The US Department of Justice (DOJ or Department) published a final rule on August 18, 2026 (Final Rule) formalizing the National Fraud Enforcement Division (Fraud Division) established in April 2026. Companies in the health care, government contracting, trade, and tax sectors should take note and scrutinize their compliance programs accordingly. The Fraud Division has grown rapidly, already wielding data-driven investigative tools and interagency partnerships, and has signaled that it will reward companies that self-disclose and cooperate while aggressively pursuing those that do not.
The Final Rule
Under the Final Rule, the Fraud Division has jurisdiction over the following broad range of fraud-related matters. Companies should understand the scope of the Fraud Division’s reach:
- Criminal fraud. Criminal fraud matters (other than antitrust cases involving conspiracy to defraud the…
IT & DATA SECURITY (MITIGATING THE “INSIDER THREAT”)
As seen in the TD Bank case, an employee with too much “access” can sell your customer data to syndicates.
- Principle of Least Privilege (PoLP): Employees should only have access to the specific folders and databases required for their current task.
- Access Revocation: Have a “Termination Checklist” that ensures all digital access (Email, VPN, Banking) is revoked within 60 minutes of an employee resigning or being dismissed.
- System Logs & Audit Trails: Enable “Read/Write Logging” on your server. If a customer’s data is leaked, you need to know exactly which login accessed that record and at what time.
- Encryption at Rest: Ensure that sensitive files (like your customer ID numbers or payroll spreadsheets) are encrypted so that if a staff member copies them to a USB, they cannot be read.