The Illusion of Choice: What’s Voluntary About a Voluntary Self-Disclosure?

The phrase ‘voluntary self-disclosure’ (VSD) carries a reassuring implication: that a firm has chosen, freely and without compulsion, to report its own misconduct. The term suggests agency and integrity. Regulators in the US and the UK have built entire enforcement frameworks around this concept, offering penalty reductions, declinations and reputational credit to firms that come forward before they are found out.

Yet across sanctions, export controls and anti-bribery enforcement, the architecture surrounding self-disclosure has been rebuilt so thoroughly that the word ‘voluntary’ now describes a decision in which only one option is rational. Non-disclosure is penalised. Whistleblower programmes race firms to the regulator’s door. The question is no longer whether to disclose. It is whether the system still permits a meaningful choice not to.

The incentive structure has outgrown its own language

VSD has existed in enforcement for decades. The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) has long treated self-reporting as a mitigating factor, reducing the base civil penalty by up to half. The US Department of Justice (DOJ) introduced its Corporate Enforcement Policy, originally the Foreign Corrupt Practices Act (FCPA) Pilot Program, to offer cooperation credit to firms that came forward first. In the UK, the Office of Financial Sanctions Implementation (OFSI) applied a 50 per cent discount to firms that disclosed sanctions breaches promptly. The logic was straightforward: regulators have limited resources; firms that assist enforcement deserve credit.

What has changed is the magnitude of the incentive. In May 2025, the DOJ’s Criminal Division revised its Corporate Enforcement and Voluntary Self-Disclosure Policy. The revision replaced a presumption of declination with a guarantee. Not a presumption. A promise. Firms that self-disclose, cooperate fully and remediate appropriately will receive a declination of criminal prosecution, provided no aggravating circumstances exist.

In February 2026, the US Attorney for the Southern District of New York (SDNY), Jay Clayton, went further. He previewed a programme that would issue conditional declination letters within weeks of a self-report. Crucially, it would credit disclosures even where the government already possessed the information, provided the firm believed in good faith that it did not. The message to firms is unmistakable: come forward, and come forward quickly.

The revised policy also introduced a ‘near miss’ category. Firms that self-report in good faith but fall short of the full VSD criteria now receive a non-prosecution agreement with a term of less than three years, a 75 per cent fine reduction and no compliance monitor. Even getting it wrong is rewarded, provided the firm tried. The safety net beneath disclosure has never been wider.

Non-disclosure is no longer neutral; it is an aggravating factor

The carrot has grown. So has the stick. In September 2024, the Bureau of Industry and Security (BIS), the export controls arm of the US Department of Commerce, published a final rule codifying a principle signalled through earlier policy memoranda. A deliberate decision by a firm not to disclose a significant apparent violation of the Export Administration Regulations would now be treated as an aggravating factor. The rule introduced a new Aggravating Factor D to the BIS Penalty Guidelines.

In a traditional enforcement framework, a firm that discovers a violation and elects not to report it faces a familiar risk calculation: the probability of detection weighed against the cost of disclosure. Under the revised framework, that calculation changes. As the then-Assistant Secretary for Export Enforcement, Matthew Axelrod, stated in a speech at NYU Law School, when someone affirmatively chooses not to file a VSD, BIS wants them to know that they risk incurring concrete costs. Non-disclosure is no longer the absence of mitigation. It is the presence of aggravation.

BIS reported that following these changes it observed a nearly 30 per cent increase in disclosures of significant violations and a 20 per cent increase in industry tips. The policy is producing the behaviour it was designed to produce. Whether that behaviour can credibly be called voluntary is a separate question.

OFAC is moving in the same direction. In February 2026, OFAC launched a new online VSD portal, streamlining the mechanics of submission. In 2025, OFAC levied a $216 million fine against GVA Capital Ltd for egregious violations compounded by a failure to self-disclose. The infrastructure of disclosure is being made easier at the same time the consequences of non-disclosure are being made sharper.

Whistleblower programmes are compressing the window for action

The pressure is not coming solely from regulators. It is coming from within the firm. The DOJ’s Corporate Whistleblower Awards Pilot Program, launched in August 2024 and expanded in May 2025, now offers financial rewards to individuals who provide actionable information on sanctions evasion, bribery, tariff fraud and material support for terrorism. By late 2025, DOJ officials reported at the American Conference Institute’s FCPA conference that the programme had received over 1,100 submissions since its launch. More than half were referred to prosecutors for further investigation.

The revised Corporate Enforcement Policy addresses this directly. A company may still qualify for a declination even if a whistleblower has already reported to the DOJ, provided the company self-discloses within 120 days of receiving the internal report and meets all other requirements.

The 120-day window is framed as a safeguard. In practice, it is a countdown. Once a firm becomes aware of an internal report, it is racing to investigate, assess and disclose before the government acts on information it may already possess.

The firm is not choosing between disclosure and silence. It is choosing between disclosing now and being disclosed upon later. That is not voluntariness. That is triage.

OFSI’s reformed framework sharpens the UK paradox

The tension is not confined to the US. In January 2026, OFSI imposed a £160,000 civil monetary penalty on Bank of Scotland plc for processing 24 payments in breach of the Russia (Sanctions) (EU Exit) Regulations 2019. The parent company, Lloyds Banking Group, had made a prompt voluntary disclosure, resulting in a 50 per cent reduction from what would otherwise have been a £320,000 penalty. The breach arose from a transliteration mismatch between the designated person’s passport spelling and the OFSI Consolidated List. A technical failure, self-reported, discounted and resolved.

Days later, OFSI published its response to a consultation on reforming its enforcement processes. The changes took effect in February 2026. The standalone disclosure discount has been cut from 50 per cent to a maximum of 30 per cent, rebranded as the Voluntary Disclosure and Co-operation discount. A new Early Account Scheme offers a further 20 per cent. A settlement scheme adds another 20 per cent. In aggregate, a cooperative firm can access cumulative discounts of up to 70 per cent, though each layer demands progressively deeper engagement with the regulator.

Several consultation respondents raised a concern at the heart of this analysis. Reducing the disclosure discount while seeking to double the maximum penalty to the greater of £2 million or 100 per cent of the breach value changes the arithmetic of self-reporting. The discount is smaller. The penalty is larger. As WilmerHale observed, there is a risk that higher penalties will dissuade companies from self-reporting at the moment when self-reporting underpins the regulator’s enforcement model.

OFSI’s own enforcement record illustrates the dependency. The majority of its published penalty cases involve firms that found their own breaches, reported them voluntarily and cooperated throughout. If the new framework discourages that candour, OFSI may find itself with stronger powers but fewer opportunities to use them.

Self-disclosure has become a default, not a decision

The practical consequence is that compliance teams, general counsel and boards are no longer weighing disclosure against non-disclosure as a balanced choice. They are comparing the cost of disclosure against the compounding cost of being found to have chosen silence. The calculus has shifted from ‘should we report?’ to ‘can we justify not reporting?’

This matters because it changes what regulators receive. When a firm discloses out of conviction, the act reflects genuine commitment to remediation. When it discloses because the alternative is an aggravated penalty and a whistleblower-driven investigation, the act reflects rational self-interest. Both produce the same regulatory outcome. They do not produce the same institutional outcome.

The costs of disclosure remain real. White and Case’s 2025 Global Compliance Risk Benchmarking Survey found that concerns around expense, duration and reputational harm continue to deter firms from self-reporting, even as the DOJ strengthens incentives. A disclosure can trigger prolonged external investigation, substantial legal fees and public exposure. For firms whose misconduct is limited in scope and unlikely to be detected, the case for silence has not disappeared entirely. It has simply become harder to defend.

Regulators have increasingly sought to reward not just disclosure but the culture behind it. The DOJ evaluates compliance programme strength. OFSI’s revised framework assesses the quality of cooperation. The Financial Conduct Authority’s (FCA) 2025 to 2030 strategy states that firms demonstrably seeking to do the right thing will benefit from less intensive supervision. If disclosure becomes self-preservation rather than self-governance, its signal value is diminished. Regulators may receive more reports but learn less about the firms that file them.

The illusion serves a purpose, but it should be named

Self-disclosure regimes are not misguided. They are a more efficient and more proportionate mechanism for resolving breaches than investigation-led enforcement alone. Firms that self-report achieve better outcomes. Regulators resolve cases faster. The system works.

Yet the language should be honest about what it describes. When non-disclosure carries a penalty premium, when whistleblower programmes compress the window for action, and when regulatory guidance demands cooperation ‘above and beyond what the law requires’, the word ‘voluntary’ is doing more rhetorical work than it can support.

If the illusion of choice is deliberate, it is effective. If it is accidental, it is worth correcting. Either way, the compliance profession would benefit from naming the reality: in 2026, a VSD is not a choice firms make. It is the price of operating under a regime that has made every other option untenable.

Do you have confidence in your VSD process if a breach were identified tomorrow?

At OpusDatum, we help firms build investigation, escalation and disclosure frameworks that ensure self-reporting decisions are made from a position of preparedness, not panic. Our advisory services support compliance teams in navigating the operational demands of regulatory engagement across sanctions, export controls and financial crime.

To find out how we can support your firm, contact us.