DOJ Announces Revised Export Control and Sanctions Enforcement Policy for Companies, Including Financial Institutions

On December 13, the U.S. Department of Justice’s (“DOJ”) National Security Division (“NSD”) announced a new policy designed to encourage business organizations to make voluntary self-disclosures (“VSDs”) to the DOJ in connection with potentially willful export control and economic sanctions violations (the “Revised VSD Policy”).[1] The policy, which only applies to voluntary self-disclosures to NSD’s Counterintelligence and Export Control Section (“CES”), revises a 2016 DOJ policy on the same topic. As the policy notes, in the export control and sanctions context, criminal violations require proof of willfulness, defined as knowledge that the conduct violated the law.[2]

In announcing the new policy, NSD Principal Deputy Assistant Attorney General David Burns stated that financial institutions—which had been previously excluded from the prior policy—can take advantage of the benefits of the Revised VSD Policy.[3] Burns noted that the Revised VSD Policy is intended to provide greater clarity for companies considering whether to make a VSD, with the goal of encouraging such disclosures.[4]

Although the Revised VSD Policy is patterned in part after the DOJ Criminal Division’s FCPA policy, the presumptive result under the FCPA policy is a declination absent aggravating circumstances, whereas the presumptive result under the Revised VSD Policy is a non-prosecution agreement without a fine absent aggravating circumstances.[5] This “key difference” reflects the serious nature of what Burns described as the “threats to national security posed by violations of our export control and sanctions laws.”[6]

The DOJ’s Revised VSD Policy

The Revised VSD Policy sets forth the criteria that the DOJ intends to use in determining an appropriate resolution for a company that makes a VSD in an export control or sanctions matter.[7] Notably, under the Revised VSD Policy, “when a company (1) voluntarily self-discloses export control or sanctions violations to [the NSD’s Counterintelligence and Export Control Section (“CES”)], (2) fully cooperates, and (3) timely and appropriately remediates, consistent with the [Revised VSD Policy], there is a presumption that the company will receive a non-prosecution agreement and will not pay a fine, absent aggravating factors.”[8]

If aggravating factors, described below, warrant a different criminal resolution, such as a deferred prosecution agreement or a guilty plea, and a company has voluntarily self-disclosed, fully cooperated, and timely and appropriately remediated, the DOJ has stated that it:

• Will accord or recommend to a sentencing court, a fine that is, at least, 50% less than the amount available under a statutory sentencing provision.[9] That is, the DOJ will cap the recommended fine at an amount equal to the gross gain or gross loss; and
• Will not require that a monitor be appointed if the company has, at the time of resolution, implemented an effective compliance program.[10]

Notwithstanding the foregoing, even in cases where a company receives a non-prosecution agreement (“NPA”), the DOJ will require the company to disgorge, forfeit or pay restitution for any of the unlawfully obtained gain.[11]

In announcing the Revised VSD Policy, Burns stated that it “provide[s] more clarity concerning the benefits of reporting and the consequences of not reporting when you are advising your clients and when decision-makers in C-Suites and in Board Rooms are weighing whether to make a self-disclosure and to whom.”[12] We describe below the criteria that the DOJ will consider in connection with the Revised VSD Policy, which the DOJ noted was intended to conform where possible to the DOJ Criminal Division’s FCPA Policy.[13]

Voluntary Self-Disclosure

While the Revised VSD Policy may have benefits to certain companies, these benefits will only be available to companies that voluntarily self-disclose potential export control or sanctions violations to NSD’s Counterintelligence and Export Control Section. Merely reporting to regulatory agencies such as the U.S. Department of Treasury’s Office of Foreign Assets Controls (“OFAC”), the U.S. Commerce Department’s Bureau of Industry and Security (“BIS”) or the U.S. Department of State’s Directorate of Defense Trade Controls (“DDTC”) will not entitle a company to the benefits available under the Revised VSD Policy, absent a near-simultaneous disclosure to CES.[14]

Further, to qualify under the Revised VSD policy, the company’s disclosure must first be “voluntary”; that is, a disclosure to DOJ’s Counterintelligence and Export Control Section that:

• Occurs ‘“prior to an imminent threat of disclosure or government investigation”’;
• Is submitted “‘within a reasonably prompt time after becoming aware of the offense’ . . . with the burden on the company to demonstrate timeliness”; and
• Discloses “all relevant facts known to [the company] at the time of the disclosure, including as to any individuals substantially involved in or responsible for the misconduct at issue.”[15]

Full Cooperation

In addition to satisfying the cooperation provisions contained in the DOJ’s Justice Manual regarding the Principles of Federal Prosecution of Business Organizations, for a company to receive full cooperation credit under the Revised VSD Policy, the DOJ will require, among other things, the following in matters involving potential export control and sanctions matters:

• Timely disclosure of all relevant facts relating to the conduct at issue, including all relevant facts gathered during a company’s internal investigation (without an expectation of a privilege waiver), and “all facts related to involvement in the criminal activity by the company’s officers, employees, or agents” or by third-party companies;
• Proactive cooperation, that is, disclosure of relevant facts even when not specifically requested to by the DOJ;
• Timely preservation, collection and production of relevant documents and information, including identification of the sources of information, the jurisdictions where information was collected, how they were located and by whom, and where requested and appropriate, provision of translations of relevant documents in foreign languages[16]; and
• When requested, de-confliction of witness interviews in connection with an internal investigation, and/or making available to the DOJ those company officers and employees who possess relevant information. The policy notes that this includes, when “appropriate and possible,” officers, employees, and agents located overseas as well as former officers and employees (subject to the individuals’ Fifth Amendment rights), and, when possible, the facilitation of production of third-party witnesses.[17]

Timely and Appropriate Remediation

In order for a company to receive full credit under the remediation aspect of the Revised VSD Policy, the DOJ requires a company to implement several remedial measures, including but not limited to:

• Demonstration of a comprehensive analysis of the causes of the potentially unlawful conduct (i.e., a root cause analysis);
• Implementing an effective compliance program, which the DOJ recognizes will depend on the size and resources of the company, but may include, among other things, the company’s culture of compliance, resources dedicated by the company to compliance, experience of the company’s compliance personnel, and the authority and independence of the company’s compliance function; and
• Appropriate discipline of employees, including those identified by the company as responsible for misconduct.[18]

Potential Aggravating Factors

While the Revised VSD Policy has a presumption of an NPA with no fine when its criteria are met, aggravating factors “if present to a substantial degree” may result in a more stringent resolution, such as a DPA or a guilty plea.  Examples of aggravating factors identified by the DOJ include, but are not limited to:

• Knowing involvement by upper management in the potentially unlawful conduct;
• Repeated violations, including similar administrative or criminal export control or sanctions violations;
• Exports of military items to a hostile foreign power;
• Exports to a Foreign Terrorist Organization or Specially Designated Global Terrorist; and
• Export of items controlled for nuclear non-proliferation or missile technology to a proliferator country, or items known to be used in the construction of weapons of mass destruction.[19]

Implications

As the DOJ noted in its announcement, the Revised VSD Policy “signals the Department’s continued emphasis on corporate voluntary self-disclosure, rewarding cooperating companies with a presumption in favor of a non-prosecution agreement and significant reductions in penalties.”[20]  While it remains to be seen how the Revised VSD Policy will be applied in practice, companies that report violations to the DOJ directly, fully cooperate and timely remediate will likely receive concrete benefits, namely a presumption of an NPA without a fine, absent aggravating circumstances.  The policy also offers benefits to companies that may face a DPA or guilty plea, with the increased likelihood that DOJ recommends that no monitor be imposed, provided the company has implemented an effective compliance program at the time of the resolution. 

The decision to self-report to the DOJ and/or other agencies requires a case-by-case analysis that balances various considerations, including the likelihood that the DOJ or another agency would discover the conduct absent a VSD and an assessment of potential penalties. Particularly for financial institutions, which have been heavily scrutinized in the past for potential sanctions violations, the Revised VSD Policy has created new incentives that could weigh in favor of a VSD.

We will continue to monitor developments related to the Revised VSD Policy, and we will provide further updates as appropriate.

*              *              *

[1]      U.S. Dep’t of Justice, Department of Justice Revises and Re-Issues Export Control and Sanctions Enforcement Policy for Business Organizations (Dec. 13, 2019), available here.  Statutes covered by the Revised VSD Policy are the Arms Export Control Act (“AECA”), 22 U.S.C. § 2778, the Export Control Reform Act (“ECRA”), 50 U.S.C. § 4801 et seq., and the International Emergency Economic Powers Act (“IEEPA”), 50 U.S.C. § 1705.

[2]      The policy notes that the DOJ uses the definition of willfulness set forth in Bryan v. United States, 524 U.S. 184 (1998), in export control and sanctions cases.   See U.S. Dep’t of Justice, Export Control and Sanctions Enforcement Policy for Business Organizations (Dec. 13, 2019) (hereinafter “Revised VSD Policy”), available here. 

[3]      David Burns, Principal Deputy Ass’t Att’y Gen., Principal Deputy Assistant Attorney General David Burns Delivers Remarks Announcing New Export Controls and Sanctions Enforcement Policy for Business Organizations (hereinafter, “Burns Remarks”) (Dec. 13, 2019), available here.

[4]      Burns Remarks.

[5]      Id.

[6]      Id.

[7]      Revised VSD Policy.

[8]      Id.  (emphasis omitted).  The Revised VSD Policy will also be considered by U.S. Attorneys’ Offices in export control and/or sanctions matters, in partnership with NSD.  Id.

[9]      Id.

[10]     Id.   

[11]     Id.

[12]     Burns Remarks.

[13]     Id.

[14]     Id.

[15]     Revised VSD Policy (quoting U.S.S.G. §§ 8C2.5(g)(1) and 8C2.5(g)(1)).  The DOJ will consider a disclosure to be voluntary if the company uncovers misconduct at a merged or acquired entity, following a merger or acquisition, through either thorough and timely due diligence or post-acquisition audits or compliance integrations efforts, and then self-discloses the misconduct or otherwise takes action consistent with the Revised VSD Policy.  See Revised VSD Policy.

[16]     The Revised VSD Policy makes explicit reference to potential foreign law restrictions precluding the production of documents located abroad:  “When a company claims that disclosure of overseas documents is prohibited due to data privacy, blocking statutes, or other reasons related to foreign law, the company bears the burden of establishing the prohibition.  Moreover, a company should work diligently to identify all available legal bases to provide such documents.”  Revised VSD Policy.

[17]     Id.

[18]     Id. 

[19]     Id. 

[20]     U.S. Dep’t of Justice, Department of Justice Revises and Re-Issues Export Control and Sanctions Enforcement Policy for Business Organizations (Dec. 13, 2019), available here.