CLIENT ALERT: 2026 Mid-Year Update on DOJ Corporate and White Collar Enforcement

Jul 21, 2026

KEY TAKEAWAYS

One disclosure framework now governs: DOJ has adopted its first Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (“CEP”), applicable to all corporate criminal matters across every component and all 93 U.S. Attorney’s Offices (except Antitrust).
Self-disclosure benefits are more predictable but narrower: The three-path structure (declination, “near miss” non-prosecution agreement, other resolutions) survives, but the near-miss fine reduction moved from a fixed 75% to a discretionary 50% to 75% range, and the most favorable outcomes still require getting to DOJ before a whistleblower or relator does.
FCPA enforcement has tapered, but exists: Enforcement continues under the 2025 executive order and June 2025 guidelines, with national security, cartels, and competitiveness prioritized. Limitations periods outlast any administration, so significant compliance rollbacks remain risky.
Trade/customs fraud enforcement remains active: Customs-related False Claims Act (FCA) actions, led by the DHS-DOJ Trade Fraud Task Force, produced a $549.5 million aluminum-duty settlement and treble-damages exposure for misclassification, undervaluation, origin masking, and duty evasion, reaching back years.
National security disclosures must go through NSD: A disclosure to the civil/regulatory agencies that administer U.S. export-control alone does not earn CEP credit for criminal exposure, it must go through the Department’s National Security Division (“NSD”). NSD’s first declination (Bosch) confirms both the reach of U.S. export controls over foreign subsidiaries and the value of a properly routed voluntary self-disclosure.
Health care and CFIUS enforcement focus: A Medicaid focused June 2026 sweep was the largest by defendant count in DOJ history. Separately, the Committee on Foreign Investment in the United States (“CFIUS”) now wields a $5 million penalty ceiling and has adopted a more aggressive, PRC-focused posture.

JANUARY-JUNE 2026 DOJ CORPORATE AND WHITE-COLLAR ENFORCEMENT

The first half of 2026 brought the most consequential restructuring of the Department of Justice’s corporate enforcement architecture in nearly a decade, capped by the March 10, 2026 rollout of the first-ever Department-wide CEP.

I. The New Department-Wide Corporate Enforcement Policy

On March 10, 2026, DOJ announced its first-ever Department-wide CEP, described by the Department as promoting “uniformity, predictability, and fairness” in white-collar cases. The policy applies to all corporate criminal matters across DOJ components and all 93 U.S. Attorney’s Offices, apart from the Antitrust Division, which retains its separate leniency regime.

The CEP largely adopts the Criminal Division’s May 2025 policy but extends it Department-wide. It preserves the familiar three-path framework:

Declination: A company that (i) voluntarily self-discloses misconduct to an appropriate DOJ criminal component, (ii) fully cooperates, and (iii) timely and appropriately remediates, will, absent aggravating circumstances, receive a declination. Aggravating circumstances turn on the nature and seriousness of the offense, the egregiousness or pervasiveness of the misconduct, the severity of harm, and recidivism.
“Near Miss” Non-Prosecution Agreements: A company that cooperated and remediated but whose disclosure fell just short of the technical definition of a voluntary self-disclosure may receive a non-prosecution agreement of fewer than three years, no independent compliance monitor, and a fine reduction. Notably, the new CEP narrowed this benefit: the 2025 policy offered a fixed 75% reduction off the low end of the Sentencing Guidelines range, while the 2026 policy sets a discretionary range of 50% to 75%.
Other Resolutions: All other cases remain within prosecutorial discretion, with possible reductions up to 50%.

Two of the CEP structural features are especially important. First, reporting is effectively channel-neutral: a good-faith disclosure to one appropriate component is still recognized if the matter is later handled by another. Second, the policy contains new language suggesting that good-faith disclosures to certain non-DOJ entities may qualify for credit, and language potentially permitting declinations outside the policy’s strict terms.

DOJ moved quickly to demonstrate the policy is in operation. On March 19, 2026, DOJ announced its first resolution under the new CEP, declining to prosecute French medical device company Balt SAS while requiring approximately $1.2 million in disgorgement.

II. Interplay with the SDNY Self-Disclosure Program

The Department-wide CEP followed closely on the heels of the U.S. Attorney’s Office for the Southern District of New York’s own Corporate Enforcement and Voluntary Self-Disclosure Program for financial crimes, announced on or about February 24, 2026, the first such policy published by a U.S. Attorney’s Office. The SDNY program featured distinctive terms, including a two-stage conditional declination process and, for qualifying companies, elimination of criminal fines rather than the CEP’s requirement to pay disgorgement and forfeiture. It is unclear whether the Department-wide CEP completely supersedes component and district-specific policies but it appears to displace the SDNY program to the extent of any inconsistency. Companies weighing where and how to disclose in the Second Circuit should treat the CEP as the governing framework but remain attentive to how SDNY exercises its retained prosecutorial discretion.

III. FCPA Enforcement

FCPA enforcement in the first half of 2026 continued to operate under the framework established in 2025: the February 2025 executive order pausing enforcement, followed by the June 9, 2025 guidelines issued by Deputy Attorney General Todd Blanche. These guidelines directed prosecutors to prioritize matters implicating U.S. national security and economic competitiveness, cartels and transnational criminal organizations, and schemes bearing strong indicia of corrupt intent, while de-prioritizing routine, low-dollar business courtesies. The initiation of any new FCPA investigation requires authorization by the Assistant Attorney General for the Criminal Division or a more senior official. Public reporting indicates DOJ closed roughly half of the FCPA investigations opened under the prior administration. Companies should not read the recalibration as a safe harbor: FCPA limitations periods can exceed a single administration, and DOJ officials have repeatedly characterized the shift as a “pivot,” not a retreat from FCPA enforcement.

IV. National Security, Export Controls, and Sanctions

The Department’s national security enforcement moved into closer alignment with the CEP during the first half of 2026 and signaled a more active posture. On March 30, 2026, the NSD issued guidance confirming that the Department-wide CEP applies to criminal matters within NSD’s jurisdiction and directing companies to submit voluntary self-disclosures of potential criminal national security violations to NSD. The guidance confirmed that the CEP superseded NSD’s prior, component-specific Enforcement Policy for Business Organizations (announced March 7, 2024).

Three features of the guidance are significant. First, NSD’s enforcement jurisdiction covers the principal export control and sanctions regimes, including the Arms Export Control Act (“AECA”), the Export Control Reform Act (“ECRA”), and the International Emergency Economic Powers Act (“IEEPA”), as well as material-support laws and criminal violations connected to CFIUS and Team Telecom matters. Second, disclosures made only to civil or regulatory agencies, such as the Bureau of Industry and Security (“BIS”), the Office of Foreign Assets Control (“OFAC”), or the Directorate of Defense Trade Controls (“DDTC”), do not qualify as a DOJ voluntary self-disclosure for criminal-enforcement purposes. The criminal disclosure must go to NSD. Third, NSD signaled it expects to increase enforcement activity in this space.

NSD demonstrated the framework is in operation. On June 17, 2026, NSD announced its first declination under the revised CEP, resolving its investigation into Robert Bosch GmbH (“Bosch”) arising from exports by two non-U.S. subsidiaries (Bosch Sensortec GmbH and ETAS GmbH) of sensor products and software to Huawei and affiliates on the Entity List without required BIS authorization. DOJ credited Bosch’s voluntary disclosure, which was made while its internal investigation was still underway, considered in conjunction with cooperation, and included remediation. Assistant Attorney General for National Security John Eisenberg described the resolution as “a first-of-its-kind decision by NSD.” In a parallel civil action, BIS imposed a penalty of approximately $36 million, reflecting a 50% reduction in recognition of Bosch’s cooperation.

The Bosch matter carries several lessons. First, that U.S. export controls reach conduct by non-U.S. subsidiaries occurring entirely abroad (including through the Foreign Direct Product Rule). Second, that a DOJ declination does not resolve parallel civil exposure or protect individuals. Third, that China-related technology transfers remain a top NSD priority even where a company ultimately earns a declination.

V. CFIUS and FIRRMA

Enforcement by CFIUS continued to operate under the new framework adopted in the November 18, 2024 final rule, which, among other changes, raised the maximum civil penalty for many violations from $250,000 to $5 million and expanded CFIUS’s information-gathering and mitigation-enforcement authorities. During the first half of 2026, the Administration focused on tightening scrutiny of investment from adversary nations, particularly the People’s Republic of China, in sensitive sectors, while seeking to streamline review for investors from allied nations.

There are two significant developments in this space in early 2026. First, on February 6, 2026, the Treasury Department issued a Request for Information regarding a proposed “Known Investor Program” intended to streamline aspects of CFIUS review for certain frequent, lower-risk foreign investors while preserving national security analysis (U.S. Dep’t of the Treasury, CFIUS). Second, according to public reporting, in February 2026 DOJ filed what has been described as its first-ever lawsuit to enforce a CFIUS divestment order, and the President issued orders in both 2025 and 2026 blocking PRC acquisitions of U.S. businesses, reflecting an unusually aggressive use of the blocking authority. Companies should treat mandatory-filing analysis and strict compliance with CFIUS mitigation agreements as high-stakes obligations, particularly for transactions with any PRC nexus or touching semiconductors, AI, critical infrastructure, or sensitive personal data.

VI. Trade and Customs Fraud

Trade and customs fraud produced the most striking enforcement activity of early 2026. The cross-agency Trade Fraud Task Force, launched in August 2025 with DHS, has made customs-related False Claims Act (31 U.S.C. § 3729 et seq.) enforcement a core priority.

The headline resolution came on May 12, 2026, when DOJ announced a $549.5 million FCA settlement with Perfectus Aluminum Inc. and affiliated entities to resolve allegations that they knowingly evaded antidumping and countervailing duties on aluminum extrusions imported from China, reportedly one of the largest customs-fraud settlements in U.S. history. This followed the December 2025 resolutions with Ceratizit USA, LLC ($54.4 million, origin misrepresentation and transshipment through Taiwan to evade Section 301 duties) and Wanxiang America Corporation (more than $53 million, misclassification of automotive components under 19 U.S.C. § 1592).

VII. Health Care Fraud

On June 23, 2026, DOJ and HHS announced the 2026 National Health Care Fraud Takedown, charging 455 defendants, including 90 doctors and other licensed medical professionals, in schemes involving more than $6.5 billion in alleged false claims, across 56 federal districts and 45 states and territories, with all 50 state Medicaid Fraud Control Units participating. By number of defendants, it was the largest takedown in Department history, though the dollar total trailed 2025, which was inflated by the roughly $11 billion “Operation Gold Rush” scheme.

Based on the Department’s enforcement activity, several signals matter for compliance planning. Medicaid was the central focus of the Department’s enforcement activity, which is evident by this takedown. The Department reported 295 defendants tied to Medicaid schemes involving more than $518 million, described as the largest Medicaid enforcement action in takedown history, following an authorized expansion of the Health Care Fraud Unit and the addition of prosecutors dedicated to Medicaid nationwide. Additionally, the enforcement was overtly data-driven, leveraging a multi-agency Data Fusion Center, a Financial Intelligence Review Team, and AI and cloud analytics deployed within Center for Medicare and Medicaid (“CMS”)’s Integrated Data Repository, together with new data-sharing arrangements with DHS and the FTC. CMS complemented criminal charges with administrative action, suspending 1,079 providers and revoking billing privileges for 1,403 providers, and increasingly acts to freeze suspect payments before funds leave the program. Lastly, the takedown appeared to be the first major public showcase for the Department’s newly announced National Fraud Enforcement Division, and the Civil Division’s May 27, 2026 memorandum directing faster review of covered False Claims Act benefits-fraud matters is likely to accelerate the civil pipeline.

The Department’s enforcement activity also singled out high-reimbursement specialties for scrutiny, especially wound care using amniotic allografts (11 defendants across six districts), alongside genetic testing, telemedicine, behavioral health, and durable medical equipment. Assistant Attorney General Colin M. McDonald framed the enforcement priority bluntly: “if you put profit over patients, you should expect to be put in prison.” Providers in high-utilization specialties should benchmark their own billing data against peer norms and treat Medicaid compliance as an enterprise-level priority.

VIII. Whistleblower Program and Monitor Guidance

The Department’s Corporate Whistleblower Awards Pilot Program, expanded in May 2025 to additional priority areas, continued to generate tips across corruption, procurement fraud, and healthcare fraud. Combined with FCA qui tam incentives in the trade context, the practical result is that the window to self-disclose ahead of a whistleblower is narrowing. In parallel, the Department’s 2025 monitor-selection guidance, curtailing the use of costly corporate monitors and imposing budget and fee caps, continued to shape resolutions, and the Department signaled willingness to terminate existing monitorships early.

IX. Practical Takeaways for Clients

Reassess the disclosure calculus now: With a single, published Department-wide framework, the benefits of self-disclosure are more predictable, but the “declination” path requires that misconduct not already be known to DOJ. Speed is decisive; a qui tam relator or whistleblower who reaches DOJ first can foreclose the most favorable outcome.
Route national security disclosures to NSD, not just regulators: A disclosure to BIS, OFAC, or DDTC alone does not earn CEP credit for criminal exposure. Build escalation and triage procedures that promptly assess potential export-control and sanctions issues for criminal risk and route them to NSD where appropriate.
Treat export/sanctions issues as parallel criminal and civil matters from the outset: As Bosch illustrates, U.S. jurisdiction can reach conduct by foreign subsidiaries abroad, a company declination does not shield individuals, and cooperation can materially reduce a parallel civil penalty.
Do not roll back compliance: The taper of FCPA enforcement is not a repeal, and limitations periods outlast administrations. Maintain anti-corruption controls, third-party due diligence, and training.
Prioritize trade and customs compliance: Review country-of-origin determinations, HTS classifications, supply-chain routing, and, critically, historical entries. Treat trade compliance as a civil-fraud risk, not merely an administrative one.
Build CFIUS analysis into deal planning: Confirm whether a mandatory declaration is triggered, diligence any adversary-nation nexus, and treat compliance with mitigation agreements as a high-penalty obligation given the $5 million ceiling and DOJ’s willingness to litigate divestment.
Prepare for data-driven health care enforcement: Monitor your own billing data against peer norms, tighten documentation integrity, and treat Medicaid risk as an enterprise-level compliance priority.
Strengthen internal reporting and messaging controls: The CEP elevates expectations around preservation and control of ephemeral and personal-device messaging.

CONCLUSION

The first half of 2026 reflects consolidation of DOJ enforcement activity. Its enforcement activity and roll out of new programs show that organizations and companies must reassess the disclosure calculus against the published framework; treat export, sanctions, trade, and customs exposure as parallel criminal and civil risk; resist relaxing compliance controls; and demonstrate their practices in operation rather than on paper. We will continue to monitor these developments and are available to discuss how they bear on your organization’s specific risk profile. Written by Brian Kidd, Catherine Dick, and Taylor Fontan. For questions, please contact Catherine Dick, Taylor Fontan, Brian Kidd, Alison Moe, Tami Stark or Michael Tremonte.