DOJ Corporate Enforcement Policy 2026: What Compliance Officers Need to Know

The new policy creates a common framework for how DOJ components and U.S. Attorney’s Offices evaluate corporate voluntary self-disclosure, cooperation and remediation in criminal matters. It replaces the previous patchwork of component-specific and district-specific corporate enforcement policies, except for antitrust matters.

For chief compliance officers, general counsel, internal audit teams and corporate investigators, the policy creates a clearer incentive structure. A company that identifies potential criminal misconduct, reports it promptly to the appropriate DOJ criminal component, fully cooperates and completes timely remediation may qualify for a public declination rather than prosecution.

However, a favorable outcome is not based merely on filing a disclosure.

The organization must be able to show how the issue was detected, when decision-makers learned of it, how evidence was preserved, which individuals were involved, why the misconduct occurred and what the company changed to prevent recurrence.

The DOJ Corporate Enforcement Policy 2026 establishes three possible resolution paths for companies involved in potential criminal misconduct. Companies that make a qualifying voluntary self-disclosure, fully cooperate, remediate promptly and lack disqualifying aggravating circumstances can receive a declination. Companies that narrowly miss the disclosure requirements or have aggravating circumstances may receive a non-prosecution agreement and substantial penalty reductions. Other cases remain subject to prosecutorial discretion.

What Is the DOJ Corporate Enforcement Policy?

The DOJ Corporate Enforcement and Voluntary Self-Disclosure Policy, often called the CEP, is an internal enforcement framework used to determine how companies should be treated when potential criminal misconduct occurs.

The policy is designed to encourage organizations to:

1. Detect potential wrongdoing early
2. Voluntarily report it to DOJ
3. Cooperate with the government’s investigation
4. Remediate the underlying misconduct
5. Compensate victims and surrender proceeds connected with wrongdoing
6. Help DOJ identify and prosecute responsible individuals

The Department says the policy is intended to promote consistency, transparency and predictability across corporate criminal enforcement.

Before March 2026, companies could encounter different voluntary self-disclosure policies depending on the DOJ division or U.S. Attorney’s Office handling the matter. The new policy applies one department-wide framework, apart from antitrust violations.

The policy applies broadly to business organizations. DOJ notes that “company” or “corporation” can include corporations, partnerships, sole proprietorships, government entities and unincorporated associations.

Why the 2026 Policy Matters

The most significant development is not simply that DOJ encourages voluntary disclosure. DOJ has promoted disclosure, cooperation and remediation for years.

The important change is the application of one structured decision model across almost all DOJ corporate criminal matters.

That gives compliance teams a clearer understanding of the consequences associated with different corporate responses.

The policy creates three primary paths:

Path	General circumstances	Potential outcome
Part I	Qualifying disclosure, full cooperation, timely remediation and no disqualifying aggravating circumstances	Public declination
Part II	Good-faith self-report that narrowly misses disclosure requirements, or aggravating circumstances requiring resolution	Non-prosecution agreement, shorter term, no monitor and substantial penalty reduction
Part III	Company does not qualify for Part I or Part II	Resolution determined through prosecutorial discretion

This structure increases the importance of early detection and escalation.

The difference between a Part I declination and a Part II or Part III resolution can depend on questions such as:

• When did the company become aware of the misconduct?
• How quickly was the matter escalated?
• Was DOJ already aware?
• Was disclosure legally required?
• Was there an imminent threat that the issue would become public?
• Was the disclosure made to the correct DOJ component?
• Did the company preserve relevant communications?
• Did it identify the individuals involved?
• Did it correct the control failures that allowed the misconduct?

These are compliance operating questions, not merely legal interpretation questions.

Part I: Declination Under the Policy

Under Part I, DOJ states that it will decline to prosecute a company when four conditions are satisfied:

1. The company made a qualifying voluntary self-disclosure to an appropriate DOJ criminal component.
2. The company fully cooperated with the investigation.
3. The company timely and appropriately remediated the misconduct.
4. There are no disqualifying aggravating circumstances associated with the misconduct or the organization.

Even where aggravating circumstances exist, prosecutors retain discretion to recommend a declination after weighing the seriousness of those circumstances against the organization’s disclosure, cooperation and remediation.

A declination does not mean the matter remains confidential or that the organization avoids financial consequences.

All CEP declinations are made public. The company may also be required to pay:

• Disgorgement
• Forfeiture
• Restitution
• Victim compensation

The policy therefore offers protection from corporate prosecution, not a complete elimination of financial, civil, regulatory or reputational consequences.

What Counts as a Voluntary Self-Disclosure?

The policy establishes five central conditions for a qualifying voluntary self-disclosure.

1. The disclosure must be made in good faith

The company must genuinely report the potential misconduct rather than provide an incomplete or misleading account intended to obtain cooperation credit.

2. DOJ must not already know about the misconduct

The conduct must not have been previously known to the Department.

This makes internal detection speed critical. A whistleblower, business partner, customer, regulator or former employee may report the matter externally before the organization completes its internal response.

3. There must be no pre-existing obligation to disclose

A disclosure made only because an organization already had a legal, contractual or regulatory obligation to report may not qualify as voluntary under the policy.

That does not mean the disclosure lacks value. It may still contribute to DOJ’s evaluation of cooperation and remediation.

4. Disclosure must occur before an imminent threat of discovery or investigation

A company cannot ordinarily wait until it is about to be exposed through a subpoena, public report, government inquiry or imminent external disclosure.

5. Disclosure must be reasonably prompt

The organization bears the burden of demonstrating that it reported within a reasonably prompt time after becoming aware of the misconduct.

The policy deliberately encourages companies to approach DOJ before completing an internal investigation.

This does not mean companies should report every unverified allegation immediately. It means they need a disciplined process for quickly assessing credibility, seriousness, potential criminal exposure and disclosure options with qualified counsel.

Reporting to the Appropriate DOJ Component

A qualifying disclosure must be made to an appropriate DOJ criminal component.

Depending on the conduct, that could include:

• The Criminal Division
• A U.S. Attorney’s Office
• The National Security Division
• Another DOJ component with authority over the potential offense

Good-faith disclosure to one DOJ component may still qualify when the matter is later transferred to the appropriate component.

However, reporting only to a federal regulator, civil enforcement agency, state authority or local government will generally not satisfy the policy’s disclosure condition. DOJ may still consider those reports when evaluating the organization’s cooperation and remediation.

For national security matters involving export controls or sanctions, DOJ has specifically directed companies to make disclosures to the National Security Division because that division has responsibility for criminal laws involving national security.

Compliance teams should therefore avoid maintaining a single generic “report to the government” procedure. The process should require legal analysis of the appropriate authority, reporting route and timing.

The 120-Day Whistleblower Exception

The policy includes an important exception connected with the DOJ Corporate Whistleblower Awards Pilot Program.

Suppose a whistleblower reports suspected misconduct internally and also submits the information to DOJ before the company does. Under ordinary circumstances, the government’s earlier receipt of the information could prevent the company from satisfying the requirement that the conduct was previously unknown to DOJ.

The exception allows the company to preserve potential declination eligibility when it:

• Reports to DOJ as soon as reasonably practicable
• Reports no later than 120 days after receiving the internal whistleblower report
• Satisfies the remaining disclosure, cooperation, remediation and aggravating-circumstances requirements

The 120-day period is not a general safe harbor for all voluntary disclosures. Companies should not assume they can wait four months before acting.

The policy requires reporting as soon as reasonably practicable, with 120 days serving as the outer boundary for this specific whistleblower scenario.

For compliance teams, the operational lesson is clear: internal reports involving possible criminal conduct need immediate triage.

A hotline report should not remain in an ordinary investigation queue while the organization assumes that it controls the timeline.

What Does Full Cooperation Require?

A voluntary disclosure alone does not qualify the organization for Part I treatment. The company must also fully cooperate.

Under the policy, cooperation includes timely, truthful and accurate disclosure of all relevant facts and non-privileged evidence.

This includes information concerning individuals inside and outside the organization, regardless of their position, seniority or status.

Disclosure of relevant facts

The company should disclose:

• Facts discovered during an internal investigation
• Information about the individuals involved
• Sources supporting specific facts
• Relevant documents and communications
• Updates as the investigation progresses
• Information that could help DOJ locate evidence held by others

DOJ expects companies to attribute facts to specific sources rather than present only a generalized narrative.

Proactive cooperation

The organization should not wait for DOJ to request every relevant record.

It is expected to identify material facts proactively and alert DOJ to evidence that may be outside the company’s possession.

Preservation and production of records

Companies must preserve, collect and produce relevant records, including information about:

• Where records were located
• Who maintained them
• Who created them
• Overseas documents
• Third-party records
• Foreign-language documents
• Relevant custodians

When foreign law, privacy restrictions or blocking statutes limit access, the company bears the burden of establishing the restriction and identifying lawful alternatives that help DOJ obtain the necessary information.

Coordination of investigative steps

DOJ may ask a company to delay particular interviews or investigative actions for a limited period where those steps could interfere with the government’s investigation.

These requests should be narrow, time-limited and tied to a specific investigative purpose.

Access to witnesses

Subject to constitutional protections and practical limitations, companies may be expected to make relevant employees, officers and agents available for interviews. This can include former employees and individuals located outside the United States.

Cooperation must be earned

The policy states that companies begin with zero cooperation credit and earn it through specific actions.

DOJ considers the scope, quality, quantity, timing and impact of the organization’s cooperation. A company that delays meaningful cooperation may reduce the credit available even if it eventually provides the requested information.

The policy does not require a company to waive attorney-client privilege or work-product protection to qualify for benefits.

Start your 21-day free trial and see how VComply helps your team bring structure, accountability, and visibility to your compliance operations

What Is Timely and Appropriate Remediation?

The policy defines remediation as more than terminating one employee or updating a policy.

DOJ expects an organization to identify why the misconduct occurred and make changes addressing the underlying cause.

Root-cause analysis

The company should conduct a thorough analysis of the factors that allowed the misconduct.

Questions may include:

• Which control failed?
• Was the control poorly designed or poorly performed?
• Were warning signs ignored?
• Did management create inappropriate pressure?
• Were responsibilities unclear?
• Was a third party insufficiently reviewed?
• Did employees use unapproved communication systems?
• Was compliance under-resourced?
• Did incentives encourage excessive risk-taking?
• Had a similar concern appeared previously?

The resulting corrective actions should address the causes, not merely the visible incident.

An effective compliance and ethics program

The policy identifies several characteristics that may support program effectiveness:

• A visible commitment to lawful and ethical conduct
• Adequate compliance resources
• Qualified and experienced personnel
• Authority and independence for the compliance function
• Access to senior leadership and governance bodies
• Compliance expertise available to the board
• Risk assessments that shape the compliance program
• Appropriate reporting structures
• Fair compensation and advancement for compliance personnel
• Testing that demonstrates whether controls work

Appropriate discipline

The organization should take appropriate action against individuals responsible for the conduct.

This can include individuals who:

• Participated directly
• Failed to exercise oversight
• Supervised the area where misconduct occurred
• Ignored identified concerns
• Failed to follow escalation requirements

Discipline should be consistent and defensible. Similar conduct should not produce dramatically different consequences based solely on the employee’s seniority or commercial importance.

Business-record retention

The company must appropriately retain business records and prevent improper deletion or destruction.

The policy specifically addresses personal communication tools and ephemeral messaging platforms that can undermine record-retention obligations.

Companies should establish controls governing:

• Personal devices
• Personal email
• Messaging applications
• Auto-deleting communications
• Collaboration tools
• Data preservation
• Legal holds
• Employee departures
• Third-party communications

Prevention of recurrence

Remediation should demonstrate that the company recognizes the seriousness of the misconduct and has taken reasonable steps to reduce the possibility of repetition.

That may require:

• Updating policies
• Redesigning approvals
• Strengthening vendor reviews
• Revising incentive structures
• Introducing transaction monitoring
• Conducting targeted training
• Adding data analytics
• Increasing compliance resources
• Testing redesigned controls
• Reporting remediation progress to the board

A corrective action should not be considered complete merely because a revised policy has been published. The organization should verify that the new control is operating.

What Are Aggravating Circumstances?

Even where a company discloses, cooperates and remediates, serious aggravating circumstances may affect whether a Part I declination is appropriate.

The policy identifies circumstances related to:

• The nature and seriousness of the offense
• The egregiousness of the misconduct
• Pervasiveness within the organization
• The severity of resulting harm
• Corporate recidivism

For recidivism, DOJ considers criminal adjudications or resolutions within the previous five years, as well as older resolutions involving similar misconduct by the entity involved in the current matter.

Aggravating circumstances do not automatically eliminate the possibility of a declination. Prosecutors can weigh their severity against the strength of the company’s disclosure, cooperation and remediation.

This makes historical compliance data important.

An organization should be able to identify:

• Previous criminal resolutions
• Similar regulatory findings
• Repeated internal control failures
• Prior hotline allegations
• Earlier corrective actions
• Whether remediation from previous incidents was completed
• Whether the same business unit, control or third party is involved

Part II: Near-Miss Disclosures and Aggravating Circumstances

Part II applies when a company fully cooperates and remediates but does not qualify for Part I solely because:

• It made a good-faith self-report that did not fully meet the policy’s voluntary self-disclosure definition
• Aggravating circumstances require a criminal resolution
• Both conditions are present

Under Part II, DOJ states that it shall:

1. Provide a non-prosecution agreement unless particularly egregious or multiple aggravating circumstances exist
2. Set a term shorter than three years
3. Not require an independent compliance monitor
4. Provide a reduction of at least 50 percent and no more than 75 percent from the low end of the applicable U.S. Sentencing Guidelines fine range

This is a significant distinction from a fully discretionary resolution.

A company that narrowly misses Part I can still receive concrete benefits if it demonstrates good-faith reporting, cooperation and remediation.

Examples of a near miss could include:

• Disclosure that was made in good faith but was not sufficiently prompt
• A disclosure made after DOJ had already obtained some information
• A disclosure affected by uncertainty over the correct DOJ component
• Serious misconduct involving aggravating circumstances despite strong cooperation and remediation

The exact outcome remains dependent on the facts.

Part III: Other Corporate Resolutions

If a company does not qualify under Part I or Part II, prosecutors retain discretion over:

• Whether to prosecute
• The form of the resolution
• The duration of the agreement
• Compliance obligations
• Whether a monitor is appropriate
• The monetary penalty

The policy states that reductions generally should not exceed 50 percent from the applicable U.S. Sentencing Guidelines fine range.

For companies that fully cooperate and remediate, there is a presumption that the reduction will be calculated from the low end of the range. Otherwise, the starting point may vary based on factors including corporate recidivism.

Part III demonstrates why cooperation and remediation remain valuable even after a company loses access to the strongest disclosure benefits.

How the Policy Relates to the DOJ Compliance Program Framework

The Corporate Enforcement Policy should be read alongside DOJ’s Evaluation of Corporate Compliance Programs.

The Evaluation of Corporate Compliance Programs asks three fundamental questions:

1. Is the compliance program well designed?
2. Is it adequately resourced and empowered to function effectively?
3. Does it work in practice?

DOJ considers compliance-program effectiveness both when the misconduct occurred and when prosecutors make charging or resolution decisions.

The existence of misconduct does not automatically prove that a compliance program was ineffective.

A program that detects misconduct, enables investigation, supports prompt escalation and leads to effective remediation may demonstrate that it worked as intended.

Prosecutors may evaluate:

• Risk assessments
• Policies and procedures
• Training
• Confidential reporting
• Investigations
• Third-party management
• Mergers and acquisitions
• Compliance independence
• Resources
• Data access
• Incentives
• Discipline
• Control testing
• Continuous improvement

This means that a company’s response after discovering misconduct cannot be separated from the design of its compliance program before discovery.

What Compliance Officers Should Change in 2026

1. Create a criminal-risk escalation protocol

Not every compliance concern is potential criminal misconduct. However, employees handling hotline reports, audits and control failures should know which warning signs require immediate legal review.

Examples include:

• Fraud involving government programs
• Bribery or improper payments
• Deliberate falsification of records
• Sanctions or export-control violations
• Market manipulation
• Obstruction
• Money laundering
• Significant healthcare fraud
• Procurement fraud
• Concealment by senior management
• Coordinated destruction of records

The procedure should identify who must be notified and how quickly.

2. Record the detection timeline

The company may need to prove that disclosure was reasonably prompt.

Maintain a defensible chronology showing:

• When the allegation was received
• Who received it
• When it was escalated
• When legal counsel became involved
• When evidence was preserved
• When the preliminary assessment began
• When senior leadership or the board was informed
• When disclosure was considered
• When DOJ was contacted
• Why any delay occurred

A well-maintained decision record can become critical months or years later.

3. Establish a disclosure-response team

Create a standing team involving:

• Legal
• Compliance
• Internal investigations
• Internal audit
• Information security
• Human resources
• Finance
• Communications
• Relevant business leadership

The team’s role is not to make an automatic disclosure. Its role is to ensure that high-risk matters receive coordinated, timely and well-documented analysis.

4. Strengthen evidence-preservation controls

The company should be able to preserve evidence before relevant employees alter, lose or delete it.

Review controls covering:

• Email
• Text messages
• Collaboration platforms
• Ephemeral messaging
• Personal devices
• Cloud storage
• Call recordings
• Financial systems
• Vendor portals
• Access logs
• Employee termination procedures

Ensure legal holds can be issued and tracked quickly.

5. Improve internal investigation governance

DOJ evaluates whether investigations are properly scoped, independent, objective and appropriately documented.

A strong process should define:

• Investigator independence
• Conflict checks
• Investigation scope
• Evidence collection
• Interview protocols
• Privilege considerations
• Status reporting
• Escalation
• Finding approval
• Corrective-action ownership
• Closure standards

6. Connect findings with remediation

Investigation reports often describe what happened but fail to establish accountability for correction.

Each substantiated issue should produce, where appropriate:

• Root-cause analysis
• Control-gap assessment
• Corrective-action plan
• Named owner
• Due date
• Evidence requirement
• Independent review
• Effectiveness testing
• Formal closure approval

7. Review third-party controls

DOJ’s compliance-program guidance emphasizes risk-based due diligence, the business rationale for third parties, appropriate contract terms, ongoing monitoring and action on identified red flags.

Organizations should review whether third-party processes cover the full relationship, not only onboarding.

8. Give the board visibility

The board should understand:

• Significant allegations
• Potential criminal exposure
• Disclosure decisions
• Investigation progress
• Root causes
• Disciplinary outcomes
• Remediation status
• Repeat issues
• Resource limitations
• Effectiveness-testing results

The board should not receive only a final incident summary after every material decision has already been made.

A Practical Misconduct-Response Workflow

When a serious allegation arises, companies can use the following governance sequence. Legal counsel should adapt the process to the specific facts.

First 24 hours

• Record the allegation and source
• Restrict access to sensitive case details
• Notify legal and compliance leadership
• Assess immediate threats to people, assets, customers or evidence
• Issue preservation instructions where appropriate
• Identify potentially implicated individuals
• Prevent retaliation
• Evaluate whether the activity is ongoing

Within 72 hours

• Conduct an initial credibility assessment
• Determine potential criminal, civil and regulatory exposure
• Identify relevant jurisdictions
• Map mandatory reporting obligations
• Confirm who has decision authority
• Establish an investigation team
• Document the known timeline
• Determine whether urgent corrective controls are required
• Evaluate external disclosure considerations

During the investigation

• Provide periodic factual updates
• Preserve and review relevant communications
• Identify all involved individuals
• Collect records from internal and external sources
• Assess third-party involvement
• Track potential conflicts with government investigations
• Review whether the conduct is isolated or systemic
• Maintain a record of disclosure decisions

During remediation

• Complete root-cause analysis
• Discipline responsible and supervisory personnel where appropriate
• redesign failed controls
• Update relevant policies
• Provide targeted training
• Strengthen oversight
• Test the corrected process
• Report progress to leadership
• Retain evidence proving completion

Early 2026 Enforcement Lessons

The DOJ began applying the department-wide policy almost immediately.

Balt SAS

In March 2026, DOJ announced its first resolution under the department-wide policy involving Balt SAS, a French medical-device company.

DOJ declined prosecution after considering Balt’s voluntary disclosure, cooperation, remediation and absence of aggravating circumstances warranting a different outcome. Balt agreed to disgorge approximately $1.2 million.

DOJ highlighted remediation that included:

• Disciplinary action
• Termination of relevant business relationships
• Targeted compliance training for senior management
• Improvements to the compliance program
• Enhancements to internal controls

The investigation also resulted in charges against individuals allegedly involved in the conduct.

The case reinforces three points:

1. Companies do not need to complete an internal investigation before reporting.
2. Individual accountability remains a central DOJ objective.
3. Remediation must address personnel, business relationships and control failures.

Bosch

In June 2026, the National Security Division announced its first declination under the department-wide policy.

The matter involved alleged unauthorized exports of products and software to a company on the U.S. Entity List.

DOJ said Bosch promptly disclosed, fully cooperated and timely remediated. Bosch agreed to disgorge approximately $11.43 million, with part of that amount credited against a parallel civil penalty imposed by the Department of Commerce.

The case demonstrates that the department-wide policy extends beyond traditional foreign-bribery matters. It can apply to national-security offenses, export-control matters and other corporate criminal conduct handled by DOJ.

It also illustrates the importance of coordination where multiple enforcement authorities investigate the same underlying activity.

DOJ Corporate Enforcement Policy Checklist

Detection and escalation

• Employees can report concerns confidentially.
• High-risk reports receive immediate triage.
• Potential criminal conduct is escalated to legal counsel.
• The organization records when it first became aware.
• Retaliation controls are activated where needed.

Disclosure assessment

• The company determines whether DOJ already knows of the conduct
• It identifies any existing obligation to report.
• It evaluates whether external discovery is imminent
• It identifies the appropriate DOJ component.
• It documents the timing and rationale for the disclosure decision.
• It considers the 120-day whistleblower exception where applicable.

Cooperation readiness

• Relevant documents are preserved.
• Personal and ephemeral communications are addressed.
• Records can be attributed to specific custodians and sources.
• Relevant individuals are identified.
• Overseas evidence and privacy restrictions are evaluated.
• The company can provide rolling factual updates.
• Third-party evidence can be obtained where possible.

Remediation

• Root-cause analysis has been completed.
• Control failures have been identified.
• Responsible individuals have been disciplined appropriately.
• Supervisory failures have been evaluated.
• Policies and procedures have been updated.
• Relevant employees have received targeted training.
• Business relationships contributing to the issue have been reviewed.
• Corrective actions have named owners and deadlines.
• Redesigned controls have been tested.
• Leadership and the board receive progress reports.

Program effectiveness

• Compliance has sufficient authority.
• Compliance has access to senior leadership and the board.
• The risk assessment covers emerging risks.
• Third parties are monitored after onboarding.
• Internal investigations are independent and documented.
• Hotline and investigation data are analyzed for patterns.
• Repeat findings are escalated.
• Compliance controls are tested periodically.
• Records are retained appropriately.

How VComply Supports Corporate Enforcement Readiness

VComply helps compliance teams manage the governance and operational processes that support detection, investigation, remediation and continuous program improvement.

Organizations can use VComply to:

• Maintain compliance obligations and internal controls
• Assign investigation and remediation owners
• Track complaints, incidents and allegations
• Document investigation workflows
• Escalate high-risk matters
• Perform root-cause analysis
• Manage corrective actions
• Collect supporting evidence
• Maintain policy approvals and revisions
• Track employee attestations
• Monitor third-party risks
• Present investigation and remediation status through dashboards
• Retain an auditable history of actions, decisions and approvals

VComply does not determine whether a company should make a voluntary self-disclosure and does not replace legal advice.

It helps compliance leaders demonstrate that concerns were received, reviewed, escalated, investigated and remediated through a controlled and accountable process.

Final Thoughts

The DOJ Corporate Enforcement Policy 2026 gives companies a clearer picture of how early disclosure, meaningful cooperation and effective remediation can influence a criminal enforcement outcome.

Its central message is not that companies must report every allegation to DOJ.

The message is that organizations seeking enforcement credit need systems capable of detecting serious misconduct, escalating it promptly, preserving evidence, supporting informed disclosure decisions and proving that corrective actions were completed.

A company cannot build that capability after receiving a subpoena.

It must already have:

• Trusted reporting channels
• Clear escalation rules
• Investigation procedures
• Evidence-preservation controls
• Qualified compliance personnel
• Board oversight
• Root-cause processes
• Corrective-action tracking
• Effectiveness testing
• Reliable records of decisions

The strongest compliance programs do more than document policies. They create a defensible record showing that the organization identifies problems, acts on them and learns from them.

That operating discipline is central to earning credibility under the DOJ’s 2026 Corporate Enforcement Policy.

Disclaimer: This article provides general information and does not constitute legal advice. Organizations evaluating potential criminal misconduct or voluntary self-disclosure should consult qualified legal counsel.

Ready to strengthen compliance management and compliance across your municipal utilities,  Book a personalized demo with VComply and take the first step toward smarter compliance management.

Frequently Asked Questions (FAQs)

What is the DOJ Corporate Enforcement Policy 2026?

It is a department-wide policy governing corporate voluntary self-disclosure, cooperation, remediation and criminal resolutions across DOJ, except for federal antitrust violations.

When did the policy take effect?

DOJ announced the policy on March 10, 2026.

Does the policy apply to every DOJ corporate criminal case?

It applies to corporate criminal matters handled by DOJ except violations of federal antitrust laws under 15 U.S.C. §§ 1–38.

What are the requirements for a declination?

The company must make a qualifying voluntary self-disclosure, fully cooperate, timely and appropriately remediate and lack aggravating circumstances that require a different resolution.

Is a declination automatic?

The policy states that DOJ will decline prosecution when the Part I factors are satisfied. Prosecutors still assess whether the facts meet those conditions, and the policy does not create enforceable rights.

Are declinations confidential?

No. The policy states that all CEP declinations will be made public.

Can a company still be required to pay money after a declination?

Yes. A company may have to pay disgorgement, forfeiture, restitution and victim compensation.

Must a company complete its investigation before reporting?

No. DOJ encourages companies to report at the earliest possible time, even where an internal investigation remains incomplete.

What does reasonably prompt disclosure mean?

The policy does not set one universal number of days. The company bears the burden of showing that it disclosed within a reasonably prompt time after becoming aware of the misconduct.

Does reporting to a regulator qualify?

A report made only to a regulator, state authority or civil enforcement agency generally does not qualify. It may still be considered when DOJ evaluates cooperation and remediation.

What is the 120-day rule?

When a whistleblower reports internally and also submits information to DOJ, the company may preserve eligibility by reporting as soon as reasonably practicable and no later than 120 days after receiving the internal report, while satisfying the policy’s other requirements.

What is a near-miss disclosure?

It is a good-faith self-report that does not fully satisfy the technical definition of voluntary self-disclosure. A company that fully cooperates and remediates may still qualify for Part II benefits.

What benefits are available under Part II?

Potential benefits include a non-prosecution agreement, a term of less than three years, no independent monitor and a 50 to 75 percent penalty reduction from the low end of the applicable Sentencing Guidelines range.

Does cooperation require waiver of privilege?

No. The policy states that eligibility is not conditioned on waiving attorney-client privilege or work-product protection.

What does remediation include?

Remediation can include root-cause analysis, control improvements, an effective compliance program, employee discipline, record-retention controls, targeted training and measures designed to prevent recurrence.

Why are messaging applications relevant?

Personal and ephemeral messaging tools can prevent organizations from retaining business records needed for investigations and legal obligations. DOJ specifically evaluates whether companies maintain appropriate policies and controls over these communications.

Does the policy apply to national-security violations?

Yes. DOJ has applied it to a National Security Division matter involving alleged export-control violations.