On February 24, 2026, the US Attorney’s Office for the Southern District of New York (SDNY) announced updates to its Corporate Enforcement and Voluntary Self-Disclosure Program for Financial Crimes (the Program).See SDNY Corporate Enforcement And Voluntary Self-Disclosure Program For Financial Crimes, effective February 24, 2026. From the perspective of SDNY and the other components of the Department of Justice (DOJ), self-disclosure policies and programs offer important incentives to encourage companies to cooperate proactively by informing the government of misconduct that might otherwise go unreported (and possibly uncorrected). These policies and programs set the rules of the road for how any subsequent investigation may resolve, allowing companies to assess the likely benefits of self-reporting.
The Program breaks new ground in ways intended to make self-disclosure more attractive for companies. These include the certainty of a declination, the likelihood of reduced financial penalties, and an assurance that a monitor will not be imposed. The Program is a significant change from SDNY’s 2023 Voluntary Self-Disclosure Policy and differs from the DOJ Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) in important ways, as described further below.
While the decision whether to self-disclose will always require careful consideration, the Program offers more favorable conditions than previously available. This Client Alert analyzes the Program and provides key takeaways for companies.
The Program requires a company to report promptly conduct to SDNY before it receives a grand jury subpoena or document request from law enforcement or a regulator and before the company learns of an existing government investigation. A company qualifies for self-reporting credit even if it knows about a whistleblower submission, including to the government, or has seen public reporting about the misconduct, so long as there has been no public reporting of the government’s investigation and the company is otherwise unaware that one has been initiated.
This is an important change from SDNY’s 2023 Policy and the CEP, which disqualified a company if the activity had been publicly reported or if the conduct was already known to the government. Historically, these have been meaningful limitations: many SDNY investigations proceed covertly before a subpoena is issued and/or begin on the heels of public reporting. Under the Program, therefore, the benefits of voluntary self-reporting should be available to a greater number of companies.
To qualify for the Program, the conduct at issue must fall within certain listed categories, all of which come under the broad umbrella of “fraud.” Importantly, various aggravating circumstances that disqualified conduct under the 2023 Policy (and continue to disqualify conduct under the CEP) are not disqualifying under the Program.Deputy Attorney General Todd Blanche announced in December 2025 that DOJ would soon issue a department-wide corporate enforcement policy, which will presumably remove these disparities, but DOJ has not yet done so. This includes the involvement of senior leadership, the pervasiveness of misconduct within the company, prior criminal resolutions involving the same company, or especially severe harm or serious misconduct. This is a significant broadening of SDNY’s self-reporting program.
The conduct must not, however, have a nexus to terrorism, sanctions evasion, sex trafficking or human trafficking, slavery or forced labor, international drug cartels, or foreign corruption, or involve the knowing or reckless funding of these activities. If it does, the company is not eligible for the Program, regardless of when and whether it voluntarily self-discloses its conduct.
The Program guarantees companies a conditional declination letter within two to three weeks of self-reporting, so long as the company provides full cooperation, commits to remediating the harm, commits to making restitution to all injured parties, and commits, for a period of three years, to bring to SDNY’s attention credible evidence or allegations of criminal conduct by the company or its employees. This conditional declination letter offers companies greater certainty at a far earlier stage than they have customarily received from federal prosecutors. Complicated financial investigations generally take months or years, and resolutions historically have not been finalized until the very end stages.
The Program guarantees a declination once a company has “reasonably” remediated the harm, made restitution to all injured parties, fully cooperated, and agreed to self-report any further criminal misconduct for a period of three years. These cooperation and self-reporting requirements are consistent with prior SDNY practice, although the Program’s specific mention of the need to preserve non-email and ephemeral messaging applications such as WhatsApp and Signal is new. The Program does not specify whether companies must have historical policies guaranteeing that such messages were previously preserved or whether companies must simply preserve such messages on a going-forward basis once they learn of the misconduct. Whether companies do the former, it is clear that, at a minimum, they should be doing the latter and should act quickly to suspend deletion of, and preserve, such messages.
The restitution and remediation requirements are important changes from prior practice and the 2023 Policy. There are three separate buckets of money that companies may be required to pay in a corporate resolution: (i) restitution, meant to make victims whole; (ii) forfeiture, meant to disgorge ill-gotten gains; and (iii) fines, meant to penalize a company and deter it from future misconduct. Under the Program, a company only has to pay restitution and does not have to pay forfeiture or a fine. This can make a significant difference to companies: fines, in particular, can tally millions or even billions of dollars, depending on the case. The Program is different in this sense from the CEP, which requires that a company pay forfeiture in addition to restitution. The Program’s requirement that a company remediate any harm is consistent with the 2023 Policy and past practice, but the Program adds a guarantee that a monitor will not be imposed as part of the resolution. This aligns the Program more closely with the CEP, which does not require a monitor if a company self-reports or attempts to self-report in good faith. It will be welcome news to companies, who may view monitors as expensive, intrusive, and unproductive.
Last, the guarantee of a declination, as opposed to another type of resolution, is a significant change from past practice and the 2023 Policy. SDNY traditionally has entered into four types of criminal resolutions with companies, in decreasing order of severity: a criminal plea agreement, a DPA, an NPA, and a declination. The first three resolutions may trigger important penalties from regulators, including the loss of a company’s QPAM status or, in the case of a criminal plea, the loss of investment adviser registration. Receiving a declination and avoiding these potential knock-on effects is therefore a significant benefit to certain companies.
The Program is a more attractive path for companies to self-report than ever before, including because the prospect of greater certainty that the Program offers can be extremely valuable to companies, their investors, and their shareholders. But companies considering a self-report under the policy must be mindful that self-reporting is not without cost, even if SDNY guarantees a declination agreement. Cooperation and remediation can be expensive, restitution under federal law can be costly, and ongoing reporting obligations can be burdensome. None of these will be defined at the point of self-reporting, which must be done at an early stage — “upon discovering illegal activity.” This will often be before a company has completed its own internal investigation — in other words, before it understands the contours and implications of the conduct. Further, any declination agreement will apply to the company only and will not preclude the prosecution of individuals involved in the misconduct, as the Program is designed to allow SDNY to focus resources on prosecuting individuals.
Another consideration is what will be made public and when. Traditionally, while criminal investigations have sometimes been reported in the press or disclosed in public company filings, SDNY has not officially reported or confirmed investigations until a final resolution has been reached. The Program does not include guidance on this issue, unlike the CEP, which expressly states that declinations will be publicized. This may be a consideration for companies that warrants pre-disclosure discussion, including because an SDNY resolution may result in additional scrutiny from civil regulators, state criminal authorities, and civil plaintiffs.
In addition to the carrots described above, the Program includes a stick: the Program states that if a company does not self-report or attempt to do so, there will be a “strong presumption” that a declination is not appropriate. This is a change from the previous practice and presents an additional reason to self-report: while self-reporting has always been an important factor in determining a disposition, SDNY has never previously adopted formal presumption against a declination when self-reporting did not occur.
In short, the Program offers important and new incentives to self-report. However, there are still nuances and complexities to whether and when to self-report. A company must also consider where to self-report: SDNY’s Program now offers more favorable conditions than the Criminal Division’s CEP. Finally, a company must consider whether to simultaneously self-report to other regulators, including the SEC and CFTC, which have their own self-reporting policies.