The Conventional Wisdom
You're hearing that the DOJ's expanded whistleblower rewards programs, announced May 12, 2025, for the Criminal Division and July 8, 2025, for the Antitrust Division, are a game-changer for corporate governance. The story is simple: improve your internal reporting channels, promote your whistleblower hotline, and you'll catch misconduct before the DOJ does. Self-disclosure under the revised Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) becomes your ticket to a declination.
It's an attractive narrative. The revised CEP even includes a flow chart showing the path to declination for companies that self-disclose, fully cooperate, remediate appropriately, and have no aggravating circumstances. Deputy Attorney General Todd Blanche's June 9, 2025, memorandum and Criminal Division head Matthew Galeotti's remarks make it clear: report early, cooperate fully, and you can avoid a criminal resolution.
Why This View Is Incomplete
Here's what's missing: your whistleblower program isn't a compliance program. It's a detection tool. If detection is your primary strategy, you've already lost.
The DOJ's new initiatives, offering whistleblowers between 15% and 30% of criminal fines or recoveries exceeding $1 million, reward information about existing misconduct, not prevention. The six priority areas for the Criminal Division's revised program (cartels, transnational criminal organizations, federal immigration law violations, material support of terrorism, sanctions offenses, trade and customs fraud, and procurement fraud) involve active criminal conduct.
When Galeotti mentioned receiving tips about drug trafficking, corruption, procurement fraud, and healthcare fraud, he wasn't describing prevention. He was talking about ongoing criminal activity detected by whistleblowers, not compliance programs.
The gap between detection and prevention matters because the CEP's benefits assume misconduct occurred. Even companies that self-disclose "in good faith" but not quickly enough receive a non-prosecution agreement with a term of fewer than three years and a 75% reduction in criminal fines. That's better than prosecution, but not as effective as having controls that prevent violations.
The Evidence
Consider what the revised CEP requires for a declination: voluntary self-disclosure, full cooperation, timely and appropriate remediation, and no aggravating circumstances. Three of these requirements apply after misconduct has happened. Only "no aggravating circumstances" relates to your control environment before the incident.
The CEP's requirement to assess "the effectiveness of the compliance program at the time of resolution" is telling. You're evaluated on how well you fixed the problem, not on whether your controls could have prevented it.
Look at the Antitrust Division's new program. Assistant Attorney General Abigail Slater said it aims to "break down walls of secrecy" around price-fixing and bid-rigging. This assumes collusion is happening and the best the DOJ can do is incentivize someone inside to reveal it. That's not a control framework, it's a surveillance framework.
The DOJ's focus on cartels and transnational criminal organizations underscores this. These aren't traditional control failures. They're deliberate criminal enterprises that your compliance training and code of conduct aren't designed to stop. A whistleblower hotline might surface them, but only after transactions have occurred.
What to Do Instead
Your whistleblower program should be your backstop, not your front line. Here's what should come first:
Design controls that prevent misconduct before decisions are made. Use segregation of duties in procurement, automated sanctions screening before payments, and vendor due diligence to flag suspicious ownership structures. These are preventive controls that make misconduct harder to execute.
Build your risk universe around the DOJ's priority areas. If your organization operates in supply chain, customs, or government contracting, map your exposure to trade fraud and procurement fraud. If you have international operations, assess your sanctions compliance posture beyond standard OFAC screening. Don't wait for a whistleblower to reveal your gaps.
Test your controls against realistic failure scenarios. What if a purchasing manager has a relationship with a vendor owned by a relative? What if a logistics coordinator is approached by a customs broker offering to "expedite" shipments? Your controls should catch these scenarios before they become reportable incidents.
When you receive a report, treat it as a control failure. Not just a conduct failure. Ask why your preventive controls didn't stop the behavior and why your detective controls (other than the whistleblower) didn't catch it earlier. The revised CEP's emphasis on "timely and appropriate remediation" should include control remediation, not just disciplinary action.
Use the CEP's self-disclosure framework strategically. If you discover misconduct through monitoring or audits, the clock starts immediately. The CEP distinguishes between timely self-disclosure and disclosure after the DOJ is already aware. Your incident response plan should include a decision tree for when to self-disclose, not just how.
When the Conventional Wisdom Is Right
The conventional wisdom isn't wrong about the importance of internal reporting channels. In large organizations, you can't monitor every transaction and relationship. Your employees will see things your controls can't catch.
The revised CEP's benefits are real and substantial. Companies that meet the core requirements will receive a declination, not a presumption of a declination. That's significant. Even companies with aggravating circumstances may still receive a declination depending on the severity and their cooperation. The DOJ has clarified the incentive structure.
If your organization operates in any of the Criminal Division's six priority areas or in markets susceptible to antitrust violations, a robust whistleblower program is essential. The financial incentives are high enough (15% to 30% of recoveries exceeding $1 million) that your employees will hear about them, whether you promote your internal channels or not.
The question isn't whether to have a whistleblower program. It's whether you're treating it as a substitute for a control environment that prevents misconduct. The DOJ's expanded programs will surface violations. Your job is to build controls that make violations less likely to occur.
