Dive Brief:

• Companies have six months to self-disclose misconduct in a company they’ve acquired to qualify for a prosecution safe harbor that the Department of Justice is offering as part of its stepped up self-disclosure policy, Deputy Attorney General Lisa Monaco said this week.
• “Acquiring companies that promptly and voluntarily disclose criminal misconduct within the safe harbor period, and that cooperate with the ensuing investigation, and engage in requisite, timely and appropriate remediation, restitution and disgorgement – they will receive the presumption of a declination,” Monaco told the Society of Corporate Compliance and Ethics.
• DOJ gave hints of its M&A self-disclosure safe harbor last month when Deputy Attorney General Marshall Miller talked about it before another group. In her remarks, Monaco added implementation details to the policy.

Dive Insight:

The six-month clock begins after the merger or acquisition closes. That timeline applies even if the misconduct is discovered well before that – while the acquiring company is doing its due diligence to see if the deal makes sense.

“The last thing the department wants to do is discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs and a history of misconduct,” Monaco said. 

The benefits of self-disclosure apply to the acquired company, too, as long as it doesn’t have any aggravating factors.

Monaco didn’t define what the department considers aggravating factors, but in other contexts it has identified them as persistent criminal recidivism, egregious wrongdoing and executive leadership involvement in the misconduct. 

If the acquired company does have aggravating factors, that doesn’t mean the acquiring company will be punished, she said. “The acquiring company’s ability to receive a declination” is still there, she said. 

In addition to meeting the six-month disclosure timeline, companies need to remediate the misconduct within a year of the deal closing.  

Monaco didn’t detail what remediation looks like, but in other contexts it has meant the adoption of controls, disgorging and clawing back ill-gotten gains and removing people who were responsible for the misconduct. 

Both the six-month and the one-year timelines can be extended if the company can make a case for it.  

“We recognize deals differ and not every transaction is the same,” she said. “So, depending on the specific facts, circumstances and complexity of a particular transaction, those deadlines could be extended by department prosecutors.”

If the acquired company’s misconduct has security implications for the United States, the acquiring company isn’t expected to take the full six months to disclose and full year to remediate; it’s expected to act immediately.  

“Companies that detect misconduct threatening national security or involving ongoing or imminent harm can’t wait for a deadline to self-disclose,” she said. 

Monaco encouraged companies to increase the prominence of compliance within their corporate structure. She also made clear that, in the absence of self-disclosure and remediation, companies risk taking on the acquired company’s liability as their own.  

“Your company … will be subject to full successor liability for that misconduct under the law,” she said.