The U.S. Department of Justice (DOJ) recently released its first-ever Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) for criminal matters. The new CEP creates a uniform national policy for how the DOJ rewards companies that voluntarily self-report criminal conduct. Building on the 2025 CEP of the DOJ’s Criminal Division, the new CEP supersedes all prior corporate enforcement policies from individual DOJ components and U.S. Attorneys’ Offices. It applies to all corporate criminal matters handled by the DOJ, except for violations of the Sherman Antitrust Act.
Why Does It Matter?
The new CEP largely mirrors the 2025 CEP. However, a key difference is that the new CEP applies throughout the DOJ and all U.S. Attorneys’ Offices. Thus, it replaces a patchwork of policies with a uniform, national framework for voluntary self-disclosures. According to the DOJ, this will promote uniformity, predictability, and fairness in how the Department pursues white collar cases. Under this framework, the DOJ will decline to prosecute companies that voluntarily disclose misconduct, cooperate with DOJ investigations, and timely and appropriately remediate the wrongdoing, absent certain aggravating circumstances.
How Does the New CEP Work?
Like the 2025 CEP it is based on, the new CEP creates a standardized framework for how prosecutors across the DOJ, including U.S. Attorneys’ Offices, reward corporations that voluntarily disclose discovered misconduct, cooperate with DOJ investigations, and remediate wrongdoing. It divides the potential incentives into three parts:
- Declination of prosecution for self-disclosures that meet certain criteria.
- Non-prosecution agreements for “near miss” self-disclosures that fail to meet the requirements of Part I.
- Prosecutorial discretion for companies that are ineligible under Parts I or II.
Below is a flow chart included as Appendix A in the CEP that illustrates how the three Parts work.
When Will the DOJ Decline to Prosecute a Company for Criminal Conduct?
Under Part I of the CEP, the DOJ will decline to prosecute a company for criminal conduct if the following four factors are met:
- The company voluntarily self-disclosed the misconduct to an appropriate DOJ criminal component.
- The company fully cooperated with the DOJ’s investigation.
- The company timely and appropriately remediated the misconduct.
- There are no aggravating circumstances.
Aggravating circumstances include the nature and seriousness of the offense, the egregiousness or pervasiveness of the misconduct within the company, the severity of harm caused by the misconduct, or corporate recidivism. Corporate recidivism means the company had a criminal adjudication or resolution either within the last five years or otherwise based on similar misconduct by the company engaged in the misconduct at issue.
To qualify as a voluntary self-disclosure: (1) the company must make a good faith disclosure of the misconduct to the appropriate DOJ component, (2) the misconduct must not be previously known to the DOJ, (3) the company must not have a pre-existing obligation to disclose the misconduct to the DOJ, (4) the voluntary disclosure must occur prior to an imminent threat of disclosure or government investigation, and (5) the company must disclose the conduct to the DOJ within a reasonably prompt time after becoming aware of the misconduct.
As an exception to the requirement that the misconduct not be previously known to the DOJ, a company can still qualify for a declination if a whistleblower makes both an internal report to the company and a submission to the DOJ, provided that the company self-reports the conduct to the DOJ as soon as reasonably practicable but not later than 120 days after receipt of the whistleblower’s internal report.
Importantly, disclosures made only to federal regulatory agencies, state and local governments, or civil enforcement agencies generally do not qualify as voluntary self-disclosures but may be considered as part of a company’s cooperation and remediation. Healthcare companies in particular should bear this in mind because misconduct could trigger reporting requirements with other regulatory bodies. For instance, Medicare or Medicaid overpayments must be reported to the Department of Health and Human Services.
What Happens If a Company Fails to Meet the Criteria Under Part I?
Under Part II, companies that do not meet the criteria under Part I because their self-reports do not qualify as voluntary self-disclosures or because they had aggravating factors that warrant a criminal resolution may nonetheless qualify for a Non-Prosecution Agreement (NPA), provided that there are not any particularly egregious or multiple aggravating circumstances. In such cases, the DOJ commits to allowing a term of fewer than 3 years , not requiring an independent compliance monitor, and providing a reduction of 50 to 75 percent off the low end of the U.S. Sentencing Guidelines fine range.
How Will the DOJ Resolve Other Cases?
In Part III, the DOJ explains that prosecutors retain discretion to determine the appropriate resolution if a company is not eligible for Part I or Part II. Additionally, Part III precludes companies from receiving a reduction of greater than 50 percent of the fine under the U.S. Sentencing Guidelines. Aside from that limitation, prosecutors will have discretion to determine fine reductions. However, for companies that fully cooperate with the DOJ and timely take appropriate remedial measures, there is a presumption that fine reductions will be taken from the low end of the U.S. Sentencing Guidelines. Otherwise, prosecutors may determine the starting point for fines based on the facts and circumstances of the case.
What Are the Implications for Corporate Compliance Programs?
In announcing the new CEP, the DOJ made clear that it is focused on quickly pursuing culpable individuals. The concept of “timely and appropriate remediation” is a critical element to qualify for a declination or NPA. Appendix B to the CEP defines this and other important terms. In order to satisfy this requirement, a company must have an effective compliance and ethics program. What is considered an effective program depends on the size and resources of the company. In addition to the resources and staff dedicated to compliance, factors for evaluating compliance programs include whether the company has conducted an effective risk assessment, how the company’s compliance program has been tailored to that risk assessment, and whether the company has tested its compliance program to assure its effectiveness. The upshot is that companies should not only have a compliance program but should also be conducting risk assessments and testing their compliance program regularly. Although the policy is subject to change as executive branch priorities shift, the DOJ’s focus on individual accountability has been a consistent theme during the Trump Administration and dates back to the Obama Administration. Thus, this new CEP likely has significant staying power.
Conclusion
The DOJ’s new Department-wide CEP provides clearer, more uniform expectations and strengthens incentives for timely self‑disclosure and remediation. Now is the time for companies to reassess and test their compliance programs to ensure that they are well functioning and tailored to the appropriate risks. Companies considering a self-disclosure should consult an attorney. The CEP is aimed at criminal conduct and depending on the timing and nature of discovered errors, there could be alternative strategies to consider. For instance, for healthcare organizations some errors could be addressed by not billing, rebilling, or other corrective action. Akerman attorneys are available to answer any questions about how this CEP could affect your organization.
CEP Flow Chart
