In a recent speech, Matthew R. Galeotti, the head of the DOJ’s Criminal Division, discussed changes in how the DOJ intends to conduct corporate enforcement. The speech, which followed the recent announcements of declinations by the National Security Division, provides insight into how the DOJ is likely to conduct its investigations and make charging determinations as well as guidance to companies on how to navigate a DOJ with changing enforcement priorities. Morgan Lewis partners Justin Weitz, Loyaan Egal and Katelyn Hilferty and associate Moshe Klein encourage companies to remember that self-disclosure has downsides, too.
On June 12, 2025, Matthew R. Galeotti, head of the DOJ’s Criminal Division, delivered remarks on how the recent memoranda impacting criminal enforcement guidelines fit with the DOJ’s efforts to address white-collar and corporate misconduct. Galeotti noted that the DOJ will continue rigorous enforcement of criminal activity by corporations.
Of particular note, Galeotti identified “three key areas of change”: declinations in light of self-disclosure, cooperation and remediation; reduction of corporate monitors; and increasing the efficiency of DOJ investigations. These changes include narrowing the definitions of “aggravating factors” to further incentivize voluntary self-disclosures, reducing or terminating corporate monitors when appropriate and increasing the speed for DOJ decisions to charge or decline.
The announcement came one month after the DOJ publicly released revisions to the Criminal Division’s enforcement priorities and policies for prosecuting corporate and white-collar crimes and almost two months after the DOJ’s National Security Division (NSD) declined to prosecute a NASA contractor that voluntarily disclosed export control violations committed by one of its employees.
That declination decision, only the second-ever issued under that division’s voluntary self-disclosure policy, showcases both how companies can avoid prosecutions for serious national security- and government contract-related violations and the importance of identifying potential violations.
Following Galeotti’s speech, on June 16, the NSD announced another declination after a voluntary self-disclosure by a private equity firm that acquired an entity that had committed sanctions violations by exporting to Iran and Venezuela. Although announced in June, the declination actually occurred in December 2024 and was authorized by the previous administration.
This episode underscores how, even where organizations have no actual knowledge of employee violations, such actions can be imputed to the company under basic principles of corporate liability and how DOJ’s stated policy of crediting prompt voluntary self-disclosures and fulsome cooperation can help companies mitigate those risks.
Recent NSD declination decisions
In 2016, a program administrator working under a NASA contract, who was responsible for conducting due diligence on prospective purchasers, sold software licenses to Beijing University of Aeronautics and Astronautics, an institution that was on the US Department of Commerce’s entity list, without first acquiring a license. Court documents indicate that the employee conducted such transactions intentionally knowing that a license was required to sell such licenses to organizations on the entity list. When NASA inquired about such sales, the contractor investigated the sales and immediately disclosed the violations to the DOJ before it had even completed its investigation.
According to the DOJ’s press release on the case, it did not pursue prosecution because “the company took swift and proactive measures to disclose the employee’s wrongdoing, provide all known facts and cooperate—and continue to cooperate—with the government’s investigation.”
Moreover, the company was not required to pay any disgorgement, forfeiture or restitution. In many ways, the decision is in line with the DOJ manual and DOJ policy, which focus on individual wrongdoers and favor declination when an organization voluntarily discloses a violation and cooperates with government investigations.
Despite this, decisions on whether to prosecute a corporation are reviewed independently of decisions to prosecute any individual employees of that corporation. The declination comes more than two years after the DOJ announced the employee’s guilty plea, which may indicate that there was serious consideration over whether to prosecute the company. The ultimate decision is also consistent with Galeotti’s remarks and the Criminal Division’s changing enforcement strategy as the company’s prompt self-disclosure and “extraordinary cooperation” were considered significant factors in the decision to decline prosecution.
More recently, the DOJ’s decision to decline prosecution of a private equity firm is consistent with both NSD’s mergers & acquisitions policy and Galeotti’s remarks regarding the Criminal Division and encouraging voluntary self-disclosure. In that case, the private equity firm’s cooperation with the criminal prosecution of the company’s former CEO, prompt voluntary self-disclosure following the close of the transaction acquiring the company and remediation actions were important factors in the decision to decline prosecution of the firm.
In fact, the NSD recognized the private equity firm’s status as an acquiring entity that voluntarily self-disclosed and cooperated as factors it separately credited in entering into a non-prosecution agreement (NPA) with the entity that was acquired that violated US sanctions laws.
Further implications of the NSD declination decisions
The declination decisions are notable because they showcase the criminal and regulatory risks companies face when they have substandard export control compliance programs. In these cases, DOJ noted that the companies’ prompt voluntary disclosures were significant factors in the decisions not to prosecute.
However, voluntary self-disclosure is not always a panacea. While it ultimately resulted in positive outcomes in these cases, the disclosures were not without burden or risk. The DOJ may still choose to prosecute even after a voluntary self-disclosure, and the decision may largely be determined by the level of cooperation of the disclosing company.
Therefore, despite Galeotti’s statements, the decision on whether to self-disclose violations still requires careful consideration of a variety of factors, including the severity of a violation, political or public relations risks and whether companies are prepared to engage in the necessary steps to make a self-disclosure.
Companies must be prepared to conduct rigorous internal investigations in order to respond to the department’s questions, with the understanding that results are never guaranteed and this may not resolve all of the potential liabilities arising from the violative conduct.
Even a “successful” self-disclosure could have a significant impact on a company’s business. With regard to the company that the private equity firm acquired, which separately entered into an NPA with the DOJ, the Office of Foreign Assets Control at the US Department of the Treasury ultimately settled the sanctions violations for nearly $4 million in penalties.
The public announcements and declination decisions also highlight a potential race to the bottom between companies and employees. Reports by whistleblowers may have the opposite impact of voluntary disclosures as there are further incentives for prosecution, so identifying potential violations as early as possible is key for companies working in the national security space.
As Galeotti mentioned in his remarks, despite any shifting corporate enforcement strategy, the DOJ will continue to vigorously pursue meritorious investigations and open new ones when warranted and voluntary disclosure is only part of an “aggressive and robust strategy to investigate and prosecute white-collar and corporate crime.”
On this point, Galeotti explicitly noted that “[f]or those who do not come forward despite all the benefits available: we will move aggressively—yet fairly—to prosecute white-collar offenders whose crimes undermine U.S. interests.” As Galeotti stated, key to such aggressive enforcement will be whistleblowers.
Finally, national security-related violations do not only result in criminal enforcement. Such violations can also be the source of civil claims, including False Claims Act liability, as well as suspension or debarment for government contractors.
Companies must remain vigilant and proactive with regard to their compliance programs, and Galeotti has recommended that when facing potential white collar violations “[t]his is the time for companies to self-report.”
During this unique period, such decisions still require careful consideration informed by rigorous factual investigations and legal analysis to assist companies in limiting various liabilities and risks, ranging from criminal liability to False Claims Act liability, civil claims and suspensions or debarment.
Key takeaways
- Comprehensive internal investigations are a key tool for companies, government contractors and organizations engaged in international trade and whose activities implicate national security considerations to identify potential violations and ultimately mitigate enforcement risk.
- Failure to identify violations opens the door to whistleblower reports that present the risk of criminal and civil enforcement as well as suspension or debarment. For example, the Criminal Division has amended its corporate whistleblower awards pilot program to include tips that lead to forfeiture for, among other things, trade, tariff and customs fraud by corporations.
- Changes in DOJ corporate enforcement strategy indicate that voluntary self-disclosures, including in the national security context, may result in positive outcomes for companies, including assessing whether early termination of an existing compliance agreement is warranted based on self-reporting of the conduct, and that the DOJ will continue to prosecute serious violations, especially when such violations are not disclosed. Yet, despite these policies and Galeotti’s remarks, there remain risks related to self-disclosure, including criminal prosecution. NSD’s voluntary self-disclosure program is still new, and in some circumstances, the division may determine that national security considerations require criminal prosecution despite the self-disclosure.
- Thus far, it appears the DOJ is rewarding companies that mitigate further criminal liability by voluntarily self-disclosing and fully cooperating once they discover violations, especially those related to export control and/or sanctions. However, the decision on whether to self-disclose is not without risk and should be subject to a factual investigation of the underlying potential violation and a rigorous legal analysis to ensure that all necessary factors have been considered and self-disclosure remains the most appropriate avenue.