On December 13, 2019, the US Department of Justice’s (“DOJ”) National Security Division (“NSD”) released a revised policy regarding voluntary self-disclosures of willful export control and sanctions violations (the “Policy”). The Policy reiterates DOJ’s commitment to pursue willful violations of export control and sanctions violations, and supersedes the DOJ’s “Guidance Regarding Voluntary Self-Disclosures, Cooperation, and Remediation in Export Control and Sanctions Investigations Involving Business Organizations,” dated October 2, 2016 (“2016 Guidance”).
The Policy clarifies the requirements for companies seeking to receive credit for voluntary self-disclosures (“VSD”) of willful export control or sanctions violations, and sets forth the potential benefit to companies who meet the requirements set forth in the Policy.
Under the Policy, companies that: (i) voluntarily self-disclose willful export control or sanctions violations to NSD’s Counterintelligence and Export Control Section (“CES”), (ii) fully cooperate with CES in its investigation of the conduct, and (iii) timely and appropriately remediate the conduct and circumstances that led to the violations, will benefit from a presumption of non-prosecution and only be required to disgorge ill-gotten gains, provided that no aggravating factors exist in relation to the conduct. The standards that a company must meet in order to obtain the benefit are set out in the Policy and are discussed in more detail below.
Criteria for Voluntary Self-Disclosure, Full Cooperation and Timely and Appropriate Remediation
Voluntary Self-Disclosure
- To be considered voluntary, the Policy requires that a company disclose to CES all relevant facts known to the company at the time of the disclosure, including those about individuals substantially involved, prior to an imminent threat of disclosure or government investigation, and within a “reasonably prompt time” after becoming aware of the offense.
- The standard for a voluntary self-disclosure under the Policy is not a meaningful departure from the standard set out in the 2016 Guidance. However, the Policy makes clear in terms that were not included in the 2016 Guidance that when a company chooses to report potentially willful conduct to only a regulatory agency such as OFAC or BIS and not the DOJ, the company will not qualify for the benefits of a VSD under the Policy in any subsequent DOJ investigation. The clear language in the Policy with respect to the timing of the disclosure serves as a stark reminder to companies that they must give careful consideration as to whether the conduct at issue was willful when engaging in the complex analysis that goes into a voluntary disclosure decision.
Full Cooperation
- The Policy states that a company seeking to receive credit for full cooperation with CES must follow the Principles of Federal Prosecution of Business Organizations and sets out five additional actions that will be required of the company. The five additional requirements include: (i) disclosure on a timely basis of all facts relevant to the potential violations, (ii) proactive (rather than reactive) cooperation with CES, (iii) timely preservation and disclosure of relevant documents (including documents located overseas), (iv) de-confliction of witness interviews and other internal investigation steps with CES, and (v) making relevant personnel available for interviews.
- With respect to the timely disclosure of relevant documents, the Policy states that when a company claims that disclosure of overseas documents is prohibited due to data privacy, blocking statutes, or other reasons related to non-US law, the company bears the burden of establishing the prohibition. As a practical matter, this means that the DOJ will expect the company to take all measures necessary to produce as much information as it can consistent with the foreign legal prohibitions of which the company claims to be bound. This could mean costly exercises to redact portions of documents that contain information that may not be produced to the DOJ on account of the law of the jurisdiction where the documents are located.
- The Policy makes clear that eligibility for cooperation is not contingent on a waiver of the attorney-client privilege or work product protection. In regards to de-confliction, the Policy notes that the DOJ will not take any steps to affirmatively direct a company’s internal investigation, although it may request that a company refrain from taking a certain action for a limited period of time.
Timely and appropriate remediation
- The Policy sets out five components of appropriate remediation required for the award of full credit under the Policy. These include: (i) thorough analysis of root causes of the underlying violations; (ii) implementation of an effective compliance program; (iii) appropriate discipline of employees; (iv) appropriate retention of business records; and (iv) other steps that “demonstrate recognition of the seriousness of the company’s misconduct.”
- The Policy sets forth criteria for an “effective compliance program” that are largely consistent with the criteria described in OFAC’s recent guidance on sanctions compliance programs, titled “A Framework for OFAC Compliance Commitments.” A more detailed analysis of the OFAC guidance can be found at our blog post here.
- The Policy also clarifies that not only is DOJ focused on the expertise and qualifications of the compliance function, but also its independence.
Aggravating Factors Could Limit the Application of the Policy
The presumption established under the Policy that the DOJ will enter into a non-prosecution agreement with a company that meets the specific criteria set out in the Policy is not applicable where aggravating circumstances exist in relation to the conduct. The non-exhaustive list of aggravating circumstances that may frustrate the application of the Policy remains largely unchanged from the 2016 Guidance, and includes circumstances such as conduct that includes exports of items known to be used in the construction of weapons of mass destruction, exports of military items to a hostile foreign power, and knowing involvement of upper management in the criminal conduct.
If aggravating circumstances exist for a company that has voluntarily self-disclosed the violations such that a resolution other than a non-prosecution agreement is warranted – i.e., a deferred prosecution agreement or guilty plea – the DOJ will recommend that the company be assessed a significantly reduced fine and will not require the appointment of a monitor. This assumes that the company has otherwise met the Policy standards for voluntary self-disclosure, full cooperation, and timely remediation.
Comparison with the Foreign Corrupt Practices Act (FCPA) Corporate Enforcement Policy
The standards set out in the Policy are largely identical to the requirements for voluntary self-disclosure, full cooperation and timely and appropriate remediation in the 2017 FCPA Corporate Enforcement Policy (and its predecessor the FCPA Pilot Program).
One important area where the policies diverge is in the scope of benefit afforded to companies who meet the criteria set out in the policies. Under the FCPA Corporate Enforcement Policy, when a company has voluntarily self-disclosed misconduct, fully cooperated, and timely and appropriately remediated in accordance with the standards in the policy, there will be a presumption that the company will receive a declination absent aggravating circumstances. Although under the terms of the FCPA Corporate Enforcement Policy a declination under the policy is made public, the company is not required to admit misconduct. Under a non-prosecution agreement, the benefit afforded under the Policy, the company is generally required to admit the misconduct as described in the non-prosecution agreement. Such an admission by the company could have collateral consequences, including potentially exposing the company to civil litigation from various stakeholders.
* * *
The Policy provides additional clarity for companies faced with the critical decision of whether to voluntarily disclose sanctions or export control violations to the DOJ. Although the Policy provides a helpful set of guideposts for companies to consider, the determination of whether the company has met the standards of cooperation and timely and appropriate remediation is subjective and a company’s decision to attempt to avail itself of the significant benefit of non-prosecution that may be afforded under the Policy is not without risk.
