Better Late Than Never: DOJ’s National Security Division Resolves First “Near Miss” Self-Disclosure Under Department-wide Corporate Enforcement Policy

On October 8, 2026, the U.S. Department of Justice (DOJ) publicly released Directive 26-13, A Comprehensive Approach in the Fight Against Fraud (the Directive). Assistant Attorney General Colin M. McDonald issued the Directive on October 7 to all personnel of the National Fraud Enforcement Division (the Fraud Division). The Directive instructs Fraud Division prosecutors to look beyond traditional fraud charges in every case and to consider whether the same conduct also supports tax, securities, or consumer fraud charges; to move against proceeds, accounts, and websites early, often before any indictment; to recruit cooperating insiders; and to press for stronger sentences.

The Directive expands on the Fraud Division’s August 13 enforcement priorities and its corporate enforcement policy (Directive 26-12), discussed by Sidley here and here. Those earlier documents identified what the Division would pursue. This latest Directive sets forth how the Fraud Division expects prosecutors to pursue it. For companies involved in government contracting, health care, tax, and trade, a fraud inquiry could quickly proceed on multiple legal theories at once. It may also involve enforcement steps, such as freezing bank accounts or seizing websites, domains, and online accounts allegedly used in the fraud, that affect business operations before charges are filed. Companies should therefore assess exposure and plan for potential pre-charge enforcement activity, and revisit self-disclosure timing in light of DOJ’s expanded detection efforts.

Directive 26-13: What’s New and What’s Not

The Directive does not create new criminal offenses or new corporate enforcement standards. Its approach to corporate enforcement expressly carries forward Directive 26-12, under which the Corporate Enforcement Section leads corporate matters and companies that disclose misconduct, cooperate, and remediate receive appropriate credit. Nor does the Directive expand the Division’s legal authority. The Attorney General had already delegated to the Fraud Division, in regulations codified at 28 C.F.R. § 0.70, broad authority to bring fraud-related charges, seek injunctions under 18 U.S.C. § 1345, and seize or forfeit property. The Directive also states that it creates no rights enforceable by any party.

What is new is how Fraud Division prosecutors are expected to use those existing authorities in individual cases. The Directive converts general priorities into case-level instructions: steps prosecutors must take in every matter, specialists they must involve, and remedies they should pursue at the outset rather than at resolution. In that sense, the Directive is less a new playbook than an effort to ensure consistent use across the Fraud Division of tools that DOJ fraud prosecutors have relied on for years. For example, DOJ has long used 18 U.S.C. § 1345, the civil anti-fraud injunction statute, to obtain temporary restraining orders and preliminary and permanent injunctions to halt ongoing fraud schemes without bond. The Directive now asks Fraud Division prosecutors to consider § 1345 and other remedies systematically rather than case by case. We discuss the Directive’s principal instructions below.

Broader Charging Strategies

The Directive reminds prosecutors that charging decisions should ordinarily include “the most serious offense” encompassed by the conduct that is likely to result in a sustainable conviction. Wire fraud, health care fraud, and major fraud against the United States will often suffice. In other cases, however, the Directive contemplates additional charges to dismantle schemes, maximize recoveries, and tell “the full story” of the misconduct. It identifies three categories:

• Tax offenses. Prosecutors must assess in every case whether there is reason to believe that the internal revenue laws have been violated. The Directive reasons that fraudsters rarely report or pay tax on fraudulent income, which creates both additional charges and additional avenues for recovery. Where tax charges may materially advance the investigation, prosecution, or recovery of assets, prosecutors should invite IRS Criminal Investigation (IRS-CI) to evaluate the conduct. If IRS-CI joins, prosecutors will work with the Division’s Tax Section to bring appropriate charges. The Directive therefore requires the assessment in every case, not tax charges in every case.
• Securities fraud. The Directive targets companies that receive federal funds or approvals and, while defrauding the government, also mislead investors. Its examples include a publicly traded government contractor whose misstatements harm both the government and investors who rely on its financial statements, and health care fraud concealed from the investing public. The Public Trust and Financial Integrity Section will prioritize securities fraud and market misconduct tied to:
  • government programs or contracts;
  • schemes to defraud the United States;
  • foreign investment schemes targeting the federal government;
  • schemes targeting U.S. service members; and
  • health care, tax, or trade fraud.
  • To identify these matters, the Section will correlate federal program, contract, and funding data against market activity, for example by comparing a contractor’s award or payment history with trading in its securities. DOJ describes this step as intended to generate matters proactively rather than wait for referrals. The Directive also preserves Main Justice’s longstanding coordination with U.S. Attorneys’ Offices on securities matters.
• Consumer fraud and cybercrime. Prosecutors should also evaluate consumer-focused charges, including mail, wire, and bank fraud, identity theft, and access-device offenses. The priorities include scams involving government programs or contracts; health care, consumer products, medical devices, or pharmaceuticals; service members; and schemes to defraud the United States. Prosecutors are directed to coordinate, as permitted by law, with investigative, civil, and regulatory partners to stop ongoing harm and pursue available remedies.

Asset Recovery Before Indictment

The Directive places particular emphasis on early seizure of proceeds and early disruption of ongoing schemes. Prosecutors must coordinate with the Fraud Division’s Asset Recovery Section at all stages of investigations and prosecutions. The listed measures include:

• warrants to seize websites, domains, online accounts, and other digital property used to commit fraud or conceal its proceeds.:
• restraining orders or seizure letters to freeze assets at banks and cryptocurrency exchanges shortly after they are stolen;
• warrants and in rem forfeiture proceedings to seize proceeds before criminal charges; and
• warrants to seize websites, domains, online accounts, and other digital property used to commit fraud or conceal its proceeds.

The Directive also calls for civil actions to obtain injunctions and asset restraints under 18 U.S.C. § 1345 for government fraud, banking law violations, and health care offenses. It further calls for prejudgment remedies under 28 U.S.C. §§ 3101–3105, such as attachment, garnishment, and receiverships, for any offense. These measures remain subject to the governing statutory requirements.

Proactive Cooperators

The Directive instructs prosecutors to use proactive cooperators and undercover law enforcement operations to identify and dismantle fraud networks. In evaluating cooperation, prosecutors will consider whether the cooperator disclosed criminal activity previously unknown to law enforcement. They will also consider whether the cooperation materially advanced an investigation, the seizure of proceeds, the conviction of others, or the disruption of ongoing harm.

Cooperators must fully and truthfully accept responsibility, including forfeiting property tied to their offenses of conviction and paying restitution to their victims. The Directive states that cooperators “will not get a free pass,” although prosecutors may bring substantial assistance to the sentencing court’s attention when appropriate.

Arrest, Detention, and Sentencing

The Directive ties its detention guidance to recent experience, noting that “[v]arious charged fraud defendants have fled the United States in recent years.” Prosecutors are therefore directed to assess flight risk and danger early and throughout a case. To do so, they should develop a record of the defendant’s means, ties, travel, access to assets, history of violence, and risk of obstruction. They should seek arrest warrants and detention “in all appropriate circumstances” and move promptly to modify or revoke release when conditions are violated. These are existing legal tools. What the Directive changes is the expectation that prosecutors will consider them systematically, at the outset of fraud cases, rather than case by case.

At sentencing, every presentation must address general deterrence. Prosecutors should seek all Guidelines enhancements supported by the facts and law, oppose unwarranted reductions, and seek approval for an upward variance or departure when the advisory range is inadequate. They should also pursue restitution, forfeiture, and fines reflecting the full scope of the offense. Where a sentence appears unreasonable, they should consult the Appellate Section about an appeal.

Key Takeaways

• Assess exposure across legal disciplines. A government contracting, health care, or trade issue may also raise questions about tax treatment, investor disclosures, or consumer representations. Companies should coordinate legal, compliance, tax, and finance reviews rather than assess each issue in isolation. The Directive’s focus on persons and entities that knowingly enable, facilitate, conceal, or profit from fraud also supports examining relevant third-party relationships.
• Plan for enforcement action before charges. Prosecutors are directed to freeze bank and cryptocurrency accounts and seize websites and domains early. A company could therefore lose access to funds or online operations before it knows the scope of an investigation. Assessing that risk should be part of the initial response to any fraud inquiry, not deferred until resolution discussions. Companies in the Directive’s priority sectors should consider identifying in advance:
  • who will respond to a seizure warrant or restraining order;
  • how critical accounts and systems would be maintained; and
  • how quickly counsel can evaluate the legal basis for a restraint and seek to narrow it.
• Expect asset restraint to feature more prominently, and test it. Because prosecutors must involve the Asset Recovery Section at all stages, pretrial restraint of alleged proceeds may become more common where the facts support it. Counsel should assess whether, and on what theory, prosecutors presented forfeiture allegations to the grand jury and should be prepared to test the government’s tracing of restrained assets to the charged conduct.
• Directive 26-13’s investigative methods may narrow the window for voluntary self-disclosure. Three of the investigative methods in the Directive—proactive data correlation, cooperators, and undercover operations—are designed to find misconduct before a company reports it. That timing matters because Directive 26-12—and DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP)—credit companies that voluntarily disclose misconduct, cooperate, and remediate. Credit for voluntary self-disclosure, however, generally depends on the company reporting first and may not be available where DOJ discovers the misconduct on its own. Companies should therefore investigate credible allegations promptly and decide on disclosure early, rather than waiting for a complete internal record.

Directive 26-13 is available here, and DOJ’s press release is available here.