The National Security Division (NSD) of the Department of Justice announced a new self-disclosure policy on March 7, 2024 (M&A Policy) that impacts corporations, private equity firms, and venture capital firms and their merger and acquisition activities.

The new M&A Policy supplements the NSD’s existing self-disclosure policies and provides a framework for companies that acquire other entities and subsequently discover potential criminal violations related to export control, sanctions, or other laws affecting U.S. national security. Such criminal violations affecting national security often arise in the commodities, technologies, and financial services sectors. The M&A Policy outlines the conditions under which voluntary self-disclosures can be made to the NSD and the benefits of doing so, including the possibility of declination of prosecution and exemption from criminal fines or forfeiture of assets. It is crucial for companies to understand and adhere to the policy to mitigate legal risks and ensure compliance.

Under the M&A Policy, an acquiring company can qualify for the additional protections when it meets all of the following criteria:

(a) Completes a lawful and bona fide acquisition. The NSD has discretion in determining the lawfulness and bona fide nature of an acquisition, considering factors such as arm’s-length negotiation, business justification, change in control and the discovery of misconduct.

(b) Voluntarily and promptly discloses potential criminal violations affecting U.S. national security by the acquired company to the NSD. Voluntarily means that the Company is not under an existing legal obligation to report the misconduct to another agency and it is not facing an imminent threat of disclosure or investigation by the government. Self-disclosure is considered timely if made within 180 days post-acquisition. Exceptions apply for immediate threats to national security or harm to persons or property and the NSD may extend these periods in its discretion for complex transactions.

(c) Fully cooperates with the NSD’s investigation. Full cooperation requires transparency, responsiveness, proactive engagement, voluntary preservation of evidence, de-confliction of witness interviews, disclosure of all non-privileged facts, and making company officers and employees available for interview (subject to their Fifth Amendment rights).

(d) Timely and appropriately remediates the misconduct. Remediation is timely if completed within one year. Exceptions apply for immediate threats to national security or harm to persons or property, and the NSD may extend these periods under certain circumstances.

If a self-disclosing acquirer meets the M&A Policy’s criteria, then the NSD will generally not seek a guilty plea and there is a presumption against prosecution. As a result, the acquiring company will be presumed to qualify for a declination of prosecution as opposed to a non-prosecution agreement—a significant benefit. The company will also be exempt from criminal fines or asset forfeiture; however, other regulatory bodies, such as the Office of Foreign Assets Control and the Bureau of Industry and Security, may impose civil fines but will apply their respective, comprehensive self-disclosure incentives programs. The disclosed misconduct will also not influence the NSD’s assessment of the company’s recidivism in future matters. As another benefit, the NSD will not take into account the presence of aggravating factors at the acquiring company, such as a history of recidivism, nor will it consider the presence of aggravating factors at the acquired entity as long as aggravating factors do not continue to affect either the acquiror or the acquired entity following a qualifying disclosure.

The M&A Policy’s protections primarily benefit the acquiror. However, if the acquired entity remains a distinct legal entity, its voluntary self-disclosure may be credited and it may also receive benefits if it meets the other M&A Policy criteria. Likewise, the M&A Policy also empowers the NSD, in its discretion, to afford the additional protection to entities involved in different kinds of transaction structures.

For companies and firms engaged in merger and acquisition activities of targets that are in the business of exporting commodities or technologies, the new M&A Policy marks an important time to re-evaluate their existing diligence and compliance functions. Given the additional benefits of the M&A Policy, acquirors operating in these sectors should:

(i) Develop a compliance plan. Consider creating a detailed compliance plan that aligns with the M&A Policy and that engages in sufficient compliance review within the 180-timeliness threshold. Specifically, companies should conduct thorough due diligence both before and after the acquisition to identify any potential criminal violations. Following the acquisition, the acquirer should integrate the acquired entity’s compliance program with its existing program, ensuring that the new, combined entity operates with a robust compliance mechanism. This should be a structured process with a clear timeline and should involve legal, financial and compliance experts.

(ii) Train and communicate. Train relevant employees on the requirements of the M&A Policy and any new or revised compliance program and communicate the policy and procedures throughout the firm. Often, potential violations are first observed by front-office employees, not compliance or legal personnel. Ensuring that all employees are aware of red flags for national security issues is essential for early detection and compliance.

(iii) Engage with legal counsel. Work closely with legal counsel as early as possible once a potential violation is identified to navigate the complexities of the M&A Policy and to ensure that all actions taken are in compliance with the policy’s requirements.