DOJ Corporate Enforcement Policy 2026: Why Self-Disclosure Earns Grace for Corporations

The federal government formalized a system where corporations earn declinations through self-disclosure and remediation. The harder question: why does the system build structured mercy for institutions while individuals face punishment first and nuance later?

What DOJ Announced on March 10, 2026

The Department of Justice’s Corporate Enforcement and Voluntary Self-Disclosure Policy, released March 10, 2026, is not a new concept. The Criminal Division has operated its own CEP framework since 2016, when it began as a narrow FCPA pilot and expanded over successive administrations. What is new is that for the first time, a single policy governs all DOJ components and all 93 U.S. Attorney’s Offices for non-antitrust corporate criminal matters.^[1]

Before this policy, a company facing potential criminal exposure had to navigate different standards depending on which office was investigating. The Southern District of New York, known for white-collar enforcement, had its own voluntary disclosure program for financial crimes, issued just weeks before the department-wide CEP. That SDNY program is now superseded.^[2] The new policy eliminates that geographic variation and creates a single, predictable framework.

The outcome structure is designed to be navigable. Companies that meet all requirements get a guaranteed declination, not a presumptive one. That shift from presumptive to guaranteed happened in the May 2025 revision to the Criminal Division policy and carried forward here.^[3] Companies that self-report but have aggravating factors, or that come close but fall short of full compliance, may receive a non-prosecution agreement with a 50 to 75 percent reduction in applicable fines rather than a declination. The policy includes a flowchart of potential outcomes.

Nine days after the announcement, DOJ declined to prosecute Balt SAS, a French medical device company, and required approximately $1.2 million in disgorgement. That was the first announced resolution under the new framework.^[4]

What Counts as Voluntary Self-Disclosure

The CEP’s definition of voluntary self-disclosure is specific enough to be meaningful. A disclosure must be a good-faith report to the appropriate DOJ component. The misconduct must not already be known to the government. The company must not have had a preexisting obligation to disclose. The disclosure must come before any imminent threat of disclosure or investigation. And it must happen within a reasonably prompt time after the company becomes aware of the conduct, with the company bearing the burden of demonstrating timeliness.^[5]

This is not an easy standard to meet, and it is designed not to be. A company that waits until a whistleblower has already contacted DOJ does not qualify. A company that has a mandatory reporting obligation under a prior agreement does not qualify. The policy is designed to reward companies that identify misconduct through their own compliance infrastructure and report it proactively, before any external pressure forces the issue.

This requires a compliance infrastructure. It requires legal counsel experienced in white-collar enforcement. It requires internal investigation capacity. It requires the organizational sophistication to identify misconduct, assess it accurately, and make a disclosure decision before the government learns of it through other means. Large corporations have all of these things. Smaller businesses may not. Individuals never do in the equivalent sense.

How Declinations Change Bargaining Power

A guaranteed declination changes the entire calculus of corporate criminal exposure. Under the prior framework, self-disclosure reduced penalties but did not guarantee an outcome. Under the new CEP, the outcome is codified: meet the requirements, get the declination. This predictability has real value. It allows companies and their counsel to assess the benefits of self-disclosure against the costs of ongoing concealment risk with much greater certainty than before.

For DOJ, the value is also real. A company that self-discloses provides the government with information it might otherwise not have, cooperation it does not have to extract through compelled process, and remediation it does not have to pursue through litigation. The enforcement calculus favors self-disclosure because it produces more information and faster remediation than prosecution produces. The policy formalizes an arrangement that has been operating informally for years.

That formalization is the significant step. It shifts self-disclosure from a strategy that might produce good outcomes to one that produces guaranteed outcomes, provided the conditions are met. Corporate counsel now operates with a structured roadmap that did not exist before March 10, 2026.

Institutional Remediation Versus Individual Punishment

The contrast this framework creates with individual criminal enforcement is not incidental. It is structural.

For individual defendants, cooperation credit exists but operates differently. Section 5K1.1 of the Sentencing Guidelines allows courts to depart below the guidelines range when the government files a motion reflecting that the defendant provided substantial assistance. That motion is the government’s to file, not the defendant’s to earn through a codified process. The government decides whether the assistance was substantial. The government decides whether to file. The defendant has no procedural guarantee.

Pre-charge cooperation agreements, proffer letters, and deferred prosecution agreements for individuals exist in some form. But they are negotiated case by case, not codified in a public policy with a published flowchart and a guaranteed outcome structure. The individual who walks into a U.S. Attorney’s office with a lawyer and information to offer is entering a negotiation. The corporation that follows the CEP checklist is following a policy with a known endpoint.

The DOJ’s rationale for the asymmetry is coherent: a corporation cannot be imprisoned, so cooperation and remediation are the only meaningful enforcement levers available. Individual defendants can be imprisoned, so the government retains maximum leverage to secure cooperation through the threat of prosecution and conviction. That logic explains the design. It does not close the legitimacy gap.

What This Reveals About Who the System Trusts

The CEP reflects a set of judgments about who can be trusted to behave in the government’s interest when given the right incentives. Corporations that self-disclose are trusted to do so accurately and completely, to cooperate fully rather than selectively, and to remediate genuinely rather than cosmetically. The policy treats these companies as capable of good-faith engagement with law enforcement when the incentive structure is clear. That is a reasonable assumption about most of the companies that will use the policy.

The system does not build equivalent structures for individuals, not because individuals are less trustworthy, but because the enforcement model for individuals is built on compulsion rather than incentive. Individuals are prosecuted and then cooperate, if they cooperate at all. The cooperation comes after the charge, after the leverage has been applied, after the individual has lost control of the narrative. The institutional model inverts this: cooperate first, and the charge may never come.

This is not a new observation. The divergence between corporate and individual treatment in federal criminal enforcement has been documented in academic literature and criticized by defense practitioners for decades. The CEP does not create this divergence. It formalizes, clarifies, and strengthens it. That clarity makes the question harder to avoid: if the system can build guaranteed mercy pathways for institutions, the question worth asking is why it does not build equivalent structures for individuals who demonstrate the same capacity for disclosure, cooperation, and remediation.