To self-report, or not to self-report? That is (still) the question

To drive more corporate self-reporting of criminal offences, the SFO recently issued updated guidance on corporate co-operation and self-reporting. Compared with the SFO’s previous guidance, the update is a welcome development for boards, senior executives and investigations practitioners alike. However, serious questions remain when deciding whether to self report potential criminal wrongdoing.

Key facts

• The SFO’s updated guidance on corporate cooperation and self reporting of criminal offences sets out (i) when and how an organisation should self-report potential criminal wrongdoing to the SFO; (ii) what an organisation can expect after making a report; and (iii) how a company may secure “cooperation credit” and be offered a Deferred Prosecution Agreement (thereby avoiding criminal prosecution). 
• The update provides some clarity on what the SFO considers “genuine cooperation”, being a crucial element for an organisation looking for eligibility to negotiate a DPA. Good co-operation practice includes, but is not limited to, early engagement on internal investigations, preserving material promptly (including material held by third parties), waiving legal professional privilege over relevant materials and detailing compliance and remediation plans.
• A streamlined process for self-reporting is described in the guidance, bringing some welcome clarity. The SFO says it will seek to contact the reporting organisation within 48 business hours of a report, decide whether to investigate within six months and target conclusion of DPA negotiations with six months.

Key takeaways

• Publication of this updated guidance chimes with direction of travel of corporate crime reform in the UK where, together with the expansion of liability of organisations for the actions of their senior managers and the impending failure to prevent fraud offence, we see the Government and law enforcement agencies prioritising the fight against corporate crime. The SFO Director has also recently indicated the agency may make greater use of covert techniques and incentivise whistleblowers, both of which we note feature in the SFO’s 2025-26 Business Plan.
• However, corporates are rarely successfully prosecuted, implicated individuals rarely convicted and almost five years have passed since a DPA in the UK. In the circumstances, boards are still faced with a complex and delicate decision about whether to self-report potential wrongdoing or not.
• For the first time, the SFO has explicitly stated that a corporate can expect to be invited to negotiate a Deferred Prosecution Agreement rather than face prosecution (unless exceptional circumstances apply) where it promptly self-reports suspected wrongdoing and fully cooperates.
• It also warns that failing to report may result in a more severe penalty. However, the SFO’s guidance also makes clear that a company that demonstrates significant cooperation could secure a DPA. In other words, ‘waiting and seeing’ could achieve the same result for organisations that are remain incentivised away from self reporting at an early stage. 
• The SFO has repeated that it expects organisations to coordinate with it when internally investigating misconduct. In practice, this will be a tall order for any investigation team. The SFO will expect practitioners to ensure nothing is done that may prejudice a SFO investigation, keep the SFO updated, ensure the investigation is independent, remove implicated individuals, give rolling disclosure, provide facts and documents (including considering whether to a voluntary limited waiver of privilege) and implement a remediation programme.

Shoosmiths’ Investigations and Disputes practice is best known for representing organisations and individuals in enforcement proceedings, conducting internal investigations, and advising on financial crime issues such as anti-money laundering, bribery, and sanctions. The team is also highly regarded for advising on complex change programmes, representing individuals under investigation, and handling litigation following regulatory breaches.