UK

General context and principles

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects as it relates to your country.

As at September 2018, the highest-profile ongoing corporate criminal investigation being undertaken by the UK’s Serious Fraud Office (SFO) is the Unaoil case, which involves allegations of bribery, corruption and money laundering.

The multi-jurisdictional investigation involving Unaoil began in March 2016 (confirmed in an announcement by the SFO in July 2016). Recent developments include the SFO charging four individuals in November 2017 with conspiracy to make corrupt payments to secure contracts in Iraq for SBM Offshore, a client of Unaoil, and additional charges being brought against two of these individuals in May 2018, relating to alleged corruption involving the award of a contract for Leighton Contractors Singapore Pte Ltd to build pipelines in Iraq. In June 2018, the SFO also summonsed two Unaoil entities with offences of conspiracy to give corrupt payments. Investigations or proceedings are understood to be continuing in relation to the various allegations. In common with other major investigations, the SFO has regularly publicised its secure reporting line for any person wishing to provide information that might be relevant to its investigation.

The matter is noteworthy for the manner in which it came to the attention of authorities following the publication of reports by Fairfax Media and the Huffington Post. Second, the scale of the investigation by the SFO is notable; encompassing a wide range of alleged offending across borders and involving other companies associated or connected, or who had had dealings with Unaoil in some way. To that extent, it has a significant sectoral impact involving energy and engineering businesses. As at September 2018, the SFO had announced on separate dates that it had opened a range of investigations ‘related to [its] ongoing investigation into the activities of Unaoil’. These include investigations involving ABB Ltd (announced on 10 February 2017), KBR, Inc (announced on 28 April 2017) and Petrofac Plc (announced on 12 May 2017).

2 Outline the legal framework for corporate liability in your country.

A corporation can be held criminally liable under UK laws and there are several ways this can arise depending on the factual circumstances and the types of underlying conduct. Typically, corporate criminal offences of strict liability and offences involving a company’s vicarious liability for its employees’ actions arise for a range of regulatory offences under UK laws. These features of corporate criminal liability are not considered in detail in this chapter, as they tend to be less common in relation to financial crime matters, with the exception of offences involving company legislation. Important to note generally, however, is that UK principles of vicarious liability of employers for the criminal conduct of employees differ markedly from the US doctrine of respondeat superior.

For more serious offences involving fraud and corruption, under the ‘identification principle’, criminal liability can be attributed to a corporate where the wrongdoing of individuals can be proven to have been done in the capacity of those individuals representing the ‘directing mind and will’ of the company. Historically, a classic hurdle for prosecutors to use the identification principle has been the difficulty in proving beyond a reasonable doubt that the acts of senior managers or directors, for instance, were acts embodying the corporation’s wrongdoing (whereas proving those individuals’ own wrongdoing might be comparatively more straightforward). The identification principle has been subject to other criticism on the grounds of its perceived unfairness – especially with respect to how it may be easier to establish corporate criminal liability in cases involving smaller companies with a restricted number of shareholders, directors and decision makers, in comparison to larger companies or multinationals with more diffuse decision-making among management teams and where complex corporate structures may mean there are numerous reporting lines that would need to be assessed. An area that frequently needs careful analysis is when management teams or business units have been given delegated authorities to act on the corporate’s behalf.

Second, in respect of financial crime matters, the most significant development in corporate criminal liability in the United Kingdom in recent years has been the introduction of two types of offences relating to failure to prevent (and there are ongoing debates to extend these types of offences to other areas of business crime). The common feature of these two offences are that corporates can be held criminally liable for ‘failure to prevent’ certain defined types of wrongdoing, subject in each case to the corporate being able to raise a compliance-related defence (i.e., that it had in place either adequate or reasonable procedures designed to prevent the defined type of wrongdoing occurring). The first example is the Bribery Act 2010’s corporate offence of failure to prevent bribery, whereby a company (incorporated or carrying on part of its business in the United Kingdom) is liable for bribes paid by a third party to win business for the company anywhere in the world, unless it can demonstrate it had adequate procedures intended to prevent bribery. Third parties are broadly defined in the Bribery Act to include anyone who performs services for or on behalf of the company in whatever capacity; for example, an employee, agent or intermediary. The Criminal Finances Act 2017 similarly introduced a new offence of failure to prevent the facilitation of tax evasion with an affirmative defence of reasonable prevention procedures.

3 In your country, what law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies relating to the prosecution of corporations?

In England and Wales, allegations of corporate offending involve the same criminal process, enforcement agencies and court system as investigations and prosecutions of individuals. As a corporate is a legal but not natural person, certain steps vary because of this status (e.g., how it may need to respond to enquiries from a regulator, how a corporate will appear in court (via counsel) and how it is sentenced if guilty of an offence). The following are the key UK law enforcement agencies (non-exhaustively) involved in the regulation, investigation or prosecution of corporates:

• The SFO. This was set up with special powers under the Criminal Justice Act 1987 for the investigation and prosecution of large and complex corporate fraud and corruption. A feature of the SFO that distinguishes it from most other UK law enforcement agencies is its combination of both investigative and prosecution functions, with case teams staffed by legal, investigative and forensic accounting experts.
• National Crime Agency (NCA) and local police forces. These agencies tend to lead investigations involving smaller-scale or less complex fraud or corporate crime, which is then prosecuted by the Crown Prosecution Service (CPS).
• Her Majesty’s Revenue and Customs (HMRC). The HMRC investigates tax-related offending which is then prosecuted by the CPS.
• Financial Conduct Authority (FCA). This is the regulator of the financial services industry. In that capacity, the FCA can impose civil sanctions for misconduct, but also may prosecute regulated firms or individuals for specific market-related offences, such as insider trading and market manipulation. Frequently, cases involving financial services companies fall within the scope of both the FCA and the SFO’s investigation powers. In those cases, the SFO will usually take precedence in relation to the criminal proceedings as it may prosecute a wider range of offences.
• Competition and Markets Authority (CMA). The CMA investigates anticompetitive behaviour; it may impose civil sanctions but can also prosecute cartel offences.
• Department for Business, Innovation and Skills (BIS). This government department investigates and prosecutes activities concerning the affairs of companies, including fraudulent trading, and breaches of bankruptcy or disqualification orders.
• Information Commissioner’s Office (ICO). The ICO investigates and prosecutes or imposes civil sanctions for data protection offences.
• Health and Safety Executive (HSE). The HSE investigates and prosecutes or imposes civil sanctions for health and safety offences.
• Office of Gas and Electricity Markets (Ofgem). Ofgem investigates and prosecutes certain criminal offences under legislation focused on the energy sector.
• UK Office of Financial Sanctions Implementation (OFSI). Although not a prosecutor, The OFSI has significant additional powers to impose financial penalties for breaches of financial sanctions measures.

In Scotland, all criminal investigations are undertaken by the Police Service of Scotland (commonly referred to as Police Scotland) and Scotland’s public prosecutor, the Crown Office and Procurator Fiscal Service (COPFS). Police Scotland has a dedicated economic crime unit, and investigations into serious and complex frauds are overseen by COPFS’ Economic Crime Unit. The SFO can also investigate crimes that have occurred in Scotland if they affect other parts of the United Kingdom, but it cannot prosecute cases in or from Scotland.

In late 2009, the SFO and the CPS published a joint guidance note for corporate prosecutions setting out general principles, and evidential and public interest factors that could be taken into account when making a prosecutorial decision in regard to a corporate. One of the public interest factors that these agencies are entitled to take into account to decide against a prosecution of a corporate is ‘the existence of a genuinely proactive and effective corporate compliance programme’.

4 What grounds must the authorities in your country have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

Law enforcement authorities must have reasonable grounds to suspect that a criminal offence has been committed to exercise their investigative powers.

The SFO may investigate any suspected offence that appears to the Director of the SFO on reasonable grounds to involve serious or complex fraud. The SFO’s powers to compel the production of evidence under section 2 of the Criminal Justice Act 1987 can be exercised in any case in which it appears to the Director that there is good reason to do so for the purpose of investigating the affairs, or any aspect of the affairs, of any person.

Additionally, and only in relation to possible bribery and corruption with an international dimension, the SFO may apply the even lower test under section 2A of the Criminal Justice Act 1987 of whether there is an ‘appearance’ that bribery and corruption may have taken place to initiate a ‘pre-investigation’ (and use its powers under section 2 to determine whether a formal investigation should be undertaken). Therefore, the section 2A powers can only be exercised for the purpose of enabling the SFO to decide whether to open a formal investigation.

5 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another country?

The principle of double jeopardy exists in that a corporation cannot be prosecuted again in the United Kingdom for the same or similar offences on the same facts following a legitimate acquittal or conviction, or other appropriate disposal, such as a deferred prosecution agreement (DPA), by a court in the United Kingdom. European law also extends double jeopardy principle in cross-border cases within the European Union.

However, the protections for corporates worldwide in relation to double jeopardy principles are more varied and likely to be an area of discussion with law enforcement authorities when a corporate is involved in cross-border investigations in multiple jurisdictions. If the predicate offending has been disposed of in one jurisdiction, double jeopardy will not preclude UK authorities from prosecuting ancillary or incidental offences, such as record-keeping or money laundering offences that occurred in the United Kingdom. Nevertheless, there is scope to engage with international regulators with close ties to UK enforcement agencies or mutual legal assistance arrangements with the United Kingdom (or both) to ensure that, in practice, one agency takes primary responsibility for the investigation and enforcement, to avoid any undue prejudice when a case spans multiple jurisdictions. Notwithstanding this, frequently corporates will be expected to respond to enquiries simultaneously with agencies inside and outside the United Kingdom, and there are no general, formal rights on the part of a company to seek to stay a UK investigation pending the outcome of a foreign investigation or set of criminal proceedings that may have commenced prior to the UK law enforcement agencies becoming involved.

6 Does criminal law have general extraterritorial effect in your country? To the extent that extraterritorial effect is limited to specific offences, describe those which have extraterritorial effect, the statutory basis and any conditions that must be met for extraterritoriality to apply.

The jurisdictional basis of criminal law in England and Wales and in Scotland is generally territorial, as an offence will only be triable in the jurisdiction in which it takes place unless there is a specific provision to the contrary, for instance where specific statutes enable the United Kingdom to exercise extraterritorial jurisdiction.

Some examples of exceptions are worthy of note. First, under general common law principles, where a substantial part of an offence occurs in the United Kingdom (even if other parts occur outside the United Kingdom), the UK courts can have jurisdiction.

Second, under Part I of the Criminal Justice Act 1993, certain fraud, theft, forgery, false accounting, blackmail and cheat offences are triable in the United Kingdom where a relevant event, or part of the actus reus of an offence, has occurred in the United Kingdom. The extension of jurisdiction under this statute also applies to attempts and conspiracies to commit these defined offences involving dishonesty and financial crime.

Third, the Bribery Act 2010 (and prior bribery and corruption legislation) has important provisions to investigate and prosecute cases of overseas corruption. A feature of the extra­territorial effect of the Bribery Act is that it applies to substantive corruption offences in which the acts and omissions are entirely outside the United Kingdom, if these involve UK nationals, others ordinarily resident in the United Kingdom, or UK companies, among other defined categories of parties with a close connection to the United Kingdom. The failure to prevent offence also applies worldwide to UK- and non-UK headquartered corporates that carry on part of their business in the United Kingdom.

7 Describe the principal challenges in your country that arise in cross-border investigations, and explain whether and how such challenges are dependent on other countries involved.

The challenges of dealing with cross-border investigations arise from inconsistencies in the approaches of the various law enforcement agencies and the application of different laws in the relevant jurisdictions.

The topmost issues are:

• the differences in the scope and application of legal professional privilege between the jurisdictions, and ensuring that privilege is adequately protected when dealing with document or information requests from the various authorities or when conducting the internal investigation;
• the differences in data protection laws in each jurisdiction, and ensuring that breaches do not occur in the gathering and transferring of data between jurisdictions for the purposes of the internal investigation or responding to requests from a law enforcement authority;
• whether any of the jurisdictions have a positive statutory obligation to make a formal report once the corporation becomes aware or begins to suspect that a crime has been committed;
• identifying which authorities may claim that the offending conduct occurred in their jurisdiction as a result of the fact that with cloud-based communications (email, WhatsApp, i-Message, etc.), offending behaviour can occur in more than one location, for example, a fraud as a result of email that contains a fraudulent misstatement can occur in the locations of both the email sender and the recipient when the message was sent and received;
• whether evidence-sharing or mutual assistance treaties exist between the relevant jurisdictions; and
• whether there are sensitivities between the authorities in the various jurisdictions, for example, whether one authority is taking precedence, and if so whether the other authorities accepted that position.

8 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

Law enforcement authorities in the United Kingdom generally try to co-operate with counter­parts in foreign jurisdictions. Usually at the outset of an investigation, the authorities will agree whether one jurisdiction should take precedence in the investigation and prosecution of the matter (e.g., if the majority of the misconduct took place in that jurisdiction or in the jurisdiction of incorporation) or agree what aspect of a larger cross-border inquiry involving a corporate each will lead on if the case involves a number of components.

Even if it is agreed that the predicate offending in a matter should be prosecuted in one particular country, incidental offences such as books and records offences can still be prosecuted in the other jurisdictions.

Ultimately, UK authorities are responsible for the conduct of their own investigations and prosecutions. The extent to which a decision made by a foreign authority would influence a UK investigation will depend on the particular facts of the matter, the relationship between the UK and the foreign authorities, and the relationship between the United Kingdom and the other country on a state level, including any history of co-operation in timely mutual legal assistance.

9 Do your country’s law enforcement authorities have regard to corporate culture in assessing a company’s liability for misconduct?

Prosecutors in England and Wales must consider the ‘Full Code Test’ set out in the Code for Crown Prosecutors before bringing charges against an individual or corporation. This test has two limbs: the evidential and public interest tests. In Scotland, prosecutors must consider the COPFS Prosecution Code. Depending on the seriousness of the offending, evidence of a very ethical corporate culture could be considered to be a public interest factor against prosecution or taken into consideration by a sentencing judge as a persuasive mitigating factor.

Evidence of an ethical corporate culture is particularly important when a corporation is under investigation for failing to prevent bribery by an associated person, as it can assist in proving the statutory defence that, at the time of the offence, the corporation had adequate procedures to prevent bribery in place. There are similar considerations in respect of the defence of reasonable prevention procedures to the new corporate offence of failure to prevent the facilitation of tax evasion.

Similarly, a company’s compliance with health and safety legislation, and specifically how senior management organise and manage the company’s activities, will have a bearing on any decision to prosecute a company for corporate manslaughter or other associated health and safety offences.

10 What are the top priorities for your country’s law enforcement authorities?

International corruption has been a top priority for the UK government and its law enforcement authorities for the past few years. In December 2014, the UK government published its Anti-Corruption Plan, which outlines anti-corruption initiatives, including the introduction of the International Corruption Unit within the National Crime Agency in May 2015.

In May 2016, the United Kingdom hosted the international Anti-Corruption Summit at which David Cameron, the prime minister at the time, pledged that the United Kingdom would be part of a ‘more coordinated, ambitious global effort to defeat corruption’.

Tax evasion is also a key priority, which has led to the introduction of a new corporate criminal offence of failing to prevent the facilitation of tax evasion, which came into force in September 2017. In 2016, the government launched an open call for evidence in relation to an even wider offence of corporate failure to prevent economic crime, the results of which, at the time of writing, are awaited. However, the UK Solicitor General stated in March 2018 that he felt there was a strong case for such an offence.

A further focus is increased transparency of the beneficial ownership of foreign companies investing in UK property or bidding for UK government contracts. This has prompted the imminent introduction of a register of beneficial ownership of foreign investors, which is intended as a measure to reduce both tax evasion and the likelihood of UK properties being used to launder foreign criminal funds.

Pursuant to the Criminal Finances Act 2017, unexplained wealth orders (UWOs) came into force on 31 January 2018. The legislation allows the High Court to make a UWO in respect of any property (which is valued at more than £50,000) if the Court is satisfied that there is reasonable cause to believe that the property is held by a politically exposed person who has been involved in serious crime or that a person connected with that individual is, or has been, involved in serious crime. So far, it is understood that the NCA has obtained several UWOs but details of these have not been made public.

11 How are internal investigations viewed by local enforcement bodies in your country?

UK authorities have publicly stated that they are not opposed to internal investigations that are carried out in a manner that would not impede a criminal prosecution.

UK authorities expect data gathering exercises to be carried out promptly, ‘covertly’ and coordinated across multiple sites simultaneously. The use by law enforcement agencies in the context of the descriptor ‘covertly’ is intended to ensure potential suspects in a later criminal investigation are not tipped off prior to the collection of data during an internal investigation, which might provide wrongdoers with an opportunity to destroy or delete incriminating material. ‘Covert’ in this context does not mean that companies should conduct internal investigations in a manner that involves unlawful surveillance or data gathering techniques (where they could be separately liable for other offences). In practice, digital material should be forensically imaged and preserved by IT specialists. All procedures used to gather and image data should be recorded and then fully disclosed to the law enforcement authority.

Additionally, UK authorities expect that full and accurate accounts are taken during any witness interviews and, in some circumstances, consideration may need to be given to whether certain interviews should be conducted at all if there is a risk of criticism that a corporate conducted them knowing a law enforcement agency would wish to speak to a witness first and obtain a first account from a witness prior to any internal investigation or review.

Following a judgment of the Court of Appeal in SFO v. ENRC in September 2018, at the time of writing it remains to be seen how and in what circumstances prosecution agencies will seek voluntary disclosure of interview notes from corporates where these may be subject to legal professional privilege. Prior to the Court of Appeal decision in ENRC, provision of interview notes would usually be expected by the SFO in the event of any self-report by a corporate, and any claims of privilege over those accounts were uncertain (and likely to be contested by the SFO). Following ENRC, there are now more established grounds for litigation privilege to apply to interview notes depending on the factual context of an internal investigation. If a corporate has considered that a criminal prosecution could reasonably be in prospect in the future and the interviews are conducted in the context of a dominant (but not necessarily exclusive) purpose that the corporate wished to be in a position later to defend itself in criminal proceedings (or avoid the risk of such proceedings), interview notes may attract litigation privilege. Depending on the particular facts, litigation privilege may therefore apply to interview notes even when a corporate does not know the full details of what is likely to be unearthed at that stage of its internal investigation (i.e., whether there is any criminality at all), or at a stage where an enforcement agency may not have made any decision itself whether to investigate or prosecute a corporate or its employees. If a matter becomes known to an authority before the internal investigation has begun or been concluded, it is highly advisable to enter into a dialogue with the authority to agree the steps of the internal investigation, preventing any accusation from the authority that the internal investigation has obstructed or impeded its criminal investigation, or ‘trampled over a crime scene’, and to ensure that appropriate credit is given for co-operation.

Before an internal investigation

12 How do allegations of misconduct most often come to light in companies in your country?

In addition to the normal means for identifying misconduct, such as audits, screening procedures and whistleblowing, UK companies can become aware of allegations of misconduct through cybercrime or data breaches (e.g., the Unaoil and Panama Papers cases) and due diligence carried out in relation to commercial transactions, including mergers and acquisitions.

If a media outlet informs a company of an allegation they intend to publish, the company will need to consider carefully whether it should make an immediate self-report to law enforcement authorities before the matter is made public. The SFO has made it clear that once an allegation enters the public domain, the option of and credit for a ‘self-report’ may not be available, although this stance seems to have relaxed somewhat following the DPA with Rolls-Royce in January 2017 (see question 41)), which did not involve a self-report, but ‘extraordinary co-operation’ by Rolls-Royce subsequently.

Similarly, as employment tribunals and litigation proceedings in civil courts are generally held in public, if allegations are raised during such proceedings, the company should consider carefully whether it should make a self-report before the matter proceeds to a public trial or tribunal, as well as the increased risk of a report being made to the relevant authority by the disgruntled opponent.

13 Does your country have a data protection regime?

The United Kingdom implemented the Data Protection Act 2018 to complement the General Data Protection Regulation (GDPR). Both new pieces of legislation took effect on 25 May 2018. The GDPR has direct effect across all EU Member States and applies directly to all organisations processing personal data within the European Union. However, it gives Member States limited opportunities to make provisions for how it applies in their country. The Data Protection Act essentially provides the details of local derogations, such as law enforcement processing. Therefore, the GDPR and the new Data Protection Act need to be read side by side. This additional legislation supplements existing UK legislation, such as the Freedom of Information Act 2000, and directly applicable EU legislation, such as the Privacy and Electronic Communications Directive.

14 How is the data protection regime enforced?

The GDPR makes provisions for its own enforcement via the data protection supervisory authority in each EU Member State: in the United Kingdom, this is the ICO. The Data Protection Act also sets out the duties of the ICO, its function and powers and enforcement provisions. The Data Protection Act confers a wide range of enforcement powers to the ICO, including issuing information notices, assessment of compliance notices and enforcement notices. The ICO may also issue financial penalties either as a result of a failure to comply with the aforementioned notices or as a sanction for an infringement of data protection legislation. The maximum fine the ICO can issue for the most egregious infringements is in the amount of 4 per cent of the organisation’s annual global turnover in the previous year.

15 Are there any data protection issues that cause particular concern in internal investigations in your country?

Typically, a considerable amount of evidence will be reviewed in the course of any internal investigation and, as such, the evidence or ‘data’ will need to be handled carefully to ensure compliance with the Data Protection Act. Decisions taken with regard to the processing and disclosure of data should be made in accordance with the Act, and all reasons for those decisions should be documented. If any of the data reviewed contains, or may contain, personal data, particularly sensitive personal data, extra care should be taken. Firms should seek legal advice with regard to what additional measures should be taken in relation to this material. This includes whether redaction of any personal information is required and whether this would be an appropriate mechanism to avoid any data protection breaches. Further, extra care should be taken in circumstances where there may be a transfer of the data outside the European Union or a jurisdiction with an adequacy decision (i.e., a jurisdiction that offers an equivalent level of protection to data as in the European Union).

16 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress the company has if those limits are exceeded.

Authorities that investigate corporate crime in the United Kingdom, such as the SFO, often conduct dawn raids of business or residential premises under the authority of a search warrant issued by a court. Depending on the specific powers of the law enforcement agency conducting a raid, the raid often is undertaken in coordination with a local police force.

When a raid is carried out under a warrant, most authorities are typically empowered to use reasonable force to gain entry to the premises. The authority may only search the premises specified in the warrant and seize items within the scope of the warrant.

Certain categories of material, such as confidential journalistic material or personal records created in the course of a business (for example, patient records in a raid of a medical practice) cannot be seized during a raid without additional authorisations being obtained in some circumstances from particular UK courts. Legally privileged material cannot be seized unless it was created with the intention of the furtherance of a crime (crime-fraud exception), or unless it is inextricably linked to other, seizable material, in which case it can be seized but must be sifted to exclude as far as possible any privileged material from the investigating team at the law enforcement agency. A typical approach is for material subject to a claim of legal privilege to be examined by an independent lawyer for privilege before it is examined by the investigating team (and any privilege material excluded). The use of this power is also subject to the Criminal Justice and Police Act 2001, which entitles the corporate’s legal representative to be present at a review of the material and apply to a judge for the material to be returned.

The CMA may conduct a dawn raid of business premises without a warrant.

Some authorities have additional powers that can be exercised during a dawn raid, for example the SFO and CMA may compel a person to answer questions relevant to the search, such as regarding the location of certain documents.

If there are significant errors in either the process of obtaining the warrant or authorising the raid, or in the execution of the raid, the raid can be challenged by judicial review and rendered unlawful, and the material seized during the raid could be rendered inadmissible. At the time of writing, the Law Commission had announced its public consultation on reforming the law of search warrants.

17 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

As a general rule, legally privileged material cannot be seized during a dawn raid unless the crime-fraud exception applies or where it is inextricably linked to seizable material as described above, in which case other safeguards, including those set out in question 16, should be adhered to.

However, in relation to certain competition investigations, the European Commission does not regard advice from in-house lawyers as legally privileged, so it may seize such material during raids or inspections.

The authorities who investigate corporate crime are routinely accompanied during raids by an independent lawyer specifically tasked with reviewing on-site any material that the company asserts as privileged. It is therefore important to be aware of where privileged material is likely to exist so that assertions can be made before items are seized.

Where there is a dispute as to privilege, the authority will seize the material by sealing it in an opaque bag for review by an independent lawyer at a later date. The company may have its legal representative present during that review.

Digital devices containing both privileged and non-privileged items that cannot be separated may be seized or imaged during a raid. In practice, the privileged material will then be quarantined by digital forensic experts within the authority by applying search criteria provided by the company.

18 Are there any privileges in your country that would prevent an individual or company from providing testimony? Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow in your country from such compelled testimony?

In England and Wales, there is a qualified right of silence when being interviewed as a suspect, and a defendant in a criminal trial has a right not to give evidence. In both situations, the right is qualified as adverse inferences can in certain circumstances be drawn from this silence. However, in Scotland this right to silence is not qualified and no negative inference can be drawn from an interviewee’s refusal to answer questions.

A right of silence does not apply if an authority such as the SFO, the FCA or the CMA exercises specific statutory powers by issuing a notice compelling a witness to answer questions or produce documents. Failure to comply with such a notice without a reasonable excuse can result in a criminal offence. However, the contents of a compulsory interview under these powers cannot be used against the individual except in a prosecution specifically for making a false or misleading statement in that interview. In practice, complications can arise when an individual is initially a witness compelled to produce evidence and then later becomes a suspect in a criminal investigation. Any evidence provided in the subsequent interviews conducted under caution can be adduced against the individual.

19 What legal protections are in place for whistleblowers in your country?

The Public Interest Disclosure Act 1998, as amended, combined with the Employment Rights Act 1996, offers statutory protections to whistleblowers.

The dismissal of a worker, employee or employee shareholder will automatically be unfair if the principle reason for dismissal is that the individual has made a qualifying ‘protected disclosure’. Workers, employees and employee shareholders are also protected from detrimental treatment (e.g., harassment or reduction in pay) on the ground that they have made a qualifying protected disclosure.

There is no requirement for a minimum period of service or any financial cap on the amount of compensation that can be awarded.

Useful guidance is available to employers, including guidance by the Whistleblowing Commission (Whistleblowing Code of Practice) and the BIS (Whistleblowing: Guidance for Employers and Code of Conduct).

20 What rights do employees possess under local employment law that determine how they are treated within a company if their conduct is within the scope of an investigation? What employment rights would attach if they are deemed to have engaged in misconduct? Does it differ for officers and directors of the company?

Suspension pending investigation

Employment legislation does not specifically deal with suspension but case law and guidance issued by ACAS (a public body in the United Kingdom), in the form of the ACAS Code of Practice on Disciplinary and Grievance Procedures (the ACAS Code), requires that employees only be suspended where this is necessary and that the period of suspension be as short as possible. It is also important that employees be informed, preferably in writing, of the nature of the allegations made against them (whether in relation to an internal or external investigation) and, in most cases, suspension should be on full pay and with no loss of benefits. Any failure to follow these principles can result in a breach of the ACAS guidance and a repudiatory breach of contract.

Right to a fair hearing

The disciplinary process should be carried out in accordance with the ACAS Code. As a minimum, the disciplinary process should include a disciplinary investigation to establish the facts of the case. If the investigation finds that there is a case to answer, there will need to be a disciplinary hearing. The employee must be informed of the right to be accompanied by a colleague or a trade union representative at any disciplinary hearing or appeal, to be informed of the issue and to be given a full opportunity to put his or her case in response before any decision is made by the employer.

Employers should carry out their own disciplinary investigation and disciplinary hearing rather than relying on an investigation by the police or an external organisation. If an employee has been convicted, or charged with wrongdoing by the police or another external organisation, this does not mean that the employer can move straight to dismissal. The applicable employment law should be complied with, and the ACAS Code should be followed as far as possible.

These requirements are relaxed when employees do not have two full years’ service with their employer; however, it is best practice to follow a fair process in dismissals, to avoid allegations of discriminatory treatment.

The right not to be unfairly dismissed

All employees with more than two years’ continuous service with an employer have the right not to be unfairly dismissed. In the case of a successful claim, an employment tribunal can award compensation. In most cases, compensation is capped at £95,211, although in certain situations, employees can argue that this compensation cap should be disapplied.

Company director considerations

Directors may also be employees (in which case the above will apply in tandem with any specific issues of directors’ duties). Directors are subject to general duties, which are set out in the Companies Act 2006 and contained within a company’s articles. It may be that the director has acted in breach of one or more of his or her duties as director. If this is the case, both the Companies Act and the company’s articles include provisions regarding the removal of a director. Additional regulations should be considered for directors of public companies.

21 Are there disciplinary or other steps that a company must take in your country when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation? Can an employee be dismissed for refusing to participate in an internal investigation?

Generally there is no strict legal requirement from an employment law perspective to suspend or discipline an individual suspected of misconduct. Some heavily regulated employers, for example within the financial services sector, may be required by their regulatory body to suspend and take disciplinary action against employees who carry out regulated activities. Employees may also be regulated themselves and will have specific obligations towards the regulator.

Failure to take disciplinary action could be regarded by an authority as evidence of poor corporate culture. Furthermore, failure to suspend or dismiss an employee who is capable of impeding a criminal investigation by destroying documents or alerting or interfering with witnesses, could be regarded as obstruction of the criminal investigation.

If an employee refuses to participate in an internal investigation, the employer may carry out the disciplinary process without the employee’s engagement, having first warned the employee in writing. Generally speaking, a request to participate in an internal investigation will be a reasonable management instruction and any unreasonable refusal to engage in this process may constitute misconduct in itself. At all times, it is important that the employer does not interrogate or pressurise the employee into making admissions of guilt and a range of safeguards should be considered for how the investigation is conducted to ensure fairness to the employee.

Commencing an internal investigation

22 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It is good practice to prepare an initial scope of an internal investigation, potentially with a written investigation plan, before commencing the investigation proper, setting out its purpose, the issues to be investigated, the investigation team and reporting lines, how legal privilege will be established and maintained (e.g., the investigation team is instructed by and reports to a lawyer), how digital and hard copy material will be collected and preserved, how staff interviews will be conducted, and any other necessary immediate controls or steps, such as ceasing all future payments to suspect third parties. The scope of an internal investigation may need to be kept under review, depending on factual findings that are possible at different stages in the investigation. Where possible for each stage, it is useful to have target timelines for completion and a clear set of tasks to be conducted.

23 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

In UK law, there are generally no formal legal obligations on a company to conduct an internal investigation into its own affairs. However, conduct rules applicable to some com­panies by the bodies that regulate them may mean an internal investigation is required under those rules, or strongly recommended. Generally, from an effective compliance perspective, a company should always investigate an issue as soon as it comes to light to enable the company to take the following steps.

Stop the offending behaviour

If it is later established by an authority that offending conduct continued after a company had become aware of it, the company could be exposed to a risk of criminal liability itself for allowing potential offending to carry on unchecked and uninvestigated.

Additionally, if after offending conduct has ceased, a company is aware or suspects that it possesses funds obtained from the conduct, but it fails to take any action in regard to those funds (for example, making a suspicious activity report to the National Crime Agency), the company could commit a further money laundering offence.

Preserve all documents and material relevant to the issue

In the event that a law enforcement authority becomes aware of the matter, it would expect the company to have taken all necessary steps to protect and preserve all material that would be relevant to its criminal investigation (including by taking forensic images of digital material) so that the material could be eventually provided to them. Failure to safeguard relevant material could impede a criminal investigation and would be viewed as a lack of co-operation by an authority.

Furthermore, it can be a criminal offence to destroy, falsify, conceal or dispose of relevant documents when a person knows or suspects an investigation of serious or complex fraud is already being, or is likely to be, undertaken by certain law enforcement agencies.

Take remedial or preventive action

Preventive measures should be implemented to ensure that the offending behaviour cannot occur in the company again.

If a company has failed to take any steps to address an allegation of bribery, it is unlikely that it would be able to rely upon the ‘adequate procedures’ defence in the event of a prosecution of corporate failure to prevent bribery under the Bribery Act 2010.

24 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from law enforcement?

Privately owned companies are not required to publicly disclose the existence of internal investigations or contact from law enforcement.

Under the UK Listing Rules, publicly listed companies must, without delay, issue a market announcement of any major new development that may affect their business, if the development may lead to a substantial share price movement. A notice compelling the provision of documents would be unlikely to require an announcement, but confirmation from the authority that the company was a suspect in a criminal investigation would be likely to require an announcement.

Organisations that are authorised by the FCA also have an obligation to disclose to it anything relating to the firm about which it would reasonably expect notice. This would include breaches of UK laws and regulations, civil, criminal or disciplinary proceedings against a firm and fraud, errors and other irregularities.

25 When would management typically brief the board of a company in your country about an internal investigation or contact from law enforcement officials?

If the allegations are serious and could expose the company or directors to criminal liability or reputational damage, the board of the company is typically briefed at the outset and kept abreast of progress.

However, to the extent that members of the board are implicated in the issues under investigation (or are potential witnesses), it may not be appropriate to brief the whole board. In addition, for legal privilege reasons, it may also be beneficial for the company to convene a subcommittee of the board or audit committee to whom briefings are given.

26 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Upon receipt, the notice or court order should be sent immediately to the appropriate person within the business whose function is to deal with such external matters (usually within the legal department); all steps should be taken to ensure that evidence that may be relevant for production under the notice or court order is not deliberately or inadvertently lost, destroyed or altered; and any individuals who may be involved in possible wrongdoing are not tipped off. The exact scope of the request should be determined and clarifications sought if the scope is unclear. The deadline for responding should also be diarised. It is advisable to seek external legal advice if the legal department is inexperienced in dealing with such matters.

To the extent that the company has an internal policy setting out the steps to be taken upon receipt of a notice or court order, this should be followed. Among other steps, the company should consider circulating document retention notices to ensure all relevant data is preserved, taking forensic images of all potentially relevant data sources (e.g., laptops, PCs, tablets and phones), and compiling a database that can be interrogated for documents falling within the request.

Once reviewed for relevance, the results should be double-checked for privilege and copies retained of anything provided to the authorities.

27 How can the lawfulness or scope of a notice or subpoena from a law enforcement authority be challenged in your country?

Depending on the authority and type of notice, it may be possible to informally agree a narrower scope of information to be produced without having to formally challenge the lawfulness or scope. Otherwise the company may challenge the lawfulness or scope of the notice or production order by way of application to court. Usually this challenge will be by way of judicial review, although it may be possible, under certain statutes, for the company to seek a hearing before the court or tribunal that had originally issued the notice or court order (where this is provided for under the applicable statute).

Attorney–client privilege

28 May attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Legal professional privilege has traditionally been claimed over various aspects of internal investigations, which, in recent years, has increasingly been disputed by law enforcement authorities. However, in a recent Court of Appeal case, Eurasian Natural Resources Corporation Limited (ENRC) successfully repelled a challenge by the SFO relating to claims of privilege by ENRC. The SFO sought to challenge claims to privilege by ENRC regarding various documents that were produced by lawyers and forensic accountants during an internal investigation into allegations of bribery and corruption that had arisen from a whistleblower report. The documents in question fell into four categories:

• category 1: notes taken by lawyers of interviews conducted during the internal investigation;
• category 2: materials generated by forensic accountants as part of a ‘books and records’ review;
• category 3: documents, such as a presentation slides, containing or surmising factual evidence, that were used by lawyers to present to ENRC; and
• category 4: emails between a senior executive and the head of mergers and acquisitions at ENRC, who was a Swiss-qualified lawyer.

The Court of Appeal held that documents falling into categories 1, 2 and 4 were protected by litigation privilege. The High Court had already held that the factual updates provided in category 3 were protected by legal advice privilege.

In short, the Court held that a criminal investigation by the SFO could be ‘litigation’ for privilege purposes and that while a party anticipating possible prosecution will often need to make further investigations before it can say with certainty that proceedings are likely, that uncertainty does not in itself prevent proceedings being in reasonable contemplation. The fact that ENRC did not have the information required to evaluate the whistleblower email, therefore causing it to be uncertain as to whether a crime had in fact taken place, was not a bar to having the protection of litigation privilege. The Court opined that it would be wrong to deny a potential defendant the benefit of litigation privilege when he or she asks his or her lawyer to investigate the circumstances of the alleged offence. It concluded that ENRC did contemplate that prosecution was possible when the documents in question were created and these documents were therefore protected by litigation privilege. Much of the reasoning of the decision of the Court of Appeal is highly fact specific in the circumstances of ENRC’s case. Therefore, the judgment should not be interpreted to extend litigation privilege to all documents created in all internal investigations.

Although several areas of the ENRC judgment leave areas of legal professional privilege uncertain, there are nevertheless several standard ways to advance and strengthen any legitimate claim to privilege, such as:

• involving lawyers (whether external or internal) as soon possible;
• marking all communications pertaining to legal advice as ‘privileged and confidential’;
• segregating privileged and non-privileged documents;
• refraining from forwarding or creating new documents that summarise the legal advice received;
• encouraging employees not to amend or quote extracts from legal advice;
• where there is the reasonable possibility of potential litigation at a later stage, recording this in writing when the future possibility arises in an internal investigation, to evidence any future legitimate claim for litigation privilege; and
• circulating legal advice and privileged material only on a strictly need-to-know basis.

Parties are able to obtain legal advice in the context of an internal investigation and communications between a lawyer and a client for the purposes of legal advice continue to be privileged under legal advice privilege principles. These principles generally do not protect communications involving third parties. However, the Court of Appeal in ENRC has expressly left open a question as to whether aspects of current UK law on legal advice privilege (see the Bank of England BIU case) should be reviewed at a later date by the UK Supreme Court. It is therefore likely that the subject of privilege in internal investigations will be a matter of ongoing development of UK law.

29 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

There are two forms of legal professional privilege in the United Kingdom: legal advice privilege, which can be claimed for any communication between a client and lawyer where the client seeks or is given legal advice; and litigation privilege, which can be claimed for any communication between a client, lawyer and third party where the dominant purpose of the communication is use in actual, pending or contemplated litigation.

The holder of the privilege is the client. In the case of corporate investigations, the client tends to be represented by the group of individual employees or directors charged with seeking and receiving legal advice on behalf of the company (or commissioning or conducting the internal investigation) rather than the entire corporate entity. This group of individuals usually includes the in-house legal team and some or all of the board of directors or subcommittee established by a company, but this group should be defined as soon as any external lawyers are engaged or at the outset of an investigation. This helps to ensure that there is a defined group from whom instructions by lawyers can be received and to whom advice is provided, which safeguards any claim of legal advice privilege.

30 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Yes, although not in the context of an antitrust and competition investigation by the European Commission. In-house counsel must always be careful to ensure that they distinguish between legal advice and advice that is commercial in nature, since the latter will not attract legal professional privilege.

31 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

UK authorities have frequently stated that they have no interest in communications between a client and its lawyers as to questions of liability or rights; however, in recent years, law enforcement agencies such as the SFO have challenged assertions of legal professional privilege for factual aspects of internal investigations and have expected the waiver of claimed legal professional privilege in the event of any self-report. This area is now potentially subject to further development in the approach by law enforcement agencies, such as the SFO, while the full implications of the Court of Appeal decision in ENRC are being considered by them.

The authorities have stated previously that a refusal to waive a well-made claim of legal professional privilege will not be held against a company, but a waiver of such a claim would be good evidence of co-operation. It is uncertain whether it is now appropriate to use waiver of privilege as evidence of co-operation, given ENRC. Nevertheless, false or exaggerated claims of legal professional privilege will continue to be considered strong evidence of not co-operating and will be challenged.

The recent ENRC Court of Appeal judgment has confirmed that even when a party may lead the SFO to believe that they might in future waive privilege over certain documents, this does not in itself amount to a waiver of privilege and would only amount to a waiver in the event of a formal agreement to do so.

32 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

There is a concept of limited waiver of legal professional privilege, and it is for the individual or entity waiving the privilege to determine the extent of the waiver.

It is important to be very clear about the scope of the waiver with regard to the purpose for which the privileged information can be used and with whom it can be shared, particularly if a party seeks to prevent the information being shared with other domestic or foreign enforcement authorities or parties in any related civil proceedings. Generally, there are various gateways where evidence is shared between law enforcement agencies in the United Kingdom (and sometimes elsewhere), and proposals for a limited waiver from a corporate may not be acceptable to a law enforcement agency, given their wider duties of disclosure or information-sharing.

33 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

This will depend on a number of factors, including the terms of the waiver, the circumstances in which the material was received by the UK authority, and whether the UK authority disputes the claim of privilege, for example where the UK authority asserts that the material falls within the crime-fraud exception.

34 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privilege does exist in the United Kingdom and can be used to preserve privilege in documents disclosed to third parties who have a common interest in the subject matter of the privileged document or the litigation for which the document was created.

It is advisable when disclosing information under the common interest privilege to ensure that the recipient understands that the document has been disclosed on this basis and to obtain undertakings from the recipient that the privilege will not be waived. Typically, in criminal-related investigations, common interest privilege has very limited practical scope, because it is often in doubt whether two parties do in fact have a common interest.

35 Can privilege be claimed over the assistance given by third parties to lawyers?

Privilege can be claimed over communications with third parties where the dominant purpose of the communication has been use in actual, pending or contemplated litigation. The recent ENRC Court of Appeal judgment has reaffirmed that this is the case.

Witness interviews

36 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes. An internal investigation is a fact-finding exercise and interviews will often be central to any internal investigation. However, it is advisable always to be sensitive to the expectations of investigating authorities, to avoid any criticism that such interviews could have prejudiced the law enforcement investigation. (See also discussions in earlier questions.)

37 Can the attorney–client privilege be claimed over internal witness interviews or attorney reports in your country?

While privilege is often claimed over internal witness interviews, UK authorities such as the SFO have stated historically that they do not accept that the factual accounts of a witness interview are privileged and disapprove of such claims. At the time of writing, this has culminated in an unsuccessful challenge by the SFO to claims to privilege over materials produced during an internal investigation, including notes of 85 interviews conducted in the course of the investigation by ENRC’s external counsel. These included notes of evidence given to lawyers by ENRC’s employees, former employees, subsidiaries, suppliers and other third parties.

The Court of Appeal held that factual notes of what is said by a witness to a lawyer constitute a privileged document on the particular facts of the ENRC case. The Court ruled that ENRC’s reasonable contemplation that an investigation by the SFO was imminent was sufficient to make out a claim for litigation privilege. The documents in question were generated at a time when there was a general apprehension of future litigation taking place as a result of a whistleblower email and early discussion between ENRC and the SFO. This apprehension was enough to be protected by litigation privilege on the facts of that case. The Court of Appeal confirmed that interviews of third parties and ex-employees undertaken for the purpose of resisting contemplated proceedings are covered by litigation privilege.

However, it should be borne in mind that in situations where proceedings are not in contemplation, communications between interviewees and counsel not made in the course of giving instructions to counsel will not attract litigation privilege or legal advice privilege. Only communications between counsel and those entrusted by the company to give instructions to counsel will attract legal advice privilege.

Nevertheless, companies should still be advised to plan any internal investigation activity carefully from the very outset and seek legal advice regarding the scope of and formalities required for any investigation.

Privilege can and should be claimed over reports that include issues of liability or rights, but generally the authorities expect to receive a report of factual findings from which the discussion of liability or rights has been redacted.

38 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Although there are no general, formal requirements when conducting witness interviews as part of an internal investigation, best practice dictates that, irrespective of whether the interviewee is an employee or a third party, they should be informed:

• that the interview is part of a fact-finding exercise;
• if they are implicated in any wrongdoing;
• that the lawyer conducting the interview represents the company and not the interviewee;
• that the interview notes created by the lawyer belong to the company and therefore any privilege in the notes rests with the company;
• the company may choose to provide the notes to an authority (and this is at its election); and
• that the interview is confidential and the contents of the interview should not be discussed with other employees or witnesses (to avoid contaminating their recollection and to generally protect the integrity of the process).

39 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

It is common for interviewees not to be legally represented in initial fact-finding interviews during internal investigations; however, companies should not refuse a request from an individual to be legally represented at his or her own expense. In other circumstances, for example where an employee may incriminate himself or herself during an interview, there are compelling ethical reasons why a company may suggest that an employee may wish to obtain his or her own independent legal advice.

Documents can be put to the interviewee. A copy of each of the documents referred to, or an interview pack, should be retained as part of the record of the interview, as a matter of good internal investigation practice.

Reporting to the authorities

40 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

The Proceeds of Crime Act (POCA) places a specific duty on employees of regulated businesses (i.e., financial services firms and professional services such as lawyers and accountants) to make a report to the NCA if they have reasonable grounds to know or suspect that another person is engaged in money laundering and that knowledge came to them within the course of their regulated business. Failure to make a report in those circumstances carries a risk of imprisonment or a fine, or both for individuals (and fines for companies), unless in the case of individuals they have reported to their firm’s money laundering reporting officer (MLRO). Other similar offences arise in the case of MLROs who have failed to report to the NCA, given their designated statutory duties to do so.

All companies (regulated and non-regulated) should make a report to the NCA if the company has a suspicion that it possesses funds obtained as a result of suspected criminal conduct by the company or employees, as this may be a money laundering offence under the POCA. Other offences can arise if transactions involve the facilitation of money laundering offences by other persons. A report to the NCA of this type of suspicion can provide a statutory defence to money laundering if made as soon as practicable.

A money laundering report to the NCA is not a self-report for the purposes of a DPA (see question 41) or mitigation of sentence. A self-report must be made directly to the relevant authority, such as the SFO.

In Scotland, there is an obligation to report any knowledge or suspicion of serious organised crime to the police when this knowledge or suspicion originates from information obtained in the course of business.

41 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

The question of when and whether to self-report in the United Kingdom has been the subject of considerable debate following the case of Rolls-Royce, which involved a DPA, notwithstanding that there was no self-report by Rolls-Royce.

A DPA is an agreement reached between a prosecutor and a company under investigation and approved by a court. The agreement allows a prosecution to be suspended for a defined period provided the organisation meets certain specified conditions. If the conditions are met, the prosecution is formally discontinued. (For further information about the DPA process in the United Kingdom, see question 55.) Prior to the DPA agreed in Rolls-Royce in January 2017, it would have been advisable for a company to self-report if it wished the matter to be settled by way of a DPA. The SFO had articulated that DPAs would only be available where there had been a genuinely proactive approach by the company, including a full self-report (i.e., complete disclosure of the facts); an acceptance of wrongdoing by the company; reparation (e.g., compensation to the victim); implementation of effective anti-bribery systems to prevent further offending; access to material and information in the company’s possession, including that gathered during the internal investigation (in particular the accounts of witness interviews); and full co-operation with the ongoing investigations and prosecution (for example, by individual employees and directors).

However, the stance that a self-report was a precondition to a DPA seems to have been put into some doubt in light of the DPA secured by Rolls-Royce in circumstances that did not follow a self-report. Notwithstanding the company admitting that senior management had been aware of the allegations of bribery since 2010, no internal investigation into the allegations was launched at the time and no report was made to the SFO. Rolls-Royce did not report to the SFO of its own volition but was approached by the SFO for comment after it had instigated its investigation. The SFO, and indeed the court in approving the DPA, has emphasised that the circumstances in which Rolls-Royce secured a DPA, notwithstanding that it had not self-reported, were due to the extraordinary level of co-operation with the SFO that followed once the offending conduct was already in part known to law enforcement authorities. The ‘extraordinary co-operation’ that was commended in the court’s judgment included a comprehensive internal investigation that extended beyond the original allegations known to the SFO, the results of which were made available to the SFO; disclosure of unreviewed documents; access to witnesses who had not previously undergone interviews by the company; and a limited waiver of any claim for legal privilege – all of which, the judgment suggests, brought to light conduct that otherwise may not have been exposed.

However, we wait to see whether a DPA in these circumstances was an exception or whether the SFO has set a precedent whereby one may remain available in the absence of a self-report if a company co-operates fully once its alleged offending has already been brought to the SFO’s attention. Certainly it is likely to be difficult for the SFO to treat the Rolls-Royce case as truly exceptional if, in the future, another company engages pro­actively with the SFO and extends similar levels of co-operation with an SFO investigation as Rolls-Royce did, in circumstances where the other company had also initially decided not to self-report.

DPAs are only available to corporate defendants and not to the individual employees or directors involved in the criminal conduct.

42 What are the practical steps you need to take to self-report to law enforcement in your country?

Before making a self-report, a company should undertake the appropriate level of investigation to ascertain the extent and nature of the offending, ensuring that the company will not be taken by surprise by further issues that could arise in the course of a criminal investigation.

UK authorities have advised that for a company to be afforded full credit for making a self-report, it must be made within the context of a genuinely proactive and co-operative approach by the company. The following steps are indications of such an approach:

• gathering and preserving hard copy and digital material the authority is likely to request;
• providing a report of the factual findings of the internal investigation, with key supporting documents;
• ensuring that employees are made available for interview;
• taking appropriate disciplinary measures against offending employees; and
• compensating victims, providing this is feasible.

Responding to the authorities

43 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

It is both possible and desirable to enter into a dialogue with the authority immediately upon receipt of a notice to discuss any concerns the company has, for example that the deadline for compliance with the notice is unreasonable, or the description of the information and documents requested is unclear.

The authorities will generally be happy to discuss such concerns and work with the company to find a reasonable and practical solution, so long as the result is that the relevant information and documents are ultimately received in a timely fashion.

44 Are ongoing authority investigations subject to challenge before the courts?

The exercise of powers by any public authority, such as in undertaking an investigation, can be challenged by application to the court for a judicial review if considered to be unlawful.

If found to be unlawful, the court can order various remedies, such as stopping the exercise of that power, rendering it ineffective, or awarding damages.

45 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

While attempting to deal with notices or court orders issued by various jurisdictions as one consistent disclosure package would reduce effort and costs, it is generally advisable to deal with them separately but have protocols in place to ensure consistent approaches are maintained in respect of any relevant documents to be produced. Court orders and notices issued under compulsory powers usually negate data protection laws and any obligations of confidentiality to third parties. Consequently, civil proceedings cannot be brought by third parties against a company for its actions in providing material in response to a lawful court order or compulsory notice as long as the material provided was within the scope of the notice or order. However, if the company voluntarily provides material beyond the scope of the notice or order, and in doing so breaches a confidentiality obligation or data protection law, it could expose itself to claims.

To avoid creating risks of civil and criminal liability, notices and orders should be responded to separately unless the company is able to satisfy itself that the scope of the orders or notices from each of the jurisdictions are, in all important respects, identical.

46 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

Generally, if information is in the control of a company (e.g., a parent company with a right to take possession, inspect or take copies of a subsidiary’s documents), the company will be expected, and may be required, to search for and produce all requested material, even when it is located in another country. In practice, if the company wishes to seek credit for co-operation, it should comply with any reasonable requests, whether or not it is required to.

The exception is when the data protection legislation in the other country does not permit the removal or transfer of the data from that jurisdiction. In those cases, the requesting authority will generally need to use mutual legal assistance to obtain the material through foreign counterparts.

47 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

The UK authorities can and do share information and investigative materials (for intelligence purposes and the detection and prevention of crime) with authorities in various other countries, whether or not there is a mutual legal assistance agreement with that country and regardless of whether the country is providing information or materials in return, although reciprocity is generally expected.

When material is required for a prosecution, a mutual legal assistance request must be made. UK law authorities will only provide assistance that conforms with the UK’s laws and international obligations.

A list of the international mutual legal assistance and extradition agreements to which the UK is a party can be found on the UK government website at www.gov.uk/government/publications/international-mutual-legal-assistance-agreements.

The UK authorities can provide further assistance by conducting dawn raids in the United Kingdom on the foreign authority’s behalf, interviewing witnesses or suspects, freezing assets, or arresting and extraditing suspects.

48 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Law enforcement authorities owe a general duty not to disclose information or material received during the course of an investigation, and which is not otherwise in the public domain, unless the public interest in the disclosure outweighs the private interests of the owner. Furthermore, before disclosing information to a third party, the law enforcement agency should provide the owner with sufficient notice of the request to allow opportunity for objections to the disclosure (Marcel and Others v. Commissioner of Police of the Metropolis and Others [1992] 2 WLR 50). Any objections should be considered and advance notice should be provided of an intention to disclose regardless. Notice does not have to be given if it would be inappropriate or impracticable to provide notice, for example if it would prejudice the investigation of the law enforcement agency requesting the information (R (on the application of Kent Pharmaceuticals Ltd) v. Serious Fraud Office and another [2004] All ER (D) 191 (Nov)).

Section 3 of the Criminal Justice Act 1987 further limits disclosure by the SFO to third parties. Information obtained during the course of an investigation by the SFO can only be disclosed to certain specific government departments or bodies, or competent authorities specified in the Act, and for the purposes of any criminal investigation or criminal proceedings, whether in the United Kingdom or abroad and for the purposes of assisting any public or other authority under the order. The list of competent authorities is wide and includes anybody having supervisory, regulatory or disciplinary functions; however, it does not include liquidators, provisional liquidators, administrators or administrative receivers.

49 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

In these circumstances the company should not provide the documents, but should inform the requesting authority of the reason why these documents cannot be provided (i.e., that the data protection laws in the other country constitute reasonable excuse for lack of compliance).

50 Does your country have blocking statutes? What related issues are implicated by complying with a notice or subpoena?

The collection and use of personal data in the United Kingdom is governed by the Data Protection Act 2018, including restrictions on the disclosure of personal data. Personal data is defined as data that relates to a living individual who can be identified from that data. However, broadly speaking, the non-disclosure provisions in the Data Protection Act do not apply where the material is requested by a notice or court order issued on the grounds that the material is necessary for the prevention or detection of crime, apprehension or prosecution of offenders, or assessment or collection of any tax or duty or of any imposition of a similar nature.

51 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

When material is provided voluntarily and without restrictions, the authority is free to share it with third parties or other authorities, and to use it for any purpose.

Generally it is advisable only to provide material voluntarily having obtained contractual undertakings that agree the restricted basis on which the material has been provided (e.g., only for use by that authority in the course of an investigation and not to be shared with other parties).

While contractual undertakings restrict the authority’s ability to voluntarily provide the material to other parties, they do not prevent third parties from obtaining court orders against the authority requiring production of the material. However, production orders should only be granted when it is in the interests of justice, and the fact that the material came into the possession of the authority under the restrictions imposed by the undertakings may lead a court to determine that it is not appropriate to grant a production order against the authority in that context, particularly as the third party could attempt to obtain the documents from an unfettered source, such as the company.

Generally, authorities are restricted as to how they can share material they obtain as a result of exercising their compulsory powers or court orders, and customarily such material should only be shared if it is necessary for an investigation and the disclosure is proportionate.

Global settlements

52 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Before entering into a settlement with a law enforcement authority, a company should assess the merits and strength of the prosecution and defence cases; the likelihood of conviction; the expected time, cost, reputational damage and other adverse effects of a lengthy investigation and trial; and the likely penalties in the event of a conviction, including possible debarment from public procurement tenders.

The company should then carefully assess the terms of the proposed settlement, including the impact that ongoing co-operation could have on the business (such as legal costs and staff resources); whether the settlement will resolve the matter in all relevant jurisdictions and, if not, the impact the settlement could have in regard to ongoing investigations in other jurisdictions (e.g., whether the authority that has settled will disclose information and assist foreign authorities); and any other adverse impact that the settlement could have on the future of the business.

Ultimately, the company should balance the seriousness of the charge and the effect of a conviction (including whether the conviction results in debarment) against the terms of the settlement, as in some circumstances the terms of a settlement, including, for example, the costs of regular review and monitoring by an independent monitor (typically a large accountancy or law firm) could be more disadvantageous to a company than a conviction.

53 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Penalties on conviction include imprisonment for individuals, fines, compensation and confiscation orders. Individuals can also be disqualified from being a director of a company for up to 15 years. Where DPAs are agreed, monitors may be imposed.

Companies convicted of certain offences, including active bribery and money laundering, must also be debarred from public tendering for up to five years.

Regulatory authorities can impose additional penalties. For example, the FCA can withdraw a firm’s authorisation and prohibit it from undertaking specific regulated activities for up to 12 months, prohibit individuals from carrying out regulated activities, or impose fines on firms or individuals. The Prudential Regulation Authority (the authority responsible for the prudential regulation and supervision of around 1,700 banks and other firms) can restrict a firm’s permission to conduct regulated activities or impose a fine.

54 What do the authorities in your country take into account when fixing penalties?

When fixing penalties following conviction, courts must have regard to the sentencing guidelines published by the UK and Scottish Sentencing Councils.

Specific sentencing guidelines were published in 2014 in respect of corporate fraud, bribery and money laundering offences with the proviso that, when sentencing a company, the court must first determine whether compensation or confiscation orders should be made. Thereafter the court should consider, inter alia, the following issues:

• the level of culpability and financial harm;
• the aggravating or mitigating factors, for example whether the criminal activity was endemic or whether the corporate offered full co-operation with the law enforcement authority during the investigation;
• the financial circumstances of the company; and
• the stage at which a guilty plea was entered (if the matter was not contested).

55 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

DPAs have been available in the United Kingdom (as a result of the Crime and Courts Act 2013) since 2014 as an alternative disposal for corporate offending. DPAs are not currently available in Scotland. Non-prosecution agreements do not exist in the United Kingdom.

The SFO and the CPS have published a Code of Practice explaining the DPA process.

A prosecutor may invite, at its discretion, a corporate suspect into DPA negotiations if it determines that, having identified the full extent of the offending, the evidential test has been satisfied and the public interest would benefit from a DPA. Until the Rolls-Royce case, the orthodox view was that a corporate would only be invited to negotiations when a self-report had been made and the corporate had fully co-operated with the authority. Following Rolls-Royce, it is more likely that a DPA is possible to negotiate in wider circumstances, including when there has been no self-report but subsequent extraordinary co-operation by a corporate with the law enforcement authority.

If it is possible to agree the terms of a DPA and a statement of facts, the corporate will be formally charged with the criminal offence or offences and the matter will be brought before a judge for approval. The judge will only approve the DPA if satisfied that it is in the interests of justice and the terms are fair, reasonable and proportionate. The judge can adjourn the matter to obtain further information or clarification as to the facts or terms.

If judicial approval is given, the criminal proceedings will be suspended for a set period as defined by the terms of the DPA. The terms and facts of the DPA will then be published on the authority’s website.

If the corporate complies with the terms of the DPA, the criminal proceedings will be formally discontinued at the conclusion of the set period. If the corporate breaches the terms and the breach cannot be remedied, the criminal proceedings will resume.

DPAs carry the advantage of avoiding a conviction, affording the opportunity of speedier resolution (relatively speaking) and to continue trading under agreed parameters. They also enable the corporate to avoid the time and costs of an open-ended, lengthy and uncertain criminal investigation and trial that can adversely affect share price and access to finance, and cause difficulties in tendering.

The obvious disadvantage of entering into a DPA arises when the corporate has substantially accepted its conduct would have constituted a criminal offence, and then will need to accept penalties based on a prosecution case that has not been tested at trial, where a corporate could potentially have been acquitted of the relevant charges. A further disadvantage to be carefully considered is that the terms of a DPA are likely to include regular monitoring and audit by an independent monitor (typically a large accountancy or law firm), for which the company will bear the costs.

At the time of writing, four DPAs have been agreed in the United Kingdom. In November 2015, a DPA was agreed in relation to a charge of corporate failure to prevent bribery against Standard Bank PLC in payments made by employees of a former sister company in Tanzania. The key terms of the three-year agreement are: financial orders of US$25.2 million, US$7 million in compensation to the government of Tanzania, £330,000 in prosecution costs, a requirement to undertake a review of the existing compliance programme by an independent monitor and implementation of their recommendations, and full continual co-operation with the SFO and any other domestic or foreign authority as directed by the SFO.

The DPA against XYZ Ltd, anonymised because criminal proceedings are ongoing against individuals, was agreed in July 2016 and involved the payment of bribes to agents across Asia for over eight years. Misconduct was identified at senior levels and so offences of conspiracy to corrupt were accepted by the company as well as a failure to prevent bribery. Its terms included disgorgement of gross profits of £6,201,085, a financial penalty of £352,000, co-operation with the SFO, and a review and maintenance of the organisation’s existing compliance programme.

The third DPA was agreed with Rolls-Royce on 17 January 2017 to cover 12 counts of conspiracy to corrupt, false accounting and failure to prevent bribery. The offending in question took place over 25 years. It involved Rolls-Royce’s civil aerospace and defence aerospace businesses and its former energy business and related to the sale of aero engines, energy systems and related services. The conduct took place across seven jurisdictions: Indonesia, Thailand, India, Russia, Nigeria, China and Malaysia. The key terms of the order include a fine totalling £497 million, comprising a disgorgement of profit of £258.17 million, a financial penalty of just over £239 million and prosecution costs of approximately £13 million. The fine incorporates a discount of 50 per cent reflecting the ‘extraordinary co-operation’ of Rolls-Royce during the investigation. Rolls-Royce also agreed to pay a further US$170 million and US$25.6 million to settle proceedings taken by the US Department of Justice and Brazil’s federal prosecutor, respectively.

The fourth DPA was agreed with Tesco Stores Limited on 10 April 2017. The conduct in question related to false accounting practices undertaken between February and September 2014. The DPA includes a fine of £128,992,500. Owing to reporting restrictions in place at the time of writing, no further information is publicly available regarding the circumstances and terms of this DPA.

56 Is there a regime for suspension and debarment from government contracts in your country? Where there is a risk of suspension or debarment or other restrictions on continuing business in your country, what are the options available to a corporate wanting to settle in another country?

The 2014 EU Public Sector Procurement Directive was transposed into UK law by the Public Contracts Regulations 2015. Under these Regulations, companies must be excluded from public procurement if they have been convicted in the past five years of any offences from a list that includes, among others, conspiracy, corruption, bribery, money laundering and fraud. The corporate offence of failure to prevent bribery (section 7 of the Bribery Act 2010) is not included in this list of offences and does not require mandatory debarment.

The regulations also provide a list of offences that carry discretionary debarment for up to three years, including professional misconduct, non-payment of tax and distortion of competition.

However, the Regulations allow companies to recover eligibility to bid for public contracts following a debarment, by demonstrating evidence of self-cleaning, such as the payment of compensation to the victim of the offending, clarification of the facts and circumstances of the offence in a comprehensive manner, co-operation with the investigating authority, and the implementation of appropriate measures to prevent further criminal offences or misconduct.

57 Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements have been known, for example the DPA agreed between the SFO and Standard Bank PLC in November 2015 was coordinated with the settlement between Standard Bank and the US Securities and Exchange Commission. The SFO will also reference the assistance it receives from foreign authorities at the conclusion of any successful prosecution.

A coordinated approach between the United States and the United Kingdom was also achieved in relation to Innospec Inc and BAE Systems in 2010, although in both cases the court was critical of the coordination.

58 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Parallel private civil actions are allowed. Generally, but not always, the criminal proceedings will take precedence, and civil proceedings can be stayed for the duration of the criminal investigation so as not to prejudice any criminal proceedings.

Private plaintiffs will only gain access to specified information in the authority’s files if they obtain a court order. Before making any such order, the court would carefully consider the reason why the private plaintiff requires the information, whether the plaintiff would be able to obtain the information from any other source, the method by which the authority obtained the relevant information, for example if it was obtained under compulsory powers, and whether the information is likely to contain any confidential, privileged or personal information of third parties.

Increasingly, small numbers of private criminal prosecutions involving allegations of fraud are being conducted in the UK courts. The instigation of a private prosecution is provided for in section 6 of the Prosecution of Offences Act 1985, and is subject to a power of the Director of Public Prosecutions to take over the private prosecution at any stage (and, if the Director so chooses, to discontinue).

Publicity and reputational issues

59 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

It is a contempt of court to publish a report that creates a substantial risk that the course of justice in active criminal proceedings will be seriously impeded or prejudiced. Proceedings are active for this purpose after arrest or charge and until the proceedings have been concluded, for example by acquittal or conviction or discontinuance by the authority. As a result there is generally very little media reporting of criminal investigations in the United Kingdom until the end of the trial, other than to state the facts of arrests and to report court hearings.

60 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

It is common practice for companies to hire a public relations (PR) firm to manage a large-scale corporate crisis to mitigate potential reputational damage. It is important to ensure a consistent approach by opening good lines of communication between the company’s internal marketing department and the external PR firm, and to ensure that the PR firm is aware of any legal or corporate issues (including any agreements reached with the investigating authority with regard to press releases, for instance).

It is also vitally important that public statements do not have the potential effect of prejudicing ongoing criminal proceedings, for example the trial of the company or individual employees, or contradict any defence that the company may later seek to reply on. For those reasons, statements issued by a company under investigation should be brief and factual, and should always be approved by the company’s criminal law advisers.

61 How is publicity managed when there are ongoing, related proceedings?

As stated above, it is vitally important that public statements issued by the company do not have the potential effect of prejudicing ongoing criminal proceedings, such as a related prosecution of employees or third parties. Statements issued by a company in those circumstances should always be brief and factual, and approved by the company’s criminal law advisers until the conclusion of all related proceedings.

Duty to the market

62 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Under the UK Listing Rules, publicly listed companies must issue a market announcement without delay of any major new development that may affect their business, if the development may lead to a substantial share price movement. A settlement of criminal proceedings would generally require such an announcement.

If the matter is settled by way of a DPA, the matter is not settled until it has actually been approved by a judge at a court hearing. In practice, prior to the final hearing (at which the parties will generally expect approval to be given as the terms, etc., will have been examined and challenged at preliminary hearings), the company and the authority will have agreed press statements to be released to the market and wider public as soon as approval is given.

Footnotes

Tom Stocker is a partner, Stacy Keen and Olga Tocewicz are senior associates, and Alistair Wood is a solicitor at Pinsent Masons LLP. Neil McInnes is a partner at Pinsent Masons MPillay LLP.