Earlier this month, the UK Serious Fraud Office (SFO) published its Corporate Cooperation Guidance (the Guidance), providing a list of “good practices” it expects from companies seeking to obtain a deferred prosecution agreement (DPA).

The Director of the SFO has said that the Guidance would provide “added transparency about what [companies] might expect if they decide to self-report fraud or corruption to my office” (see our previous blogpost). However, the long-awaited Guidance is very short (five pages) and provides little detail other than in relation to expectations around data preservation.

Many of the SFO’s suggested practices set out in the Guidance are familiar, but the nature and extent of the SFO’s expectations in certain areas raise yet more questions about the benefit of self-reporting and seeking a DPA.

Given the SFO’s well-documented struggles with the prosecution of major corporates and senior individuals, many companies may consider whether self-reporting and seeking to obtain a DPA is the right course of action in the absence of a compelling commercial imperative to do so (such as seeking to avoid debarment).

New expectations

The SFO expects companies to:

• self-report at a very early stage of an investigation and consult with the SFO before taking basic steps to determine the nature and credibility of allegations (for example conducting interviews – see Internal investigations below);
• conduct key functions of the SFO’s investigation at the company’s own cost (see Outsourcing and independence below); and
• waive privilege (although the extent of waiver expected is unclear) and provide confirmation by independent counsel (at the company’s cost) that material withheld on the basis of privilege is privileged – see Privilege below).

It was hoped that Ms Osofsky would adopt a more pragmatic and practical US-style approach to the resolution of investigations. However, compared to the Department of Justice (DOJ), the SFO demands much more cooperation from companies and offers much less in return.

For instance, the DOJ (unlike the SFO) does not consider an organisation to be non-cooperative based on a decision to assert privilege or work product protection, including asserting privilege over interview notes. In its March 2019 Corporate Enforcement Policy, the DOJ provides for a presumption that it will decline prosecution absent aggravating circumstances if a company: (i) voluntarily self-discloses the misconduct; (ii) fully cooperates in any investigation; and (iii) remediates the problematic conduct. By contrast, for a corporate engaging with the SFO “even full, robust co-operation does not guarantee any particular outcome”.

Given this lack of certainty, the expectation of waiving privilege (which may have a consequential effect in other jurisdictions or in related civil disputes) and the expectation that companies will effectively hand over control of their investigation to the SFO at the outset,  many companies will question whether self-reporting to seek a DPA makes commercial sense.

Internal investigations

The SFO has not sought to offer practical guidance on how and the extent to which companies can conduct an initial investigation in a manner which preserves their ability subsequently to seek cooperation credit. This is a strange omission, given that this is one of the fundamental challenges faced in the early stages of an investigation. The Guidance contains an expectation that companies will report to the SFO “within a reasonable time of the suspicions coming to light”, but it also suggests that companies should:

• “consult in a timely way with the SFO before interviewing potential witnesses or suspects, taking personnel/HR actions or taking other overt steps”. This is however, quite unrealistic as it would require the company to self-report before the allegations have been investigated;
• not put “subjects on notice” (which is difficult when conducting interviews); and
• “refrain from tainting a potential witness’s recollection, for example, by sharing or inviting comment on another person’s account or showing the witness documents that they have not previously seen”. This can prove to be difficult if, for example, an allegation is made by one interviewee about another.

In many cases, investigations need to be conducted at pace due to broader commercial and legal factors. Self-reporting to the SFO and waiting for the SFO’s instructions can paralyse a company at exactly the time when it needs to be moving quickly.

Although the DOJ expects early self-reporting and the FCPA Corporate Enforcement Policy states that the DOJ may in certain circumstances ask that a company refrains from conducting certain interviews for a limited period (deconfliction), the DOJ expects to be involved much less in a company’s investigations and, compared to the UK, the potential rewards available to companies that self-report are much greater and more certain.

Outsourcing and independence

The Guidance states that SFO’s investigations will remain fully independent, but it also indicates that the SFO is seeking to outsource key parts of its role (e.g. data collection and review, privilege reviews, and identification of exculpatory evidence). For example, the SFO expects that the company will:

• make accountants available to explain what financial records mean;
• provide relevant material that is held abroad where it is in the possession or under the control of the organisation (which goes further than the recent KBR case, which is currently being appealed);
• preserve means of reading digital files over the life of the investigation and any prosecution and appeal (which could be an extremely expensive undertaking);
• assist in identifying material that might assist any accused or potential accused or undermine the case for prosecution and identify “potential defences that are particular to the market or industry at issue”;
• (where it asserts privilege) provide a schedule of documents withheld on the basis of privilege and certification by independent counsel that the material in question is privileged. This means that privilege reviews will need to be done twice at the company’s expense; and
• make employees and (where possible) agents available for SFO interviews, including arranging for them to return to the UK if necessary.

Previous attempts by the SFO to rely on information gathered and investigations conducted by third parties have caused issues for and criticism of the SFO (see for example the Victor Dahdaleh and Sarclad cases), which as a prosecutor has fulsome duties of fairness and disclosure to a defendant.

 Privilege

In a speech in April this year, Ms Osofsky said that waiving privilege “will be a strong indicator of cooperation” and “an important factor” in any DPA negotiations. However, the Guidance states that organisations will not be penalised for not waving privilege in relation to first accounts, but will be unable to “attain the corresponding factor against prosecution” contained in the DPA Code of Practice (which sounds very much like being penalised). By contrast, in the US the eligibility for cooperation credit is not in any way predicated upon waiver of privilege.

Comments in the DPA judgments to date make clear that waiver of privilege will be only one of the many factors in assessing the extent to which a company has cooperated with the SFO. A company should not be prevented from potentially obtaining a DPA on the basis of its refusal to give up its fundamental right to legal privilege, particularly given the broader issues which feed into a decision on waiver, including the now common trend for civil disputes to arise from criminal matters, and the likelihood of enforcement in other jurisdictions.

Conclusion

The Guidance does not materially assist in the most difficult of decisions, that is, whether to report, when to report and how far an internal investigation should go before reporting. The Guidance makes clear that there will be significant demands on the finances and management time of a company that self-reports (or indeed reports any wrongdoing to the SFO). The SFO requires “cooperation” to include substantial assistance by the company in identifying the evidence, collecting and processing data and preparing the SFO’s case such that it is “trial ready” for the SFO to bring a prosecution against the company and/or individuals.