7 Strategies to Comply with the DOJ’s New Whistleblower Rewards Program

Banner artwork by ptgregus / Shutterstock.com

In recent years — especially under the Biden administration — the US Department of Justice (DOJ) has become increasingly aggressive regarding corporate responsibility, ramping up its policies and enforcement efforts concerning criminal and civil actions. This article advises legal departments on these recent policies and directives, highlighting the intersection of internal compliance programs, corporate self-disclosure policies, and the new Whistleblower Rewards Program. It also addresses the importance of internal reporting, challenges encountered in corporate operations, and considerations for effectively implementing these policies in corporate settings.  

DOJ's corporate responsibility policies

Over the past several years, DOJ has established and refined its policies promoting the creation of strong internal compliance programs, incentivizing self-reports of criminal conduct, and offering monetary payments for whistleblowers who unveil certain corporate misconduct. The common thread through these policies is DOJ’s focus on using all possible tools and incentives to identify and pursue corporate misconduct.

Promoting internal compliance programs

For many years now, DOJ has encouraged corporations to implement and strengthen internal compliance and ethics programs, which have proven to be the most significant tools for creating a strong culture of compliance. DOJ’s recent written policies clarify that substance matters: “The adequacy of a corporation’s compliance program, including its corporate culture, … can have a direct and significant impact on the terms of any resolution with the Department.”

DOJ has also provided its prosecutors, as well as the public, with detailed guidance on evaluating corporate compliance programs when making investigative decisions, charging decisions, and developing a resolution. Similarly, the US Sentencing Commission Guidelines also outline expectations for corporate compliance and ethics programs, providing another useful tool for establishing or refining existing compliance programs. In private industry and government circles, these policies and guidance are recognized as the most critical foundations for responsible and lawful corporate and business practices.    

Incentivizing voluntary self-disclosure of corporate and individual misconduct

More recently, DOJ has focused on encouraging self-disclosure by corporations and individuals in exchange for more lenient treatment or non-prosecution. On Feb. 22, 2023, DOJ instituted its Voluntary Self-Disclosure Policy, which outlines the circumstances under which a company can receive credit for voluntarily self-disclosing criminal conduct to US Attorneys’ Offices (USAOs). Similarly, on April 15, 2024, DOJ announced a pilot program incentivizing Voluntary Self-Disclosure by Individuals, providing that individual wrongdoers will be eligible to receive a non-prosecution agreement (NPA) if they meet certain criteria.

Creating DOJ's Whistleblower Rewards Program

On March 7, 2024, Deputy Attorney General Lisa Monaco first announced DOJ’s crafting of a Whistleblower Rewards Program designed to reward tipsters for unveiling major corporate crimes financially. The new Whistleblower Reward Program went live on Aug. 1, 2024, and seeks to fill perceived gaps in other whistleblower programs in four areas, which are much narrower than many anticipated and include violations involving:

In light of this program’s recent implementation, below are some more details on what it does and does not cover.

True to the moniker “gap filler,” DOJ’s new Whistleblower Reward Program is characterized by its limited applicability. The program is available only to individuals (not corporate entities) who possess original, truthful information that leads to criminal, civil, or administrative forfeiture of more than US$1,000,000. 

To qualify for potential compensation, an individual must not be eligible under any other whistleblower program and must voluntarily provide original information in writing. “Original information” means that the information is not public, is based on independent knowledge or analysis, and is not known by DOJ before the disclosure. Importantly, “original information” does not include privileged information or information obtained by senior officers or gained through internal compliance or audit processes. There are exceptions to those limits for:

• Matters involving national security, crimes of violence, imminent harm to patients, or potential imminent financial or physical harm to others;
• If there is a reasonable basis to believe the bad actor is going to obstruct justice; or
• At least 120 days has expired since senior official, compliance or audit official reported the problem through the relevant compliance avenues and/or senior officers and it appears those same individuals receiving the information were previously aware of the information.

This 120-day window after a whistleblower reports internally is particularly significant — along with announcing this pilot program, DOJ also temporarily amended its Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy. The bottom line is that a company has 120 days, or one quarter, to report covered misconduct flagged internally by a whistleblower to remain eligible for DOJ’s Self-Disclosure Policy and benefits.

If a whistleblower makes both an internal report to a company and a whistleblower submission to DOJ, the company may still qualify for a presumption of a declination — even if the whistleblower submits to DOJ before the company self-discloses — provided that the company:

1. Self-reports the conduct to DOJ within 120 days after receiving the whistleblower’s internal report, and
2. Meets the other requirements for voluntary self-disclosure and presumption of a declination under the policy.

While 120 days is the actual “magic number” under DOJ’s new program and amended policies, the reality is that 120 days is not a lot of time for many companies to thoroughly investigate, analyze, and make an informed decision about self-disclosure, particularly where the subject matter of the allegation is complex, outside experts are needed to analyze policies or practices, or where the alleged conduct is historical or conducted across various locations or time periods. Even with robust compliance programs and procedures, a well-trained staff, and the desire to ferret out problems, 120 days leave very little margin for error. 

Finally, while the new program does not require employees to report through internal compliance programs before going to DOJ, it does provide that a whistleblower can receive a higher award for using internal compliance and reporting systems or assisting in any internal investigation regarding the reported criminal violations. A whistleblower can also have their award reduced for undermining the integrity of an internal compliance or reporting system. 

7 ways to meet the challenges posed by DOJ’s programs

In general, the incentives for DOJ and corporations are aligned to build strong corporate cultures, enhance compliance programs, and root out misconduct and bad practices. While the new DOJ Whistleblower Program and Voluntary Self-Disclosure Program promote strong internal compliance and reporting practices, a 120-day reporting period may be too rigid a deadline for realistic reporting for complex situations or smaller companies that lack investigative resources. While time will tell whether these time limits are reasonable, it bears emphasis that designing a strong compliance system that promotes reliance on internal reporting procedures first is more efficient and timelier than government enforcement mechanisms, which will often be accompanied by investigation and litigation delays. Those routes also increase costs for the government and corporations and cost the taxpayers more in the long run.

With these realities in mind, the following are some considerations for establishing a strong compliance playbook to meet these challenges and stay out of DOJ’s prosecution crosshairs:

1. Promote strong compliance and investigations programs

The importance of implementing and relying upon an effective compliance and investigations process cannot be overemphasized. This process forms the foundation for corporate credibility and is at the heart of all DOJ policies. It helps identify misconduct before it becomes out of control, allowing the investigation and compliance processes to engage and timely address problems. It also ensures that business leaders appropriately escalate and address issues, promoting a feedback loop that allows businesses to learn from mistakes and enhance policies to avoid future problems.

2. Ensure that investigations are properly managed and addressed

Every investigation presents an opportunity to effectively address serious problems and a risk that something critical could be missed. Businesses must make sure their investigations process:

•  Fully captures and timely addresses reported concerns, including identifying hidden legal problems that could be lurking in the details;
• Escalates serious matters for handling and consideration by the in-house legal department, appropriate company stakeholders, and outside counsel (when appropriate);
• Ensures an even-handed approach in addressing all cases, from the start through discipline;
• Avoids siloing of information and helps highlight bigger trends and patterns; and
• Includes a feedback loop, resulting in lessons learned and policy and process improvements.

3. Encourage individual reporting and anti-retaliation policies

Encouraging internal reporting through established compliance avenues is critical — those reports will allow internal corporate mechanisms to catch and fix problems before they worsen and provide for appropriate referral of misconduct as required by DOJ’s policies. Supporting strong anti-retaliation policies and providing anonymous hotline reporting options are also key for building a sound internal reporting stream (or river) to feed the corporation’s reservoir of credibility. That reservoir, in turn, will serve the corporation well in future dealings with DOJ and other agencies. 

4. Establish a playbook providing for timely addressing employee complaints

Compliance and legal departments should strive for timely, accurate resolutions on employee complaints, ensuring long delays and employee perceptions do not discredit the company program and that nothing is being done. This is particularly important in light of DOJ’s new 120-day period for amnesty under the Self-Disclosure Policy, which can be difficult to meet in certain situations. With these realities in mind, plan ahead for the key questions on complex investigations that come through the door:

• What person or department is responsible for receiving the complaint or allegation? 
• Who will run point on communication with the reporting individual? 
• Who will be thinking about and implementing issues of privilege and work product? 
• Under what circumstances will outside counsel be engaged, and who will be responsible for that process? 
• What departments or individuals will be responsible for pulling relevant documents or information, interviewing other employees, etc.? 
• Who will be making the ultimate determination about whether (and what) to self-disclose? 
• How much time will decision-makers need to make an informed decision? 

5. Identify and address potential areas of concern or heightened vulnerability

Much like seeing a doctor for an annual physical examination for potential early detection of disease or peace of mind, companies should consider using DOJ’s new program as a catalyst for internal review of systems, reporting lines, problem areas, etc. Whether a whistleblower files a complaint or an internal allegation/concern arises, documented compliance checks and preventative analysis go a long way with investigators and DOJ decision-makers, even if problems manifest later. Similarly, engaging in serious and meaningful internal analysis fosters a compliance-forward culture that will pay dividends over time. To recap, write your playbook and critically analyze your systems and culture as initial steps to prepare any company for heightened scrutiny in the event of a whistleblower allegation.

6. Foster external government relations, transparency, and trust

If a company is already in a highly regulated environment, building relationships and trust within the regulator’s ranks will pay long-term dividends for corporations. Maintaining good working relationships with law enforcement and prosecution authorities is equally important. Consider reporting problems to your local offices even if there is low or no risk of prosecution, fines, or civil penalties. While risky in some jurisdictions, in many locales, transparency, trust, and ongoing communications with regulators and law enforcement agencies often trump nationwide policies or DOJ proclamations. 

7. Explain the “why” for employees

Establishing a strong compliance program is only half the battle if employees do not understand and buy into the corporate compliance culture. Top-level leaders and compliance team members must take every opportunity to educate employees about the program and why they can rely upon it to address significant concerns that could garner DOJ attention. 

Craft a gameplan and playbook

Whistleblowing — particularly the monetization of whistleblowing — is here to stay, along with the other corporate policies outlined above. While DOJ’s new Whistleblower Rewards Program has been billed as a “pilot” program, there is little reason to believe that DOJ will scrap the program, particularly where the return on investment of whistleblower programs far exceeds the cost.

There are undoubtedly foreseeable wrinkles that DOJ will have to iron out, but taking proactive steps to craft a gameplan and playbook, as well as internal assessments of compliance culture and reporting, will mitigate the risk of a new, untested program. Companies should consider this new emphasis on whistleblowing by DOJ as an opportunity to tighten controls, enhance internal reporting and communication, and reinforce a strong compliance culture.