Compliance officers have spent years understanding how DOJ enforcement works: different divisions, different priorities, and varied approaches depending on the prosecutor. That mental model just shifted.
The DOJ's National Fraud Enforcement Division issued two directives in early October 2026 that centralize corporate fraud cases under a single Corporate Enforcement Section and outline explicit priorities and aggravating factors. For many compliance teams, these directives confirm what you've been doing. For others, they expose gaps you didn't know mattered. Either way, several persistent myths about fraud enforcement deserve a closer look.
Myth 1: "Our fraud risk is limited to our finance department"
Reality: The DOJ now explicitly prioritizes four categories that cut across your organization: health care fraud and controlled substance distribution, procurement and government contract fraud, revenue evasion, and trade violations including tariff evasion and forced labor.
If you manufacture medical devices, your quality and regulatory teams own fraud risk. If you're a government contractor, your procurement, billing, and project management functions are in scope. If you import goods, your supply chain and customs compliance teams carry exposure. Revenue evasion doesn't just mean tax fraud; it includes schemes that deprive the government of money it's owed across programs.
What to do: Map these four priority areas to your business units. Identify which teams touch health care billing, government contracts, customs declarations, or tax reporting. Your fraud risk assessment should follow your business model, not your org chart.
Myth 2: "We'll know if the DOJ is looking at us"
Reality: Directive 26-13 emphasizes data analytics through the National Fraud Detection Center and aims to incentivize whistleblowers, including those who participated in the misconduct, to come forward with credible fraud information.
The government is mining data to find fraud patterns before anyone reports them. Meanwhile, the DOJ is designing policies to reward insiders who bring information, even if they were involved. The directive promises public transparency about these programs where possible but doesn't yet describe the terms.
This creates a shrinking window. Under the Corporate Enforcement and Voluntary Self-Disclosure Policy, you generally have up to 120 days after receiving a whistleblower report to self-disclose and remain eligible for declination, even if the whistleblower reports to the government first. But if the government finds the issue through data analysis or receives a tip from someone you haven't heard from, you may not get that window.
What to do: Don't wait for a hotline report to surface fraud risk. Run your own data analytics on billing patterns, procurement activities, customs filings, and revenue recognition. If you find something, you control the timing. If a whistleblower finds it first, you're racing the clock.
Myth 3: "Centralization means slower decisions"
Reality: Centralization under the Corporate Enforcement Section is designed to create consistency and a "clear, predictable path to resolution" for companies that self-disclose. But it also means every corporate fraud case across the Division's health care, government, tax, and trade portfolios now flows through a single section that must be consulted "at all phases" from intake through resolution.
Prosecutors must report all ongoing corporate investigations to the Corporate Enforcement Section Chief within seven days of Directive 26-12. New investigations and major developments require prompt reporting. This isn't bureaucracy; it's coordination. The Division wants corporate cases handled the same way regardless of which line prosecutor opened the file.
For companies under existing agreements, this means a new set of reviewers may be looking at your compliance program enhancements and disclosure obligations. Confirm your reporting is current and complete.
What to do: If you're considering self-disclosure, understand that you'll be dealing with a centralized team that sees every corporate fraud matter in the Division. They'll have institutional knowledge of what works and what doesn't. Use that consistency to your advantage: ask clear questions, document cooperation, and follow through on commitments.
Myth 4: "The charging factors are just the same old considerations"
Reality: Directive 26-12 lists ten factors prosecutors "must place great weight on" when deciding whether to charge a company. Several are bright-line thresholds: conduct lasting three years or more, affecting three or more federal districts, involving 25 or more victims, or $25 million or more in loss.
These aren't suggestions. They're aggravating factors that prosecutors are instructed to weigh heavily. If your misconduct crosses these lines, expect the government to view it as serious. The list includes management knowledge or involvement, concealment from agencies or auditors, substantial hardship to taxpayer-funded programs, threats to safety or security, exfiltration of U.S. dollars to support foreign adversaries, and immigration offenses.
Directive 26-13 extends these factors beyond charging decisions. It calls for pre-indictment asset seizure where appropriate and directs prosecutors to seek upward variances and departures at sentencing. The government isn't just deciding whether to charge; it's planning asset recovery and sentencing strategy from the outset.
What to do: When you investigate potential misconduct, assess it against these ten factors. How long did it last? How many business units or locations were involved? What's the dollar impact? Who knew? If you're hitting multiple aggravating factors, that's information your leadership and board need before deciding how to proceed.
Myth 5: "Asset recovery happens after the case resolves"
Reality: Directive 26-13 instructs prosecutors to "prioritize early seizure of fraud proceeds and early disruption of fraud schemes," coordinating with the Division's Asset Recovery Section "at all stages" of an investigation and prosecution.
This is a significant shift. Asset recovery used to be something that happened during or after resolution. Now, companies may find themselves dealing with both the Corporate Enforcement Section and the Asset Recovery Section from the outset of a matter. The government wants to preserve assets and disrupt ongoing fraud before the investigation concludes.
What to do: If you discover fraud that generated proceeds, assume the government will move quickly to identify and preserve those assets. Document where money went, who received it, and what remains. If you're self-disclosing, be prepared to discuss asset location and preservation as part of your cooperation.
What to Do Instead
Stop treating fraud risk as a finance problem. Identify which business units touch the four priority areas and build controls there.
Run your own data analytics before the government does. If you find an issue, you control the disclosure timeline.
Understand that centralization means consistency, not leniency. The Corporate Enforcement Section will apply the same standards across cases. Use that predictability to make informed decisions about cooperation.
Assess potential misconduct against the ten aggravating factors. If you're hitting multiple factors, escalate quickly and consider self-disclosure seriously.
Prepare for early asset recovery discussions. The government isn't waiting for resolution to identify and preserve fraud proceeds.
The DOJ's new approach doesn't change whether fraud is illegal. It changes how quickly the government will find it, how consistently it will be prosecuted, and how early asset recovery will begin. Your compliance program should adjust accordingly.
