Last One Standing: DOJ Narrows Fraud Enforcement Priorities to Companies that Violate the CSA and FDC Act

For the third time in this Administration, DOJ is directing its prosecutors to “take an aggressive, all-tools approach to investigating and prosecuting” certain categories of fraud.  Unfortunately, the health care and life sciences space has been singled out, and remains solidly in the crosshairs for white collar enforcement.

In May 2025, Assistant Attorney General Matthew Galeotti of the Criminal Division issued a memorandum listing 10 areas of white-collar crime that DOJ should prioritize.  That list included as number 1, “health care fraud,” and number 8, “[v]iolations of the Controlled Substances Act and the Federal Food, Drug, and Cosmetic Act (FDCA).” Then in April 2026, DOJ issued its first-ever Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) (see what we wrote about and what it means for FDA- and DEA-regulated companies).  And just last week, on October 1, 2026, Assistant Attorney General Colin M. McDonald, head of the Department’s National Fraud Enforcement Division, issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud, that identifies just four areas that prosecutors should prioritize for corporate investigation.  The key takeaway for our clients: health care fraud, drug diversion, and Federal Food, Drug, and Cosmetic Act violations now headline DOJ’s narrowed list of enforcement priorities.  We routinely handle internal investigations into alleged violations of these laws and regulations for the FDA- and DEA-regulated industry, and we are well-prepared to advise on the predicted expansion of corporate prosecutions for this underlying conduct.

What’s New

1. Centralized oversight. All Criminal Division corporate fraud matters now route through the Division’s Corporate Enforcement Section, and Fraud Division prosecutors must notify the Corporate Enforcement Section of new corporate investigations or major developments in ongoing corporate cases.  The Corporate Enforcement Section is also tasked with primary responsibility for any post-resolution compliance monitoring.
2. Health care and drug enforcement is priority one. Of the four listed priorities, health care fraud, controlled-substance distribution, and Federal Food, Drug, and Cosmetic Act violations come first, ahead of government procurement fraud, revenue evasion, and trade/tariff fraud, a direct signal that FDA- and DEA-regulated companies top the Division’s target list.
3. Ten weighting factors. Prosecutors must give “great weight” to ten listed factors when determining whether to bring charges or negotiating plea or other agreements. Relevant factors include management’s knowledge of the scheme, efforts to conceal the scheme from regulators, conduct lasting three-plus years, multi-district conduct, and losses of $25 million or with 25+ victims, among others.
4. Whistleblower incentives. The directive again pushes for policies rewarding whistleblowers, including participants in the misconduct, paired with expanded data analytics through the National Fraud Detection Center.

Why It Matters for Our Clients

Directive 26-12 does not change the CEP itself; it tells prosecutors how to apply it, with health care, drug diversion, and FDA regulation front and center. For pharmacies, distributors, manufacturers, and health systems, several weighting factors, especially multi-year conduct, multi-district reach, and loss or victim thresholds, are the kind of facts that routinely arise in health care fraud and diversion investigations. Companies should assess early whether they have engaged in conduct that implicates these factors, as that shapes both resolution leverage and the self-disclosure calculus.

As we noted in April, the CEP’s core path to the best outcome remains voluntary self-disclosure, full cooperation, timely remediation, and the absence of aggravating circumstances. With the Division emphasizing whistleblower tips and data analytics, misconduct is more likely to reach DOJ from a source other than the company. Companies already subject to FDA or DEA reporting obligations should keep asking whether an internally identified issue warrants escalation to a voluntary self-disclosure before DOJ hears about it elsewhere.

We will continue to track how the Corporate Enforcement Section applies this directive to health care and controlled-substance matters, and we are happy to discuss how it bears on your company’s facts.