In December 2019, the Department of Justice (“DOJ”) announced a new Export Control and Sanctions Enforcement Policy for Business Organizations (the “Policy”) regarding voluntary self-disclosures of potentially criminal violations of export control and sanctions laws.¹ The Policy, which was issued by DOJ’s National Security Division (“NSD”), applies only to export control and sanctions enforcement matters brought by NSD’s Counterintelligence and Export Control Section. It replaces DOJ’s prior policy governing self-disclosures of such matters, which was issued in October 2016. The new Policy is intended to incentivize businesses to self-disclose willful violations and clarifies the requirements for voluntary self-disclosure. The new Policy also reflects an effort to align this Policy more closely with other DOJ voluntary disclosure policies.²

The key regulatory agencies responsible for enforcement of U.S. export controls and sanctions—the Department of State’s Directorate of Defense Trade Controls (“DDTC”), which administers the International Traffic in Arms Regulations; the Department of Commerce’s Bureau of Industry and Security (“BIS”), which administers the Export Administration Regulations; and the Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), which administers U.S. economic sanctions—maintain policies that strongly encourage voluntary disclosures of potential civil violations.³ Where there is potential criminal liability, companies should consider making a disclosure to DOJ in addition to the relevant regulatory agency.

Potential Benefits of Voluntary Disclosure to DOJ

Presumption of Non-Prosecution Agreement. Under the Policy, there is a presumption of a non-prosecution agreement and no fine when, absent aggravating factors, a company (1) voluntarily self-discloses export control or sanctions violations to DOJ, (2) fully cooperates with DOJ, and (3) timely and appropriately remediates the relevant conduct. If aggravating factors are present that warrant a different resolution, such as a deferred prosecution agreement or a guilty plea, in voluntary disclosure cases DOJ will recommend a fine that is at least 50% less than the amount otherwise statutorily available, and will not require a monitor if the company has implemented an effective compliance program. Aggravating factors include, among other things:

• “exports of items that are particularly sensitive,” such as items known to be used in the construction of weapons of mass destruction or items controlled for nuclear nonproliferation or missile technology reasons;
• exports “to end users that are of heightened concern,” such as exports of military items to hostile foreign powers or exports to terrorist organizations;
• repeated violations, including similar administrative or criminal violations;
• knowing involvement of senior management; and
• significant profit.

Whether or not aggravating factors are present, a self-reporting company must pay all disgorgement, forfeiture, and restitution resulting from the disclosed misconduct.

While the new Policy purportedly is intended to “resemble existing and analogous guidance from other DOJ components,” the Policy does not align with the FCPA Corporate Enforcement Policy, which provides for a presumption of a “declination” absent aggravating circumstances, rather than a non-prosecution agreement, if the requirements to voluntarily self-disclose, fully cooperate, and timely and appropriately remediate are met. In contrast, the presumption under the new Policy is a non-prosecution agreement without a fine. Declinations are preferable to non-prosecution agreements because non-prosecution agreements can include remedial obligations and other requirements. However, DOJ has stated that a declination generally would not be appropriate for export control and sanctions violations due to the likely harm to U.S. national security interests.

Includes Financial Institutions. DOJ now offers financial institutions the same incentives to voluntarily self-disclose as other companies. Under the prior enforcement policy, financial institutions were carved out due to their unique reporting obligations under other regimes leading to investigations by other DOJ offices.

Requirements of the New Self-Disclosure Policy

Voluntary Self-Disclosure. To be considered “voluntary,” a company must disclose all potentially willful violations of sanctions and export control laws to DOJ before “an imminent threat of disclosure or government investigation.” A company has the burden of showing that its disclosure was made within a “reasonably prompt time” after the company becomes aware of the violation. Under the Policy, a company that discovers misconduct through due diligence or post-acquisition compliance integration efforts in connection with a merger or acquisition may also be entitled to favorable treatment. Importantly, the company must disclose “all relevant facts known to it at the time of the disclosure,” including any individuals involved in or responsible for the misconduct.

Full Cooperation. In order to receive credit for “full cooperation,” a company must satisfy the provisions in the Principles of Federal Prosecution of Business Organizations, and take the following actions: (a) timely disclose and provide updates regarding all relevant facts related to the misconduct involving the company’s personnel and third-party companies; (b) proactively cooperate, including disclosing all relevant facts even when not specifically asked to do so and identifying sources of evidence outside the company’s possession; (c) timely preserve, collect, and disclose relevant documents and information; (d) coordinate witness interviews and other investigative steps with DOJ’s investigation; and (e) make witnesses available for DOJ interviews when requested, subject to Fifth Amendment due process rights.

Timely Remediation. To meet the requirement for timely and appropriate remediation, a company must conduct a thorough analysis of the underlying misconduct and remediate the root causes. It must also implement an effective compliance program based on the size and resources of the company and appropriately discipline employees involved in the misconduct. Further, a company must implement appropriate document retention policies and prohibit the improper destruction or deletion of business records, including by implementing guidance and controls on the use of personal communications and ephemeral messaging platforms. Overall, the company’s remediation steps should reflect a recognition of the seriousness of the conduct, acceptance of responsibility, and an aim to reduce the risk of the misconduct recurring.

Practical Tips and Strategies to Avoid Risks and Pitfalls

Weigh the Risk vs. Reward. If the facts implicate potential criminal penalties, companies considering self-disclosure must decide whether to report to DOJ in addition to the appropriate regulatory agency. On the one hand, if a company self-reports only to a regulatory agency but not DOJ, it will not be eligible for favorable treatment under the Policy. On the other hand, the company should be mindful that the act of reporting to DOJ may imply there is reason to believe its activities should be viewed as criminal.

Consider Overlap with Other Violations. Conduct implicating potential violations of U.S. export control and sanctions laws may also involve potential violations of other U.S. and foreign laws, adding to the mix the possibility of making disclosures to additional agencies. As demonstrated by the recent Airbus settlement, discussed here, FCPA violations may intersect with potential violations of export control and sanctions laws. When companies consider making a disclosure to other U.S. or foreign authorities in such investigations, such as the Securities and Exchange Commission or the UK’s Serious Fraud Office, they should consider whether to disclose to DOJ under the Policy.

Use Robust Preservation Techniques. Timely preservation and collection of evidence during the internal investigation is critical to a company’s ability to “fully cooperate.” To the extent preservation efforts involve overseas documents, companies must consider data privacy and other foreign laws that will govern and potentially inhibit the production of such documents to U.S. authorities. Under the Policy, the self-reporting company bears the burden of showing any prohibition on the production of overseas documents.

Protect Privilege. As companies move toward self-disclosure, they should take steps to prevent the unintentional waiver of privilege. The Policy leaves intact existing DOJ policy that cooperation credit is not predicated upon the waiver of the attorney-client privilege or work product doctrine.

Time It Right. Companies should carefully consider the timing of their disclosures. The Policy acknowledges that a company may only have conducted a preliminary investigation and, therefore, may not know all relevant facts at the time of the initial self-disclosure. In such a situation, the company must still provide all relevant facts known at that time and provide rolling updates as the company’s internal investigation proceeds. Companies should aim to disclose early enough to ensure that the disclosure is considered both voluntary and timely, but not so early that they have insufficient information to determine whether a potential criminal violation has occurred.

Businesses routinely take advantage of voluntary disclosure policies to disclose violations to DDTC, BIS and OFAC, but it remains to be seen whether these changes to the DOJ disclosure policy will lead to a significant increase in the number of voluntary self-disclosures that are filed with DOJ for such violations. Such disclosures of potential criminal violations should be carefully considered.

¹ The Policy has been incorporated into the Justice Manual (previously known as the United States Attorneys’ Manual) at Section 9-90.625.

² We previously discussed DOJ’s Foreign Corrupt Practices Act (“FCPA”) Corporate Enforcement Policy (Justice Manual § 9-47.120) here and the Guidelines For Taking Disclosure, Cooperation, And Remediation Into Account in False Claims Act Matters (Justice Manual § 4-4.112) here.

³ See 15 C.F.R. § 764.5 (BIS voluntary disclosures); 22 C.F.R. § 127.12 (DDTC voluntary disclosures); 31 C.F.R. Part 501, Appendix A (OFAC voluntary disclosures).