The United Kingdom’s Serious Fraud Office (SFO) recently published updated guidance on how corporates can best avoid or reduce the risk of prosecution in cases involving economic crimes such as bribery, fraud and corruption (the Guidance). The Guidance builds upon the draft guidance published for consultation last year and updates the earlier 2019 guidance by setting out the SFO’s position on self-reporting and the meaning of “genuine” co-operation by corporates in order to secure “cooperation credit.” For the first time in this updated Guidance, the SFO has set out clearer time frames in responding to a report within 48 hours and making a decision on opening an investigation within six months of the initial report. 

Corporation Credit

The Guidance stipulates that corporates who self-report suspected wrongdoing and fully and “genuinely” co-operate with investigators will receive “cooperation credit” allowing them to negotiate and enter into a Deferred Prosecution Agreement (DPA) in lieu of prosecution, subject to exceptional circumstances. These exceptional circumstances include, but are not limited to, a lack of cooperation and inadequate remedial actions, repeat offending, a violation of terms of a previous DPA agreement and where the alleged criminal conduct is so serious that it would be in the public interest to prosecute. 

Under the DPAs, prosecutors will agree to suspend legal proceedings in exchange for the company agreeing to conditions such as fines, compensation payments and corporate compliance programmes.

Why Self-Report?

Prior to the publishing of the Guidance, companies who self-reported to the SFO could still run the risk of a criminal conviction if the SFO decided that a DPA was not appropriate. The updated Guidance further encourages and emphasises the necessity of self-reporting as a mark of a reasonable and reflective organisation, with a legitimate expectation that, where possible, this will result in a DPA. A failure to self-report, or a failure to do so promptly within a reasonable time, could impact the SFO’s assessment of co-operation, thereby threatening the eligibility to negotiate a DPA. What amounts to a reasonable time to self-report will depend on the circumstances and is assessed on a case-by-case basis. 

Co-operation 

Companies that fully and “genuinely” cooperate with SFO investigations will be eligible to be invited to negotiate a DPA. Co-operation during an investigation means providing assistance to the SFO that goes above and beyond what the law requires. This is case-specific but is likely to include behaviour such as providing access to documents (digital and hard copy) likely to be relevant to the investigation, identifying potential witnesses, identifying persons involved in the alleged misconduct and early engagement with the SFO, amongst other things. A non-exhaustive list is set out in the Guidance here. Examples of cooperation include promptly reporting suspected misconduct; preservation of data; providing information to the SFO in a structured, user-friendly manner; identifying potential witnesses; identifying money flows and briefing the SFO on the background to the issue. A corporate which maintains a valid claim of legal professional privilege (LPP) will not be penalised; however, a waiver of LLP will be a significant co-operative act and would help expedite matters. This may be a significant issue where witness accounts have been taken during any internal investigation prior to the self-report. 

The Guidance also sets out what the SFO views as unco-operative. This includes seeking to overload the investigation and tactically delaying it by providing an unnecessarily large amount of material or “forum shopping” by unreasonably reporting offending to another jurisdiction for strategic reasons and thereby seeking to exploit differences between international law enforcement agencies or legal systems.

Internal Investigation and Practical Guidelines on Self-Reporting

The SFO has acknowledged that the Guidance does not specify in sufficient detail what level of investigating the corporate should undertake prior to self-reporting. However, the Guidance does set out a series of core principles. The SFO expects the corporate to follow and adhere to the below self-reporting procedures and expectations as soon as the corporate learns of direct evidence indicating corporate offending:

1. Report directly to the Intelligence Division, which includes a legal team, headed by a senior lawyer, who will manage the initial engagement with the corporate and their legal representatives. The initial contact can be made through a secure reporting form (found here). This reporting form allows the firms or their legal representatives to discuss the reporting process with an Intelligence Division representative before making a portal submission.
2. The self-report should identify all relevant known facts and preserve all evidence concerning:
   1. The suspected offences; 
   2. The individuals involved (both inside and outside the organisation); 
   3. The relevant jurisdiction; 
   4. The whereabouts of key material and any risk associated with the destruction of said material; 
   5. Any previous relevant corporate criminal conduct and how it was remediated; and
   6. If digital material is provided, the corporate should agree with the SFO on the correct digital format for such material to be received.

It is important that corporates present a thorough analysis of any and all compliance programmes and procedures in place at the time of the offending, as well as what remedial action has been taken or planned. Information that may not be available immediately during the time of the initial self-report should be provided as soon as possible thereafter to indicate full cooperation.

Self-reporting through a suspicious activity report to the National Crime Agency or to any other agency (domestic or foreign) does not equate to self-reporting to the SFO unless done so simultaneously or after self-reporting to the SFO.

Clearer Deadlines

The Guidance also makes transparent the SFO’s responsibility when receiving a secure reporting form. In return for self-reporting, a company can expect the Intelligence Division to do the following:

• Personally establish contact within 48-hours of the report or other initial contact with the Intelligence Division.
• Provide regular updates to the corporate on the status.
• Provide a decision as to whether to open an investigation within six months of a self-report.
• Conclude the investigation within a reasonably prompt time frame. The length of the investigation will depend on the complexity and level of proactive cooperation.
• Conclude DPA negotiations within six months of sending an invite.

Conclusion

This Guidance makes the SFO position clearer: The best way for corporates to avoid prosecution is through prevention, transparency, and accountability by proactively self-reporting misconduct. In return, the SFO has committed to more timely deadlines on the decision to investigate and concluding DPA negotiations, once initiated. That sharpens the timescales involved at the start and the end of the process. But what of the investigation process? The length of any SFO investigation may still take some considerable time to conclude, depending on the complexity involved.