DOJ Issues Updated Export Control and Sanctions Enforcement Policy for Business Organizations

On December 13, 2019, the U.S. Department of Justice (DOJ) announced the release of a revised policy for business organizations regarding voluntary disclosures of export control and sanctions violations (VSD Policy) where there are potentially “willful” violations. The updated policy is intended to incentivize businesses to voluntarily self-disclose any such potentially willful violations and to cooperate fully with the government. The revised policy also reflects a recent push from government organizations to foster a greater public-private partnership to promote national security.

The policy states that “business organizations and their employees are at the forefront of the effort to combat export control and sanctions violations. As the gatekeepers of our export-controlled technologies, business organizations play a vital role in protecting our national security.” The policy’s stated goals are to deter and prevent export control and sanctions violations, encourage the implementation of stronger compliance programs, and increase DOJ’s ability to prosecute individual wrongdoers.

The VSD Policy highlights that when a company: (1) voluntarily self-discloses violations to the National Security Division’s Counterintelligence and Export Control Section (CES); (2) fully cooperates; and (3) timely and appropriately remediates, then “there is a presumption that the company will receive a non-prosecution agreement and will not pay a fine, absent aggravating factors.” The VSD policy clarifies that if aggravating factors are present, but the company has voluntarily self-disclosed, fully cooperated, and timely and appropriately remediated, then DOJ will: (i) agree to a fine that is at least 50% less than the amount normally imposed; and (ii) will not require the appointment of a monitor if, by the time a resolution is reached, the company has implemented an effective compliance program.

The VSD notes that businesses will not be allowed to retain any of the profits obtained for any transaction the government identifies as a violation and will be required to pay such profits to the government as restitution.

To obtain the benefits of the VSD policy, a company must satisfy the following requirements:

• Voluntary Self-Disclosure: The company must disclose the violation to CES prior to any disclosure or government investigation, promptly after becoming aware of the offense, and the company must demonstrate the timeliness of its report to CES. Further, all facts must be disclosed, including the identity of all individuals involved in and responsible for the violation.
  • Notably, the policy requires disclosure directly to CES – a disclosure to a regulatory agency such as the Office of Foreign Assets Control, the Directorate of Defense Trade Controls, or the Bureau of Industry and Security is not sufficient to obtain the VSD Policy benefits in any subsequent DOJ investigation. Of course, a disclosure could be filed simultaneously with CES and a regulatory agency.
• Full Cooperation: The company must disclose on a timely basis all the relevant facts, including those obtained through an internal investigation, along with timely updates on the internal investigation. The company also must engage in proactive cooperation by disclosing all relevant facts and evidence, and preserving, collecting, and disclosing relevant documents and their provenance, and facilitating third-party production. The company must on request de-conflict witness interviews and other investigative steps that the company intends to take as part of its internal investigation, and must make employees and third-party witnesses available for interviews with DOJ.
• Timely and Appropriate Remediation: The company must demonstrate that it took prompt and effective action to remediate the misconduct. The company must conduct a thorough analysis of the root causes of the noncompliance and implement action to address the root causes. It must also implement an effective compliance program that includes employee training and effective resource allocation based on a risk assessment, a program tailored to the identified risks, effective audits, and a reporting system. The company must also implement appropriate disciplinary actions with regard to any employee that engages in violations, and must implement an appropriate record-keeping policy. The company must also take any additional steps needed to remedy the issue.

Aggravating Factors identified by the VSD that would serve to limit, the potential benefits of the policy include:

• exporting items controlled for nuclear nonproliferation or missile technology reasons to a proliferator country;
• exporting items known to be used in the construction of weapons of mass destruction;
• exporting to a foreign terrorist organization or a specially designated global terrorist;
• exporting military items to a hostile foreign power; repeating violations; or
• the knowing involvement of upper management.

The key takeaways from the updated policy are:

• First, the clear guidance that qualifying companies will receive a non-prosecution agreement is a substantial incentive for companies to consider disclosure.
• Second, the emphasis that a voluntary disclosure must be made directly to DOJ and not to the regulatory agencies means that companies uncovering potentially significant violations should carefully consider when making a disclosure, whether direct contact with DOJ is appropriate.
• Third, given that the DOJ guidance addresses instances of “willful” conduct, a company will have to determine in advance whether the potential disclosure warrants the attention of DOJ and the regulatory bodies – or just the regulatory bodies. Such a determination is not without risks as the regulatory agencies can refer cases to DOJ and enforcement officers and prosecutors alike have the benefit of “20-20 hindsight”.
• Fourth, the requirement to de-conflict witness interviews and other internal investigation steps upon DOJ request, combined with the requirement for direct notice to DOJ, could lead to a situation at odds with the common practice for disclosure of potential civil export and sanctions violations. Typically, the process for disclosures to the regulatory agencies generally permits a company to conduct its own thorough investigation and begin remediation before the agency enforcement offices do their own confirmatory review and investigation.  nder the revised VSD policy, a company may be required to make a disclosure prior to completing its internal investigation, and may find that investigation limited by governmental investigatory actions.  s a consequence, companies encountering a potential violation will need to assess carefully the risk of criminal liability to evaluate the timing of a potential disclosure and to whom such a disclosure should be made.