Making the Grade: DOJ Revises Standards for Compliance Program

On September 23, 2024, the U.S. Department of Justice (DOJ) made important updates to its Evaluation of Corporate Compliance Programs (ECCP). These updates reflect the DOJ’s guiding principle that corporate compliance programs need to evolve to address the risks posed by modern businesses with ever-changing technologies. The ECCP guideline updates arrived less than a month after the DOJ released guidance on its new Corporate Whistleblower Awards Pilot Program, the DOJ’s first non-statutory financial awards program to incentivize whistleblowers.

Voluntary disclosure is a key policy in the DOJ’s prosecution framework. Indeed, all DOJ components that prosecute corporate crime now have a voluntary self-disclosure policy. As part of the “calculus” to obtain maximum benefits for a voluntary disclosure, a company should scrutinize its compliance program to see if it includes proactive measures. Having an evolving and updated compliance program is an important component in negotiating a successful resolution with the DOJ.

Key updates to the ECCP guidelines include:

1. Risks Associated with Emerging Technologies.

The DOJ will assess how a company mitigates risks associated with emerging technologies, such as artificial intelligence, that the company uses to conduct business or in its compliance program. Questions will be asked on “How is the company curbing any potential negative or unintended consequences resulting from the use of technologies?” and “How does the company train its employees on the use of emerging technologies?”

2. Incorporating Lessons Learned.

Compliance policies and procedures need to continue evolving. A key consideration for the DOJ is whether “there is a process for updating policies and procedures to reflect lessons learned either from the company’s own prior issues or from those of other companies operating in the same industry and/or geographical region.” Companies need to also take into consideration “emerging risks, including those associated with the use of new technologies.”

3. Whistleblower Reporting, Protection, and Anti-Retaliation.

As part of its guidelines, the DOJ reaffirmed its commitment to advancing whistleblowing as a tool in its enforcement procedures. Be prepared to address how employees are encouraged and incentivized to report potential misconduct. The DOJ will also assess whether employees are effectively trained in anti-retaliation and whistleblower protection laws.

4. Access to Data and Resources.

The DOJ will assess whether a corporation is “leveraging data analytics tools to create efficiencies in compliance operations” and measuring its effectiveness. There should also be a proportionate amount of resources allocated to compliance and risk management compared to those available elsewhere in the company.

Other updates in the guidelines also address the importance of compliance and risk management in M&A transactions, the management of contractors, and the development of effective and regular employee training.

The harm of an ineffective compliance program is underscored by United States v. TD Bank, N.A., case number 2:24-cr-00667, in the U.S. District Court for the District of New Jersey. On October 10, 2024, TD Bank agreed to a total fine of $3.09 billion in an anti-money laundering settlement that emphasized how ineffective compliance programs lead to actual, material harm. The DOJ and FinCEN noted that as TD Bank grew, its spending on U.S. anti-money laundering compliance did not. The failure to fund and keep up-to-date its compliance systems was specifically emphasized as a reason for the high settlement. Due to its failures to fund its compliance program, TD allowed money-laundering networks to funnel more than $600 million through the bank. Although an egregious example, the TD Bank settlement underscores the need for updating and funding compliance programs.

If you have any questions about the updates or any other information from this alert, please contact Jonathan Feld, Darren Chen, or your Dykema relationship attorney.