The United States Environmental Protection Agency (EPA) took steps to modernize implementation of its audit^[1] and small business compliance^[2] policies when it launched a web-based “eDisclosure portal” on December 9, 2015^[3], in order to receive and process self-disclosed violations. EPA developed the eDisclosure system to make it easier for members of the regulated community to disclose violations to EPA and for EPA to process those disclosures.

EPA’s Audit and Small Business Compliance Policies provide incentives for regulated entities to self-disclose environmental violations in an effort to attain compliance. These incentives include significant penalty reductions, non-pursuit of criminal prosecution, protection of underlying audit documents and exemption from routine audit report requests. EPA retains its discretion to collect any economic benefit that may have been realized by the violating party because of its noncompliance with applicable rules and regulations.

Eligibility for these mitigation measures is based on the following conditions. The disclosing entity must:

• Discover the violation through a voluntary, independent and systemically conducted audit;

• Disclose the violation within 21 days of discovery;

• Correct and remediate the violation within 60 days of discovery;

• Cooperate with EPA; and

• Take measures to prevent the violation from recurring.

EPA’s policies do not allow these incentives for certain, serious violations that involve actual harm or imminent and substantial endangerment, or violations that have been repeated at the same facility in the past three years or at multiple facilities owned or operated by the same entity in the past five years.

To submit an electronic self-disclosure, entities must register with EPA’s Central Data Exchange (CDX) system at cdx.epa.gov. Consultants, attorneys and other agents will be allowed to disclose violations through the eDisclosure portal on behalf of a regulated entity. EPA has not designed the eDisclosure system to manage Confidential Business Information (CBI). Any disclosures submitted through the eDisclosure system must be scrubbed of CBI before submission, and any CBI that is a necessary component of the disclosure must be submitted according to EPA procedures and requirements in 40 C.F.R. Part 2.

Disclosures are grouped into two categories, Tier 1 and Tier 2. Tier 1 disclosures include certain Emergency Planning and Community Right-to-Know Act (EPCRA) violations that meet all Audit Policy or Small Business Compliance Policy conditions[4]. The eDisclosure portal will automatically issue an electronic Notice of Determination for Tier 1 disclosures, confirming that the violations are resolved with no civil penalties, conditioned upon the accuracy and completeness of disclosure. EPA will “spot check” Tier 1 disclosures and most will receive fast-track processing with little to no review from EPA.

Tier 2 disclosures will include all non-EPCRA violations, EPCRA violations with respect to which the regulated entity cannot meet the Audit Policy’s “systematic discovery” condition but can meet its other conditions and EPCRA/CERCLA violations excluded from Tier 1. For Tier 2 disclosures, the eDisclosure portal will automatically issue an electronic acknowledgment letter confirming receipt of the disclosure and stating that EPA will make a determination regarding penalty mitigation if it decides to take enforcement action.

Although EPA has designed the eDisclosure portal to handle disclosures for violations that arise outside the context of upfront audit agreements with EPA, EPA has indicated that it is willing to continue negotiating such agreements in some situations. For violations that fall into Tier 2, an upfront audit agreement may provide more certainty in terms of penalty mitigation as compared to the new process disclosures under the eDisclosure portal.