On December 13, 2019, the U.S. Department of Justice (“DOJ”) issued a new policy for companies that voluntarily disclose potential criminal violations of U.S. sanctions and export control laws to the DOJ’s National Security Division (“NSD”).

The new policy, entitled “Export Control and Sanctions Enforcement Policy for Business Organizations” (“Policy”), increases the incentives for companies to submit voluntary disclosures regarding potential criminal violations of U.S. sanctions and export control laws.¹ In particular, the Policy states that for companies that voluntarily disclose potential violations, fully cooperate with the DOJ’s investigation and timely and appropriately adopt remedial measures, the DOJ will adopt a presumption that the disclosing company will receive a non-prosecution agreement (“NPA”) and avoid criminal fines, absent aggravating factors. In remarks announcing the Policy, Principal Assistant Attorney General David Burns stated that the Policy is intended to “provide more clarity concerning the benefits of reporting and the consequences of not reporting when . . . weighing whether to make a self-disclosure and to whom.”

Although the new Policy is meant to create more certainty for companies making disclosures to DOJ, it contains stringent, comprehensive requirements that need to be carefully considered and addressed as part of a disclosure. It will take time and implementation experience for companies to fully assess the benefits of this new Policy.

Overview of New Policy

The new Policy states that the DOJ will adopt a presumption that, absent aggravating factors, a company will receive an NPA and not pay criminal fines when the company:

1. Voluntarily self-discloses potential criminal violations of sanctions or export control laws or regulations to the DOJ;
2. Fully cooperates with the DOJ; and
3. Timely and appropriately remediates the misconduct at issue.

The Policy includes several definitions regarding the actions a company must take to fulfill each of the three prongs set forth above and receive the full benefits of the Policy. For a self-disclosure to be considered “voluntary”, the Policy states that the conduct must be disclosed:

• Prior to an imminent threat of disclosure or government investigation;
• Within a reasonably prompt time after the company becomes aware of the offense; and
• With all relevant facts known to it at the time of the disclosure (including identification of individuals substantially involved in, or otherwise responsible for, the misconduct).

To receive credit for “full cooperation” with the DOJ, a company must:

• Disclose all relevant facts on a timely basis, including attribution to specific sources where possible and identification of company personnel and third party personnel that might have engaged in the misconduct;
• Engage in “proactive cooperation” by providing timely updates regarding facts relevant to the investigation, even if not specifically asked to do so by the DOJ;
• Preserve, collect and disclose all relevant documents (including disclosures of overseas documents and translated materials as appropriate);
• Make personnel available for potential interviews by DOJ; and
• De-conflict witness interviews and other internal investigation steps with actions the DOJ intends to take as part of its investigation.

Finally, companies must demonstrate “timely and appropriate remediation” of misconduct by:

• Conducting a thorough analysis of the root causes of the misconduct and implementing appropriate measures to address such causes;
• Implementing an effective compliance program, which might include elements such as clear statements regarding the company’s commitment to compliance, adequate compliance resources, risk assessments, auditing of the compliance program and appropriate reporting mechanisms regarding potential violations;
• Appropriately disciplining employees responsible for the misconduct;
• Retaining business records and preventing the improper destruction of such records; and
• Implementing any additional measures “that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risks.”

Potential “aggravating factors” that could make a company ineligible for an NPA and the avoidance of criminal fines under the Policy include (i) exports of items that are particularly sensitive or to end users of heightened concern, (ii) repeated violations, (iii) involvement of senior management, and (iv) significant profit gained from the misconduct. Even if the DOJ determines that aggravating factors warrant a resolution other than an NPA—such as a deferred prosecution agreement or a plea of guilty—companies can still be eligible for a significant reduction in fines (capped at an amount equal to the gross gain or loss) and avoid a requirement to appoint a compliance monitor. Companies, however, must have voluntarily self-disclosed the violations, cooperated with the DOJ, implemented remedial measures and have an effective compliance program.

Other Key Points

In addition to more clearly identifying the standards that will be considered by the DOJ in assessing whether a company might receive an NPA and avoid criminal penalties, the Policy also contains a number of other important clarifications:

• Voluntary Self-Disclosure to Other Agencies: The Policy states that if a company chooses to self-report only to the regulatory agency with primary responsibility for administering the relevant sanctions or export control laws or regulations at issue (such as the Treasury Department’s Office of Foreign Assets Control or the Commerce Department’s Bureau of Industry and Security) and not to the DOJ, the company will not be eligible for the benefits set forth under the Policy. Companies still should consider making self-disclosures to such other agencies to receive potential benefits related to those agencies’ own enforcement actions. But if the conduct at issue involves potential criminal violations and there is a chance that other agencies might refer the matter to DOJ for a criminal investigation, then a disclosure must be submitted to the DOJ (in addition to agencies with civil enforcement powers) in order to receive the Policy’s benefits related to DOJ jurisdiction.
• Application to Financial Institutions: The Policy applies to financial institutions that voluntary self-disclose potential criminal violations to the DOJ. The 2016 guidance expressly did not apply to financial institutions, and such institutions therefore were not able to receive the full scope of benefits related to self-disclosure of sanctions or export control violations to the DOJ.
• Successor Liability: The Policy makes clear that in mergers and acquisitions, companies that uncover a criminal export control or sanctions violation by a merged or acquired entity through timely due diligence, post-acquisition audits, or compliance integration efforts and voluntarily self-disclose the misconduct to DOJ also will benefit from a presumption in favor of an NPA. This further underscores the importance of both conducting pre-transaction due diligence to identify potential sanctions or export violations and continuing to be vigilant for potential issues even after closing.
• Comparison to FCPA Policy: The Policy is similar in scope, structure and intent to the DOJ’s Foreign Corrupt Practices Act Enforcement Policy (“FCPA Policy”) that offers companies benefits from voluntarily self-disclosure of potential FCPA violations to the DOJ. One notable difference, however, is that the primary benefit of the FCPA Policy is a presumption that a company will receive a formal declination (meaning that the DOJ has decided not to bring any charges). Under the sanctions and export control Policy, the primary benefit is a presumption of receiving an NPA without criminal fines, meaning that a company still would be required to enter into an agreement with the DOJ under which the DOJ agrees not to pursue formal charges in exchange for certain conditions on future behavior by the company.

Conclusion

The Policy provides additional clarity (and certainty) for companies grappling with whether to self-report to the DOJ potential violations of sanctions and export control laws. Specifically, the Policy identifies the potential benefits that a company can receive by submitting a disclosure to DOJ and the factors DOJ will consider when assessing the adequacy of the disclosure, including cooperation in any subsequent investigation and appropriate remediation of the misconduct. The decision about whether to disclose still requires consideration of a number of factors, including (i) whether all of the DOJ criteria can be satisfied, (ii) at what point during an internal investigation a self-disclosure should be made, and (iii) what agencies, if any, should receive self-disclosures. Our assessment is that the issuance of the Policy will not on its own lead companies that are making disclosures to administrative agencies to also make companion disclosure to DOJ. If the DOJ provides more transparency regarding the Policy’s implementation, including publicizing some examples of how the Policy is working, this may help foster an environment in which companies increasingly will seek to utilize DOJ’s disclosure process.

Footnotes