DOJ Guidance on Voluntary Self-Disclosures of Criminal Violations of Export Control and Sanctions Laws

The US Department of Justice's National Security Division (NSD) recently issued guidance on how DOJ's approach to cooperation from business organizations will apply in the national security context. The guidance reiterates DOJ's commitment to pursue willful violations of export control and sanctions laws by corporate entities and their employees, and clarifies that the directives to hold corporate entities criminally liable and to prosecute culpable employees individually in criminal cases will apply with equal force in cases involving threats to national security. What is new in this guidance is the listing of "aggravating circumstances" involving potential threats to national security that may justify a more stringent outcome for companies in these types of cases. Despite this potentially more stringent treatment, the October 2, 2016 guidance nonetheless seeks to encourage business organizations voluntarily to self-disclose, cooperate, and remediate in investigations of criminal violations of export control and sanctions laws.¹ This guidance follows other recent DOJ initiatives to encourage corporate compliance and self-disclosure through incentive programs.² The success of these programs will depend on how companies and counsel respond to these directives over the next several years.

Business organizations must determine whether to self-disclose potential export control or sanctions violations that could be considered willful to NSD's Counterintelligence and Export Control Section (CES) and must be prepared to meet NSD's requirements in order to receive credit for voluntary self-disclosure, cooperation, and remediation.³ NSD's guidance does not delineate how much credit a company may receive, but states that NSD will evaluate companies' efforts on a case-by-case basis when considering the appropriate disposition of the case, fine amount, and monitoring requirements.

NSD's voluntary self-disclosure process is not intended to change the existing practice of companies submitting voluntary self-disclosures to regulatory agencies, including the US Department of State's Directorate of Defense Trade Controls (DDTC) for violations of the International Traffic in Arms Regulations (ITAR), the US Department of Commerce's Bureau of Industry and Security (BIS) for violations of the Export Administration Regulations (EAR), and the US Department of the Treasury's Office of Foreign Assets Control (OFAC) for violations of US sanctions regulations. NSD's guidance anticipates that companies will file voluntary self-disclosures concurrently with NSD and the appropriate regulatory agency, and notes that a voluntary self-disclosure to NSD is necessary only for those violations that may be considered willful criminal acts.

This guidance applies the Deputy Attorney General's memorandum on Individual Accountability for Corporate Wrongdoing, dated September 9, 2015 (Yates Memo), to DOJ investigations of export control and sanctions violations.⁴ Under the strict language of the Yates Memo, to receive any cooperation credit, a company must provide all facts relevant to its employees' wrongdoing, so that NSD and US Attorneys' Offices may prosecute individual conduct which might otherwise have gone undiscovered or been impossible to prove.

This advisory outlines the guidance's criteria for voluntary self-disclosure, cooperation, and remediation credit, and offers insight and practical advice on whether voluntarily to self-disclose and how to minimize risks of export control and sanctions violations in light of this guidance.

Criteria for Voluntary Self-Disclosure, Cooperation, and Remediation Credit

NSD's guidance intends to provide greater transparency about what is required from companies that are seeking credit. It states that if a company voluntarily self-discloses criminal violations of US export control and sanctions laws, fully cooperates with the government's investigation, and appropriately remediates, in accordance with the NSD standards described below, the company may be eligible for a significantly reduced penalty, including possibly a non-prosecution agreement (NPA), a reduced period of supervised compliance, a reduced fine and forfeiture, and no requirement for a monitor. The government will evaluate the totality of the circumstances in each case to determine the ultimate resolution.

NSD's guidance does not supplant the Principles of Federal Prosecution of Business Organizations in the US Attorneys' Manual (USAM Principles) regarding what prosecutors should consider when determining how to resolve criminal investigations of business organizations, but instead sets forth how NSD and US Attorneys' Offices will evaluate credit for companies that voluntarily self-disclose, cooperate, and remediate in export control and sanctions cases.

Voluntary Self-Disclosure

To constitute a voluntary self-disclosure, the company's disclosure must:

• occur "prior to an imminent threat of disclosure or government investigation";
• be disclosed to NSD and the appropriate regulatory agency "within a reasonably prompt time after becoming aware of the offense," with the burden on the company to demonstrate timeliness; and
• include all relevant facts known to it, including all relevant facts about the individuals involved in any export control or sanctions violation.

Full Cooperation

The guidance acknowledges that cooperation is case specific and encourages prosecutors to assess the scope, quantity, quality, and timing of cooperation to determine how much credit to award a company. The Yates Memo provides the threshold requirements for cooperation, namely that companies must provide all relevant facts relating to the individuals responsible for the misconduct in order to qualify for any cooperation credit.

Specifically, in addition to the USAM Principles, full cooperation requires:

• Timely disclosure of all relevant facts, including all facts related to the involvement in the criminal activity by the corporation's officers, employees, or agents;
• Proactive cooperation—i.e., disclosing relevant facts even if not specifically requested to do so and identifying opportunities for the government to obtain relevant evidence not in the company's possession and not known to the government;
• Preserving and disclosing relevant documents to the government;
• Providing timely updates on the company's internal investigation with rolling disclosures of information;
• Ensuring (if the government requests) that the company's internal investigation does not conflict with the government's investigation;
• Providing all relevant facts about third-party companies and individuals' potential criminal conduct;
• Making the company's officers and employees, including those located abroad, available for government interviews, subject to the individuals' Fifth Amendment rights against self-incrimination;
• Disclosing all relevant facts gathered during the company's independent investigation, including attribution of facts to specific sources where such attribution does not violate the attorney-client privilege;⁵
• Disclosing documents located abroad, including providing where and by whom the documents were found, unless foreign law prohibits such disclosure, which the company has the burden to prove;
• Facilitating third-party production of documents and witnesses from foreign jurisdictions, unless prohibited by foreign law; and
• Translating relevant documents upon request.

Companies should be eligible for some cooperation credit even if they do not satisfy all the above components of full cooperation (as long as they meet the criteria specified in the Yates Memo), but the benefits generally will be "markedly less" than for full cooperation, depending on the extent to which cooperation is lacking.

Even if a company does not voluntarily self-disclose, but fully cooperates and appropriately remediates the practices that led to the violations after learning of the violations from the government, the company may still be eligible to receive some credit, including the possibility of a deferred prosecution agreement (DPA), a reduced fine and forfeiture, and an outside auditor as opposed to a monitor. A company that does not voluntarily self-disclose its export control and sanctions violations will rarely qualify for a NPA.

Remediation

NSD views remediation as an important step to reducing corporate recidivism and detecting and deterring individual wrongdoing. If a company fails to cooperate with the government's investigation, then the company is likely not eligible for remediation credit. NSD will consider providing credit for timely and appropriate remediation (beyond the credit available under the Sentencing Guidelines) if the company:

• Implements an effective compliance program, which includes fostering a culture of compliance within the company, instituting and dedicating sufficient resources to an independent compliance function, retaining qualified and experienced compliance personnel, performing risk assessments and tailoring the compliance program based on those assessments, implementing a technology control plan, requiring regular employee compliance training, auditing the compliance program to ensure its effectiveness, and establishing a reporting structure for compliance personnel;
• Disciplines employees, including those responsible for the criminal conduct, and develops a disciplinary system for employees with oversight over the responsible individuals; and
• Takes any additional steps to demonstrate recognition of the seriousness of the company's criminal conduct, acceptance of responsibility for it, and the implementation of measures to identify and prevent future misconduct.

These remediation measures are similar to those encouraged by the regulatory agencies in their assessments of companies' voluntary self-disclosures. NSD intends to coordinate with the regulatory agencies in assessing a company's remediation efforts and compliance program.

Aggravating Circumstances

The guidance also provides a non-exhaustive list of aggravating circumstances that pose an increased threat to national security and could result in a more stringent resolution of criminal export control and sanctions violations:

• Exports of items controlled for nuclear nonproliferation or missile technology reasons to a proliferator country;
• Exports of items known to be used in the construction of weapons of mass destruction;
• Exports to a terrorist organization;
• Exports of military items to a hostile foreign power;
• Repeated violations, including similar administrative or criminal violations in the past;
• Knowing involvement of upper management in the criminal conduct; and
• Significant profits from the criminal conduct, including disproportionate profits or margins, whether intended or realized, compared to lawfully exported products and services.

Even if one or more aggravating circumstances requiring a more stringent resolution are present, the guidance advises that companies that voluntarily self-disclose, cooperate, and remediate misconduct would still be in a better position than if they had not done so.

Hypothetical Examples

The guidance provides four hypothetical examples to assist federal prosecutors in exercising their discretion in prosecuting export control and sanctions cases. The hypothetical cases describe corporate action and inaction in response to potential export control and sanctions violations and the corresponding penalties and fines. The examples show that even if a company cooperates, the case still may result in a stringent resolution, including significant periods of supervision or monitoring, substantial fines, and profit forfeiture. See NSD Guidance, at 9-11.

Concurrent Voluntary Self-Disclosures to NSD and Regulatory Agencies

NSD does not intend to alter the current practice of organizations voluntarily self-disclosing violations of US export controls and sanctions to the appropriate regulatory agency, including DDTC, BIS, and OFAC, but instead intends to utilize an "all-tools" approach by working in partnership with the regulatory agencies and US Attorneys' Offices to combat and deter export control and sanctions violations. This guidance encourages an organization to submit a voluntary self-disclosure to NSD, in addition to the appropriate regulatory agency, when an organization becomes aware that a violation may have been willful—defined as an act done with the knowledge that it is illegal—and thus potentially criminal.

Deciding Whether Voluntarily to Self-Disclose

Business organizations remain free to decline voluntarily to self-disclose, cooperate, and remediate, but risk losing out on potentially significant reductions in penalties and fines. NSD's guidance strives to balance dual goals of encouraging voluntary self-disclosures of illegal export control and sanctions conducts and deterring these offenses through criminal prosecution and penalties. The guidance does not describe how much credit a company may receive for voluntarily self-disclosing, cooperating, and remediating, and the guidance's hypothetical examples describe stringent resolutions despite corporate cooperation. Companies will have to consider whether the benefits of voluntary self-disclosure outweigh the increased risks of criminal corporate and individual prosecutions.

Companies also will have to consider whether to disclose potential export control and sanctions violations only to the appropriate regulatory agency or also to NSD. The guidance places the burden on companies to determine whether the misconduct may be a willful criminal act. Moreover, regulatory agencies have ongoing discretion to refer cases to DOJ, which would render a company ineligible to receive DOJ's voluntary self-disclosure credit. Companies will have to consider this interagency context when deciding the timing of potential voluntary self-disclosures.

Companies that decide voluntarily to self-disclose should be prepared to provide all relevant facts regarding the wrongdoing, including all facts related to individual officers, employees, or agents' involvement, to receive cooperation credit. The Yates Memo on individual accountability provides the threshold requirements for a company to receive cooperation credit. NSD expects that a company's voluntary self-disclosure will include all culpable information of individual wrongdoing if the company seeks to receive cooperation credit.

Practical Advice for Handing Export Control and Sanctions Risks in Light of NSD's Guidance

NSD's guidance increases transparency regarding its expectations for companies seeking credit for voluntary self-disclosures, cooperation, and remediation in investigations of criminal export control and sanctions violations.

To mitigate risks of export control and sanctions violations, companies should consider:

• Implementing a strong export control and sanctions compliance program and hiring skilled and experienced compliance personnel to prevent and detect such violations;
• Developing a culture of compliance within the company and training employees to identify and escalate potential issues;
• Ensuring that corporate affiliates, particularly those located abroad, understand their US export control and sanctions obligations; and
• Developing capabilities to initiate an internal investigation to understand the facts involved in the potential misconduct.

Once a potential violation has been identified, a company should:

• Initiate an internal investigation and work with outside counsel as appropriate to manage an independent and thorough investigation;
• Preserve immediately all relevant records;
• Because of DOJ's focus on individual misconduct in the corporate context, consider whether to retain separate counsel for individuals associated with the potential wrongdoing;
• Consider whether and when to disclose potential violations to the regulatory agencies and/or NSD, with the awareness that if the regulatory agencies or other third parties disclose the wrongdoing before the company does, the company likely will not be eligible for full cooperation credit; and
• Be committed and prepared to provide full disclosure of the relevant facts to receive full cooperation credit, including providing DOJ access to documents and witnesses located abroad in compliance with foreign laws.

Companies will have to make the strategic decision when confronted with potential export control and sanctions violations whether to seek the benefits of DOJ's voluntary self-disclosure program or risk significantly higher penalties and fines. The success of DOJ's program, which aims to encourage disclosures of potentially criminal violations and to prosecute corporate entities and individuals for those violations, will become clearer as companies and counsel respond to these directives over the next several years.