The Self-Disclosure Window Is Closing, and Most Programs Are Built to Miss It

The DOJ released its first-ever department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy on March 10, 2026. For companies weighing whether to self-disclose potential misconduct, the policy offers a clear benefit: no prosecution for those who disclose promptly, cooperate fully, and remediate. The question is whether most compliance programs are designed to use it.

The voluntary self-disclosure window is narrowing. Since the DOJ Whistleblower Awards Pilot Program launched in 2024, the department has received over 1,100 submissions. After the program’s expansion in May 2025, the referral rate climbed to 80 percent. At the same time, the DOJ is deploying data analytics tools: graph databases mapping entity relationships, AI detecting transaction anomalies, and predictive modeling flagging high-risk patterns. The government can now identify misconduct independently of tips. Companies that delay disclosure risk losing the window entirely.

The compliance design implication is structural. A program built around annual reviews or reactive triggers is not keeping pace with the government’s detection capabilities. The DOJ’s 2025 Year in Review confirmed increased use of proactive data analysis to develop investigations independently. DOJ detection capabilities are improving, and data analytics make it increasingly likely that the government will discover misconduct on its own. Proactive internal monitoring is no longer best practice. It is the minimum required to preserve the option to self-disclose.

There is also a critical operational detail most programs have not absorbed. The new policy preserves a 120-day safe harbor - even if an employee simultaneously files a whistleblower complaint with DOJ, the company can still avoid prosecution as long as it self-reports within 120 days of receiving that complaint. The clock starts the moment the complaint is received. Not when the investigation is complete. Not when the board has been briefed. A company that spends 90 days on an internal investigation before deciding whether to disclose has consumed most of that window before making a single disclosure decision.

The pattern I see most consistently is not companies that ignored compliance. It is companies whose programs were designed for a prior enforcement environment that no longer exists. The gap between what a compliance program can detect and what the DOJ can detect independently is where enforcement exposure now lives.

If your program still relies on reactive triggers to surface potential misconduct, that gap is worth examining before the DOJ closes it for you.