U.S. Enforcement: Uniform Policy on Corporate Voluntary Self-Disclosures and Mitigation of Penalties

On March 10, 2026, the U.S. Department of Justice (DOJ) issued a new policy establishing a uniform framework for corporate enforcement and voluntary self-disclosures (“Corporate Enforcement and Voluntary Self-Disclosure Policy,” CEP):

• The new policy is also relevant for European companies with a U.S. nexus. In the event of compliance incidents, decision-making regarding disclosure to U.S. authorities should be facilitated by harmonized requirements for penalty mitigation.
• The CEP is the DOJ’s first department-wide policy governing how voluntary self-disclosures and cooperative corporate conduct are treated and evaluated in criminal proceedings. It builds on the DOJ Criminal Division’s policy from May 2025, but now extends across DOJ divisions and applies as well to U.S. Attorneys’ Offices. This is intended to ensure consistent standards in how self-disclosures and cooperation are assessed, both at the regional prosecutorial level and within DOJ-led investigations.
• The CEP is intended to replace all prior U.S. Attorneys’ Office and division-specific policies in this area. Under certain conditions, the DOJ outlines a range of standardized mitigation benefits for companies that voluntarily disclose misconduct and cooperate:

I. Potential Outcomes of Voluntary Self-Disclosure and Full Cooperation

1. Declination (No Prosecution)

A voluntary self-disclosure may result in a declination where: (i) the misconduct was not previously known to authorities, (ii) the company fully cooperates during the investigation, and (iii) timely and appropriate remediation is undertaken, provided no aggravating factors are present.

Even in the case of a declination, the DOJ may require disgorgement of profits or restitution. Declinations are typically made public.

2. Mitigated Resolution (“Near Miss”)

If aggravating factors exist, or if not all requirements for a declination are met despite good-faith efforts, prosecutors may still enter into a mitigated resolution under the CEP, typically in the form of a Non-Prosecution Agreement (NPA), subject to conditions.

In such cases, prosecutors are expected to balance aggravating factors against the extent of the company’s disclosure, cooperation, and remediation efforts. Aggravating factors may include the nature and severity of the misconduct, the scale of harm caused, or prior criminal enforcement actions for similar misconduct within the past five years.

An NPA may include financial penalties, restitution, remediation obligations, and continued cooperation requirements. As mitigation, the DOJ provides that:

• the term of the NPA will generally be less than three years,
• no compliance monitor will be imposed, and
• penalties will be reduced by approximately 50–75% from the low end of the applicable range.

3. Continued Prosecution Without Mitigation

If the requirements for either a declination or a mitigated resolution are not met, prosecutors retain full discretion to proceed with enforcement and impose penalties.

Even where a company cooperates later in the process, any reduction in penalties will generally not exceed 50%. Additional measures may include the imposition of a compliance monitor and other obligations.

II. Requirements for Voluntary Self-Disclosure (CEP)

To qualify for mitigation under the CEP, a voluntary self-disclosure must meet the following criteria:

1. It must be made in good faith to the appropriate DOJ enforcement authority;
2. The misconduct must not already be known to the DOJ (except in the case of internal whistleblower reporting, see Section V);
3. The company must not already be under a legal obligation to disclose the misconduct;
4. The disclosure must be truly voluntary—i.e., made before there is reason to believe the DOJ will imminently learn of the misconduct through other means;
5. The disclosure must be made within a reasonable time after the company becomes aware of the misconduct, with the burden on the company to demonstrate timeliness.

III. Cooperation Requirements

The CEP also defines “full cooperation.” Companies are expected to:

1. Disclose all relevant facts, including identifying individuals involved in the misconduct (subject to applicable privileges);
2. Provide concrete evidence and sources supporting the disclosed facts—generalized summaries are typically insufficient;
3. Proactively disclose relevant information, even absent a specific request;
4. Preserve and produce evidence, including data and documents located abroad;
5. Coordinate internal employee interviews with enforcement authorities;
6. Facilitate DOJ interviews of witnesses and subjects.

IV. Remediation Requirements

To meet the CEP’s remediation expectations, companies should:

1. Conduct a root cause analysis and address identified deficiencies;
2. Implement or enhance an effective compliance program based on that analysis;
3. Take appropriate disciplinary action against responsible employees;
4. Ensure proper document retention and prevent improper deletion, including by implementing policies governing the use and retention of communication tools and applications;
5. Take further measures to reduce the risk of recurrence.

V. Exception: Corporate Whistleblower Awards Pilot Program

An exception applies to the requirement that misconduct must not already be known to authorities:

If a whistleblower reports misconduct both internally and externally, the company may still qualify for a declination if it submits its own disclosure within 120 days of the internal report and meets all other CEP requirements.

VI. Conclusion and Outlook

The DOJ’s new policy continues the enforcement approach developed in recent years, relying on strong incentives for companies to voluntarily disclose previously undetected misconduct. This reflects both the effectiveness of a “carrot and stick” strategy and the DOJ’s reliance on corporate cooperation. The latter is particularly relevant in light of recent staffing reductions within the DOJ and many U.S. Attorneys’ Offices.

For companies, recent developments in the U.S. have two key implications:

1. Following a pause in FCPA enforcement in 2025 and a strategic realignment, the DOJ appears to be resuming enforcement activities more comprehensively. A relaxation of U.S. enforcement or of expectations regarding robust compliance systems should not be anticipated.
2. The new CEP policy provides companies with clearer criteria to assess whether voluntary disclosure of internally identified misconduct with a U.S. nexus may be advisable, particularly in light of the potential for significant penalty reductions.