How an Export Control Voluntary Self-Disclosure Lawyer Can Protect Your Company from Criminal Prosecution

If your company has discovered a possible violation of U.S. export control regulations, a voluntary self-disclosure (VSD) submitted to the Department of Justice National Security Division can mean the difference between a non-prosecution agreement and a criminal indictment. Under the Corporate Enforcement and Voluntary Self-Disclosure Policy effective March 30, 2026, companies that disclose violations timely, cooperate fully, and remediate promptly receive a presumption of no prosecution and no fine—absent aggravating factors. Our legal team has guided multinational corporations, aerospace contractors, and technology exporters through voluntary self-disclosures across 19 jurisdictions, securing non-prosecution agreements for violations involving dual-use items under the Export Control Reform Act (ECRA) and defense articles under the Arms Export Control Act (AECA).

Voluntary Self-Disclosure (VSD)—a company’s proactive notification to the Department of Justice National Security Division that it has discovered potential criminal violations of U.S. export control or sanctions laws, submitted before the violation imminently comes to light by other means; the disclosure must include all relevant facts, identify individuals involved, and be accompanied by concurrent reporting to the appropriate regulatory agency (Bureau of Industry and Security, Directorate of Defense Trade Controls, or Office of Foreign Assets Control).

Key Takeaways

• The DOJ Corporate Enforcement and Voluntary Self-Disclosure Policy grants a presumption of non-prosecution and no fine for companies that voluntarily disclose export control violations before they come to light, fully cooperate, and timely remediate. Miss this window, and you’re exposed to criminal prosecution.
• All voluntary self-disclosures for potential criminal violations must now be submitted to [email protected] under the updated March 30, 2026 guidance. Concurrent reporting to Bureau of Industry and Security, Directorate of Defense Trade Controls, or Office of Foreign Assets Control is mandatory—not optional.
• Aggravating factors—including egregious misconduct, executive involvement, repeated violations, export of sensitive items, or significant profit—disqualify companies from presumptive non-prosecution and may result in deferred prosecution agreements or guilty pleas instead.
• A voluntary self-disclosure qualifies only if made before the violation imminently comes to light by other means. Once government inquiry begins or the media reports it, VSD benefits evaporate.
• Companies must provide all relevant facts including individuals involved. Attorney-client privilege applies only to internal investigation work product—not to the underlying facts themselves.

What Is a Voluntary Self-Disclosure for Export Control Violations?

A voluntary self-disclosure for export control violations is a company’s formal submission to the Department of Justice National Security Division reporting discovery of potential criminal violations of U.S. export control or sanctions laws. The submission must occur before the violation imminently comes to light by other means, include all relevant facts and individuals involved, and be made concurrently to both DOJ and the appropriate regulatory agency. Three primary statutes form the legal backbone here: the Arms Export Control Act (AECA), 22 U.S.C. § 2778, which regulates defense articles and services; the Export Control Reform Act (ECRA), 50 U.S.C. § 4801 et seq., controlling dual-use items with both commercial and military applications; and the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701 et seq., which provides statutory authority for economic sanctions enforcement.

The line between administrative and criminal violations determines whether you report to DOJ or stay within the regulatory agencies. Administrative violations—missing a required export license, misclassifying an item under Export Administration Regulations—stay with the Bureau of Industry and Security for dual-use goods or the Directorate of Defense Trade Controls for defense articles. Criminal violations involve willful conduct: knowing or reckless violations of export licensing, deliberately falsifying Shipper’s Export Declarations, systematic evasion of Export Control Classification Number requirements, or shipments to sanctioned end users when you knew the destination was prohibited. When your internal investigation uncovers facts suggesting willful violations—unlicensed exports of controlled items, false statements to regulators, shipments to denied parties—you’ve crossed into criminal territory. That’s when DOJ National Security Division at [email protected] becomes your filing destination.

The March 30, 2026 update unified previously separate VSD programs across DOJ divisions. All voluntary self-disclosures concerning potential criminal violations of U.S. national security laws—export controls under AECA and ECRA, sanctions under IEEPA—now follow department-wide procedures. You can’t submit disclosures using old standalone methods anymore. Every submission must comply with the three mandatory requirements of the Corporate Enforcement and Voluntary Self-Disclosure Policy while maintaining concurrent reporting to your regulatory agency.

When Should a Company Make a Voluntary Self-Disclosure?

Submit a voluntary self-disclosure when your internal investigation confirms potential criminal export control violations and you can still meet the three mandatory VSD requirements. First: disclose before the violation imminently comes to light by other means. That means before any government inquiry, media reporting, or third-party notification that would alert authorities. Second: report timely to the Criminal Enforcement Section of DOJ National Security Division and the appropriate regulatory agency after discovering the violation. Third: disclose all relevant facts, including complete identification of individuals involved, without withholding information to reduce apparent culpability.

Timeline matters enormously. You must start your internal investigation immediately upon discovering red flags—audit findings showing exports to high-risk jurisdictions, whistleblower complaints about licensing shortcuts, compliance reviews revealing systematic Export Control Classification Number misclassifications. Then complete your investigation efficiently enough to understand the scope and nature of violations, identify the individuals involved, and assess whether aggravating factors exist. Delays that allow violations to continue, destruction of evidence, or investigations dragging on for months without good reason undermine the “timely” requirement. Once your investigation reaches sufficient maturity to give DOJ a complete factual narrative, submit the voluntary self-disclosure promptly—typically within weeks of confirming criminal exposure, not months. The longer you wait, the greater the risk that someone else discovers the violation first.

Risk assessment factors help determine whether you face criminal exposure requiring DOJ disclosure or merely administrative violations handled by Bureau of Industry and Security, Directorate of Defense Trade Controls, or Office of Foreign Assets Control. Criminal exposure surfaces when: exports were made with knowledge no license existed or the license application contained false statements; patterns of violations suggest deliberate compliance failures rather than isolated mistakes; senior management or compliance personnel authorized unlicensed exports; shell companies, freight forwarders, or transshipment routes were used to conceal the true end user or destination; particularly sensitive items—military technology, encryption software, Commerce Control List Category 0 (nuclear) or Category 1 (materials and chemicals) items—went to countries of concern including China, Russia, Iran, North Korea, or Syria; and significant transaction values indicate the violations generated substantial revenue or cost savings. When multiple indicators converge, criminal prosecution becomes likely without a voluntary self-disclosure.

What Are the Benefits of Making a Voluntary Self-Disclosure for Export Control Violations?

The primary benefit is a presumption of a non-prosecution agreement with no criminal fine. Under the DOJ’s December 13, 2019 VSD Policy for export control and sanctions violations—now incorporated into the March 30, 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy—companies that voluntarily disclose violations before they come to light, fully cooperate throughout the investigation, and timely remediate receive presumptive non-prosecution treatment absent aggravating factors. You avoid criminal conviction, eliminate the collateral consequences of a corporate guilty plea (including mandatory debarment from government contracting), and preserve reputation and business relationships. Without a voluntary self-disclosure, companies discovered through government investigation or third-party reporting face deferred prosecution agreements with substantial fines, guilty pleas with criminal penalties reaching tens of millions of dollars, and court-ordered compliance monitors.

A comparison of enforcement outcomes reveals why voluntary self-disclosure matters. Non-prosecution agreements impose no criminal fine, require compliance enhancements and cooperation, but result in no criminal conviction—typically lasting 18-24 months with minimal DOJ oversight. Deferred prosecution agreements acknowledge criminal conduct. They impose fines calculated as a percentage of transaction value or illicit profit, require independent compliance monitors for 2-3 years, and leave the company with a deferred conviction that becomes final if breached. Guilty pleas result in criminal convictions, criminal fines that can reach statutory maximums, mandatory exclusion from export privileges, and permanent reputational harm. The progression from non-prosecution to deferred prosecution to guilty plea typically reflects either aggravating factors or the company’s failure to disclose before the violation surfaced.

Full cooperation and timely remediation unlock maximum leniency. Full cooperation means providing DOJ with all relevant facts, making witnesses available for interviews without subpoenas, producing documents and communications showing how violations occurred and who was involved, and preserving evidence without destruction. Timely remediation requires implementing enhanced compliance measures before DOJ concludes its investigation: revising export control procedures, enhancing screening protocols for denied parties and sanctioned destinations, providing targeted training for personnel involved in licensing and classification, disciplining or terminating individuals responsible for willful violations, and conducting lookback audits to identify unreported violations. When companies satisfy these requirements, they demonstrate they’ve addressed root causes and pose minimal risk of future misconduct.

The crediting mechanism extends voluntary self-disclosure benefits across parallel administrative proceedings. When a company reports an export control violation concurrently to DOJ and the appropriate regulatory agency, the agency credits that disclosure in calculating civil penalties. Bureau of Industry and Security reduces base penalty amounts by 25-50% for voluntary self-disclosures made before the agency becomes aware of violations. Directorate of Defense Trade Controls applies similar mitigation for ITAR violations. Here’s the practical result: a company obtains leniency in both the criminal enforcement action (non-prosecution agreement) and the administrative enforcement action (reduced civil penalties), substantially lowering total financial and operational consequences.

If your company has discovered potential export control violations involving dual-use technology, defense articles, or exports to sanctioned jurisdictions, our export control regulations legal team can conduct a privileged assessment, guide your voluntary self-disclosure strategy, and coordinate reporting to DOJ and regulatory agencies.

What Is a Non-Prosecution Agreement in Export Control Cases?

A non-prosecution agreement in export control cases is a written agreement between the Department of Justice National Security Division and a company in which DOJ agrees not to prosecute disclosed violations in exchange for continued cooperation, compliance enhancements, and adherence to specific conditions. The legal structure differs fundamentally from deferred prosecution agreements: DOJ files no criminal charges, no information or indictment is filed with any court, and the agreement requires no judicial approval or supervision. The agreement typically recites the facts of violations, acknowledges that conduct could support criminal charges, states that the company voluntarily disclosed and cooperated, and sets forth conditions for DOJ to decline prosecution permanently.

Voluntary Self-Disclosure Process Timeline and Key Milestones

The timeline from violation discovery through resolution spans roughly 10-18 months, though individual cases vary considerably. Understanding each phase helps you anticipate costs, manage board expectations, and avoid procedural missteps that could forfeit DOJ leniency.

Discovery and Initial Response (Days 1-14)

Violation discovery often comes through internal audits, compliance reviews, whistleblower reports, or due diligence during mergers and acquisitions. Immediately preserve all relevant documents and data—failure to do so invites spoliation charges and may undermine your voluntary disclosure credibility. Notify senior management and the board’s audit committee without delay. Retain outside counsel to conduct a privileged investigation. Most companies complete this phase in 7-14 days.

Internal Investigation (Weeks 2-12)

Outside counsel determines the scope of violations, criminal exposure level, and whether aggravating factors exist. This means interviewing witnesses, reviewing transaction documents, analyzing items against Export Control Classification Numbers, screening parties against sanctions lists, and assessing compliance program deficiencies. The VSD Policy requires “timely” disclosure after internal discovery—so speed matters. Focused investigations typically take 4-8 weeks; complex matters involving thousands of transactions or multiple business units may require longer. If investigation reveals criminal exposure, you must decide whether to voluntarily self-disclose or seek administrative resolution with BIS, DDTC, or OFAC only.

Disclosure Preparation and Submission (Weeks 13-15)

Draft the factual narrative, organize supporting documentation, prepare concurrent disclosures to regulatory agencies, and submit to [email protected]. Outside counsel submits the disclosure electronically with a cover letter identifying the company, describing violations, and requesting a meeting with DOJ Criminal Enforcement Section. Submit concurrent disclosures to the appropriate regulatory agency within days of the DOJ submission—this satisfies VSD Policy requirements and prevents gaps in coverage. Plan 2-3 weeks for comprehensive submissions meeting the “all relevant facts” standard.

DOJ Investigation (Months 3-9)

Criminal Enforcement Section acknowledges the disclosure and assigns prosecutors. They review your submission, identify information gaps, request supplemental document productions, schedule witness interviews, and consult with BIS, DDTC, or OFAC. You must respond promptly to information requests and provide witnesses without requiring subpoenas. Update DOJ on remediation progress. Duration varies—typically 6-18 months—because DOJ controls the investigation pace and complexity matters. A straightforward violation may resolve in six months; multi-subsidiary schemes may take two years.

Resolution and Agreement Execution (Months 9-13)

DOJ concludes investigation and determines enforcement outcome. For qualifying voluntary self-disclosures without aggravating factors, prosecutors negotiate a non-prosecution agreement with cooperation and remediation conditions. Cases involving aggravating factors may yield deferred prosecution agreements with criminal fines and compliance monitors. Review proposed agreement terms, negotiate modifications if possible, and execute the final agreement. Public announcement may follow if violations are significant or legally novel. Expect 4-8 weeks from initial discussions to executed agreement.

Post-Resolution Monitoring (Months 13-30+)

Comply with non-prosecution agreement or deferred prosecution agreement terms for the specified duration—typically 18-24 months for NPAs, 24-36 months for DPAs. You must certify compliance periodically, report any newly discovered violations, cooperate with ongoing regulatory enforcement by BIS, DDTC, or OFAC, and permit DOJ verification if requested. Successful completion without breaches results in DOJ declining prosecution permanently for the disclosed violations.

Why Choose Our Export Control Voluntary Self-Disclosure Legal Team?

Our export control voluntary self-disclosure legal team has represented multinational corporations, defense contractors, technology exporters, and aerospace manufacturers in voluntary self-disclosures to DOJ National Security Division across 19 jurisdictions spanning North America, Europe, and Asia-Pacific. We have secured non-prosecution agreements for violations involving dual-use technology exports to China, defense articles shipments to Middle East end users, encryption