backOn October 4, 2023, the Department of Justice’s (“DOJ”) Deputy Attorney General Lisa Monaco announced a new “Mergers & Acquisitions Safe Harbor Policy” (“M&A Safe Harbor Policy” or “Policy”) for companies that voluntarily self-disclose corporate criminal misconduct to the Department of Justice. Under the new M&A Safe Harbor Policy, companies that engage in a merger or acquisition and voluntarily and timely self-disclose criminal misconduct at the acquired company will receive a presumption of a criminal declination if they cooperate with the DOJ’s ensuing investigation and “engage in requisite, timely and appropriate remediation, restitution, and disgorgement.”1Lisa O. Monaco, Deputy Att’y Gen., Remarks at the Soc’y of Corp. Compliance and Ethics’ 22nd Ann. Compliance & Ethics Inst. (Oct. 4, 2023), available here.
The M&A Safe Harbor Policy reflects the latest step in the DOJ’s ongoing effort to incentivize companies to voluntarily self-disclose criminal conduct, as explained in King & Spalding’s Client Alert in March of this year.2For additional background and information about the DOJ’s policy announcements regarding voluntary self-disclosures, see King & Spalding’s March 13, 2023 client alert, available here. Although it remains to be seen how the M&A Safe Harbor Policy will be implemented by individual DOJ components—and the Policy has not yet been published or incorporated into the Justice Manual—its announcement emphasizes the value of having effective and rigorous compliance, legal, and deal diligence teams that are able to identify potential compliance issues prior to transaction closing, promptly assess and address such issues post-closing, and integrate acquired companies into the acquirer’s compliance program, and who can carefully assess the difficult strategic question of whether, when, and how to undertake a voluntary self-disclosure.
October 4, 2023 Announcement of Mergers & Acquisitions Safe Harbor Policy
On October 4, Deputy Attorney General (“DAG”) Lisa Monaco gave public remarks in Washington, DC at the Society of Corporate Compliance and Ethics’ Annual Compliance & Ethics Institute, at which she announced the new M&A Safe Harbor Policy for voluntary self-disclosures stemming from mergers and acquisitions. In her remarks, DAG Monaco explained that under the M&A Safe Harbor Policy, self-disclosing companies will be required to take the following steps to avail themselves of its benefits:
- Irrespective of when the misconduct is discovered, voluntarily disclose misconduct discovered at the acquired entity within 6 months of the transaction close date;
- Cooperate with any ensuing investigation by DOJ; and
- Fully remediate the misconduct within 12 months of the transaction close date, including paying restitution and disgorgement as applicable.
Companies that disclose misconduct consistent with the M&A Safe Harbor Policy will “receive the presumption of a declination.”3Id. DAG Monaco signaled some flexibility in the timelines specified in the Policy, observing that both the reporting and remediation timelines are “subject to a reasonableness analysis,” and noted that “deals differ and not every transaction is the same.”4Id.
Significantly, DAG Monaco stated that the presence of aggravating factors will be “treated differently in the M&A context.” Most of DOJ’s formal voluntary self-disclosure policies state that the presence of aggravating factors—circumstances like pervasive misconduct, the involvement of senior management, significant profit, or criminal recidivism—can overcome the presumption in favor of a declination (or against a guilty plea, depending on the specific self-disclosure policy). However, DAG Monaco made clear that “[t]he presence of aggravating factors at the acquired company will not impact in any way the acquiring company’s ability to receive a declination.”5In this way, the Safe Harbor Policy resembles the Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy, which provides that “[i]n appropriate cases, an acquiring company that voluntarily self-discloses misconduct as set forth in this paragraph may be eligible for a declination, even if aggravating circumstances exist as to the acquired entity.” U.S. Dep’t of Just., Crim. Div., 9-47.120 Corp. Enf’t and Voluntary Self-Disclosure Pol’y (Jan. 2023), available here. In her remarks, DAG Monaco explained that the DOJ will treat acquired entities under a slightly different framework, stating that “[u]nless aggravating factors exist at the acquired company, that [acquired] entity can also qualify for applicable [voluntary self-disclosure] benefits, including potentially a declination.”6Monaco, supra note 1.
Furthermore, DAG Monaco announced that conduct that is disclosed under the M&A Safe Harbor Policy will not affect the DOJ’s criminal recidivist analysis “at the time of the disclosure or in the future,” and that “any misconduct disclosed under the Safe Harbor Policy will not be factored into future recidivist analysis for the acquiring company.”7Id..
In announcing the new Policy, DAG Monaco said in her announcement that “[t]he last thing the Department [of Justice] wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct. Instead, we want to incentivize the acquiring company to timely disclose misconduct uncovered during the M&A process.” At the same time, she cautioned that “full successor liability” will remain on the table for companies that do not engage in effective due diligence or self-disclose misconduct at an acquired entity.8Id.
Broader DOJ Effort to Formalize and Incentivize Voluntary Self-Disclosure of Corporate Criminal Misconduct
The October 4 announcement of the M&A Safe Harbor Policy is the latest step in a recent DOJ effort to formalize and implement voluntary self-disclosure policies across DOJ. In September 2022, DAG Monaco issued a policy memorandum announcing revisions to the Department’s Corporate Criminal Enforcement Policies. Among other policy announcements, the September 2022 “Monaco Memo” instructed all DOJ components that prosecute corporate crime to develop formal, written voluntary self-disclosure policies. According to DAG Monaco, all DOJ voluntary self-disclosure policies should set forth expectations for voluntary self-disclosures, as well as benefits that self-disclosing companies should expect to receive, and offered the following core principles:
- Presumption Against Guilty Plea: “[A]bsent the presence of aggravating factors, the Department will not seek a guilty plea where a corporation has voluntarily self-disclosed, fully cooperated, and timely and appropriately remediated the criminal conduct.”9Lisa O. Monaco, Deputy Att’y Gen., Mem. on Further Revisions to Corp. Crim. Enf’t Pol’ys Following Discussions with Corp. Crime Advisory Grp. (Sept. 15, 2022), available here.
- Presumption Against Monitorship: “[T]he Department will not require the imposition of an independent compliance monitor . . . if [the corporation] also demonstrates that it has implemented and tested an effective compliance program.”10Id.
After the Monaco Memo, a number of DOJ components have issued or updated voluntary self-disclosure policies (links all provided below), including: (1) the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy (Jan. 2023);11Crim. Div., supra note 4. (2) the United States’ Attorneys’ Offices Voluntary Self-Disclosure Policy (Feb. 2023);12U.S. Dep’t of Just., U.S. Att’ys Offs., Voluntary Self-Disclosure Pol’y (Feb. 2023), available here. (3) the Civil Division Consumer Protection Policy (Feb. 2023);13U.S. Dep’t of Just., Civ. Div., Consumer Prot. Branch, Voluntary Self-Disclosure Pol’y for Bus. Orgs. (Feb. 2023), available here. (4) the National Security Division Enforcement Policy for Business Organizations (updated March 2023);14U.S. Dep’t of Just., Nat’l Sec. Div., Enf’t Pol’y for Bus. Orgs. (Mar. 1, 2023), available here. (5) the Tax Division Corporate Voluntary Self-Disclosure Policy (March 2023);15U.S. Dep’t of Just., Tax Div., Corp. Voluntary Self-Disclosure Pol’y (Mar. 2023), available here. and (6) the Environmental and Natural Resources Division’s (ENRD) Voluntary Self-Disclosure Policy (updated March 2023).16U.S. Dep’t of Just., Envtl. Crimes Sec., Env’t & Nat. Res. Div., Voluntary Self-Disclosure Pol’y (Mar. 2023), available here.
As a general matter, the various DOJ voluntary self-disclosure policies require disclosures to be made “prior to an imminent threat of disclosure or government investigation”; “prior to the misconduct being publicly disclosed or otherwise known to the government”; and within a “reasonably prompt time after the company becoming aware of the misconduct, with the burden being on the company to demonstrate timeliness.”17See, e.g., Crim. Div., supra note 4; U.S. Att’ys Offs., supra note 10; Civ. Div., supra note 11; Nat’l Sec. Div., supra note 12; Tax Div., supra note 13; Envtl. Crimes Sec., supra note 15. The policies also generally require self-disclosing companies to disclose “all relevant, non-privileged facts known to it, including all relevant facts and evidence about all individuals involved in or responsible for the misconduct at issue, including individuals inside and outside of the company regardless of their position, status, or seniority.”18Crim. Div., supra note 4. See also U.S. Att’ys Offs., supra note 10; Civ. Div., supra note 11; Nat’l Sec. Div., supra note 12; Tax Div., supra note 13; Envtl. Crimes Sec., supra note 15.
Key Considerations for Acquiring and Acquired Companies
The announcement of the M&A Safe Harbor presents critical strategic and compliance considerations for companies that might participate on either side of a merger or acquisition, and reinforces that DOJ is paying close attention to potential liability associated with acquisitions of all shapes and sizes.
As an initial matter, the M&A Safe Harbor Policy and the DOJ’s voluntary self-disclosure policies are limited to corporate criminal misconduct, and do not extent to individual accountability or civil enforcement efforts, complicating the already difficult considerations companies must consider when deciding whether to voluntarily self-disclose criminal conduct to the DOJ. In fact, DAG Monaco made clear in her October 4 remarks that corporate voluntary self-disclosures and the M&A Safe Harbor Policy were intended to facilitate greater individual accountability, stating that “by giving a path to resolution and declination to companies trying to do the right thing, we are able to identify and prosecute the individuals who are not.”19Monaco, supra note 1. In addition, DAG Monaco made clear that each DOJ component “will tailor its application of this policy to fit their specific enforcement regime, and will consider how this policy will be implemented in practice.”20Id. This caveat makes clear that although the M&A Safe Harbor Policy offers meaningful benefits and some helpful context to companies, there is still significant risk and uncertainty associated with potential self-disclosures. A company’s decision whether to self-disclose potential misconduct will rarely be a straightforward or clear-cut decision, and will require difficult assessments about mixed facts and intent, risk mitigation, individual culpability, the presence of legal defenses to potential misconduct, and potential DOJ approaches to civil enforcement and individual accountability. Further, a company should consider the implications of such self-disclosure regarding parties not bound by the M&A Safe Harbor Policy. Any self-disclosure should be considered in the context of potential litigation or enforcement from regulatory bodies not under the purview of DOJ, from states and from shareholders directly.
For acquiring companies, the M&A Safe Harbor Policy places a further premium on having sophisticated, rigorous, and efficient compliance, diligence and integration programs, teams and processes that are able to (1) identify potential substantive compliance issues in deal diligence often with only partial information pre-closing and often on an accelerated timeline, and (2) integrate acquired companies into an effective corporate compliance program promptly and efficiently post-closing. The M&A Safe Harbor Policy’s timelines—generally requiring disclosures within 6 months of transaction close and remediation within one year—mean that companies wishing to consider taking advantage of the Policy will have to move quickly to undertake the work needed to consider and undertake voluntary self-disclosures. These tight timelines further emphasize the need for acquiring companies to undertake rigorous compliance diligence during the transaction, which may rely more on substantive issue assessments and attempts to obtain detailed, sensitive business information, than on standard contractual representations and warranties from the acquired company.
Identifying potential compliance issues before closing can help to best position the acquiring company to evaluate the full range of options and flexibility in determining whether (1) to continue with the transaction at all, and (2) how to investigate further post-signing and/or post-closing and address identified compliance issues, including through a potential self-disclosure after the transaction closes. Other transaction-related areas for careful consideration could include the specific terms of the transaction that could bear on the remediation of possible compliance issues and potential self-disclosures, including holdback and reserve amounts or specific rights to indemnification coverage, to address the remediation of risk areas and potential civil exposure, along with evaluating executive employment/compensation agreements (including evaluating possible clawback provisions for retained executives) and advancement and indemnification agreements for directors and officers of the acquired company.
For early-stage or developing companies that anticipate being acquired, the M&A Safe Harbor Policy reinforces that an effective compliance program can meaningfully increase the company’s likelihood of a successful exit and may impact potential transaction value. The Policy will likely incentivize acquiring companies to consider undertaking more rigorous and substantive compliance diligence, and it may increase the likelihood that compliance issues will be identified prior to a transaction close. Although DAG Monaco made clear in her remarks that the DOJ does not want to “discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct,”21Id. companies that identify a compliance issue prior to a transaction simply have more flexibility to evaluate the terms of any transaction than companies that discover a compliance issue after a transaction is closed. As a practical matter, acquiring companies may be less willing to purchase companies with known or suspected compliance issues along with the attendant risks and liabilities that could ensue, at least without materially changing the deal terms; and even if an acquiring company avails itself of the M&A Safe Harbor Policy to reduce prospective risk, it will be expected to undertake a retrospective internal review, cooperate with a DOJ investigation, remediate the compliance issues, navigate personnel issues associated with any potential responsible parties, and pay some civil remedy. On the other hand, companies may be more willing—and willing to pay more—to acquire companies with an effective compliance program in place.
Economic headwinds including geopolitical instability, increased cost of capital, an uncertain or challenging regulatory approval process, and labor market challenges already present a dynamic matrix of business risks for companies and their executives when evaluating a potential corporate transaction. Corporate self-disclosures, in the M&A context and otherwise, are necessarily fact- and situation-dependent, and become inherently unpredictable after a disclosure has occurred (including risks as to third parties that may have interests implicated in a disclosure). Frequently, it is unclear whether resolution of a compliance concern identified in diligence (or otherwise) by self-disclosure to DOJ is more advantageous when compared to responsibly addressing the identified issues without self-reporting. These additional considerations resulting from DOJ’s new M&A Safe Harbor Policy do not make the calculation any easier, other than underscoring the incentives—be they carrots or sticks—associated with compliant business practices.
