New DOJ Safe Harbor Policy for Voluntary Self-Disclosures in M&A Transactions—What You Should Know

Overview

In October 2023, the U.S. Department of Justice (DOJ) unveiled a department-wide Safe Harbor Policy (the Policy) for voluntary self-disclosures made in the context of merger and acquisition transactions. In announcing the Policy, Deputy Attorney General Lisa O. Monaco stated a simple goal: "[G]ood companies — those that invest in strong compliance programs—will not be penalized for lawfully acquiring companies when they do their due diligence and discover and self-disclose misconduct." The Policy professes to grant a presumption of a declination to companies that promptly and voluntarily disclose criminal misconduct discovered during an arms-length M&A transaction, but there are certain criteria for securing its benefits:

• Criminal conduct: The Policy applies only to criminal conduct discovered in the M&A transaction and not to misconduct that was already public or known to DOJ. The Policy does not impact civil merger enforcement.
• Timely disclosure: The discovered misconduct must be disclosed within six months of the date of closing the M&A transaction (whether it was discovered pre- or post- closing).
• Timely remediation: In general, misconduct should be fully remediated within one year of the date of disclosure. The remediation of matters involving national security threats or imminent harm must be addressed immediately, and the Policy allows discretionary extensions to remediation deadlines based on the facts and circumstances of each transaction.
• Complete remediation: Disclosing companies are expected to cooperate with any related government investigation and fully remediate the misconduct, including the restitution and disgorgement of profits from the misconduct where appropriate.

Misconduct disclosed under the Policy will not be factored in to any future recidivist analysis for the acquiring company.

Key takeaways

Meeting the tight timelines to qualify for declination under the Policy requires proactive, comprehensive diligence pre-closing and swift integration of an acquired company into the acquirer's compliance program post-closing. Developing a robust integration plan, including compliance training and establishing reporting channels for compliance-related issues, can help position an acquirer to identify misconduct where diligence was limited during the acquisition process. Although the Policy is intended to be implemented consistently across all DOJ departments, each component is empowered to tailor the Policy to achieve its individual enforcement mandate. As with any voluntary self-disclosure, companies should carefully weigh with counsel the risks and uncertainty regarding application of the Policy against the potential benefits of disclosure.