• On October 4, 2023, the U.S. Department of Justice announced a new enforcement policy for mergers and acquisitions that creates a presumptive six-month “safe harbor” during which an acquiring company can self-report misconduct at an acquired entity without fear of prosecution. The new policy requires acquiring companies to conduct thorough pre-acquisition or immediate post-acquisition due diligence in a bona fide M&A transaction; promptly and voluntarily disclose criminal misconduct at an acquired entity to DOJ within six months of closing; cooperate with any ensuing investigation; fully remediate the misconduct within one year of closing; and engage in timely and appropriate restitution and disgorgement.
• The new policy establishes that aggravating circumstances at the acquired company will not prevent the acquiring company from accessing the safe harbor, and explicitly expands potential eligibility for the safe harbor to the acquired entities, which was not entirely clear under prior DOJ guidance.
• Although companies undertaking this analysis will be aided by the clarity of the new policy, it remains to be seen how DOJ will apply the policy in enforcement actions and whether this new guidance will materially alter the voluntary self-disclosure calculus.

On October 4, 2023, Deputy Attorney General Lisa Monaco of the U.S. Department of Justice announced a new “safe harbor” policy for voluntary self-disclosures in connection with mergers and acquisitions (the “Policy”). The Policy modifies DOJ’s prior guidance on successor liability and further applies it across the Criminal Division.

Although the new Policy largely tracks former guidance (both formal and informal), it does provide some useful bright lines. More specifically, the Policy now explicitly creates a “safe harbor” from prosecution for acquiring companies that:

• Conduct thorough pre-acquisition or immediate post-acquisition due diligence in a bona fide M&A transaction;
• Promptly and voluntarily disclose criminal misconduct at an acquired entity to DOJ within six months of closing;
• Cooperate with any ensuing investigation;
• Fully remediate the misconduct within one year of closing; and
• Engage in timely and appropriate restitution and disgorgement.

The Policy also establishes that aggravating circumstances at the acquired company will not prevent the acquiring company from accessing the safe harbor. Additionally, consistent with DOJ’s Corporate Enforcement Policy, acquired companies may be eligible for a declination if there are no aggravating circumstances.

The Policy differs from prior guidance regarding successor liability in several other respects:

• Most significantly, the Policy explicitly expands potential eligibility for the safe harbor to additional entities. Under prior DOJ guidance, an acquiring company would receive the presumption of a declination if it met the requirements of the Corporate Enforcement Policy, including self-reporting, cooperation and remediation. The Policy now provides expressly that this presumption also will apply to the acquired company.
• Under the Policy, such a declination will cover both pre- and post-closing misconduct within the six-month safe harbor period. That includes both successor liability for pre-closing misconduct and the acquirer’s primary liability for post-closing misconduct, giving the successor company six months to remediate any lingering issues. This will be particularly helpful where the acquiring company was unable to conduct full anti-corruption due diligence pre-closing, whether due to the structure of the deal or for another reason.
• Conduct disclosed under the Policy will not be included in any future assessment of whether a company is a recidivist.
• The Policy adds specific timeframes for reporting and remediation, subject to a reasonableness analysis, replacing the “as quickly as practicable” timeframe provided by prior DOJ guidance.

Further Analysis. DOJ’s new Policy is explicitly designed to encourage companies to give the compliance function “a prominent seat at the table” in M&A transactions. As with DAG Monaco’s 2022 speech and memorandum, it emphasizes both voluntary self-disclosure and timeliness, and it now provides some welcome clarity regarding how long is presumed “reasonable.”

Although the potential of a safe harbor for an acquired entity reduces the threat of criminal monetary penalties effectively being levied on the successor, both entities remain obligated to disgorge profits if obtaining a declination under the Corporate Enforcement Policy. Given that DOJ’s disgorgement calculations often can be onerous, this can serve as a significant deterrent.

As we pointed out in 2018, when the then-Deputy Assistant Attorney General proposed offering self-disclosing acquirers declinations with disgorgement, “that form of resolution is far less attractive to a successor company than a true declination (i.e., not charging a company or seeking any settlement), along the lines suggested by DOJ and the SEC in their 2012 Resource Guide to the U.S. Foreign Corrupt Practices Act.” Accordingly, this Policy may increase the number of acquiring companies that seek to build clawback provisions into their acquisition agreements, retroactively reducing the purchase price to account for any previously earned profit disgorged to the government.

Finally, the Policy leaves unanswered whether successor liability will become the norm for acquirers that do not voluntarily self-disclose, as opposed to a theory deployed in “limited circumstances, generally in cases involving egregious and sustained violations.” The suggestion in DAG Monaco’s speech that non-self-disclosing companies “will be subject to full successor liability for misconduct under the law” is a significant threat and certainly an incentive for voluntary self-disclosure. However, as has always been the case, voluntary self-disclosure is not the only factor to be weighed under the Principles of Federal Prosecution of Business Organizations. While companies that do not self-disclose will not receive a safe harbor, they likely still would receive some benefit from cooperation, remediation, the potential for civil or regulatory remedies and the other factors listed in the Principles.

Conclusion. Rigorous compliance due diligence in M&A transactions has many benefits, such as enabling an acquiring company to properly value an acquisition and to cease pursuing a transaction that exhibits too much risk. Given the short (six-month) timeframe of the safe harbor, companies that are unable to perform rigorous diligence before the deal closes will need to be prepared to move expeditiously to identify any misconduct post-closing.

The Policy may provide a clearer path forward for acquiring companies that have identified an issue and want the benefit of self-disclosure. However, the practical reality is that the costs of an investigation and potential disgorgement must be weighed against the value of the assets to be acquired and the likelihood that DOJ otherwise would discover the past misconduct. Although companies undertaking this analysis will be aided by the clarity of the Policy, it remains to be seen how DOJ will apply the Policy in enforcement actions and whether this new guidance will materially alter the voluntary self-disclosure calculus.