Voluntary Self-Disclosure: Is the Value Self-Evident?

The July 26 joint compliance note describes the voluntary self-disclosure (VSD) policies of the DOJ's National Security Division (NSD), BIS and OFAC relating to sanctions, export controls and national security violations. The note also covers recent updates to these policies, as well as information about the Financial Crime Enforcement Network's (FinCEN) Anti-Money Laundering and Sanctions Whistleblower Program.

DOJ leadership has emphasized since 2022 that sanctions and trade controls are the so-called "New FCPA," i.e., a key U.S. enforcement priority with global scope and significant compliance expectations. OFAC sanctions programs have played an increasingly key role in U.S. foreign policy and have been used extensively in response to Russia’s ongoing invasion of Ukraine. BIS dual-use and commercial export controls have been used to address U.S. concerns with China and Russia, and its expanded use of Entity List and denial order tools, along with policies to assert U.S. jurisdiction over the foreign-manufactured direct product of U.S. technology and software, have increased compliance risk for U.S. and non-U.S. companies alike.

In this environment, the use of a Tri-Seal note to reiterate existing VSD policies highlights the U.S. commitment to enforcement, an evolving cooperation between the civil agencies and DOJ, and the importance of voluntary disclosure in the eyes of U.S. officials. The announcement comes in the wake of a massive and highly publicized new resource commitment by the DOJ to its National Security Division to enforce corporate violations of sanctions and trade controls. Given that violations carry a five-year statute of limitations, the prospect of expanding DOJ enforcement with more aggressive "FCPA-scale" penalties could begin to impact the risk calculation of companies in considering (1) voluntary disclosures; and (2) DOJ disclosures in addition to civil disclosures to BIS and OFAC in cases where a company sees evidence of willful or knowing conduct. "The benefits of VSD are clear," the note states. The agencies now will have to monitor how U.S. and non-U.S. companies respond.

The "New FCPA"
In May 2022, U.S. Deputy Attorney General Lisa O. Monaco referred publicly to U.S. sanctions enforcement as the "New FCPA." In likening sanctions to the U.S. Foreign Corrupt Practices Act (FCPA), Deputy AG Monaco indicated that sanctions and trade controls enforcement would receive the resource commitment and focus on large-scale penalties applied to U.S. anti-corruption efforts. In June 2022, again discussing the "New FCPA," Monaco emphasized that all companies engaging in the cross-border sale, shipment or sourcing of U.S.-origin items must adopt thoughtful compliance programs—and rigorously test and improve those programs over time. As she said:

Every [multinational company and company with an international supply chain] needs to be pressure-testing its sanctions compliance program, for instance through risk assessments, technology upgrades and industry benchmarking. Every board of directors of such a company should be inquiring whether it is conducting necessary oversight of the company’s sanctions controls. Every corporate officer should be committed to ensuring they have the programs, culture, personnel and counsel to identify problem areas and navigate the rapidly changing landscape. And for anyone who seeks to evade sanctions, the warning is simple: the Justice Department is coming for you. (Emphasis added.)

In March of 2023, Monaco announced that the DOJ is restructuring its National Security Division and plans to add 25 new prosecutors, including the first-ever Chief Counsel for Corporate Enforcement, to focus on efforts to evade sanctions, trade controls and other national-security-related crimes.

Voluntary Self-Disclosure: Does Increased Criminal Enforcement Impact Considerations?
Despite the "New FCPA" slogan, enforcement of U.S. sanctions and trade controls has decades of history with major actions by BIS, OFAC and in some cases the DOJ, with fines of hundreds of millions or billions of dollars. While voluntary disclosure is truly voluntary, i.e., not required by law, BIS and OFAC have well-developed and long-standing voluntary disclosure policies that U.S. and non-U.S. companies have used for years to mitigate risk where enforcement appears possible, to allow a company to create certainty about liability for past activity, to facilitate relationship management with the U.S. government, or even where one company wants to call attention to a competitor’s misconduct. However, BIS and OFAC only have the resources to pursue a select number of cases, and most voluntary disclosures result in no or small civil fines. It is unclear how effective the processes have been for the DOJ/NSD to become aware of or receive criminal referrals as a result of BIS or OFAC disclosures.

The DOJ has sought to invite more voluntary disclosures of sanctions and export control violations, but with limited success to date. Companies with violations have had options to voluntarily disclose to civil authorities in BIS and OFAC and may have questioned whether it made sense to make an additional disclosure that might raise the possibility of criminal liability. The Criminal Division has included generally applicable voluntary disclosure policies in its Corporate Enforcement Policy since 2018 (growing out of an earlier, FCPA-specific voluntary disclosure program), and the NSD's Counterintelligence and Export Control Section (CES) announced its own VSD policy in December 2019 to encourage DOJ disclosure as an option in sanctions and export control cases. In January 2023, the Assistant Attorney General for the Criminal Division announced revisions to the Corporate Enforcement Policy and further incentives for voluntary disclosures.

In this context, the DOJ is bolstering NSD capacity while sanctions and trade controls administered by the OFAC and BIS continue to expand in scope and geopolitical importance. The DOJ hopes to incentivize disclosure under its programs. The July 26 joint compliance note summarizes the current state of voluntary self-disclosure programs at the DOJ's National Security Division (NSD), BIS and OFAC, and thus offers useful information to companies that discover potential violations. The note also provides information regarding the FinCEN's Anti-Money Laundering and Sanctions Whistleblower Program. Specifically:

• DOJ. In March 2023, the NSD issued an updated VSD policy covering potential criminal violations of export control and sanctions laws. Like the Corporate Enforcement Policy, the NSD’s policy provides incentives for companies and other organizations to (1) voluntarily self-disclose potentially criminal violations to the NSD; (2) cooperate fully with the NSD, including in any investigation; and (3) timely and appropriately remediate potential issues. Where the NSD determines that a company has taken all three steps, and in the absence of certain aggravating factors, the NSD "generally will not seek a guilty plea, and there will be a presumption that the company will receive a non-prosecution agreement and will not pay a fine." The company still must disgorge all profits associated with the identified misconduct.

The NSD's disclosure policy provides an extensive list of factors that the Division will consider in determining whether a company qualifies for VSD incentives. These factors relate to whether a disclosure is timely and truly voluntary, how cooperative a discloser is in making the disclosure, and whether the discloser has taken appropriate steps to remediate identified issues. In addition, a company cannot obtain the benefits of VSD if certain aggravating factors exist. These factors include egregious or pervasive criminal misconduct within the company, concealment or involvement by upper management, repeated administrative and/or criminal violations of national security laws, the export of items that are particularly sensitive or to end users of heightened concern, and significant profit from the disclosed misconduct. When any aggravating factors are identified, the NSD has the discretion to seek a deferred prosecution agreement or even a guilty plea despite the VSD.

• BIS. The BIS VSD policy can be found in Section 764.5 of the Export Administration Regulations (EAR) and on the Export Enforcement website. Under the policy, a disclosure that is timely, comprehensive and involves full cooperation of the disclosing party reduces the applicable civil penalty under BIS settlement guidelines, or can result in no action. Even in egregious cases, a VSD can result in a base penalty amount reduced up to one-half of the statutory maximum applicable to the violation. In June 2022, the BIS Office of Export Enforcement (OEE) implemented a dual-track system to handle VSDs. VSDs involving minor or technical infractions are now resolved on a fast-track basis, with the issuance of a warning or no-action letter within 60 days of final submission.

In April 2023, BIS updated its enforcement policy to further incentivize outreach by companies via stick and carrot. If a company becomes aware of a possible violation with significant impacts for U.S. policy and does not disclose voluntarily, BIS will treat non-disclosure as an aggravating factor. At the same time, BIS encourages the disclosure of potential export controls violations committed by others. If an entity becomes aware that another party is potentially violating the EAR and submits a tip to the OEE, the OEE will consider that a mitigating factor under the penalty guidelines if the information leads to an enforcement action and if the disclosing entity faces an enforcement action in the future (even if unrelated).

• OFAC. For the OFAC, VSDs are a mitigating factor when the Office decides what enforcement action to take in a particular case. In cases where a civil monetary penalty is warranted, moreover, a qualifying VSD "can" result in a 50 percent reduction in the base amount of a proposed civil penalty. Qualifying VSDs must occur prior to or simultaneous with the discovery by the OFAC or another government agency of the apparent violation or a substantially similar apparent violation. Unlike the NSD’s policy, which requires that VSDs be made to the NSD specifically, the OFAC will consider "on a case-by-basis" whether VSDs to another agency will qualify as a VSD to the OFAC.

Disclosures to the OFAC will not qualify as VSDs under certain circumstances. These circumstances include: when a third party is required to notify the OFAC of the apparent violation (e.g., because the transaction was blocked); the disclosure includes false or misleading information; the disclosure is not self-initiated (e.g., when the disclosure results from the suggestion or order of a federal or state agency or official); and for entities, when disclosure is made by an individual at the company/organization without the authorization of the entity's senior management. Persons disclosing violations also must be responsive to follow-up inquiries from the OFAC.

• FinCEN. The July 26 joint compliance note further highlights the monetary rewards available for the reporting in certain circumstances of violations of U.S. trade and economic sanctions (as well as the Bank Secrecy Act). The note explains that FinCEN maintains a whistleblower program designed to incentivize individuals in the United States and abroad to report suspected violations of these regulations—individuals who provide information to the FinCEN or the DOJ "may be eligible for awards totaling between 10 to 30 percent of the monetary sanctions collected in an enforcement action, if the information they provide ultimately leads to a successful enforcement action." In certain circumstances, the FinCEN may also pay awards to whistleblowers whose information led to the successful enforcement of a "related action," meaning that the agency could pay awards on enforcement actions taken under authorities such as the Export Control Reform Act.

Conclusion
The July 26, 2023, joint compliance note from the DOJ, BIS and OFAC highlights existing VSD policies and does not identify new priorities or obligations. Nevertheless, the note is a helpful reminder of the significance that U.S. authorities place on VSD—and their hope that the private sector will take more initiative in detecting and reporting violations.

Given U.S. authorities' stated intent to keep ramping up compliance and export controls enforcement, companies with multinational operations and supply chains will need—in the face of potential violations—to consider carefully whether VSD is an appropriate course of action. BIS and OFAC voluntary disclosure procedures are well-established, and both U.S. and non-U.S. companies have frequently used these channels to manage risk in the case of both inadvertent violations and misconduct. The DOJ has had less success in encouraging voluntary disclosures that admit potential criminal violations, including where civil disclosure options exist via BIS and OFAC, and also perhaps due to the significant discretion retained by the DOJ under current policies not to award available credit to disclosures. Regardless of how one views the merits of voluntary self-disclosure, this recent joint compliance note is yet another data point showing that U.S. authorities expect companies with cross-border operations and supply chains to be adopting, testing, improving and maintaining robust compliance programs.