Voluntary Self-Disclosure: When to Raise Your Hand (and When Not To)

Your investigation team just confirmed it: there is a real problem, and it is not one you can fix with a retraining session or a policy update. Do you walk into the government's office and tell them before they find out on their own, or do you remediate quietly? In this edition of The Ethicsverse, Matthew S. Axelrod, Partner at Gibson Dunn and former Assistant Secretary for Export Enforcement, Senior Counselor, and Special Counsel to The White House, and Adam Smith, Partner at Gibson, Dunn & Crutcher LLP, joined Nick Gallo, Chief Servant & Co-CEO of Ethico, to unpack one of the most consequential judgment calls in compliance.

Matt led export enforcement at the Bureau of Industry and Security (BIS) and served as a senior DOJ official; Adam was Senior Advisor to the Director of the Office of Foreign Assets Control (OFAC). Both helped write disclosure policy inside government and now advise companies on whether to use it. From the DOJ, BIS, and OFAC frameworks to the Bosch resolution and BIS's growing enforcement muscle, here are the key takeaways.

Key Takeaways

Disclosure Looks Simple from Government and Complicated from the Inside

From the government side, the goal is straightforward: build policies that incentivize more companies to come forward so enforcers can evaluate and act on misconduct.
On the company side, it is a constant cost-benefit analysis. Disclosure can bring penalties with financial and reputational impact, so the question becomes what benefits you get for coming in versus how likely the government is to find out if you don't.
Matt called it an iron law: you would rather knock on the government's door before it comes knocking on yours. But if you never knock, there is a chance no one ever comes, and that is what makes the decision so complex.
Adam emphasized that the environment has changed, not just the perspective. Over the past five to ten years, nearly everything has become national security, raising both the stakes of disclosure and the risk of non-disclosure, especially for matters involving China or Russia.

Disclosure Benefits Can Be a Black Box

OFAC's disclosure rules have not materially changed since its enforcement guidelines were issued around 2009–2010, but its 2019 framework for sanctions compliance programs gave companies a clearer benchmark to measure themselves against.
The challenge is tracing a disclosure through to the final penalty. Enforcement releases may say mitigation credit was given, but rarely how much, making it hard to quantify the actual benefit from the outside.
That lack of back-end data means the payoff of disclosure is not always clear when you are making the decision.

There Is No Blanket Rule

Both guests rejected an “always disclose” or “never disclose” policy. Matt described self-disclosure as one of the most complex strategic judgment calls in their practice.
The analysis depends on the specific facts: how sensitive the items are, where they went, who the end user was, the number and dollar value of transactions, and whether there is potential criminal exposure that would bring DOJ into the picture.
Adam noted that a general presumption in favor of disclosure is a reasonable starting point for some companies, as long as it remains a presumption that can be overcome rather than a hard rule.
The political environment matters too. Violations touching hot-button areas for the current administration, such as China, Iran, Russia, or Venezuela, carry higher risk and need to be factored into the calculus.

Remediation Is Not Optional; Disclosure Is the Judgment Call

Responding to a comment from the audience, Matt was clear: ignoring a potential violation is never an option. Every potential violation should be investigated, understood, and remediated so it does not recur.
Whether to then go to the government and ask to be penalized is a separate decision. The investigation and fix must always happen; the disclosure is the judgment call.
Adam pushed back on the idea of eliminating risk entirely. Unless you only trade with New Zealand, every business carries regulatory and commercial risk. The goal is to manage and reduce it by engaging seriously when problems surface, because people will make mistakes.

Three Agencies, Three Different Doors

DOJ, BIS, and OFAC all offer penalty reductions for voluntary self-disclosure, but DOJ offers something the others cannot: a change in the type of resolution. Under DOJ's department-wide Corporate Enforcement Policy, a company that voluntarily discloses, cooperates, and remediates, absent aggravating factors, can receive a declination of prosecution, meaning no plea agreement, DPA, or NPA.
Adam described a “DOJ-ization” of the regulators, driven by personnel cross-pollination. Expectations around compliance programs, training, and tone from the top that trace back to FCPA practice now appear in OFAC and BIS guidance.
BIS has a unique policy: if a company identifies a potentially significant violation, deliberately chooses not to disclose, and BIS later finds out, that decision is treated as an aggravating factor. Matt said it does not take the “voluntary” out of voluntary self-disclosure; it shifts the risk calculus.
Over-disclosure has its own downside. Agencies have finite resources, and disclosing every minor issue can look like outsourcing your compliance function to the regulator.

Who You Are Talking To Changes the Calculus

DOJ is staffed by lawyers end to end. OFAC enforcement is often handled by brilliant policy professionals who are not lawyers, which makes the broader policy environment more relevant to how matters are evaluated.
OFAC is explicitly non-precedential, while BIS looks at the spectrum of past resolutions to see where a current matter falls.
BIS has federal law enforcement agents in the field developing tips and leads; OFAC does not. That difference directly affects one of the biggest disclosure factors: how likely the government is to find out on its own.
History matters. Before roughly 2010, OFAC was a small agency focused largely on Cuba and narcotics trafficking. It is now central to national security policy but still operates with only about 300 full-time employees.

BIS's Two-Track Process Frees Up Resources

More than 95% of voluntary self-disclosures to BIS result in a warning letter or no action letter. Before the change, those matters sat at the bottom of agents' piles for years, and significant matters got buried with them.
Under the two-track system, minor or technical violations can be submitted through an abbreviated narrative disclosure without a full five-year lookback, with a response expected within about 60 days.
Only significant matters are assigned to agents, letting both BIS and corporate compliance teams focus on the violations that truly matter.

One Violation, Multiple Agencies

If there is potential criminal exposure, a disclosure to DOJ is essential. Matt recommended making disclosures to all relevant agencies simultaneously rather than choosing one to approach first.
The agencies share voluntary self-disclosures with one another. Disclosing to OFAC but not BIS on a matter with export control implications risks losing credit from BIS while it gets pulled in anyway.
Adam noted that coordination between sanctions and export control enforcement was once limited but changed drastically with Russia in early 2022. The conversation is now incessant on both the policy and enforcement sides.
Other regulators may also be in play. Financial institutions, for example, may need to consider FinCEN obligations such as suspicious activity reports alongside OFAC, BIS, and DOJ exposure.

What the Bosch Resolution Teaches

Bosch was the first application of DOJ's department-wide Corporate Enforcement Policy by the National Security Division. The company self-disclosed, cooperated, remediated, and received a declination.
The underlying conduct involved roughly $72 million in sensor product exports to Huawei in China. The BIS penalty was $36.2 million, about half the transaction value, and DOJ required $11.4 million in disgorgement, with approximately $3.6 million credited against the BIS penalty.
Matt suspected the company expected a lower penalty given the low-level, foreign-made items involved. Instead, it received close to the maximum BIS assesses for a voluntary self-disclosure, reflecting a more aggressive enforcement posture.
That posture shows in the numbers. BIS had seven corporate resolutions in 2025; by October of this year it had already reached ten, and nine of the ten carried penalties of $1 million or more.
Adam added that OFAC no longer automatically credits penalties imposed by other agencies. Global settlements with cross-crediting are still possible, but they are no longer the default.

Most Cases Close Without Penalty, But It Is Not Luck

OFAC closes roughly 1,000 cases a year and issues around 20 penalties. Most matters end with no action or a non-public cautionary letter.
Matt cautioned against reading that as a lottery. The high close-out rate reflects the volume of minor, technical disclosures. Matters with real substance, like Bosch, will draw attention and penalties.
OFAC also looks for cases that can educate the regulated community, such as new sanctions programs or emerging areas like crypto, which can raise enforcement likelihood in those spaces.

Advice for the CCO Facing a Decision Tomorrow

Adam: keep your ear to the ground on how disclosures in your specific issue area are being treated, and keep the pedal to the floor on remediation regardless of what you decide. The most important part of any disclosure is the remediation section: what happened, why, and how you fixed it.
Matt: project forward. BIS's budget and agent headcount are growing, and legislation is pending on Capitol Hill to create a BIS whistleblower program. With a five-year statute of limitations, conduct you decide not to disclose today could be found by a much larger, better-resourced BIS years from now.
Timing matters. If you are going to disclose, do it promptly once you have enough evidence of an apparent violation. DOJ places a real premium on prompt disclosure, and BIS allows an initial disclosure followed by a final disclosure within 180 days, giving companies time to complete the picture.

Closing Thoughts

Voluntary self-disclosure is truly voluntary, and that is exactly what makes it hard. As Matt and Adam made clear, there is no formula that works for every case. The right answer depends on the facts, the agencies involved, the political and national security climate, and a realistic view of how likely the government is to find the issue on its own, today and several years from now.

What is not optional is the work underneath the decision: investigate thoroughly, remediate completely, and document what you fixed. Whether you ultimately raise your hand or not, a company that can show it understood the problem and solved it will be in a far stronger position with every regulator at the table.