On October 4, Deputy Attorney General (DAG) Lisa Monaco announced the Department of Justice's (DOJ) new Safe Harbor Policy for voluntary self-disclosures made in connection with mergers and acquisitions (M&A). This policy is a significant development in the DOJ's ongoing efforts to encourage corporate transparency and cooperation, particularly in matters that could impact national security. Unlike the DOJ's past self-disclosure incentive policies, the new policy permits leniency for conduct that is discovered post-closing.

Corporate Enforcement Remains a Top DOJ Priority

In her speech to the Society of Corporate Compliance and Ethics, Monaco highlighted the rapid expansion of national security-related corporate crime. She emphasized that corporate crime now intersects with national security in areas such as terrorist financing, sanctions evasion, export controls circumvention, cyber-crime, and crypto-crime. To meet the growing challenges of this landscape, the DOJ is significantly increasing its resources. More than 25 new corporate crime prosecutors are being added to the National Security Division, including the division's first-ever chief counsel for corporate enforcement. Additionally, the number of prosecutors in the Criminal Division's Bank Integrity Unit will increase by 40%.

Monaco also noted that the DOJ is developing new tools and remedies to punish and deter corporate misconduct. These include divestiture of lines of businesses, specific performance as part of restitution and remediation, and dollar-for-dollar credits that will function as deductions from the company's total monetary penalties if bonus compensation is clawed back or withheld from employees involved in the misconduct.

The increase in prosecutor headcount and the introduction of new, nonmonetary-specific penalties may indicate a new wave of upcoming enforcement actions.

Key Takeaways From the New Safe Harbor Policy Announcement

The DOJ's new Safe Harbor Policy creates two important incentives for acquiring companies to promptly disclose and remediate any misconduct discovered during the M&A process. First, subject to the limitations described below, prompt self-disclosure creates a presumption that the DOJ will decline criminal prosecution of the acquiring and acquired companies. This presumption is created for the acquiring company regardless of whether aggravating factors are present, and for the acquired company, so long as no aggravating factors are present. Second, any misconduct disclosed under the Safe Harbor Policy will not influence future recidivist evaluations for the acquiring company. In other words, if the acquiring company voluntarily discloses any misconduct at the acquired company under this Safe Harbor Policy, it will not be deemed a "recidivist," or a repeat offender, in the context of future, unrelated enforcement actions. Therefore, if the acquiring company uncovers any misconduct in the future — regardless of whether it is within the acquiring company or the acquired company — it will not be labeled as a recidivist because of any disclosures made under the Safe Harbor Policy. This provision ensures that the acquiring company is not penalized for Safe Harbor Policy disclosures, retaining the potential for a declination of prosecution under the DOJ's Corporate Enforcement Policy for issues that may arise in the future.

Here are the essential steps companies must implement, along with some notable limitations:

• Immediate Disclosure Required in Specific Situations: Companies that detect misconduct "threatening national security" or involving "ongoing or imminent harm" must self-disclose immediately, without waiting for the six-month deadline.

• Remediation Required Within One Year: Companies must remediate the misconduct within one year from the date of closing, subject to the DOJ's assessment of the reasonableness of the remediation in light of the specific circumstances disclosed. However, DOJ prosecutors may extend this timeline depending on the specific facts, circumstances, and complexity of a particular transaction.

• Limitations: The Safe Harbor Policy only applies to criminal conduct discovered in bona fide, arms-length M&A transactions. It does not apply to misconduct that was otherwise required to be disclosed, misconduct that was already public, or to misconduct already known to the DOJ. Companies should also consider whether the misconduct needs to be disclosed to other federal agencies, such as the U.S. Securities and Exchange Commission (SEC), U.S. Department of Health and Human Services – Office of Inspector General (HHS-OIG), Federal Trade Commission (FTC), Bureau of Industry and Security (BIS), Directorate of Defense Trade Controls (DDTC), among others. Depending on the circumstances, companies should also consider whether there are state-specific reporting obligations.

Although the Safe Harbor Policy will be applied departmentwide, each unit within the DOJ will tailor and implement the policy to suit its specific enforcement regime. Companies are encouraged to review their current compliance programs and develop protocols for voluntary self-disclosures to prepare for any potential misconduct discovered during a deal.

This new policy may serve as a beneficial tool, providing acquirers with additional confidence to proceed with closing a transaction. It offers some assurance that the acquirer may receive the same leniency for criminal matters disclosed post-closing as they would have if they had disclosed and remediated the issue prior to closing. While this is not a substitute for due diligence, it offers some protection against behavior discovered post-closing that was not or could not be identified pre-closing. In addition, the introduction of a six-month timeframe under this policy underscores the importance of prompt onboarding and immediate post-closing investigations. Given that due diligence may not uncover all misconduct, it is crucial that the acquired company's operations are inspected right after closing. Additionally, the DOJ's exception to the six-month rule, requiring immediate disclosure for "ongoing or imminent harm" and "national security" threats, further highlights the need for prompt action. Timely self-disclosures and remediation in compliance with this new policy could ultimately be the deciding factor between facing one of the DOJ's new punitive measures, such as an involuntary divestiture, and receiving a declination of criminal prosecution.