4 Practical Tips for Complying With Monaco Memo

In September 2022, the Deputy Attorney General Lisa Monaco issued a memo describing revisions to the DOJ’s corporate enforcement policy — the Monaco memo, as it’s come to be known. The memo signaled a shift in the DOJ’s expectations for corporate cooperation, incorporating the work of the DOJ’s recently formed corporate crime advisory group, which has been tasked with strengthening criminal enforcement “with respect to individual accountability, the treatment of a corporation’s prior misconduct and the use of corporate monitors.”

Taken as a whole, the Monaco memo foretells of a more rigorous approach to corporate criminal enforcement, including that the DOJ expects investigations to take place at a more rapid pace. To accomplish that, Monaco has emphasized the importance of speed in cooperation, stating, among other things, that “to receive full cooperation credit, corporations must produce on a timely basis.” Corporations are expected not only to avoid contributing to delays in disclosure of relevant facts but also to find ways to affirmatively assist the DOJ in moving an investigation along more quickly in order to receive full cooperation credit. If a corporation decides to cooperate with a DOJ investigation, it should be prepared to cooperate fully and speedily.

Here are four practical tips for how corporate counsel can be so prepared:

Be ready to organize and produce information on individuals

Under the new guidance, corporations are expected to identify to prosecutors, in a “timely manner,” any individuals that participated in corporate misconduct. Disclosure of individual participation and individual data is a factor in whether a corporation will receive cooperation credit. As a result, corporations will be expected to produce information about individuals at the beginning of an investigation. Moving at such a rapid pace will require corporations to make quick decisions about disclosures while still gathering facts about the underlying conduct.

The DOJ will positively evaluate:

• Disclosure of individual participation in misconduct early and often.
• Disclosure during an investigation, even before a full factual record has been collected.
• Retention and disclosure of individual’s information related to misconduct.

Uncertainty remains regarding how much benefit a corporation will receive from prioritizing disclosure of individuals and information related thereto. Likewise, how quickly corporations are expected to disclose to meet the expectations of producing on a “timely basis” is still unclear under the Monaco memo. Regardless, it is in a cooperating corporation’s best interest to report on and about individuals who have potentially participated in the investigated misconduct, as such disclosure is identified as “the clearest path for a company to avoid a guilty plea or an indictment.”

Thus, a cooperating corporation should, for example, prioritize providing the DOJ with organizational charts that identify individuals involved in the investigated conduct, the electronic communications of such individuals, HR history of such individuals and debriefings on interviews related to such individuals. Organizing information provided to the DOJ on an individual-by-individual basis, even if duplicative, should be considered and discussed with the DOJ.

Review and consider revisions to compensation agreements

The Monaco memo identified a corporation’s compensation structure as a key area in prosecutors’ assessment of a corporate compliance program. The new guidance stated that the DOJ will now evaluate corporate compensation policies to determine whether a compliance program is effective in preventing misconduct. An effective compliance program is one factor in the DOJ’s determination as to whether to prosecute a corporation (and the recent update to the DOJ’s corporate enforcement policy further solidifies this). The Monaco memo instructs prosecutors to look for, “[c]ompensation systems that clearly and effectively impose financial penalties for misconduct” because such systems “can incentivize compliant conduct, deter risky behavior, and instill a corporate culture in which employees follow the law and avoid legal ‘gray’ areas.”

The DOJ will look favorably on corporate compensation policies that contain:

• Both incentives for compliant behavior and penalties for misconduct.
• The inclusion of compliance behaviors in performance reviews.
• Compensation clawback provisions.
• Options for “retroactive discipline” of former employees, executives, or directors who contributed to misconduct, such as partial escrowing of compensation or similar arrangements.

Prosecutors are instructed to examine the implementation of corporate compensation policies, not just policies on paper. Prosecutors will consider whether opportunities to reward compliant behavior or penalize misconduct were taken by the company. These factors in evaluating the corporate compliance programs and compensation structures can directly affect the prosecutor’s recommendation, including whether a compliance monitor is recommended.

Corporations should work with HR teams to incorporate reviews of compliance behavior in performance reviews for all levels of employees. Corporations should be ready to quickly produce evidence of how compensation policies are implemented. For example, corporations can produce evidence of imposing consequences in performance reviews for employees who demonstrate non-compliant behavior. Evidence of consistent application of a corporate compensation policy will be key to demonstrating that the policy is intended to deter misconduct. Considerations regarding revisions to employment agreements should be carefully undertaken.

Have in place ephemeral and encrypted messaging policies

In addition to corporate compensation structures, the memo stated that the DOJ will now carefully examine corporate policies governing the use of personal devices and third-party messaging applications. In particular, the DOJ is concerned with the use of ephemeral and encrypted messaging applications that pose substantial challenges during the recovery of data in investigations.

The Monaco memo instructs prosecutors to evaluate whether a corporate device policy is “effective” at ensuring that “business-related electronic data and communications are preserved.” In a recent speech, Acting Principal Deputy Assistant Attorney General Nicole M. Argentieri explained that cooperation credit is available for corporations that have and effectively implement policies prohibiting the “deletion of business records” regardless of whether those communications are on personal devices.

The DOJ would look favorably on corporate policies that:

• Prohibit deleting business records from personal devices and third-party applications.
• Frequently reevaluate ephemeral data preservation.
• Ensure a corporation’s ability to access encrypted communications when necessary.

Additional guidance on ephemeral and encrypted data retention, use of personal devices and use of third-party applications is expected from the Criminal Division in the next iteration of the Evaluation of Corporate Compliance Programs.

In the meantime, a corporation should have clear, thorough documentation of their data retention policies ready to be shared with the DOJ. A corporation should be able to readily access preserved data. Corporations should work with vendors to review how data will be accessed if needed. The DOJ will expect to quickly review corporate policies shared with employees on retention of business records and use of third-party applications, and evidence that the company regularly reviews employee compliance with the policies.

Be ready to quickly produce evidence of existence and effectiveness of the corporation’s compliance program

An “effective” compliance program can be a significant mitigating factor in an investigation’s resolution. Prosecutors are directed to equally evaluate two time periods of corporate compliance: (1) compliance at the time of the offense being investigated and (2) compliance at the time the DOJ makes its charging decision.

The DOJ will assess whether a corporate compliance program was in existence and well implemented at the time of the conduct in question. The Monaco memo emphasizes evaluating whether a compliance program is effective as implemented. “Prosecutors should consider, among other factors, whether the corporation’s compliance program is well designed, adequately resourced, empowered to function effectively, and working in practice.”

As a part of assessing the compliance system at the time of the conduct, the DOJ will review how the company identified compliance risks, monitored vendors and partners for suspicious activity, and supervised human resources decision making. The DOJ is now placing significant emphasis on data analytics use in compliance. The role of corporate culture in encouraging misconduct will be evaluated as well. The DOJ expects the review of the compliance program to occur alongside, not after, the investigation of the alleged misconduct.

The DOJ will positively evaluate corporate compliance programs that:

• Encourage compliant behavior and internal reporting.
• Demonstrate the commitment of senior leadership to compliance.
• Are well-funded and staffed.
• Are authorized to make efficient and effective disciplinary decisions.
• Closely monitor vendors, suppliers and partners for suspicious transactions.

A corporation should be ready to demonstrate the details and efficacy of its compliance program, including through data, at the outset of an investigation. Given the emphasis on speedy cooperation, a corporation should have documentation detailing their compliance program in place and ready to be produced. Particular emphasis should be placed on data demonstrating the efficacy of the compliance program, not just anecdotal evidence. Internal statements from senior leadership encouraging compliance with specific portions of the program would be beneficial as well to evidence the proper tone from the top.  

Final takeaways

The Monaco memo commits the DOJ to faster-paced investigations, which will be facilitated in large part by requiring proactive cooperation to receive credit. Corporate compensation structures that promote compliant behavior and penalize misconduct, as well as robust ephemeral and encrypted data retention policies will be key in obtaining full cooperation credit under the Monaco memo guidance.