute a company where the company:

  • Voluntarily self-discloses misconduct to the appropriate DOJ criminal component;
  • Fully cooperates;
  • Timely and appropriately remediates; and
  • Has no aggravating circumstances, such as egregious misconduct, pervasive wrongdoing, significant harm, or relevant recidivism.

Even where aggravating circumstances may be present, prosecutors retain discretion to recommend a declination based on the totality of the company’s disclosure, cooperation, and remediation.  Declinations under the CEP will be made public and require payment of disgorgement, forfeiture, and restitution where applicable.

Path 2: “Near Miss” Self- Disclosures and Cases with Aggravating Factors

Even when a declination is unavailable, voluntary self-disclosure significantly improves the posture of a resulting resolution.  As outlined under Path 2, where a company narrowly misses the requirements for voluntary self-disclosure or where aggravating factors warrant a resolution, DOJ generally still will:

  • Offer a non-prosecution agreement (“NPA”) absent particularly egregious circumstances;
  • Limit the NPA term to fewer than three years;
  • Not require an independent compliance monitor; and
  • Provide a reduction of 50 percent to 70 percent off the low end of the U.S. Sentencing Guidelines fine range.

Path 3: Other Resolutions

In cases where neither of the above paths apply, DOJ retains discretion regarding the form of resolution, duration, compliance obligations, and monetary penalties.  In such cases, fine reductions generally will not exceed 50 percent of the U.S. Sentencing Guidelines fine range, with cooperation and remediation influencing the outcome.  Prosecutors will also weigh the particular facts and circumstances as well as the company’s recidivism when determining the appropriate resolution. 

Criminal Division’s May 2025 Revised Corporate Enforcement Policy

The CEP is relatively unchanged from the Criminal Division’s revised Corporate Enforcement Policy announced in May 2025 (see our alert here).  The eligibility criteria for voluntary self-disclosure, definitions of full cooperation and timely remediation, as well as the structured benefits available to companies remain substantively the same.

What is new is the scope and uniformity of the CEP.  DOJ has now expressly extended the CEP framework across all divisions, reinforcing DOJ’s stated goal of consistency, predictability, and transparency in corporate criminal enforcement.

Continued Importance of Compliance Programs

The CEP underscores – again – that effective compliance programs remain critical and central to a company’s ability to secure favorable outcomes under DOJ’s enforcement policies.  DOJ’s analysis at each stage of the enforcement lifecycle is informed by the strength, maturity, and adaptability of a company’s compliance infrastructure.

Enabling Timely Voluntary Self-Disclosure

A company’s ability to voluntarily self-disclose in satisfaction of DOJ’s requirements depends heavily on whether the company’s compliance program and internal controls are designed to detect potential misconduct early and escalate issues efficiently.  DOJ encourages early disclosure, placing a premium on systems that surface risks promptly and allow companies to assess whether disclosure is appropriate. Risk-based controls, effective reporting channels, and clear escalation protocols enable companies to make informed, good-faith disclosure decisions within DOJ’s expected timeframes.  In this respect, compliance programs function as both an early-warning mechanism and a decision-support framework for voluntary self-disclosure.

Supporting Meaningful and Proactive Cooperation

DOJ’s definition of full cooperation requires companies to timely, proactively, and accurately disclose all facts and non-privileged evidence, identify all individuals involved, as well as preserve and produce relevant documents, including those located overseas.  These expectations presuppose strong investigative controls, disciplined documentation practices, and coordination between legal, compliance, and business functions. 

Companies with mature compliance programs are better positioned to satisfy these requirements, given that internal controls help facilitate fact-gathering, data preservation, and cross-functional collaboration.  DOJ emphasizes that cooperation credit is “earned, not presumed,” further underscoring that the quality of a company’s compliance and internal control environment directly impacts its ability to obtain cooperation credit.

Demonstrating Timely and Appropriate Remediation 

Most directly, DOJ evaluates compliance programs as part of its assessment of whether a company has timely and appropriately remediated misconduct. The CEP expressly ties remediation credit to a company’s ability to conduct a meaningful root-cause analysis, implement or enhance an effective compliance and ethics program, appropriately discipline responsible individuals, and reduce the risk of recurrence through strengthened internal controls. 

Taken together, the CEP makes clear that compliance programs and internal controls are not assessed in isolation or only after misconduct occurs. Companies that continuously evaluate their risk profile, strengthen internal controls, and tailor compliance programs accordingly are better positioned to take advantage of the CEP’s incentives.

Practical Takeaways

  • Early decision-making matters.  Companies should be prepared to assess potential misconduct quickly and determine whether voluntary self-disclosure is appropriate before an “imminent threat” of government awareness arises.  This includes ensuring that reporting channels, escalation protocols, and internal controls are designed to identify potential misconduct quickly and route it to the relevant function for review and investigation, as appropriate.
  • Compliance remains a differentiator.  Well-designed and well-resourced compliance programs continue to be a critical factor in maximizing credit under DOJ enforcement policies.  To that end, companies should prioritize on-going testing and monitoring of internal controls to evaluate effectiveness.  Companies should also conduct periodic risk-based compliance assessments to evaluate the company’s risk profile, ensuring that internal controls are appropriately tailored and well-designed to mitigate risks.
  • Preparation is key.  Companies should ensure their internal investigation, reporting, documentation practices, and escalation protocols are aligned with DOJ’s expectations for disclosure, cooperation, and remediation.  Further, companies should pre-identify decision-makers, outside counsel, and investigative workflows to enable timely engagement with DOJ in the event issues arise.
  • Account for heightened whistleblower risk.  Towards the end of last year, DOJ shed light on certain statistics concerning the Criminal Division’s Corporate Whistleblower Awards Pilot Program (the “Whistleblower Program”), including that approximately 1,100 whistleblower tips had been received since the Whistleblower Program’s creation in August 2024, with more than half of those tips referred to prosecutors for further investigation.  Since the Whistleblower Program was most recently updated in May 2025 (see our alert here), DOJ reported receiving over 100 tips by the end of last year, with nearly 80 percent of those tips referred to prosecutors. As DOJ continues to emphasize whistleblower-driven enforcement, companies must be prepared to identify, assess, and remediate issues promptly.  

CEP Flowchart, as originally published by DOJ

Womble Bond Dickinson (US) LLP’s White Collar Defense and Criminal Investigations Team navigates domestic and international clients in all manner of white collar, regulatory, corporate and congressional investigations. Our team includes a distinguished roster of veteran defense attorneys, former federal prosecutors and U.S. Attorneys who served at the highest levels of the Department of Justice and at leading United States Attorneys’ Offices. Our team includes Chambers Ranked (Band 1) lawyers and alumni of the U.S. Department of Justice, the SEC’s Enforcement Division, the U.S. Senate, House of Representatives, and in-house compliance specialists of publicly traded companies.