At a third-party risk management and supply chain conference in Chicago on Wednesday, October 28, 2026, Assistant Attorney General A. Tysen Duva, who has led the Justice Department’s Criminal Division since December 2025, delivered a message aimed squarely at boards and chief executives: fund compliance properly, and when it finds something, come to the Department early. The remarks, made in a fireside chat and reported by Compliance Week, restate themes he has stressed since the Department introduced its Corporate Enforcement Policy in March. They are worth reading closely, because they reveal how the Criminal Division wants companies to behave and what it is offering in return.

The Budget Message

Duva’s first point was about resources. He wants the C-suite to see compliance spending as worthwhile and as something that pays off for the company. His reasoning is practical. Threats are changing quickly, fueled by AI and cyber-enabled crime, and being ahead of a problem is far better than being behind it, when the alternative can mean indictment and years of external monitoring. Compliance, he said, is the main line of defense in finding these problems, and he hopes companies will come forward sooner rather than later.

For chief compliance officers, that is a useful quote for the next budget meeting. It is also a reminder that the Department evaluates whether compliance programs are adequately resourced. A program that cannot detect, investigate, or remediate because it lacks people and tools is a program that will not earn credit.

The Corporate Enforcement Policy: Three Outcomes

Under the policy, as described in the report, a company can end up in one of three places: a Part I declination, a Part II “near miss” resolution, or a Part III resolution. Duva’s pitch is that the declination is real. He wants the business community to know the Department means what it says, while prosecutions of the individuals involved continue to be pursued vigorously. His comparison was blunt: disclose early and pay a smaller amount of disgorgement, or wait and potentially pay hundreds of millions.

He also drew the line on timing. If a whistleblower or the media gets to the Department first, the declination is off the table, although a non-prosecution agreement or deferred prosecution agreement may remain possible. That line has real consequences. It means the race I have described in the antitrust context, between the company and the insider, applies across the Department’s criminal enforcement: a company that sits on a known problem risks losing the best outcome.

How Early Is Early?

This is the most practical part of the discussion. Duva said a company should first conduct some internal investigation, interviewing witnesses and reviewing documents, so that it knows wrongdoing occurred and that there were bad actors. That usually takes more than a few weeks but not years, and he acknowledged that investigating third-party corruption tends to take longer. His formulation was to be swift and diligent, not fast and reckless, because the Department wants accuracy.

The trigger he described is the moment when the light switch flips from off or “not sure” to on. At that point, a company should not wait to assemble a comprehensive report. He suggested bringing a summary of what happened, who was involved, and relevant documents, perhaps in a slide presentation, and educating the Department. After that, expect a point person in the Criminal Division’s Fraud and corporate enforcement unit (the report calls it the White Collar and Corporate Enforcement Section) and a series of meetings about how the conduct occurred and the history of the individuals involved.

He added two assurances. The Department will look at the totality of the circumstances rather than being rigid, and it will not retroactively fault a self-disclosing company for not discovering the problem sooner. But he also warned against the opposite problem: if a company knew about the conduct and sat on it for years, that is “not great.”

I think this guidance helps in one way and leaves a problem in another. It helps because it gives a practical benchmark: disclose when you know that misconduct occurred and who was responsible, not when you have a finished investigation. The problem is that there is still no bright line between “not sure” and “on,” and the cost of misjudging it is the loss of a declination. Companies need a documented decision process, with counsel, for making that call and a record of the facts known at each stage.

Third Parties and High-Risk Regions

Because the conference focused on third-party risk, Duva spent time on it. He called third-party due diligence imperative. The Department understands that in many places bribery is a way of life, and if a company or its intermediary is being shaken down by a head of state or official, he said the Department wants to hear about it. He described Mexico and Central and South America as minefields for corruption risk and noted that early disclosure also lets the Department conduct undercover investigations.

On controls, he urged vigilance in audits as products move through supply chains, and the use of workflow tools so that receivables can be evaluated and payments verified as legitimate.

AI Is a Tool, Not the Compliance Function

Duva said companies can use AI to analyze data and accounts receivable, but they should keep an expert human in the loop. AI is not a substitute for compliance; the professionals are the investigators and evaluators who know the company and its people. That is consistent with what other Department officials have said about AI in compliance, and with the position of the Antitrust Division that a pricing model is not an excuse.

A New Initiative on Cyber-Enabled Scams

The Criminal Division is also using what Duva called a Cyber-Enabled Scam Initiative aimed at frauds originating in Southeast Asia and at how U.S. markets are involved, including how companies tied to Chinese entities that engage in unlawful activity can list on Nasdaq and launder proceeds. He described this as a return to what he called the old Nasdaq pump-and-dump problem. Financial institutions, exchanges, and advisers with exposure to these markets should expect questions.

What Companies Should Do Now

1. Make the budget case with this language. Boards and executives hear it from the person who leads criminal enforcement. Tie requests to detection, investigation, and remediation capacity.
2. Write the disclosure decision protocol. Define who decides when to disclose, what facts trigger the decision, how quickly the first investigative phase should run, and how it is documented.
3. Plan for the first conversation. Prepare a short briefing format: what happened, who was involved, key documents, remediation steps. Be able to produce it within weeks of reasonable confidence.
4. Assume the race with whistleblowers and the press. If an employee or reporter can tell the story, delay risks the declination. Strengthen internal reporting and non-retaliation, and monitor media inquiries as a signal.
5. Invest in third-party diligence and monitoring. Focus on high-risk regions, shake-down scenarios, and escalation routes for demands from officials.
6. Use AI with human review. Document who reviews outputs and how exceptions are resolved.
7. Be ready for individuals. The Department’s flexibility toward companies comes with vigorous pursuit of individuals, so separate counsel and cooperation questions need early attention.