023 was a very active one for Department of Justice (DOJ or the “Department”) guidance, and that guidance had one clear theme: DOJ wants companies to voluntarily self-disclose their misconduct. To incentivize self-disclosure, DOJ has offered tangible benefits for those willing to set an example by coming forward swiftly. The few voluntary self-disclosures on record in 2023 do appear favorable to the disclosing entities, but it remains to be seen whether others will follow suit in 2024.

The Criminal Division’s Revised Corporate Enforcement Policy

In January 2023, DOJ announced significant updates to the Criminal Division’s Corporate Enforcement Policy (the “CEP”).[1] Once applicable only in the Foreign Corrupt Practices Act (FCPA) context and known as the FCPA Corporate Enforcement Policy, the revised CEP now extends to all corporate criminal matters handled by DOJ’s Criminal Division. The changes constituted the first set of major revisions to the CEP since 2017, and they expanded upon certain principles outlined in Deputy Attorney General (DAG) Lisa Monaco’s September 2022 memorandum regarding corporate criminal enforcement.

According to the revised CEP, absent aggravating circumstances involving the seriousness of an offense or the nature of an offender, DOJ will apply a presumption of a declination, which is an exercise of governmental discretion to not bring criminal charges, for companies that 1) voluntarily self-disclose their misconduct to DOJ, 2) fully cooperate, and 3) timely and appropriately remediate.

Although not presumed, a declination may still be possible in cases where aggravating circumstances are present.[2] The revised CEP explains that prosecutors may deem a declination appropriate where the company demonstrates it has satisfied each of the following conditions:

• the company makes a voluntary self-disclosure immediately upon becoming aware of the alleged misconduct;
• the company had an effective compliance program and system of internal accounting controls at the time of misconduct and disclosure, which allowed for identification of the misconduct and led to self-disclosure; and
• the company exhibited “extraordinary” cooperation and remediation.[3]

Where the government believes a criminal resolution is warranted for a company that has voluntarily self-disclosed, fully cooperated, and timely and appropriately remediated, the Criminal Division will recommend to the sentencing court a 50 – 75% reduction off the low end of the US Sentencing Guidelines (USSG) fine range, except in the case of the criminal recidivist. Resolutions will also generally not require a corporate guilty plea absent particularly egregious circumstances. Finally, corporate monitors will not be required for companies that demonstrate they have implemented and tested an effective compliance program and remediated the root cause of misconduct at the time of resolution.

Companies that fail to voluntarily self-disclose their misconduct, but then fully cooperate and timely and appropriately remediate, may receive credit to a lesser extent. In such circumstances, DOJ will recommend up to a 50% reduction off the low end of the USSG fine range, but the full reduction will be reserved only for companies that distinguish themselves through extraordinary measures.

The United States Attorneys’ Offices Voluntary Self-Disclosure Policy

In February 2023, DOJ furthered its progress and issued its Voluntary Self-Disclosure Policy for corporate criminal enforcement (the “VSD Policy”), which applies to all United States Attorneys’ Offices (USAOs).[4] The VSD Policy signaled an effort from DOJ to standardize how the voluntary self-disclosure process is defined and credited by USAOs nationwide.

The following criteria determine whether a company’s disclosure will be deemed a voluntary self-disclosure for purposes of receiving credit under the VSD Policy:

• Voluntariness: A disclosure must be truly voluntary and will not be deemed a voluntary self-disclosure where the company had a pre-existing duty to disclose (e.g., by contract or prior resolution with DOJ).
• Timing: Disclosures must be made prior to an imminent threat of disclosure/government investigation, prior to the misconduct being publicly disclosed or otherwise known to the government, and “within a reasonably prompt time” after the company learns of the misconduct. Reasonable promptness is not defined by the VSD Policy, but it is the company’s burden to demonstrate timeliness.
• Substance of the Disclosure and Accompanying Actions: To be deemed a voluntary self-disclosure, a disclosure must include all relevant facts known to the company at the time it discloses. Companies are expected to work swiftly to preserve, collect, and produce relevant information, in addition to providing timely factual updates to DOJ.

Consistent with the revised CEP, the VSD Policy also states that absent aggravating factors, USAOs will not pursue a guilty plea for companies that 1) voluntarily self-disclose their misconduct consistent with the criteria set forth above, 2) fully cooperate, and 3) timely and appropriately remediate (including agreeing to pay disgorgement, forfeiture, and restitution resulting from the misconduct).

The presence of an aggravating factor does not necessarily require a guilty plea, and such cases will be evaluated on an individual basis. Where a company fully satisfies the VSD Policy’s standards, the USAO may choose not to impose any criminal penalty, and even if a criminal penalty is warranted, it will not impose a penalty that is greater than 50% below the low end of the USSG fine range. If the presence of an aggravating factor warrants a guilty plea for a company that voluntarily self-discloses, fully cooperates, and timely and appropriately remediates, the USAO will recommend a 50 – 75% reduction off the low end of the USSG fine range after other potentially applicable reductions.

Also consistent with the revised CEP, monitors will not be required for companies that demonstrate they have implemented and tested an effective compliance program at the time of resolution. Prompt self-disclosures that do not meet the criteria of the VSD Policy will still be viewed favorably by DOJ, but the specific benefits available in such circumstances remain unclear.

Safe Harbor Policy for Voluntary Self-Disclosures Made in Connection with Mergers and Acquisitions

Most recently, in October 2023, DAG Monaco announced a new safe harbor for voluntary self-disclosures made in connection with mergers and acquisitions (the “M&A Safe Harbor Policy”).[5] The M&A Safe Harbor Policy reiterates and builds upon many of the themes from DOJ’s prior 2023 guidance outlined above.

In her speech announcing the policy, DAG Monaco explained that DOJ encourages acquiring companies to timely disclose any misconduct that they discover during the transaction process. The M&A Safe Harbor Policy states there will be a presumed declination for acquiring companies that 1) promptly and voluntarily disclose within the safe harbor period criminal misconduct, 2) cooperate with the ensuing investigation, and 3) engage in timely and appropriate remediation (including paying restitution and disgorgement).

To qualify for the safe harbor, acquiring companies must disclose misconduct discovered at the acquired entity within six months from the date of closing (regardless of whether the misconduct was discovered pre- or post-acquisition). Then, companies will have one year from the date of closing to fully remediate the misconduct. These timing requirements are subject to a “reasonableness” analysis and can potentially be extended due to the complexity of a particular transaction.

The presence of aggravating factors at the acquired company will not impact the acquiring company’s ability to receive a declination. Absent the presence of aggravating circumstances at the acquired company, it may also qualify for a declination.

On the other hand, companies that do not perform effective due diligence or self-disclose misconduct unveiled at an acquired entity will be subject to full successor liability for that misconduct. Companies will not be permitted to reap the M&A Safe Harbor Policy’s benefits if the misconduct was otherwise required to be disclosed or DOJ was already aware that it occurred.

Early Examples of Declinations

The Criminal Division’s webpage memorializing CEP declinations credits three companies for voluntary self-disclosures since March 2023 (Corsa Coal Corporation (Corsa Coal), HealthSun Health Plans, Inc. (Healthsun), and Lifecore Biomedical, Inc. (f/k/a Landec Corporation) (Lifecore)).

Corsa Coal and Lifecore engaged in schemes to bribe foreign government officials, while Healthsun engaged in a scheme to submit false and fraudulent information to the United States Department of Health and Human Services’ Centers for Medicare & Medicaid Services (CMS) to increase the amount that the company received for certain of its Medicare Advantage enrollees.

Despite the varied fact patterns and corresponding statutory schemes, each declination notes five considerations that guided the government’s decision not to prosecute:

• timely and voluntary self-disclosure of misconduct;
• full and proactive cooperation and agreement to continue to cooperate with any ongoing government investigations and potential future prosecutions;
• the nature and seriousness of the offense;
• timely and appropriate remediation; and
• agreement to disgorge ill-gotten gains the company is able to pay.

For example, the HealthSun declination noted that HealthSun provided all known facts about the misconduct, including providing information about the individuals involved. This effort included the provision of information obtained from imaging several business and personal cell phones. In addition, it terminated employees involved in the misconduct, reported and corrected the false and fraudulent information submitted to CMS, and substantially improved its compliance program and internal controls (through, among other measures, significant investment in designing, implementing, and testing a risk-based and sustainable Medicare Advantage compliance program). The declination also states that HealthSun agreed to immediately remit the approximately $53 million that the government determined CMS overpaid due to the fraudulent scheme.

Each of these declinations stated that the government’s investigation was ongoing and that the company agreed to continue to fully cooperate with the government’s effort, including through the continued provision of information and making available relevant officers, employees, and agents for interviews, testimony, or both.

These examples provide a limited number of data points for companies to consider as they weigh the potential benefits of voluntary self-disclosure. They also demonstrate that the government is eager to provide concrete examples of the benefits available to those who self-disclose, indicating a potential advantage for those willing to come forward as this area remains underdeveloped.

Civil Enforcement

While the policies outlined above apply to corporate criminal enforcement, accompanying comments from those at DOJ have made clear that the overarching policy objectives are equally important in the civil context. For example, when announcing the M&A Safe Harbor Policy, DAG Monaco stated:

The entire Department shares the same principles in both civil and criminal enforcement: (1) holding corporate and individual wrongdoers accountable, (2) incentivizing compliance, self-disclosure, remediation, and cooperation, and (3) deterring and penalizing repeat bad actors. You should expect more to come on this topic as we continue to extend consistent, transparent application of our corporate enforcement policies across the Department, beyond the criminal context to other enforcement resolutions[.]

In the False Claims Act (FCA) context, policy guidance contained in the Justice Manual dating back to 2019, JM § 4-4.112, encourages voluntary self-disclosure, cooperation, and remediation in FCA cases but, unlike the criminal issuances outlined above, it provides few details regarding incentives.[6] In 2023, DOJ publicized the benefits of self-disclosure in four FCA settlements, two of which involved health care fraud allegations.

In June 2023, VitalAxis Inc. (VitalAxis), a Maryland-based billing company for diagnostic laboratories, agreed to pay approximately $300,480 to resolve FCA allegations that it caused the submission of false claims to Medicare for medically unnecessary respiratory pathogen panels run on seniors who received COVID-19 tests. The published settlement agreement specifically credits VitalAxis under JM § 4-4.112 for performing and disclosing the results of an internal investigation and relevant facts not known to the government, providing information relevant to potential misconduct by other individuals and entities, and admitting liability. As part of the settlement, VitalAxis further agreed to cooperate with the government’s investigation into other individuals and entities; encourage the cooperation of its current and former directors, officers, and employees; and furnish complete and unredacted copies of all non-privileged documents, reports, memoranda of interviews, and records concerning any investigation into the relevant conduct it has undertaken. The agreement states that $171,702.62 of the $300,479.58 settlement amount constitutes restitution, which amounts to a 1.75x multiplier.

A few months later, in September 2023, the Northern District of Texas US Attorney’s Office announced a FCA settlement with Oliver Street Dermatology Management LLC d/b/a US Dermatology Partners (“USDP”), which self-reported potential violations of the Stark Law and the Anti-Kickback Statute that allegedly gave rise to FCA liability. USDP self-reported specifics about the potentially illegal conduct, which was unknown to the government at the time of the self-disclosure, and the potential financial impact on the government. Based on a review of the settlement agreement – which mentions self-disclosure and collaboration – USDP paid nearly $8.9 million, including approximately $5.9 million in restitution, which amounts to a 1.5x multiplier.

While each of these settlements did involve a multiplier of less than 2.0x, which is typically what DOJ seeks in FCA settlements, the multiplier ranged from 1.5 – 1.75x, which can be achieved at times in cases that do not involve self-disclosure. However, self-disclosure may offer additional benefits, such as a reduction in legal fees, avoidance of a Corporate Integrity Agreement, and a shorter, less disruptive government investigation.

In sum, DOJ is clearly focused on incentivizing voluntary-self disclosure and already has announced another FCA settlement involving self-disclosure in 2024.[7] Given the relatively low number of available case studies, those companies willing to act as early examples may still be able to reap tangible benefits in 2024. However, the task is not complete upon self-reporting to the government. Companies must be willing to fully cooperate with the ensuing investigation and remediate their misconduct to the government’s satisfaction. Furthermore, to avail themselves of the available benefits, companies should have effective compliance programs that can sufficiently identify misconduct at the outset, as the strongest benefits are reserved for those who are first in the door.