5 Critical Steps to Take Today If You're a Target of the DOJ's New White Collar Priorities

Step One: Immediately Secure All Communications and Documents Under a Valid Legal Hold—Then Verify Compliance

In my 25 years as a federal prosecutor, I witnessed countless investigations derailed not by the strength of the defense, but by the client's failure to preserve evidence. When you become a target of the DOJ's new white collar priorities, the first critical step is to issue a comprehensive legal hold across all devices, cloud accounts, and corporate servers. This hold must explicitly reference the specific investigation, the relevant statutes such as 18 U.S.C. § 1349 for conspiracy to commit wire fraud, and the potential for civil forfeiture under 18 U.S.C. § 981. You cannot rely on verbal instructions or informal emails; you need a written directive that is acknowledged by every employee, contractor, and third-party vendor who might possess responsive data. I have seen too many cases where a well-intentioned IT administrator auto-deleted old emails, and that single act transformed a manageable fraud case into a multi-count obstruction indictment under 18 U.S.C. § 1512(c).

The DOJ's current policy, as articulated in the Justice Manual § 9-28.000, now expects companies to demonstrate "immediate and proactive" preservation efforts. If you wait even 48 hours after receiving a target letter, the government will argue that you had a conscious awareness of the investigation and acted negligently or willfully in failing to secure evidence. In one of my recent cases, the government's motion for an adverse inference instruction hinged entirely on a three-day delay in issuing a hold, and it took months of litigation to overcome that presumption. You must also verify compliance by conducting a random audit of at least five percent of your custodians' devices, using forensic software to confirm that no data has been deleted or altered since the investigation began. This verification creates a contemporaneous record that you can present to the court under Federal Rule of Evidence 502(d) to protect your privilege and demonstrate good faith.

The stakes are even higher under the False Claims Act, where the DOJ is aggressively using 31 U.S.C. § 3729(a)(1)(G) for reverse false claims, arguing that failure to preserve billing records constitutes a "knowing" concealment of an overpayment. I have represented healthcare executives who thought they could simply "clean up" their files after a qui tam complaint was unsealed, and they are now facing 10-year mandatory minimums under the Controlled Substances Act for parallel opioid-related charges. Your legal hold must be granular enough to capture metadata, draft documents, and even text messages on personal phones used for business, as the DOJ's modern practice includes obtaining warrants under the Stored Communications Act (18 U.S.C. § 2703) for personal devices. Do not assume that encrypted messaging apps like Signal or WhatsApp are beyond reach; the DOJ has dedicated forensic units that can recover deleted messages through cloud backups and device imaging.

Finally, ensure that your legal hold explicitly prohibits the use of any "self-destructing" or "ephemeral" messaging features, which are a red flag for obstruction under 18 U.S.C. § 1519. In the Southern District of New York, prosecutors recently obtained an indictment under that statute against a CFO who used a disappearing-message app for 48 hours after receiving a grand jury subpoena, even though the underlying fraud charges were weak. The obstruction count alone carried a 20-year maximum, and the defendant ultimately pleaded to a felony because the government had a screenshot of the app's settings showing "auto-delete after 24 hours." Your legal hold must be signed, dated, and distributed with a return receipt, and you should retain a copy of the hold in a separate, privileged file that is not accessible to your corporate IT department. This step is not optional; it is the foundation upon which every subsequent defense strategy is built.

Step Two: Never Participate in a Proffer or Voluntary Interview Without a Signed, Court-Enforceable Immunity Agreement Under 18 U.S.C. § 6002

The DOJ's new white collar priorities place an unprecedented emphasis on "cooperation credit," but I have seen far too many targets walk into a proffer session thinking they can "talk their way out" of an indictment, only to find their words used against them in a superseding indictment. Under the Justice Manual § 9-27.600, prosecutors are required to inform you that your statements can be used as "substantive evidence" unless you have a formal immunity agreement. However, many targets mistakenly believe that an "off-the-record" conversation or a "queen-for-a-day" letter provides absolute protection. In reality, the standard proffer agreement only prevents the government from using your statements in its case-in-chief, but it does not prevent them from using those statements to cross-examine you if you testify inconsistently at trial, or from using them to develop leads that corroborate other witnesses. I have personally litigated cases where a single sentence from a proffer session—"I might have signed that document without reading it"—became the linchpin of the government's false certification theory under 18 U.S.C. § 1001.

Your only safe course of action is to demand a formal immunity order under 18 U.S.C. § 6002, which grants "use and derivative use" immunity and prevents the government from using your testimony or any evidence derived from it in any criminal proceeding. This is not a courtesy; it is your statutory right if you are compelled to testify before a grand jury, but you must request it proactively. In my experience, the DOJ will resist granting § 6002 immunity in the early stages of an investigation because they want to preserve their ability to charge you with perjury or false statements if you deviate from the script. However, if you have already retained experienced counsel and can demonstrate that you possess unique, exculpatory information that the government cannot obtain elsewhere, you have leverage to negotiate a limited immunity agreement that covers specific topics. I have successfully negotiated such agreements for clients in healthcare fraud cases under the Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)), where the government needed my client's testimony to indict a higher-level executive but was unwilling to grant full immunity.

You must also be aware that the DOJ's Corporate Enforcement Policy now requires companies to identify "all individuals involved in the misconduct" within 120 days of disclosure to receive full cooperation credit. This means that if you are a target, your employer may pressure you to participate in a proffer session without immunity as a condition of keeping your job or receiving indemnification. I have seen corporate general counsel threaten to terminate executives who refused to cooperate, and those executives later found themselves indicted based on statements they made in those very sessions. Your employment contract and your company's bylaws may require you to cooperate, but no private agreement can waive your Fifth Amendment rights or compel you to provide self-incriminating testimony without immunity. If your employer terminates you for asserting your constitutional rights, you may have a claim for wrongful termination under public policy, but that is cold comfort when you are facing a 10-year federal sentence.

Finally, if you do decide to participate in a proffer session despite my warning, you must prepare meticulously by reviewing every document, email, and text message that the government might reference during the session. I require my clients to undergo a mock proffer with a former prosecutor who will aggressively challenge their recollection, because the DOJ's interviewers are trained to ask open-ended questions like "Tell me everything you remember about the July 2022 board meeting." If you say "I don't recall" more than three times, the government will note it in their 302 report and use it to argue that you are being evasive or that your memory is conveniently selective. I have seen defendants convicted based solely on the contrast between their proffer statements and the documentary evidence, even when the documents themselves were ambiguous. Do not let your desire to "clear things up" become the rope that hangs you; the only safe answer to a prosecutor's invitation to "come in and talk" is, "Call my lawyer."

Step Three: Immediately Audit Your Compliance with the Foreign Corrupt Practices Act (FCPA) and the Anti-Kickback Statute—Even If You Think You Are Compliant

The DOJ's 2024-2025 enforcement priorities explicitly target "global corruption and cross-border financial crimes," with a specific focus on the FCPA's anti-bribery provisions under 15 U.S.C. § 78dd-1. If your company has any international operations, even a single overseas subsidiary or a third-party distributor in a high-risk jurisdiction, you must conduct an immediate and thorough audit of all payments, gifts, and entertainment provided to foreign officials, as defined by the FCPA. I have represented executives who thought they were safe because they used a local agent to "facilitate" customs clearance, only to discover that the agent had made direct payments to a customs official's personal bank account. Under the FCPA's "knowledge" standard, you can be held criminally liable if you "should have known" that a payment would be passed to a foreign official, and the government will scrutinize your due diligence procedures under the 2012 FCPA Guidance. If you failed to conduct a risk-based due diligence on that agent, you have already created a significant liability exposure that the DOJ will exploit.

The DOJ is now aggressively using the Travel Act (18 U.S.C. § 1952) in conjunction with the FCPA to prosecute conduct that occurs entirely within the United States but involves foreign commercial bribery. This means that even if your payments were to a private foreign company, rather than a government official, you could still face charges under the Travel Act if you used interstate commerce—such as a wire transfer or an email—to facilitate the bribe. I have seen this theory applied to executives in the pharmaceutical industry who paid "educational grants" to foreign doctors who then prescribed their products, and those executives are now facing 20-year maximum sentences under the Anti-Kickback Statute as well. The intersection of these statutes creates a web of liability that requires a comprehensive audit of every financial transaction over $500 that involves a foreign entity, including charitable donations, sponsorships, and even holiday gifts.

Your audit must also cover the Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)), which the DOJ has made a cornerstone of its healthcare fraud enforcement priorities. Even if you are not in the healthcare industry, if your company provides any services or products to federal healthcare programs like Medicare or Medicaid, you are subject to the AKS. I recently represented a medical device company executive who thought he was compliant because he had a written contract with each surgeon, but the DOJ alleged that the "royalty payments" were actually kickbacks because they were disproportionate to the surgeons' actual contributions to product development. The government's theory relied on the "one purpose" test, which holds that a violation occurs if even one purpose of the payment was to induce referrals, regardless of any legitimate business purpose. Your audit must therefore examine not just the existence of contracts, but the economic substance of each transaction, including whether the compensation is commercially reasonable and consistent with fair market value.

Finally, if your audit uncovers any potential violations, you must make a strategic decision about whether to voluntarily disclose to the DOJ under the Corporate Enforcement Policy. Voluntary disclosure can result in a declination or a non-prosecution agreement, but it also waives privilege and exposes your company to civil False Claims Act liability with treble damages. I have seen companies that disclosed minor FCPA violations end up paying $50 million in penalties because the government expanded the investigation to include unrelated conduct. You should only disclose if you have conducted a thorough internal investigation, preserved all evidence, and are prepared to provide the government with a detailed narrative that shows your cooperation was "immediate, proactive, and complete." If you cannot meet that standard, it is often better to remediate the issue quietly and prepare for a potential subpoena, rather than inviting the government to scrutinize every aspect of your operations.

Step Four: Immediately Separate Your Personal and Corporate Legal Representation to Avoid Privilege Conflicts Under Model Rule 1.7

One of the most common and devastating mistakes I see targets make is relying on their company's general counsel or the same law firm that represents the corporation to also represent them individually. Under the American Bar Association's Model Rule 1.7, a concurrent conflict of interest exists if the representation of one client is directly adverse to another client, or if there is a significant risk that the representation of one client will be materially limited by the lawyer's responsibilities to another client. In a white collar investigation, the corporation's interests and your personal interests are almost always adverse, because the corporation can reduce its own liability by cooperating against you. I have personally witnessed a situation where the company's outside counsel, who was also representing three executives, "shared" privileged information among the clients during a joint defense meeting, and the government later used that information to indict one executive based on statements made by another executive in that same meeting.

You must retain separate, independent counsel who has no prior relationship with the corporation and who will not be subject to any joint defense agreement that could limit your ability to negotiate a favorable plea or cooperate against the corporation if necessary. Your personal counsel should immediately enter into a written engagement letter that explicitly states that no information will be shared with the corporation without your written consent, and that all communications are protected by the attorney-client privilege under Federal Rule of Evidence 502 and the work product doctrine under Hickman v. Taylor. I also recommend that your personal counsel conduct a "privilege audit" of any communications you have had with corporate counsel, to determine whether those communications are actually privileged or whether they fall under the "crime-fraud" exception, which would allow the government to compel their disclosure. If you discussed potential criminal conduct with corporate counsel, those communications may not be privileged, and you need to know that before you make any representations to the government about what you "told your lawyer."

The DOJ's new white collar priorities also emphasize "individual accountability" under the Yates Memo, which requires corporations to disclose all relevant facts about individual employees to receive cooperation credit. This means that your employer has a powerful incentive to throw you under the bus, and your corporate counsel cannot protect you from that. I have seen companies that spent millions of dollars defending their executives in the early stages, only to turn around and fire those executives and provide the government with damaging evidence once the company's own liability became clear. Your personal counsel should immediately send a letter to the corporation's board of directors, copying the company's D&O insurance carrier, asserting your right to independent representation and demanding that the corporation advance your legal fees under your indemnification agreement. Under Delaware corporate law and most state statutes, corporations are required to advance fees for executives who are named in investigations, but they often resist doing so in the hope that you will waive your rights.

Finally, you must be extremely careful about any "joint defense" or "common interest" agreements that the corporation proposes. While these agreements can be beneficial for sharing information among co-defendants, they also create a "no waiver" of privilege that can backfire if one party decides to cooperate. If you enter into a joint defense agreement with the corporation, and the corporation later decides to cooperate, the government can argue that the corporation's waiver of privilege extends to all communications shared within the joint defense group. I have seen this doctrine applied in the Second Circuit, where a cooperating corporation was required to produce emails that its executives had shared with co-defendants under a joint defense agreement, and those emails became the basis for a superseding indictment. Your personal counsel should insist on a "severable" joint defense agreement that allows you to opt out at any time without waiving privilege, and you should never share any information that you are not prepared to see in a government exhibit at trial.

Frequently Asked Questions