Introduction

The unlawful export of sensitive commodities, technologies, and services, as well as trading and engaging in transactions with sanctioned countries and designated individuals and entities, undermines the national security of the United States. Thwarting these unlawful efforts and holding those who violate our export controls and sanctions laws accountable is a top priority for the National Security Division (NSD) of the Department of Justice.

Business organizations and their employees are at the forefront of the effort to combat export control and sanctions violations. As the gatekeepers of our export-controlled technologies, business organizations play a vital role in protecting our national security. The Department encourages companies to voluntarily self-disclose all potentially willful[2] violations of the statutes implementing the U.S. government’s primary export control and sanctions regimes—the Arms Export Control Act (AECA), 22 U.S.C. § 2778, the Export Control Reform Act (ECRA), 50 U.S.C. § 4801 et seq., and the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1705—directly to NSD.[3]

This Policy sets forth the criteria that the Department, through NSD’s Counterintelligence and Export Control Section (CES)[4] and in partnership with the U.S. Attorneys’ Offices, uses in determining an appropriate resolution for an organization that makes a voluntary self-disclosure (VSD) in export controls and/or sanctions matters. It is important to note that almost all criminal violations of U.S. export control and sanctions laws harm the national security or have the potential to cause such harm. This threat to national security informs how the Department arrives at an appropriate resolution with a business organization and distinguishes these cases from other types of corporate wrongdoing. Federal prosecutors must balance the goal of encouraging such disclosures and cooperation against the goal of deterring these very serious offenses.

Benefits of the Policy

With those goals in mind, it is the Department’s policy that when a company (1) voluntarily self-discloses export control or sanctions violations to CES, (2) fully cooperates, and (3) timely and appropriately remediates, consistent with the definitions below, there is a presumption that the company will receive a non-prosecution agreement and will not pay a fine, absent aggravating factors. Aggravating factors, as described below, include exports of items that are particularly sensitive or to end users that are of heightened concern; repeated violations; involvement of senior management; and significant profit.

If, due to aggravating factors, a different criminal resolution—i.e., a deferred prosecution agreement or guilty plea – is warranted for a company that has voluntarily self-disclosed, fully cooperated, and timely and appropriately remediated, the Department:

1. • will accord, or recommend to a sentencing court, a fine that is, at least, 50% less than the amount that otherwise would be available under the alternative fine provision, 18 U.S.C. § 3571(d). In other words, the Department will cap the recommended fine at an amount equal to the gross gain or gross loss;[5] and
2. • will not require appointment of a monitor if a company has, at the time of resolution, implemented an effective compliance program.

At a minimum, however, even in cases in which the company is receiving a non-prosecution agreement, the company will not be permitted to retain any of the unlawfully obtained gain. The company is required to pay all disgorgement, forfeiture, and/or restitution resulting from the misconduct at issue.

Definitions

For purposes of this Policy, the following definitions apply:

1. Voluntary Self-Disclosure

The following actions are required for a company’s disclosure to be voluntary:

1. • The company discloses the conduct to CES “prior to an imminent threat of disclosure or government investigation,” U.S.S.G. § 8C2.5(g)(1);[6]
2. • The company discloses the conduct to CES “within a reasonably prompt time after becoming aware of the offense,” U.S.S.G. § 8C2.5(g)(1), with the burden on the company to demonstrate timeliness;[7] and
3. • The company discloses all relevant facts known to it at the time of the disclosure, including as to any individuals substantially involved in or responsible for the misconduct at issue.[8]

It is important to note that when a company identifies potentially willful conduct, but chooses to self-report only to a regulatory agency and not to DOJ, the company will not qualify for the benefits of a VSD under this Policy in any subsequent DOJ investigation.

2. Full Cooperation

In addition to the provisions contained in the Principles of Federal Prosecution of Business Organizations, see Justice Manual 9-28.000, the following actions will be required for a company to receive credit for full cooperation for purposes of this Policy:

1. • Disclosure on a timely basis of all facts relevant to the wrongdoing at issue, including: all relevant facts gathered during a company’s internal investigation; attribution of facts to specific sources where such attribution does not violate the attorney-client privilege, rather than a general narrative of the facts; timely updates on a company’s internal investigation, including but not limited to rolling disclosures of information; all facts related to involvement in the criminal activity by the company’s officers, employees, or agents; and all facts known or that become known to the company regarding potential criminal conduct by all third-party companies (including their officers, employees, or agents);
2. • Proactive cooperation, rather than reactive; that is, the company must timely disclose all facts that are relevant to the investigation, even when not specifically asked to do so. Additionally, where the company is aware of relevant evidence not in the company’s possession, it must identify that evidence to the Department.
3. • Timely preservation, collection, and disclosure of relevant documents and information relating to their provenance, including (a) disclosure of overseas documents, the locations in which such documents were found, and who found the documents, (b) facilitation of third-party production of documents, and (c) where requested and appropriate, provision of translations of relevant documents in foreign languages;
   1. • Note: When a company claims that disclosure of overseas documents is prohibited due to data privacy, blocking statutes, or other reasons related to foreign law, the company bears the burden of establishing the prohibition. Moreover, a company should work diligently to identify all available legal bases to provide such documents;
4. • When requested and appropriate, de-confliction of witness interviews and other investigative steps that a company intends to take as part of its internal investigation with steps that the Department intends to take as part of its investigation;[9] and
5. • When requested, making available for interviews by the Department those company officers and employees who possess relevant information; this includes, when appropriate and possible, officers, employees, and agents located overseas as well as former officers and employees (subject to the individuals’ Fifth Amendment rights), and, when possible, the facilitation of production of third-party witnesses.

As set forth in Justice Manual 9-28.720, eligibility for cooperation credit is not predicated upon the waiver of the attorney-client privilege or work product protection. Nothing herein alters the Justice Manual policy, which remains in full force and effect. Furthermore, not all companies will satisfy all the components of full cooperation, whether because they decide to cooperate only later in an investigation or they timely decide to cooperate but fail to meet all of the criteria listed above. In general, such companies should be eligible for some cooperation credit if they provide all relevant information related to individual accountability, but the benefits generally will be markedly less than for full cooperation as defined in this Policy, depending on the extent to which the cooperation is lacking.

3. Timely and Appropriate Remediation

The following items will be required for a company to receive full credit for timely and appropriate remediation under this Policy:[10]

1. • Demonstration of thorough analysis of causes of underlying conduct (i.e., a root cause analysis) and, when appropriate, remediation to address the root causes;
2. • Implementation of an effective compliance program, the criteria for which will be periodically updated and which may vary based on the size and resources of the organization, but may include:
   1. • The company’s culture of compliance, including awareness among employees that any criminal conduct, including the conduct underlying the investigation, will not be tolerated;
   2. • The resources the company has dedicated to compliance;
   3. • The quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk;
   4. • The authority and independence of the compliance function and the availability of compliance expertise to the board;
   5. • The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment;
   6. • The compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors;
   7. • The auditing of the compliance program to assure its effectiveness; and
   8. • The reporting structure of any compliance personnel employed or contracted by the company.
3. • Appropriate discipline of employees, including those identified by the company as responsible for the misconduct, either through direct participation or failure in oversight, as well as those with supervisory authority over the area in which the criminal conduct occurred;
4. • Appropriate retention of business records, and prohibition of the improper destruction or deletion of business records, including implementing appropriate guidance and controls on the use of personal communications and ephemeral messaging platforms that undermine the company’s ability to appropriately retain business records or communications or otherwise comply with the company’s document retention policies or legal obligations; and
5. • Any additional steps that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risks.

Potential Aggravating Factors

The following are examples of aggravating factors that represent elevated threats to the national security and that, if present to a substantial degree, could result in a more stringent resolution for an organization that has engaged in criminal export control and/or sanctions violations:[11]

1. • Exports of items controlled for nuclear nonproliferation or missile technology reasons to a proliferator country;
2. • Exports of items known to be used in the construction of weapons of mass destruction;
3. • Exports to a Foreign Terrorist Organization or Specially Designated Global Terrorist;
4. • Exports of military items to a hostile foreign power;
5. • Repeated violations, including similar administrative or criminal violations in the past; and
6. • Knowing involvement of upper management in the criminal conduct.

Conclusion

This Policy will serve to further deter export control and sanctions violations in the first place; encourage companies to implement strong export control and sanctions compliance programs to prevent and detect such violations; and increase the ability of the Department to prosecute individual wrongdoers whose conduct might otherwise have gone undiscovered or been impossible to prove.

[1] This Policy supersedes the Department’s “Guidance Regarding Voluntary Self-Disclosures, Cooperation, and Remediation in Export Control and Sanctions Investigations Involving Business Organizations,” dated October 2, 2016. This Policy does not create any privileges, benefits, or rights, substantive or procedural, enforceable by any individual, organization, party, or witness in any administrative, civil, or criminal matter.

[2] In export control and sanctions cases, NSD uses the definition of willfulness set forth in Bryan v. United States, 524 U.S. 184 (1998). Under Bryan, an act is willful if done with the knowledge that it is illegal. The government, however, is not required to show the defendant was aware of the specific law, rule, or regulation that its conduct may have violated.

[3] Businesses should continue to make voluntary self-disclosures to appropriate regulatory agencies under existing procedures. It is not the purpose of this Policy to alter that practice.

[4] Voluntary self-disclosures (VSDs) covered by this Policy should be emailed to CES at the following address: NSDCES.ExportVSD@usdoj.gov. VSDs can also be mailed to the Deputy Chief for Export Control and Sanctions, Counterintelligence and Export Control Section, 950 Pennsylvania Ave., NW, Washington, D.C. 20530. The current Deputy Chief is Elizabeth L. D. Cannon, elizabeth.cannon@usdoj.gov.

[5] The Fine Guidelines for corporate defendants, covered in the U.S. Sentencing Guidelines (U.S.S.G.) §§ 8C2.1 - 8C2.9, do not apply to charges for export control and sanctions violations. See U.S.S.G. § 8C2.1. Instead U.S.S.G. § 8C2.10 directs that the fine be determined pursuant to “the general statutory provisions governing sentencing.” See U.S.S.G. § 8C2.10 cmt. background. Prosecutors in these matters rely on the alternative fine provision in 18 U.S.C. § 3571(d) and on forfeiture. Under 18 U.S.C. § 3571(d), the fine would ordinarily be capped at an amount equal to twice the gross gain or gross loss. In addition, DDTC, BIS, and OFAC commonly impose administrative fines for export control and sanctions violations. Consistent with Department policy, NSD attorneys will endeavor to coordinate with and consider the amount of fines, penalties, and/or forfeiture paid to other federal, state, local, or foreign enforcement authorities that are seeking to resolve a case with a company for the same misconduct. See Justice Manual § 1-12.100.

[6] If a company makes a disclosure before it becomes aware of an ongoing nonpublic government investigation, the company will be considered to have made a voluntary self-disclosure.

[7] When a company undertakes a merger or acquisition, uncovers misconduct by the merged or acquired entity through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy (including, among other requirements, the timely implementation of an effective compliance program at the merged or acquired entity), there will be a presumption of a non-prosecution agreement in accordance with and subject to the other requirements of this Policy.

[8] The Department recognizes that a company may not be in a position to know all relevant facts at the time of a voluntary self-disclosure, especially where only preliminary investigative efforts have been possible. In such circumstances, a company should make clear that it is making its disclosure based upon a preliminary investigation or assessment of information, but it should nonetheless provide a fulsome disclosure of the relevant facts known to it at that time.

[9] Although the Department may, where appropriate, request that a company refrain from taking a specific action for a limited period of time for de-confliction purposes, the Department will not take any steps to affirmatively direct a company’s internal investigation efforts.

[10] NSD will also coordinate with the appropriate regulatory agency in assessing a corporation’s remediation efforts and compliance program.

[11] This list is not exhaustive.

[added December 2019]