The United States Department of Justice (DOJ) recently announced a new department-wide Mergers & Acquisitions Safe Harbor Policy that protects acquiring companies that self-disclose criminal misconduct discovered at an acquired company.[1] For acquiring companies that promptly and voluntarily disclose criminal misconduct, fully cooperate in the government’s investigation, and provide timely remediation, restitution, and disgorgement of ill-gotten gains, DOJ will presumptively decline to prosecute.

The Safe Harbor Policy is intended to encourage timely disclosures by an acquiring company with effective compliance programs that learn of criminal misconduct through the due diligence process into an acquired company. In announcing the new Safe Harbor Policy, Deputy Attorney General Lisa Monaco noted that “[t]he last thing the Department wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct. Instead, we want to incentivize the acquiring company to timely disclose misconduct uncovered during the M&A process.”[2]

The policy includes specific timelines. First, to be eligible, the acquiring company must promptly and voluntarily disclose the criminal misconduct within six months from the date of the closing. The criminal misconduct may be discovered before or after the acquisition. Second, the acquiring company must fully remediate the misconduct within one year from the date of the closing. DOJ states it will apply a reasonableness standard to permit some flexibility outside of the policy timelines depending on the specific facts and circumstances, in recognition that not all deals are the same and some are more complex than others. DOJ emphasizes, however, that criminal misconduct posing a threat to national security or involving an ongoing or imminent risk of harm should be disclosed as early as possible.

Under the Safe Harbor Policy, DOJ will address aggravating factors differently from other criminal matters.[3] Namely, acquiring companies may still receive a declination of prosecution even if there are aggravating factors present in connection with the acquired company’s misconduct. More specifically, DOJ promises that it will not take into account “in any way” the acquired company’s aggravating factors when DOJ considers whether to decline to prosecute the acquiring company.

The Safe Harbor Policy also provides some protection to the acquired company when an acquiring company voluntarily self-discloses misconduct at the acquired company. The acquired company will be eligible for potential benefits, which may include a declination, unless the acquired company has aggravating factors.

DOJ states that if a company has voluntarily self-disclosed under the Safe Harbor Policy, then DOJ will not consider any of the disclosed misconduct in any recidivist analysis, either at the time of the voluntary disclosure or at a future time. 

DOJ cautions, however, that the Safe Harbor Policy protects an acquiring company only if the criminal misconduct is “discovered in bona fide, arms-length M&A transactions.” If the misconduct is (a) already publicly known; (b) discovered in some other way; (c) already required to be disclosed; or (d) already known to DOJ, then the Safe Harbor Policy will not apply.  In addition, the Safe Harbor Policy is not meant to impact DOJ’s civil merger investigations and enforcement.  

The Safe Harbor Policy was previewed by Principal Associate Deputy Attorney General Marshall Miller in late September 2023, when he said the Safe Harbor Policy was consistent with DOJ’s “new and enhanced premium on voluntary self-disclosure.”[4] Moreover, in announcing the Safe Harbor Policy, DAG Monaco stressed that each DOJ component “will tailor its application of this policy to fit their specific enforcement regime, and will consider how this policy will be implemented in practice.”[5] 

Companies may want to wait for additional guidance to determine the interplay between the Safe Harbor Policy and other existing policies that may provide benefits from prosecution and reduction in fines for companies. For example, DOJ’s Antitrust Division’s longstanding leniency policy provides benefits to companies that are the first to self-report involvement in an antitrust conspiracy (which could be subject to criminal prosecution) and provides potential immunity for cooperating employees.[6] For companies that are actively considering deals reportable under the Hart-Scott-Rodino (HSR) Act[7] in industries where a merger review is likely, the need to understand and evaluate the potential interplay between the Safe Harbor Policy and other existing policies may be heightened, given that past merger reviews by DOJ and the Federal Trade Commission (FTC) have led to criminal enforcement proceedings.

DOJ’s Safe Harbor Policy follows a number of recent DOJ policy pronouncements that have emphasized compliance, self-disclosure, remediation, and cooperation with the government.[8] The Safe Harbor Policy in particular sends a strong message to acquiring companies that they need to perform effective due diligence and to promptly and voluntarily self-disclose any criminal misconduct at the acquired company. If they do so, they will be presumptively rewarded by DOJ with a declination of prosecution. If they fail to do so, in contrast, they’ll be subject to successor liability for the acquired company’s misconduct.

Some key takeaways from DOJ’s Safe Harbor Policy and other recent DOJ policy pronouncements:

  • Review your own compliance programs to ensure they are well designed, adequately resourced, and functioning effectively.
  • Review your M&A due diligence processes to ensure that any potential new business acquisitions are conducted with effective due diligence and that there’s timely post-acquisition integration with the acquired company, including compliance program audit and training.
  • Assess the risks and benefits of timely and voluntarily self-disclosure to DOJ when you uncover criminal misconduct at an acquired company or at your own company.

[2] Id.

[3] In DOJ’s Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy, DOJ defines aggravating circumstances to include “involvement by executive management of the company in the misconduct; a significant profit to the company from the misconduct; egregiousness or pervasiveness of the misconduct within the company; or criminal recidivism.” That policy provides that a company will not qualify for a presumption of a declination if aggravating factors are present, although the company may still obtain a declination ultimately if the company immediately and voluntarily self-disclosed misconduct, had an effective compliance program, and provided extraordinary cooperation and undertook extraordinary remediation. Id.