DOJ’s National Security Division updates voluntary self-disclosure policy

The Justice Department has made it clear in recent years that corporate violations of sanctions and export control laws are an enforcement priority. The Treasury Department’s Office of Foreign Assets Control (OFAC) and the Department of Commerce’s Bureau of Industry and Security (BIS) have similarly taken an aggressive enforcement posture – imposing record-setting penalties and releasing a slew of guidance on compliance expectations for the private sector.[1] As discussed in our recent client update, the DOJ and regulators have also increasingly encouraged companies to voluntarily self-disclose violations of sanctions and export control laws through public statements, guidance, and policy changes.[2] Consistent with this trend, on March 7, 2024, the DOJ’s National Security Division (NSD) updated its policy on voluntary self-disclosures of violations of sanctions, export control, and other national security laws enforced by the NSD (the VSD Policy). [3] The updates, among other things, codify a safe harbor policy for violations disclosed during mergers and acquisitions, which the DOJ previously announced in October 2023 and was also the subject of a client update, and provide an additional benefit to voluntary self-disclosures by stating that a compliance monitor generally will not be imposed in self-disclosed cases.

On March 6, the DOJ, BIS, and OFAC provided a further reminder of their sharpened focus on enforcement through a new tri-seal compliance note (the Compliance Note), which highlighted the sanctions and export control compliance obligations of non-U.S. businesses as well as “the enforcement mechanisms that are available for the U.S. government to hold non-U.S. persons accountable.[4] Although the Compliance Note and the updates to the VSD Policy are broadly consistent with existing policies, they provide a valuable window into the enforcement priorities and decision-making of the respective agencies. The VSD Policy, in particular, provides a clear outline of the NSD’s expectations when violations are identified in the M&A process.

Key changes to the VSD Policy

Incorporation of the M&A Policy

In October 2023, Deputy Attorney General Lisa O. Monaco announced a new safe harbor policy for voluntary disclosure of criminal misconduct identified during M&A transactions (the M&A Policy) to be incorporated into the voluntary self-disclosure policies of DOJ divisions.[5] On March 7, the NSD updated its VSD Policy to incorporate the M&A Policy and clarify how it applies to violations of sanctions, export control, and other laws enforced by the NSD.

Under the M&A Policy, when an acquiring company voluntarily self-discloses potential criminal violations of export control, sanctions, or other laws affecting U.S. national security by the target company to the NSD, the “NSD generally will not seek a guilty plea from the acquiror, and there is a presumption that NSD will decline to prosecute the acquiror.” In addition, the acquiror will not be required to pay a criminal fine or forfeit assets, and the misconduct disclosed to the NSD will not affect the NSD’s assessment of the acquiror’s history of recidivism in future matters.[6] The M&A Policy does not, however, extend these protections to the acquired company.

The protections of the M&A Policy will only apply if the acquiror:

• Completes a lawful, bona fide acquisition of another company. To determine if this requirement is met, the NSD will consider (among other things) whether the transaction was negotiated at arms-length and the business justification for the transaction.
• Voluntarily and timely self-discloses to NSD potentially criminal violations of laws affecting U.S. national security committed by the acquired entity. Generally, a VSD will be considered timely if the acquiror makes the disclosure within 180 days after the date the transaction is completed.
• Fully cooperates with NSD’s investigation. For example, all non-privileged facts relevant to the wrongdoing must be disclosed, and companies are expected to timely and voluntarily preserve, collect, and disclose relevant documents.
• Timely and appropriately remediates the misconduct. Remediation will generally be considered timely if it is completed within one year after the date the transaction is completed.

The NSD may, in its discretion, determine that failure to comply with the deadlines above is reasonable under the circumstances and treat the relevant disclosure or remediation as timely, but if the underlying conduct presents either “a current and ongoing threat to the national security of the United States” or “a current and ongoing threat of harm to persons or property wherever located,” self-disclosure and remediation will only be considered timely “if made immediately, i.e., at the earliest reasonable opportunity.”

Presumption against imposition of a monitor

Corporate criminal proceedings often result in the imposition of an external compliance monitor by the DOJ as part of any settlement.  Monitorships often last for years and can be an expensive and disruptive consequence of criminal violations.  In the revised VSD Policy, however, NSD has stated a presumption that monitorships will generally not be imposed as part of the resolution of a voluntary self-disclosure complying with the VSD Policy, “if a company has, at the time of resolution, demonstrated that it has implemented and tested an effective and well-designed compliance program and has taken appropriate steps to remediate the root cause of the misconduct.”

Scope of the VSD Policy

The VSD Policy only applies to criminal enforcement matters relating to export controls and sanctions laws handled by the NSD; while it does not directly apply to other criminal laws enforced by the NSD, the revised VSD Policy makes clear that they will generally be treated comparably.  More importantly, though, the VSD Policy is not applicable to civil violations of sanctions or export control laws enforced by OFAC or BIS (and, conversely, a voluntary self-disclosure to those agencies is not treated as a voluntary self-disclosure to the NSD). However, OFAC and BIS have longstanding policies intended to encourage voluntary self-disclosure. Among other things, OFAC’s Economic Sanctions Enforcement Guidelines and BIS Settlement Guidelines provide for a reduction in penalty of 50% for parties that voluntarily self-disclose a violation.[7] Notably, the BIS announced in April 2023 that a party’s decision not to file a voluntary self-disclosure would be treated as an aggravating factor in subsequent enforcement actions (arguably stretching the meaning of voluntary).[8]

The Compliance Note

The Compliance Note – titled “Obligations of Foreign-Based Persons to Comply with U.S. Sanctions and Export Control Laws” – is one of a series of tri-seal compliance notices released jointly by OFAC, BIS, and the DOJ over the past year. The purpose of the Compliance Note appears to be to emphasize and underscore the U.S. authorities’ increasing focus on sanctions compliance by non-U.S. actors, extending beyond foreign financial institutions – a trend reflected in recent enforcement actions, designations, and compliance guidance.[9] Consistent with prior notes, the Compliance Note urges companies to voluntarily disclose violations of sanctions and export control laws[10] and combines a high-level overview of regulatory compliance obligations with overt warnings to those who fail to comply. Although the Compliance Note does not break new ground in this regard, it remains notable for its underlying message – that is, the DOJ, BIS, and OFAC will actively target non-U.S. persons and companies that violate U.S. sanctions and export control laws. We expect the DOJ and regulators will continue to repeat this message – both through public statements and enforcement actions – in the immediate future.