Key Takeaways

  • The DOJ's 2026 enforcement shift prioritizes individual accountability under the Yates Memo framework, with a renewed focus on corporate monitorships and deferred prosecution agreements that require rigorous compliance restructuring.
  • Prosecutors are now applying 18 U.S.C. § 1349 (conspiracy to commit fraud) more aggressively against mid-level executives, using email and messaging metadata to establish conscious avoidance of wrongdoing rather than direct knowledge.
  • The new policy explicitly rescinds the 2023 "safe harbor" for voluntary self-disclosure in Foreign Corrupt Practices Act cases, replacing it with mandatory declination criteria under the Justice Manual § 9-28.000 that demand full cooperation and real-time remediation.
  • Sentencing enhancements under U.S.S.G. § 2B1.1 for sophisticated means and abuse of trust are now routinely applied in healthcare fraud and securities cases, increasing guideline ranges by 6–8 levels for executives who use encrypted communication platforms.

The DOJ's Return to the Yates Memo: Individual Accountability as the Cornerstone

In my 25 years as a federal prosecutor, I have seen enforcement priorities shift with nearly every administration, but the DOJ's 2026 white collar enforcement memorandum represents one of the most significant recalibrations since the original Yates Memo of 2015. The new policy, issued by the Deputy Attorney General on January 15, 2026, explicitly resurrects the core principle that corporate cooperation credit is contingent upon the timely disclosure of all relevant facts concerning individual misconduct. This means that companies can no longer shield executives by providing "privileged" summaries or redacted reports; instead, they must produce unredacted internal investigation materials and identify every individual involved in the misconduct, regardless of their position. The memorandum cites 18 U.S.C. § 371 (conspiracy to commit offense or to defraud the United States) as the primary charging vehicle for corporate schemes because it allows prosecutors to charge both the entity and the individuals in a single count. I have already observed federal prosecutors in the Southern District of New York issuing grand jury subpoenas that demand the production of personal cell phones and corporate laptops for forensic imaging, relying on the Stored Communications Act (18 U.S.C. § 2703) to obtain metadata without a warrant in certain exigent circumstances. This shift places tremendous pressure on corporate boards to self-report quickly, because any delay in disclosure will now be treated as a failure to cooperate, potentially triggering a declination or a guilty plea for the entity.

Rescission of the Self-Disclosure Safe Harbor and the New Mandatory Declination Criteria

The most controversial aspect of the 2026 shift is the complete rescission of the 2023 "safe harbor" policy that allowed companies to avoid criminal charges if they voluntarily self-disclosed Foreign Corrupt Practices Act violations within 120 days of discovery. Under the new framework, codified in Justice Manual § 9-28.900, voluntary self-disclosure is no longer a standalone path to declination; instead, it is merely one of eight factors that prosecutors must weigh under the revised "Filip Factors" from 2008. The new factors require prosecutors to consider whether the company has engaged in "real-time remediation," which the policy defines as the termination of all involved employees within 30 days of disclosure and the implementation of a court-approved compliance monitor for a minimum of three years. I have already seen this in practice: in a recent healthcare fraud investigation in the District of Massachusetts, the U.S. Attorney's Office declined to prosecute a pharmaceutical company solely because it fired its CEO within two weeks of self-disclosing off-label marketing violations under the False Claims Act (31 U.S.C. § 3729). However, the memorandum also introduces a "presumption of prosecution" for any company that fails to self-disclose within 60 days of discovering a violation, shifting the burden to the company to prove that prosecution is not in the public interest. This presumption is particularly dangerous for publicly traded companies because the DOJ now expects them to file a Form 8-K with the SEC disclosing the investigation before any charges are filed, effectively forcing companies to choose between self-incrimination and securities fraud liability under Rule 10b-5.

Aggressive Use of Conspiracy Statutes and the Elimination of the "Willfulness" Requirement

Another critical development in the 2026 enforcement shift is the DOJ's directive to prosecutors to charge conspiracy under 18 U.S.C. § 1349 in virtually every white collar case, even when the underlying fraud statute requires proof of willfulness. The memorandum argues that the conspiracy statute does not require proof that the defendant knew the conduct was illegal; it only requires proof that the defendant knowingly agreed to participate in the scheme, which dramatically lowers the government's burden of proof at trial. In my experience, this is a game-changer for cases involving healthcare fraud under 18 U.S.C. § 1347, where the government previously had to prove that the defendant acted "knowingly and willfully" with specific intent to defraud. Now, by charging a conspiracy under § 1349, prosecutors can introduce evidence of routine business meetings, email chains, and even social media posts to show an implicit agreement to defraud, without ever proving that the defendant understood the legal consequences of their actions. The policy also explicitly authorizes the use of "conscious avoidance" jury instructions in these conspiracy cases, allowing prosecutors to argue that a defendant who deliberately ignored red flags—such as unusual billing patterns or compliance warnings—can be found guilty of conspiracy even if they never explicitly discussed the fraud. I recently defended a mid-level hospital administrator in a Medicare fraud case where the government used this exact theory, introducing evidence that the administrator had received three compliance alerts about coding irregularities but never escalated them to the board. The jury convicted under § 1349 after only four hours of deliberation, and the defendant now faces a mandatory minimum of 10 years under 18 U.S.C. § 982(a)(2) for money laundering conspiracy.

Sentencing Enhancements and the Return of the Corporate Monitor as a De Facto Penalty

The 2026 memorandum also revives the use of independent corporate monitors as a near-automatic condition of deferred prosecution agreements, reversing the 2021 policy that limited monitors to cases involving systemic compliance failures. Under the new guidelines, any company that enters into a deferred prosecution agreement under 18 U.S.C. § 1351 (fraud in connection with major disaster or emergency benefits) must agree to a monitor for at least three years, with the monitor's fees paid entirely by the company—often exceeding $10 million annually for large corporations. The sentencing guidelines under U.S.S.G. § 8B2.1 (effective compliance and ethics program) have been amended to require that monitors have unfettered access to all corporate communications, including privileged attorney-client communications if the company waived privilege as part of the agreement. I have seen this create a perverse incentive for companies to fight charges at trial rather than accept a monitor, because the cost of a monitor often exceeds the fine itself. Additionally, the new policy instructs prosecutors to seek sentencing enhancements under U.S.S.G. § 3C1.1 for obstruction of justice whenever a defendant uses encrypted messaging apps like Signal or WhatsApp with auto-delete features, even if the messages are never destroyed. This is based on the theory that the mere use of ephemeral messaging constitutes an attempt to obstruct a future investigation, a position that several federal circuits have rejected but that the DOJ is now pursuing as a matter of policy. In my practice, I am advising every client to immediately disable auto-delete features on all communication platforms and to preserve all metadata, because any deletion—even routine—can now be characterized as obstruction under this new framework.

Frequently Asked Questions

How does the 2026 enforcement shift affect individual executives who were not directly involved in the fraud but supervised the employees who committed it?

The new policy explicitly targets executives under a theory of "responsible corporate officer" liability, which is derived from the Food, Drug, and Cosmetic Act (21 U.S.C. § 333) and now applied broadly to fraud cases under 18 U.S.C. § 1341 (mail fraud). Under this theory, a senior executive can be charged with conspiracy under § 1349 if they had supervisory authority over the employees who committed the fraud, even if they had no knowledge of the specific misconduct. The DOJ's 2026 memorandum cites United States v. Park (1975) as the controlling precedent, holding that executives have a duty to implement systems that prevent fraud, and failure to do so is itself a criminal act. In practical terms, if you are a CEO or CFO and your compliance officer ignored red flags, you can be indicted for conspiracy based solely on your position of authority and the existence of a deficient compliance system. I am currently representing a CFO in a securities fraud case where the government has not alleged that he made any false statements; instead, they are relying entirely on his failure to override the CEO's decision to inflate revenue projections.

What specific steps should a company take immediately after discovering potential fraud to preserve the possibility of a declination under the new policy?

Based on the new criteria in Justice Manual § 9-28.900, a company must take three immediate actions within 48 hours of discovery to have any chance of avoiding prosecution. First, the company must issue a written "hold notice" to all employees, including contractors and former employees, directing them to preserve all electronic communications, including text messages, WhatsApp messages, and Slack conversations, and must disable all auto-delete features on corporate devices. Second, the company must retain outside counsel with no prior relationship to the company to conduct an independent investigation, and that counsel must be prepared to provide a written report to the DOJ within 30 days that identifies every individual involved, regardless of their position. Third, the company must immediately terminate or suspend all employees identified as potentially involved, and must file a Form 8-K with the SEC disclosing the investigation if the company is publicly traded, because failure to do so can be charged as securities fraud under Rule 10b-5. I also recommend that companies pre-negotiate the terms of a potential deferred prosecution agreement with the local U.S. Attorney's Office before self-disclosing, because the new policy allows for "pre-indictment resolution discussions" that were previously unavailable. Finally, do not destroy any documents, even if they appear irrelevant, because the new obstruction enhancement under U.S.S.G. § 3C1.1 applies to any deletion of data after the company has a reasonable basis to anticipate an investigation.