Authors: William J. Stellmach, Michael S. Schachter, Jason Linder, Sonali D. Patel, Robert J. Meyer, Soumya Dayananda, Andrew English, Koren Bell, Marina A. Torres, Rita D. Mitchell, Juliet Gunev, Gasey E. Donnelly, Sean Sandoloski, and Adrian F. Geilen
On October 7, 2026, Assistant Attorney General Colin M. McDonald of the Department of Justice’s (“DOJ” or the “Department”) National Fraud Enforcement Division (the “Fraud Division” or “Division”) issued Directive 26-13: A Comprehensive Approach in the Fight Against Fraud (the “Directive”),[1] which the Department publicly announced the following day.[2] The Directive builds on the Division’s previously announced priorities and its recently announced Corporate Enforcement Directive 26-12, and it sets out the prosecutorial methodology that Division attorneys are expected to follow when “investigating, disrupting, and prosecuting fraud.”[3] The Department has described the Directive as marking “a significant operational shift.” We are inclined to agree. In several respects, it signals a materially more aggressive posture in fraud matters, including with regard to charging, pre-indictment asset seizure, cooperation, pretrial detention, and sentencing advocacy. his update provides background on the Directive, summarizes its principal components, and recommends action items for companies and employees.
Key Takeaways
- The Division is directing prosecutors to charge fraud “from all angles.” Prosecutors must consider the most serious alleged offense that is both encompassed by the defendant’s conduct and likely to result in a sustainable conviction and, in every case, affirmatively assess whether an internal revenue violation occurred—inviting IRS Criminal Investigation (“IRS-CI”) in where tax charges could advance the investigation or asset recovery.
- Asset seizure and disruption are priorities, and prosecutors should be considering them at the outset of every matter. The Directive prioritizes early, pre-indictment restraint and seizure of accounts, cryptocurrency wallets, and securities, as well as takedowns of websites, domains, and other digital infrastructure, so that schemes are halted and assets frozen at the front end of an investigation.
- Corporate actors remain squarely in scope. The Directive cross-references the early-October Corporate Enforcement Directive and reiterates that the Division will “zealously” prosecute corporate actors that defraud taxpayers and the United States, while crediting companies that disclose, cooperate, and remediate.
- Individuals face heightened arrest and detention exposure. Prosecutors are told to build a record on flight risk and danger—including means, foreign ties, travel documents, asset mobility, and obstruction risk—from the outset of an investigation and to seek arrest warrants and detention in appropriate cases.
- Sentencing advocacy is expected to be robust. Prosecutors “must not be mechanical” at sentencing. And they are also instructed to be aggressive; prosecutors are told to seek all supported Guidelines enhancements, oppose unwarranted reductions, seek approval to pursue upward variances or departures where the advisory Guidelines range is inadequate, and seek restitution, forfeiture, fines, and other financial penalties that reflect the full scope of the offense.
Background: A New Division with Broad Delegated Authority
As we have previously discussed, the Fraud Division was formally established by a Department final rule published on August 18, 2026, and effective August 24, 2026, as part of what the Department described as a revamped approach to investigating and prosecuting fraud against taxpayer dollars and taxpayer-funded programs.[4] The rule delegates to the Division a broad portfolio: criminal fraud proceedings; criminal proceedings under the internal revenue laws; trade fraud matters involving imports, customs duties, tariffs, external revenue, and foreign commerce; proceedings involving monies owed to or paid by the United States; and fraud or abuse involving health plans, health care fraud, and controlled-substance distribution and diversion schemes.[5] The Directive frames the enforcement problem in substantial terms, estimating that fraud costs the federal government between $233 billion and $521 billion annually and stating that the Division will use “every available tool” to identify the full scope of fraud schemes; hold accountable persons and entities that knowingly enable, facilitate, conceal, or profit from them; dismantle the networks, infrastructure, and financial channels that sustain them; and advocate at sentencing for accountability, deterrence, victim protection, and financial recovery.[6]
“Attacking Fraud from All Angles”
Section I of the Directive instructs prosecutors to consider the most serious, sustainable charge that vindicates the interests of the government and victims. While the Directive acknowledges that familiar charges—wire fraud, health care fraud, and major fraud against the United States—will often suffice, it presses prosecutors to layer additional charges where doing so will dismantle a scheme or network, maximize recoveries, or secure justice.
Two instructions warrant particular attention from companies and counsel:
- Mandatory tax screening. In every case, prosecutors must assess whether a violation of the internal revenue laws occurred. If tax charges may materially advance the investigation, prosecution, or asset recovery, prosecutors are to invite IRS-CI to evaluate the tax dimensions and, if IRS-CI joins, to work with the Division’s Tax Section. Conduct that a company has scoped as a billing, procurement, or disclosure problem should now be evaluated for potential tax implications.
- Securities and market misconduct tied to the public fisc. The Public Trust and Financial Integrity Section is directed to prioritize securities fraud and market misconduct relating to government programs or contracts, schemes to defraud the United States, foreign investment schemes targeting the federal government, schemes targeting U.S. service members, and schemes involving health care, tax, or trade fraud—using “analytical capabilities to correlate federal program, contract, and funding data against market activity.”
The Directive’s guidance as to consumer fraud and cybercrime is similarly tethered to the public fisc. The Division’s consumer-facing work will focus on scams relating to government programs or contracts; health care, consumer product, medical device, and pharmaceutical schemes; schemes targeting service members; and schemes to defraud the United States. Prosecutors are told to evaluate consumer-focused charges including mail, wire, and bank fraud, identity theft and aggravated identity theft, access-device fraud, and offenses involving fraudulent identification documents, and to coordinate with investigative, civil, and regulatory partners to stop ongoing harm, preserve evidence, identify victims, and pursue remedies.
Early Asset Seizures, Injunctions, and Digital Takedowns
Perhaps the most operationally significant portion of the Directive is its instruction to prioritize early seizure of fraud proceeds and early disruption of schemes in close coordination with the Division’s Asset Recovery Section. The Directive catalogs the tools prosecutors are expected to deploy:
- restraining orders and seizure letters to freeze assets held at banks and cryptocurrency exchanges;
- seizure warrants and in rem forfeiture proceedings directed at accounts, cryptocurrency wallets, securities, and other instruments and assets—before charges are filed;
- warrants to seize websites, domains, online accounts, domestic and international satellite and cellular terminals and related U.S.-based service accounts, and other digital property;
- civil actions for restraining orders to prevent dissipation of proceeds or equivalent value in banking and health care matters;
- civil injunction actions under the Division’s delegated authority; and
- civil prejudgment remedies, including attachment, garnishment, sequestration of income, and the appointment of receivers.
For companies, the practical consequence is that a Fraud Division investigation may include asset freezes, domain seizures, or civil restraining orders that disrupt operations and complicate payroll, vendor relationships, and financing before any final case resolution. Counsel should assume that the Division may pursue disruptive asset-recovery and infrastructure remedies early in an investigation, leaving less time to shape the factual narrative before operational disruption occurs.
Proactive Cooperators and Corporate Enforcement
The Directive observes that fraudsters frequently operate with co-conspirators, distributed fraud networks, and transnational criminal organizations offering “crime-as-a-service,” and it urges prosecutors to leverage proactive cooperators and undercover operations. At the same time, it sets conditions: cooperating fraudsters must accept responsibility, including forfeiture of property with a nexus to the offenses of conviction and restitution to victims. Prosecutors may bring substantial assistance to the court’s attention and are directed to consider whether the cooperation disclosed previously unknown criminal activity or materially advanced an investigation, a seizure, the conviction of others, or the disruption of ongoing harm.
On corporate enforcement, the Directive cross-references the Corporate Enforcement Directive and confirms that the Division will zealously prosecute corporate actors that defraud taxpayers and the United States, while crediting companies that disclose misconduct, cooperate, and remediate.[7] The Corporate Enforcement Directive separately instructs prosecutors to follow the Principles of Federal Prosecution of Business Organizations and the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy, directs close coordination with the Corporate Enforcement Section from case intake through resolution or litigation, and gives that section primary responsibility for evaluating compliance with corporate criminal resolutions. Read together, the directives indicate that the Division intends to pursue individuals and entities in parallel, and companies evaluating self-disclosure should account for the possibility that employees, other companies, or other participants—including participants in misconduct—may approach the government before an internal review is complete.
Arrest, Detention, and Sentencing Advocacy
The Directive devotes substantial attention to the flight risk posed by fraud defendants. It reasons that fraud defendants may have significant resources, international connections, false identities or travel documents, the ability to move assets or flee abroad, and strong incentives to avoid accountability. Prosecutors are accordingly instructed to assess flight risk early and throughout a case; to develop a record concerning means, ties to the community, travel, access to assets, compliance with court orders, history of violence, and obstruction risk; and to seek arrest warrants and pretrial detention in appropriate circumstances. Where a defendant violates release conditions, prosecutors are to move promptly to modify or revoke them.
At sentencing, the Directive states that prosecutors “must not be mechanical.” They are directed to recount the greed, lies, and deception underlying the scheme and the harms it caused; to address general deterrence in every case; to seek all Guidelines enhancements supported by the facts and law while opposing unwarranted reductions and departures; to seek approval for upward variances or departures where the advisory range is inadequate; to pursue restitution, forfeiture, fines, and other financial penalties reflecting the full scope of the offense; to request supervised-release conditions that reduce recidivism, protect victims and government programs, and support compliance with financial obligations; and to consult on a possible appeal where a sentence is too light.
For individuals under investigation, these provisions make early defense preparation more important. Mitigation, restitution planning, and bail presentation should be considered before charging where the facts suggest potential flight-risk, asset-movement, obstruction, or detention issues.
Action Items
- In light of the Directive and the Division’s previously announced priorities, companies and individuals with exposure to federal programs, health care, tax, trade, procurement, securities, or consumer-facing conduct should consider the following:
-
- Evaluate the scope of ongoing internal investigations. Because prosecutors must screen every matter for tax violations and are encouraged to consider securities, consumer, cybercrime, asset-recovery, and corporate enforcement tools, internal investigations scoped narrowly around a single theory may understate exposure. Review tax, customs and trade, government procurement, securities disclosure, consumer-facing, management-knowledge, concealment, multi-district, victim-count, and loss issues in any matter under review.
- Revisit disclosure strategy and timing, but resist pressure to disclose prematurely. The combination of proactive cooperators, early disruption tools, and the Corporate Enforcement Directive’s instruction to design programs that incentivize whistleblowers, including those who participated in the criminal conduct, will likely be cited as reasons to self-disclose sooner. Companies should approach that pressure with caution. A disclosure made on a compressed record risks committing the company to a factual narrative before counsel understands the scope of the conduct, the individuals involved, or the strength of the government’s likely evidence. It can also invite a broader inquiry than the underlying facts warrant, and it creates exposure in parallel civil, regulatory, and foreign proceedings that DOJ credit does not resolve. The benefits of self-disclosure remain discretionary and uncertain, while its costs are immediate and largely irreversible.
- Stress-test asset-preservation and business-continuity protocols. Identify which accounts, digital assets, domains, and systems are operationally critical, and prepare a response plan for a freeze, seizure, or takedown—including treasury contingencies, lender and counterparty notification obligations, and a process for seeking prompt judicial relief.
- Counsel individuals on cross-border and asset issues early. For executives and employees who are or may become “subjects,” foreign travel, dual citizenship, offshore accounts, and asset transfers may have bail consequences. These issues should be assessed at the outset of representation, not after an arrest.
Audit compliance with existing corporate criminal resolutions. Companies operating under deferred prosecution agreements, non-prosecution agreements, or similar corporate criminal resolution undertakings should test compliance now because Directive 26-12 gives the Corporate Enforcement Section primary responsibility for evaluating companies’ compliance with corporate criminal resolutions, including compliance program enhancements and reporting obligations.
Click here to download this article.
[1] Memorandum from Colin M. McDonald, Assistant Attorney General, National Fraud Enforcement Division, to All Fraud Division Personnel, Directive 26-13: A Comprehensive Approach in the Fight Against Fraud (Oct. 7, 2026).
[2] U.S. Dep’t of Justice, Office of Public Affairs, Press Release No. 26-1160, Assistant Attorney General Colin M. McDonald Issues Memorandum on the National Fraud Enforcement Division’s Comprehensive Approach in the Fight Against Fraud (Oct. 8, 2026).
[3] See Willkie Farr & Gallagher LLP, DOJ’s Newly Established National Fraud Enforcement Division Announces New Structure and Five Priority Enforcement Areas (Aug. 18, 2026), https://www.willkie.com/-/media/files/publications/2026/08/dojs-newly-established-national-fraud-enforcement-division-announces-new-structure-and-five-priority.pdf; Willkie Farr & Gallagher LLP, The National Fraud Enforcement Division Announces Corporate Investigative Priorities (Oct. 5, 2026), https://www.willkie.com/-/media/files/publications/2026/10/the-national-fraud-enforcement-division-announces-corporate-investigative-priorities.pdf.
[4] Establishing the National Fraud Enforcement Division, 91 Fed. Reg. 53357 (Aug. 18, 2026) (effective Aug. 24, 2026) (codified at 28 C.F.R. §§ 0.70–0.71).
[5] 28 C.F.R. §§ 0.70(a)–(h). Sections 0.70(j)–(k) further authorize the Division to prosecute any federal criminal provision charged in a covered proceeding as well as offenses identified in the course of a covered investigation.
[6] Directive 26-13 cites the Government Accountability Office estimates of annual federal fraud losses of between $233 billion and $521 billion.
[7] Memorandum from Colin M. McDonald, Assistant Attorney General, National Fraud Enforcement Division, to All Fraud Division Personnel, Directive 26-12: Corporate Enforcement in the Fight Against Fraud (Oct. 1, 2026). See also our prior client alert, The National Fraud Enforcement Division Announces Corporate Investigative Priorities (Oct. 5, 2026).
