SDNY’s Recent Corporate Self-Disclosure Policy: Can Anything Be Learned From the First Conditional Declination? 

When it launched on February 24, 2026, the Southern District of New York (SDNY)’s new Corporate Enforcement and Voluntary Self-Disclosure Program for Financial Crimes (the SDNY Program) promised swift, certain leniency for companies that self-report financial misconduct. That promise quickly came to fruition on May 19, 2026, when, just weeks after Telekom Malaysia Berhad self-reported internal fraud to the U.S. Attorney’s Office, it received a conditional declination, and three of its former senior employees were indicted for allegedly misappropriating over $20 million in company assets. The speed of this outcome—arrests within two to three weeks of the company’s self-report and a public indictment unsealed six weeks later—is a concrete illustration of the benefits potentially available to companies that come forward. 

While this matter demonstrates that the SDNY is implementing its promised policy, it still raises questions for companies as to whether a declination will be provided. Based on the information available, the Telekom Malaysia case involved employee theft from the company, which is arguably the most favorable fact pattern for self-disclosure. Future cases in which fraud was undoubtedly committed for a company’s benefit will likely present closer, more fact-specific assessments, including the extent of the company’s potential exposure, in determining whether a company may benefit from the SDNY Program.

Background: The SDNY’s New Self Disclosure Program

On February 24, 2026, the U.S. Attorney’s Office debuted the SDNY Program, which applies broadly to financial fraud—defined expansively to include “all manner of intentionally deceptive conduct” including corporate fraud, securities and commodities fraud, and digital asset fraud (but not FCPA, public corruption, national security, or violent crimes).

The most significant innovation of the SDNY Program is the purported certainty and swift resolution it offers. Under traditional voluntary self-disclosure frameworks, companies that came forward faced months or even years of uncertainty about whether they would receive a declination. The SDNY Program promised that qualifying companies would receive a conditional declination letter within two to three weeks of a qualifying self-disclosure, which becomes final upon the company’s completion of its cooperation, remediation, and restitution obligations. Notably, the SDNY Program does not extend to individuals. In fact, it explicitly encourages companies to identify wrongdoers, who remain subject to prosecution.

The SDNY Program also expands eligibility in meaningful ways compared to the DOJ’s broader department-wide Corporate Enforcement Policy (CEP), which has existed in various iterations since 2016 and was adopted department-wide on March 10, 2026:

• No disqualification for senior-level misconduct: Traditionally, fraud that involves senior-level management or is pervasive throughout an organization typically foreclosed a declination. The SDNY Program eliminates that disqualifier.
• No disqualification where a government investigation is already underway, so long as the company is unaware of that investigation when it self-discloses. In contrast, the CEP adopts a meaningfully narrower standard: the DOJ must not be aware of the misconduct for a disclosure to qualify.
• No criminal fines or corporate monitorship for companies that receive a declination and fulfill restitution obligations under the SDNY Program. Under the CEP, companies eligible for a declination may still be required to pay forfeiture and disgorgement in addition to restitution. 

Until last week, it was an open question as to whether the SDNY Program survived the DOJ’s broader adoption of the CEP. However, the Telekom Malaysia resolution, discussed below, demonstrates that the SDNY Program remains operative, echoing comments from the District’s United States Attorney, Jay Clayton, that reports of the CEP superseding the SDNY Program were “fake news.” Whether the tension between the two policies will come to a head remains to be seen. 

The SDNY Program’s First Resolution: United States v. Lockman, Yusof & Nguyen

On May 19, 2026, the SDNY unsealed an indictment against three former senior managers of Telekom Malaysia (USA) Inc., the wholly owned U.S. subsidiary of Telekom Malaysia Berhad, a major Malaysian telecommunications company. The defendants—Mohd Hafiz Lockman, Mohd Yuzaimi Yusof, and Khanh Thuong Nguyen—are charged with wire fraud conspiracy, wire fraud, and aggravated identity theft. Over nearly six years, these individuals allegedly misappropriated more than $20 million through unauthorized asset sales, inflated invoices, and ghost employees. Most brazenly, they allegedly used an AI deepfake to impersonate a departed employee during a live HR video call.

Upon discovering the fraud, Telekom Malaysia Berhad conducted an internal investigation, self-reported to the SDNY in early April 2026, and has continued to cooperate with the ongoing investigation. In exchange, it received a conditional declination of charges conditioned on full cooperation, restitution, remediation, and a three-year obligation to report further criminal conduct. Arrests followed within weeks of the self-report, and the indictment was unsealed on May 19, 2026, roughly six weeks after disclosure.

Why This Case Matters

When the SDNY announced its Program in early 2026, some questioned whether it would deliver in practice. The Telekom Malaysia case provides an early but concrete confirmation: the SDNY moved from company self-report to federal arrests in approximately two to three weeks, and to a public indictment in approximately six weeks.

Under traditional DOJ practice, the involvement of senior managers might have foreclosed a corporate declination entirely. That Telekom Malaysia nonetheless received one confirms that senior-level misconduct is not disqualifying under the SDNY Program, at least at that level. Because the defendants were not C-suite executives of the parent company, however, this case does not fully test the outer limits of that commitment, and future cases involving fraud directed by parent-company executives will provide a more definitive test. 

This result must also be analyzed in the context of the particular facts present. The underlying fraud was employee theft from the company, making Telekom Malaysia the victim rather than the beneficiary of misconduct. In other words, the company’s interests were aligned with the government’s, meaning that any restitution flowed back to the company itself. This raises the question as to whether undisclosed facts made a declination necessary in this case.  Regardless, cases involving fraud committed for a company’s benefit, such as accounting fraud or regulatory violations undertaken to reduce cost, will present more complex self-disclosure calculations.

Key Takeaways

• Act quickly. The SDNY program requires disclosure before receiving a subpoena or learning of a government investigation, and that window is narrowing. The DOJ has significantly expanded its ability to detect fraud independently of company reporting: the recently announced National Fraud Enforcement Division deploys a multi-agency data analytics team specifically designed to identify fraud before companies come forward. Separately, the DOJ’s Civil Division announced an initiative in late April 2026 to prioritize whistleblower and qui tam actions by third-party data miners who use analytics to root out fraud that would otherwise go undetected. These developments mean that companies may have less time to self-report than in the past, and there may be a higher likelihood of the government discovering the conduct.    
• The benefit is front-loaded, but so are the obligations. Eligible companies receive a conditional declination letter promptly at the outset, not at the end, removing the uncertainty that previously made self-disclosure unattractive. However, companies that receive this kind of declination have a three-year commitment to report any further criminal conduct by the company or its employees, and failure to meet these conditions could result in revocation of the declination and prosecution of the company itself.
• A declination is not a clean slate. The conditional declination binds only the SDNY, and does not affect other federal agencies, state regulators, or foreign authorities. Disclosure could also increase exposure to civil litigation. 
• Not every case is Telekom Malaysia. The SDNY Program worked cleanly here because the fraud was employee theft—the company was the victim, its interests were aligned with the government’s, and the wrongdoers were identifiable. Cases involving fraud committed for a company’s benefit will present harder questions.
• The relationship between the SDNY Program and the DOJ’s CEP is unresolved: The department-wide CEP purports to supersede the SDNY Program’s more generous terms, but the Telekom Malaysia resolution suggests the SDNY has continued to apply its own framework. Companies should monitor how this tension is resolved in future cases and discuss with counsel which set of terms is likely to apply.
• Self-disclosure remains a complex decision requiring counsel. Despite the incentives, self-disclosure carries significant risks, and financial and collateral consequences that require careful analysis. The Telekom Malaysia case is a best-case scenario for a company that moved decisively with good facts, but not every case may be so straightforward.

Ballard Spahr’s White Collar Defense and Investigations Group has robust experience in advising public and private sector clients in navigating these issues. Please contact us if we can assist you with advice and counsel regarding such matters or in responding to active inquiries, investigations, or proceedings.

Copyright © 2026 by Ballard Spahr LLP.
www.ballardspahr.com
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.