DOJ’s First‑Ever Corporate Enforcement Policy: Key Takeaways

On March 10, 2026, the United States Department of Justice (“DOJ”) (“CEP”) for criminal matters, establishing a unified framework for how prosecutors evaluate and resolve all white-collar cases, with the exception of those relating to antitrust. The CEP incentivizes companies to voluntarily disclose discovered misconduct, cooperate with DOJ investigations and timely and appropriately remediate any wrongdoing. For companies that do so, the upside is substantial: absent certain limited aggravating circumstances, DOJ will decline to prosecute them. The CEP therefore has significant implications for companies of all sizes, from startups to public companies, underscoring the importance of investing in effective compliance frameworks that proactively identify, investigate and mitigate risk.

In connection with DOJ’s announcement of this first-ever policy, Deputy Attorney General Todd Blanche emphasized that “well-intentioned businesses know that, across the Department, they will be rewarded when they self-disclose wrongdoing, cooperate with our investigations, and remediate the misconduct. But for those that do not, make no mistake — we will not hesitate to seek appropriate resolutions against companies and individuals alike that perpetrate white collar offenses that harm American interests.”

Background and Application of the CEP

Prior to the CEP, DOJ enforcement decisions varied depending on the nature of the alleged corporate criminal misconduct at issue and the policies of individual DOJ components or offices. The CEP now standardizes DOJ’s approach by applying to all corporate criminal cases across the Department (aside from those relating to antitrust) and supersedes all component-specific or U.S. Attorney’s Office specific corporate enforcement policies currently in effect. In doing so, DOJ’s goal is to promote greater transparency and consistency in DOJ’s prosecutions of corporate criminal matters.

At the same time, while the CEP standardizes DOJ’s approach, any resolution under the CEP must still be approved by the Assistant Attorney General for the relevant division or the United States Attorney for the relevant district, in coordination with the Office of the Deputy Attorney General. As a result, even under the CEP, certain DOJ components and individual United States Attorneys’ offices may continue to retain discretion.

Finally, while the CEP is intended to unify DOJ’s approach to corporate criminal enforcement, it does not bind regulators outside DOJ. State Attorneys General, the Securities and Exchange Commission and foreign regulators are not bound by the CEP and may pursue enforcement actions independently.

The CEP’s Guidance for Companies

The CEP provides greater transparency regarding the benefits available to companies that voluntarily self-disclose potential misconduct. Under the policy, DOJ will decline to prosecute a company that satisfies four factors:

1. Voluntary self-disclosure of misconduct before the government learns of it;
2. Full and proactive cooperation with DOJ;
3. Timely and appropriate remediation of the underlying misconduct; and
4. The absence of aggravating circumstances, such as those relating to the nature and seriousness of the offense.

Moreover, even when a company does not satisfy all four factors (e.g., when certain aggravating factors are present), the CEP affords prosecutors discretion to decline prosecution or offer other mitigation. Available mitigation may include reductions from the applicable Sentencing Guidelines’ fine range, avoidance of an independent compliance monitor and shorter compliance reporting obligations. Companies that fail to act promptly risk forfeiting these potential benefits.

Takeaways for Company Compliance and Internal Investigation Programs

The unified CEP provides companies at every stage with clear guideposts for addressing potential misconduct. The takeaway is straightforward: companies of all sizes who take swift action to investigate, disclose and remediate will be eligible for significant benefits from DOJ. 

Companies looking to capitalize on the CEP’s benefits can assess their compliance protocols to ensure they have adequate protocols to investigate, disclose and remediate. For example, compliance protocols should provide:

• Early detection of potential misconduct;
• Clear escalation pathways for potential misconduct, including robust whistleblower mechanisms;
• Well-defined internal investigation protocols of any potential misconduct, including document retention practices depending on applicable data protection statutes;
• Timely voluntary reporting to authorities; and
• Appropriate remediation of potential misconduct.

However, companies that are unwilling to heed DOJ’s warning risk DOJ seeking appropriate resolutions without any mitigation.