The Serious Fraud Office ("SFO") has issued new SFO External Guidance on Corporate Co-Operation and Enforcement in relation to Corporate Criminal Offending which significantly raises the stakes for businesses in the event of suspected wrongdoing.
Any business now wishing to avoid prosecution for corporate financial crimes usually prosecuted by the SFO by entering into a Deferred Prosecution Agreement ("DPA") must now self-report "promptly". By doing so, the SFO now effectively commits to invite the business to negotiate a DPA in place of prosecution, save in exceptional circumstances.
This advice sits alongside the existing Code for Crown Prosecutors, Corporate Prosecutions Guidance and the DPA Code.
No precise guidance is given as to what amounts to "promptly", however the SFO seeks to respond to a self-report within 48 business hours, and thereafter to conclude DPA negotiations within six months. This, in itself, gives an indication that promptly really does mean without any delay.
The guidance also helpfully sets out factors which the SFO will consider to be examples of cooperative and un-cooperative conduct in investigations, which will go directly to determining how a case is resolved and what the penalty will be. One "significant co-operative act" of note will be the voluntary disclosure of material subject to legal professional privilege - an act which requires great consideration.
Why this matters
This new guidance directly affects how you respond to internal issues. A failure to act fast - or at all - in the face of concerns regarding fraud, bribery, money laundering or other corporate criminal acts, could remove any opportunity to negotiate a DPA.
This change is particularly significant in light of the forthcoming "failure to prevent fraud" offence under the Economic Crime and Corporate Transparency Act 2023, set to take effect on 1 September 2025. The SFO has already indicated it will take a proactive approach in using the legislation to prosecute.
Boards will still need to balance the benefit and risk of self-reporting carefully. While DPAs offer a pathway to avoid criminal prosecution, preserve contracts, and limit reputational damage, they are not without risks. Premature self-reporting without a thorough internal investigation can lead to unintended consequences. Inadequate internal processes, inconsistent messaging, or insufficient legal oversight may weaken a company's position across criminal, regulatory, or civil proceedings.
Next steps
Businesses now face significantly increased pressure to detect and report wrongdoing proactively. We strongly recommend you review:
- Internal investigation and escalation processes;
- Internal policies on fraud, whistleblowing and regulatory engagement;
- Board-level awareness of reporting obligations;
- Legal privilege protocols; and
- Your readiness to preserve and disclose key material swiftly.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
