On October 1, 2026, Assistant Attorney General Colin McDonald issued Directive 26-12 to all personnel of the Department of Justice’s National Fraud Enforcement Division. The five-page memorandum, titled “Corporate Enforcement in the Fight Against Fraud,” is addressed to prosecutors, but compliance officers and general counsel should read it as if it were addressed to them. It identifies the fraud schemes that will receive priority, lists ten factors that prosecutors must weigh heavily when deciding whether to charge a company, creates a central role for a Corporate Enforcement Section, and orders the design of new whistleblower incentive programs. Few DOJ documents so plainly show how the government will evaluate your company on its worst day.

An All-Tools Posture With a Stated Limit

The memo opens with an aggressive tone, promising an “all-tools approach” to health care, government, tax, and trade fraud. But it pairs that rhetoric with a restraint that deserves attention. The Division says it will guard against “overbroad corporate enforcement” and will distinguish among “shades of corporate malfeasance” so that legitimate business operations are not disrupted. Read together, the two themes describe a division that intends to pursue serious, pervasive misconduct hard while giving real credit to companies that disclose, cooperate, and remediate. For compliance leaders, that is the opening to make the business case internally: the policy rewards the companies with credible programs and punishes those without them.

The directive does not rewrite existing policy. It instructs prosecutors to follow the Justice Manual’s Principles of Federal Prosecution of Business Organizations and the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. What it adds is a layer of Division-specific priorities and weighting.

A Central Corporate Enforcement Section

The memo gives significant operational authority to the Division’s Corporate Enforcement Section, created earlier this year. Within seven days of the directive, prosecutors had to report their ongoing corporate investigations to the Section’s chief, and they must notify the Section of new corporate investigations and major developments. The Section will participate in matters from intake through resolution or litigation.

Two consequences follow. First, corporate cases across health care, procurement, tax, and trade will be handled more consistently, so a company can expect less variation based on which office happens to open the file. Second, the Section will take primary responsibility for evaluating compliance with the terms of corporate criminal resolutions, including whether a company has implemented or enhanced its compliance program and whether it is meeting its reporting obligations. Companies under a resolution should expect a specialized, experienced team reviewing their post-resolution performance, not a prosecutor who has moved on to the next case.

Four Investigative Priorities

Prosecutors are told to prioritize four categories when opening and conducting corporate investigations:

• Health care fraud, including controlled substance distribution and violations of the Food, Drug, and Cosmetic Act.
• Schemes affecting procurement, government contracts, and other government functions.
• Significant evasion of internal or external revenue, which covers tax and customs duties.
• Tariff evasion, importation of goods or services, and forced labor.

The fourth category is the one many multinational compliance programs still underweight. Placing tariff evasion and forced labor on the same short list as health care fraud and procurement fraud confirms what the False Claims Act trade settlements have already suggested: customs and supply chain integrity are now core fraud priorities, not niche regulatory topics.

Ten Factors That Carry “Great Weight”

The heart of the directive is a list of ten factors that Division personnel “must place great weight” on in deciding whether to bring charges and in negotiating pleas or other agreements. They are:

1. Knowledge of or involvement in the scheme by corporate management.
2. Efforts to conceal fraud from government agencies or auditors, or otherwise to obstruct government oversight.
3. Conduct that furthers the scheme and lasts three years or more.
4. Actions that threaten the safety or security of Americans, including military readiness.
5. Conduct that causes substantial financial hardship to a taxpayer-funded program or government function.
6. Conduct that affects multiple taxpayer-funded programs or government functions.
7. Conduct that affects three or more federal districts.
8. Conduct that harms twenty-five or more victims or causes $25 million or more in loss.
9. Conduct that involves the exfiltration of American dollars to support foreign adversaries.
10. Conduct that involves immigration offenses.

The memo describes the list as non-exhaustive and allows prosecutors to consider other factors, but “great weight” is language that will shape every charging recommendation and every negotiation.

Several of these factors are measurable facts about a case: duration, number of districts, number of victims, dollar loss. Those are largely beyond a compliance function’s ability to change after the fact. The factors that a compliance program can influence are the first two, and they are the ones that matter most. Management knowledge or involvement is the factor that separates a rogue employee case from an institutional case. Concealment from agencies or auditors is the factor that converts a billing dispute into obstruction. A company whose leaders did not know, and whose records and communications show no effort to hide the problem, is in a very different position than one whose executives were in the room.

The duration factor should also change how companies think about monitoring. A three-year threshold is easy to cross when problems go undetected, which is exactly why continuous monitoring, transaction testing, and prompt investigation of anomalies matter. The shorter the life of a problem, the better the charging posture, and the better the opportunity to qualify for voluntary self-disclosure credit.

Whistleblowers Are Now a Stated Policy Pillar

The final section of the directive addresses disclosure. The Division describes using data analytics and technology through the National Fraud Detection Center to generate leads and open investigations “at a rapid pace,” and it instructs Division leadership, with law enforcement partners, to design and implement policies and programs that incentivize whistleblowers to come forward with credible information. The memo goes further, stating that these policies should encourage and protect the disclosure of information by whistleblowers, including those who participated in the criminal conduct. The Division also commits to providing the public transparency about those programs to the extent possible.

For companies, this has an immediate practical meaning. Data-driven detection, combined with whistleblowers who may include participants in the misconduct, shortens the time a company can expect to control the narrative. Employees with knowledge of wrongdoing, including those who were involved, now have reason to approach the government. A company that learns of a problem has to assume that the government may learn of it too, and perhaps from someone inside. The rational response is an internal reporting channel that works, a culture where concerns are taken seriously, and a disclosure decision process that can move quickly.

What Compliance Leaders Should Do Now

First, map your exposure to the four priority areas. If your business touches federal health care programs, government contracts, tax, or imports, assess whether your risk assessment treats those risks with the weight DOJ now assigns them. Tariff, customs valuation, country of origin, and forced labor controls deserve particular scrutiny.

Second, test your program against the ten factors. Ask what a prosecutor would find on management knowledge, on any sign of concealment from auditors or regulators, and on how long a problem would likely persist before your controls would catch it. Build detection that shortens that duration.

Third, review your document retention and communications practices. Concealment is a heavily weighted factor, and the appearance of concealment can arise from poor record practices as easily as from intent. Make sure that audit and regulatory responses are accurate, complete, and well documented.

Fourth, strengthen your speak-up system. With DOJ designing whistleblower incentives, internal reporting must be the faster and more attractive path. Respond to reports promptly, protect reporters from retaliation, and escalate serious allegations to counsel and the board.

Fifth, prepare your voluntary self-disclosure decision process in advance. The directive requires prosecutors to apply the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy in all circumstances. Companies that have decided in advance who evaluates a potential disclosure, how quickly, and on what criteria will be in a better position to qualify for the benefits that policy offers.

Sixth, if your company operates under a corporate resolution, expect closer and more consistent review. The Corporate Enforcement Section will lead evaluation of compliance enhancements and reporting obligations, so build evidence of program improvements in a form that a specialist team can readily verify.

The Bottom Line

Directive 26-12 is both a warning and an invitation. The warning is that DOJ is building the people, the data analytics, and the whistleblower pipeline to find corporate fraud faster, with a clear list of what will push a case toward charges. The invitation is that the same document promises to protect law-abiding companies and credit those that disclose, cooperate, and remediate. Which side of that line your company ends up on will depend less on what you say in a presentation to prosecutors than on the program you built before they ever called.