UK Serious Fraud Office Issues Significant New Guidance on Corporate Self-Reporting – What It Means for Your Business

Self-Reporting – Timing

The SFO views self-reporting suspected corporate criminal conduct as a “mark of a responsible organisation”⁵ and notes that a “prompt” self-report “always weighs heavily in favour of a DPA”.⁶  On the other hand, a failure to self-report suspected offending within “a reasonable time of it coming to light” will negatively impact the public interest assessment.⁷

What amounts to “a reasonable time” will depend on the circumstances. The Guidance accepts that a company may wish to take steps to investigate the suspected offending before self-reporting.⁸ However, the SFO does not expect a company to wait to complete its investigation prior to self-reporting. The length of time that it may reasonably take to investigate the matter before then will be a sliding scale which depends on the evidence that emerges:

“If there is direct evidence of corporate offending, we would expect a corporate to self-report soon after learning of that evidence. If the position is less clear-cut we recognise that some further investigation may be necessary.” ⁹

SFO Director Nick Ephgrave added some colour on this in a speech on the day the Guidance was launched:

“As soon as you have reasonable suspicion – it doesn’t have to be ‘beyond reasonable doubt’, doesn’t have to be ‘on the balance of probabilities’, just reasonable suspicion you’ve got some offending going on – that’s the point at which you stop, that’s the point at which you talk to us.” ¹⁰

The Guidance does not expand on what “prompt” amounts to, whether this means any earlier than within “a reasonable time”, or whether it still allows for a degree of investigation by the company. In practice, the advantages of taking initial steps to better understand the nature and extent of any offending prior to self-reporting are likely to outweigh any potential downsides, provided the initial investigation moves quickly. Companies should ensure that the necessary arrangements are in place for the board (and/or any other relevant governance forum) to approve the making of a self-report as soon as a “reasonable suspicion” (in the Director’s words) has emerged.

A company which submits a Suspicious Activity Report to the National Crime Agency (e.g. under the provisions of the UK Proceeds of Crime Act 2002 (POCA), or makes a report to another UK or overseas agency, should also report to the SFO “simultaneously or immediately thereafter”.  Failure to do so means that it will not gain credit from the SFO for self-reporting.   Bearing in mind the very low threshold for reporting a suspicion to the NCA under POCA, this may well give rise to challenges in practice.  It should also be borne in mind that the SFO will generally only investigate and prosecute serious crime, so this requirement should not be misinterpreted as giving rise to a general expectation that all levels and types of suspected misconduct should be reported to the SFO.

Self-Reporting – Content

On the content of a self-report, the Guidance states that companies should provide information which enables the SFO to “understand the nature and extent of the suspected offending.” ¹² This will include identifying all known facts and evidence, the individuals involved and the relevant jurisdictions.

The SFO also expects to receive information at the self-reporting stage on the location of key material and “any risks associated with the destruction of key evidence…” ¹³  If the SFO has concerns about potential document destruction, the implicit risk is that it takes intrusive steps to secure the material itself (e.g. a ‘dawn raid’).

Accordingly, companies conducting an initial investigation with a view to self-reporting should carefully document the methodology used to identify and preserve potentially relevant material and be prepared to justify this to the SFO in relatively short order.

Timelines

For the first time, the SFO has set out certain case-progression timescales following a self-report.¹⁴ The SFO will seek to:

• contact a self-reporting company within 48 business hours of a self-report;
• decide whether to open an investigation within 6 months;
• conclude its investigation “within a reasonably prompt time frame”;¹⁵ and
• conclude DPA negotiations within six months of sending an invitation.

Co-operation

A prompt self-report is not sufficient to secure a DPA invitation – the company “must go on to provide genuine co-operation to be eligible be invited to negotiate a DPA.”¹⁶

On the other hand, a company that does not self-report may still qualify for a DPA invitation if it provides “exemplary co-operation” (emphasis added). This is consistent with previous cases demonstrating that a DPA (and full 50 per cent penalty discount) could be secured, in the absence of a self-report, through an “extraordinary”¹⁷ or “exemplary”¹⁸ level of co-operation.

Paragraph 22 of the Guidance provides the following non-exhaustive list of hallmarks of co-operative conduct:

• Proactively and promptly preserving all digital and hard copy material likely to be relevant to the SFO investigation.
• Collecting and identifying documents and information likely to be relevant to the SFO investigation. Non-exhaustive examples include:
  • Providing a list of relevant custodians and the location of material (whether hardcopy or digital);
  • Identifying and/or producing relevant overseas documents within the company’s control;
  • Identifying potentially relevant third-party material; and
  • Providing translations of relevant foreign language documents.
• Presenting the facts on the suspected criminal conduct, including identifying all persons involved, both inside and outside of the company.
• If the company undertakes an internal investigation:
  • Engaging early with the SFO as to the parameters of the investigation;
  • Informing the SFO in advance of proposed investigation steps (such as interviews) and not taking any step which might prejudice the SFO investigation. The Guidance envisages discussing at the outset which steps the SFO would like to be consulted on and those where that is unnecessary;
  • Providing timely updates including any key findings;
  • Providing the facts gathered during the investigation;
  • Providing non-privileged records of interviews. If the company claims that interview records are subject to privilege, a voluntary waiver “will weigh strongly in favour of co-operation”;
  • Refraining from interviewing employees at the SFO’s request; and
  • Notifying the SFO of the involvement or interest of any other authority.
• Informing the SFO of any previous relevant corporate criminal conduct and how it was resolved.
• Providing information on any disciplinary action and personnel changes made because of the offending.
• Providing financial information regarding the benefit and/or harm the offending has caused.
• Presenting a thorough analysis of the company’s compliance programme at the time of the offending and how it has remediated, or plans to remediate, any ongoing deficiencies.
• Assisting the SFO to access employees for the purposes of their interviews and ensuring, where appropriate, independent legal advice is made available to employees.

Interestingly, the Guidance states that a company which takes all the above steps is “likely to be assessed as providing exemplary co-operation”.  If a company is assessed in this way, the SFO will “consider” inviting it to DPA negotiations, even where it has not self-reported. However, in practice, it would likely be a high-risk approach for a company to make a tactical decision not to self-report and then seek to make up for that deficit later by relying on the above as a roadmap to a DPA via exemplary co-operation.  Such an approach may be looked on poorly by the SFO when making its overall public interest assessment, particularly against the backdrop of the SFO Director starkly warning companies that “If you have knowledge of wrongdoing, the gamble of keeping this to yourself has never been riskier.”²⁰

A company will not be penalised for maintaining a valid privilege claim over relevant material, but the SFO will consider a voluntary waiver of privilege “a significant co-operative act.”²¹ Companies considering privilege waivers will need to carefully weigh the potential benefits in terms of co-operation credit against the wider risks of waiver on a case-by-case basis.

Non-Cooperative Conduct

The Guidance also gives examples of non-cooperative conduct, including delaying providing information or material for tactical reasons, seeking to overload the SFO investigation with unnecessarily large volumes of material, and attempting to withhold the full extent of the suspected offending.

Two further examples caution against what the SFO would appear to view as unreasonably ‘tactical’ approaches to multi-jurisdictional investigations, namely “‘forum shopping’ by unreasonably reporting offending to another jurisdiction” and “[s]eeking to exploit  differences between international law enforcement agencies or legal systems.”²² As it is not immediately clear what the Guidance has in mind on the latter point,  the extent to which companies (and their external counsel) will need to be mindful of this when engaging with the SFO alongside overseas authorities remains uncertain.²³

What Are “Exceptional Circumstances”?

The Guidance concludes by reiterating that “it will only be in exceptional cases that the combination of a prompt self-report and full co-operation will result in prosecution rather than an invitation to discuss a DPA.”²⁴ The Guidance is silent as to what exceptional circumstances the SFO might have in mind. While this maintains the SFO’s flexibility to address the specific circumstances of a given case, two potentially helpful reference points may be:

• The Skansen Interiors Limited (Skansen) case where the company was prosecuted by the Crown Prosecution Service despite self-reporting co-operating with the investigation. The CPS took the view that as a dormant company Skansen would be unable to pay a fine or otherwise comply with the terms of any DPA, whereas a prosecution would send a message to smaller companies about the importance of adequate anti-bribery and corruption procedures. The SFO may choose to adopt a similar approach in cases where the terms of a DPA could not be complied with by the company and where this could not be mitigated by obtaining appropriate parent company undertakings.²⁵
• The public interest factors in favour of prosecution detailed in the DPA Code of Practice²⁶ and Corporate Prosecutions Guidance.²⁷ These include a history of similar conduct and pervasiveness of the conduct within the company. The Guidance²⁸ leaves open the possibility that, in certain cases, one of, or a combination of, these factors may prove determinative.

Conclusion

A DPA in any given case ultimately remains subject to judicial approval through a declaration that it is in the interests of justice and its terms are fair, reasonable and proportionate.²⁹ The Guidance therefore goes effectively as far as the SFO could in seeking to make the path to a DPA (or at least a DPA invitation) clear and transparent while maintaining some flexibility in recognition that each case will turn on its own facts.

It remains to be seen if this will be sufficient to move the dial and incentivise a new wave of corporate self-reporting. Deciding whether to self-report remains a highly fact-sensitive exercise where companies must carefully weigh the potential benefits of self-reporting against what are often very significant downsides. The Guidance spells out the SFO’s high expectations in terms of the speed of reporting and the requisite degree of co-operation. This is no small undertaking.

Companies may therefore wish to ensure that boards are pro-actively briefed on the principles and practical implications of self-reporting, ahead of any specific decision. This would reflect the Guidance but also broader considerations including, for example, remarks by the judge approving the DPA between the SFO and Amec Foster Wheeler Energy Limited that the board’s failure to self-report was “deplorable” and the “proper course” would have been to do so “as a matter of ethical corporate governance”.³⁰ To this extent, it may be considered prudent to appraise board members of these issues and expectations, whether or not an incident has occurred.

Indeed, it is likely that boards may be faced with difficult dilemmas such as this ever more frequently, given a landscape featuring broad new legislation (such as the failure to prevent fraud offence),³¹ increased international co-operation,³² heightened scrutiny from auditors, civil society and other stakeholders, (potentially) newly-incentivised whistleblowers³³ and aggressive competitors and litigation funders.

Even though the recent SFO announcement does not change matters fundamentally, senior management should familiarise themselves with the relevant principles in case matters arise which require quick decision making.  In doing so, they should not ignore the fact that the enforcement landscape in the UK is changing rapidly, against a background where the SFO has recently acquired sweeping new powers to prosecute companies (including foreign companies) in ways that were not previously possible. The SFO’s announcement is therefore carefully timed and should be viewed as part of an increasingly co-ordinated and determined strategy to respond to corporate crime.