The Problem: Why This Matters Now
The DOJ's expansion of whistleblower rewards programs in both the Criminal Division and Antitrust Division has significantly changed the risk landscape for corporate misconduct. With whistleblowers eligible for 15% to 30% of recoveries over $1 million, your organization must recognize the strong financial incentives for employees to report directly to federal authorities instead of using internal channels.
The revised Corporate Enforcement and Voluntary Self-Disclosure Policy heightens this urgency. Companies that voluntarily self-disclose, fully cooperate, remediate appropriately, and have no aggravating circumstances will receive a declination. This is not just a presumption but a guaranteed path out of criminal resolution. The Criminal Division's memo from Matthew Galeotti makes it clear: report first and gain substantial benefits, or face an NPA, reduced fine credits, and potential monitoring.
The Criminal Division's priority areas now include violations related to cartels, transnational criminal organizations, federal immigration law, material support of terrorism, sanctions offenses, trade and customs fraud, and procurement fraud. If your operations intersect with these domains, you're in a heightened enforcement environment where external whistleblowers are already submitting tips.
Essential Preparations
Before implementing a self-disclosure protocol, ensure these foundational elements are in place:
Governance Structure: Identify who has the authority to approve self-disclosure decisions. This typically involves general counsel, the audit committee, and potentially the full board for significant matters. Document these escalation paths now, not during a crisis.
Legal Privilege Framework: Establish clear procedures for maintaining attorney-client privilege during internal investigations. Your protocol must distinguish between fact-gathering (potentially discoverable) and legal analysis (privileged). Engage outside counsel early to structure investigations properly.
Investigation Resources: Maintain relationships with external forensic accountants, e-discovery vendors, and specialized counsel in relevant practice areas (FCPA, antitrust, trade compliance). When you discover misconduct, you'll need to act quickly, vetting vendors during an active investigation wastes critical time.
Whistleblower Intake System: Deploy a secure, confidential reporting mechanism that logs all submissions with timestamps and tracks investigation status. You need an audit trail showing you took reports seriously and investigated promptly. Platforms like NAVEX provide this documentation layer.
Remediation Playbook: Draft template remediation plans covering personnel actions, control enhancements, training protocols, and monitoring mechanisms. You won't have time to build these from scratch when the DOJ expects "timely and appropriate remediation."
Step-by-Step Implementation
Phase 1: Detection and Preliminary Assessment (Days 1-3)
When you receive a credible allegation through internal channels, convene your core response team within 24 hours. This team should include general counsel, the compliance officer, internal audit, and relevant business unit leaders.
Conduct a preliminary scoping assessment: What laws potentially apply? What's the potential financial exposure? Are there ongoing transactions or regulatory filings that could be affected? Is there evidence of intentional misconduct versus control failures?
Engage outside counsel immediately if the matter involves potential criminal violations in the DOJ's priority areas. Their involvement helps preserve privilege and provides an independent assessment of self-disclosure benefits.
Phase 2: Investigation Design (Days 4-7)
Outside counsel should design the investigation scope, including document preservation, custodian interviews, and forensic analysis requirements. Issue a litigation hold to all relevant custodians and IT systems.
Establish investigation protocols that separate fact development from legal conclusions. Investigators should report findings to counsel, who then provides legal advice under privilege.
Create a timeline: When did the conduct occur? When did the company first have knowledge? The CEP distinguishes between companies that self-disclose "quickly enough" and those that delay. You're racing against the possibility that the DOJ already knows through external whistleblowers.
Phase 3: Self-Disclosure Decision (Days 8-14)
Outside counsel should prepare a written recommendation analyzing:
- Likelihood the DOJ already has knowledge through other sources
- Strength of the CEP's presumption of declination based on your specific facts
- Aggravating circumstances that could override the declination path
- Estimated financial exposure under various scenarios (declination, NPA with 75% reduction, full prosecution)
Present this analysis to the audit committee or board. Document their decision and rationale. If you're disclosing, prepare to do so within days, not weeks.
Phase 4: Disclosure Execution (Days 15-16)
If proceeding with self-disclosure, contact the Criminal Division's Fraud Section or relevant specialized unit. Your disclosure should include:
- Concise description of the misconduct
- Preliminary findings from your investigation
- Individuals involved (to the extent known)
- Your commitment to full cooperation and remediation
- Timeline for completing the investigation
Do not wait until your investigation is complete to disclose. The CEP rewards companies that report "voluntarily", before the government discovers the misconduct independently.
Phase 5: Cooperation and Remediation (Ongoing)
Provide regular updates to the DOJ on investigation progress. Produce documents and make witnesses available as requested. The CEP requires "full cooperation," which the DOJ interprets broadly.
Implement remedial measures in parallel with the investigation:
- Discipline or terminate culpable individuals
- Enhance controls that failed
- Conduct targeted training
- Engage independent compliance consultants if control failures were systemic
Document all remediation steps with dates, responsible parties, and completion status. The DOJ will evaluate whether remediation was "timely and appropriate."
Validation: How to Verify It Works
Test your self-disclosure protocol before you need it. Conduct tabletop exercises simulating whistleblower allegations in each of the Criminal Division's priority areas. Time how quickly you can convene the response team, engage outside counsel, and prepare a preliminary assessment.
Review your whistleblower intake data quarterly. Are employees reporting through internal channels, or do you have silence where you should see activity? If tips are going straight to the DOJ, you've lost your first-mover advantage.
Audit your investigation files. Do they clearly distinguish privileged legal analysis from factual findings? Would they withstand DOJ scrutiny if produced?
Verify that your audit committee receives regular reports on pending investigations and self-disclosure decisions. Board minutes should reflect these discussions.
Maintenance: Ongoing Tasks
Quarterly: Review DOJ enforcement actions and declination letters to identify evolving priorities. The Criminal Division's focus areas may shift based on administration priorities.
Annually: Update your self-disclosure protocol to reflect changes in DOJ policy. The CEP was revised in 2025; expect further refinements.
Continuously: Monitor legislative and regulatory developments affecting whistleblower rewards. The Antitrust Division's program launched in July 2025 with a dedicated webpage, other divisions may follow.
Train your compliance team on the self-disclosure protocol. They're your early warning system. When they identify red flags, they need to know exactly how to escalate and whom to contact.
Maintain your external counsel relationships. You don't want to be searching for FCPA specialists when you're already under time pressure to self-disclose.
The DOJ has created clear incentives: report first, cooperate fully, remediate quickly, and you'll avoid criminal prosecution. Build the infrastructure to act on those incentives before your competitors, or your employees, beat you to the disclosure.
