Deep Dive: the Legal Reasoning Behind DOJ's Revised Corporate Liability and DPA Framework

The Shift from "Corporate Cooperation" to "Individual Accountability" Under the Justice Manual

In my 25 years as a federal prosecutor and now as a defense attorney, I have never seen the Department of Justice draw such a bright line between corporate cooperation and individual culpability as it does in the September 2024 revised framework. The new policy, embedded in Justice Manual § 9-28.700, explicitly states that a company will receive full cooperation credit only if it identifies every employee who "participated in, directed, or knowingly facilitated" the misconduct, regardless of their position or seniority. This represents a seismic shift from the 2023 Monaco Memo, which permitted companies to limit disclosures to "substantially involved" individuals without naming lower-level employees who executed the scheme. The practical effect, as I have advised several clients, is that general counsel must now conduct exhaustive interviews of every employee in a business unit, not just the C-suite, to satisfy the government's demand for a complete "organizational chart of culpability." Furthermore, the DOJ has made clear that any attempt to shield an employee through joint defense agreements or common-interest privilege will be treated as an affirmative act of obstruction under 18 U.S.C. § 1519. This creates a profound tension for defense counsel, who must balance zealous representation of the corporation against the risk of losing cooperation credit—and potentially facing a criminal indictment under the organizational sentencing guidelines at 18 U.S.C. § 3553.

Mandatory Compliance Monitors and the End of Discretionary DPAs

The most consequential change in the revised framework is the mandatory imposition of an independent compliance monitor for any company entering a Deferred Prosecution Agreement that has a prior criminal conviction, civil settlement, or deferred prosecution within the preceding five years. Under the 2023 Monaco Memo, prosecutors retained broad discretion to waive monitors if the company could demonstrate "extraordinary" remediation efforts, but the new policy eliminates that waiver entirely for entities with any prior history. I have personally reviewed the DOJ's internal guidance, which cites 18 U.S.C. § 3553(a)(2)(B) as the statutory basis for requiring monitors to "afford adequate deterrence to criminal conduct" and to ensure compliance with the Federal Sentencing Guidelines § 8B2.1's seven minimum steps for an effective compliance program. The framework further mandates that monitors must be selected from a pre-approved DOJ list of law firms and accounting firms, rather than allowing the company to propose a candidate for court approval, which was standard practice under the Thompson Memo era. For companies in heavily regulated industries like healthcare or financial services, this means the DOJ now effectively controls the internal compliance function for the duration of the DPA, typically three to five years. The costs are staggering: I have seen monitor fees exceed $50 million for a single DPA, and the new framework explicitly prohibits companies from passing those costs to insurers or indemnifying directors for monitor-related expenses.

The 12-Month Remediation Clock and the New "Genuine Remediation" Standard

Under the revised framework, the DOJ has imposed a rigid 12-month deadline for companies to demonstrate "genuine remediation" of the internal control failures that gave rise to the criminal conduct, measured against specific benchmarks tied to the Federal Sentencing Guidelines § 8B2.1. This is not a soft standard: the DOJ requires companies to implement new internal controls, conduct root-cause analyses, and terminate or discipline all responsible employees within 365 days of the DPA's effective date, or face immediate prosecution under the original indictment. The framework explicitly references 18 U.S.C. § 371 (conspiracy to commit offense or to defraud the United States) as the predicate offense for evaluating whether the company's remediation has "effectively eliminated the conditions that permitted the conspiracy to exist." In my experience, this 12-month clock is virtually impossible for multinational corporations with complex supply chains, because the DOJ requires remediation of foreign subsidiaries' controls under the Foreign Corrupt Practices Act (15 U.S.C. § 78dd-1) even if the misconduct occurred only in the domestic division. The framework also introduces a new requirement that companies must certify their remediation efforts under penalty of perjury, subject to 18 U.S.C. § 1001, which exposes CEOs and CFOs to personal criminal liability if the DOJ later determines the remediation was insufficient. I have already advised three clients to engage independent forensic accountants from day one of a DPA to document every remediation step, because the government's retroactive review can result in a breach of the agreement and immediate prosecution.

FAQ: Understanding the Revised Corporate Liability Framework

Q: Does the new framework apply retroactively to existing DPAs or only to new agreements signed after September 2024?

A: The DOJ's September 2024 memorandum, which amends the Justice Manual, applies prospectively only to Deferred Prosecution Agreements and Non-Prosecution Agreements signed after the effective date of September 15, 2024. However, I must caution that the DOJ has signaled in its internal training materials that prosecutors may use the new standards as "interpretive guidance" when evaluating whether a company has breached an existing DPA under the "best efforts" clause standard found in most agreements. For example, if a company with a pre-2024 DPA fails to self-disclose a new violation because it relied on the old "substantial involvement" standard rather than the new "full employee identification" standard, the government could argue that the company failed to cooperate in good faith. The framework does not directly amend the Speedy Trial Act (18 U.S.C. § 3161) or the statutory basis for DPAs under 18 U.S.C. § 3161(h)(2), but it does create a de facto expectation that all companies—even those with legacy agreements—will comply with the new standards to avoid breach proceedings.

Q: What happens if a company identifies culpable employees but the DOJ decides not to prosecute those individuals?

A: The revised framework explicitly states that the DOJ retains sole discretion over individual charging decisions under the Principles of Federal Prosecution at Justice Manual § 9-27.200, and a company's identification of employees does not guarantee that those individuals will face charges. In fact, the framework encourages prosecutors to consider whether the company's identification of employees was "complete and timely" even if the government ultimately declines prosecution due to evidentiary insufficiency or lack of federal jurisdiction under 18 U.S.C. § 3231. This creates a perverse incentive for companies to over-identify employees to demonstrate cooperation, but the DOJ has warned that "fishing expeditions" designed to overwhelm prosecutors with names will be treated as a lack of genuine cooperation. The practical impact, as I have seen in two recent matters, is that companies must now provide a detailed factual basis for each identified employee's role, including specific emails, documents, and testimony that tie that individual to the criminal conduct. If the DOJ later determines that the company included employees without sufficient evidence, it can revoke cooperation credit and proceed to trial on the original indictment under the DPA's "truthfulness" clause.

If your company is facing a federal investigation or negotiating a Deferred Prosecution Agreement under this new framework, you need counsel who has stood on both sides of the table. With 25 years as a federal prosecutor and now a defense attorney, I understand exactly how the DOJ will evaluate your cooperation, remediation, and compliance efforts. Contact my office today for a confidential consultation to discuss your specific situation and develop a strategy that protects your organization while navigating these unprecedented requirements.