DOJ's New Corporate Enforcement Policy Explained

Overview

When US companies discovered misconduct internally, the benefits of self-reporting depended heavily on which DOJ component or US Attorney’s Office ended up handling the case. Each ran its own enforcement policy, with its own rules and rewards. At least, this was the case until March of this year.

On March 10, 2026, the US Department of Justice released its Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP). This framework is the first to bring all of the varying rules across offices under one policy.

The goal, as the CEP states, is to get ahead of corporate wrongdoing by rewarding companies that “voluntarily disclose discovered misconduct, cooperate with [government] investigations, and timely and appropriately remediate the wrongdoing.”

That means self-reporting companies can unlock significantly better outcomes, from full declination to non-prosecution agreements, depending on how quickly and thoroughly they come forward. The calculation matters most to the people who have to quickly make the call about whether to self-report the moment misconduct surfaces. This could be a general counsel, head of compliance, or outside counsel. To help guide them, the CEP now spells out the benefits of coming forward against what’s risked by staying quiet.

The CEP replaces all the enforcement policies that varied across DOJ components or the US Attorney’s Office, with one exception: the Antitrust Division keeps its own leniency program. Importantly, it supersedes the Southern District of New York’s Financial Crimes program, a notably more generous framework SDNY had rolled out just two weeks earlier. Companies that were counting on SDNY’s faster, fine-free path to a declination now need to reassess their options under the department-wide rules.

What counts as voluntary self-disclosure

To qualify for the CEP’s benefits, a company has to clear five bars. The disclosure must be made in good faith, cover conduct the Department doesn’t already know about, and involve no pre-existing legal duty to report. It also must arrive before any investigation or disclosure is imminent, and happen within a “reasonably prompt” window, with the company itself carrying the burden of proving it acted fast enough.

There’s also a built-in safety valve for whistleblower situations: if an employee files an internal report and a whistleblower complaint with the DOJ around the same time, the company can still qualify for a declination as long as it self-reports within 120 days of learning about the internal complaint.

From there, the company has to fully cooperate with the investigation. It must disclose facts promptly and attribute them to specific sources rather than a general narrative. The company has to identify everyone involved regardless of seniority, make relevant employees available for interviews, and then remediate appropriately. Remediation covers everything from a root-cause analysis and employee discipline to building out an effective compliance program, including new controls over personal devices and ephemeral messaging apps (a mobile or desktop communication tool that automatically deletes texts, photos, or videos after a short time or once a user reads them).

A three-tier system

The CEP sorts outcomes into three tiers:

Tier 1: Declination. Companies that voluntarily self-disclose, fully cooperate, timely remediate, and pay all restitution and forfeiture will have charges declined, provided there are no “aggravating circumstances.” That means egregious or pervasive misconduct, severe harm, or recidivism (a resolution within the last five years, or any prior resolution involving similar conduct). Declinations are made public. Even where aggravating circumstances exist, prosecutors can still recommend a declination if a company’s cooperation and remediation are strong enough to outweigh them.

Tier 2: “Near miss” cases. Some companies fully cooperate and remediate but fall short on a technicality, either their good-faith self-report doesn’t quite meet the voluntary disclosure bar, or they have aggravating factors that aren’t severe enough to rule out leniency entirely. These “near miss” cases still get benefits: a non-prosecution agreement under three years, no independent compliance monitor, and a fine cut of 50–75% off the low end of the Sentencing Guidelines range. That’s a change from the Criminal Division’s prior policy, which offered a flat 75% cut. This new range gives prosecutors more flexibility but takes away the certainty of a fixed number.

Tier 3: Everyone else. Companies that don’t self-disclose, or that otherwise fail to meet the Tier 1 or 2 bar, fall back on ordinary prosecutorial discretion: a guilty plea, deferred prosecution agreement, or NPA, with fine reductions capped at 50% off the low end of the guidelines range.

Implications for compliance

The CEP raises the stakes for having compliance infrastructure ready before misconduct surfaces:

The 120-day whistleblower clock creates time pressure: Companies need triage and escalation protocols that can move fast enough to investigate an internal complaint and decide whether to self-report, all within four months.
Cooperation credit rewards preparation: Because full cooperation means attributing facts to specific sources and identifying individuals “regardless of seniority,” companies with mature investigation capabilities and document-preservation systems are far better positioned to earn credit than those building a process from scratch mid-investigation.
Ephemeral messaging policies must be airtight: The CEP folds personal-device and messaging-app controls into the baseline remediation requirement, building on DOJ’s 2024 update to its compliance program evaluation criteria. Companies should be able to demonstrate and defend their enforcement of these policies.

The common thread across all three tiers is readiness. The CEP rewards companies that already know their own risk exposure across their people, their counterparties, and their history. That puts a premium on the due diligence and investigative infrastructure companies build before misconduct ever surfaces, so they can move at speed when something goes wrong.