On October 4, 2023, the U.S. Department of Justice (DOJ) announced a uniform approach for the resolution of voluntary self-disclosure (VSD) of misconduct discovered during M&A due diligence. The Mergers & Acquisitions Safe Harbor Policy (M&A Safe Harbor) provides that, absent aggravating factors, the DOJ presumptively will decline to press charges if the acquiring company voluntarily discloses and remediates, in a timely manner, any misconduct discovered during pre- and post-acquisition diligence. This guidance articulates a more consistent and transparent approach than the ad hoc approach that had existed for decades. It also further validates the DOJ’s declared commitment to “placing an enhanced premium on timely compliance-related due diligence and integration.”

Previous VSD Policies Were Inconsistent in Terms of Eligibility and Benefits

Historically, the DOJ took an ad hoc, matter-specific approach with respect to VSDs. A considered move further away from that approach started in September 2022, when Deputy Attorney General (DAG) Lisa Monaco directed all DOJ components to adopt VSD policies. DOJ components rolled out their versions of VSD policies in early 2023, but those policies did not completely align.

Eligibility

While the components’ policies shared the same elements for qualification—voluntary self-disclosure (which includes an element of timeliness), full cooperation (which includes communication of all relevant facts), remediation, and the lack of aggravating factors—the policies themselves, the DAG recently acknowledged, “differ from each other in approach.” The U.S. Attorneys’ Offices, in an apparent nod to the inconsistent qualifying criteria under the former approach, adopted a policy in early 2023 under which an individual U.S. Attorney’s Office “will coordinate with, or, if necessary, obtain approval from, the Department component responsible for the VSD policy specific to the reported misconduct” and specifically reserved that it could “choose to apply any provision of an alternative VSD policy in addition to, or in place of, any provision of this policy.”

Benefits of Qualification

Similarly, and perhaps more importantly, assuming a lack of aggravating factors, the policies adopted earlier this year lack consistency about the potential benefits of VSD in the M&A context.

• The Criminal Division policy provides for the “presumption of a declination in accordance with and subject to the other requirements of this Policy.”

• The Consumer Protection Branch policy articulates “a presumption against a guilty plea in accordance with and subject to the other requirements of this policy.”

• The National Security Division policy declares “a presumption of a non-prosecution agreement or, where circumstances so warrant, a declination in accordance with and subject to the other requirements of this Policy.”

• The Environmental and Natural Resources Division policy, after noting its applicability to misconduct discovered in the M&A context, provides that the Division “will not seek a guilty plea.”

• Meanwhile, the Tax Division policy—silent about the benefits of VSD in the M&A context—states that the Tax Division “will not seek a guilty plea.”

• Although silent about the M&A context, the U.S. Attorneys’ Offices policy allows that the resolution of a VSD “could include a declination, non-prosecution agreement, or deferred prosecution agreement.”

• The Antitrust Division did not update its April 2022 Leniency Policy and Procedures which provides that, in general, “an organization … that meets the criteria for leniency will not be charged criminally for the illegal activity.”

Under the M&A Safe Harbor, Companies May Reduce or Avoid Criminal Liability Through Voluntary Self-Disclosure of Misconduct Discovered During M&A Due Diligence

At the Society of Corporate Compliance & Ethics conference on October 4, the DAG announced that all DOJ components will apply a VSD policy largely consistent with the Criminal Division’s policy. Reflecting the impetus behind the M&A Safe Harbor, the DAG stated, “In a world where companies are on the front line in responding to geopolitical risks—we are mindful of the danger of unintended consequences. The last thing the Department wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct. Instead, we want to incentivize the acquiring company to timely disclose misconduct uncovered during the M&A process.” This new approach resolves the inconsistent treatment acquiring companies confronted.

The M&A Safe Harbor provides that a “presumption of a declination” is the baseline for an acquiring company that voluntarily self-discloses, in a timely manner, misconduct discovered at a target in pre- or post-acquisition diligence, fully cooperates with the DOJ and appropriately remediates the misconduct (including promptly implementing an effective ethics and compliance program at the target). The acquired company, too, may receive a declination. However, VSD credit may not be available for the acquired company if the offense is especially serious or the offender has other adverse qualities—for example, recidivism. (Aggravating factors at an acquired company will not impact an acquiring company’s ability to receive a declination.) In certain contexts, a company subject to aggravating factors may still have a path to declination through the M&A Safe Harbor.

The DAG announced firm timelines for what qualifies as a timely VSD. “As a baseline matter, to qualify for the Safe Harbor, companies must disclose misconduct discovered at the acquired entity within six months from the date of closing. That applies whether the misconduct was discovered pre- or post-acquisition.” In addition, the DOJ set a timeline for the remediation that accompanies a VSD. “Companies will then have a baseline of one year from the date of closing to fully remediate the misconduct.” The DAG allowed for some extension of these deadlines under a “reasonableness analysis because [the DOJ] recognize[s] deals differ and not every transaction is the same.” Relatedly, rather than waiting until the six-month deadline, one must promptly disclose misconduct that threatens national security or involves an ongoing or imminent harm.

Of note, a declination obtained through this VSD program does not result in amnesty. To receive a declination, an acquiring company must have invested in appropriate due diligence and subsequent investigation and remediation efforts. In addition, to qualify, the acquiring company must also pay disgorgement, forfeiture and/or restitution based on the ill-gotten gains from the misconduct.

Although not stated expressly in the DAG’s announcement, declinations under the VSD policy will likely be made public and bear with them any collateral or reputational impacts that such publicity carries.

These consequences, though potentially costly, may pale in comparison to the alternative that the DAG offered—“if your company does not perform effective due diligence or self-disclose misconduct at an acquired entity, it will be subject to full successor liability for that misconduct under the law.”

The DOJ Emphasized the Importance of Engagement of the Compliance Function in “Careful Due Diligence” and Remediation

When announcing the new guidance, the DAG reiterated that disclosing companies need to perform “careful due diligence and timely post-acquisition integration,” principles set forth in the Criminal Division’s Evaluation of Corporate Compliance Programs (the Compliance Guidance). The DAG specifically emphasized that “[c]ompliance must have a prominent seat at the deal table if an acquiring company wishes to effectively de-risk a transaction.”

The Compliance Guidance expresses a preference for comprehensive pre-acquisition due diligence conducted by knowledgeable and skilled experts who follow a routinized process, but it recognizes that such diligence is not always feasible. Pre-acquisition due diligence typically involves an assessment of a target’s risk profile, its compliance program and its experience with allegations of misconduct. When context impedes a full understanding of these factors, an acquiror should undertake post-signing or post-closing diligence, testing or auditing. Signing an agreement or closing a transaction should alleviate the impediments pre-signing diligence that might arise, for example, in an accelerated, highly competitive auction process. And the DOJ’s expectation is that an acquiror will use the greater certainty or control to expand previously limited diligence.

The Compliance Guidance highlights the role of the compliance function in the M&A process. The compliance function—either through internal resources or outside counsel/consultants—should be engaged early in and throughout the diligence process to ensure adequate time to design diligence, receive relevant information and analyze the target’s risk profile and internal controls. Completing this process allows compliance to opine on issues from the contours of representations, warranties, covenants or indemnification provisions in the merger agreement to pricing that internalizes the potential costs associated with identified risks.

The Compliance Guidance emphasizes that the role of the compliance function and the lessons of due diligence do not end at signing. The DOJ looks to an acquiror’s ongoing management of the risks acquired through the transaction. This includes remediation of specific risks or actual misconduct identified through diligence, timely post-acquisition implementation of relevant policies and procedures, and ongoing monitoring of acquired entities. The M&A Safe Harbor, with its one-year deadline, now places a premium on efficiency in remediation and implementation of an effective compliance program.

Key Takeaways

• The DOJ’s focus on achieving resolutions through VSD has led to an environment with greater transparency and predictability for acquiring companies.

• Companies should ensure that their compliance function or counsel who is filling that role is fully engaged in and integrated into the due diligence processes.

• The due diligence processes should be sufficiently comprehensive to assess risk profile, efficacy of controls and experience with allegations of misconduct. Such diligence can occur pre-signing, between signing and closing or post-closing. Diligence may be appropriate or necessary in more than one of these windows.

• An acquiring company choosing to make a VSD is required to make its disclosure within six months of closing unless extenuating circumstances justify a delay.

• The DOJ expects that an acquiring company will not wait for disclosure to the DOJ before starting remediation efforts. Those remediation efforts may include implementation or enhancement of a compliance program at the target (including risk assessments, policies and procedures, training, building a culture of compliance, ongoing monitoring and reporting mechanisms), personnel actions or termination of or more stringent control of certain business relationships. Importantly, the default deadline for completion of remediation under the M&A Safe Harbor is one year from closing.

• The DOJ also expects a VSD to be detailed and complete. If complete disclosure is impossible because of timeliness constraints, an acquiring company may wish to consider a partial disclosure to ensure timeliness, which disclosure should specifically highlight its partial nature and confirm that the company will update the DOJ as new facts are discovered on the way to full disclosure.

• A VSD resolution is not cost-free. Beyond the expense associated with an internal investigation sufficient for a complete disclosure, a company making a VSD likely faces disgorgement, restitution or forfeiture. Accordingly, it is worthwhile to consider potential purchase price adjustments or indemnification or other provisions to allow recovery of any such expenses, including disgorgement, forfeiture or restitution.