Tri-Seal Compliance Note: Voluntary Self-Disclosure of Potential Violations

On July 26, 2023, the departments of Commerce, Justice and the Treasury issued their second ever to date “Tri-Seal Compliance Note” (the “Note”). It describes expectations for the voluntary disclosure of sanctions, export, and other potential violations of national security laws, urging voluntary self-disclosures (VSDs) without regard to whether there is an administrative or criminal violation.

The Note also follows updated enforcement policies issued by the Department of Justice (DOJ) and Bureau of Industry and Security (BIS) to further incentivize VSDs and reward whistleblowers earlier this year. It augments but does not change either policy or analysis. Our summary of the key considerations concerning the updated enforcement policies are accessible here and here.

Key Takeaways:

• The Note reinforces the prioritization of these enforcement matters, as well as the multiagency coordination effort, all of which has been supported by additional significant resources.
• VSDs can significantly mitigate civil and criminal liability for companies. However, they must be timely, accurate and complete, and backed by full cooperation and remediation of identified violations.
• VSDs to DOJ without aggravating factors are presumed to be resolved with a non-prosecution agreement. However, VSDs to only BIS and the Office of Foreign Assets Control (OFAC) that disclose criminal violations will not be afforded such a presumption. This may incentivize companies to disclose potential violations to DOJ even where the conduct at issue was not willful, but also carries risk because assessing criminal intent is far more challenging in these highly technical matters, in comparison to inherently problematic conduct involving, for example, foreign bribery and corruption.
• Conducting internal investigations of potential violations is critical, and the strength of a company’s compliance program and success in conducting internal investigations will be carefully considered by DOJ, BIS and OFAC.
• Companies are well advised to review their disclosures processes and compliance programs to ensure they align with the guidance and enforcement priorities discussed in the Note.

Summary:

The Note focuses on the incentives available to companies that choose to voluntarily self-disclose violations, and how to ensure any disclosure conforms to published guidelines in order to receive full disclosure credit. Credit for a VSD can extend as far as a non-prosecution agreement or a reduction of 50% in the base penalty amount for civil or criminal penalties, with the potential for further discretionary mitigation of monetary penalties.

A central theme of the Note is that companies must timely and comprehensively disclose non-privileged factual information concerning the potential violations, fully cooperate with the investigating agency and appropriately remediate any violations in order to receive full credit for a VSD. DOJ, BIS and OFAC may also consider the existence and strength of a company’s compliance program and whether disciplinary measures were taken in connection with the violations.

While there is significant overlap in how the individual agencies treat VSDs, each agency maintains distinct guidance and companies must make separate disclosures to each regulator with jurisdiction over the potential violation(s) in order to get the benefit of the disclosure. That said, the DOJ program for managing VSDs is relatively new and there is limited precedent to accurately predict how the agencies will manage this. Conceptually, companies are generally not eligible for full VSD credit where VSDs were made after the commencement of a government investigation, or where the investigating agency has otherwise already learned of the violation.

The Note additionally indicates that the Financial Crimes Enforcement Network (FinCEN) maintains a whistleblower program that may offer monetary awards to persons who provide information to the government about violations of U.S. trade and economic sanctions. FinCEN has not yet issued regulations or other guidance on the whistleblower program, but is expected to do so in late 2023.

Interestingly, the Department of State, Directorate of Defense Trade Controls (DDTC) is not involved or referenced in the Note. We are not aware of comments from DDTC as of publishing this alert, but companies should continue to monitor for DDTC updates given the close nexus between violations being disclosed to BIS, DOJ and OFAC to those being disclosed to DDTC regarding the International Traffic in Arms Regulations and Arms Export Control Act.

DOJ

DOJ’s National Security Division issued an updated VSD policy covering potential criminal violations of export control and sanctions laws in March of this year, and has hired or intends to hire at least 25 new prosecutors to enforce such laws. The updated policy is designed to incentivize businesses to report violations, noting such a disclosure may reduce or avoid altogether the potential for criminal fines and penalties. It applies to U.S. export controls and sanctions, but also to other corporate criminal violations of U.S. national security laws within the National Security Division’s authority.

The Note emphasizes that there is a presumption that a company will receive a non-prosecution agreement and will not pay a fine when it voluntarily discloses potential criminal violations, fully cooperates and timely and appropriately remediates the violations. However, there is no such presumption when there are aggravating factors such as egregious or pervasive criminal misconduct, deception, repeated offenses, the export of particularly sensitive items or to end users of heightened concern, or a significant profit to the company. Moreover, this presumption is not available where disclosures were made to BIS or OFAC only.

Companies may have previously been reluctant to share with DOJ their disclosures to BIS or OFAC to avoid conceding that an activity was “willful.” Now, that reluctance may soften given the Note’s emphasis on a non-prosecution agreement where a disclosure is made, the fact that non-disclosure can be considered an aggravating factor under BIS enforcement policy and DOJ signaling a more aggressive enforcement posture and resources.

BIS

To more timely assess VSDs, BIS implemented a dual-track process. Minor or technical infractions are now reviewed on a fast-track basis, typically within 60 days of receipt of a final VSD. More serious potential violations are on a second track with more intensive analysis. The implementation of the dual-track system appears to be in response to the influx of VSDs related to Russia, Belarus and China in the past year. Deputy Assistant Secretary of Commerce for Export Administration Matt Borman was recently quoted stating that “[w]e spend 100 percent of our time on Russia sanctions, another 100 percent on China, and the other 100 percent on everything else,” highlighting the agency’s continued focus on Russia and China. The Note emphasizes that this dual-track triage system is also driven by the desire for the Office of Export Enforcement within BIS to use its “finite resources” more effectively.

BIS reiterated that companies “deserve, and will get, significant credit for coming forward voluntarily.” BIS emphasized that it will consider the effectiveness of a company’s compliance program. It also referenced its April 18, 2023, policy memo, which introduced the position that deliberate non-disclosure of a significant violation of the Export Administration Regulations is an aggravating factor. BIS now further treats investigative leads submitted to the Office of Export Enforcement concerning another company’s potential violation as a mitigating factor if it leads to an enforcement action and the disclosing entity faces its own enforcement action, even if these actions are unrelated. In other words, deliberate non-disclosure is an aggravating factor, BUT informing BIS of other companies’ unrelated violations can be a mitigating factor. The Note builds on this prior guidance by further explaining thatcompanies which conduct an internal investigation and address compliance gaps could get mitigation credit if BIS later brings an enforcement action even in the absence of a VSD about their own conduct.

OFAC

Finally, OFAC’s portion of the Note reiterates that VSDs are an important mitigating factor under OFAC’s Enforcement Guidelines and a qualifying VSD can result in a 50% reduction in the base amount of a proposed civil penalty. VSDs must be accurate, comprehensive and self-initiated.

OFAC also reinforced its policy that VSDs will not qualify as a mitigating factor, where a third party only notifies OFAC in instances in which blocked property was reported, when the VSD contains false or misleading information, the disclosure is not self-initiated, or where the disclosure is materially incomplete. OFAC’s policy makes clear that it will consider the totality of the circumstances involving the apparent violation described in a VSD, as well as the circumstances underlying the company’s decision to disclose.

Conclusion

In sum, the Note emphasizes the ways in which DOJ, BIS and OFAC are trying to incentivize companies to voluntarily disclose potential violations of U.S. export controls, sanctions and related national security laws.

Whether to disclose such violations is a risk-based decision for companies to make, except for violations of 22 C.F.R. Sec. 126.1 (not addressed by the Note). However, the calculus as to whether to disclose even minor, technical violations is shifting toward favoring disclosure in many circumstances. The Note may also cause companies to reevaluate whether to disclose to DOJ as well as simultaneously to BIS and/or OFAC for conduct that could arguably be considered willful. As always and as emphasized throughout the agencies’ guidance, disclosures must be complete and truthful and cooperation with BIS, DOJ and OFAC remains paramount.