A compliance agreement is a binding arrangement between a company or individual and a government agency that sets out exactly what the entity must do to resolve a regulatory or criminal matter without going to trial. It sits between full prosecution and no consequences at all: the government gets structural reforms, admissions, and often penalties; the entity gets a path that avoids a conviction, program exclusion, or other outcomes that could end the business. The specifics depend heavily on which agency is involved and how serious the underlying conduct was.
The Justice Department has described the trade-off plainly, saying these resolutions “can help restore the integrity of a company’s operations and preserve the financial viability of a corporation that has engaged in criminal conduct, while maintaining the government’s ability to prosecute a recalcitrant corporation that materially breaches the agreement.”1U.S. Department of Justice. Principles of Federal Prosecution of Business Organizations For regulators, that means real consequences without the collateral damage of a corporate collapse or a hospital shutdown. For the entity, it almost always beats the alternative, since criminal convictions can trigger automatic debarment from government contracts and loss of professional licenses.
The Main Types You Will Encounter
“Compliance agreement” is an umbrella term. Which type you are dealing with determines the stakes, the duration, and the enforcement mechanism.
Deferred Prosecution Agreements
A deferred prosecution agreement is the most structured version. The government files criminal charges in court, then suspends the prosecution for a set period while the company meets specific conditions. The authority for this comes from the Speedy Trial Act, which excludes from its time limits “any period of delay during which prosecution is deferred by the attorney for the Government pursuant to written agreement with the defendant, with the approval of the court.”2Office of the Law Revision Counsel. 18 USC 3161 – Speedy Trial Act Satisfy the conditions, and the charges get dismissed. Fall short, and the government can prosecute immediately.
DPAs almost always include an agreed-upon statement of facts describing the misconduct. The Justice Department’s policy is that every resolution should contain that statement along with an explanation of why prosecutors chose this route over indictment.1U.S. Department of Justice. Principles of Federal Prosecution of Business Organizations It is not a guilty plea, but it gives the government enormous leverage if the company later breaches.
Non-Prosecution Agreements
A non-prosecution agreement works similarly, with one key difference: no charges are ever filed. The government simply agrees not to prosecute as long as the entity meets the conditions. NPAs tend to show up where the company cooperated early, self-reported, or where the conduct was less severe. Because nothing is filed with a court, NPAs involve less judicial oversight than DPAs.
Corporate Integrity Agreements
In healthcare, the Office of Inspector General at the Department of Health and Human Services uses corporate integrity agreements to resolve fraud and abuse cases. The leverage here is statutory: under 42 U.S.C. § 1320a-7, the OIG can exclude individuals and entities from Medicare, Medicaid, and other federal healthcare programs.3Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs For most providers that would be fatal. The CIA offers a different path: “When an entity agrees to the obligations outlined in the Corporate Integrity Agreement, OIG agrees not to seek the entity’s exclusion from participation in Medicare, Medicaid, or other Federal health care programs.”4Office of Inspector General. Corporate Integrity Agreements
CIAs run for five years. They typically require hiring a dedicated compliance officer, retaining an independent review organization, submitting annual reports, and reporting events like overpayments and ongoing investigations.4Office of Inspector General. Corporate Integrity Agreements That five-year duration makes them among the longest compliance agreements in common use.
Consent Decrees
Consent decrees are compliance agreements entered as court orders. That distinction matters because violating one can be punished as contempt of court, which is faster and more powerful than filing a new lawsuit. A typical decree states that the government “retains and reserves all rights to enforce the provisions of this Final Judgment, including the right to seek an order of contempt from the Court.”5U.S. Department of Justice. United States Explanation of Consent Decree Procedures Consent decrees appear often in antitrust, environmental, and civil rights enforcement. The EPA uses related administrative settlement agreements and orders on consent to address cleanup obligations under statutes like CERCLA.6United States Environmental Protection Agency. Removal Action ASAOC
What the Agreement Typically Requires
Terms vary by agency and situation, but most compliance agreements share a common structure. The entity commits to concrete remedial actions: overhauling internal policies, training employees, strengthening financial controls, or restructuring reporting lines. These are specific, not aspirational. A well-drafted agreement spells out what has to change and by when.
Monitoring and verification provisions describe how the government will confirm the entity is actually doing what it promised. That might mean periodic self-reporting, independent audits, site inspections, or some combination. Timelines set the overall duration and the intermediate milestones.
The agreement also lays out what happens if the entity falls short. Penalties can include financial sanctions, revocation of the agreement itself, or the government proceeding with the enforcement action it originally held back. For a DPA, that means prosecuting the suspended charges. For a CIA, it means exclusion from federal healthcare programs.
When an Independent Monitor Gets Added
Some compliance agreements require the entity to accept an independent monitor, a third party (often a former prosecutor or senior regulator) who oversees the reform work and reports directly to the government. This is one of the most consequential terms an agreement can include, both operationally and financially.
Monitors are expensive. They usually bring in teams of consultants with industry-specific expertise, and for large corporations the costs can run into the tens of millions of dollars over a multi-year engagement. The entity has limited ability to control those costs once a monitor is in place, and monitors sometimes expand their scope beyond fixing the identified problems to recommending broader compliance improvements.
Current DOJ policy offers some relief. Under the 2025 Corporate Enforcement and Voluntary Self-Disclosure Policy, companies that fully cooperated and appropriately remediated the misconduct but narrowly missed qualifying for a declination will not be required to accept an independent compliance monitor.7U.S. Department of Justice. Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy For companies that did not cooperate or self-report, prosecutors keep full discretion over whether to impose one.
How the Negotiation Works
The process usually starts with an investigation. That might be an audit, a whistleblower complaint, a routine examination that turns up irregularities, or the company’s own internal discovery of a problem. Once the agency determines a violation occurred, it decides whether a compliance agreement is the right resolution. The factors include the severity of the conduct, whether anyone was harmed, the company’s history, whether it self-reported, and how fully it cooperated.
If the agency offers an agreement, negotiations open on the specific terms: what corrective actions are required, how long the agreement will last, whether a monitor is necessary, and what financial penalties apply. These negotiations can take months. During that period, the parties may enter into a tolling agreement, a separate arrangement that pauses the statute of limitations so the government does not lose the ability to bring charges if talks collapse. Tolling agreements identify the specific conduct and statutes being tolled, set start and end dates, and confirm that agreeing to toll is not an admission of guilt.
Once both sides agree, the agreement is signed and becomes binding. For a DPA, the charges are filed in court at the same time. For NPAs and administrative agreements, the resolution typically stays between the agency and the entity unless a court filing is required.
What Happens at the End, and What Breach Looks Like
If the entity satisfies every requirement within the timeframe, the agreement concludes and the matter is resolved. For a DPA, the government moves to dismiss the criminal charges, and the company walks away without a conviction. For an NPA, the commitment not to prosecute becomes permanent. For a CIA, the OIG’s threat of exclusion lifts.
Breach is a different story. If the entity fails to meet the terms, the government can pursue the original enforcement action with the added advantage of whatever admissions the entity made along the way. This is where the factual stipulations in a DPA bite hard: the company has already agreed to a detailed account of what it did wrong, so prosecution becomes much simpler. For consent decrees, the government can seek contempt of court and skip filing a new lawsuit altogether.5U.S. Department of Justice. United States Explanation of Consent Decree Procedures
How a Prior Compliance Program Changes the Picture
What a company did about compliance before anything went wrong affects both whether an agreement is offered and what the sentencing math looks like if a plea or conviction follows. The federal sentencing guidelines for organizations allow a three-point reduction in the culpability score when the company had an effective compliance and ethics program in place at the time of the offense.8United States Sentencing Commission. Annotated 2025 Chapter 8 – Sentencing of Organizations Because the culpability score drives the multiplier on the base fine, that reduction can mean millions of dollars less in penalties.
There is a catch. The credit does not apply if senior management participated in, condoned, or was willfully ignorant of the offense. A narrow exception survives if the compliance team had direct reporting access to the board, the program itself detected the misconduct before outsiders did, and the company promptly self-reported.8United States Sentencing Commission. Annotated 2025 Chapter 8 – Sentencing of Organizations The structure creates a strong incentive to build compliance programs that genuinely operate independently from the business units they oversee.
The same factor shapes whether a company gets offered a DPA or NPA at all. The Justice Manual directs prosecutors to weigh “the state of the corporation’s compliance program at the time of the underlying criminal conduct and at the time of the resolution” when choosing a resolution type.1U.S. Department of Justice. Principles of Federal Prosecution of Business Organizations A company that invested in compliance before the subpoena arrived negotiates from a very different position than one that did not.