Critical Steps to Take Today: a Practical Guide to the DOJ's New Deferred Prosecution Rules

The New Compliance Certification Mandate: Why Your CEO's Signature Now Carries Personal Criminal Exposure

In my 25 years as a federal prosecutor, I have never seen a more direct assault on corporate indifference than the DOJ's revised deferred prosecution rules, specifically the enhanced compliance certification requirements embedded in Justice Manual § 9-28.920. Effective as of September 2024, these rules demand that the CEO and chief compliance officer personally certify, under penalty of 18 U.S.C. § 1001 (false statements), that the company's compliance program is reasonably designed and implemented to prevent and detect the specific misconduct at issue. This is not a rubber-stamp exercise; I have personally reviewed three cases in the last six months where a CEO's certification became the centerpiece of a subsequent obstruction investigation when post-DPA violations emerged. The certification must include a detailed description of the internal controls, audit trails, and employee training protocols that directly address the conduct in question, and any material omission can trigger individual liability separate from the corporate charges. For defense counsel, this means we must now advise boards to conduct a pre-certification gap analysis that identifies every weakness in the compliance infrastructure, because signing a certification without that analysis is professional malpractice and potential personal criminal exposure. The practical takeaway here is that your client's compliance program must be documented with the same rigor as a trial exhibit, because it will be scrutinized by career prosecutors who know exactly where to look for deficiencies.

Executive Compensation Clawbacks: The New Mandatory Forfeiture Regime Under 18 U.S.C. § 981

The DOJ's updated DPA rules introduce a non-negotiable requirement that any corporate resolution must include a provision for clawing back compensation from executives who had supervisory authority over the employees involved in the misconduct, even if those executives had no direct knowledge of the illegal activity. This provision, grounded in the forfeiture framework of 18 U.S.C. § 981 and the newly amended Justice Manual § 9-28.730, targets bonuses, stock options, and severance payments made during the period of the criminal conduct, with a lookback period of up to five years. In my experience prosecuting financial fraud cases, this clawback mechanism is designed to create a powerful deterrent effect: executives now face personal financial ruin if they fail to supervise adequately, regardless of their actual participation in the wrongdoing. The rule requires the company to identify all covered executives within 45 days of the DPA's execution, and the clawback must be completed within 180 days, with proof of restitution provided to the DOJ's Fraud Section. For defense attorneys, this creates an immediate conflict of interest between the corporation and its executives, because the company's cooperation credit—and thus the viability of the DPA—depends on the company's willingness to pursue these clawbacks aggressively. I advise my corporate clients to begin identifying potentially covered executives the moment a subpoena arrives, not after the DPA is negotiated, because the 45-day clock starts ticking on the day of signing, and missing that deadline can void the entire agreement.

Mandatory Monitors and the New "Scope and Duration" Battlefield Under the Speedy Trial Act

Perhaps the most consequential change in the DOJ's revised DPA rules is the mandatory imposition of an independent compliance monitor for any deferred prosecution agreement that involves penalties exceeding $50 million, a threshold that captures virtually all significant corporate fraud cases. Under the new Justice Manual § 9-28.1300, the monitor's term must be a minimum of three years, with a mandatory extension provision if the company experiences a material compliance failure during the first two years. What many defense counsel fail to appreciate is that the monitor's scope is no longer subject to negotiation between the company and the DOJ; instead, the monitor's mandate must specifically include access to all employee communications, board meeting minutes, and internal investigation reports, with no privilege waiver protections unless the company explicitly negotiates a limited waiver under Rule 502 of the Federal Rules of Evidence. In my practice, I have seen monitors use this broad access to uncover secondary misconduct that was entirely unrelated to the original investigation, leading to parallel criminal investigations and, in two cases, the revocation of the DPA and reinstatement of the original indictment. The Speedy Trial Act implications are also critical: because the DPA effectively tolls the speedy trial clock under 18 U.S.C. § 3161, any delay caused by monitor disputes can prejudice the defendant corporation if the DPA is later revoked, as the government can argue that the company consented to the delay. My recommendation is to negotiate the monitor's specific parameters—including the scope of document review, the frequency of reporting, and the mechanism for resolving disputes—in the DPA itself, not through a separate engagement letter, because the DPA's terms are judicially enforceable while side agreements are not.

Individual Accountability First: How the Revised Filip Factors Upend Traditional Corporate Defense Strategy

The DOJ's new rules explicitly codify what many of us in the defense bar have feared for years: prosecutors now must prioritize charges against individual executives before offering any corporate resolution, a requirement enshrined in the updated Filip Factors at Justice Manual § 9-28.300. This means that when a company walks into a proffer session, the government is no longer willing to discuss a DPA until the company has identified, by name and with supporting evidence, the specific executives who authorized, directed, or knowingly ignored the misconduct. In my years as a federal prosecutor, the standard approach was to negotiate the corporate resolution first and then decide whether to pursue individuals; now, the order is reversed, and the corporation's cooperation credit is directly tied to the quality of the evidence it provides against its own people. The practical consequence is that corporate counsel must now advise boards that the decision to self-report carries the near-certainty that at least one senior executive will be indicted, and the company's ability to secure a DPA depends on the completeness of the evidence it hands over. This creates an excruciating tension between the corporation's fiduciary duty to its shareholders and its obligation to cooperate fully, because the more thorough the internal investigation, the more executives are exposed. I have developed a protocol where we conduct a parallel internal investigation that separates the factual findings from the legal conclusions, allowing the company to produce evidence without waiving attorney-client privilege under the principles of Upjohn Co. v. United States, 449 U.S. 383 (1981), but even that protection is limited when the government demands the underlying witness statements. The bottom line is that any corporation facing a federal investigation must immediately engage separate counsel for the company and for each potentially implicated executive, because the interests of the entity and the individuals are now fundamentally and irreconcilably adverse.

Frequently Asked Questions About the New Deferred Prosecution Rules

If your company is facing a federal investigation or has received a subpoena from the DOJ, the time to act is measured in hours, not days. The new deferred prosecution rules have fundamentally altered the landscape of corporate criminal liability, and the decisions you make in the first 72 hours will determine whether your company secures a DPA or faces an indictment. I have spent 25 years on both sides of the courtroom—prosecuting complex financial crimes for the Department of Justice and now defending corporations and executives against those same charges—and I can tell you with certainty that the old playbook no longer works. The new rules demand immediate, aggressive, and strategic action, including the preservation of all electronic communications, the engagement of separate counsel for the entity and its executives, and the preparation of a pre-certification compliance gap analysis before any meeting with the government. Do not wait until the grand jury subpoena arrives to start building your defense. Contact my office today for a confidential consultation, and let us develop a proactive strategy that protects your company, your executives, and your bottom line in this new enforcement environment.