DOJ Voluntary Disclosure Guidance Signals Expanded Role in Export Control & Sanctions Investigations

October 24, 2016

Scott M. Flicker & Kenneth Gazzaway

In a development that could significantly alter the calculus for companies dealing with possible sanctions and export controls violations, the National Security Division of the Department of Justice recently issued guidance (the “NSD Guidance”) underscoring “the policy of the NSD to encourage business organizations to voluntary self-disclose criminal violations of” these laws.[1]

On its face, the NSD Guidance declares a benign purpose: to establish the criteria the NSD’s Counterintelligence and Export Control Section (CES) “uses in exercising its prosecutorial discretion … and in determining the possible benefits that could be afforded to an organization that makes a voluntary self-disclosure”[2] in the framework set forth by DOJ’s Principles of Federal Prosecution of Business Organizations,[3] particularly as clarified by a September 2015 Deputy Attorney General memorandum – the so-called “Yates memo” -- calling for greater individual accountability for corporate wrongdoing.[4]

But for practitioners accustomed to presenting voluntary disclosures initially (and often exclusively) to the principal regulatory agencies charged with administering the sanctions and export control laws, the NSD Guidance suggests something more: the potential for much greater DOJ involvement at the early stages of a disclosure case. Put another way, in issuing the NSD Guidance, the DOJ has signaled that it expects to be brought into the process at the outset of any investigation that could uncover willful violations of sanctions or export controls.
Sanctions and Export Control Law Enforcement

Several regulatory agencies exercise authority to enforce U.S. sanctions and export control laws designed to prevent sensitive technology and critical commodities from reaching foreign countries and agents that pose national security threats. These agencies often have overlapping jurisdiction to address potential violations. The State Department Directorate of Defense Trade Controls (DDTC) administers and enforces violations of the International Traffic in Arms Regulations (ITAR),[5] which governs the export and temporary import of defense articles and services, as set forth by the Arms Control Export Control Act (AECA).[6] DDTC is empowered by the AECA to assess civil penalties of up to $500,000 per violation.[7] The Commerce Department Bureau of Industry Security (BIS) oversees the Export Administration Regulations (EAR),[8] which regulate the export of “dual-use” items, as set forth by the Export Administration Act of 1979.[9] Finally, the Treasury Department Office of Foreign Assets Control (OFAC) implements and enforces a broad range of U.S. sanctions regulations, “based on U.S. foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States.”[10] BIS and OFAC are empowered by IEEPA to assess civil penalties of the greater of either $250,000 per violation or twice the value of the underlying transaction(s).[11]

In parallel and in coordination with these regulatory agencies, the DOJ – primarily through the CES and the appropriate U.S. Attorney’s Office – is authorized to bring criminal actions against entities and individuals who commit willful violations of sanctions and export control laws.[12]

NSD Guidance

The newly-promulgated NSD Guidance establishes the criteria for assessing the degree of credit a corporate entity will receive for voluntary self-disclosure of willful violations of export control and sanctions laws. Importantly, the DOJ clarifies that the NSD Guidelines do not apply to regulated financial institutions, due to their “unique reporting obligations under their applicable statutory and regulatory regimes.”[13] All other persons and entities subject to the jurisdiction of the U.S. export control and sanctions laws are subject to this policy.

In assessing the degree of credit to which a company is entitled, the CES will consider four main aspects of a company’s response to the wrongdoing:

(1) the company’s disclosure must be voluntary and timely;

(2) the company must cooperate fully with the DOJ’s investigation;

(3) the company must initiate timely and appropriate remediation measures to correct the malfeasance and prevent its recurrence; and

(4) the company’s behavior must not involve “aggravating circumstances” that would necessitate a stricter penalty.

Voluntary Self-Disclosure

The NSD Guidance acknowledges that companies typically make voluntary self-disclosure for violations of export control and sanctions laws to the relevant regulatory agency, and the DOJ claims that “[i]t is not the purpose of this Guidance to alter that practice.”[14] However, the NSD Guidance clearly advises that, “when an organization, including its counsel, becomes aware that the violations may have been willful, it should within a reasonably prompt time also submit a VSD to CES.”[15] This represents a substantial departure from traditional voluntary self-disclosure practices. Though the DOJ cites the willfulness standard set forth in Bryan v. United States, 524 U.S. 184 (1998) – viz, that an act is considered “willful” if done with the knowledge that it is illegal – ascertaining whether this standard applies is not always apparent at the time a company makes a self-disclosure to DDTC, BIS, or OFAC. In many cases, such determinations are made well after the initial disclosure to the regulatory agencies, with agency investigators then referring cases for criminal prosecution to the applicable U.S. Attorney’s Office and/or CES. The NSD Guidance places companies and their counsel in the precarious position of assessing at a much earlier stage in the process whether a violation “may have” been willful.

This is because, in order to receive full credit under the NSD Guidance, a company must inform the CES of willful violations of the sanctions or export control laws of its own volition. Disclosure compelled by a plea agreement, deferred prosecution agreement, or non-prosecution agreement, or after the company is informed of a government investigation on the matter will not be considered voluntary.[16] However, if a whistleblower has informed the government of a company’s violations, the company’s disclosure still may be deemed voluntary if it informs the CES before being informed of the government investigation.[17]

To get credit, the company must disclose “all relevant facts known to it,”[18] “within a reasonably prompt time after becoming aware of the offense.”[19] The company bears the burden of proving the disclosure was within a “reasonably prompt time.”[20]

The impact of the NSD Guidance will be to drive more parallel voluntary disclosures, thereby increasing the number of cases reviewed by CES for possible criminal prosecution. Indeed, this seems to be the entire point. By displaying both carrot and stick, CES is declaring an intent to play a larger role in resolution of matters heretofore handled at the agency level. What remains to be seen is how a company will fare if it makes a voluntary self-disclosure to the applicable regulator, internally reasonably concluding that the misconduct was not willful, but the agency ultimately concludes otherwise and refers the matter to CES for prosecution.
Full Cooperation

The NSD Guidance recognizes that assessment of the degree of a company’s cooperation will depend on its size and resources, as well as the scope of the alleged misconduct. As a baseline, however, all companies must satisfy the threshold requirements for cooperation set forth in the U.S. Attorney’s Manual’s Principles of Federal Prosecution of Business Organizations and the memoranda expanding on those principles.[21] In addition, the NSD Guidance provide a list of 11 requirements for full cooperation credit, which collectively describe a thorough disclosure of the full details of the misconduct, including: identification and description of the conduct of any individuals involved; preservation and production of all relevant documents and information, including materials overseas (to the extent permitted by applicable blocking statutes); proactive, detailed disclosure of internal investigation findings, including attribution of facts to specific sources; and facilitation of government interviews of U.S. and foreign employees and third parties.[22] The DOJ recognizes that a company may be limited in its ability to satisfy certain requirements by foreign jurisdiction’s conflicting laws; in such cases, the company bears the burden of proving the limitation or prohibition.[23]

Timely and Appropriate Remediation

Furthermore, a company must implement remediation measures to ensure the misconduct is stopped and avoid recurrence. The CES only will assess remediation efforts once full cooperation has been established: “a company cannot fail to cooperate and then expect to receive credit for remediation despite that lack of cooperation.”[24] Remediation includes the implementation of an effective compliance program that is routinely assessed and updated to meet evolving risks and circumstances. In addition, the company must initiate “appropriate discipline” of employees for failure to fulfill the requirements of the company’s compliance program, especially those identified as being associated with the disclosed misconduct.[25] The company also must weigh “disciplinary infractions and failure to supervise adequately” when determining employee compensation.[26]

Potential Aggravating Circumstances

Given the gravity of sanctions and export control law violations and the potential impact to national security, the NSD Guidance clarifies that certain circumstances may require harsher penalties or resolutions, regardless of the level of cooperation or remediation a company demonstrates. These circumstances include export of nuclear technology to a proliferator country, export of items involved in weapons of mass destruction, or exports to a terrorist organization or military items to a hostile foreign power.[27] In addition, the NSD Guidance reiterates aggravating factors typically considered under the U.S. Sentencing Guidelines, such as repeated violations, involvement of senior management, and significant or disproportionate profits from the illegal activity.[28]

Benefit to Business Organizations

The NSD Guidance describes a sliding scale of remedies available to CES to resolve voluntary self-disclosures of sanctions and export law violations, depending on the facts and circumstances of each case and the extent to which a company satisfies the requirements set forth in the NSD Guidance. CES could offer significantly lower penalties, including a non-prosecution agreement, reduced periods of supervised compliance, or reduced fines and forfeiture.[29] Even if the company’s conduct involved aggravating circumstances, voluntary self-disclosure, full cooperation, and swift remediation could result in a deferred prosecution agreement rather than full prosecution.[30] The NSD Guidance provides several hypothetical examples of how it may view certain factors in practice and the attenuated remedies it might seek against companies that voluntarily disclose misconduct.

Implications of the NSD Guidance

Despite DOJ’s declaration that the NSD Guidance does not alter the current manner of making of voluntary self-disclosure of violations of sanctions or export control law, in practice it is likely that counsel will advise companies to make parallel voluntary self-disclosures to both the applicable regulatory agencies and CES, even where there is some question whether the misconduct is or may be found to be willful. While CES has had tremendous success prosecuting individuals for violation of sanctions or export control laws, the role of the regulatory agencies as gatekeepers to potential criminal prosecution appears to have limited the scope of CES involvement in cases against corporate entities. For example, so far this year OFAC has announced eight settlements with companies totaling $15.6 million in penalties.[31] Of those, only one case was found to be “egregious” under OFAC standards, which include an assessment of willfulness.[32] The DOJ declined to pursue criminal prosecution in that case, but it is not known whether, if initial disclosure had been made to CES under the NSD Guidance, DOJ may have disagreed with OFAC’s assessment of the egregiousness (or willfulness) of the remaining seven cases. By incentivizing early parallel voluntary self-disclosure to CES and the regulatory agencies, the DOJ increases the likelihood that CES will have greater insight into the misconduct committed by corporate entities. Given this heightened scrutiny by prosecutors and the uncertainty surrounding the requirement for parallel disclosure based on whether the alleged conduct “may have” been willful, companies that identify potential violations of sanctions or export control law should ensure that its counsel considers both criminal and regulatory enforcement processes prior to committing to a voluntary disclosure.

[1] “Guidance Regarding Voluntary Self-Disclosures, Cooperation, and Remediation in Export Control and Sanctions Investigations Involving Business Organizations” (NSD Guidance, available at https://www.justice.gov/nsd/file/902491/download.
[2] Id. at 2.

[3] U.S. Attorneys’ Manual 9-28.000 and 9-28.900, available at https://www.justice.gov/usam/usam-9-28000-principles-federal-prosecution-business-organizations.

[4] Deputy Attorney General Sally Quillian Yates, “Individual Accountability for Corporate Wrongdoing” (Sept. 9, 2015), available at https://www.justice.gov/dag/file/769036/download.

[5] 22 CFR §§ 120-130.

[6] 22 U.S.C. §2778.

[7] Id. at § 2778(e).

[8] 15 CFR §§ 730-774.

[9] 50 U.S.C. app. §§ 2401-2420. The Export Administration Act of 1979 has been in lapse since 2001. Accordingly, administration and enforcement of the EAR is currently conducted under the authority of the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. 1701 et seq. Executive Order 13222 (Aug. 17, 2001), 66 Fed. Reg. 44025 (Aug. 22, 2001).

[10] U.S. Treasury Department, “Office of Foreign Assets Control – Sanctions Programs and Information,” https://www.treasury.gov/resource-center/sanctions/Pages/default.aspx.
[11] 50 U.S.C. § 1705(b).

[12] 22 U.S.C. § 2778(c) (providing criminal liability for violations of the AECA); 50 U.S.C. § 1705(c) (providing criminal liability for violations of sanctions and export control laws).

[13] NSD Guidance at 2, n. 3. Instead, the investigation and prosecution of export control, sanctions and other criminal violations by regulated financial institutions are conducted by NSD and the DOJ’s Asset Forfeiture and Money Laundering Section (AFMLS), in conjunction with responsible U.S. Attorney’s Offices, as well as federal and statute regulatory agencies.

[14] Id. at 3.

[15] Id. at 3-4.

[16] Id. at 4, n. 7.

[17] Id. at 5, n. 8.

[18] Id. at 5.

[19] Id. (citing U.S.S.G. § 8C2.5(g)(1)).

[20] Id.

[21] See supra, n. 3 & 4.

[22] NSD Guidance at 5-6.

[23] Id. at n. 10 & 11.

[24] Id. at 7.

[25] Id.