Deep Dive: the Legal Reasoning Behind the DOJ’s New Deferred Prosecution Framework

The Shift from Ad Hoc Discretion to Structured Guidelines: What the DOJ Changed and Why

In my 25 years as a federal prosecutor, I saw deferred prosecution agreements handled with an almost arbitrary degree of discretion—some offices demanded guilty pleas for minor infractions while others handed out DPAs like participation trophies. The DOJ’s new framework, announced by Deputy Attorney General Lisa Monaco in September 2024 and now embedded in the Justice Manual, aims to end that inconsistency by imposing a mandatory, factor-based analysis under USAM § 9-28.010. The core innovation is the requirement that prosecutors document, in writing, how each of the eight enumerated factors—ranging from the nature and seriousness of the offense to the company’s history of noncompliance—weighs in the decision to offer a DPA. This isn’t merely a policy preference; it is a binding directive that prosecutors must follow, and failure to do so can be raised by defense counsel as a procedural defect in any subsequent motion. The framework also introduces a formal presumption against DPAs for companies that have entered into a prior DPA or criminal resolution within the preceding five years, effectively creating a “three strikes” rule that I believe will force repeat offenders to plead guilty. For defense attorneys, this means our job now involves building a pre-indictment record that affirmatively rebuts each negative factor, rather than simply negotiating in the dark.

The Self-Disclosure Safe Harbor: How the 120-Day Window Changes Corporate Behavior

Perhaps the most consequential change in the new framework is the codification of a 120-day self-disclosure window, found in USAM § 9-28.400, which grants companies a rebuttable presumption that they will receive a DPA rather than a guilty plea if they voluntarily report misconduct within that period. Previously, the DOJ’s “first-in” policy under the Yates Memo and subsequent guidance gave credit for voluntary disclosure but never guaranteed any particular outcome, leaving companies uncertain whether coming forward would actually avoid an indictment. Now, the framework flips the burden: if a company self-discloses within 120 days of learning of the misconduct, the government must rebut the presumption of a DPA by showing that aggravating factors—such as executive involvement or systemic obstruction—outweigh the disclosure credit. In my experience, this is a game-changer for corporate counsel because it creates a clear, measurable deadline that forces companies to conduct internal investigations with unprecedented speed. However, I must caution that the 120-day clock starts ticking from the date the company’s senior management or legal department “knew or should have known” of the misconduct, a standard that requires immediate implementation of robust whistleblower and monitoring systems. The risk is that companies that delay disclosure beyond 120 days—even for legitimate investigative reasons—lose the presumption and revert to the more discretionary, pre-2024 framework where a guilty plea becomes far more likely.

Compliance Monitors and the New “Preexisting Culture” Defense: How to Avoid External Oversight

Under the new framework, any DPA must include a compliance monitor unless the company can demonstrate, by clear and convincing evidence, that it already has a “preexisting effective compliance culture” that renders external oversight unnecessary. This provision, detailed in USAM § 9-28.710, represents a significant hardening of DOJ policy, which previously allowed prosecutors to waive monitors in cases where the company had voluntarily replaced management or implemented remedial measures. In my 25 years as a federal prosecutor, I saw too many companies promise internal reforms only to backslide after the DPA expired, and this new rule reflects the DOJ’s frustration with that pattern. To avoid a monitor, defense counsel must now present documentary evidence—such as third-party audit reports, employee training completion rates, and historical compliance committee minutes—that predate the misconduct and show a genuine culture of compliance. The framework explicitly states that a company cannot simply hire a new compliance officer or purchase new software after the fact and claim it has a preexisting culture; the evidence must show that the culture was in place before the wrongdoing occurred. For companies that cannot meet this burden, the monitor’s term will now run for the full duration of the DPA—typically three to five years—and the monitor’s reports will be filed directly with the court, creating a public record that plaintiffs’ attorneys can use in subsequent civil litigation.

Recidivism and the “Three Strikes” Rule: How Prior Resolutions Eliminate DPA Eligibility

The new framework creates a formal recidivism penalty that I believe will dramatically reshape how companies approach successive compliance failures: any company that has entered into a DPA, non-prosecution agreement, or criminal guilty plea within the preceding five years is presumptively ineligible for another DPA, absent extraordinary circumstances. This rule, codified in USAM § 9-28.110, is not a complete ban, but the burden shifts entirely to the company to prove that a DPA is appropriate despite its history, and the Deputy Attorney General must personally approve any deviation from the presumption. In my practice, I have already seen this provision force companies to plead guilty to criminal charges that, under the old framework, would have resulted in a DPA with a fine and a monitor. The practical effect is that companies with a history of noncompliance now face a binary choice: either accept a guilty plea and the attendant collateral consequences—including mandatory debarment from federal contracting and loss of licenses—or litigate the case to trial, which carries its own risks of a conviction and potentially harsher sentencing under the U.S. Sentencing Guidelines § 8C2.5. For defense attorneys, this means that the first DPA a company ever receives is now the most important one, because a second resolution within five years will almost certainly result in a criminal conviction. I advise all my clients to treat the 120-day disclosure window and the preexisting compliance culture requirement as existential priorities, because the cost of a second DPA—or the loss of DPA eligibility altogether—can be the death of the company.

If your company is facing a potential criminal investigation or has discovered misconduct that may trigger the new DPA framework, do not wait until the 120-day window closes. Contact my office today for a confidential consultation. I have spent 25 years on both sides of the prosecutor’s table, and I know exactly how to build the record you need to secure a DPA under these new, stricter rules. Call 202-555-0199 or email [email protected] to schedule a privileged discussion of your specific situation.