Co-operating with the Authorities: The UK Perspective

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

15.1 Introduction

This chapter focuses on corporate co-operation with regulatory agencies and criminal authorities: where and when co-operation is required, its outcomes and its implications. It looks at the expanding meaning of ‘co-operation’, current practice and guidance and recent jurisprudence.

Where co-operation is mandatory, the corporate has no option but to comply, or face criminal or disciplinary sanction. A few non-exhaustive examples of mandatory co-operation in the United Kingdom are where:

  • there is a warrant to enter and search premises, and to seize material found therein;
  • a court issues a witness summons for a representative of the corporate to attend court, often with documents; or
  • a compelled notice is issued, requiring the recipient to provide information or documents, or to attend for interview.

Where co-operation is voluntary, the debate becomes more interesting. Generally, there is an increasing expectation that corporates should co-operate with investigations. Co-operation can be beneficial for a number of reasons (e.g., it can result in a less serious outcome, help to mitigate sentences or sanctions in the event of a successful prosecution or enforcement, or enable an early decision to take no further action to be reached). It will be relevant at every stage of engagement with regulators, or other enforcement authorities, and can help to limit costs to the business and give the corporate some influence over the course of an investigation. A collaborative approach may also enable a corporate to manage publicity and communications in conjunction with the authority and limit reputational damage.

15.2 The status of the corporate and other initial considerations

Understanding the status of the corporate is essential to providing proper, informed guidance. Is it a victim or a witness? Is it the target or subject of the investigation? If a witness, is it at risk of becoming a subject?

Establishing the status of the corporate at the outset of an investigation, if possible, enables the evaluation of potential liability, including if the corporate is exposed to risk and the potential mitigating benefits of co-operation. This evaluation should define how the approach to the authority is made and how the relationship is managed.

If the corporate is a witness, it may be subject to mandatory co-operation requirements, such as compelled requests for information. While proactive co-operation may enhance a corporate’s relationship with its regulator or enforcement body, and be consistent with its corporate governance values, a corporate may have good reasons to be circumspect in dealings with the authorities in an investigation. For example, a corporate witness may have an ongoing commercial relationship with the corporate suspect (e.g., an auditor–client relationship), meaning the corporate witness will need to consider its obligations to the client and potential exposure to litigation or investigation resulting from disclosure. A corporate may also evolve from witness to suspect over time.

Beyond mandatory obligations, there is also a discretionary element to the type of co-operation that might be appropriate for a corporate to consider providing, and there are different drivers behind this – legal, tactical, practical and even ‘ethical’. The court suggested in the Amec Foster Wheeler Energy Limited (AFWEL) deferred prosecution agreement (DPA) that self-reporting is ‘a matter of ethical corporate governance’ and that there is a ‘moral duty on all citizens in this respect which extends at least equally to corporations’.[2] This judgment is the first to indicate a moral standard for self-reporting above and beyond the requirements of the law and outside the context of penalty reduction (albeit in obiter).

The desire or need to co-operate may trigger an internal investigation to preliminarily establish the facts and veracity of the allegations. While not the only factor influencing the approach to take, corporates must consider whether the authorities would want or expect involvement in setting the scope of an internal investigation (discussed further below). The corporate should also be mindful of any mandatory reporting or disclosure obligations that arise as it gains further information relating to the allegations.[3]

Other initial considerations include legal privilege – asserting such privilege where appropriate but balancing it with certain authorities’ desire to review first accounts of witnesses (discussed further below).

Where able, the strength of the known evidence should be assessed as quickly as possible. Information obtained by a prosecutor during an investigation is generally admissible in criminal proceedings against the corporate, so it is important to have regard to the potential effects of any documents or information voluntarily disclosed and the extent to which co-operation may undermine any potential defences the corporate may later wish to mount.[4] It is also important to try to understand what evidence might arise in the investigation (other than that known to the corporate), so that a broader assessment of potential exposure can be made.

15.3 What does co-operation mean?

15.3.1 Definition and descriptions

Increasingly, co-operation is a more nuanced concept than a traditional guilty plea and an offer to give evidence on behalf of the prosecution: it involves self-reporting, acting in a manner that saves the authority’s time and resources, a willingness to cede a good deal of control in internal investigations, voluntary disclosure of gathered evidence, and genuine and consistent transparency – all factors referred to by courts and authorities.

Multiple authorities have stressed the importance of genuine co-operation. In August 2019, the Serious Fraud Office (SFO) published an extract of its operational handbook entitled Corporate Co-operation Guidance, which provides guidance to SFO prosecutors on how to assess corporate co-operation.[5] The guidance lists several dozen ‘indicators of good practice’ that the SFO may take into account when assessing whether a corporate is genuinely co-operative. Importantly, the list is neither exhaustive nor prescriptive: the SFO acknowledges that each case will be different.

As a summary, the Corporate Co-operation Guidance notes:

Co-operation means providing assistance to the SFO that goes above and beyond what the law requires. It includes: identifying suspected wrong-doing and criminal conduct together with the people responsible, regardless of their seniority or position in the organisation; reporting this to the SFO within a reasonable time of the suspicions coming to light; and preserving available evidence and providing it promptly in an evidentially sound format.

Genuine co-operation is inconsistent with: protecting specific individuals or unjustifiably blaming others; putting subjects on notice and creating a danger of tampering with evidence or testimony; silence about selected issues; and tactical delay or information overloads.[6]

Various other authorities have similarly stressed the importance of corporate co-operation by the entities they are investigating, including the Information Commissioner’s Office (ICO), which can impose fines for data protection breaches, and the Financial Conduct Authority (FCA).[7]

15.3.2 Genuine and continual co-operation

Authorities expect co-operation to be genuine, proactive and continual.[8] When a resolution of an investigation is under consideration, a dominant public interest factor against prosecution is co-operation. Considerable weight is given to a ‘genuinely proactive approach’ by a corporate that becomes aware of potential offending.[9] If an investigation is to be resolved by way of a DPA, then the public interest will be a focus of the court in its assessment of the proposed agreement.

Co-operation will clearly be considered in the context of the corporate’s general attitude towards the investigation. Companies that make incorrect or unsubstantiated arguments about the underlying nature of the misconduct run a real risk of being deemed unco-operative, while companies that fully co-operate can earn significant leniency in terms of the eventual disposal of a matter, whether that entails entirely extinguishing, or at least reducing, monetary and other penalties.

For example, Sweett Group’s conduct was heavily criticised by the SFO and the court for attempting to ‘divert the attention of the SFO away from further enquiry of the contract’ under scrutiny by attempting to obtain a letter characterising the offending payment its subsidiaries had made as a legal finder’s fee under United Arab Emirates law.[10] On the other hand, in the Rolls-Royce case, the SFO offered, and the court approved, for the first time, a DPA with a 50 per cent discount to the monetary penalty that would otherwise have been required. This represented the one-third discount that is the equivalent of what is usually available for an early guilty plea plus an additional 16.7 per cent discount in recognition of Rolls-Royce’s ‘extraordinary cooperation’.[11]

The SFO has since agreed to a similar level of discount in several DPAs. The Office of Financial Sanctions Implementation (OFSI) within HM Treasury, which has powers to impose potentially significant monetary penalties on companies and individuals for breaches of financial sanctions law, mirrors this approach, noting in its guidance that it ‘values co-operation throughout its investigation’, particularly in terms of ‘voluntary disclosure, materially complete disclosure and good faith’.[12] The ICO will also take into account the level of co-operation shown by a corporate when deciding on enforcement, and (as discussed further below) corporates may be subject to greater penalties if they fail to co-operate fully with an ICO investigation.[13]

As mentioned, the AFWEL DPA[14] introduced new language concerning the morality of self-reporting, providing further complexion on what ‘co-operation’ really means. Many companies already have in place processes designed to encourage reflection at the most senior levels of management. These processes typically promote consideration of whether to self-report potential criminal conduct that may be identified internally through whistleblowers or otherwise.

15.3.3 Self-reporting

The SFO, the FCA, the OFSI, the ICO and the Competition and Markets Authority (CMA) have all indicated that a corporate should self-report as promptly as possible to be considered to be co-operating.[15] How early a corporate does so is a factor the regulators and enforcement authorities will consider when deciding how to handle the matter, including the appropriate resolution.[16]

However, regulators and enforcement authorities generally do not expect corporates to report all allegations of criminal behaviour as soon as they become aware of them, so a balance needs to be struck.[17] Allegations need to be considered and verified to a certain extent before any potential self-report occurs. For the SFO, reporting wrongdoing but failing to verify it or believing it is inaccurate or incomplete is a factor in favour of prosecution or higher sanctions.[18] The level of investigation required to ‘verify’ wrongdoing is undefined and a difficult judgement call for the corporate and its advisers.

When considering a self-report, regulators and authorities consider the information provided, and the time at which the corporate came forward, to assess whether it was voluntary and complete – generally, disclosure will not be considered voluntary if regulators have already required documents or the corporate knows that an investigation is imminent.[19] There are nuances in the approach taken by different agencies: the OFSI may give credit even when the entity was not the first to voluntarily report the activity (provided the person was not prompted to disclose because OFSI or another agency was already investigating), whereas the CMA requires a potential cartel member expecting leniency to be the first member to report the potential wrongdoing.[20]

Companies should therefore consider the following factors if they wish to maximise their co-operative stance:

  • where possible, the alleged criminal conduct should be reported to the regulator or enforcement authority before it otherwise becomes aware of it. A corporate should consider the possibility of whistleblowers and be aware of reports to other authorities in the United Kingdom or overseas;
  • the corporate is entitled to conduct an ‘initial assessment’ of the allegation. However, as soon as reasonable grounds to suspect wrongdoing are identified, there is an expectation that these will be flagged;[21] and
  • the extent to which a corporate involves the prosecutor in the early stages of an investigation is a relevant factor in assessing co-operation.[22]

For DPAs, although the failure of a corporate to self-report is not necessarily a bar to DPA negotiations, it must be considered when assessing whether a DPA is in the public interest.[23] In the absence of self-reporting, a corporate is likely to need to make up lost ground by demonstrating significantly more subsequent co-operation to earn a comparable degree of leniency.

In Rolls-Royce, there was no self-report at the outset but ‘extraordinary’ co-operation was offered during the investigation, resulting in the SFO and the court giving the same degree of leniency in the DPA as if Rolls-Royce had self-reported.[24]

15.3.4 Conducting an internal investigation with SFO or FCA approval

Following a self-report, the SFO or the FCA expects genuine and constructive co-operation, meaning any internal investigation should be approved by, and done in conjunction with, the relevant enforcement agency.[25] It is likely they will want to have a reasonable degree of involvement in the early stages of an internal investigation. For example, the SFO expects to be able to discuss work plans, timetabling, interviewing and actions regarding personnel, and to give directions (e.g., relating to data capture and processing) and ‘other overt steps’.[26] Both the SFO and the FCA will expect the corporate to provide a copy of any internal investigation report, including source documents.[27]

15.3.5 SFO expectations on data handling

The SFO has expressed particular concern regarding the proper preservation of relevant data. For example, its Corporate Co-operation Guidance advises companies to ensure that the digital integrity of material is preserved, to identify the reasons for any data loss, deletion or destruction, and to create and maintain an audit trail on the acquisition and handling of data.

Preserving the integrity of data (and later collecting it) may require significant effort. Companies may consider evaluating, in advance of any investigation, what data sources they have and how they are stored and accessed.[28] For example, Standard Bank provided documents from email servers held in Africa, inboxes, hard drives and shared drives, paper files, CCTV images and recordings of telephone calls: this material would otherwise have been inaccessible to the SFO.[29] Further examples are Sarclad, Rolls-Royce and Airbus.[30]

The Guidance also notes that co-operation may involve providing material from overseas when it is in the organisation’s possession or control, as well as identifying and facilitating access to data held by third parties.

15.3.6 Facilitating access to witnesses

The SFO has expressed particular concern regarding ‘first accounts’ from witnesses being free from prejudice.[31] Other authorities, including the FCA, are increasingly adopting a similar stance.

From a prosecutor’s perspective, achieving evidence that will perform at trial is a key principle in a criminal prosecution. The first account of a witness is crucial, and the circumstances in which it is obtained can be critical to the credibility and efficacy of the evidence in a trial. Discrepancies between a first account and subsequent testimony, or being unable to demonstrate consistency (i.e., if the prosecutor cannot produce a first account), can undermine the prosecution case.

As such, the SFO places particular significance on obtaining first access to witnesses or to notes or summaries of first accounts. In certain circumstances, the SFO or the FCA may expect corporates not to interview witnesses before consulting the relevant authority,[32] or may request that a corporate not interview potential witnesses before a compelled interview has been carried out or a witness statement obtained. Where a corporate is able to interview witnesses, the SFO or the FCA may wish to have a say in how the interview is carried out and to receive copies of any work-product generated following each interview.

The SFO will expect co-operating companies to make employees and (where possible) third parties available for SFO interviews, including arranging for them to return to the United Kingdom if necessary.

15.3.7 Privilege

The legal professional privilege often applying to communications generated during an investigation has been a focus of regulators in recent years, especially the SFO, particularly in relation to interview notes. Public statements by the SFO make clear that it considers as a ‘significant mark of co-operation a company’s decision’ to waive privilege over notes of witness interviews.[33] Rolls-Royce received credit for voluntarily disclosing, with limited waiver of privilege, memoranda from more than 200 interviews conducted in its internal investigation.[34]

Standard Bank and Sarclad, on the other hand, are understood not to have provided notes (or referred to first-account witness interviews) in their internal investigation reports to avoid waiving privilege, instead providing oral summaries. However, the decision in R(AL) v. SFO[35] demonstrates the difficulties that can arise for the SFO from this approach. The court made plain its view that the SFO had not complied with its duty, as a prosecuting authority, to take further steps to obtain witness interview notes so that they may be disclosed in the criminal proceedings in accordance with the defendant’s right to a fair trial under Article 6 of the European Convention on Human Rights. The SFO was required to ‘assess claims for privilege properly and not cursorily and superficially’.[36]

Further, in Director of the SFO v. ENRC, the SFO initially successfully challenged claims of privilege over various documents produced during ENRC’s internal investigation and subsequent engagement with the SFO.[37] However, this decision was overturned on appeal on the basis that the interview notes and other materials (including the work-product of forensic accountants) were protected by litigation privilege.[38] The Court of Appeal found that criminal proceedings were sufficiently contemplated for litigation privilege purposes at the time ENRC commenced its internal investigation, and they were definitely contemplated when the SFO subsequently contacted ENRC about the same matter. The dominant purpose test for litigation privilege will still apply.[39]

As a matter of principle, maintaining a proper assertion of privilege should be a ‘neutral’ factor as far as obtaining credit for co-operation is concerned. The DPA Code of Practice recognises that nothing in the DPA process alters the fact that privilege is a fundamental right.[40] However, the Court of Appeal in ENRC did note that an examination of a corporate’s co-operation, for the purposes of determining whether a DPA would be in the interests of justice, ‘will consider whether the company was willing to waive any privilege attaching to documents produced during internal investigations, so that it could share those documents with the SFO’. In practice, therefore, the SFO may consider waiving privilege over certain documents to assist them as a sign of co-operation. A corporate ought to consider this factor in its overall engagement.

The Corporate Co-operation Guidance is particularly strong on privilege, signalling that the SFO is continuing its robust stance on assessing (and challenging) corporates’ claims of privilege. The Guidance establishes two new procedural expectations for companies seeking to assert privilege: first, to provide certification by independent counsel supporting any claim of privilege; and second, to provide ‘privilege logs’ itemising each document withheld on the basis of privilege and the basis on which each is privileged. Although time-consuming and expensive, these new procedures may signal that, if the steps are followed, there is a clearer path for a corporate to assert privilege while maintaining a co-operative stance.

When considering co-operation in the context of a DPA, the Guidance suggests the SFO will expect the corporate to disclose ‘witness accounts’ and documents shown to witnesses.[41] It also includes a new express expectation that companies seeking co-operation credit should provide any recordings, notes and transcripts of witness interviews and identify a witness who is competent to speak about the content of each interview.

The Guidance states that companies that retain a legitimate claim to privilege over witness material will not be penalised for asserting privilege (where supported by an independent certification). That said, it is not yet clear whether the SFO will expect such companies to work harder in other areas to ‘make up’ for lack of credit they would otherwise have received. On the other hand, the SFO has emphasised that it will view the waiver of privilege as a ‘strong indicator of co­operation’ and an ‘important factor’ in deciding whether to offer a DPA.[42]

In respect of the regulated sector, the FCA has also highlighted the importance of sharing privileged information generated in internal investigations to be considered co-operative, recognising ‘the needs and the right of firms to claim and protect their rights to legal privilege where appropriate’ but stressing that ‘it should be possible to strike the right balance’ and share appropriate documents with the FCA.[43]

15.3.8 Highlighting exculpatory material to the SFO

The SFO has emphasised the importance of holding individuals accountable for criminal behaviour. The Corporate Co-operation Guidance repeats this overarching objective. It also articulates a new and controversial expectation that a co-operative corporate will assist the SFO in identifying documents or information capable of assisting a potential accused or undermining the case for the prosecution (typically called ‘exculpatory material’).

15.4 Co-operation can lead to reduced penalties

Co-operation with authorities in criminal cases has always been rewarded with a more lenient sentence for a defendant. Conversely, attempts to conceal misconduct may result in a more severe sentence.[44]

Individuals who plead guilty and offer significant voluntary co-operation with a prosecutor may also be entitled to a lesser sentence under section 74 of the Sentencing Act 2020 (amending the Serious Crime and Police Act 2005 (SOCPA)).[45] A defendant enters into an agreement with the authorities under SOCPA to provide assistance, the extent and nature of which is taken into account when he or she is sentenced. The assistance is often directed at obtaining evidence about other individuals or establishing facts that advance the investigation.

The likelihood of prosecution and the likely sanction in the event of conviction are important factors in any decision to co-operate voluntarily; there is no guarantee that it will result in a reduced sanction or complete immunity. The corporate and its advisers should remember that, where there are allegations of criminal offences or regulatory breaches, the regulatory and enforcement bodies’ primary role is to properly investigate and prosecute or otherwise sanction the offender.

Consideration should also be given to the overall impact of a particular potential outcome. For example, while a DPA is likely to result in a lower financial penalty than a conviction at trial, it is also likely to entail additional obligations (e.g., future co-operation and self-reporting, and compliance programme upgrades and assurance) that are not otherwise available as sanctions.

As noted, co-operation with the SFO can result in leniency in penalties. In respect of DPAs, the more serious the offence, the less likely it is that a DPA (as opposed to prosecution) will be considered to be in the public interest. However, in Rolls-Royce, the court acknowledged that, notwithstanding the gravity of the wrongdoing, on the right terms it was in the interests of justice to resolve the conduct by way of a DPA rather than a trial.[46] Nevertheless, the legislation requires any financial penalty that forms part of a DPA to be broadly comparable to a fine the court would have imposed following a guilty plea.[47]

Analysis of recent judgments suggests that a 50 per cent reduction can typically be expected in return for broad and effective co-operation from the outset (this has been the case in seven of the 10 DPAs published to date).[48] However, the discount may be lower, for instance, if full co-operation came ‘relatively late in the day’[49] or when there are a myriad of aggravating and mitigating factors to be assessed.

For example, the AFWEL DPA involved a more complex discount process. Figures for compensation and disgorgement were added together to calculate a ‘harm figure’ that formed the basis of the fine. Multipliers in respect of aggravating and mitigating factors were then applied to the ‘harm figure’ to calculate the fine.[50] The total financial penalty comprised the fine, disgorgement and compensation figures.[51] Co-operation with authorities in the regulated space can have a similar effect on the level of penalties imposed.[52]

In the regulated space, although regulated persons are legally required to co-operate with the FCA,[53] proactive co-operation can also lead to reduced penalties. This can include not pursuing enforcement action,[54] reduced charges or lighter sanctions. The FCA’s Enforcement Guide makes clear that the settlement discount scheme allows a reduction in a financial penalty or period of suspension, restriction or condition that would otherwise be imposed, if agreement is reached at an early stage.[55]

Further, the CMA also operates a leniency regime for self-reporting and co-operating cartel members; the OFSI considers voluntary self-reporting and good-faith co-operation when deciding the level of any penalty (including a potential penalty reduction of up to 50 per cent);[56] and the ICO states that failure to co-operate is an aggravating factor when assessing penalties.[57]

In some cases, the authority in question may have the choice of whether to pursue a criminal or civil (or regulatory) outcome (e.g., the FCA in relation to certain anti-money laundering failures): the corporate’s level of co-operation will be one factor that authorities usually take into account when choosing.[58]

15.5 Compliance

Enforcement authorities have been focusing increasingly on the compliance programmes of corporates under investigation. For example, the SFO considers the quality of a compliance programme relevant to whether a prosecution is in the public interest, whether the corporate should be invited into DPA negotiations and what the terms of the DPA should include.

An organisation’s compliance programme is also relevant to whether it has an ‘adequate procedures’ defence to the offence under section 7 of the UK Bribery Act 2010 of failing to prevent bribery or a ‘reasonable prevention procedures’ defence to the offence of failing to prevent the facilitation of tax evasion under the Criminal Finances Act 2017. It is also relevant to sentencing.[59] Consequently, even if a corporate co-operates with the SFO, its pre-existing compliance programme, any changes it has made to it during the investigation, and the scope for improvement will be relevant considerations as to whether a DPA will be considered appropriate and, if so, on what terms.

The ICO has similarly highlighted the importance of adequate compliance programmes.[60] A corporate should therefore expect that in any engagement with the SFO (and probably other authorities), it will need to be prepared to commit significant resources to explaining and enhancing its compliance environment.

15.6 New management

Recent DPAs have focused on a change in a corporate’s cultural framework. This is an important factor when considering whether a DPA is appropriate and features heavily in external communications about DPAs from senior SFO personnel. In practice, this means the SFO will consider whether corporate leadership is the same as at the time of the misconduct and, separately, whether responsible individuals are appropriately held to account. This informs the SFO’s degree of confidence that the misconduct will not be repeated.

In the AFWEL case, cultural change resulted in a meaningful reduction of the financial penalty. The court stated that the DPA would not have gone ahead if the criminal activity were not so remote from the corporate in its present form.[61] This emphasis on a change in culture continues a thread introduced in the Sarclad DPA.[62]

15.7 Companies tend to co-operate for a number of reasons

With all that said, corporates increasingly choose to co-operate with regulators and enforcement bodies, in many cases very extensively. Sometimes this is just a matter of being a good corporate citizen and maintaining integrity in the eyes of stakeholders, government and the general public. Sometimes there will be considerable stakeholder pressure. Sometimes there is an ongoing relationship with the investigating authority to consider either in the context of previous enforcement proceedings or where the corporate is in an industry that faces heavy regulatory scrutiny.

There may be significant strategic benefits to co-operating. Without some degree of co-operation, a corporate will have little control over, or ability to influence, an investigation. Co-operation that is thorough and genuine may help to resolve the issue in a non-adversarial way (e.g., a DPA), while retaining some control over what, if any, admissions are made and what is said publicly by the relevant authority.[63]

Few corporates will take lightly the financial implications of a prolonged investigation, or the management time and business interruption it entails, nor can corporates afford to be dismissive of the effects of a drawn-out process on employee morale and the risk of ‘talent flight’. For many companies, gaining clarity and certainty and being able to focus on day-to-day business will be an absolute priority.

Finally, no corporate will relish the prospect of a criminal conviction and the reputational impact this will have. Undoubtedly, the mark of criminal conviction carries a major deterrent, such that an alternative, such as a DPA, is perceived to be a better outcome. For many companies, there may be broader implications of a criminal conviction, such as debarment from public tendering, that outweigh the narrow legal merits of challenging allegations of wrongdoing.

15.8 Multi-agency and cross-border investigations

Corporates should expect the involvement of multiple agencies across multiple jurisdictions as the co-operation between agencies and authorities increases. The ways in which regulators and criminal prosecutors choose to co-operate with each other are many and varied (through informal channels of communication, information gateways, memoranda of understanding and other means).[64]

There is undoubtedly an increasing desire for agency co-operation on domestic and international levels, and this is being borne out in practice.[65] Co-operation may be formal or informal, and may range from passive information sharing or more active roles, including interviewing witnesses and allowing secondments.[66]

Voluntary co-operation with an authority can result in requests for the corporate to obtain documents from overseas, wherever possible, as a demonstration of its ongoing and genuine co-operation.[67] A corporate will need to consider all relevant data privacy laws when considering whether to comply with these requests voluntarily.

15.9 Strategies for dealing with multiple authorities

Corporates should proceed on the assumption that authorities share, or will share, information and materials and are likely to obtain evidence from multiple sources, not just from the corporate itself. Accordingly, a coherent strategy should be formulated from the outset. The corporate may find it sensible to engage in an open and pragmatic dialogue with each authority and be proactive in encouraging the authorities to take the same approach with each other wherever possible. Ultimately, if more than one agency has a legitimate basis on which to enforce, it is usually preferable to bring the matter to a combined resolution.

The SFO has set out the factors its prosecutors should consider when assessing whether to enter into a DPA if there is a parallel investigation by another agency in the United Kingdom or overseas, which include the need for early communication and harmonising the approach to matters such as witnesses and privilege, ensuring consistent positions on facts and liability, and coordinating on practical issues such as court dates and market announcements.[68]

There are also additional points for corporates to consider when dealing with multi-agency investigations, including:

  • what enquiries or internal investigation should be conducted;
  • which authorities are likely to be more influential or proactive;
  • ensuring that a consistent approach is taken to explanations, documents and privilege; and
  • if entering settlement discussions, whether it would be beneficial or possible to engage with all authorities at the same time.

15.10 Conclusion

Corporates are increasingly expected to co-operate with regulatory agencies and criminal authorities fulsomely, even when their co-operation is voluntary. The DPAs that corporates have entered into with the SFO demonstrate this expectation, but this behaviour is increasingly expected from regulators and enforcement bodies across the spectrum.

There is increasing pressure on corporates from the public, stakeholders and government to act as good corporate citizens. Maintaining credibility with capital markets can be an additional factor in a decision to co-operate.

Co-operation is relevant at every stage of an investigation, and for every outcome. It requires significant commitment: continual and genuine assistance, prompt self-reporting; and access to hard copy materials, electronic data and potential witnesses. Multiple agencies may also be involved, with differing requests. There can be many benefits to co-operating fulsomely, but it is no easy task.


Footnotes

[1] Matthew Bruce, Ali Kirby-Harris, Ben Morgan and Ali Sallaway are partners at Freshfields Bruckhaus Deringer LLP.

[2] Director of the Serious Fraud Office v. Amec Foster Wheeler Energy Limited [2021], paras. 19–20.

[3] Obligations may arise under the Proceeds of Crime Act 2002, Part 3 of the Terrorism Act, or any reporting obligations that may arise under the United Kingdom’s financial sanctions regime, particularly for entities in the ‘regulated sector’. Further, listed companies will need to consider their disclosure obligations to the market, such as Part 7 of the Financial Services Act 2012 and the EU Market Abuse Regulation and the Market Abuse (Amendment) (EU Exit) Regulations 2018.

[4] Material described in para. 13(6) of Schedule 17 of the Crime and Courts Act 2013 can only be used in limited circumstances but there is no limitation in the use to which other material obtained by a prosecutor during the deferred prosecution agreement (DPA) negotiation period may be put against the corporate or anyone else so far as the rules of evidence permit. See the Deferred Prosecution Agreements Code of Practice (the DPA Code of Practice), paras. 4.4 and 4.5, www.sfo.gov.uk/publications/guidance-policy-and-protocols/deferred-prosecution-agreements.

[6] ibid., p. 1.

[7] Information Commissioner’s Office (ICO), Regulatory Action Policy, p. 24, https://ico.org.uk/media/about-the-ico/documents/2259467/regulatory-action-policy.pdf; Financial Conduct Authority (FCA), FCA Handbook, EG 2.12 (Co-operation).

[8] For instance, the FCA considers that a firm’s pattern of co-operation during the period leading up to the investigation, as well as during the investigation itself, is relevant. The FCA Handbook notes: ‘An important consideration before an enforcement investigation and/or enforcement action is taken forward is the nature of a firm’s overall relationship with the FCA and whether, against that background, the use of enforcement tools is likely to further the FCA’s aims and objectives. So, for any similar set of facts, using enforcement tools will be less likely if a firm has built up over time a strong track record of taking its senior management responsibilities seriously and been open and communicative with the FCA’ (FCA Handbook, EG 2.12.1). The Competition and Markets Authority (CMA) similarly requires continuous and complete co-operation, as well as refraining from further participation in cartel activities (see ‘Leniency and no-action applications in cartel cases: OFT1495’, www.gov.uk/government/ publications/leniency-and-no-action-applications-in-cartel-cases; and ‘Applications for leniency and no-action in cartel case’, OFT, July 2013, www.gov.uk/government/uploads/system/uploads/attachment_data/file/284417/OFT1495.pdf).

[9] DPA Code of Practice, para. 2.8.2(i); FCA Handbook, EG 2.12.1.

[10] R v. Sweett Group, Sentencing Remarks.

[11] SFO v. Rolls-Royce (Case No. U20170036) [2017] Lloyd’s Rep FC 249, para. 19.

[12] ‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022, para 3.29-3.37, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1083297/15.06.22_OFSI_enforcement_guidance.pdf. For example, OFSI noted that TransferGo Limited, despite not offering voluntary disclosure, subsequently (during OFSI’s investigation) ‘fully cooperated with OFSI and promptly provided all information which was requested of it’ (OFSI, ‘Imposition of Monetary Penalty – TransferGo Limited’ (June 2021), https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1008859/050821_-_TransferGo_Penalty_Report.pdf).

[13] An instructive example of the ICO’s tough approach is the £400,000 fine and criminal penalty handed to Keurboom Communications after Keurboom failed to comply with an information notice regarding a breach of the Privacy and Electronic Communication Regulations.

[14] Director of the Serious Fraud Office v. Amec Foster Wheeler Energy Limited [2021].

[15] See, e.g., ‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022, para. 3.33. For example, the OFSI reduced the fine imposed on Standard Chartered Bank for breaches of financial sanctions by 30 per cent in light of the bank’s voluntary disclosure: OFSI Imposition of Monetary Penalty – Standard Chartered Bank, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/876971/200331_-_SCB_Penalty_Report.pdf. For the ICO’s position, see ICO, Regulatory Action Policy, p. 24, https://ico.org.uk/media/about-the-ico/documents/2259467/regulatory-action-policy.pdf. For the FCA’s position, see the FCA Handbook, EG 2.12.1.

[16] DPA Code of Practice, para. 2.9.2.

[17] For the SFO’s position, see a speech by Lisa Osofsky, SFO Director, at the Royal United Services Institute in London, 3 April 2019, www.sfo.gov.uk/2019/04/03/fighting-fraud-and-corruption-in -a-shrinking-world. The FCA ‘expect firms to be able to judge how serious a problem is and where it falls on a continuum between urgent notification and potentially no need to tell us at all’ (speech by Jamie Symington, Director in Enforcement, at the Pinsent Masons Regulatory Conference 2015, 5 November 2015, www.fca.org.uk/news/speeches/internal-investigations -firms). The OFSI notes that breaches should be disclosed ‘as soon as reasonably practicable after discovery’ and that ‘it is reasonable for a person to take some time to assess the nature and extent of the breach, or seek legal advice’ (‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022, para. 3.33).

[18] DPA Code of Practice, para. 2.8.1(vi).

[19] SFO prosecutors must consider ‘the totality of the information that the Company has provided, the extent to which the offending was previously known, if at all, to the SFO, and the extent to which the Company is providing it voluntarily, that is without the threat of imminent disclosure by a third party or compulsion’ (see the DPA Code of Practice). The OFSI ‘will consider the facts and timing of each disclosure individually’ but does not consider disclosure to be voluntary if it comes after it or other regulators have used their powers to compel disclosure of information or if ‘the person has been prompted to disclose the facts because OFSI is assessing a case’ (‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022, para. 3.36).

[20] ‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022, para 3.36; CMA, ‘Leniency and no-action applications in cartel cases: OFT1495’, and ‘Applications for leniency and no-action in cartel cases’, July 2013.

[21] DPA Code of Practice; see, e.g., speech by Lisa Osofsky, 3 April 2019; ‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022, para. 3.32.

[22] See DPA Code of Practice, para. 2.9.2. For example, in the Standard Bank case, the alleged misconduct was reported ‘within a matter of days of it coming to its attention’ (SFO v. Standard Bank plc, Statement of Facts prepared pursuant to para. 6(1) of Schedule 17 to the Crime and Courts Act 2013, para. 4). The court noted that considerable weight was to be attached to the swift and proactive self-reporting (SFO v. Standard Bank plc, Approved Judgment (Case No. U20150854) [2016] Lloyd’s Rep FC 102, para. 27). In Sarclad, after unearthing concerns, Sarclad took immediate action by retaining a law firm to undertake an independent internal investigation and a self-report came six weeks later. The court commended this promptness and co-operation (SFO v. Sarclad Ltd, Approved Judgment, (Case No. U20150856) [2016] 7 WLUK 220; [2016] Lloyd’s Rep FC 509, para. 11).

[23] DPA Code of Practice; see also footnote 15.

[24] SFO v. Rolls-Royce (Case No. U20170036) [2017] Lloyd’s Rep FC 249.

[25] For the SFO, see DPA Code of Practice, para. 2.9.2. For the FCA, see speech by Jamie Symington, 5 November 2015.

[26] For the SFO, see DPA Code of Practice, para. 2.9.2, and Corporate Co-operation Guidance. For the FCA, see speech by Jamie Symington, 5 November 2015.

[27] DPA Code of Practice. For the FCA, see, e.g., the FCA Handbook, EG 3.11.

[28] Where providing data voluntarily to the SFO or when dealing with overseas data, a corporate will have to consider the applicable data privacy laws and take steps accordingly. This may involve proactive and early engagement with the SFO on any potential limitations to the corporate’s ability to provide the SFO with the expected data.

[29] SFO v. Standard Bank plc, Statement of Facts prepared pursuant to para. 6(1) of Schedule 17 to the Crime and Courts Act 2013, para. 4.

[30] Similarly, Sarclad identified and provided relevant information, such as email caches, that extended the investigation beyond the SFO’s original scope (SFO v. Sarclad Ltd, Approved Judgment (Case No. U20150856) [2016] 7 WLUK 220, [2016] Lloyd’s Rep FC 509). Rolls-Royce agreed to provide the SFO with unfiltered access to its records – some 30 million documents – and permitted the SFO to conduct its own digital review to identify potentially privileged documents (SFO v. Rolls-Royce (Case No. U20170036) [2017] Lloyd’s Rep FC 249). Similarly, Airbus collected more than 30 million documents and assisted in the prioritisation of documents (SFO v. Airbus, Approved Judgment (Case No. U20200108), [2020] 1 WLUK 435, para. 74).

[31] DPA Code of Practice, para. 2.9.3.

[32] Corporate Co-operation Guidance, Preserving and providing material, para. 6(i). Further, the court in SFO v. Rolls-Royce (Case No. U20170036) [2017] Lloyd’s Rep FC 249, para. 20(i)) cited Rolls-Royce’s deferring of internal interviews until the SFO had first completed its interviews as evidence of their co-operation with SFO.

[33] See speech by Lisa Osofsky, 3 April 2019.

[34] SFO v. Rolls-Royce (Case No. U20170036) [2017] Lloyd’s Rep FC 249, para. 20(ii).

[35] R(AL) v. SFO and others [2018] EWHC 856 (Admin).

[36] There have been a number of high-profile decisions in relation to interview notes that have led to substantial development of this topic. For example, in the 2016 RBS Rights Issue Litigation [2016] EWHC 3161 (Ch), the High Court rejected claims of legal advice privilege over memoranda of employee interviews prepared by the bank’s lawyers, as ‘client’ was interpreted to cover only individuals authorised to seek and receive advice from the lawyers. The employees interviewed by the lawyers were therefore not considered to be clients of the bank’s lawyers. The FCA has also noted that the practice of reading out notes instead of providing written documents is ‘unhelpful and unwelcome’ (speech by Jamie Symington, 5 November 2015).

[37] SFO v. ENRC [2017] EWHC 1017 (QB) (8 May 2017).

[38] Serious Fraud Office v. Eurasian Natural Resources Corporation [2018] EWCA Civ 2006.

[39] In the ENRC case, the investigation of the allegations in question was initially framed in contemporaneous documents as being for ‘corporate governance reasons’, but the Court of Appeal still found that the dominant purpose was to investigate the facts so the corporate could defend the proceedings that were reasonably contemplated at the time.

[40] DPA Code of Practice, para. 3.3.

[41] ibid., para. 2.8.2(i).

[42] Speech by Lisa Osofsky, 3 April 2019.

[43] Speech by Jamie Symington, 5 November 2015.

[44] See, for example, ‘Fraud, Bribery and Money Laundering Offences – Definitive Guideline’, 1 October 2014, p. 50, www.sentencingcouncil.org.uk/wp-content/uploads/Fraud-Bribery -and-Money-Laundering-offences-definitive-guideline-Web.pdf.

[45] This applies when an offence specified under the Schedule to the Serious Crime and Police Act 2005 (SOCPA) has been committed. Prosecutors holding SOCPA powers include the Crown Prosecution Service (CPS), the FCA and the SFO. See also CPS Guidance on SOCPA (guidance for convictions on or after 1 December 2020: www.cps.gov.uk/legal-guidance/assisting-offenders-immunity-undertakings-and-agreements; guidance for convictions before 1 December 2020: www.cps.gov.uk/legal-guidance/queens-evidence-immunities -undertakings-and-agreements-under-serious-organised-crime).

[46] SFO v. Rolls-Royce, Approved Judgment (Case No. U20170036) [2017] Lloyd’s Rep FC 249, paras. 61–64.

[47] Crime and Courts Act 2013, Schedule 17, para. 5(4).

[48] See, e.g., the Rolls-Royce case in which the SFO offered, and the court approved, a DPA with the one-third discount that is the equivalent of what is usually available for an early guilty plea plus an additional 16.7 per cent discount in recognition of Rolls-Royce’s ‘extraordinary co-operation’ (SFO v. Rolls-Royce (Case No. U20170036) [2017] Lloyd’s Rep FC 249, para. 19). Note that the SFO announced two further DPAs in July 2021. However, further details regarding the relevant companies or the terms of the DPAs have not yet been made publicly available.

[49] SFO, ‘[t]he 40% discount reflects the delayed nature of G4S C&J’s substantial cooperation with the SFO’s investigation’, www.sfo.gov.uk/2020/07/17/sfo-receives-final-approval-for -dpa-with-g4s-care-justice-services-uk-ltd.

[50] See Magistrates’ Court Sentencing Guidelines, ‘Corporate offenders: fraud, bribery and money laundering’, Sentencing Council, www.sentencingcouncil.org.uk/offences/magistrates-court/item/corporate-offenders-fraud-bribery-and-money-laundering.

[51] In SFO v. Petrofac Ltd, where the court followed a similar approach, it listed co-operation as a mitigating factor for calculating the multipliers applied to the harm figure, but noted that ‘there was no voluntary or early admission’ and that there was a large number of aggravating factors. The court therefore applied a higher multiplier than the default starting point. The harm figure was then reduced under the totality guidance in the Magistrates’ Court Sentencing Guidelines (www.sentencingcouncil.org.uk/overarching-guides/magistrates-court/item/totality) for which Petrofac’s co-operation was not a relevant factor. Finally, the court applied the usual one-third discount for a guilty plea (SFO v. Petrofac Ltd, Sentencing Remarks).

[52] See, e.g., the FCA’s Enforcement Guide and the CMA’s guidance on self-reporting cartel conduct (CMA, ‘Leniency and no-action applications in cartel cases: OFT1495’, and ‘Applications for leniency and no-action in cartel cases’, OFT, July 2013).

[53] See FCA Handbook, Principle 11.

[54] See FCA Handbook, EG 2.1.4.

[55] FCA procedure also allows a firm to settle aspects of a case and achieve a discount in respect of those aspects, while continuing to contest other aspects of the case. Timetables for settlement discussions will be set for efficiency and effectiveness, and the FCA will expect firms and others to give it all reasonable assistance in this regard.

[56] For the OFSI, see ‘OFSI enforcement and monetary penalties for breaches of financial sanctions guidance’, OFSI, June 2022. For the CMA, see ‘Leniency and no-action applications in cartel cases: OFT1495’ and ‘Applications for leniency and no-action in cartel case’, OFT, July 2013. For example, Tracerco Limited was granted a 50 per cent reduction in its penalty following voluntary disclosure, with a total penalty value of £15,000 (OFSI, ‘Imposition of Monetary Penalty – Tracerco Limited’, June 2022, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1086645/29.06.22_Tracerco _monetary_penaly_notice.pdf). Standard Chartered Bank was granted a 30 per cent reduction following voluntary disclosure, with a total penalty value of £20.47 million in 2020 (OFSI, ‘Imposition of Monetary Penalty – Standard Chartered Bank’, February 2020, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/876971/200331_-_SCB_Penalty_Report.pdf).

[57] ICO, Regulatory Action Policy, pp. 24 and 28, https://ico.org.uk/media/about-the-ico/documents/2259467/regulatory-action-policy.pdf. An example of the ICO’s tough approach is the £400,000 fine and criminal penalty handed to Keurboom Communications after Keurboom failed to comply with an information notice regarding a breach of the Privacy and Electronic Communication Regulations (ICO Monetary Penalty Notice to Keurboom Communications Ltd, https://ico.org.uk/media/action-weve-taken/enforcement-notices/2014013/mpn-keurboom-ltd-20170503.pdf).

[58] In March 2021, for example, the FCA announced criminal proceedings against NatWest for alleged breaches of regulations 8(1), 8(3) and 14(1) of the Money Laundering Regulations 2007 (MLR 2007). This is a significant landmark, as the FCA’s first criminal prosecution under the MLR 2007, indicating a willingness to pursue a criminal outcome in relation to anti-money laundering systems and controls issues (www.fca.org.uk/news/press-releases/fca-starts -criminal-proceedings-against-natwest-plc).

[60] For the ICO, ‘wilful or negligent approach to compliance’ is an aggravating factor indicating that more serious regulatory action should be taken (Regulatory Action Policy, p. 11, https://ico.org.uk/media/about-the-ico/documents/2259467/regulatory-action-policy.pdf.

[61] Director of the Serious Fraud Office v. Amec Foster Wheeler Energy Limited [2021], para. 29.

[62] SFO v. Sarclad Ltd, Approved Judgment (Case No. U20150856) [2016] 7 WLUK 220, [2016] Lloyd’s Rep FC 509.

[63] A DPA is not, however, guaranteed, even for companies that co-operate. In R v. Skansen, a case prosecuted by the CPS in March 2018, the corporate defendant, which was by then dormant, was convicted, following a trial under s.7 UK Bribery Act. The corporate had demonstrated co-operation by having investigated and self-reported conduct to the police that might not otherwise have come to light, and by co-operating with the police and the CPS. However, a DPA was not offered. The judge questioned why a prosecution was being brought against a dormant corporate against whom it was agreed that no financial penalty could be imposed and whose only sentence could be an absolute discharge. The status of the corporate, and a desire to send a deterrent message appear to have been the reasons: the CPS said that the public interest test for a prosecution was satisfied so that a message could be sent to others in the industry, and they had decided that no ongoing benefit could be achieved by a DPA. The SFO has brokered four DPAs to date, while the CPS has not agreed any. This case is a reminder that a DPA is by no means a predictable outcome – particularly with agencies other than the SFO – even when co-operation exists.

[64] Authorities commonly enter into memoranda of understanding (MOUs) with authorities in their own or other jurisdictions where both exercise similar functions or are concerned with the same issues. MOUs are not legally binding, but declare a shared commitment and aim to provide useful guidelines enabling faster and more efficient sharing of information. For example, the Department for Business, Energy and Industrial Strategy and the CMA entered into an MOU (published on 16 June 2022) that sets out a framework for co-operation, coordination and sharing information regarding the operation of the National Security and Investment Act 2021.

[65] The SFO’s Airbus investigation, for example, was part of a broader international law enforcement effort that involved France’s National Financial Prosecutor’s Office and the US Department of Justice (DOJ) and Department of State relating to conduct in several countries, including China, Colombia, Nepal, Russia, South Korea, Saudi Arabia, Taiwan and the United Arab Emirates (SFO v. Airbus, Approved Judgment (Case No. U20200108) [2020] 1 WLUK 435, para. 3). In the SFO’s investigation into Amec Foster Wheeler, there was co-operation between the SFO, the US Securities and Exchange Commission and the DOJ, and Brazil’s Federal Comptroller General, Attorney General of the Union and Federal Public Ministry relating to conduct in several countries, including Malaysia, Nigeria, Saudi Arabia, India and Brazil (Director of the Serious Fraud Office v. Amec Foster Wheeler Energy Limited [2021]).

[66] For example, in December 2016 the US DOJ Criminal Division announced it would second a lawyer to the United Kingdom to work at the FCA and the SFO to further co-operation between the jurisdictions and share best practice, www.sfo.gov.uk/2016/12/09/us-department-justice-secondee.

[67] Where a corporate does not voluntarily provide such documents, the SFO may seek to compel production. The High Court of England and Wales ruled in R (KBR Inc.) v. SFO [2018] EWHC 2012 (Admin) that the scope of the SFO’s power to compel the production of data extends to data of a UK corporate held abroad and data of a non-UK corporate held abroad, provided there is a ‘sufficient connection’ between that corporate and the United Kingdom.

[68] DPA Code of Practice.

Unlock unlimited access to all Global Investigations Review content