DOJ’s Duva Urges C-Suites to Fully Fund Compliance at TPRM Summit

A. Tysen Duva, the Assistant Attorney General who heads the US Department of Justice’s Criminal Division, told boards and C-suites on October 28 that it is critically important to approve ample resources for compliance.

Duva spoke in a fireside chat at the 2026 Third-Party Risk Management and Supply Chain Summit in Chicago. He said compliance departments face fast-moving threats from AI- and cyber-powered crime and corruption. The message on DOJ compliance program funding came from the official whose division decides how prosecutors treat corporate misconduct.

Why DOJ compliance program funding is a board issue

For compliance chiefs, the remarks land in budget season. DOJ prosecutors ask whether a company’s compliance program has adequate funding and the empowerment to work in practice, and a board that trims compliance headcount or tooling can face that question after misconduct surfaces.

The Criminal Division’s Evaluation of Corporate Compliance Programs (ECCP), last updated in September 2024, is the document prosecutors use. It asks whether a program is well designed, whether it is adequately resourced and empowered, and whether it works. Its section on autonomy and resources looks at whether compliance staff are qualified, funded and independent of management.

That test sits alongside enforcement action decisions on charges, fines and monitors. A program judged effective at the time of the offense and at the time of resolution can reduce the penalty a company pays.

What Duva has said about compliance and enforcement

Duva has made the same case in other settings this year. At a May 7 event, he said: “This is the best time to have a robust compliance department. It can save your company a lot of money.” He also said “we’re seeing an uptick” in corporate prosecutions and that Foreign Corrupt Practices Act enforcement is again a central focus of the division.

At that event he urged companies to disclose misconduct once they have something concrete, rather than wait for an internal investigation to finish. “Don’t wait,” Duva said.

The two points connect. A company can only disclose early if its compliance function is staffed to detect problems early. Duva has framed compliance teams as partners in spotting misconduct, not as a cost line to be reduced when enforcement appears to ease.

The Corporate Enforcement Policy raises the stakes

On March 10, 2026, the Justice Department released its first Department-wide Corporate Enforcement Policy for criminal matters. It covers every component and US Attorney’s Office, except antitrust matters, and supersedes component-specific policies. The Criminal Division’s own policy dates to 2016 and was revised in May 2025.

Under Part I of the policy, DOJ will decline to prosecute a company that voluntarily self-discloses to a criminal component, fully cooperates, remediates in a timely and appropriate way, and has no aggravating circumstances.

Part II covers near misses. A company that self-reports in good faith but does not qualify as a voluntary disclosure, or that has aggravating factors, is generally offered a non-prosecution agreement. That agreement runs under three years, carries no independent compliance monitor, and cuts the fine by at least 50% and no more than 75% off the low end of the US Sentencing Guidelines range. The 2025 version fixed the cut at 75%.

The policy also widened the recidivism test to cover prior criminal resolutions within five years, or for similar misconduct regardless of timing. It requires whistleblower-related self-reports within 120 days of an internal report, as soon as reasonably practicable. Remediation standards in Appendix B did not change. They include root cause analysis and an effective, risk-based compliance program.

Todd Blanche, the Deputy Attorney General, said the policy “draws on decades of experience across the Department.” Duva said that “having helped craft the Department-wide policy, our prosecutors will continue to reward good corporate behavior.”

Third-party risk under the DOJ compliance program test

The venue matters. Third parties, including agents, distributors and resellers, are a recurring route for bribery and sanctions failures. The ECCP includes third-party management among the areas prosecutors probe, asking how a company assesses, oversees and monitors the parties it works through.

For teams running third-party risk management programs, resourcing decides how many suppliers get diligence beyond a questionnaire, and how often. A program that screens only the highest-risk vendors needs staff and data to justify that cut. The same applies to ongoing monitoring after onboarding.

Duva’s reference to AI- and cyber-powered crime also bears on the tools teams buy. Compliance functions that adopt AI for screening and monitoring will need people able to govern it. RegTech Post has covered what boards need to know about AI in third-party risk and how legal teams are approaching third-party risk in 2026.

What the funding message means for budget talks

The remarks give compliance leaders a documented DOJ view on compliance program funding to bring to budget committees. They do not set a spending level. Neither the ECCP nor the Corporate Enforcement Policy prescribes a headcount or a share of revenue, and DOJ judges resources against a company’s size, risk profile and operations.

Board reporting is where the argument is usually made. Committees that receive regular data on investigations, testing results, open remediation items and staffing gaps can show they weighed resourcing. Essential reporting for boards sets out what that information can look like.

The enforcement structure is also shifting. On October 1, the department’s new National Fraud Enforcement Division, led by Assistant Attorney General Colin McDonald, issued a memorandum on its corporate enforcement program. It directs prosecutors to follow the Department-wide policy and lists factors to weigh in corporate resolutions, including management involvement, concealment and the size of the loss.

Duva said at a September 30 event that the Fraud Division will generally handle matters in which the government was the victim, while other matters stay with the Criminal Division’s White-Collar and Enforcement Section. He acknowledged that procurement and health care fraud may fall under both. Companies that sell to the federal government may therefore face either component.

What to watch next

Watch for the Criminal Division’s next resolutions under the Department-wide policy, and for whether prosecutors cite compliance resourcing in declination letters and non-prosecution agreements. Those documents show how DOJ applies the autonomy and resources questions in practice. The Fraud Division’s first corporate resolutions under its October 1 memorandum will show how the two components divide the work.