Introduction

The Foreign Corrupt Practices Act (FCPA), enacted in 1977 and significantly amended in 1988 and 1998, stands as the cornerstone of American anti-bribery law. Its reach is broad: it prohibits U.S. persons, U.S.-listed companies, and — in many circumstances — foreign companies and individuals from paying bribes to foreign government officials in order to obtain or retain business. The statute is enforced jointly by the Department of Justice (DOJ), which pursues criminal violations, and the Securities and Exchange Commission (SEC), which handles civil enforcement against issuers. Together, these two agencies have built one of the most aggressive and internationally coordinated anti-corruption enforcement regimes in the world.

For companies that discover potential FCPA violations — whether through an internal audit, a whistleblower complaint, an anonymous tip, or a routine compliance review — the discovery itself marks only the beginning of a complex, high-stakes decision-making process. Chief among the questions that must be confronted swiftly is whether to voluntarily self-disclose the potential misconduct to the DOJ and, where applicable, the SEC. This is rarely a straightforward call. Voluntary self-disclosure (VSD) can produce substantial benefits in the form of reduced penalties, deferred or declined prosecution, and meaningful cooperation credit. At the same time, it triggers a cascade of obligations, costs, and reputational consequences that companies must evaluate carefully and with skilled legal counsel.

This article provides a detailed examination of the VSD framework under the FCPA, including the DOJ’s and SEC’s current policies, the factors that influence the decision to disclose, the procedural mechanics of the disclosure process, and the practical implications for businesses operating across international markets.

The Enforcement Landscape: Why Self-Disclosure Matters

To understand why VSD has become such a critical strategic tool, it is necessary to appreciate the scale and seriousness of FCPA enforcement. Over the past two decades, the DOJ and SEC have extracted billions of dollars in penalties from companies across virtually every industry sector and in every corner of the globe. Settlements routinely run into the hundreds of millions of dollars, and in landmark cases — such as those involving Goldman Sachs, Airbus, Odebrecht, and Siemens — total resolutions have exceeded one billion dollars. Corporate executives have faced personal criminal prosecution, and the reputational damage associated with a public FCPA enforcement action can be severe and long-lasting.

Against this backdrop, the government has consistently signaled that companies which proactively come forward, cooperate fully, and remediate their compliance failures will receive meaningfully better outcomes than those that do not. This message has been formalized through a series of DOJ policy pronouncements that have evolved and become more concrete over time, culminating in what is now a well-articulated framework offering specific, quantifiable benefits for timely voluntary disclosure.

It is important to note, however, that the government’s willingness to reward self-disclosure is not unconditional. The benefits flow only to companies that satisfy each element of a demanding three-part standard: timely voluntary disclosure, thorough and proactive cooperation, and effective remediation of underlying compliance deficiencies. A company that discloses but then withholds documents, fails to make witnesses available, or neglects to overhaul its compliance program will not receive the full benefit of the VSD framework — and may in some cases fare worse than a company that never disclosed at all.

The DOJ’s Corporate Enforcement Policy

The primary framework governing VSD in FCPA matters is the DOJ’s Corporate Enforcement Policy (CEP), which was introduced in 2017 as a pilot program and made permanent in 2019, with subsequent revisions in 2023. The CEP is set forth in the Justice Manual and applies specifically to FCPA cases, though its principles inform the DOJ’s approach to corporate criminal enforcement more broadly.

The Presumption of Declination

Under the CEP, a company that voluntarily self-discloses an FCPA violation and then fully cooperates and timely and appropriately remediates will receive a presumption of declination — meaning the DOJ will presumptively decline to prosecute the company criminally. This is a powerful benefit. It means that, absent aggravating circumstances, a company that does everything right after discovering misconduct should not face criminal charges. The presumption of declination is not absolute: it can be overcome by factors such as involvement by executive leadership in the misconduct, a significant profit from the bribery scheme, recidivism by the company, or criminal activity that poses a risk to public health or safety. But the existence of a formal presumption represents a significant and concrete incentive for early disclosure.

Where aggravating circumstances are present but the company has nonetheless voluntarily disclosed, cooperated, and remediated, the CEP provides that the DOJ will recommend a non-prosecution agreement (NPA) or deferred prosecution agreement (DPA) rather than pursuing a guilty plea. This too is a meaningful benefit: NPAs and DPAs avoid formal criminal conviction and typically allow companies to avoid collateral consequences such as debarment, loss of government contracts, or disqualification from regulated industries.

Penalty Reductions

In addition to the declination presumption, the CEP specifies quantifiable penalty reductions. Where a company is eligible for a declination but one is not granted due to aggravating factors, the DOJ will recommend a fine at or near the low end of the U.S. Sentencing Guidelines range — and may further reduce that amount by up to 50% below the guidelines minimum. For companies that cooperate and remediate but did not voluntarily self-disclose, the available reduction is capped at 25% below the guidelines minimum.

These distinctions matter enormously in practice. FCPA fines can reach tens or hundreds of millions of dollars. A 50% reduction versus a 25% reduction against a large base penalty may translate into a difference of tens of millions of dollars in actual liability. When companies are weighing the costs and benefits of disclosure — including the costs of the inevitable internal investigation — these numbers carry significant weight.

Monitorships

Another important benefit of voluntary self-disclosure is the reduced likelihood of an independent compliance monitor being imposed. Corporate monitors are expensive — monitor costs can exceed tens of millions of dollars — intrusive, and time-consuming. They typically involve a multi-year engagement during which an outside expert reviews and reports on the company’s compliance systems, with authority to escalate to the DOJ if problems are found. The CEP states that the DOJ generally will not require a monitor for companies that voluntarily disclose, fully cooperate, and demonstrate they have implemented an effective compliance program at the time of resolution. This is a powerful incentive for companies that take remediation seriously.

The SEC’s Approach to Voluntary Disclosure

For companies that are issuers — meaning they have securities registered with the SEC or are required to file periodic reports — the SEC’s Enforcement Division also plays a central role in FCPA enforcement. The SEC has its own framework for evaluating cooperation and self-disclosure, drawn from the Seaboard Report (2001), the Cooperation Program (formalized in 2010), and subsequent guidance and practice.

The SEC does not have a formal analogue to the DOJ’s presumption of declination, but it has an extensive toolkit for rewarding cooperation. The Commission may decline to bring an enforcement action, resolve a matter through a no-admission settlement rather than litigation, significantly reduce the disgorgement amount or civil penalty, or grant a company “cooperation” or “extraordinary cooperation” credit that is reflected in the terms of a final order. In a small number of notable cases, the SEC has publicly announced declinations in connection with company self-disclosures, sending a strong market signal about the value of proactive disclosure.

Companies should also be aware that the SEC’s whistleblower program, established under the Dodd-Frank Act, creates an independent pathway for FCPA violations to come to the government’s attention. Whistleblowers who report securities law violations — including FCPA violations by issuers — to the SEC may be entitled to financial awards ranging from 10% to 30% of sanctions exceeding $1 million. This means that if internal wrongdoing exists within a company, the clock may be running on the government’s independent knowledge of the misconduct, further underscoring the importance of acting swiftly when potential violations are identified.

The Decision to Self-Disclose: Key Considerations

Deciding whether to self-disclose is one of the most consequential and legally complex decisions a company can face. There is no universal correct answer; the decision is inherently fact-specific and must be made in close consultation with experienced FCPA counsel. The following factors are among the most important to evaluate.

Nature, Scope, and Severity of the Potential Violation

Not all potential FCPA violations are created equal. At one end of the spectrum, a low-level employee may have made a modest improper payment in a single jurisdiction without the knowledge of management, and the company may have robust controls that simply failed to catch an isolated event. At the other end, senior executives may have orchestrated a systematic bribery scheme across multiple countries over many years, generating enormous profits and carefully evading internal oversight. The nature, scope, and severity of the conduct are central to assessing both the likely penalty exposure and the strength of any defense arguments, and they therefore bear directly on the calculus of disclosure.

Likelihood of Independent Discovery

The government benefits of VSD only accrue if the disclosure is genuinely “voluntary” — that is, made before the government has opened an investigation or is reasonably likely to have learned of the violation through other means. If there is a significant likelihood that the DOJ or SEC will independently discover the misconduct — for example, because a foreign government is already investigating, because a co-conspirator has entered into a cooperation agreement with U.S. authorities, or because a disgruntled employee has filed an SEC whistleblower complaint — then the case for early disclosure is substantially stronger. A disclosure that the government views as having been compelled by an imminent exposure will receive reduced credit, and may receive none at all.

Adequacy of the Internal Investigation

Before making any disclosure to the government, a company must have conducted — or be in a position to commit to conducting — a thorough internal investigation. The DOJ and SEC expect disclosed companies to provide a complete and accurate picture of the misconduct, to identify all responsible individuals, to trace the flow of funds, and to preserve all relevant documents and data. A disclosure that is followed by an incomplete or poorly conducted investigation will not only forfeit cooperation credit but may expose the company and its counsel to additional scrutiny. Retaining independent outside counsel to lead the investigation, with a clear mandate and appropriate resources, is virtually always the right approach.

Remediation Readiness

The CEP requires that a company demonstrate timely and appropriate remediation. This means more than simply terminating the individuals responsible for the misconduct. It typically involves a comprehensive assessment and overhaul of the company’s compliance program, enhanced internal controls, improved training, revised policies and procedures, and — in many cases — personnel changes at senior levels. Companies that can demonstrate they have already undertaken meaningful remediation steps by the time of disclosure are in a considerably stronger position than those that have not yet begun to address the underlying deficiencies.

Business and Reputational Consequences

Voluntary self-disclosure is not a private act. Enforcement resolutions — whether NPAs, DPAs, or formal settlements — are typically made public, often with detailed statements of facts that describe the misconduct in considerable detail. The reputational implications of this public disclosure must be weighed seriously. Companies that do business with government agencies, operate in regulated industries, or have publicly traded securities face particular risks. At the same time, it is worth noting that the alternative — public discovery of misconduct through a government-initiated investigation, or through media exposure — is generally far more damaging both reputationally and legally than a controlled self-disclosure followed by a favorable resolution.

The Mechanics of Self-Disclosure

Once a company has decided to self-disclose, the process itself requires careful management. Disclosure should ordinarily be made to both the DOJ’s FCPA Unit (housed within the Fraud Section of the Criminal Division) and, for issuers, the SEC’s FCPA Unit (within the Division of Enforcement). Initial disclosure is typically made through outside counsel, in a formal letter or meeting that describes the nature of the potential violation, the company’s preliminary findings, and the steps the company is taking in response.

Counsel should be prepared to discuss the timeline of the company’s discovery, the scope of the internal investigation to date, the steps taken to preserve evidence, and the company’s commitment to full cooperation. The initial disclosure does not need to — and typically will not — present a complete picture of all facts; the investigation will be ongoing. But it must be candid and accurate, and it should demonstrate that the company is engaging in good faith rather than attempting to manage the government’s access to information.

Following the initial disclosure, the company will enter into a period of cooperation that may extend for months or years. This typically involves regular briefings of government counsel on the progress of the internal investigation, the production of documents and data on a rolling basis, the provision of factual presentations summarizing investigative findings, and the making available of current and former employees for interviews. The DOJ’s cooperation standards require companies to proactively provide the government with information it has not specifically requested — not merely to respond to subpoenas — and to identify and disclose all individuals who were involved in or responsible for the misconduct, including senior executives.

Protecting Privilege During the Process

One of the most significant and recurring challenges in VSD situations is managing the tension between the government’s expectations of cooperation and the company’s legitimate interest in preserving attorney-client privilege and attorney work product protections. The DOJ has stated, as a matter of policy, that it will not require companies to waive privilege as a condition of receiving cooperation credit. In practice, however, the line between a voluntary disclosure of factual findings and a waiver of privilege can be difficult to maintain, and companies must be thoughtful about how investigative findings and counsel’s legal analysis are documented and shared.

Companies should instruct outside counsel to structure the internal investigation from the outset so as to preserve privilege over legal analysis while permitting the disclosure of underlying facts. This includes maintaining a careful distinction between counsel’s legal conclusions (which are privileged) and the factual findings on which they are based (which may be shared with the government). Interviews of employees should be conducted under clear privilege assertions, and employees should be informed of the dual-client nature of the representation and the company’s right to decide whether to share the contents of interviews with the government.

Individual Liability Considerations

A company’s decision to self-disclose has direct and significant implications for the individuals involved in the alleged misconduct. The DOJ has made clear, through the Yates Memorandum (2015) and subsequent policy guidance, that individual accountability is a central priority. As a condition of receiving cooperation credit, a company must identify all individuals who were substantially involved in or responsible for the misconduct — not only lower-level employees but also executives and board members where the evidence supports their involvement.

This means that employees who participated in improper payments may face personal criminal or civil exposure arising from the company’s own disclosure. Companies should ensure that potentially implicated employees are advised to retain independent personal counsel at the earliest opportunity. The interests of the company and the interests of individual employees will often diverge materially as the investigation progresses, and employees who rely solely on company counsel may find themselves without adequate representation when they need it most.

Post-Resolution Obligations

A VSD that results in an NPA, DPA, or SEC settlement does not mark the end of the company’s obligations. Resolutions typically carry ongoing compliance requirements that may extend for three to five years or more. These include the implementation and maintenance of an enhanced compliance program meeting specific benchmarks, the designation of a Chief Compliance Officer with direct reporting lines to the board, periodic compliance certifications, mandatory training programs, and enhanced due diligence requirements for third parties such as agents, distributors, and joint venture partners.

In cases where a monitor is nonetheless imposed — which may occur where the company’s compliance program was particularly deficient or where management was deeply implicated — the post-resolution period involves the additional burden of monitor oversight, including periodic access to company records, personnel, and systems, and the obligation to remediate any deficiencies identified by the monitor.

Companies should approach these post-resolution obligations not merely as compliance burdens but as an opportunity to build a genuinely effective anti-corruption culture. The costs of a robust compliance program — while not trivial — are invariably far less than the costs of a second FCPA enforcement action, and recidivism is treated with particular severity by both the DOJ and the SEC.

Conclusion

Voluntary self-disclosure of FCPA violations is among the most consequential decisions a company operating in international markets may ever face. Done well — with timely and candid disclosure, a thorough and independent internal investigation, genuine cooperation with enforcement authorities, and meaningful remediation of compliance failures — VSD offers substantial and documented benefits: a presumption of declination, reduced penalties, reduced likelihood of a corporate monitor, and the opportunity to resolve a potentially catastrophic enforcement exposure on terms that allow the business to move forward.

Done poorly — with incomplete disclosure, a superficial investigation, stalled or adversarial cooperation, or cosmetic remediation — VSD can produce the worst of all worlds: the costs and disruption of government engagement without the benefits of cooperation credit.

The decision requires careful, early, and ongoing engagement with outside FCPA counsel who can assess the facts, evaluate the exposure, navigate the government relationship, and guide the company through every stage of the process. Speed is important — but accuracy, thoroughness, and strategic judgment are equally so. Companies that invest in this process, and in the compliance culture that can prevent violations from occurring in the first place, are best positioned to protect themselves, their shareholders, and their reputations in an era of intensifying global anti-corruption enforcement.

This article is intended for general informational purposes only and does not constitute legal advice. Businesses facing potential FCPA exposure should consult qualified legal counsel promptly.