A report starts the clock
On a Thursday afternoon, the compliance inbox of a mid-size industrial equipment maker receives a report from a regional sales manager. A distributor abroad has been invoicing "market development support" at 8 percent of sales, and the manager believes part of it reaches a customs official. The general counsel reads it twice and opens a calendar. If the same manager has also gone to the Justice Department's whistleblower program, the company has at most 120 days from today to self-report and remain eligible for a declination.
This is an illustrative example. The arithmetic in it is real. Since 10 March 2026, a single DOJ policy decides what a company receives for finding misconduct first and reporting it, and most of its benefits depend on how quickly the company acts.
This article explains the policy. It is not legal advice, and decisions about disclosure belong with counsel.
One policy now covers criminal cases
On 10 March 2026, DOJ issued its first Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. It applies to corporate criminal matters handled by every DOJ component and US Attorney's Office, with one exception: antitrust violations, which stay under the Antitrust Division's leniency program. DOJ's announcement said the policy supersedes the component-specific and office-specific policies previously in effect. It closely tracks the Criminal Division's May 2025 revision of its own policy.
Three paths, three outcomes
Path one: declination
A company that voluntarily self-discloses, fully cooperates, and timely and appropriately remediates receives a declination if no aggravating circumstances are present. It still pays disgorgement, forfeiture and restitution, and DOJ makes declinations public.
The aggravating circumstances are the nature and seriousness of the offense, how egregious or pervasive the misconduct was, the severity of harm, and recidivism, meaning a criminal adjudication or resolution within the past five years, or one based on similar misconduct. Even when an aggravating circumstance is present, prosecutors keep the discretion to recommend a declination.
What counts as voluntary
A disclosure qualifies only if it is:
- made in good faith to the appropriate DOJ criminal component;
- about misconduct DOJ did not already know of;
- not required by a preexisting obligation to disclose to DOJ;
- made before an imminent threat of disclosure or government investigation; and
- made within a reasonably prompt time, which the company has the burden to show.
Disclosure to other regulators, state agencies or civil enforcers generally does not count, though good-faith disclosures to them may earn some credit.
Path two: the near miss
A company that fully cooperates and remediates but misses a disclosure condition, or faces aggravating circumstances, falls into the near-miss category. Absent egregiousness or multiple aggravating circumstances, it receives a non-prosecution agreement with a term under three years, no independent monitor, and a fine reduced by 50 to 75 percent from the low end of the Sentencing Guidelines range.
Path three: everything else
In all other cases, prosecutors decide the form and terms of the resolution, and the fine reduction will not exceed 50 percent.
The distance between path one and path two is often a single condition. The condition most within a company's control is timing.
The whistleblower clock sets the pace
DOJ's Corporate Whistleblower Awards Pilot Program pays individuals a share of forfeited assets for original, truthful information about corporate misconduct in listed areas. These include certain crimes involving financial institutions; foreign and domestic corruption; federal health care offenses; fraud against the United States; trade, tariff and customs fraud; corporate immigration offenses; and sanctions, material support of terrorism, and cartels and transnational criminal organizations. As of DOJ's program page, updated 6 October 2026, it is still a pilot, with program guidance revised in July 2026.
The enforcement policy carves out an exception for this program, and that exception is where the clock comes from. If a whistleblower reports internally, the company can still qualify for a declination if it self-reports within 120 days of receiving that report, reports before DOJ contacts it, and meets the other conditions. The policy text requires the company to self-report as soon as reasonably practicable, and no later than 120 days after the internal report. Treat 120 days as an outer limit, not a target.
So the date of the first internal report matters. If your reporting channel does not timestamp reports and route them to someone with authority to act, you may not know when your clock started.
Where the 2025 FCPA guidelines fit
FCPA enforcement was paused by an executive order in February 2025. Deputy Attorney General Todd Blanche signed guidelines for resuming it on 9 June 2025, and DOJ announced them the next day. They point prosecutors to four factors:
- links to cartels and transnational criminal organizations;
- harm to the ability of US companies to compete fairly;
- national security, such as access to critical minerals, deep-water ports or other infrastructure; and
- serious misconduct showing strong signs of corrupt intent by particular individuals, as opposed to routine business practices or low-dollar courtesies.
New FCPA investigations need approval from the Assistant Attorney General for the Criminal Division or a more senior official.
For a mid-size company, the guidelines narrow which foreign bribery cases DOJ is likely to open. They do not repeal the statute, and they do not narrow the enforcement policy, which applies to customs and tariff fraud, sanctions, procurement fraud and health care fraud as fully as to bribery. For importers and government contractors, those may be the nearer risks.
Build the capability before a report
The policy rewards companies that know first and decide quickly. That depends on four capabilities, and all four have to exist before the first report arrives.
Intake that records the date
A speak-up channel that logs, timestamps and acknowledges every report, and routes it within a day to someone outside the reported chain. Whistleblower hotline setup for smaller companies covers the design.
Data you can query in days
The ability to pull every payment to a third party, every vendor bank change and every manual journal entry for a period, quickly and without alerting the people involved. A full-ledger analytics baseline makes that a query and not a project.
A decision path agreed in advance
Who decides whether to investigate, who engages outside counsel, who briefs the board, and who makes the disclosure decision. Write it down before the first report.
Remediation that changes the control
Root cause, discipline where warranted, and a control change that would have stopped the conduct, each documented.
A 120-day plan, report to decision
The windows below are illustrative and overlap on purpose. Counsel sets the real plan, and "reasonably prompt" can mean well before day 90.
| Window | Action | Owner |
|---|---|---|
| Days 0 to 2 | Log and acknowledge the report; preserve email, ledger and system data; limit who knows | Compliance lead |
| Days 1 to 5 | Engage outside counsel; establish privilege; brief the audit committee chair | General counsel |
| Days 3 to 20 | Scope with data: payments, vendors, entries and access linked to the allegation | Forensic data analyst, directed by counsel |
| Days 15 to 60 | Interviews and document review; interim findings to the committee | Counsel and investigators |
| Days 45 to 75 | Disclosure analysis under the policy, including which DOJ component is appropriate | Counsel and board committee |
| By day 90 | Decision recorded with reasons; disclose if that is the decision | Board committee |
| Throughout | Remediation plan, control fixes, and checks that the reporter faces no retaliation | CFO and compliance lead |
Where to start
Test the intake channel and the decision path with a tabletop exercise before a real report tests them for you. Our compliance program evaluation reviews how reports are received, triaged and escalated, and whether the data needed to scope an allegation can be pulled in days. For companies with a UK connection, does the UK failure-to-prevent-fraud offence reach US companies? covers a related defense built on documented procedures.