Eye on Economic Crime: SFO releases new guidance on corporate cooperation and enforcement

On 24 April 2025, the UK’s Serious Fraud Office (“SFO”) launched new guidance for corporates on self-reporting, cooperation and deferred prosecution agreements (“DPAs”). Among other things, the new guidance states that, if a corporate self-reports suspected wrongdoing and co-operates fully with investigators, it can expect to be invited to negotiate a DPA rather than face prosecution, unless exceptional circumstances apply.

The new guidance comes amidst a push by Nicholas Ephgrave, Director of the SFO, to update the SFO’s operations more broadly over the coming year (see our previous update previous update), including by advancing plans to incentivise whistleblowers; reforming disclosure practices; trialling new technology; and, setting up a taskforce to tackle bribery and corruption with international partners (see our update on this).

It remains to be seen if these developments will lead to a sustained increase in enforcement activity from the SFO in the coming months and beyond, but the SFO is certainly making overtures to corporates and individuals to report suspected wrongdoing. Indeed, Mr Ephgrave has said: “If you have knowledge of wrongdoing, the gamble of keeping this to yourself has never been riskier.”

What has changed?

Corporates may be querying the extent to which this new guidance departs from the earlier regime (under the guidance published on 6 August 2019) which also encouraged self-reporting. The guidance published by the SFO on 6 August 2019 asked companies to go “above and beyond what the law requires” in order to be deemed “co-operative”. Once deemed “co-operative” the corporate could then potentially be offered the chance to enter DPA negotiations but a DPA was not necessarily considered the default pathway following self-reporting and co-operation.

The key difference now is that the SFO no longer states that even where there are efforts to self-report and achieve good cooperation, a DPA is only a possibility. In other words, it appears that the SFO is heavily favouring DPAs such that it will only be in exceptional cases that the combination of a prompt self-report and full cooperation will result in prosecution rather than an invitation to negotiate a DPA.

However, there is some uncertainty regarding how strictly the SFO’s new approach will be applied. The Amec Foster Wheeler Energy Limited (“AFWEL”) DPA dated 28 June 2021 sets a precedent of corporates securing DPAs without having self-reported. Lord Justice Edis’ judgment approving the DPA was published on 1 July 2021 and in that Edis LJ condemned AFWEL’s subsidiary, Foster Wheeler Energy Limited (“FWEL”), for its “deplorable” failure to self-report to the SFO when it had already received investigation reports produced by the company’s lawyers in 2007 to 2009. Edis LJ stated that FWEL should have reported to the SFO “as a matter of ethical corporate governance”. Crucially, however, this was not taken into account in determining the financial penalty.

It is therefore possible that future investigations and DPAs will go one of two ways: either the SFO will implement its new guidance so strictly that DPAs will only be available if the instructions on self-reporting and cooperating are followed, or, despite the SFO’s new focus on DPAs, we will see more AFWEL-type scenarios arising whereby a company which has not self-reported may still enter a DPA under the undefined “exceptional circumstances”.

How to self-report

In order to self-report, initial contact can be made through the secure reporting form. A self-report should identify all relevant known facts and evidence concerning the suspected offences, the individual(s) involved (both those inside and outside the organisation), and the relevant jurisdiction(s). At this stage, the reporting entity should also confirm the whereabouts of key material and any risks associated with the destruction of key evidence or the dissipation of relevant assets.

Cooperative conduct

The degree to which a corporate co-operates with the SFO will be a key factor when deciding how a case is resolved and the level of penalty ascribed.

The guidance provides an illustrative list of cooperative conduct including:

• preservation of digital and hard copy material;
• presenting the facts on suspected criminal conduct clearly;
• early engagement with the SFO on any internal investigation;
• providing information on any disciplinary action taken and changes to personnel made as a result of the offending;
• providing financial information to quantify the benefit and/or harm the offending has caused;
• presenting a thorough analysis of the corporate’s compliance programme and procedures in place at the time of offending and how the corporate has remediated, or plans to remediate, any ongoing deficiencies.

Uncooperative conduct

The guidance also sets out examples of uncooperative conduct including:

• “forum shopping” (i.e. seeking to exploit differences between international law enforcement agencies or legal systems);
• attempting to minimise or obfuscate the involvement of individuals;
• tactically delaying providing information or material;
• providing unnecessarily large amounts of material that may hinder the effectiveness of the SFO’s investigation.

The SFO’s promise

In return, a self-reporting company can expect the SFO to:

• contact it within 48 business hours of a self-report or other initial contact;
• provide a decision whether to open an investigation within six months of a self-report;
• conclude its investigation within a prompt time frame;
• conclude DPA negotiations within six months of sending an invite.

When to self-report – an open question?

Where suspected wrongdoing has occurred, corporates will be more likely to avoid prosecution if they self-report in a timely fashion and continue to cooperate with the SFO’s subsequent investigation. Notably, though, the SFO has not clarified in its new guidance the timeframe within with a self-report ought to occur. Instead, the guidance says “what amounts to a reasonable time will depend on the circumstances.”

***

In light of the SFO’s evolving enforcement strategy, businesses should take steps to review their risk management and compliance programmes to ensure they are effective at identifying, assessing and mitigating corporate crime risks, including in relation to fraud and bribery. The Mayer Brown team is closely monitoring these developments and their potential implications, and is fully equipped to advise companies in all sectors.