Whistleblower programs seek to incentivize people with knowledge of crimes to come forward, representing a fundamental shift from the government’s historical dependence on sources who emerged through happenstance or arrest. Winston & Strawn’s Matt Graves, who announced the District of Columbia’s September 2024 whistleblower program as then-US attorney, and Kennedy Mackey map the progression from the Antitrust Division’s first-on-the-bus corporate leniency policy through multiple Biden Administration programs to the 2024 pilot initiatives that expanded both geographic reach and criminal scope beyond previously covered statutes.
While law enforcement uses a variety of tools to identify and disrupt fraud and public corruption schemes, no tool is more important than identifying people with knowledge of such schemes and incentivizing them to report on them. For many years, law enforcement did not make any concerted effort to convince sources to come forward, largely depending instead on good Samaritans who reported improper conduct because it was the right thing to do or individuals who were arrested for a crime reporting other crimes of which they were aware to try to gain more favorable treatment.
Good Samaritans and arrested individuals trying to decrease their own criminal exposure have been, and will continue to be, an important source of information. But relying on such sources is necessarily a reactive strategy: The government waits to see who comes forward and simply takes what comes to its doorstep.
Whistleblower programs are different. They seek to proactively incentivize people with knowledge of particular kinds of crimes to come forward. While such programs have existed at the DOJ for over 30 years, there has been a proliferation of these programs over the past five years, including a whistleblower program announced in September 2024. (Matt Graves, one of the two authors of this article, announced that program in his capacity as the then-US attorney for the District of Columbia.)
Collectively, these programs have fundamentally altered not just the incentives that individuals who have knowledge of wrongdoing have for coming forward, but they have also fundamentally altered the analysis that business organizations must undertake when deciding whether they should voluntarily self-disclose wrongdoing of which they are aware. To understand this paradigm shift and what leaders within the Department of Justice were trying to accomplish in announcing these programs, it is first necessary to understand the chronology.
Antitrust Division’s corporate leniency policy: the first, and for many years, only whistleblower-like program
The DOJ’s Antitrust Division is recognized for establishing one of the earliest and most well-known programs for incentivizing those with knowledge of wrongdoing to come forward, a corporate leniency policy whose terms were fleshed out in the 1990s. To be sure, there are important distinctions between programs directed at encouraging individuals to report wrongdoing and those directed at business organizations, and, colloquially speaking, one would not typically refer to a business organization as a “whistleblower.” But both kinds of programs have at their core the goal of getting those with knowledge of wrongdoing to report it — that is, to blow the whistle.
To take advantage of the corporate leniency policy, an entity typically contacts the division to begin an application. To be eligible for leniency, the division requires that the company self-report promptly after discovering wrongful conduct. Significantly, only the first company involved in the alleged wrongful conduct that reports the conduct can benefit from it. To qualify for leniency, the company must also undertake remedial measures redressing harm and improving its internal compliance program.
By contacting the division, the company is formally requesting a “marker,” which reserves the opportunity for leniency — that is, non-prosecution — if the reporting company satisfies all the requirements of the program. This program is often colloquially referred to as the first-on-the-bus policy and assuredly incentivizes business organizations that have allegedly participated in such crimes to self-report them lest some other organization beat them to the bus.
Criminal Division ultimately joins the Antitrust Division in implementing a whistleblower program, but it is very narrowly tailored
More than two decades after the Antitrust Division announced its corporate leniency policy, the Criminal Division decided to implement its own whistleblower program. The program focused exclusively on one statute the Criminal Division was tasked with enforcing: the Foreign Corrupt Practices Act (FCPA) and was aptly titled the FCPA corporate enforcement policy.
According to the published policy, “When a company has voluntarily self-disclosed misconduct in an FCPA matter, fully cooperated, and timely and appropriately remediated, all in accordance with the standards set forth below, there will be a presumption that the company will receive a declination absent aggravating circumstances involving the seriousness of the offense or the nature of the offender.” The DOJ has reported 24 resolutions from this program.
While over 20 years lapsed between the department’s first major whistleblower program and its second, the next major step came just a few years later during the Biden Administration when the department announced a host of programs across all levels.
The Biden Administration announces multiple nationwide programs
The Biden Administration took steps to incentivize both individuals and corporations to report wrongdoing.
With respect to individuals, the Biden Administration announced the corporate whistleblower awards pilot program. This program allows whistleblowers who provide the Criminal Division with original and truthful information about certain corporate crime to receive a monetary reward if the eventual resolution involves a forfeiture. To be eligible for the award, the information shared by the whistleblower must relate to (1) certain crimes involving financial institutions, from traditional banks to cryptocurrency businesses; (2) foreign corruption involving misconduct by companies; (3) domestic corruption involving misconduct by companies; or (4) healthcare fraud schemes involving private insurance plans.
The corporate enforcement policy, on the other hand, is targeted at business organizations, providing the presumption of a declination when a company voluntarily self-reports within 120 days of receiving an internal whistleblower report. Specifically, this policy provides that the Criminal Division will decline to prosecute a company for criminal conduct when (1) the company voluntarily self-disclosed the misconduct to the division, (2) the company fully cooperated with the investigation, (3) the company timely and appropriately remediated the misconduct and (4) there are no aggravating circumstances related to the nature and seriousness of the offense.
Whistleblower programs leave the Beltway and broaden in scope
The Antitrust and Criminal Division policies were, and are, administered by line attorneys and department leaders based in Washington, D.C. who were understandably focused on the statutes they were charged with enforcing. In 2024, multiple US attorneys offices sought to address these limitations by launching whistleblower programs that would be administered across the country and that would cover the broad panoply of non-violent crimes these offices are tasked with enforcing.
Akin to the others, the District of Columbia whistleblower non-prosecution pilot program provides that the government will enter into a non-prosecution agreement in exchange for an individual’s voluntary disclosure of criminal conduct and continued cooperation. An individual may engage in the program by submitting an intake form to the office of the US attorney. If upon review of the disclosure, the evaluation committee determines that a non-prosecution agreement is appropriate and warranted under the policy, the reporting individual or their representative will be contacted by the committee.
Under these pilot programs, non-prosecution agreements are available where the following seven conditions are met:
- The misconduct has not previously been made public and is not already known to USAO-DC or to any component of the DOJ.
- The individual discloses the criminal conduct voluntarily to USAO-DC and not in response to a government inquiry or obligation by any federal law enforcement or regulatory agency on the subject matter of the disclosure, not pursuant to an existing agreement to report misconduct to any federal law enforcement or regulatory agency and prior to imminent threat of disclosure or government investigation.
- The individual is able to provide substantial assistance in the investigation and prosecution of one or more equally or more culpable persons (e.g., the highest-ranking individuals criminally liable for misconduct within their organizations) and is prepared to cooperate fully with the office in its investigation and prosecution of the disclosed conduct and the recovery of any related criminal proceeds.
- The individual truthfully and completely discloses all criminal conduct in which the individual has participated and of which the individual is aware.
- The individual is not (a) a federal, state, local or foreign elected or appointed and confirmed official; (b) an official or agent of a federal, state or local investigative or law enforcement agency; (c) the highest-ranking person within the organization where the misconduct occurred (e.g., chief executive officer, executive director); or (d) the person who, regardless of title, exercises primary control over the operations of the organization where the misconduct occurred.
- The individual did not lead or originate the illegal activity and has not engaged in the use of force or violence (or threat of violence); any federal or state criminal conduct that involves the use of force or violence (or threat of violence); any federal or state sex offense involving fraud, force or coercion or a minor; and any federal or state offense involving terrorism or implicating national security or foreign affairs.
- The individual has not been previously convicted of any felony involving fraud or dishonesty; violence or the threat of violence; terrorism or implicating national security; or a sex offense involving fraud, force, coercion or a minor.
Where an individual voluntarily self-reports but falls short of the above criteria, prosecutors may use discretion and additional guidance to determine whether a non-prosecution agreement may still be extended.
For US attorneys, basing these programs outside of Washington, D.C., was meant to make it logistically easier to report crimes. Whistleblowers no longer need to report wrongdoing in Washington or to know a lawyer who practices in DC to participate in these programs. Now, people can report crimes in the jurisdiction in which they live or retain a local attorney to aid them with doing so.
More fundamentally, though, these programs expanded the kinds of crimes individuals were incentivized to report. They are not focused on a single statute, for instance. Instead, they cover effectively all non-violent federal crimes, including a host of crimes not previously covered by any nationwide program. For instance, these programs apply to public corruption crimes that were not previously covered by any program. Rooting out public corruption is always a top priority for US attorney’s offices which are often the tip of the spear for holding national, state and local public officials accountable. Incentivizing individuals with knowledge of such crimes to come forward was top of mind for those of us who launched these programs.
Whistleblower non-prosecution pilot programs will always be relevant regardless of enforcement priorities
A risk with a narrowly focused whistleblower program, like the FCPA declination program, is that enforcement priorities can shift. In early 2025, we saw a pause imposed on FCPA enforcement, rendering the declination program temporarily moot. Administrations will always have different enforcement policies. A declination program that applies equally to all anti-fraud and anti-public corruption laws can weather these shifts.
In May 2025, the department identified enforcement against (1) fraud, (2) market manipulation schemes, (3) conduct threatening the country’s national security, (4) material support by corporations to foreign terrorist organizations and (5) money laundering as its priorities. Laws used to prosecute such crimes are all covered by these whistleblower non-prosecution pilot programs.
None of this is to say, though, that there will not be improvements made to these programs. As with all programs, they will evolve over time. Once operationalized, such programs often function differently than intended and tweaks must be made. These changes can include criteria for who is eligible to participate in the program and what benefits they receive for doing so. Given how important whistleblowers are to an effective anti-fraud and anti-corruption program, though, these programs are most assuredly here to stay. At the end of the day, US attorney’s offices want individuals with knowledge of wrongdoing to come forward and to report the wrongdoing to them.
The expanding framework of programs creates challenges for companies
These programs incentivize individuals in new and different ways to report wrongdoing. As companies learn of wrongdoing, they must take into account the increased likelihood of individual reporting when considering whether and how to voluntarily self-disclose wrongdoing of which they are aware. Moreover, these various programs each have different criteria and different benefits for self-reporting, so any individual or business organization considering reporting should do so only after having a complete understanding of the criteria and benefits of all potentially applicable programs.
Matt Graves
Kennedy Mackey
