Part 4 of 4 in a series drawn from the Barnes & Thornburg white paper “False Claims Act and Criminal Enforcement in the Tariff Context: Practical Guidance for Companies, Corporations, and Executives”

The Department of Justice (DOJ) evaluates the adequacy of compliance programs as a factor in enforcement decisions. A well-designed customs program therefore does double duty: it reduces the likelihood of violations, and it strengthens the company's position in any investigation that follows.

The inverse also holds. DOJ guidance treats the absence of an effective compliance program as one of the circumstances that makes individual executive liability most likely.

The Framework Prosecutors Use

The DOJ Criminal Division publishes the standard its prosecutors use to judge a compliance program, the Evaluation of Corporate Compliance Programs. It was written with foreign bribery and healthcare fraud in mind, but its principles apply with equal force to customs. It asks three questions: Is the program well designed? Is it adequately resourced and empowered? Does it work in practice?

Applied to customs, that means written policies covering classification, valuation, origin determination, and AD/CVD compliance; a compliance leader with real authority and board access; role-specific training for personnel involved in import operations; a confidential reporting channel; and regular reassessment. The guidance is explicit that a static program will be viewed skeptically.

One element deserves emphasis. Most customs fraud cases under the False Claims Act (FCA) — the government's main civil fraud statute — begin with a whistleblower rather than a government audit. An internal reporting channel that people actually use is therefore not a governance formality. It is the difference between hearing about a problem first and hearing about it from the government.

Policies Don't Fail. Controls Do.

Two control areas account for a disproportionate share of recent enforcement.

1. Classification and Valuation

Classification decisions should be documented, reviewed by qualified personnel, and re-evaluated as the tariff schedule and Customs and Border Protection (CBP) rulings change — with enhanced scrutiny where a classification produces a significantly lower duty rate. On the valuation side, declared values need to reconcile with commercial invoices and purchase orders, and related-party transfer pricing needs review against CBP's rules. The Global Office Furniture complaint, alleging one invoice for customer billing and a lower one for CBP, illustrates how DOJ characterizes double invoicing as deliberate fraud.

2. Broker and Third-Party Oversight

The importer of record remains responsible for the accuracy of entries regardless of who prepared them and cannot contract away its duty of reasonable care. Blind reliance on a broker's determinations does not insulate the importer. It can make matters worse: choosing not to look is itself a form of knowledge under the FCA, which treats deliberate ignorance the same as actual knowledge.

CBP Can Trace the Supply Chain

The FCA reaches anyone who causes a false claim to be submitted, not just the party that files it. An importer can therefore be liable for inaccurate entries that originate with its agents, contractors, or supply chain partners.

The government's expectations here are not subtle. The Trade Fraud Task Force's Resource Guide cautions that "[t]he era when a company can claim ignorance of its upstream partners' activities is over."

CBP has backed that up with technology. In October 2025, it contracted to deploy AI-powered supply chain mapping across its enforcement operations — a platform that examines billions of shipment records, resolves corporate identities across hundreds of millions of organizations, and reconstructs trade routes transaction by transaction to detect illicit transshipment.

DOJ expects compliance functions to keep pace. A company whose sales team runs on advanced analytics while its compliance team runs on spreadsheets will be viewed skeptically.

Two Ways to Come Forward, One Closing Window

There are two separate routes for reporting a customs problem voluntarily, and they are not interchangeable. Disclosing to CBP can reduce the penalties CBP itself imposes, but it does not resolve exposure under the False Claims Act. Disclosing to DOJ is a distinct process with its own requirements. The two should be coordinated.

DOJ's current policy is favorable to companies that qualify: absent serious aggravating facts, a company that discloses, cooperates, and fixes the problem should expect DOJ to forgo criminal charges — a stronger commitment than the policy previously offered. But the window closes without warning – as it did for Grosfillex. 

What Executives Should Document

Individual liability turns substantially on what an executive knew and what the record shows. That makes documentation a personal protection, not just a corporate one: attendance at compliance briefings and review of audit results; classification, valuation, and origin decisions made by qualified personnel and written down; and advice relied on from customs brokers, trade counsel, or CBP rulings, recorded at the time rather than reconstructed later.

And the obvious one, which recent enforcement suggests is not obvious enough: nothing that could look like interference with an investigation, including anything that touches the preservation of documents.

Where to Start

The worst time to build a response plan is the afternoon a government demand for documents arrives. The civil version, a civil investigative demand, carries a 20-day deadline for written objections. Routine document destruction has to stop immediately across every affected system. And the question of whether individual employees need their own lawyers should not be decided under time pressure.

Our white paper, False Claims Act and Criminal Enforcement in the Tariff Context, includes a phased response protocol covering the first 24 hours through document production — the kind of plan worth having before it is needed. It also provides a model compliance checklist across eleven functional areas, guidance on third-party due diligence and supply chain traceability, and an actionable checklist organized by responsible party: board and senior management, chief compliance officer, and operational management.