Latest SFO guidance on corporate self-reporting, cooperation and DPAs

Earlier this year the Serious Fraud Office (SFO) issued guidance for companies on corporate self-reporting and cooperation in investigations. It is of particular relevance when seeking a Deferred Prosecution Agreement (DPA).

The below article was originally published in the July/August Edition of Financial Regulation International.

Introduction

The guidance, which replaces guidance on corporate cooperation issued in 2019, sets out clearer expectations for companies seeking to resolve allegations of criminal misconduct through cooperation. This includes timelines for engagement, a stronger presumption in favour of DPAs where corporates self-report and a more detailed framework for what constitutes “genuine” cooperation.

The SFO’s approach now goes further than the DPA Code of Practice (published in 2013) by offering what appears to be a de facto guarantee: if a corporate promptly self-reports suspected criminal conduct and provides full cooperation, the SFO will invite it to negotiate a DPA rather than prosecute, unless "exceptional circumstances" apply. 

The guidance coincides with broader efforts to increase case intake for the agency, including a government review of whistleblower compensation and the introduction of the “failure to prevent fraud” offence under the Economic Crime and Corporate Transparency Act 2023. Self-reporting though remains a key source of cases for the SFO. The agency's Director, Nick Ephgrave QPM, has previously stated that one of the main aims of this guidance is to counteract a decline in recent years in the number of companies self-reporting.

Potential impact of the guidance

For companies at risk of prosecution in bribery and fraud cases, DPAs generally offer an appealing route to resolution. They are negotiated agreements between the company and enforcement agencies, such as the SFO and Crown Prosecution Service in which, broadly, the company agrees to various terms, normally including payment of a financial penalty and obligations to cooperate in connected prosecutions and to make necessary enhancement to its financial crime compliance framework. In exchange, the SFO agrees to suspend its prosecution of the company and discontinue its case if the company satisfies all the DPA terms. Specifically, they offer companies certainty, reduced financial penalties and, importantly, no criminal conviction. 

The SFO's latest guidance provides greater clarity to companies on what they will need to do to be eligible for a DPA along with a more structured framework for self-reporting. It also provides statements from the SFO as to the process it will observe following a self-report and the speed with which it will respond and investigate. 

This clarity is welcome, and the timelines the SFO has said it will seek to follow offer some encouragement to companies that cases will not become protracted. However, there remain some open questions, including around what is meant by "exceptional circumstances" where self-reporting and cooperation will not be enough to secure a DPA and how cases that have previously resulted in a DPA, such as the Rolls-Royce case, which were not considered to be self-reports by the SFO, would now be treated. 

It remains to be seen if the greater clarity around outcome and speed of investigation offered by the SFO in this latest guidance will be sufficient to encourage more companies to self-report potential criminal wrongdoing. Also, the guidance does not include any detail on other means by which the SFO will increase its efforts to identify new cases involving potential wrongdoing by corporates. Therefore, companies will still need to weigh up the risks and benefits of making, or not making, an early disclosure to the SFO. In carrying out this balancing exercise corporates will need to consider not just the SFO's guidance but also the wider context of developments concerning financial crime enforcement, such as the coming into effect of the offence of failure to prevent fraud (pursuant to section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA)), and the recent broadening of the test for establishing corporate criminal liability (set out in section 196, ECCTA). 

What are the key provisions in the guidance?

• Clearer expectations of cooperation: The guidance outlines proactive steps companies must take to demonstrate adequate levels of cooperation in order to be eligible for a DPA, including preservation and provision of relevant material (including overseas documents) and early consultation before internal investigative steps are taken. With respect to legal professional privilege, the SFO states that companies will not be penalised for asserting it, but emphasises that voluntary waiver will be treated as a “significant cooperative act” and will "weight strongly in favour of cooperation".
• Importance of self-reporting: Prompt voluntary disclosure to the SFO of potential criminal wrongdoing by a company disclosure is now framed as a “key consideration” when determining whether a DPA is appropriate, though no guarantee is provided. However, the guidance significantly narrows the gap between “key consideration” and effective assurance. If companies self-report and cooperate fully, an invitation to a DPA negotiation is now all but guaranteed. Notably, the SFO has also accepted that DPAs may be appropriate even for companies that did not self-report, provided their cooperation is “exemplary” (a nod to past cases such as Rolls-Royce and Airbus). The guidance provides a non-exhaustive list of conduct that it may consider "exemplary", including providing to the SFO: (i) facts of the relevant criminal conduct, including identifying the individuals involved; (ii) information regarding any previous corporate criminal conduct and how it was resolved; and (iii) a thorough analysis of the company's compliance procedures at the time of the alleged offending, including any deficiencies at that time.
• Discouragement of forum shopping and limits on what will be considered a self-report: The SFO will not treat a report to another authority (such as a disclosure to a business's regulator, such as HMRC or the Financial Conduct Authority) as a self-report unless the SFO is notified “simultaneously or immediately thereafter”. Equally, the SFO may not accept that a company has self-reported if it has disclosed the conduct to an overseas agency whose enforcement action may be seen as a more lenient avenue for the company.
• Timely engagement: The SFO has provided indications as to its own processes and speed of response. These are intended to offer certainty to companies and to demonstrate that a self-report will not cause the company to face significant delays in waiting for final resolution of the matter. The SFO will respond to self-reports within 48 hours and decide within six months whether to open an investigation. If DPA negotiations are initiated, they are generally to be concluded within a further six months. The SFO says it will aim to conclude its investigation within a "reasonably prompt time frame". The SFO also states that it will provide regular updates throughout the process to the company. These timelines reflect a wider organisational shift aimed at reducing delay and uncertainty which have been longstanding barriers to cooperation cited by corporates and their advisers.

Conclusion

The SFO's guidance offers welcome clarity to companies when considering whether they should self-report potential wrongdoing to the SFO, or, if already under investigation, whether they should adopt a cooperative approach to their dealings with the agency. The language of the guidance, particularly when compared to the previous 2019 version, suggests the SFO may take a somewhat more corporate-friendly approach when assessing whether matters are suitable for DPAs.

However, to achieve its aim of encouraging more companies to self-report, this guidance will likely need to be coupled with increased enforcement activity from the SFO, including the agency identifying and pursuing suitable cases through other means. The increased threat of the "stick" of the SFO identifying and prosecuting a company's wrongdoing, will make the "carrot" offered by the guidance more appealing.