On December 13, 2019, the National Security Division (NSD) of the Department of Justice (DOJ) issued revised policy guidance for business organizations governing voluntary self-disclosures (VSDs) to NSD’s Counterintelligence and Export Control Section (CES) regarding potentially criminal violations of U.S. export control and sanctions laws. The new guidance supersedes the original guidance issued in October 2016, and is aimed at encouraging more companies to submit voluntary self-disclosure (VSDs). For companies that voluntarily self-disclose potentially willful violations, fully cooperate, and implement timely and appropriately remediation, there is now a presumption that they will receive a non-prosecution agreement (NPA) and will not be assessed a fine, absent aggravating factors.

As before, NSD is seeking VSDs only with respect to matters involving “potentially willful” – and therefore criminal -- violations of the statutes implementing the primary U.S. export control and sanctions regimes – i.e., the Arms Export Control Act, the Export Control Act, and the International Emergency Economic Powers Act. DOJ is not seeking, nor does the guidance concern, disclosures of civil violations made to regulatory enforcement agencies like the Directorate of Defense Trade Controls (DDTC) at the Department of State, the Office of Foreign Assets Control (OFAC) at the Department of the Treasury, or the Bureau of Industry and Security (BIS) at the Department of Commerce. Willful conduct disclosed only to regulatory enforcement agencies, but not to DOJ, will not qualify for the maximum benefits available under the new DOJ guidance.

Not every company will be able to meet all the requirements to qualify for the maximum benefits available under the new guidance. That DOJ has now clearly delineated such benefits, however, makes the submission of a VSD a more attractive option for companies that have discovered evidence of willful violations.

Changes in New VSD Policy

Clearly Identified Financial Benefit. The original 2016 guidance stated only that if a company voluntarily self-discloses potentially willful violations, fully cooperates, and appropriately remediates, it “may be eligible for a significantly reduced penalty, to include the possibility of a non-prosecution agreement (NPA), a reduced period of supervised compliance, a reduced fine and forfeiture, and no requirement for a monitor.” (Emphasis added.) The new policy establishes concrete benefits available to “a company [that] (1) voluntarily self-discloses export control or sanctions violations to CES, (2) fully cooperates, and (3) timely and appropriately remediates….” Specifically, in the absence of aggravating factors, there will now be a presumption that the company will receive a non-prosecution agreement and will not be required to pay any fine.  

Certain aggravating factors may result in a more stringent resolution. These factors include (1) exports of items controlled for nuclear nonproliferation or missile technology reasons to a proliferation country; (2) exports of items known to be used in the construction of weapons of mass destruction; (3) exports to a Foreign Terrorist Organization or a Specially Designated Global Terrorist; (4) exports of military items to a hostile foreign power; (5) repeated violations, including similar administrative or criminal violations in the past; and (6) knowing involvement of upper management in the criminal conduct.

If aggravating factors do exist and they warrant an enforcement action other than a non-prosecution agreement (such as a deferred prosecution agreement or a guilty plea) – but “the company satisfies all other criteria” – DOJ will “accord, or recommend to a sentencing court,” a fine that is at least 50 percent lower than what would otherwise be available under the alternative fine provision set forth in 18 U.S.C. § 3571(d). Thus, the government “will cap the recommended fine at an amount equal to the gross gain or gross loss.” In addition, DOJ will not require the appointment of a monitor if, at the time of resolution, the company has implemented an effective compliance plan. (The guidance takes no position on the imposition of a monitor by DDTC, BIS, or OFAC.) Still, even in cases where a company receives a non-prosecution agreement, it will not be permitted to retain “any of the unlawfully obtained gain,” and it will be required to pay all disgorgement, forfeiture, and/or restitution resulting from the company’s misconduct.

The original 2016 guidance did not provide any presumption for companies regarding the disposition of VSDs submitted to CES, and it also did not identify any specific financial benefits that companies could obtain if they satisfied the criteria for a VSD. The omission of such benefits in the prior guidance contributed to skepticism among companies and their counsel regarding the net benefits of submitting VSDs to CES.

Submission of VSDs to Regulatory Agencies. The new guidance reaffirms (albeit, now in a footnote), that companies “should continue to make voluntary self-disclosures to appropriate regulatory agencies under existing procedures.” But it clarifies that a company will not qualify for the benefits of a VSD in any subsequent DOJ investigation if the company “identifies potentially willful conduct, but chooses to self-report only to a regulatory agency and not to DOJ....” (Emphasis added.) Thus, for example, a company submitting a VSD to DDTC regarding a potentially criminal violation of the International Traffic in Arms Control Regulations (ITAR) will not be eligible for the benefits available under the new DOJ guidance unless it has also timely submitted a VSD to DOJ.

Harmonization of Key Definitions. Although the 2016 guidance contained language defining key terms such as “Voluntary Self-Disclosure,” “Full Cooperation,” and “Timely and Appropriate Remediation,” the new guidance conforms these definitions to now mirror the definitions in similar guidance contained in other DOJ voluntary disclosure guidance, specifically, DOJ’s FCPA Corporate Enforcement Policy. Thus, companies which have identified multiple violations implicating both the FCPA and export control and sanctions laws can rely on a uniform set of key definitions in evaluating whether to submit a VSD.

Voluntariness

For a company’s disclosure to be deemed “voluntary,” the company must satisfy three requirements. First, it must disclose information regarding its potentially willful conduct to CES “prior to an imminent threat of disclosure or government investigation.” Second, the company must disclose the conduct “within a reasonably prompt time after becoming aware of the offense,” and the burden is on the company to demonstrate timeliness. Third, the company must disclose “all relevant facts known to it at the time of disclosure, including as to any individuals substantially involved in or responsible for the misconduct at issue.”

The revised policy contains new guidance regarding disclosures based on information of potential export control or sanctions violations discovered through a merger or acquisition. It states that “[w]hen a company undertakes a merger or acquisition, uncovers misconduct by the merged or acquired entity through thorough and timely diligence or, in appropriate circumstances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity, there will be a presumption of a non-prosecution agreement in accordance with and subject to the other requirements of this Policy.”

The revised policy omits footnote language in the original 2016 guidance stating that “NSD will not consider a self-disclosure to be voluntary where it is required by a plea agreement, DPA, NPA, or any other similar agreement.” DOJ provided no explanation for this omission, so its intentions are unclear. The omission could be construed to mean, however, that NSD is now open to considering disclosures in those circumstances to be voluntary under the revised VSD policy if a company first learns of new, potentially criminal conduct after executing one of these agreements and otherwise meets the specified requirements for a disclosure to be deemed voluntary.

The revised policy also omits, without explanation, footnote language in the original guidance stating that a VSD will be deemed voluntary if a whistleblower has previously informed the government of export control or sanctions violations, provided that the company is unaware of the whistleblower disclosure and submits a VSD before it learns of a government investigation. The revised policy does contain a new footnote stating that “[i]f a company makes a disclosure before it becomes aware of an ongoing non-public government investigation, the company will be considered to have made a voluntary self-disclosure.” This suggests that a company’s VSD could be deemed voluntary even if a whistleblower has lodged a non-public complaint with the government, so long as the company is unaware of the complaint.

Full Cooperation

The new guidance replicates the original guidance’s requirements that a company must satisfy to receive credit for full cooperation:

• “Disclosure on a timely basis of all facts relevant to the wrongdoing at issue, including all relevant facts gathered during a company’s internal investigation; attribution of facts to specific sources where such attribution does not violate the attorney-client privilege, rather than a general narrative of the facts; timely updates on a company’s internal investigation, including but not limited to rolling disclosures of information; all facts related to involvement in the criminal activity by the company’s officers, employees, or agents; and all facts known or that become known to the company regarding potential criminal conduct by all third-party companies (including their officers, employees, or agents).”

• “Proactive cooperation, rather than reactive; that is, the company must timely disclose all facts that are relevant to the investigation, even when not specifically asked to do so. Additionally, where the company is aware of relevant facts not in the company’s possession, it must identify that evidence to [DOJ].”

• “Timely preservation, collection, and disclosure of relevant documents and information relating to their provenance, including (a) disclosure of overseas documents, the locations in which such documents were found, and who found the documents, (b) facilitation of third-party production of documents, and (c) where requested and appropriate, provision of translations of relevant documents in foreign languages." And in circumstances “[w]hen a company claims that the disclosure of overseas documents is prohibited due to data privacy, blocking statutes, or other reasons related to foreign law, the company bears the burden of establishing the prohibition. Moreover, a company should work diligently to identify all available legal bases to provide such documents.”

• “When requested and appropriate, de-confliction of witness interviews and other investigative steps that a company intends to take as part of its internal investigation with steps that [DOJ] intends to take as part of its investigation.”

The new guidance recognizes that “not all companies will satisfy all of the components of full cooperation, whether because they decide to cooperate only later in an investigation or they timely decide to cooperate but fail to meet all of the criteria.” DOJ states that “such companies should be eligible for some [i.e., at least partial] cooperation credit if they provide all relevant information related to individual accountability…..” However, the benefits available in that circumstance “generally will be markedly less than full cooperation as defined….” 

Companies will not be disadvantaged by making a preliminary disclosure to NSD before they have completed an internal investigation. The new guidance recognizes that “a company may not be in a position to know all of the relevant facts at the time of a voluntary self-disclosure, especially where only preliminary investigative efforts have been possible.” It explains that “[i]n such circumstances, a company should make clear that it is making its disclosure based on a preliminary investigation of assessment of information, but it should nonetheless provide a fulsome disclosure of the relevant facts known to it at that time.”

Consistent with more broadly applicable DOJ policy as set forth in the Justice Manual at § 9-28.720, the new guidance affirms that a company’s eligibility for cooperation credit is not dependent upon a waiver of the attorney-client privilege or work-product protection.

Timely and Appropriate Remediation

To receive full credit for timely and appropriate remediation, a company must satisfy the following requirements:

• “Demonstration of thorough analysis of causes of underlying conduct (i.e., a root cause analysis) and, when appropriate, remediation to address the root causes”;

• “Implementation of an effective compliance program, the criteria for which will be periodically updated and which may vary based on the size and resources of the organization, but may include:

  • The company’s culture of compliance, including awareness among employees that any criminal conduct, including the conduct underlying the investigation, will not be tolerated;

  • The resources the company has dedicated to compliance;

  • The quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk;

  • The authority and independence of the compliance function and the availability of compliance expertise to the board;

  • The effectiveness of the company’s compliance function and the availability of compliance expertise to the board;

  • The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment;

  • The compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors;

  • The auditing of the compliance program to ensure its effectiveness; and

  • The reporting structure of any compliance personnel employed or contracted by the company.”

• “Appropriate discipline of employees, including those identified by the company as responsible for the misconduct, either through direct participation or failure in oversight, as well as those with supervisory authority over the area in which the criminal conduct occurred;

• Appropriate retention of business records, and prohibition of the improper destruction or deletion of business records, including implementing appropriate guidance and controls on the use of personal communications and ephemeral messaging platforms that undermine the company’s ability to appropriately retain business records or communications or otherwise comply with the company’s document retention policies or legal obligations; and

• Any additional steps that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including messages to identify future risks.”

DOJ also will confer with its law enforcement partners to assess whether a company merits full credit for timely and appropriate remediation. The guidance notes that NSD “will also coordinate with the appropriate regulatory agency (e.g., BIS) in assessing a corporation’s remediation efforts and compliance program.”

Willfulness

As noted above, the new DOJ policy guidance applies only to VSDs concerning potentially willful (and therefore criminal) violations of export control and sanctions law. Willfulness is an element of the offense that the government must prove beyond a reasonable doubt in any criminal prosecution of export control or sanctions violations. The new policy guidance reiterates that NSD uses the definition of willfulness set forth by the Supreme Court in Bryan v. United States, 524 U.S. 184 (1998), which provides that an act is willful if it was committed with the knowledge that it is illegal. As later courts of appeal have ruled, however, the government is not required to prove that a defendant was aware of the specific law, rule, or regulation that the defendant’s conduct may have violated.

The new DOJ guidance does not elaborate on the degree of belief or certainty regarding a possible criminal violation that a company must possess in order to warrant a VSD. The fact that the guidance expressly concerns the disclosure of only “potentially willful” violations, however, indicates that companies need not have reached a conclusive determination that a potential violation was willful, and that credible evidence of such a violation (or a reasonable belief) may suffice to come within the scope of the guidance.

New Applicability to Financial Institutions

The new guidance directs that all VSDs concerning potentially willful export control and sanctions violations be sent to CES, which has primary jurisdiction and approval authority within DOJ for the criminal enforcement of export control and sanctions laws. The previous guidance, which by its terms expressly did not apply to financial institutions, directed financial institutions to submit VSDs to the Asset Forfeiture and Money Laundering Section in the Criminal Division (now the Money Laundering and Asset Recovery Section) or the relevant U.S. Attorney’s Office.

Implications

DOJ continues to assign high priority to holding companies accountable for violations of export control and sanctions laws, and to punishing wrongdoing by individual company officials. The original VSD guidance apparently did not result in a significant volume of disclosures, as many companies were wary of informing the government of potential criminal violations without the prospect of more tangible, meaningful, and predictable benefits. Not every company will be able to meet all the requirements to qualify for the maximum benefits available under the new guidance. That such benefits have now been clearly delineated, however, makes the submission of a VSD a more attractive option for companies that have discovered evidence of willful violations. Whether the new policy guidance results in a significantly greater number of more VSDs, however, may depend on the extent to which companies considering a VSD can see public evidence of favorable resolutions in other cases.