This site uses cookies to provide you with a more responsive and personalized service. By using this site you agree to our use of cookies. You can learn more about our use of cookies and similar technologies and your choices by reviewing our Privacy Policy. By clicking “I agree” you agree to our use of cookies and similar technologies.
The DOJ’s New Corporate Enforcement Policy: What It Means for Your Company — and Your Internal Investigations
Last month, the Department of Justice released its first-ever department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), establishing a single framework for how the DOJ handles corporate criminal matters across all of its components and U.S. Attorney’s Offices. The policy replaces a patchwork of division-specific policies that had created inconsistency for companies navigating potential criminal exposure.
Deputy Attorney General Todd Blanche stated that the policy “. . . creates incentives for companies to come forward and do the right thing when misconduct occurs so that we may hold accountable the individual wrongdoers.”[1] He warned, however, that for companies that choose not to self-disclose, the DOJ “will not hesitate to seek appropriate resolutions against companies and individuals alike that perpetrate white collar offenses that harm American interests.” Id. Assistant Attorney General A. Tysen Duva emphasized the policy’s continuity, noting it “takes the principles the [Criminal] Division has long promoted — disclosure, cooperation, and remediation — and applies them uniformly across the Department.” Id.
The CEP applies to all corporate criminal matters except antitrust violations.
The Three-Tiered Framework
Part I: Declination. The DOJ will decline to prosecute when a company voluntarily self-discloses misconduct, fully cooperates, timely remediates, and there are no aggravating circumstances. This is a guaranteed declination. Companies must still pay the full amount of all disgorgement, forfeiture, and restitution.[2]
Part II: “Near miss” resolutions. Companies that cooperated and remediated but whose disclosure didn’t technically qualify as “voluntary,” or that had aggravating factors, can still receive a non-prosecution agreement with a term of fewer than three years, no monitor, and a fine reduction of 50–75% off the low end of the Sentencing Guidelines range. They are also promised a Non-Prosecution Agreement of less than three years that does not require a compliance monitor. Id.
Part III: All other cases. Full prosecutorial discretion, with fine reductions capped at 50%. Id.
The CEP in Action: Balt SAS
Nine days after the CEP was released, the DOJ announced its first resolution under the policy — a Part I declination for Balt SAS, a French medical device company investigated for FCPA violations involving approximately $602,000 in bribes to a physician at a state-owned hospital in France.
AAG Duva called the resolution a demonstration of “the value of voluntarily self-reporting wrongdoing to the Department of Justice,” adding that the “related indictment of two individuals associated with Balt demonstrates the Criminal Division’s unwavering pursuit of culpable individuals.”[3]
The Balt resolution is instructive. The DOJ credited the company for its disclosure while its internal investigation was still ongoing. The company provided “full and proactive cooperation,” including identifying the individuals involved, remediating by disciplining personnel, terminating problematic business relationships, and improving its compliance program. Id. At the same time, two individuals were indicted — underscoring that corporate cooperation does not shield individuals from prosecution.
What This Means for Internal Investigations
The CEP fundamentally changes how companies need to resource and conduct internal investigations.
Speed is now the central imperative. The DOJ wants disclosures early, even before an internal investigation is complete. The Balt declination reinforced this: the company disclosed while its investigation was still ongoing. Companies that wait for certainty before disclosing may find themselves outside the window for the most favorable outcomes. The investigation and the disclosure decision now need to run in parallel.
The 120-day whistleblower clock. If a whistleblower reports internally and also files with the DOJ, the company can still qualify for a declination, but only if it self-reports “. . . as soon as reasonably practicable but no later than 120 days after receiving the whistleblower’s internal report.”[4] Companies need investigation processes capable of moving from complaint to disclosure-ready assessment within roughly four months.
Cooperation requirements shape the investigation itself. The CEP requires companies to identify all individuals involved regardless of rank, attribute facts to specific sources rather than generalized narratives, make rolling disclosures, preserve and produce documents including those overseas, and de-conflict witness interviews with the DOJ’s investigation. An investigation that produces only a general summary will not meet the standard. The DOJ wants granular, source-attributed facts about who did what.
Remediation requires root cause analysis. It is not enough to discipline the bad actors. Companies must demonstrate they understand the systemic failures that allowed misconduct to occur and have taken concrete steps to address them.
Individual accountability runs alongside corporate cooperation. The Balt resolution made this unmistakable: on the same day the company received a declination, two individuals were indicted. Companies must understand that cooperating, including identifying individuals and making employees available for interviews, will directly contribute to the government’s ability to bring charges against those people.
How Can Companies Meet CEP Demands
The CEP places enormous pressure on companies to detect misconduct early, investigate it quickly and thoroughly, and present findings in a format that satisfies demanding cooperation standards — all while remediating root causes and navigating individual accountability. For many organizations, that represents a significant gap between current capabilities and what the CEP now demands.
That gap is best closed by engaging independent experts, like Guidepost, who can work under in-house lawyers or outside counsel to protect privilege and have structured investigations around government expectations before, and who know what prosecutors will actually scrutinize.
Rapid-response internal investigations. When an allegation surfaces, the initial assessment needs to happen fast. An outside team of experienced investigators, working under in-house lawyers or outside counsel, can quickly evaluate scope and severity, preserve evidence, and provide leadership with the factual foundation needed for an informed disclosure decision. Under the CEP, moving from allegation to preliminary assessment in days or weeks — not months — can be the difference between a Part I declination and a Part III outcome.
Fact-finding that meets DOJ standards. An investigation built for DOJ scrutiny looks different from a standard compliance review. It attributes facts to specific sources. It identifies all individuals involved regardless of rank. It is organized around the questions prosecutors will ask, not around the questions the company finds most comfortable. Independent investigators who have worked on the government’s side of these matters understand that distinction from firsthand experience, and they build the record accordingly.
Witness interview management. Managing interviews under the CEP requires balancing the company’s need for facts, the DOJ’s de-confliction requests, employees’ rights, and privilege. An investigative team that has navigated these dynamics in prior government-facing matters is far better positioned to get the facts the company needs without creating problems for the investigation or for the individuals involved.
Root cause analysis and remediation. Companies must be able to show prosecutors that they understand what structural, cultural, or procedural conditions allowed the misconduct to occur and that they have taken concrete steps to address those conditions. That analysis requires objectivity and credibility that internal teams often cannot provide on their own.
Compliance program assessments. The CEP ties favorable outcomes to having an effective compliance program with adequate resources, independence, and testing. Companies must evaluate their existing program against the DOJ’s expectations and implement improvements that position companies to capture the policy’s benefits before misconduct is discovered.
Whistleblower readiness. The 120-day window means companies need robust internal reporting mechanisms and the ability to escalate and act on complaints quickly. An outside expert can help design and stress-test these processes to meet the CEP’s timeline.
Guidepost works with companies across all of these areas, from rapid-response investigations and DOJ-ready fact-finding to compliance program assessments and whistleblower readiness. Our team includes former federal prosecutors and experienced investigators who have worked these matters from both sides of the table.
The Bottom Line
The DOJ has told companies exactly what it expects and exactly what it will reward. The benefits are substantial: guaranteed declination, no monitor, reduced penalties. The consequences for falling short are left to prosecutorial discretion.
The question for most organizations is whether they have the investigative speed, rigor, and compliance infrastructure to take advantage of the policy when it matters most. The time to answer that question is before an allegation arrives, not after.[5]
The full text of the CEP is available on the DOJ’s website.
[1] U.S. Dep’t of Justice, Office of Public Affairs, Press Release No. 26-230, “Department of Justice Releases First-Ever Corporate Enforcement Policy for All Criminal Cases” (March 10, 2026), https://www.justice.gov/opa/pr/department-justice-releases-first-ever-corporate-enforcement-policy-all-criminal-cases.
[2] U.S. Dep’t of Justice, Corporate Enforcement and Voluntary Self-Disclosure Policy (March 10, 2026), https://www.justice.gov/dag/media/1430731/dl?inline
[3] U.S. Dep’t of Justice, Office of Public Affairs “Justice Department Resolves Foreign Bribery Investigation with Balt SAS; Healthcare Executive and Sales Consultant Indicted in Alleged Years-Long Foreign Bribery Scheme” (March 19, 2026), https://www.justice.gov/opa/pr/justice-department-resolves-foreign-bribery-investigation-balt-sas-healthcare-executive-and
[4] U.S. Dep’t of Justice, Corporate Enforcement and Voluntary Self-Disclosure Policy (March 10, 2026), https://www.justice.gov/dag/media/1430731/dl?inline
[5] It should also be noted that the Department is creating a “new division for national fraud enforcement . . . [to] enforce criminal and civil laws against fraud targeting Federal government programs.” White House, Fact Sheet: President Donald J. Trump Establishes New Department of Justice Division for National Fraud Enforcement (Jan. 8, 2026), https://www.whitehouse.gov/fact-sheets/2026/01/fact-sheet-president-donald-j-trump-establishes-new-department-of-justice-division-for-national-fraud-enforcement/ Government contractors and grantees may be subject to more scrutiny than ever before from this new Division exercising centralized control, authority, and resource allocation in this area.
MSU Institutional Assessment + RAMAGELLAN MonitorshipEmpire/Liberty Review