Fraud Enforcement in a New Era: Would Your Compliance Programme Stand Up to Scrutiny?

What the Latest Directive from the DoJ Means for UK and EU Compliance Teams

The US Department of Justice told us last month how its new fraud enforcement machine would be built. Now it has told prosecutors how that machine will be directed at companies. For compliance teams (including those working diligently here in Europe) the question is no longer whether a programme exists on paper. Rather, it is whether their programme can withstand prosecutorial scrutiny.

McDonald Supersizes

On 1 October 2026, Colin M. McDonald, Assistant AG of the National Fraud Enforcement Division, issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud to all Fraud Division personnel.

Where his 13 August memo described an enforcement capability engineered around data, the new Directive 26-12 explains how that capability will be used against companies. It sets four investigative priorities, ten factors prosecutors must weigh heavily when charging and negotiating and a single gatekeeper for every corporate case: the Corporate Enforcement Section.

For UK and EU compliance leaders, once again this is not a purely American story. Companies selling into US healthcare, supplying US government programmes, importing goods into the US or otherwise exposed to US jurisdiction should take particular note. More broadly, the new directive is a clear statement of what prosecutors will look for when they examine a compliance programme and what they will hold against companies who fall short.

The Directive in a N(EU)tshell

Directive 26-12 is short, but its mechanics matter. Three points stand out.

1. One gatekeeper for corporate cases. The US DoJ Corporate Enforcement Section, created earlier in 2026, must now be involved at every phase of a corporate investigation, from intake to resolution or trial. Within seven days of the directive, prosecutors were required to report every ongoing corporate investigation to the Section's Chief.

2. The same team checks your remediation. The Section has primary responsibility for evaluating whether companies honour their corporate criminal resolutions - including efforts to implement or enhance compliance programmes and to meet disclosure obligations. If remediation is promised in a negotiation, this will be tested afterwards!

3. Leads come from data and insiders. The Division will use data analytics, including through its National Fraud Detection Center, to generate leads. It will also design and publicise whistleblower incentive programmes - and explicitly encourage disclosures from people who took part in any misconduct.

Principles have not been thrown out. Prosecutors must still apply the Principles of Federal Prosecution of Business Organizations and the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), under which compliance policies, internal controls and a company's history of misconduct remain relevant. Companies that disclose, cooperate and remediate should still receive prosecutorial credit.

Four Priorities and What They Mean for European Companies

1. Health care

Top of the list, and now explicitly including controlled-substance distribution and Food, Drug and Cosmetic Act violations.

European pharmaceutical, medtech and life sciences groups with US sales, distributors or clinical operations need to revisit their promotional practices, distributor oversight, pricing and reimbursement data and diversion controls.

2. Public trust and financial integrity

Procurement fraud, government contracts and schemes affecting government functions.

European defence, engineering, IT and services suppliers including subcontractors in lower tiers – need to be able to evidence pricing integrity, conflicts-of-interest management and clean billing.

3. Revenue evasion

The directive targets significant evasion of "internal or external revenue", taxes and duties alike.

Fraud rarely respects organisational boundaries, so tax, finance, customs and procurement data need to be read together, not within separate silos.

4. Tariff evasion, imports and forced labour

As in August, this should be a major area of attention for European organisations. Country-of-origin misstatements, transshipment, undervaluation and forced labour in supply chains are inherently cross-border risks.

Your supplier, customs and beneficial ownership data, and the work you are already doing for the EU's own forced labour and supply chain due diligence rules - is directly relevant.

Ten Factors Prosecutors Will Weigh Heavily

Directive 26-12 lists ten factors to weigh heavily in charging decisions and in plea bargains or other agreements. Read through a compliance lens, most of them are questions about whether your programme detected, escalated and stopped the conduct in time.

From Mitigating Factor to Decisive Factor

Notice how many of these factors grow worse the longer misconduct runs undetected. A scheme becomes "three years or more" because nobody stopped it in year one. Losses cross $25 million and spread to three districts because a red flag was dismissed as isolated. Management knowledge becomes an aggravating factor when escalation reached the top and nothing happened.

That is why the quality of a compliance programme may become a decisive factor in enforcement outcomes, not merely a mitigating consideration. A programme which detects early keeps the company below these thresholds - and keeps the option of self-disclosure, cooperation and remediation on the table. A programme which does not is, in effect, building the prosecution's case.

Eight Takeaways for UK and EU Compliance Teams

1. Re-run your fraud risk assessment against current enforcement priorities

A risk assessment written before 2026 may not reflect healthcare, procurement, revenue, tariff and forced labour risk as prosecutors now rank them.

Map your US-facing business lines, products and supply chains to the four priorities.

2. Measure yourself against the ten factors

Duration, number of victims, loss size and geographic spread are now explicit charging considerations.

Ask which of your controls would stop a scheme before it reached three years, $25 million or three districts.

3. Test whether controls actually work in the business, not just on paper

Policies and attestations do not demonstrate effectiveness.

Controls must be embedded in operational processes: sales, procurement, customs, billing - and tested with real transactional data.

4. Make your speak-up channel the first port of call

The DoJ is building incentive programmes for whistleblowers, including participants in misconduct. If employees, distributors or suppliers trust a prosecutor more than your hotline, you will be the last to learn about your issues!

Review your channels, anti-retaliation protections and the speed and quality of your investigations.

5. Evidence senior management oversight and accountability

Management knowledge cuts both ways.

Boards and executives should be able to show what fraud risk information they receive, what they asked and what they did about it - in minutes, escalation logs and decisions.

6. Protect the integrity of your records

Concealment from auditors and obstruction of oversight are aggravating factors.

Document retention, legal holds, audit responses and data preservation need to be reliable before an investigation starts, not improvised once it is underway.

7. Prepare remediation which stands up to scrutiny

The Corporate Enforcement Section will evaluate compliance with resolutions.

Remediation should rest on root-cause analysis, include disciplinary and control improvements - and be measured over time. Not just a promise in a negotiation!

8. Treat early detection and self-disclosure as strategy

The CEP still rewards companies that voluntarily self-disclose, cooperate and remediate.

Agree your escalation and disclosure decision process now, including how you will handle privilege, GDPR and cross-border data transfer questions under time pressure.

‍

The Wider UK and EU Perspective

UK and EU compliance teams should not read Directive 26-12 as a requirement to copy the US model. Legal frameworks, privilege rules, data protection and employment law differ, but the direction of travel is the same.

In the UK, the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 has applied since 1 September 2025, with "reasonable procedures" as the only defence. In the EU, whistleblowing, anti-money laundering, forced labour and supply chain due diligence rules all ask organisations to show that their controls work in practice and are not just paper programmes!

The DoJ has now spelled out how it will judge companies: by what management knew, how long the misconduct ran for, how far it spread and whether the company found it first. That is a useful stress test on either side of the Atlantic. The benchmark has moved from "Do we have a compliance programme?" to "Could our programme withstand a prosecutor asking why it did not detect, escalate and stop this sooner?"

Organisations that can answer that question with evidence will have options. Those that cannot will find the answer written for them.

‍

How Case IQ Can Help

As the DOJ increases its focus on early fraud detection, management accountability and effective remediation, Case IQ helps organisations strengthen their compliance programmes through integrated technology that supports prevention, detection, investigation and resolution.

Our Compliance Monitoring solution uses AI-powered analytics and automated risk scoring to continuously monitor financial transactions, identify suspicious activity and surface emerging risks before they become systemic. Our Whistleblower Hotline provides secure, multilingual reporting channels that encourage early reporting, and our case management software centralises investigations, evidence, corrective actions and audit trails. Together, these solutions help UK and EU compliance teams improve risk visibility, accelerate investigations and provide documented evidence of how their organisations detect, escalate and address misconduct.

Request a demo to see how Case IQ can help strengthen your fraud prevention and compliance efforts.

‍

Important: This post is for informational and educational purposes only. This post should not be taken as legal advice or used as a substitute for such. You should always speak to your own lawyer.

‍

Contact the author: Murray Grainger M: +34 649 86 06 90 | E: grainger2008@gmail.com | LI: linkedin.com/in/murraygrainger

‍

Sources

Directive 26-12: Corporate Enforcement in the Fight Against Fraud, US Department of Justice, 1 October 2026

Frequently Asked Questions

What is DOJ Directive 26-12?

DOJ Directive 26-12, Corporate Enforcement in the Fight Against Fraud, was issued on 1 October 2026. It establishes four fraud enforcement priorities, identifies ten factors prosecutors must weigh heavily when making corporate charging decisions, and gives the Corporate Enforcement Section a central role in corporate investigations and resolutions.

What are the DOJ's four fraud enforcement priorities under Directive 26-12?

The directive prioritises healthcare fraud, fraud affecting public trust and financial integrity, revenue evasion, and tariff evasion, imports and forced labour. These priorities cover risks such as healthcare billing, government procurement fraud, tax and customs evasion, and misconduct within international supply chains.

How does DOJ Directive 26-12 affect UK and EU companies?

UK and EU companies with US operations, customers, government contracts or supply chain exposure may face increased scrutiny under the directive. Organisations should assess their exposure to US jurisdiction, review fraud risks across relevant business activities, and ensure their compliance controls can detect and document potential misconduct.

What factors does the DOJ consider when evaluating corporate fraud cases?

Directive 26-12 identifies ten factors prosecutors must weigh heavily, including management involvement, concealment or obstruction, misconduct lasting three years or more, harm to government programmes, geographic reach, financial losses, and certain national security and immigration concerns. These factors can influence corporate charging decisions and negotiated resolutions.

How can companies demonstrate that their fraud compliance programme is effective?

Companies should be able to show that their compliance controls operate in practice through documented risk assessments, transaction monitoring, investigation records, escalation procedures and remediation activities. Testing controls against actual business data, tracking corrective actions and documenting management oversight can help demonstrate programme effectiveness.

Why is continuous compliance monitoring important for fraud prevention?

Continuous compliance monitoring helps organisations identify suspicious transactions, unusual patterns and potential control failures before misconduct becomes widespread. By analysing financial and operational data on an ongoing basis, compliance teams can prioritise high-risk activity, investigate concerns earlier and document their response.

What role do whistleblower hotlines play in corporate fraud detection?

Whistleblower hotlines provide employees, suppliers and other stakeholders with channels to report suspected fraud or misconduct. Secure, confidential reporting options, appropriate anti-retaliation protections and effective investigation workflows can encourage early reporting and help organisations identify problems before they escalate.

How should companies prepare for increased DOJ fraud enforcement scrutiny?

Companies should update their fraud risk assessments, evaluate their controls against the directive's enforcement priorities, strengthen whistleblower reporting and investigation processes, and document senior management oversight. They should also review data preservation, remediation and voluntary self-disclosure procedures to ensure they can respond effectively when potential misconduct is identified.