Enforcement Insights Q2 2026

Welcome to the latest edition of Enforcement Insights, and our first as Hogan Lovells Cadwalader. As we embark on this exciting new chapter as a combined organization, we look forward to continuing to share our insights.

In this edition, we cover key developments shaping the current enforcement environment, including the U.S. Department of Justice (DOJ) National Security Division's first declination under the new Department-wide Corporate Enforcement Policy, continued DOJ reliance on qui tam relators, notable False Claims Act and Foreign Corrupt Practices Act enforcement trends, evolving U.S. Securities and Exchange Commission (SEC) enforcement priorities, and recent sanctions enforcement activity.

DOJ National Security Division issues its first declination under new Department-wide CEP

As discussed in our Q1 2026 edition, the Department of Justice (DOJ) announced a Department-wide Corporate Enforcement Policy (CEP) in March 2026, which provides that companies will receive a declination if they voluntarily self-disclose, fully cooperate, and timely and appropriately remediate misconduct, and may receive a declination even where aggravating factors are present. On June 17, 2026, the DOJ National Security Division announced its first declination under the new CEP, resolving an investigation into Robert Bosch GmbH (Bosch) for potential violations of the Export Control Reform Act (ECRA). Assistant Attorney General for National Security John A. Eisenberg stated the “declination reflects the clear benefits for companies that promptly disclose potential violations and fully assist in our investigations.”

According to DOJ’s public statements, its investigation revealed that Bosch, through two of its non-U.S. based subsidiaries, re-exported over $70 million worth of foreign-produced software and Micro-Electro-Mechanical Systems sensor products to Huawei Technologies Co., Ltd. and certain of its affiliates. Although the re-exported products were foreign-produced, they were subject to the Export Administration Regulations (EAR) pursuant to the Foreign Direct Product Rule (FDPR). Under the FDPR, products that meet the product-scope test and end-user test are subject to the EAR. Products satisfy the product scope test if it they are (i) direct products of technology or software subject to the EAR and classified under a certain Export Control Classification Number (ECCN); or (ii) produced by any plant or major component of a plant when the plant or major component of a plant itself is a direct product of U.S. origin technology or software that is classified under a certain ECCN. The end-user test is met if (i) the products will be incorporated into, or will be used in the production or development of any part, component, or equipment produced, purchased, or ordered by any entity with a Footnote 1 designation on the Bureau of Industry and Security (BIS) Entity List; or (ii) such entity is a party to any transaction involving the products. Despite being subject to the EAR pursuant to the FDPR, Bosch re-exported the products without obtaining the required license or other authorization from BIS, in violation of the EAR. DOJ noted that these violations occurred because Bosch’s trade compliance personnel were not adequately equipped to provide advice and guidance on the FDPR.

Consistent with the CEP, DOJ credited Bosch’s prompt internal investigation, timely and voluntary self-disclosure to both BIS and the DOJ National Security Division Counterintelligence and Export Control Section, full and proactive cooperation with the government’s investigation, and lack of aggravating circumstances. DOJ also highlighted Bosch’s timely and appropriate remediation efforts, including updating its policies and procedures and adding 66 employees and making other organizational changes to its trade compliance group. In connection with the declination, Bosch agreed to disgorge the $11,430,098 in profits it made as a result of the transactions, a portion of which will be credited toward the $36,184,680 penalty imposed on Bosch by BIS for civil violations of the ECRA and EAR.

New DOJ initiatives demonstrate continued reliance on qui tam relators

Amidst heightened enforcement of the False Claims Act (FCA), the DOJ announced two new policy initiatives aimed at streamlining the identification and prioritization of credible qui tam filings.

On April 30, DOJ launched a Fraud Oversight through Careful Use of Statistics (FOCUS) initiative. The FOCUS initiative addresses the growing number of qui tam complaints brought by “data miners” leveraging publicly available information to identify potential fraud. According to the DOJ, it received nearly 1,300 qui tam complaints in fiscal year (FY) 2025, up from 980 complaints in FY 2024. As of April 30, 2026, the DOJ reported having received 780 qui tam complaints in FY 2026, putting it on track to outpace the results of 2025. DOJ attributed more than 45% of all qui tam complaints since FY 2024 to data miners. Accordingly, the FOCUS initiative offers guidance to prospective data miner relators on how to successfully bring a qui tam action and further invites potential relators to meet with the Civil Division Fraud Section to discuss how their data correlates to potential fraud, emphasizing that it will prioritize working with relators who can show sophisticated analysis as well as a strong understanding of relevant regulatory frameworks. Companies can expect the new initiative will result in the filing of stronger qui tam complaints by data miners and the continued reliance on data analytics by the DOJ as a means to identify and combat fraud.

Separately, in May, Assistant Attorney General Brett A. Shumate of the Civil Division issued a memo prioritizing and accelerating the review of new FCA qui tam actions alleging fraud against federally funded, state-administered benefits. The memo instructs DOJ attorneys, to the maximum extent possible, to complete the review of new qui tam complaints involving federally funded, state-administered benefits programs within 60 days, and not later than 120 days. Within that same 60-to-120 day period, DOJ must also decide whether it will 1) permit the relator to proceed as the primary litigant; 2) conclude the allegations warrant further government investigation; or 3) determine the qui tam complaint should be dismissed under 31 U.S.C. § 3730(c)(2)(A). Cases selected for further government investigation will be expected to proceed on an expedited 120-day timeline. DOJ noted that while this new protocol is likely to increase the number of benefit fraud cases handled solely by relators, it anticipates DOJ attorneys will continue to primarily investigate the majority of incoming qui tam complaints. Together, the two new initiatives demonstrate DOJ’s continued reliance on and willingness to partner with relators.

False Claims Act enforcement blazes on

FCA enforcement continued at a robust pace throughout the second quarter of 2026. In April, the DOJ announced a settlement with IBM, its first FCA resolution under the Civil Rights Fraud Initiative, which it launched in May 2025 to investigate and pursue claims against any recipient of federal funds that knowingly violates federal civil rights laws. As part of that settlement, IBM agreed to pay $17.1 million to resolve allegations that it failed to comply with anti-discrimination provisions incorporated into its federal contracts. The settlement demonstrates DOJ’s willingness to use the FCA expansively as a means to enforce compliance with anti-discrimination laws.

In May, the DOJ announced a $549.5 million dollar settlement with Perfectus Aluminum Inc., Perfectus Aluminum Acquisitions LLC, and four related warehouse companies, resolving allegations that they knowingly evaded antidumping and countervailing duties on Chinese aluminum extrusions by mischaracterizing the imported products on customs forms. The Perfectus settlement marks the largest ever customs-related FCA recovery in U.S. history, nearly $500 million in excess of the previous largest customs-related FCA settlement, which we reported on in January. The settlement followed criminal convictions related to the same conduct and resolved three FCA qui tam suits. Also in May, the DOJ announced a $19 million settlement with two Canadian steel companies, Farjess Inc. and Royal Canadian Steel Inc., and their president, resolving allegations that they knowingly misrepresented the steel’s country of origin as Canada or the U.S. to avoid tariffs. Both matters resulted from qui tam complaints and were coordinated through DOJ’s Trade Fraud Task Force, demonstrating DOJ’s continued emphasis on combatting trade fraud.

On June 18, DOJ announced an FCA settlement with LOGZONE Inc., an Alabama-based defense contractor. As part of the settlement, LOGZONE agreed to pay $507,144 to resolve FCA allegations that it knowingly failed to implement certain cybersecurity requirements in two contracts with the Department of the Navy. The settlement is yet another example of increased cybersecurity enforcement through use of the FCA, regardless of the occurrence of an actual cybersecurity breach.

In the health care industry, DOJ announced nine FCA settlements resolving allegations relating to the submission of false claims premised on medically unnecessary procedures, unlawful kickbacks, and overcharging Medicare. Collectively, those settlements resulted in the collection of approximately $189.5 million in penalties. Notably, Oglethorpe Inc., a Tampa-based operator of psychiatric hospitals and substance abuse treatment facilities, settled its second FCA case in the last five years, agreeing to pay $32 million to resolve allegations that it failed to return Medicare overpayments identified by the company’s consultants. Oglethorpe was also found to be in violation of the corporate integrity agreement it entered into in connection with its 2021 FCA settlement, and as a result, entered into a

10-year voluntary exclusion agreement, pursuant to which Oglethorpe will be excluded from all federal health care programs for a period of 10 years. For a provider whose business includes inpatient psychiatric and substance abuse treatment, the exclusion is a particularly significant consequence and underscores the risks companies face when they fail to comply with obligations imposed as part of a prior FCA resolution.

Most recently, on June 23, DOJ announced its 2026 National Health Care Fraud Takedown, which resulted in the charging of 455 defendants, including 90 doctors and other licensed medical professionals, in alleged health care fraud and opioid-abuse schemes involving more than $6.5 billion in false claims. DOJ described the takedown as involving extensive national and international coordination, spanning 56 federal districts and 45 states and territories, with the largest level of Medicaid Fraud Control Unit participation in any national health care fraud takedown to date. DOJ also emphasized its continued use of data analytics to identify and pursue major fraud schemes, including cases involving wound-care products, hospice and Medicaid fraud, telemedicine, durable medical equipment, and illegal opioid distribution.

FCPA enforcement update

Following the Foreign Corrupt Practices Act (FCPA) pause and DOJ’s issuance of its revised FCPA enforcement guidelines, DOJ indicated that it “will firmly – but fairly – prosecute foreign bribery cases consistent with the Guidelines.” DOJ’s targeted FCPA enforcement approach continued throughout the second quarter, although no new FCPA-related investigations or actions were publicly reported.

On May 14, 2026, Methode Electronics, Inc. (Methode) disclosed in a Form 8-K that the SEC had notified the company that it was closing its investigation into potential FCPA violations without filing an enforcement action. Methode, a Michigan-based global supplier of mechatronic products to original equipment manufacturers in the automotive, commercial vehicle, and aerospace industries, had previously disclosed in public filings that the SEC had issued subpoenas in November 2024 and March 2025 to investigate potential violations of the FCPA and other anti-corruption laws.

On May 18, 2026, DOJ moved to dismiss the criminal charges against Gautam Adani, Sagar Adani, and seven other individuals with prejudice, after indicting them in October 2024 with conspiracy to violate the FCPA, as well as securities fraud, wire fraud, and conspiracy to obstruct justice. The DOJ stated that it had decided, in its exercise of prosecutorial discretion, not to devote further resources to prosecuting the criminal charges. DOJ’s motion remains pending before Judge Nicholas Garaufis in the Eastern District of New York and Judge Garaufis has ordered DOJ to supplement its motion with every reason for dismissal of each count against each defendant with “sufficient factual support for each basis.” DOJ’s motion was filed on the same day as the Department of Treasury’s $275 million settlement with Adani Enterprises Limited for 32 alleged violations of OFAC’s Iran Sanctions between November 2023 to June 2025 (described in further detail below), and four days after the SEC announced that it was moving for the entry of final judgments by consent against Gautam Adani and Sagar Adani, imposing injunctions and civil monetary penalties of $6 million and $12 million, respectively for making false and misleading statements in connection with a 2021 bond offering by Adani Green Energy Ltd.

SEC announces intent to review enforcement processes and reiterates the end of regulation by enforcement

Amidst slowed enforcement activity, the SEC appointed David Woodcock as the Director of the Division of Enforcement, following the resignation of the Honorable Margaret Ryan. Woodcock, who previously led the SEC’s Fort Worth Regional Office from 2011 to 2015, assumed the position on May 4 following a stint in private practice. In remarks at the May 13, 2026 MFA Legal & Compliance Conference, Woodcock vowed “to return the enforcement program back to basics,” echoing prior messaging from SEC Chairman Paul Atkins. Woodcock detailed enforcement priorities the Division intends to aggressively pursue, including offering fraud, accounting and disclosure fraud, market manipulation, fraud by foreign actors targeting U.S. markets and investors, and breaches of fiduciary duties by advisers misusing client assets. Woodcock further encouraged any potential wrongdoers to cooperate, self-disclose and remediate any wrongdoing.

In remarks at the Economic Club of New York on June 30, Atkins announced his intent to conduct a thorough review of SEC enforcement processes as part of a larger effort to modernize the SEC’s rulebook and promote innovation. Atkins further reiterated the current SEC’s enforcement priorities, noting a shift away from “regulation by enforcement” and the prioritization of cases relating to investor harm, including fraud, market manipulation, and abuse of trust.

Sanctions enforcement update

On May 1, 2026, Executive Order 14404 was issued, significantly expanding OFAC’s Cuba sanctions program to authorize the imposition of secondary sanctions on non-U.S., non-Cuban persons pursuant to the International Emergency Economic Powers Act (IEEPA). In the second quarter of 2026, OFAC continued to implement its “Economic Fury” program to disrupt Iran’s military and weapons programs, including by targeting Iranian shadow banking and procurement networks, and by tightening controls on the transport, sale, and refining of Iranian oil. In addition, OFAC published a new “Introduction to the Office of Foreign Assets Control,” which provides an overview of how U.S. sanctions operate, OFAC’s expectations for risk-based compliance programs, and factors OFAC considers when weighing an enforcement action. Finally, OFAC announced two significant settlements that are discussed below.

On May 18, OFAC announced that Indian company Adani Enterprises Limited agreed to pay $275 million to resolve 32 apparent violations of U.S. sanctions related to Iran. OFAC alleged that, between November 2023 and May 2025, Adani purchased liquefied petroleum gas (LPG) from a Dubai-based trader that represented the cargo as originating in Oman or Iraq, when the LPG actually originated from Iran. As a result, OFAC alleged that Adani caused U.S. financial institutions to process approximately $192 million worth of payments in connection with the shipments. According to OFAC, Adani overlooked warning signs, including third-party concerns about the cargo’s origin, suspicious vessel activity, questionable shipping documents, and prices well below market rates. OFAC determined that the apparent violations were egregious and not voluntarily self-disclosed, but cited cooperation from the company. The settlement underscores that companies – including non-U.S. companies that work with U.S. financial institutions – cannot rely solely on documentation or counterparty assurances when other facts suggest a potential sanctions risk.

On June 1, OFAC announced that a global consulting firm agreed to pay $1.05 million to resolve potential liability for alleged violations of sanctions targeting Russia’s financial sector. OFAC alleged that, between April 2019 and May 2021, the consulting firm indirectly extended prohibited credit to VTB Bank OAO, a U.S. sanctioned bank in Russia, by providing consulting services through a law firm and invoicing for those services. The consulting firm invoiced the law firm, but the firm was required to pay the consulting firm only after first receiving payment from VTB. When VTB failed to pay the consulting firm’s invoices and the consulting firm continued working while invoices remained outstanding for more than the 14 days permitted by Directive 1 under Executive Order 13662, OFAC considered that the consulting firm was indirectly extending debt to VTB for longer than the permitted time period. OFAC determined that the apparent violations were non-egregious and not voluntarily self-disclosed. The settlement underscores OFAC’s principle that one is prohibited from doing indirectly what one cannot do directly.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.