DOJ Revises Guidance for Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations

On November 12, 2024, the Department of Justice Antitrust Division (the “Division”) revised its guidance on the Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (the “Revised ECCP”).¹ The ECCP was first published in July 2019 and is intended to aid prosecutors in evaluating the strength of a company’s antitrust compliance program at two points in time: when making charging decisions and sentencing recommendations. Through the Revised ECCP, the Division retains the core principles of its original guidance, but also:

• emphasizes that all employees have roles in antitrust compliance and provides guidance on the role each category of employees plays in an effective antitrust compliance program;
• addresses the use of technology—including Artificial Intelligence (“AI”) and ephemeral messaging systems—in an effective antitrust compliance program;
• focuses on the importance of confidential and thorough reporting structures; and
• tweaks the guidelines for remediation.²

I. Employees at All Levels Are Responsible for Creating a Culture of Compliance

The Revised ECCP emphasizes the importance of a “culture of compliance.” It states that all employees, from compliance personnel to managers to senior leadership, have roles in antitrust compliance and provides guidance on the role each category of employees plays in an effective antitrust compliance program.³

Starting at the top of the leadership structure, the Division reaffirms its position that “[s]upport from . . . the board of directors and executives . . . is critical to the success of an antitrust compliance program.”⁴ The Revised ECCP expands on the previous guidance by directing prosecutors to investigate whether the Board of Directors has compliance expertise, whether it held private sessions with compliance and control functions, and what types of information it reviewed when misconduct occurred.⁵

In addition to the “tone from the top,” the Revised ECCP also includes a new emphasis on the “tone from the middle.” Prosecutors are instructed to examine the extent to which both senior leadership and mid-level managers have “articulated” and “conducted themselves in accordance with” the company’s policies and the “concrete actions they have taken to demonstrate a commitment to” antitrust compliance.⁶

Finally, the Revised ECCP emphasizes that compliance personnel and other employees should understand the company’s antitrust compliance program and be empowered to address any antitrust issues that may arise. For example, the Revised ECCP directs prosecutors to ask whether “the company’s hiring and incentive structure reinforce its commitment to ethical culture,” “compliance personnel [are] in place long enough to be effective without excessive turnover,” the company has appropriately funded compliance functions, and employees at all levels of the company receive adequate training and access to compliance materials.⁷

These updates suggest that the Division will examine how antitrust compliance programs are implemented and executed on a day-to-day basis, not just whether adequate policies are in place on paper.

II. Antitrust Compliance Includes Understanding and Leveraging Technology

The Revised ECCP includes a new focus on the relationship between technology, including AI and electronic messaging systems, and antitrust compliance. This new focus includes both preventing technology from being used to evade compliance programs and leveraging technology to strengthen compliance programs.

With respect to AI, Division prosecutors will focus on whether a company’s compliance personnel (i) have “an understanding of the AI and other technology tools used by the company,” (ii) are “involved in the deployment of AI and other technologies,” and (iii) “monitor and detect decision-making by AI or other technology tools to ensure they are not violating antitrust laws.”⁸ The Revised ECCP specifically cites algorithmic revenue management as a technology that companies should evaluate as part of their antitrust compliance programs and risk assessments.⁹

The Revised ECCP also addresses electronic and ephemeral messaging systems. New sections of the ECCP instruct prosecutors to consider guidelines that a company has provided to employees for using (or not using) ephemeral messaging, mechanisms for preserving messages, and a company’s rationale for its preservation and deletion settings.¹⁰ In addition, the Division will consider whether the company’s compliance program leverages electronic data to strengthen oversight, asking “[h]ow do compliance personnel utilize company data to audit and monitor employees,”¹¹ and “[i]s the compliance program using data analytics tools in its compliance and monitoring.”¹²

III. Employees Must Have Access to Confidential Reporting Structures

The Revised ECCP now reflects an emphasis on confidential internal reporting structures.¹³ The Division views reporting mechanisms that employees can use to raise concerns about antitrust violations “anonymously or confidentially and without fear of retaliation” as integral to maintaining an effective compliance program.¹⁴ Further, the Revised ECCP steers prosecutors to review whether the company’s policies are “encouraging . . . or chilling reporting” of antitrust violations, as well as whether employees and managers are trained on anti-retaliation policies and the protections provided under the Criminal Antitrust Anti-Retaliation Act (“CAARA”).¹⁵ A company will also likely be evaluated on its use of non-disclosure agreements (“NDAs”) for their positive or negative effect on the reporting of potential antitrust violations and if language and other policies make it clear that employees have the freedom to report antitrust violations internally and to government authorities.¹⁶ This focus on NDAs and ensuring no barriers exist to report potential violations internally or externally is consistent with recent Securities and Exchange Commission enforcement actions and other DOJ guidance.¹⁷

IV. ECCP Requires Both Prevention and Remediation

The Division expects that company compliance programs will “prevent” antitrust violations rather than merely detect them.¹⁸ And, when prevention fails, prosecutors are guided to take into account the “thoroughness of the company’s remedial efforts” to determine whether the compliance program was effective when the antitrust violation occurred.¹⁹ The Revised ECCP directs prosecutors to look for a “root cause analysis” of antitrust misconduct that was discovered and ask who is in charge of producing any root cause analysis and whether the issues are systemic.²⁰ Additionally, the Revised ECCP expands the scope of questions regarding senior leadership’s role in addressing an antitrust violation to include their role in “identifying and internally disciplining employees and supervisors” following the discovery of an antitrust violation.²¹

V. Key Takeaways

The Division’s updates to the ECCP for Criminal Antitrust Investigations follow similar updates to the Criminal Division’s ECCP that were released on September 23, 2024,²² which focused on “ensuring companies are implementing robust corporate compliance programs and are not discouraging whistleblowers.”²³ The Division’s newest updates are best understood as closing gaps that existed in the previous compliance guidelines—with a focus on ensuring that compliance programs are effective in practice as well as on paper—and expanding on the role of technology in corporate antitrust compliance. There is also greater attention to ensuring that compliance programs are more proactive, with accountability attributed to senior leadership and middle management for a program’s success or failure.

These updates to the ECCP present a good opportunity for companies to review their antitrust compliance programs to ensure that they are sufficiently robust, clearly explain the antitrust compliance roles of employees up and down the management structure, include a confidential reporting mechanism, and consider technologies like AI and ephemeral messaging. If you have any questions regarding the Revised ECCP or the standards that companies should consider when designing an effective compliance program, please contact the individuals listed in this alert.