Clients with even the strongest internal compliance policies, operating procedures, and leadership find themselves from time to time confronting potential exposure for civil liability due to regulatory violations. No one enjoys going through those heavy moments when otherwise hypothetical risks become tangible. Recognition of potential violations often rise from benign settings, such as a customary periodic compliance review and risk assessment, a diligence request as part of mergers and acquisitions activity, or during consideration of what it may take to service what appears to be a spectacular deal. Regardless of circumstance, the pragmatic path forward typically involves determination of the facts that occurred as best as they may be known, those agencies having jurisdiction and their regulations, and the strategy for resolving any issues with minimal exposure.

Best-in-class compliance toolboxes contain many options for managing and mitigating risk. One of the most effective tools that can be considered after internal identification of a possible violation is the voluntary self-disclosure (VSD). Many federal agencies provide some form of incentive when entities within their jurisdiction provide advanced notification of violations. Those incentives often result in a mitigation of the monetary exposure for civil penalties and in some cases can result in a total cancellation of any penalty. To determine whether a VSD strategy is available, and whether it should be exercised based upon known facts, one must of course understand the relevant agency and its processes for handling VSDs, together with the benefits relative to typical enforcement activities. This decision-making process is fact specific, and determining next steps can rely heavily upon agency experience and relationships.

1. Agencies Accepting Voluntary Self-Disclosures

A short summary of certain federal agencies for whom VSDs can be a meaningful part of a mitigation strategy following recognition of a potential compliance violation is shown below. Recognizing the agency with jurisdiction will serve to guide analysis of the complete range of options available. The most common pitfall, apart from submitting to the incorrect agency is failure to recognize that more than one agency may have jurisdiction over a particular set of facts. Companies sometimes find it necessary to submit multiple VSDs to various agencies so that the entire field of exposure is addressed. Agencies do communicate with one another about enforcement activity and, as a result, one cannot assume that a particular agency will not learn about facts amounting to a violation, which could in turn eliminate the value of a VSD.

  • Customs and Border Protection (CBP). S. Customs and Border Protection provides for the statutory reduction of penalties under 19 USC § 1592 when a person notifies CBP of the circumstances of a violation. Where effective, the VSD could result in either substantial mitigation or cancellation of a penalty in full based upon CBP's published mitigation guidelines.
  • Office of Foreign Assets Control (OFAC). S. Treasury's Office of Foreign Assets Control will accept VSDs and consider mitigation for violations of the various economic sanctions programs. If OFAC elects to bring an enforcement action, companies that voluntarily self-disclose receive a 50% reduction in the base penalty for both egregious and non-egregious violations. [31 CFR Appendix A to Part 501.]
  • Bureau of Industry and Security (BIS). S. Commerce's Bureau of Industry and Security strongly encourages VSDs regarding violations of the Export Administrative Regulations (EAR). [15 CFR § 764.5(a).] There is no set mitigation as provided by other federal agencies, although BIS considers the VSD as a mitigating factor and will consider that factor when determining appropriate penalties and enforcement actions.
  • Directorate of Defense Trade Controls (DDTC). S. Department of State's Directorate of Defense Trade Controls also strongly encourages VSDs regarding violations of the Arms Export Control Act (the Act), the International Traffic in Arms Regulations (ITAR), or any order, license, or other authorization issued under the authority of the Act. DDTC may consider a VSD as a mitigating factor in determining the administrative penalties, if any, that should be imposed. While not technically mandatory, companies are incentivized to self-disclose in order to avoid such nondisclosure being considered an aggravating factor or a further violation. [22 CFR § 127.12(a).]

The agencies identified above are far from an exhaustive list of all federal and state agencies that formally or informally accept VSDs or similar disclosures. For example, the Census Bureau (with respect to the violations of the Foreign Trade Regulations) and the Transportation Security Administration (with respect to violations of Transportation Security Requirements) also provide some form of mitigation for VSD.

2. Deciding to Submit a Voluntary Self-Disclosure

A company's decision whether to submit a VSD, or to forego doing so, is largely strategic in nature. Experience will guide an understanding of the relationship with the particular agency and the typical enforcement posture for the violations under review. Diligent internal investigations will guide an understanding of the specific facts and circumstances surrounding the violation, any associated violations, and other exposure that may come to light. Together, these elements support a rational cost-benefit analysis of the situation to help determine the path forward.

The determination of next steps also necessarily involves consideration of the specific agency having jurisdiction and their unique rules for VSD. Careful attention is due to those rules so that the requirements for timing, form, content, and agency contacts are closely followed. The exercise typically involves a narrative description of all substantial and significant facts related to the violation, along with supporting evidence of such facts where appropriate. The timeline for recognizing the violation and the sequence of events that followed are often critically important to the story as well as the agency's adjudication. Explaining the absence of aggravating factors and the presence of mitigating factors, such as a clean record of enforcement and use of strong corrective actions, are essential to arriving at the most favorable outcome from the endeavor. Viewed this way, VSDs are in part an exercise of candor before the agency. The goal is to address the issue head-on while also demonstrating that despite the severity of violations the company acted reasonably, in light of the circumstances, when it discovered and responded to the incident.

Agency discretion is often the most difficult factor to address in the decision-making process. A violation is a violation. While there may be well-defined VSD and mitigation guidelines, and even a strong history of compliance or successful mitigation, there is no guarantee that the agency will agree to reduce or eliminate exposure. This variance can depend on the specific facts of the case and on the individual personalities sitting on both sides of the issue. The immediate trade-off is having gone "on record" with the agency about the violation, disclosure of details surrounding the violation, and acceptance of whatever the outcome may be. However, despite uncertainty, VSDs also offer an opportunity to frame the facts and the issues surrounding the potential violation and to introduce favorable information. VSDs can be valuable for "controlling the narrative" in the interest of minimizing the impact of a violation.

Aside from cost-benefit analysis, some of our clients choose by corporate policy to file a VSD on most violations out of an abundance of caution. This can amount to "over-compliance" that generates a record with the respective agency and some degree of exposure (despite mitigation). However, the strategy also yields the tangible benefit of arriving at certainty on the issue at hand including any exposure. For some the certainty of knowing that a potential violation is resolved brings greater comfort from an enterprise compliance perspective than merely waiting out the applicable statute of limitations.

3. Attention to Regulatory Compliance Programs

VSDs are a tool for dealing with apparent regulatory violations that may from time to time arise. They are not a free pass to avoiding proper compliance leadership, policies, and practices. The identification of any potential violation must be dealt with quickly, efficiently, and compliantly regardless of whether an available VSD option is exercised. The efficacy of those immediate actions will serve as the greatest risk mitigation factor by demonstrating to the enforcement agency, if necessary, that the company is a quality operator that implemented root-cause analysis followed by a meaningful corrective action plan. On a forward-looking basis, those activities will lead to improvements in the overall compliance organization, such as retraining of associates or updates to polices, which will serve to avoid reoccurrence of the particular risk.

Clear thinking and a well-reasoned strategy are fundamental to achieving the best results when confronting both day-to-day and high-impact situations. The attorneys at Benesch are experienced in dealing with a wide range of enforcement agencies, internal audits, development of compliance programs and policies, assessment of regulatory compliance violations, drafting and filing VSDs, and enforcement defense.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.