Understanding the Department of Justice's New Safe Harbor Policy

Continuing its focus on incentivizing prompt and voluntary self-disclosure of criminal misconduct, Deputy Attorney General Lisa Monaco announced earlier this month a new U.S. Department of Justice (DOJ) Safe Harbor Policy promising a presumption of prosecutorial declination for voluntary self-disclosures of criminal conduct discovered in the course of a merger or acquisition.

Under the new departmentwide policy, DOJ will decline to prosecute "acquiring companies that promptly and voluntarily disclose criminal misconduct within the Safe Harbor period, and that cooperate with the ensuing investigation, and engage in requisite, timely and appropriate remediation, restitution, and disgorgement." DOJ noted that "any misconduct disclosed under the Safe Harbor Policy will not be factored into future recidivist analysis for the acquiring company."

Application

The policy, as stated, applies only to the acquiring company. Application of the policy can extend to the acquired entity as well, provided there are no aggravating circumstances. However, presence of aggravating factors – such as significant profit from the conduct, recidivism or pervasiveness of the conduct within the company – will not shield the acquired company from criminal prosecution.

As a threshold matter, the Safe Harbor will be available only for acquirors in arm's-length deals and will not be available where conduct was already required to be disclosed or known to DOJ or the public. Companies engaged in merger and acquisition (M&A) activities and the professionals who steward them through such transactions need to understand the key elements of the new policy pertaining to timing, cooperation, remediation and monetary payment.

Timing

To qualify for the Safe Harbor, self-disclosure must occur within six months after the M&A transaction closes, regardless of whether the misconduct was discovered pre- or post-acquisition (and it must be remediated within one year, as discussed below). Monaco warned, "Companies that detect misconduct threatening national security or involving ongoing or imminent harm can't wait for a deadline to self-disclose."

This period may prove to be unfeasibly short for many transactions. Internal investigations are often slow, cumbersome activities that can take more than six months before the full scope of misconduct is apparent. For many acquiring companies, early hints of misconduct do not even come out of the woodwork until many months after acquisition, typically following turnover of existing personnel or full integration of the acquired company into the acquiring company's culture and practices. Evidence of misconduct may go unnoticed for years after a transaction where the acquired company continues to operate as a subsidiary with a level of independence from the acquiror.

Recognizing this conundrum, DOJ is "placing an enhanced premium on timely compliance-related due diligence and integration. Compliance must have a prominent seat at the deal table if an acquiring company wishes to effectively de-risk a transaction." For companies negotiating a deal, a perfunctory compliance diligence process will not satisfy this requirement and will likely prevent the acquiring company from later obtaining voluntary self-disclosure benefits if criminal misconduct is identified. Diligence in key risk areas – Foreign Corrupt Practices Act (FCPA), accounting practices, export controls, anti-money laundering, cybersecurity, supply chain integrity and procurement practices – must occur throughout the life cycle of a transaction, both pre- and post-closing. Companies that invest time and resources to conducting a thoughtful and robust compliance diligence review of M&A targets are now also investing in potentially vastly better future outcomes – including complete declination – if that diligence process identifies evidence of a crime. Of course, thoughtful and thorough compliance diligence also secures a would-be acquiror important data points for considering whether to negotiate different terms or potentially discontinue negotiations. On this point, Monaco noted, "[t]he last thing the Department wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct. … Instead, we want to incentivize the acquiring company to timely disclose misconduct uncovered during the M&A process."

Failure to take compliance diligence seriously could result in even harsher sanctions, with Monaco noting companies that do "not perform effective due diligence or self-disclose misconduct at an acquired entity" will be "subject to full successor liability for that misconduct[.]"

Cooperation

Monaco noted the importance of cooperation in connection with the new Safe Harbor Policy, providing an example of DOJ's decision to decline to charge an FCPA case following a company's timely and voluntarily self-disclosure of the misconduct, remediation and cooperation in DOJ's investigation, which included identification of individual wrongdoers. Over the past several years, DOJ has consistently highlighted the importance of cooperation during the investigation phase as a mitigating factor in both criminal and civil cases. Paramount to the concept of cooperation is the identification and appropriate discipline of individual wrongdoers – including potential compensation clawback or termination – regardless of their status or seniority at the company.

Cooperation also includes timely capture, disclosure and highlighting of all facts relevant to the department's investigation, providing access to witnesses and assistance in interpreting key documents. Again, this can pose a challenge to companies that may still be assessing the full scope and impact of wrongdoing but that want to voluntarily self-report within the Safe Harbor's six-month deadline. Companies that identify evidence of a crime in connection with M&A activity will want to consider self-reporting even in the midst of an ongoing internal investigation and position themselves as engaged in ongoing cooperation through frequent, proactive updates to the government.

Remediation

To qualify for the Safe Harbor, the conduct must not only be self-reported within six months, it must also be "fully" remediated within one year from the date of closing. Recognizing this may be an unworkable time period, Monaco noted in her speech that this deadline was a "baseline" that can be extended by prosecutors to take into account the "specific facts, circumstances, and complexity of a particular transaction[.]" Suffice to say, DOJ will expect to see companies focused on designing a tailored and effective remediation plan and then taking steps to promptly implement and complete that plan.

This timeline might be difficult even in less-complex transactions. For smaller companies, a relative lack of financial, people and technological resources may hinder their ability to create the necessary sea change in internal controls at the acquired company. This concern cannot be ignored; the majority of criminal prosecutions of corporations are of small, privately held organizations.

Monetary Payment

DOJ's new Safe Harbor Policy will require the acquiring company to disgorge profits gained from the misconduct. Though not a significant departure from past DOJ policies, this is a consideration that may wipe out the value of the investment, depending on the breadth and duration of the misconduct.

Notably, treatment of civil or other regulatory enforcement actions is not contemplated by DOJ's policy. With increasing parallelism in criminal and civil investigations – and the SEC and other agencies' own focus on incentivizing and crediting voluntary self-disclosure, cooperation and remediation – certain industries may find themselves saddled with coordinating reporting to and cooperation with multiple agencies with different internal policies and proof requirements, along with lingering risk of enforcement and civil or monetary penalties following a self-disclosure to non-DOJ agencies.

Next Steps

Note that DOJ's own press activity that can follow surrounding a company's decision to voluntarily disclose was not discussed in statements announcing the Safe Harbor. Companies that are eligible and want to take advantage of the policy should consider that DOJ may later publicly disclose the investigation and its decision to decline prosecution of the company and plan for potential financial and reputational impact therefrom, as well as possible future private class action and other claims stemming from DOJ's public disclosure after a company seeks to do the right thing by coming forward.

Holland & Knight's white collar attorneys are a dedicated team of highly experienced professionals from government, industry and academia, and are well positioned to advise on companies' most complicated and serious legal problems. If you have questions about the DOJ's Safe Harbor Policy and its impact on your business, contact the authors or another member of Holland & Knight's White Collar Defense and Investigations Team.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.