Veloxis Pharmaceuticals, the maker of the kidney transplant immunosuppression drug Envarsus XR, has agreed to pay more than $46 million and submit to years of enhanced compliance oversight to resolve civil and criminal allegations that the company ran a sustained kickback scheme to drive prescriptions of its drug. This case is worth a close read for compliance officers well beyond the pharmaceutical industry, because it’s one of the clearer real-world applications we’ve seen of DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, and it shows exactly what that policy can offer a company willing to cooperate, even when the underlying conduct reached the CEO’s office.

The Scheme

According to the deferred prosecution agreement DOJ filed, Veloxis ran an aggressive marketing campaign from January 2016 through June 2023 built around paying kickbacks to the physicians who could drive prescriptions of Envarsus. Surgeons, nephrologists, nurse practitioners, pharmacists, and hospital administrators received lavish meals, alcohol, expensive trips, resort stays, gifts, and payments structured as consulting fees, all designed to influence prescribing decisions for Medicare and Medicaid patients. Separately, from July 2017 through April 2023, Veloxis paid per-patient and per-month kickbacks directly to pharmacies to induce them to stock and dispense the drug.

What makes this case particularly serious from an enforcement perspective is where the conduct originated. According to the DPA, the company’s former chief executive officer, along with its former president of sales and former vice president of market access, directed and oversaw significant portions of these payment schemes. This wasn’t a rogue regional sales team operating outside leadership’s knowledge. The DPA describes conduct orchestrated at the highest levels of the organization, which is exactly the kind of fact pattern that typically pushes DOJ toward the harshest available resolution, criminal prosecution of the corporate entity itself.

Veloxis also concealed the conduct through its own books and records, falsifying expense reports and mischaracterizing kickback payments as legitimate consulting fees. And the company failed to report required payments to CMS under the Open Payments Program, commonly known as the Sunshine Act, the federal transparency regime requiring drug and device manufacturers to publicly disclose payments made to physicians and teaching hospitals.

Why Veloxis Avoided Prosecution Despite Executive-Level Misconduct

Here’s where this case becomes genuinely instructive rather than just another kickback settlement. DOJ brought a criminal charge against Veloxis for conspiracy to violate the federal Anti-Kickback Statute. Despite that charge, and despite the involvement of the company’s own former CEO in directing the conduct, DOJ did not prosecute Veloxis. Instead, the company entered into a deferred prosecution agreement under DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, the CEP framework the department released earlier this year.

Under the DPA, Veloxis was required to formally admit guilt, a meaningful concession that distinguishes this resolution from a typical no-admission settlement. But the company received real credit for what it did after the conduct came to light: disclosing relevant facts to DOJ, cooperating with the investigation, and undertaking genuine remediation, including identifying the individuals responsible for the illegal conduct, up to and including its own former CEO, and terminating them. That combination of disclosure, cooperation, and remediation is precisely the formula the CEP is designed to reward, and this case demonstrates that DOJ will extend that reward even when the underlying conduct implicates the C-suite, provided the company’s post-discovery response meets the bar.

The Financial Terms

The total resolution runs to more than $46 million across several components. Veloxis agreed to pay $34.5 million to settle the civil Anti-Kickback Statute allegations, which originated from a whistleblower complaint filed in the District of Massachusetts back in 2020, with DOJ intervening on the civil side in June of this year. On the criminal side, Veloxis paid a $10 million penalty under the DPA. And separately, the company paid $1.55 million to CMS to resolve allegations that it knowingly failed to make required disclosures under the Sunshine Act, which DOJ identified as the largest Sunshine Act payment since that reporting program launched in 2010.

As U.S. Attorney Leah Foley put it in DOJ’s announcement, the core problem with this conduct is straightforward: medical treatment decisions need to be driven by what’s best for the patient, not by what a drug manufacturer can offer in the form of a lavish meal or a resort stay. That framing captures exactly why kickback enforcement in the pharmaceutical space carries such consistent DOJ priority. It’s not simply a financial fraud on federal healthcare programs; it’s a direct threat to the integrity of medical decision-making itself.

The Compliance Overhaul

The financial penalty is only part of the resolution. Veloxis also entered into a five-year Corporate Integrity Agreement with the HHS Office of Inspector General, and the specific structural requirements in that CIA are worth studying closely because they reflect the government’s current thinking on what makes a compliance function genuinely independent and effective, rather than just present on an org chart.

The CIA requires Veloxis to appoint a compliance officer who reports directly to the CEO or the board, with direct and independent access to the board at any time, and with a level of organizational stature equal to any other executive reporting to the CEO. Critically, the CIA specifies that this compliance officer cannot report through the legal or finance function, a structural requirement designed to prevent exactly the kind of dynamic where a compliance function is subordinated to, and potentially overridden by, business or legal considerations. The compliance officer will lead a compliance committee responsible for building out policies and procedures, monitoring and auditing compliance risk on an ongoing basis, training employees, and screening every new hire, including directors and owners, against federal exclusion lists.

What This Case Should Tell Every Compliance Officer

A few lessons stand out from this settlement that apply well beyond pharmaceutical marketing compliance.

Self-disclosure and cooperation can meaningfully change outcomes even when the misconduct originated at the executive level. Veloxis avoided prosecution of the corporate entity despite its own former CEO directing part of the scheme, precisely because the company’s response after the fact, disclosure, cooperation, identifying and firing the responsible executives, met DOJ’s bar under the CEP. Compliance officers should treat this as strong evidence that the CEP framework is a real, usable path even in fact patterns involving senior leadership, not just a policy that applies to lower-level misconduct.

Structural independence for the compliance function is not a nice-to-have; it’s increasingly a government-mandated requirement in post-settlement remediation. The specific requirement that Veloxis’s compliance officer cannot report through legal or finance, and must have direct board access, reflects a broader trend in corporate integrity agreements toward insisting on genuine organizational independence for compliance leadership, not just a title.

Sunshine Act and Open Payments compliance deserves more attention than many compliance programs currently give it. A $1.55 million penalty tied specifically to Sunshine Act reporting failures, described by DOJ as the largest such payment in the fifteen-plus year history of the program, is a signal that transparency reporting obligations are not a peripheral, check-the-box exercise. They are an independent area of enforcement risk that can generate significant penalties on their own.

And finally, mischaracterizing improper payments as “consulting fees” in company books and records is not a novel concealment tactic, but it remains a recurring one across kickback enforcement actions, and it consistently aggravates outcomes once discovered because it converts a substantive violation into a books-and-records and false-statement problem as well. Any compliance program overseeing consulting arrangements, speaker fees, or similar physician payment categories should have real substantive review behind those classifications, not just a label applied to make a payment look legitimate.