The New Corporate Enforcement Blueprint: DOJ’s “First-Ever” Department-Wide Corporate Enforcement Policy

By: Robert Ward

Understanding the DOJ’s New Corporate Enforcement Framework

On March 10, 2026, just weeks after the U.S. Attorney’s Office for the Southern District of New York (SDNY) released its updated voluntary corporate self-disclosure program for fraud and financial misconduct, the Department of Justice introduced its first Department‑wide Corporate Enforcement Policy (CEP).

The CEP establishes a uniform approach for evaluating voluntary disclosures and cooperation across all DOJ criminal enforcement components (except for the Antitrust Division, which retains its own policy[1]), replacing the patchwork of policies across DOJ components and U.S. Attorney’s Offices, including SDNY’s February 2026 Voluntary Self‑Disclosure Program (SDNY VSP).

The CEP therefore eliminates two of the most attractive features of the recently announced SDNY VSP: the promise of a conditional declination within two to three weeks and the exclusion of many aggravating circumstances from the declination analysis. Nevertheless, the CEP offers significant benefits to companies that become aware of potential criminal misconduct and promptly disclose it to the DOJ.

Key Features

The CEP has its roots in, and largely reflects an expansion of, the Criminal Division’s Corporate Enforcement and Voluntary Self‑Disclosure Policy. In particular, like the Criminal Division policy, the CEP continues to offer three categories of potential benefits to companies.

Part I: Declination

The DOJ will decline prosecution if a company:

• Voluntarily self‑discloses misconduct to an appropriate DOJ criminal component,
• Fully cooperates with the investigation,
• Timely and appropriately remediates the misconduct, and
• Has no aggravating circumstances.

Unlike the SDNY VSP—which excluded certain aggravating circumstances from its declination analysis—the CEP retains the Criminal Division policy’s potentially disqualifying aggravating circumstances, including:

• The nature and seriousness of the offense
• The egregiousness or pervasiveness of the misconduct
• The severity of harm
• Corporate recidivism

That said, aggravating circumstances do not necessarily preclude a declination. Prosecutors continue to retain discretion to recommend a declination after assessing the severity of such circumstances in light of the company’s disclosure, cooperation, and remediation efforts.

Moreover, CEP declinations continue to require payment of any applicable disgorgement, forfeiture, and victim restitution.

Part II: “Near‑Miss” Disclosures or Aggravating Factors

The CEP offers important benefits even if a company does not qualify for a Part I declination. Under Part II, a company may receive a non‑prosecution agreement (NPA) if it fully cooperates and remediates but is ineligible for Part I solely because:

• Its disclosure did not meet the CEP’s definition of “voluntary self‑disclosure,” and/or
• It has aggravating factors warranting a criminal resolution.

Part II NPAs will:

• Include a term length of under three years
• Not require an independent compliance monitor
• Include a 50–75% reduction off the low end of the Sentencing Guidelines fine range

This last element reflects a change from the Criminal Division policy—which provides for a 75% reduction—giving prosecutors additional flexibility in reaching a resolution.

However, not all companies that make “near‑miss” disclosures will qualify for an NPA. “Particularly egregious” or “multiple aggravating circumstances” may result in a Part III resolution.

Part III: “Other” Cases

For companies not qualifying under Part I or Part II, prosecutors retain full discretion. Reductions will not exceed 50% off the Sentencing Guidelines fine range. For companies that fully cooperate and remediate, the default presumption is that reductions apply to the low end of the range. Otherwise, prosecutors will determine the starting point after evaluating factors such as recidivism and culpability.[2]

What Counts as Voluntary Self‑Disclosure?

A declination under Part I is only available if the company has “voluntarily self‑disclosed” the misconduct. A disclosure satisfies this requirement only if:

• The company makes a good‑faith disclosure to the appropriate DOJ component;
• The misconduct was not already known to DOJ;
• The company had no preexisting obligation to disclose;
• Disclosure occurs before an “imminent threat” of external reporting or a government investigation; and
• Disclosure occurs within a “reasonably prompt time” after the company becomes aware of the misconduct, with the company bearing the burden of proving timeliness.[3]

Notably, a company may still receive a Part I declination even if DOJ receives a whistleblower submission first, provided the company:

• Self‑reports as soon as reasonably practicable and no later than 120 days after receiving the internal report; and
• Meets all other Part I requirements.

The Bottom Line: Act Quickly but Carefully

The benefits of self‑disclosure are substantial. Even if a company cannot secure a Part I declination, Part II NPAs continue to offer meaningful benefits.

And while the CEP does not offer the level of assurance provided by SDNY’s short‑lived “conditional declination” approach, DOJ has at least formalized the expectation that prosecutors move quickly in evaluating disclosures.

Nevertheless, risks remain: a declination does not prevent further investigation by the Civil Division or state authorities and could trigger private civil litigation. Additionally, advances in investigative technology are shortening the window for companies to investigate internally before the government independently uncovers potential misconduct.

In short, companies that detect potential criminal misconduct must balance the concrete benefits of disclosure against the more nebulous risks of future civil liability or regulatory action. And to reap the CEP’s full benefits, they must do so swiftly.

[1] The Antitrust Division’s corporate leniency policy will continue to apply to organizations and individuals that self-report Sherman Act violations.

[2] Prosecutors are to consider the factors set out in the Sentencing Commission’s Determining the Fine Within the Range Policy Statement, U.S.S.G. § 8C2.8, which include among other things the company’s role in the offense, the need for deterrence, and the company’s culpability score under U.S.S.G. § 8C2.5.

[3] The fourth and fifth requirements track the language of U.S.S.G. § 8C2.5(g)(1), which provides a 5-point reduction in culpability score to an organization that, among other things, reported the offense prior to imminent threat of disclosure or government investigation and within a reasonably prompt time after becoming aware of the offense.