Key Questions Remain Under DOJ’s New Department-Wide Corporate Enforcement Policy

The announcement was not unexpected. In December 2025, U.S. Deputy Attorney General (DAG) Todd Blanche disclosed DOJ’s plan to issue a single, uniform CEP. In anticipation of the announcement, we highlighted the differences among the then-existing corporate enforcement policies and discussed questions that might be answered by the new CEP. In this article, we evaluate the extent to which the CEP answers those questions and identify outstanding issues that remain.

Q1: What are the specific benefits available; how will the DOJ promote transparency and predictability for those outcomes; and what procedures will ensure that credit for deserving companies will be applied equitably within and across components?
The CEP largely mirrors the structure and three-part framework of the Corporate Enforcement and Voluntary Disclosure Policy issued by the Criminal Division (CRM) in 2025. Indeed, the CEP was announced by DAG Blanche and CRM’s newly confirmed U.S. Assistant Attorney General A. Tysen Duva, who explained that the CEP “takes the principles of disclosure, cooperation, and remediation” from CRM’s policy and “applies them uniformly across the Department.”

Under Part I of the CEP, like CRM’s policy, DOJ will provide a declination when:

(1) a company voluntarily self-discloses misconduct to an appropriate component;

(2) the company fully cooperates with DOJ’s investigation;

(3) the company timely and appropriately remediates; and

(4) there are no aggravating circumstances relating to: the nature and seriousness of the offense, the egregiousness or pervasiveness of misconduct, the severity of harm, or corporate recidivism (defined as a criminal adjudication or resolution either (a) within the last five years or (b) based on similar misconduct).

Even if there are aggravating circumstances, prosecutors retain the discretion to recommend a CEP declination. Any CEP declination will require a company to pay all disgorgement/forfeiture and restitution/victim compensation resulting from the misconduct.

Under Part II—if a company otherwise qualifies for Part I but either (1) its good-faith self-report did not qualify as a voluntary self-disclosure (VSD) or (2) there are aggravating factors that warrant a criminal resolution—then DOJ shall: (a) provide a Non-Prosecution Agreement (NPA) (unless there are “particularly egregious or multiple aggravating circumstances”) for a term of less than three years; (b) not require an independent compliance monitor; and (c) reduce the applicable fine by 50% to 75% from the low end of the range established by the U.S. Sentencing Guidelines. (Part II is nearly identical to CRM’s 2025 policy, except that CRM’s policy authorized a uniform 75% fine reduction for all Part II resolutions.)

Under Part III—which applies to companies that are not eligible for a resolution under Part I or Part II—prosecutors have discretion to determine the appropriate resolution, including form, term, compliance obligation and monetary penalty, provided the fine reduction is not more than 50%. For companies that fully cooperate and timely and appropriately remediate, there will be a presumption that the reduction will be taken from the low end of the Guidelines range; otherwise, prosecutors will determine the starting point based on the facts and circumstances of the case, including (but not limited to) the company’s recidivism.

The CEP attempts to ensure uniformity, predictability and fairness across DOJ components by applying this three-path framework Department-wide, superseding all existing policies (with one exception for antitrust offenses). It also provides—as the 2025 CRM policy did—standardized guidance by including detailed definitions of terms like “fully cooperate” and “timely and appropriately remediation.”

Like CRM’s 2025 policy, though, the CEP permits the exercise of prosecutorial discretion, which could lead to disagreements between prosecutors and companies about, for example, whether circumstances are “aggravating” or whether a disclosure was sufficiently “prompt.” Accordingly, the manner in which prosecutors across various components exercise their discretion—and the degree to which the DAG influences proposed resolutions—will shape whether the CEP delivers on DOJ’s goals of uniformity, predictability and fairness. And, when it comes to a company’s decision whether to make a VSD, predictability is a particularly significant factor.

Q2: What tools will the CEP employ to speed up investigations and resolutions, in light of DOJ’s loss of agents and prosecutors over the past year?
The CEP is intended to accelerate corporate enforcement by reducing negotiating uncertainty through the three-part framework described above. In addition, the CEP incentivizes faster disclosures and closer cooperation through the following features, among others:

• Incentivizing early disclosure by encouraging companies to disclose before completing internal investigations;
• Promoting ongoing cooperation by encouraging companies to make rolling disclosures rather than waiting for final reports; and
• Requiring deconfliction by authorizing prosecutors to request that companies pause internal investigations if they conflict with DOJ’s own investigations.

The new CEP does not, however, implement any specific time constraints, nor does it directly address DOJ’s decreased staffing. Moreover, involvement by the Office of the Deputy Attorney General (ODAG), discussed below, could add some uncertainty as to the specific procedures that will be used to vet proposed resolutions and the timeline for such resolutions.

Q3: How will the new CEP limit monitorships? Will it follow the Criminal Division’s lead?
In Part II resolutions, the CEP presumes there will be no corporate monitor, following CRM’s previous approach. In Part III cases, the CEP—like CRM’s 2025 policy—grants prosecutors the discretion to impose a monitor but neither expressly endorses nor explicitly rejects CRM’s previous guidance on the exercise of that discretion.

Q4: How will the CEP balance corporate and individual accountability?
Like CRM’s 2025 policy, the CEP reinforces DOJ’s longstanding prioritization of individual accountability by making full cooperation credit contingent on whether companies (1) identify all individuals involved in the misconduct and (2) disclose all relevant facts about the culpable individuals.

Q5: How will the CEP allow components to evaluate circumstances that are unique to their particular enforcement programs?
As previously described, Department components maintain some degree of flexibility to apply the new CEP through their specific enforcement programs. For example, whether there are “aggravating circumstances” or whether a company has remediated the misconduct will be highly context-specific and, therefore, amenable to component-level priorities.

Significantly, the CEP does not apply to antitrust violations under 15 U.S.C. §§ 1–38. Accordingly, the Antitrust Division’s (ATR’s) Leniency Policy, which covers violations of the Sherman Antitrust Act (15 U.S.C. §§ 1, 3(a)), will continue to govern those cases. In addition, the CEP expressly preserves the prior Department-wide Mergers & Acquisitions (M&A) Policy, which continues to apply to misconduct identified in connection with M&A diligence and reported within six months of the closing of an acquisition. While the CEP expressly incorporates the M&A Policy, the CEP is silent on whether components continue to have flexibility—as they have had previously—to tailor their approach to M&A disclosures to component-specific priorities.

Q6: Will the new CEP incorporate various compliance programs that apply to distinct areas, including CRM’s Evaluation of Corporate Compliance Programs (ECCP), ATR’s Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations or the Export Compliance Guidelines issued by the National Security Division (NSD)?
Like CRM’s policy, the CEP defines “timely and appropriate remediation” to include the implementation of “an effective compliance and ethics program,” and it includes a non-exhaustive list of criteria for evaluating whether a compliance and ethics program is “effective.” However, the CEP does not explicitly supplant or replace component-level criteria. This suggests that components remain free to implement their existing guidelines in determining what “effective compliance” means in individual cases.

While this approach may introduce some variability in DOJ’s corporate enforcement program, at the same time it provides a degree of predictability for companies that had been evaluating their existing compliance programs based on component-level guidelines in distinct enforcement areas. It is also consistent with the general principle that compliance programs should be tailored to specific risks—i.e., an export compliance program is different from antitrust compliance program because they focus on distinct risks and issues.

Q7: How will the CEP interact with whistleblower programs and other incentives?
The CEP expressly incorporates CRM’s Corporate Whistleblower Awards Pilot Program. However, the CEP also does not explicitly replace or reject other Department whistleblower programs, such as the Antitrust Whistleblower Rewards Program, nor does it affect the False Claims Act’s qui tam process. For more on these issues, see DOJ’s First Antitrust Whistleblower Award: The New “Race to Report” and What Companies Should Do Now.

As with CRM’s policy, a company may still obtain a declination notwithstanding a prior whistleblower report as long as the company makes its report “as soon as reasonably practicable but no later than 120 days” after receiving the whistleblower report internally. Consequently, the CEP continues to incentivize companies to strengthen their internal reporting mechanisms and to make prompt self-disclosures. By expressly seeking VSDs before internal investigations are completed, the CEP could make it easier for companies to make faster disclosures.

Q8: Who will enforce compliance with the policy? Should all corporate resolutions now be appealed directly to the ODAG?
All CEP resolutions must be approved by the Assistant Attorney General for the relevant component and/or the U.S. Attorney for the relevant district. The CEP further requires “coordination” with ODAG or CRM, as required by existing Justice Manual (JM) provisions (though, notably, the CEP contains no reference to NSD’s unique authorities under the JM). While the CEP does not contain any formal mechanism for ensuring cross-component compliance, application of certain JM requirements will likely result in ODAG reviewing most—if not all—proposed CEP resolutions.

*          *          *          *

While the CEP answers many questions, it raises others. Below we outline a few that companies may wish to evaluate on a case-by-case basis.

How Much Discretion Will Prosecutors Actually Exercise?
While the CEP is framed as a rule‑based, three‑tier framework, DOJ expressly preserves broad prosecutorial discretion at key decision points, including:

• whether a self-disclosure is “reasonably prompt” and whether cooperation is “timely”;
• whether aggravating factors are “significant” enough to defeat a declination, or “particularly egregious” so as to defeat an NPA;
• whether a “near‑miss” self‑disclosure qualifies for Part II treatment;
• where within the 50%–75% fine‑reduction range a Part II case will be resolved;
• whether a compliance and ethics program is “effective”; and
• the starting point and fine-reduction range that apply to a Part III resolution.

The Boundaries of “Aggravating Circumstances”
Although the CEP lists examples (such as egregiousness, pervasiveness, harm and recidivism), it does not define thresholds. Thus, questions may arise, including:

• How “similar” must prior conduct be?
• Can resolved regulatory matters count?
• How much cooperation and remediation is sufficient to offset aggravation?

Interaction with Parallel Regulators 
The CEP reiterates that a disclosure to a regulator other than DOJ generally does not qualify as a VSD, though “good faith disclosures” could qualify “if appropriate under the circumstances,” as determined “at the discretion of the Department.” This raises additional questions, including:

• What are the circumstances in which a “good faith disclosure” to another entity could qualify as a VSD to DOJ?
• Should companies re-think “parallel‑first” disclosure strategies, where companies disclose potential misconduct to all potential enforcers at the same time?
• How will disclosures to the SEC, CFTC, or state or foreign enforcers affect DOJ’s cooperation and remediation analysis?

While the CEP makes significant steps to promote uniformity, it highlights a new structure of risks and rewards for companies considering whether to self-report misconduct. For boards and counsel, the decision whether—and when—to self‑disclose remains a fact‑intensive, risk‑weighted calculation, and not a mechanical safe harbor.