Two months have passed since the Department of Justice (DOJ) took a major step in encouraging companies to self-report willful economic sanctions and export control violations by providing concrete incentives that significantly increase transparency in this arena. On Dec. 13, 2019, DOJ’s National Security Division (NSD) announced revisions to its policy on the voluntary self-disclosure (VSD) of potential criminal violations of economic sanctions and export control laws. The policy, entitled “Export Control and Sanctions Enforcement Policy for Business Organizations” (“VSD Policy”), bolsters the incentives for voluntary disclosures to NSD in at least two key respects: first, by providing greater clarity and predictability on the benefits of disclosure, including a presumption that reporting companies will be given a non-prosecution agreement; and second, by expanding the class of companies that can avail themselves of these benefits, to include financial institutions and corporate successors-in-interest. Notably, this VSD Policy applies in cases of suspected willful violations of economic sanctions and export control laws. In instances of suspected unintentional or inadvertent violations, voluntary self-disclosure would be appropriate instead to the relevant administrative agency (most likely the Department of the Treasury’s Office of Foreign Assets Control (OFAC), Department of Commerce’s Bureau of Industry and Security (BIS) and/or Department of State’s Directorate of Defense Trade Controls (DDTC)).

Under the terms of the VSD Policy, the benefits of voluntary self-disclosure are available only if the disclosure to NSD is timely, and only if the company fully cooperates with DOJ while “timely and appropriately” remediating the compliance failure. Accordingly, companies that identify potential sanctions or export control violations must quickly evaluate the costs and benefits of actually making a disclosure, simultaneously determining how to time any potential disclosures while also endeavoring to comply with the terms of the policy to maximize cooperation credit if the disclosure is in fact made. The DOJ’s revisions place sanctions violations essentially in the same category as FCPA violations and criminal antitrust violations, where the Department has determined that encouraging corporate self-reporting is a necessity for enforcing these crimes.

Greater Clarity and Predictability on the Benefits of Self-Disclosure

The costs of voluntarily disclosing sanctions and export violations to DOJ are self-evident: voluntary self-disclosure may alert prosecutors to violations they may never uncover, exposing companies to potential criminal liability they might not otherwise have faced. Prior to the recent VSD Policy, companies had a difficult time identifying, much less quantifying, the benefits of disclosure with any confidence. Although NSD’s prior policy on this issue set forth the factors companies needed to meet in order to qualify for self-disclosure credit, no measure of assurance was given about what form that credit would take, making it difficult for companies to evaluate the pros and cons of self-disclosure.

In theory, the new VSD Policy remediates that problem by providing for a presumption of non-prosecution for companies that voluntarily self-disclose and cooperate in accordance with the terms of the guidance. When this presumption is applied, a reporting company would not be required to pay a fine, although they would be required to disgorge any gains from the violation. At present, this seems to be a powerful incentive to report willful misconduct, although only time will tell how this presumption is applied.

Under the VSD Policy, violations with “aggravating factors,” including but not limited to the presence of heightened national security concerns, a prior history of violations by the company, or involvement of upper management in the misconduct, will not be eligible for a non-prosecution agreement. But even where aggravating factors may be present and a more serious criminal resolution is deemed appropriate by DOJ, the VSD Policy nonetheless directs prosecutors to accord, or recommend to a court to apply, a 50% reduction to the available fine. This effectively caps the fine at an amount equal to the gross gain or gross loss.

Financial Institutions and Successors-in-Interest Can Take Advantage of the Policy

The predecessor to the VSD Policy, issued by NSD on Oct. 2, 2016, expressly excluded financial institutions from its coverage, in light of their “unique reporting obligations.” The VSD Policy removes that carve-out, allowing financial institutions to take advantage of the presumption of non-prosecution on the same basis as other companies. It should be noted, however, that the press release that announced the VSD Policy indicated that the policy applies only to sanctions and export control violations reported to NSD’s Counterintelligence and Export Control Section (CES) and “does not apply to . . . any other part of the Department of Justice.” On its face, this would seem to indicate the policy does not bind the Criminal Division’s Money Laundering & Asset Forfeiture Section (MLARS), which has approval authority over certain criminal resolutions against financial institutions. As a practical matter, however, DOJ policy requires different components to work together on corporate resolutions to avoid any unfairness, and it would be highly irregular for MLARS to seek a resolution that is inconsistent with the VSD Policy. For the sake of finality, financial institutions may nonetheless wish to at least consider disclosure to MLARS (as well as any prudential regulators) at or around the time of any disclosure to NSD.

The VSD Policy also expressly provides that self-disclosure credit may be given in the context of a merger or acquisition, where a company uncovers violations through due diligence or post-acquisition audits, and otherwise complies with the terms of the policy.

The VSD Policy Is Not a Silver Bullet

The VSD policy is a significant improvement for reporting willful violations of the law that may incur criminal liability. However, the policy does not address nor does it improve transparency for self-disclosures to administrative agencies, such as OFAC, involving non-willful violations. The decision whether to self-report potential inadvertent economic sanctions violations to OFAC is often a difficult decision for similar reasons as a decision whether to disclose a potential criminal violation to DOJ. Questions arise as to what potential savings there will be if a fine or other OFAC-required mitigation measures are levied on the company, and, often more importantly, how long OFAC’s inquiry will take. In a time where the mere existence of an ongoing investigation may cause numerous corporate reporting requirements and other disclosures to be triggered, these are important factors to consider when debating whether to report to OFAC or another relevant administrative agency.

In situations where willfulness is one of the issues in question during the internal review, it may be prudent to consider putting in a placeholder with the NSD early. With that placeholder VSD in place and the communications with NSD occurring as the investigation continues, it is difficult to see how OFAC would not participate in this process. By gaining this participation, companies may be able to get additional visibility into how the OFAC review is proceeding and may at least be able to avoid the long periods of “radio silence” that often accompany these civil investigations at Treasury, and, ideally, can coordinate efforts to prompt each agency’s review in a more efficient and expeditious manner.

Timing Considerations Are Critical to Preserving VSD Credit

Importantly, however, the DOJ VSD Policy makes clear that the benefits of VSD Policy will not be available to anyone who has disclosed the suspected violations to an administrative agency before disclosing to DOJ. Conversely, if OFAC is made aware of a sanctions violation through its involvement in an NSD VSD review, and a VSD has not yet been submitted to OFAC, the violating party risks losing mitigation credit that may be granted by OFAC for violations voluntarily notified. As OFAC-assessed monetary fines may easily reach into the double- or triple-digit millions of dollars, the preservation of such mitigation credit is critical. Accordingly, it is vital to properly strategize and time parallel simultaneous disclosures to DOJ and other relevant agencies. In instances where VSDs to multiple agencies are considered, it is critical for outside counsel to coordinate efforts for the duration of the process.

The VSD policy is far too new to understand how the interaction between OFAC and the NSD will work, but it is clear that if the two entities do not work in a coordinated fashion, the admirable goal of increasing transparency in DOJ self-reporting may be in jeopardy.

Early Planning Is Key to Taking Full Advantage of the Policy

To benefit from the new incentives set forth in the VSD Policy, companies that identify potentially willful sanctions or export control violations must act quickly to understand the scope of the issue, evaluate the costs and benefits of disclosure, and if disclosure is to be made, ensure full compliance with the terms of the policy. The VSD Policy provides that in order to receive full credit for any self-disclosure, companies must (1) timely self-disclose, (2) fully cooperate, and (3) timely and appropriately remediate any violations. The policy also outlines the contours of these requirements, which are consistent with DOJ’s more well-known FCPA Corporate Enforcement Policy (CEP).

• Coordinate the Timing of Disclosures. Of significance on the timeliness requirement, companies will not get credit from DOJ for voluntary disclosures made to regulators, including OFAC. Rather, disclosure must be made directly and “promptly” to NSD’s CES. Companies considering self-disclosure to NSD should carefully evaluate the timing of any possible disclosures to regulators, NSD, and other components of DOJ (e.g., MLARS).

• Be Prepared to Cooperate Proactively. The VSD Policy emphasizes the need for “proactive” cooperation in order to take advantage of the presumption of non-prosecution. That does not mean that companies must waive privilege, or must turn over documents when doing so would violate foreign data privacy laws. What it means is that companies must be prepared to turn over salient information before it is requested, identify issues to the government before prosecutors spot those issues themselves, and otherwise demonstrate responsiveness to prosecutors’ concerns.

• Begin Remediation As Soon As Possible. The VSD Policy specifies that, to be deemed to have fully remediated a violation, a company must, among other things, conduct a root-cause analysis to determine the cause of the breakdown and appropriately address any root causes identified. The earlier this process is undertaken, the more credible it will be to DOJ, and the better the result. Companies must also reexamine their overall compliance programs and plug any holes. While the VSD Policy sets forth some criteria by which compliance programs will be evaluated, DOJ’s more comprehensive Evaluation of Corporate Compliance Programs Guidance, issued in May 2019, is also likely instructive.

Conclusion

The decision to self-report a potential felony is one of the most difficult decisions that general counsels, directors, and other senior executives may ever face. While the decision remains incredibly complex, this new policy makes the calculus more transparent. Although careful deliberation must still be given to any decision to voluntarily self-disclosure potential criminal violations to DOJ, the VSD Policy makes self-disclosure of sanctions and export control violations considerably more attractive by codifying the specific ways a company may expect to benefit, and the things they need to do to qualify. The VSD Policy also makes these benefits available to a larger class of companies, including financial institutions. The benefits of the VSD Policy are intended to create strong incentives for companies to report willful misconduct. However, this policy is new. Until it has been properly vetted through actual self-disclosures, companies should carefully consider these potential benefits with counsel, as there may be unforeseen risks that accompany the obvious benefits.