By Eddie Suarez and Sara Mieczkowski / www.suarezlawfirm.com
On March 10, 2026, the Department of Justice did something it had never done before: it issued a single, uniform enforcement policy for corporate criminal cases across every component and U.S. Attorney’s Office in the country. The new Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”) changes the calculus for companies facing potential federal criminal exposure. If your company discovers misconduct today, the rules governing what to do next have fundamentally shifted.
Here is what you need to know.
One Policy Now Governs Everything — Almost
Before March 10, corporate self-disclosure was a patchwork. The DOJ Criminal Division had its own policy, revised in May 2025. Individual U.S. Attorney’s Offices maintained separate programs with different criteria, different benefits, and different expectations. A company deciding whether to self-disclose had to evaluate not just what happened, but who would end up handling the case and what that office’s local policy said.
That patchwork is gone. The new CEP applies to all corporate criminal matters handled by the Department, superseding every component-specific and district-specific program currently in effect. The only carve-out is antitrust, which remains governed by the Antitrust Division’s separate leniency program. For virtually every other federal criminal offense — fraud, healthcare fraud, bribery, money laundering, cybercrime, government contracting violations — there is now one set of rules.
The Core Deal: Disclose, Cooperate, Remediate = Declination
The CEP’s central promise is straightforward. A company that voluntarily self-discloses misconduct, fully cooperates with the Department’s investigation, and promptly and appropriately remediates will receive a declination of prosecution. The policy commits that DOJ will decline prosecution when the criteria are met — a firm commitment, not a mere presumption. That formulation carries forward the Criminal Division’s May 2025 policy, which had already made this shift at the division level, and now extends it to every U.S. Attorney’s Office across the country. For most companies, and particularly those whose cases might otherwise land in a U.S. Attorney’s Office that previously offered no formal declination commitment at all, that department-wide extension is the key practical advancement. There remains, however, some wiggle room.
The new CEP requires declination provided no significant aggravating factors exist. Aggravating factors include particularly egregious conduct, misconduct that was pervasive within the company, substantial harm to victims, or corporate recidivism, which the new CEP defines more broadly than its predecessor. A company is considered a recidivist if it has any criminal adjudication or DOJ resolution within the last five years, regardless of whether the prior conduct was similar, or if it has any criminal adjudication or DOJ resolution based on similar misconduct at any time, with no time limit. That second prong is new. Under the May 2025 Criminal Division policy, only prior similar-conduct resolutions within the five-year window counted. Companies with older resolutions involving analogous conduct, even those resolved more than a decade ago, now face recidivism exposure under the new CEP.
Declination carries no criminal fine. The company must still pay disgorgement, forfeiture, restitution, and victim compensation. And DOJ will publicly disclose the declination. But no prosecution, no guilty plea, no deferred prosecution agreement hanging over the company for years.
The “Near Miss” Path: Still Valuable, Now More Predictable
Not every disclosure is clean. Companies that tried in good faith to disclose but fell short because DOJ him had already caught wind of the misconduct, because disclosure was too slow, or because aggravating factors prevent a full declination, now fall under what the CEP calls a “near miss” framework.
For those companies, the policy directs prosecutors to resolve the matter through a non-prosecution agreement with a term of less than three years, waive a corporate compliance monitor, and reduce the criminal fine. Under the new CEP, that reduction is discretionary within a range of at least 50% but no more than 75% off the low end of the Sentencing Guidelines range. The prior Criminal Division policy provided a flat 75% reduction. The new framework preserves the possibility of a 75% reduction but no longer guarantees it — prosecutors now weigh the quality of the company’s cooperation and remediation in determining where within that range the reduction lands. Companies in the “near miss” category will compete less on the bare fact of disclosure and more on what they actually did after discovering the problem.
Forum Shopping Is Largely Over — But Not Entirely
One of the most important practical shifts is the elimination of meaningful venue-shopping at the disclosure stage. Under the old patchwork system, a company advising on whether to self-disclose had to weigh not just the substance of the conduct but where the case was likely to land. Would it end up in the Criminal Division, with its clear declination path? Or in the SDNY, which operated under its own more demanding program?
Those distinctions are substantially reduced under the new CEP. A company can now focus primarily on the merits of disclosure without worrying that the wrong office will apply a categorically different standard. As DOJ has stated, the goal is to ensure that companies can rely on consistent outcomes regardless of which component handles their case. That goal is largely achieved — but not unconditionally. The CEP expressly reaffirms prosecutorial discretion, meaning that practical differences in how individual offices apply the policy may persist even within the uniform framework.
The SDNY situation illustrates why this caveat matters. The SDNY issued its own corporate enforcement program just two weeks before DOJ announced the CEP. The new policy supersedes that program, but the CEP’s express preservation of prosecutorial discretion means that SDNY — and other offices — retain meaningful latitude in how they implement the uniform framework in practice. The rules at the disclosure stage are now the same everywhere; how individual prosecutors exercise judgment within those rules may not be. Defense counsel should watch this space closely.
The Definition Of “Voluntary” — Clarified and Expanded, Not Reinvented
The new CEP received less attention than the Department-wide rollout for one of its more practically significant features: what it does and does not change about voluntary self-disclosure for companies in heavily regulated industries.
The standard itself is not new. Under both the May 2025 Criminal Division policy and the 2026 Department-wide CEP, a disclosure qualifies as voluntary as long as the company had no pre-existing obligation to disclose to the Department of Justice specifically. A regulatory reporting obligation to the SEC, HHS, or a contracting officer does not, standing alone, disqualify a company from voluntary credit under DOJ’s policy.
What the 2026 CEP adds is a meaningful — but carefully limited — flexibility for companies that disclose to a federal regulatory agency rather than directly to DOJ. Under the prior patchwork of USAO-specific policies, disclosures made only to a regulatory agency generally received no voluntary credit and no clear path to discretionary treatment. The new CEP changes that calculus. A good-faith disclosure made to a federal regulatory agency does not automatically qualify as voluntary, but DOJ now expressly retains discretion to treat it favorably depending on the circumstances. At minimum, any regulatory disclosure will be considered as part of the company’s cooperation and remediation — a floor that did not exist uniformly across all components before March 10.
For healthcare companies, financial institutions, and government contractors that operate under mandatory sector-specific reporting frameworks, this flexibility is real but not a guarantee. The better practice remains direct and prompt disclosure to the appropriate DOJ component whenever legally permissible. But for companies whose regulatory obligations required them to report to an agency before they could get to DOJ, the new CEP offers a clearer but still discretionary path to credit for having done so.
Individual Accountability Remains the Cornerstone
Nothing in the new CEP should be read as softening the Department’s focus on individual wrongdoers. The CEP reaffirms that corporate self-disclosure, cooperation, and remediation are evaluated in significant part by whether the company has identified and turned over evidence against culpable individuals — executives, officers, employees. That focus is not new, but it is sharpened.
The Department has also made clear that prosecuting individuals alone can sometimes be enough to address low-level corporate misconduct. The implication: not every corporate investigation will result in a corporate charge or resolution if the real culprits are the individuals involved. How aggressively the company has cooperated on individual accountability will shape that outcome.
This is where corporate executives need independent counsel and need it early. As lawyers who regularly represent individuals caught in corporate investigations, we have seen this dynamic play out too many times. Corporate counsel, focused on securing the best outcome for the company, will sometimes offer up employees to satisfy the government’s demand for individual accountability. The employees handed over are not always the architects of the misconduct. They are often mid-level managers and employees who followed instructions from supervisors, sometimes without fully understanding the significance of what they were doing or the legal exposure it created. They trusted the company. They assumed the company’s lawyers were looking out for them. They were wrong.
The new CEP accelerates this risk. Because a company’s path to declination now runs directly through its willingness to identify and deliver culpable individuals, the institutional pressure to name names is greater than ever. Corporate executives and employees who are asked to sit for an interview by company counsel, or who simply sense that something has gone wrong, should not assume that the company’s interests and their own interests are aligned. Often, they are not.
If you are an executive or employee whose company is under federal investigation, you need your own lawyer — one whose only obligation is to you.
What To Do Now
The new CEP creates both an opportunity and a ticking clock. The policy’s benefits flow to companies that get ahead of a problem before DOJ learns of it through a whistleblower, a competitor’s disclosure, or its own investigation. Once DOJ becomes aware, the window for voluntary disclosure closes.
Every company with significant government exposure should take three immediate steps. First, audit existing compliance programs to ensure they are designed to detect and surface misconduct promptly. Second, review internal reporting channels to confirm that misconduct, when identified, actually reaches legal counsel quickly. Third, establish clear protocols for how the company will evaluate and decide whether to self-disclose, so that decision does not get made in a panic.
The DOJ has told companies clearly what it wants: prompt disclosure, full cooperation, and meaningful remediation. Companies that deliver on all three are likely to find a federal enforcement system that, at least in theory, is likely to treat them consistently no matter where their case lands. Those that wait and hope the government never finds out, now face a more unified and more predictable enforcement machine at every U.S. Attorney’s Offices.
#DOJ #CorporateEnforcement #VoluntarySelfDisclosure #WhiteCollarDefense #CEP #FederalCriminalLaw #CorporateCriminal #ComplianceProgram #InternalInvestigation #FederalEnforcement #CorporateCompliance #WhiteCollarCrime #CriminalDefense #USAttorney #FederalInvestigation #CorporateLaw #BusinessLaw #LegalAlert #ComplianceAlert #FalseClaims #HealthcareFraud #AntiCorruption #SDNY #DOJPolicy #SelfDisclosure #IndividualAccountability #CorporateCounsel #ExecutiveExposure #FederalProsecution #SuarezLawFirm
