The U.S. Department of Justice has outlined how companies may avoid criminal prosecution by voluntarily disclosing violations of U.S. national security laws under its new corporate enforcement policy.
Guidance from the Department’s National Security Division makes clear that companies that disclose misconduct early, cooperate fully, and remediate effectively may receive a declination of prosecution.
The policy effectively creates a binary outcome: companies that disclose promptly may avoid prosecution, while those that delay risk full enforcement exposure.
For businesses operating internationally or handling sensitive technologies, early disclosure is no longer just a compliance option—it can shape the enforcement outcome.
The Policy Framework
The DOJ’s announcement builds on its department-wide corporate enforcement policy (CEP), introduced on 10 March 2026 to bring greater consistency to how corporate criminal cases are handled.
Within that framework, the Department has clarified how companies should approach voluntary self-disclosure in national security-related matters.
These include potential violations of U.S. export control and sanctions laws, such as the Arms Export Control Act, Export Control Reform Act, and International Emergency Economic Powers Act.
The DOJ emphasises that companies and their employees play a key role in preventing unlawful exports of sensitive goods, technologies, and services, as well as prohibited transactions involving sanctioned countries or designated individuals.
Under the policy, companies that identify potential misconduct are encouraged to voluntarily disclose it to the appropriate DOJ component.
In national security matters, this responsibility sits with the National Security Division, which leads prosecutions in this area.
The guidance also clarifies how disclosures should be handled in practice. Reports must be directed to the appropriate division, but a good-faith disclosure made to one DOJ component may still qualify if the matter is later handled by another.
Legal Exposure and Enforcement Approach
The DOJ states that the policy is designed to incentivise companies to come forward when misconduct is identified, while allowing enforcement authorities to focus on culpable individuals and serious wrongdoing.
Companies that voluntarily disclose misconduct, fully cooperate with investigators, and appropriately remediate issues may receive significant benefits, including a potential decision by the DOJ to decline prosecution, subject to certain conditions.
The Department also emphasises that all resolutions under the policy must be approved by the Assistant Attorney General responsible for the relevant division, reinforcing central oversight and consistency in decision-making.
The announcement does not relate to a specific enforcement action, and no charges or penalties are outlined.
Instead, it sets out how companies may reduce potential criminal exposure under U.S. national security laws, including those arising under export control and sanctions regimes, as well as other national security-related conduct.
While the policy allows for the possibility of avoiding prosecution, this outcome is not automatic and may not apply where aggravating factors are present. No sentencing or enforcement proceedings are described in the release.
Why this Matters for Business
For general counsel and compliance leaders, the policy shifts self-disclosure from a procedural step to a decision that can directly affect whether a company faces prosecution.
The DOJ makes clear that timing is critical. Companies that identify potential misconduct must decide quickly whether to disclose, as delays or incomplete reporting may reduce the likelihood of a favourable outcome.
The requirement to report to the appropriate DOJ component also introduces a practical governance challenge.
Organisations must ensure that escalation pathways are clearly defined and that internal teams understand where responsibility sits, particularly in cross-border matters involving national security risks.
Disclosure alone is not sufficient. The policy emphasises full cooperation and effective remediation, meaning companies must be able to investigate issues promptly, address root causes, and implement corrective controls.
The guidance also reinforces the continuing risk of individual liability.
While companies may receive favourable treatment, the DOJ states that the policy supports pursuing culpable individuals, creating parallel exposure for executives and employees involved in the underlying conduct.
The announcement also reflects a broader enforcement approach. By introducing a department-wide framework, the DOJ is moving towards more consistent treatment of corporate misconduct across divisions, while maintaining discretion to prosecute where appropriate.
The emphasis on voluntary disclosure, cooperation, and remediation indicates a continued focus on encouraging companies to come forward, particularly in areas involving export controls and sanctions.
For multinational organisations, the message is clear: failures in these areas can move rapidly from internal compliance issues to criminal exposure if not addressed promptly.
Early detection and timely engagement with enforcement authorities are now central to managing that risk.
What Companies Should do Now
The guidance is already in effect as part of the DOJ’s corporate enforcement policy introduced on 10 March 2026.
Companies that identify potential violations of U.S. national security laws should assess promptly whether voluntary disclosure is appropriate and ensure that any disclosure is directed to the correct DOJ component.
This requires clear internal escalation processes and coordination between legal, compliance, and operational teams.
Organisations should also be prepared to support any disclosure with full cooperation and evidence of remediation, including steps taken to investigate the issue and address underlying control failures.
Case Details
Court: Not specified in the DOJ release
District: Not specified in the DOJ release
Case posture: Policy guidance (no specific case)
Lead investigative agencies: Not specified in the DOJ release
DOJ components: U.S. Department of Justice, National Security Division
Date of announcement: 30 March 2026
People Also Ask
What is voluntary self-disclosure to the DOJ?
It is when a company reports potential criminal misconduct to the U.S. Department of Justice before it is identified by enforcement authorities, which may lead to more favourable treatment.
Can a company avoid prosecution by self-reporting to the DOJ?
According to the DOJ, companies may receive a declination of prosecution if they voluntarily disclose misconduct, cooperate fully, and remediate appropriately, subject to certain conditions.
When should a company self-report a potential violation to the DOJ?
The DOJ guidance emphasises early disclosure. Companies that identify potential violations are encouraged to assess promptly whether voluntary disclosure is appropriate.