On March 30, 2026, the US Department of Justice (“DOJ”) National Security Division (“NSD”) announced updated guidance clarifying how companies should report voluntary self-disclosures (“VSDs”) of potential criminal violations of US national security laws, including export controls and sanctions, under DOJ’s new department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”). The announcement reflects NSD’s transition away from its prior division-specific VSD policy in favor of the department-wide CEP released on March 10, 2026 (covered in our client alert here), which explicitly supersedes any previously-issued policies by DOJ components or U.S. Attorneys’ Offices, including the NSD’s own Enforcement Policy for Business Organizations, which was last revised in March 2024 (covered by our prior blog post here). Although NSD’s announcement does not introduce new substantive standards for cooperation or remediation, it provides important procedural clarity for companies evaluating whether (and how) to self‑disclose potential national security‑related violations.
Under the updated approach, companies seeking credit for a voluntary self‑disclosure of potential criminal export control, sanctions, or other national security violations should submit that disclosure to DOJ in accordance with the CEP, rather than under NSD’s prior standalone VSD policy. In practice, NSD remains the primary DOJ component responsible for evaluating disclosure involving national security matters, but those disclosures will now be assessed under the Department-wide framework. This alignment provides greater clarity for matters that may implicate multiple DOJ components, such as NSD and a U.S. Attorney’s Office, by ensuring that all components apply the same voluntary self‑disclosure framework under the CEP, rather than their own separate policies. The NSD’s new guidance confirms that all voluntary self-disclosures concerning potential criminal violations of U.S. national security laws should be sent to NSD’s email inbox for voluntary self-disclosures: NSD.VSD@usdoj.gov. The scope of covered matters includes violations of the U.S. Government’s primary export control and sanctions regimes: the Arms Export Control Act (“AECA”), 22 U.S.C. § 2778, the Export Control Reform Act (“ECRA”), 50 U.S.C. § 4801 et seq., and the International Emergency Economic Powers Act (“IEEPA”), 50 U.S.C. § 1701 et seq., as well as other U.S. national security laws. Under the CEP, “disclosure must be made to the appropriate component of the Department,” (which in this context is the NSD) and all resolutions under the CEP “must be approved by the Assistant Attorney General (AAG) for the relevant Division.” That said, a “good faith disclosure to one component where the matter is later brought to another appropriate component for investigation will also qualify” for declination. [justice.gov, Pt. 11, Fn. 5]
The DOJ’s CEP applies only to potential criminal violations and does not affect parallel, non‑criminal voluntary disclosure regimes administered by other agencies, including the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) and the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”), which administer their own VSD regimes and related benefits. Those regimes involve distinct standards and considerations and must be evaluated separately, particularly where there is uncertainty whether identified conduct constitutes a potential civil violation or rises to the level of a potential criminal offense. Importantly, a civil voluntary disclosure made solely to OFAC or BIS, without a corresponding disclosure to DOJ, will not qualify for criminal VSD credit under the DOJ CEP.
NSD reiterated that VSDs remain a critical factor in DOJ’s charging decisions and may result in significant credit where companies meet DOJ’s standards for prompt disclosure, full cooperation, and timely remediation. The CEP now provides that qualifying companies will receive a declination of prosecution — a shift from the superseded NSD Enforcement Policy, which provided that when a company (1) voluntarily self-disclosed to NSD potentially criminal violations arising out of or relating to the enforcement of sanctions or export controls laws, (2) fully cooperated, and (3) timely and appropriately remediated the violations, and absent aggravating factors, NSD would generally not seek a guilty plea and there was a presumption that the disclosing company would receive a non-prosecution agreement and would not pay a fine. Companies considering VSDs of potential national security law violations should carefully review the requirements of the new CEP, together with the VSD regimes of other implicated agencies.
