skip to main content

Our Environmental Group combines comprehensive knowledge of environmental laws and regulatory developments with a keen understanding of our clients’ business interests. With an environmental practice that spans transactional work, compliance advice and litigation, we have handled critical environmental matters faced by our clients. We help clients effectively manage the business and legal risks of environmental matters, with solutions that address both short- and long-term impacts.

EPA Simplifies Disclosure and Resolution of Certain Hazardous Chemical Reporting Violations

January 15, 2016 download PDF

On December 9, 2015, the U.S. Environmental Protection Agency's ("EPA") issued its "Notice of eDisclosure Portal Launch: Modernizing Implementation of EPA's Self-Policing Incentive Disclosure Policies" ("eDisclosure Policy").[1]

The new eDisclosure Policy allows companies to self-disclose eligible violations of the Emergency Planning and Community Right-to-Know Act ("EPCRA") under certain EPA audit disclosure policies through an automated online system.  The new system will expedite resolution of common violations and provide greater certainty about avoiding penalties.  However, to effectively employ the eDisclosure Policy it is important to understand the requirements and limitations for disclosures made under the new system.


EPCRA requires reporting to the EPA of the presence at or release from facilities of certain designated hazardous chemicals. For example, EPCRA requires the reporting of the presence at a facility over a threshold quantity of any of approximately 500,000 listed hazardous chemicals.

In our experience, facilities are not always aware of the applicability of EPCRA's reporting requirements.  For example, lead and sulfuric acid are among the hazardous chemicals subject to this reporting requirement, and both are present in lead-acid batteries frequently found in forklifts.  If a warehouse facility maintains a sufficiently large forklift fleet, EPCRA's reporting requirements will apply.  On several occasions, we have identified this non-compliance with EPCRA in the context of the due diligence associated with an acquisition or financing, necessitating corrective reporting to the EPA.

EPA's existing Audit Disclosure Policy ("Audit Policy") is intended to encourage companies to voluntarily disclose and correct environmental violations in exchange for penalty mitigation and EPA not recommending criminal prosecution. The Audit Policy[2] conditions such benefits on nine requirements, which include (i) discovery of the violation through systematic audits or compliance review; (ii) voluntary discovery (i.e., other than through a legally required process); (iii) disclosure in writing to EPA within 21 days of discovery; and (iv) correction and remediation of the violation within 60 calendar days of discovery.  Certain violations are ineligible for disclosure-based mitigation, including repeat violations, violations resulting in actual harm or violations of existing orders or consent agreements.  EPA has issued a similar policy, the Small Business Compliance Policy, for small business owners (100 or fewer employees) which allows for a longer period for correcting violations.[3]

EPA has supplemented these policies with a guidance on applicability of the Audit Policy to new owners of facilities ("New Owner Policy").[4]  Eligible new owners must, within 9 months of closing and within 21 days of discovery, disclose violations to EPA or enter into an audit agreement with EPA and satisfy the Audit Policy requirements, subject to certain modifications.  Benefits include no assessment of penalties for the period preceding the acquisition date, as well as eligibility for a wider range of violations than available under the Audit Policy.

Eligible Violations and Outcomes

The eDisclosure Policy establishes two categories of eligible violations.  Category 1 includes  EPCRA violations for which the company has met all conditions under the Audit Policy or Small Business Compliance Policy, as applicable.  For such disclosures, the eDisclosure system will issue a Notice of Determination that resolves the violation with no penalties required.  Such disclosures will be spot-checked by EPA to ensure compliance with the Audit Policy and EPCRA requirements.  Violations relating to chemical release reporting under EPCRA Section 304 are not eligible as Category 1 violations; nor are violations from which the company has derived significant economic benefit.

Category 2 includes (i) all non-EPCRA violations eligible under the Audit Policy or Small Business Compliance Policy; (ii) EPCRA violations where the company meets all Audit Policy conditions except for systematic discovery; and (iii) EPCRA and Comprehensive Environmental Response, Compensation, and Liability Act ("CERCLA") violations not included in Category 1.  For such violations, the eDisclosure system will issue a letter acknowledging receipt of the disclosure and promising EPA will determine eligibility for penalty mitigation if, in the future, it considers taking enforcement action.  EPA will screen disclosures in this category to identify significant concerns, such as criminal conduct and potential imminent hazards.

While the eDisclosure system will address a significant proportion of violations, EPA will still handle disclosures made under the New Owner Policy, as well as any potential criminal violations. New owners should ensure that any disclosures made for prior violations are submitted manually, to ensure that they do not lose benefits available under the New Owner Policy.

eDisclosure Process

The eDisclosure system is intended to increase efficiency in resolving disclosures in the face of the heavy volume of disclosures seeking the benefits of the Audit Policy or the Small Business Compliance Policy received by EPA, but the eDisclosure System does not alter disclosure and corrective action timelines established by existing disclosure policies.[5]

In order to use the eDisclosure system, companies will need to register with EPA's Central Data Exchange system, if not already registered.  To make a disclosure, companies submit the violation disclosure online in the system.  Disclosures must still be made within 21 days of discovery, and correction of the violation made within 60 days of discovery (or 90 days under the Small Business Compliance Policy). In the new eDisclosure system, companies must submit a Compliance Certification within the 60 day or 90-day period, as applicable, certifying that the violation was corrected and applicable audit disclosure policy conditions met.  In addition, for Category 2 violations only, companies may request an extension of the corrective action period.  An initial 30-day extension (90 days for disclosure under the Small Business Compliance Policy) is granted automatically under the eDisclosure system; a further extension of up to 180 days after discovery of the violation (or up to 360 days after the discovery of the violation under the Small Business Compliance Policy) is granted only with justification, and could be a factor in EPA's consideration of future enforcement action.   For Category 1 violations, extensions are not available; failure to correct the violation within the 60-day period transforms the violation into a Category 2 violation, meaning a Notice of Determination will not be available.

For the transition period, unresolved disclosures for any EPCRA violations made prior to the launch of the eDiscovery system may be resubmitted within 120 days of December 9, 2015, with the compliance certification of timely (i.e. within 60 or 90 days, as applicable, of the original discovery of the violation) corrective action  required within 30 days of the resubmittal. Any pre-existing disclosures that are not subject to audit agreements or settlement negotiations, and are not resubmitted, will be treated as Category 2.

Confidential Business Information

Importantly, the eDisclosure system does not allow for marking submitted information as Confidential Business Information ("CBI").  Because EPA considers resolved audit disclosures to be subject to release under the Freedom of Information Act, any information submitted through the eDisclosure system may become public.  Further, EPA clarifies in the new eDiscovery Policy that it will determine whether disclosures with pending resolution are subject to release under FOIA on a case-by-case basis.  Accordingly, companies should ensure that any information submitted into the eDisclosure system does not contain CBI or other sensitive information (e.g. private employee information), and instead submit any such information necessary to meet applicable audit disclosure policy requirements through a separate, manual submission. 


EPA's new eDiscovery system should allow companies to address certain minor violations eligible for resolution under the Audit Policy and the Small Business Compliance Policy more simply and efficiently.  While the automatic resolution of certain minor violations is helpful, disclosures for a wide range of other violations, as well as reportable spills, will not receive automatic closure and may still be subject to EPA screening and enforcement action.  Nor does the new system expand the scope of the existing audit disclosure policies.  The new policy is best viewed as a process improvement that will yield faster and simpler resolution of certain straightforward violations.

Please do not hesitate to contact any of us if you are interested in exploring the utility of EPA's new eDisclosure Policy in your business.

[1] Notice of eDisclosure Portal Launch: Modernizing Implementation of EPA's Self-Policing Incentive Disclosure Policies, 80 Fed. Reg. 76476 (December 9, 2015).

[2] Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations, 65 Fed. Reg. 19618 (April 11, 2000).

[3] Small Business Compliance Policy 65 Fed. Reg. 19630 (April 11, 2000).

[4] Interim Approach to Applying the Audit Policy to New Owners, 73 Fed. Reg. 44991 (August 1, 2008).

[5] 80 Fed. Reg. 76476.

© 2024 Paul, Weiss, Rifkind, Wharton & Garrison LLP

Privacy Policy