Insights

On October 20, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division announced a new whistleblower rewards initiative, the Fraud Whistleblower Incentive Program (WHIP). Assistant Attorney General Colin M. McDonald issued a directive earlier this month directing Division leadership to design and implement policies and programs that incentivize whistleblowers to bring forward credible information pertaining to fraud. The new WHIP incentive pays awards of $10,000 to $30,000 for qualifying tips at or around the time criminal charges are filed or unsealed, rather than years later at case resolution.

On October 1, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud. Assistant Attorney General Colin M. McDonald’s October directive follows his August 2026 memorandum setting the Division’s enforcement priorities. The directive signals — in the DOJ’s words — “an aggressive, all-tools” enforcement posture across the Division’s health care, government contracting, tax, and trade fraud priorities, while simultaneously supporting the incentives designed to promote transparency, reward cooperation, and encourage voluntary disclosure of misconduct. 

When federal law enforcement agencies issue subpoenas to companies for information about their customers, the subpoenas or cover letters often contain boilerplate nondisclosure language. This language generally directs companies not to notify those customers and implies that there may be legal consequences for doing so. But as two lawmakers recently called out in a formal letter to the U.S. Supreme Court and the U.S. Government Accountability Office (GAO), this boilerplate language may not carry the force of law.

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

It has been an eventful summer for followers of congressional oversight, with significant implications for individuals and organizations of all stripes. As we move closer to the midterms and then the 2028 general election, private entities both in the U.S. and overseas will find themselves increasingly pulled into the middle of clashes between Republicans and Democrats — and those disputes are inevitable, regardless of election outcome.

On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List, established through the Secure and Trusted Communications Networks Act to include foreign-produced connected power inverters and advanced robotic devices. The designation of these products to the Covered List follows an Executive Branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment listed on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products absent an exception or approval. This action comes only months after the FCC added consumer-grade routers to the Covered List on March 23, 2026 and uncrewed aircraft systems (UAS) on December 22, 2025. Taken together, these actions reflect the FCC’s increasingly expansive approach to using its authorities to guard against foreign produced connected technologies that may create vulnerabilities enabling disruption of critical infrastructure, unauthorized access to sensitive information, or cyber intrusions. The shift is a departure from the FCC’s previous focus on equipment and services produced by certain PRC and Russian companies.

On July 17, 2026, the United States Department of Justice (DOJ) announced that it had entered into a Deferred Prosecution Agreement (DPA) with The Scoular Company (Scoular), an agricultural supply chain company based in Omaha, Nebraska, to resolve allegations that Scoular relied on customs brokers to bribe Mexican government officials to allow Scoular goods to pass customs inspections and be delivered to Mexico from the United States. As part of its resolution, Scoular agreed to pay a $9,769,521 criminal penalty and forfeit an additional $414,351. Scoular also committed to continue cooperating with DOJ on any ongoing or future criminal investigations, implement a compliance and ethics program designed to prevent and detect violations of the Foreign Corrupt Practices Act (FCPA), and periodically report to DOJ on remediation and implementation of compliance measures throughout the term of the DPA.

On June 17, 2026, the U.S. Department of Justice’s (DOJ( National Security Division (NSD) announced that it had issued a declination for Robert Bosch GmbH (Bosch) relating to potential violations of the Export Control Reform Act, 50 U.S.C. § 4819 (ECRA). Specifically, the DOJ declined to criminally prosecute Bosch’s violations of the Export Administration Regulations’ (EAR) Foreign Direct Product Rule (FDPR), which apparently resulted from two Bosch subsidiaries’ export of products and software manufactured with equipment that was the direct product of U.S. software or technology to Huawei Technologies Co., Ltd. and its “Entity List” affiliates, including Huawei Tech. Investment Co., Ltd., Hong Kong (collectively, Huawei). The same day, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a parallel civil administrative settlement with Bosch.

On June 4, 2026, the U.S. Supreme Court unanimously held that the U.S. Securities and Exchange Commission (SEC) can continue to pursue disgorgement as an equitable remedy in securities fraud cases without showing pecuniary loss by investors. The Court’s ruling in Sripetch v. SEC resolves a split between the U.S. Court of Appeals for the Second Circuit, which concluded that the SEC must demonstrate pecuniary loss, and the U.S. Courts of Appeals for the First and Ninth Circuits, which declined to require such a showing.

Last week, the U.S. Department of Justice (DOJ) Antitrust Division (the Division) revealed criminal charges against China International Marine Containers (Group) Co., Ltd. (CIMC) and several other major Chinese companies and executives involved in the manufacture and sale of standard dry shipping containers, which are used for shipping dry, unrefrigerated cargo on ships around the world. One of the executives was arrested at an airport in France and is awaiting extradition to the U.S. The indictment charged these defendants with violating Section 1 of the Sherman Act by conspiring to restrict output and fix prices of standard dry containers, including in the U.S. market, from 2019 to 2024.

As companies and individuals increasingly embed AI tools in legal practice, courts are grappling with how to treat communications with, and information generated by, these tools. Chief among these questions is whether and in what circumstances attorney-client privilege and work-product protections as they are applied in different jurisdictions extend to AI-generated content or communications with an AI tool.

On April 7, 2026, Acting Attorney General Todd Blanche issued a memorandum establishing the National Fraud Enforcement Division (NFED) within the U.S. Department of Justice (DOJ). This new division will be dedicated to the centralized, coordinated investigation and prosecution of fraud against taxpayer dollars and taxpayer-funded programs. AAG Blanche acknowledged that, while DOJ has a “storied history of combatting fraud,” DOJ has “never adopted a comprehensive and coordinated approach to investigating and prosecuting fraud against taxpayer dollars and tax-payer funded programs.” The NFED was created to close that gap with its core mission being to “zealously investigate and prosecute those who steal or fraudulently misuse taxpayer dollars.”

On March 10, 2026, the Department of Justice released the first-ever Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (the “Department-wide CEP” or “Policy”), which applies to all non-antitrust corporate criminal cases across the Department. The new policy has been anticipated since December 2025, when Deputy Attorney General Todd Blanche announced the Department’s plans to release a new, single corporate enforcement policy for all criminal matters. According to the Department, the new policy is designed to “help ensure consistency across the Department” and “transparently describe the Department’s policies and decisionmaking.”

On January 14, 2026, State Senator Zellnor Myrie proposed legislation in the New York State Senate that would amend New York law to make it a criminal offense to operate a virtual currency business in New York without the proper license. By introducing the possibility of criminal penalties, Senate Bill S. 8901, the Cryptocurrency Regulation Yields Protections, Trust, and Oversight Act (CRYPTO Act), would mark a significant regulatory shift in the state’s oversight of virtual currency businesses, given New York’s prominence in virtual currency regulation in the U.S.

AI tools have significantly transformed how companies operate, but they come with serious legal risks that are only now taking shape. A recent ruling by a federal judge in the U.S. District Court for the Southern District of New York highlights one such risk: certain inputs and outputs from commercial AI models may not be considered privileged attorney-client communications or protected by the work-product doctrine.

On January 29, 2026, the U.S. Department of Justice (DOJ) Antitrust Division (Division) and U.S. Postal Service announced the first-ever payment under the antitrust whistleblower rewards program, awarding $1 million to an individual whose information led to a $3.28 million fine as part of a deferred prosecution agreement with EBLOCK Corporation, an online auction platform for used vehicles.

On January 13, 2026, Miami-based pharmaceutical wholesaler Atlantic Biologicals Corporation entered into a two-year DPA, admitting to conspiracy to distribute and dispense controlled substances, including more than 14 million opioid doses to “pill mill” pharmacies in Texas at a markup. The DOJ and DEA underscored the company’s deliberate evasion of compliance checks and disregard for red flags signaling diversion.

On January 8, 2026, the Trump Administration announced the creation of a new Division for National Fraud Enforcement within the Department of Justice (DOJ). The division will be led by a newly appointed Assistant Attorney General (AAG), pending Senate confirmation, who will report directly to both the President and Vice President and operate out of the White House. Such a reporting structure is unprecedented in the history of the DOJ.

On January 5, 2026, District of Colorado Magistrate Judge Cyrus Chung issued a recommendation that the district court grant a motion to quash a Department of Justice (DOJ) administrative subpoena that sought records about the provision of gender-related care by Children’s Hospital Colorado (Children’s) in In re: Department of Justice Administrative Subpoena No. 25-1431-030, U.S. District Court for the District of Colorado, No. 1:25-mc-00063. The court concluded that the DOJ had failed to carry its “light” burden, noting that no other courts that had considered the more than 20 similar subpoenas issued by DOJ had ruled in the DOJ’s favor.