The Conventional Wisdom
Corporate compliance teams often view the DOJ's new National Fraud Enforcement Division as just another shift in enforcement priorities. The typical response is to update risk assessments, add slides to board presentations, and refresh whistleblower hotline materials. With a compliance program in place, self-disclosure when required, and cooperation under the Corporate Enforcement and Voluntary Self-Disclosure Policy, many believe they're adequately covered.
This perspective assumes centralization is merely an administrative change. If the DOJ wants to route cases through a new Corporate Enforcement Section, it's seen as their concern, not yours. Your responsibility is to maintain a reasonable program and respond when contacted.
Why This View Is Incomplete
Centralization fundamentally alters the timeline and calculus of voluntary disclosure. Traditionally, government contact has been the trigger for compliance decisions. However, Directive 26-12, issued on October 1, 2026, indicates a significant shift: the DOJ is developing infrastructure to identify issues before you do.
The Fraud Division isn't merely reorganizing existing cases. It's establishing a National Fraud Detection Center with data analytics capabilities and policies designed to incentivize whistleblowers, including those involved in misconduct. Directive 26-13 further instructs prosecutors to cultivate "proactive cooperators." These are not passive enforcement tools but active discovery mechanisms.
Compliance officers must recognize that centralization compresses decision-making timelines. Previously, with cases distributed across U.S. Attorneys' Offices, there was a buffer between internal discovery and government awareness. That buffer is vanishing. The DOJ is using data analytics to independently identify schemes and is encouraging insiders to report first.
While you're operating on a 120-day self-disclosure timeline under the CEP, measured from when you receive a credible report, this window may never open if a whistleblower reports to the DOJ first or if analytics flag your company.
The Evidence
Directive 26-12 mandates structural changes, requiring prosecutors to report all ongoing corporate investigations to the Corporate Enforcement Section Chief within seven days. New investigations also demand prompt reporting. This isn't mere coordination; it's command and control.
The directive prioritizes four areas: health care fraud and controlled substance distribution, government procurement and contract fraud, revenue evasion schemes, and trade violations, including tariff evasion and forced labor. If your organization operates in these sectors, you're under direct scrutiny from Main Justice.
Significantly, ten aggravating factors must be heavily weighted during charging decisions. Factors like management involvement, concealment from auditors, and obstruction of oversight directly relate to compliance program failures. Others, such as conduct lasting three years or more and affecting multiple federal districts, describe systemic issues that whistleblowers and data analytics can detect.
The thresholds, 25 or more victims or $25 million or more in loss, are not massive frauds. They're mid-market schemes that a robust compliance program should catch. If the DOJ's analytics or a whistleblower identifies them first, you've lost self-disclosure credit before realizing you needed it.
Directive 26-13 extends implications beyond charging, directing prosecutors to pursue early asset seizure and coordinate with the Asset Recovery Section throughout investigations. Companies may face both the Corporate Enforcement Section and Asset Recovery Section from the start. This isn't about improving your response after contact; it's about whether you can respond before contact.
What to Do Instead
Stop treating voluntary disclosure as a reactive compliance obligation. Assume the government may learn of misconduct before you do, or simultaneously with your discovery.
First, accelerate your investigation protocols. The 120-day self-disclosure window assumes you control the clock, but you don't anymore. Establish triage procedures to assess credible allegations within 30 days, not 90. In sectors like health care, government contracting, or trade, assume every whistleblower complaint is racing you to the DOJ.
Second, audit your data footprint. The National Fraud Detection Center is analyzing transaction patterns, billing data, customs filings, and procurement records. Conduct similar analyses internally. If your healthcare billing shows statistical outliers, customs declarations contain inconsistencies, or government contract charges cluster suspiciously, the DOJ's analytics will find them. Find them first.
Third, redesign your whistleblower program, understanding that the DOJ is actively incentivizing reports from participants in misconduct. Your hotline isn't competing with silence; it's competing with a federal prosecutor offering cooperation credit. Make internal reporting faster and more protective than external reporting, with same-day intake acknowledgment, defined investigation timelines, and clear communication about handling participant disclosures.
Fourth, map your exposure against the ten aggravating factors. If you identify management involvement, multi-year duration, multi-district operations, or potential losses exceeding $25 million, you're in the charging zone. These factors also guide prosecutors on asset seizure and sentencing departures under Directive 26-13. Address these exposures immediately.
Finally, understand that centralization means consistency. The Corporate Enforcement Section will develop institutional knowledge about effective compliance programs in each priority sector. Generic programs won't satisfy reviewers familiar with numerous cases in your industry. Invest in sector-specific controls that address the actual fraud patterns the DOJ is prioritizing.
When the Conventional Wisdom Is Right
The conventional approach is correct in one aspect: a reasonable compliance program still matters. Directive 26-12 reaffirms that self-disclosure, cooperation, and remediation receive credit under the CEP. The Principles of Federal Prosecution of Business Organizations still apply.
If you discover misconduct internally, investigate promptly, self-disclose within the CEP timeline, and cooperate fully, you're still positioned for a declination or reduced penalty. The fundamentals haven't changed.
However, "reasonable" now requires speed and detection capabilities you may not have developed yet. The conventional wisdom fails not because compliance programs are irrelevant, but because it underestimates how quickly you need to deploy them. Centralized enforcement with proactive detection tools doesn't give you more time to get your program right. It gives you less.
