Quick Hits

• DOJ announces M&A Safe Harbor Policy to enable acquiring companies to voluntarily self-disclose criminal misconduct of companies being acquired to avoid criminal prosecution.
• Acquiring companies will have six months from the close of an acquisition to self-disclose misconduct at an acquired company and one year from the close to remediate the misconduct.

On October 4, 2023, during public remarks, Deputy Attorney General Lisa Monaco announced the new departmentwide “Mergers & Acquisitions Safe Harbor Policy,” which will allow acquiring companies to disclose criminal misconduct in exchange for receiving a presumption of a declination to prosecute.

The stated purpose of the policy, which follows up on recent changes to the DOJ’s broader Corporate Voluntary Self-Disclosure (VSD) Policy, is to incentivize companies to perform effective due diligence and self-disclose misconduct at a company being acquired by enabling the acquiring company to avoid successor liability for that misconduct.

“Our goal is simple: good companies—those that invest in strong compliance programs—will not be penalized for lawfully acquiring companies when they do their due diligence and discover and self-disclose misconduct,” Monaco stated.

M&A Safe Harbor

According to Monaco, in order for companies to be considered for more lenient treatment, they will be required to “promptly and voluntarily disclose” discovered misconduct at the acquired company, cooperate with any ensuing investigation, and remediate the misconduct, including making any restitution or necessary disgorgement.

Monaco stated that the key to the policy is baseline timelines for reporting and remediating misconduct once it is discovered.

1. Companies must disclose misconduct discovered at the company being acquired within six months from the date of the closing of the acquisition, whether or not the misconduct was discovered before or after the acquisition.
2. Companies will have “one year from the date of closing to fully remediate the misconduct.”

However, Monaco noted that those baselines will be subject to a reasonableness standard given the unique complexities of individual transactions and that prosecutors may extend the deadlines based on the “specific facts, circumstances, and complexity of a particular transaction.”

Aggravating Factors

“Aggravating factors” will be treated differently in the M&A context. The presence of aggravating factors at the acquired company will not prevent the acquiring company from receiving a declination. However, such aggravating factors may still be considered by prosecutors against the acquired company, Monaco said.

The DOJ has indicated in other contexts that such aggravating factors include, but are not limited to, misconduct that “poses a grave threat” to national security, public health, or the environment, is “deeply pervasive throughout the company,” or involves the current executive management.

Further, Monaco stated that disclosure under the M&A Safe Harbor Policy “will not be factored into future recidivist analysis for the acquiring company.”

The Safe Harbor Policy applies only to criminal conduct that is “discovered in bona fide, arms-length M&A transactions” and does not apply to misconduct otherwise required to be disclosed or already publicly known or known to the DOJ.

Next Steps

The Biden administration’s DOJ has made corporate compliance a priority, including Monaco’s recent remarks explicitly connecting international corporate crime with U.S. national security interests. As such, the DOJ is seeking to encourage companies to cooperate, turn over individual bad actors who may face federal prosecution, and remediate misconduct through policies that enable companies to avoid criminal prosecution or face more lenient penalties.

The M&A Safe Harbor Policy is the latest effort on that front and follows the launch of the DOJ’s new Voluntary Self-Disclosure (VSD) policy in February 2023, which sets standards for companies to meet in order to receive credit for self-reporting misconduct. The M&A Safe Harbor Policy specifically aims to enable companies to make acquisitions without risk of absorbing criminal liability from the acquired company’s prior misconduct.

“The last thing the Department wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct,” Monaco stated in her public remarks. “Instead, we want to incentivize the acquiring company to timely disclose misconduct uncovered during the M&A process.”

This emphasis on self-disclosure places the onus on company executives and compliance officers to maintain and administer effective compliance policies, programs, and procedures and to conduct effective due diligence during an M&A transaction. Companies may want to review their existing compliance programs, whistleblower protections, and internal investigation procedures to make sure they are effective when it comes to encouraging the discovery and reporting of potential criminal misconduct.