Source: https://globalinvestigationsreview.com/benchmarking/the-practitioner%E2%80%99s-guide-to-global-investigations-fourth-edition/1212369/self-reporting-to-the-authorities-and-other-disclosure-obligations-the-uk-perspective
Timestamp: 2020-07-16 18:11:33
Document Index: 621121320

Matched Legal Cases: ['EWCA ', 'EWCA ', 'EWCA ', 'UKSC ', 'EWCA ', 'EWCA ', 'EWCA ', 'EWCA ']

Self-Reporting to the Authorities and Other Disclosure Obligations: The UK Perspective - GIR - Global Investigations Review
A corporate’s voluntary decision to self-report requires directors to evaluate the potential benefits and risks involved in doing so, while complying with their duties under the Companies Act 2006 to consider and act in the best interests of the company as a whole.[3] Key benefits of self-reporting include the ability to manage the timing and content of the information being provided to the authorities, the potential for securing a DPA (or other negotiated settlement), reducing any financial penalties, minimising or managing reputational fallout, and achieving an earlier and more predictable resolution than may otherwise be possible. Particular risks include potential disruptive and damaging action by investigating authorities, damage to share prices, the removal or suspension of senior management,[4] costly internal investigations (including potential regulator involvement and the potential loss or waiver of privilege over key material) and potential civil litigation. The still relatively small body of decided cases in relation to DPAs, together with guidance setting out the circumstances in which they will be contemplated and entered into, provide some direction as to whether self-reporting may produce a negotiated outcome.
The stakes for individuals (usually directors) are also higher than ever in the United Kingdom – those working in firms regulated by the Financial Conduct Authority (FCA) or the Prudential Regulation Authority (PRA) will need to consider how the (relatively) new individual accountability regimes may provide those regulators with an easier route to regulatory enforcement action against them, in addition to any criminal and civil liability.
Frequently, questions as to how to deal with internal disclosures made by whistleblowers and, in those circumstances, whether, when and how to self-report matters to authorities, go hand in hand. Similarly, where a corporate operates in multiple jurisdictions, any trigger of mandatory reporting obligations in one jurisdiction warrants careful consideration regarding corresponding mandatory or voluntary reporting in others – particularly in light of authorities’ increasingly collaborative approach to (formal and informal) sharing of information.[5]
The decisive and effective management of the risks and benefits of self-reporting, which typically involves balancing complex questions of fact and (criminal, regulatory and employment) law is critical and can help to conclude swiftly or pre-empt regulatory intervention. All these considerations play out against the backdrop of an obvious tension between self-reporting with sufficient speed to obtain or maximise co-operation credit and the chance of a DPA on the one hand, and taking the time to investigate an allegation sufficiently to understand whether, when and what to report on the other. The Court of Appeal’s 2018 decision in the ENRC case[6] emphasises the importance (for the purposes of asserting legal privilege) of recording clearly and in good time the points at which a firm considers that it is involved in the self-reporting process and that litigation or criminal prosecution is reasonably in contemplation.
3.2Culture and whistleblowing
3.2.1The importance of culture
The FCA Handbook and PRA Rulebook set out the authorities’ expectations that regulated firms will consider adopting internal procedures encouraging workers to blow the whistle internally about matters relevant to the functions of the FCA or PRA.[7] What is more, in response to recommendations by the Parliamentary Commission on Banking Standards in 2013, the FCA and the PRA published new rules, which have made it a requirement (since 7 March 2017) for in-scope banks and insurance firms to allocate responsibility for whistleblowing under the individual accountability regimes (i.e., the Senior Managers Regime, and the Senior Insurance Managers Regime) to a ‘whistleblowers’ champion’, who must be a non-executive director.[8]
Versions of these individual accountability rules are being introduced for all UK-regulated financial services firms. At the time of writing, the rules giving effect to this extension were due to enter into force in December 2019. There are variations as to how, and the extent to which, some aspects of the regulators’ rules and guidance on whistleblowing apply to different types of financial services firms. However, regulatory guidance makes clear that other types of firms should regard the stringent rules currently in place for banks and insurers as best practice and that failures to implement appropriate arrangements may have adverse consequences on the assessment of firms’ and individuals’ ability to meet the required threshold conditions and fitness and propriety standards.[9]
In firms where one is required, the whistleblowers’ champion is responsible for overseeing the effectiveness of internal whistleblowing procedures, including arrangements for protecting whistleblowers against detrimental treatment, preparing an annual report to the board, and reporting to the FCA where, in a case contested by the firm, an employment tribunal finds in favour of a whistleblower. Selection of the whistleblowers’ champion should involve careful consideration of the proposed individual’s standing and role within the firm, as well as the capacity, resources and access (e.g., to people and information) necessary to effectively discharge the responsibility for ‘ensuring and overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on whistleblowing and for ensuring staff who raise concerns are protected from detrimental treatment’.[10] As a result of this new whistleblowing regime, the significance of whistleblowers will likely only increase.
Whistleblowing also features in the UKBA framework – under section 7 of the UKBA, a relevant corporate organisation commits an offence where a person associated with it bribes another person, intending to obtain or retain business or a business advantage for the firm. The firm has a defence if it can show that it had in place ‘adequate procedures’ to prevent such bribery. The Ministry of Justice published statutory guidance on ‘adequate procedures’ in March 2011, pursuant to section 9 of the UKBA.[11] That guidance recommends that adequate procedures should include procedures for reporting bribery ‘including “speak up” or “whistleblowing” procedures’.[12]
Similarly, whistleblowing is featured in guidance published by the UK tax authority, HM Revenue and Customs (HMRC), in February 2019 in relation to the corporate offences of failing to prevent the facilitation of tax evasion under sections 45 and 46 of the Criminal Finances Act 2017 (CFA). It is a defence to those offences to show that ‘reasonable prevention procedures’ were in place (or that it was reasonable not to have any in place). Although, like its equivalent issued in respect of the UKBA, it is careful to avoid prescribing which particular measures specific corporate entities should have in place, the guidance issued by HMRC indicates that a demonstrable commitment to whistleblowing may assist corporate entities with establishing that arrangements maintained by them amounted to ‘reasonable prevention procedures’.
Codes that govern prosecutors’ decisions to bring charges against corporates,[13] and the DPA Code of Practice (the DPA Code)[14] itself, set out public interest factors for and against prosecution,[15] which, as Lisa Osofsky put it recently, ‘instruct us to take into account the existence of effective compliance programmes and speedy self-reporting. It is about incentivising the private sector to cooperate in preventing crime, to be willing to report it if it occurs nonetheless, and to co­operate when we investigate and prosecute those who have transgressed.’[16] A self-report is also relevant at later stages in the UK criminal justice process. The Sentencing Council’s Definitive Guideline,[17] which was effective from 1 October 2014 in relation to the sentencing of corporates for fraud, bribery and money laundering offences, and which is considered in setting financial penalties under a DPA, takes into account a corporate’s culture in the event of a conviction.[18] Further, the amended Public Contracts Regulations 2015, introduced in February 2015, allow blacklisted companies to bid for public contracts if they can prove (among other things) that they have ‘clarified the facts and circumstances in a comprehensive manner by actively collaborating with the investigating authorities’ and ‘taken concrete technical, organisational and personnel measures that are appropriate to prevent further criminal offences or misconduct’.[19]
3.2.2Whistleblowing
The SFO launched its whistleblowing hotline (SFO Confidential) in 2011, although reports are now made electronically to the SFO’s Intelligence Unit through the ‘secure reporting form’.[20] The SFO’s take-up of cases for investigation, based on such reports, remains low.[21]
The FCA managed 1,119 cases from whistleblowers in 2018, taking further action in 95 of these. The FCA has previously indicated that it expects to see an increase in the proportion of reports that lead directly to enforcement action or other intervention, or that provide intelligence of significant value, although these predictions are yet to come to fruition as the proportion of cases in which it has taken action has in fact declined slightly in recent years (10 per cent in 2017 and 8.5 per cent in 2018).[22]
The SFO has been keen to emphasise that whistleblowing is one avenue by which it may come to hear of alleged criminal conduct: ‘Any such source can give us, or more particularly the Director, reasonable grounds to suspect the commission of an offence involving serious fraud, bribery or corruption and, with it, the power to open a criminal investigation.’[23] However, while whistleblower reports in the United Kingdom account for a proportion of the investigations commenced by the SFO, they are by no means the majority. They have led to some relatively high-profile successful prosecutions, although to date these have largely concerned individuals rather than corporate organisations.[24] More are expected to follow, including some of the SFO’s current flagship investigations and prosecutions into large corporates. In September 2013, the SFO commenced criminal proceedings against Gyrus Group Limited, the UK subsidiary of Olympus Corporation, in connection with a worldwide fraud valued at approximately US$1.7 billion. That investigation flowed from the widely publicised whistleblowing disclosure made by Michael Woodford, the former CEO of Olympus, although the investigation has since been discontinued following a Court of Appeal judgment in February 2015, which ruled that English law does not criminalise the misleading of auditors by the company under audit. Separately, in December 2012, the SFO started an investigation into Rolls-Royce plc following a whistleblower report, although, despite the company having concluded a DPA with the SFO in January 2017,[25] the SFO confirmed in February 2019 that no charges would be brought against individuals. The investigation into ENRC by the SFO was also influenced by whistleblower allegations first made to the company by email and then published in the media a few months later.[26]
3.3The evolution of the link between self-reporting and a DPA
DPAs are now an established feature of the UK investigations landscape. The Director of the SFO, Lisa Osofsky, has spoken of her commitment to bringing the most complex and difficult cases of crimes to trial or, if in the public interest, to resolution through DPAs.[27] At the time of writing, five years and five DPAs after the introduction of the regime, there are some useful indications as to the SFO’s stance – and equally importantly the courts’ – in the cases decided (including those where DPAs have not been concluded), and in the operation of prosecution guidance in ongoing investigations and negotiations that may lead to further DPAs. The SFO’s Corporate Co-operation Guidance,[28] issued in August 2019, gives greater clarity about when the SFO will consider a corporate organisation to be behaving sufficiently co-operatively to justify the commencement of discussions about possible negotiated outcomes. The Corporate Co-operation Guidance forms part of the SFO’s internal Operational Handbook. It is published on the SFO’s website in the interests of transparency, and the Guidance clearly states that it does not create legally enforceable rights, expectations or liabilities. The Guidance sets out what in practice constitutes co-operation. It focuses on the steps companies need to take to assist the SFO with its investigation, including by setting out the SFO’s expectations with regard to the timeliness and extent of self-reporting by co-operating corporate organisations; in its introduction, it states:
Co-operation means providing assistance to the SFO that goes above and beyond what the law requires. It includes: identifying suspected wrong-doing and criminal conduct together with the people responsible, regardless of their seniority or position in the organisation; reporting this to the SFO within a reasonable time of the suspicions coming to light; and preserving available evidence and providing it promptly in an evidentially sound format.
However, to understand the effect of any such co-operation, companies and practitioners still have to look to the DPA Code.
The DPA Code sets out prosecutors’ expectations in relation to self-reporting. A key factor when deciding whether a DPA is appropriate, to be weighed with other factors relating to the nature and seriousness of the offending, is whether the corporate has been ‘genuinely proactive’ in its approach.[29] This is measured by reference to the factors including the timing of a corporate’s self-report, and how comprehensive, relevant and useful the material is (particularly in the context of any potential action to be taken against individuals).
The DPA Code makes clear that the SFO (or Crown Prosecution Service (CPS)) expects to be ‘notified’ of wrongdoing ‘within a reasonable time of the offending conduct coming to light’ for a DPA to be a realistic option.[30] The word ‘notified’ in this context replaced the word ‘reported’ originally included in the draft of the DPA Code. Although (perhaps given that it was not the subject of a consultation exercise prior to its publication in August 2019) the same distinction between ‘reporting’ and ‘notifying’ is not drawn in the Corporate Co-operation Guidance,[31] the message prosecutors are seeking to convey in both the DPA Code and the Corporate Co-operation Guidance is that corporate organisations wishing to obtain as much co-operation credit as possible should not wait until they have carried out their own detailed internal investigation before self-reporting concerns about possible wrongdoing. The Corporate Co-operation Guidance does not provide any further detail about when the SFO expects matters to be brought to its attention. Instead it reiterates previous general indications that this should occur ‘within a reasonable time’ of the corporate organisation becoming aware of the relevant matters. What is clear is that prosecutors expect to receive an initial notification of circumstances giving rise to concerns that criminal wrongdoing may have occurred. They do not expect or wish to receive a completed investigation report. As is set out in both the Corporate Co-operation Guidance and the DPA Code, they expect to be involved in the investigation at the planning stage and certainly before any witness interviews are conducted.[32] In cases where significant historic wrongdoing that is not already known to prosecutors and may suitably be resolved through a DPA comes to light, firms should consider making an initial notification to the SFO (or CPS, if appropriate) when they file suspicious activity reports (SARs) or other statutory reports (whether in the United Kingdom or abroad).
The timing of notification relative to details entering the public domain is of particular importance. At the time of writing, Rolls-Royce remains the highest-value DPA concluded in the United Kingdom. That it was still possible for the SFO to conclude a DPA with Rolls-Royce in 2017 despite some details of wrongdoing being already known to the SFO illustrates that this is just one factor informing a prosecutor’s approach and does not by itself determine whether a DPA will follow.[33] However, as Sir Brian Leveson, then President of the Queen’s Bench Division, noted in respect of Rolls-Royce, the case was anomalous in this regard, and it was necessary for the company to provide ‘extraordinary’ co-operation and to notify the SFO of matters ‘of a different order’ to those it would otherwise have known to obtain credit for self-reporting in the context of DPA negotiations.[34] Absent such extraordinary co-operation and disclosure, it is clear that a failure to notify the SFO of matters before they become public (or before negative headlines are threatened or imminent) will jeopardise the prospects of successfully negotiating a DPA.
The decision of the SFO in December 2015 to prosecute Sweett Group plc for the corporate offence of failure to prevent bribery under section 7 of the Bribery Act 2010 also illustrates this. Sweett self-reported to the SFO upon learning that a newspaper intended to publish allegations of involvement in bribery in connection with Middle Eastern construction consultancy agreements. Although informal discussions about DPAs did commence at one stage of the SFO’s investigation, they were unsuccessful; and Sweett was deemed to have been un-cooperative for much of the investigation, leading ultimately to conviction and the imposition of a fine of £2.25 million in February 2016. Sweett’s experience contrasts starkly with that of Standard Bank plc, with which the SFO agreed the first DPA in the United Kingdom in November 2015.[35] The SFO, and subsequently the court, highlighted and commended Standard Bank for reporting concerns to the SFO within weeks of the suspicious payment, and within days of filing a SAR.
The court’s judgments in respect of Standard Bank and the other corporates with which DPAs have been concluded have added some colour to the indications in the DPA Code as to what the courts consider a corporate must do in practice when self-reporting to demonstrate ‘genuine and proactive’ co-operation. As already noted, these indications have been supplemented most recently by the Corporate Co-operation Guidance. Although it reflects what has occurred in previous cases where DPAs have been negotiated and approved (and other decided cases concerning issues arising during SFO investigations) and what continues to happen during discussions between co-operating corporate organisations and the SFO in cases where a DPA may be an option, at the time of writing, it has not been applied or referenced in any reported cases. For now, it has to be read together with the body of case law relating to DPAs in the United Kingdom. In these cases, ‘genuine and proactive’ co-operation has manifested itself largely through pragmatic decisions by firms to waive privilege on a limited basis and to make material available voluntarily (i.e., without requiring the SFO to use powers of compulsion, although the Corporate Co-operation Guidance confirms that the fact that the SFO may perceive a need to use its powers of compulsion will not necessarily mean that the corporate organisation concerned is not behaving suitably co-operatively). In all cases it has been crucial to show clear separation from the individuals alleged to have been involved in wrongdoing and commitment to providing material to be used in prosecutions against them, although in no case yet concluded has such material contributed to the conviction of any individual for the conduct in respect of which the corporate entity entered into a DPA.[36]
In early 2018, the CPS sent a useful reminder that self-reporting, however promptly, is only one factor influencing whether a DPA may be available. In R v. Skansen Interiors Ltd[37] – the first contested case in relation to the corporate ‘failure to prevent’ offence under section 7 of the UKBA – Skansen was prosecuted despite self-reporting to the National Crime Agency (NCA) and provided extensive co-operation to the CPS in the ensuing criminal investigation, including by disclosing privileged material. Skansen argued in court that its policies and procedures were adequate for a small company with operations only in the United Kingdom and a staff of 30, but the jury returned a guilty verdict, finding that the policies and procedures in place were insufficient for the purposes of the ‘adequate procedures’ defence. The CPS justified its decision to prosecute rather than pursue a DPA on grounds that Skansen was a dormant company and could neither pay a fine nor comply with the terms of any DPA, and that it wanted to send a message more generally to smaller companies as regards the importance of having effective anti-bribery and corruption procedures in place, rather than relying on ‘company values’ to establish proper compliance and conduct.
3.4Key self-reporting requirements in the United Kingdom
3.4.1Anti-money laundering and terrorist financing reporting obligations
In outline, the Proceeds of Crime Act 2002 imposes specific obligations on businesses operating in the ‘regulated sector’ to make SARs to the NCA where they know or suspect, or have reasonable grounds for knowing or suspecting, that another person is engaged in money laundering.[38]
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLTF Regulations) require firms that are ‘relevant persons’[39] to appoint a nominated officer and to ensure that anyone who is working in the firm, handling relevant business and has the requisite suspicion in relation to money laundering will make an internal report to the nominated officer, who is then obliged to consider whether to file a SAR.[40] This means that there are (internal) reporting obligations on the individuals working in those firms. For businesses operating in the regulated sector, information triggering reporting obligations is likely to have come to them as a consequence of customer due diligence and monitoring obligations imposed by the Money Laundering Regulations 2007 and the MLTF Regulations.
SARs may include a request to the NCA for ‘appropriate consent’ to enable the reporter to do a particular act in relation to the property concerned, which might otherwise amount to the commission of a money laundering offence.[41] Such SARs have historically been referred to as ‘consent SARs’, although they are now referred to by the NCA as ‘requests for a defence against money laundering’ or ‘DAML SARs’.
There is a corresponding reporting and consent regime in relation to terrorist financing under the Terrorism Act 2000.[42] In addition, authorities may impose specific obligations on financial institutions, in particular, to report dealings with certain ‘designated persons’.[43]
The relatively low threshold for making a SAR and the natural desire of businesses and the individuals within them to avoid liability (which can include potentially lengthy periods of imprisonment for individuals) means the NCA receives very substantial volumes of DAML SARs, placing a significant strain on its resources. In a review of the SAR framework completed in July 2018, the Law Commission acknowledged this, identifying that, on average, the relevant section of the NCA receives 2,000 SARs per working day, with some 100 reports seeking consent to proceed with a financial transaction.[44]
The number of SARs submitted remains high: the most recent statistics released by the NCA indicate that 478,437 SARs were filed between April 2018 and March 2019 (of which 34,151 were DAML SARs).[45] The statistics also show that the number of staff within the relevant section of the NCA is increasing (to 115 at the time of writing).
However, for the time being at least, the volume of SARs, together with the need for the NCA to consult with other enforcement authorities potentially interested in the information (of which there will be many), typically means that the NCA is not in a position to provide consent, or to confirm whether the reporter has ‘appropriate consent’ to proceed (in NCA parlance, whether the reporter has a ‘defence against money laundering’) much before the end of the seven-working-day notice period following the filing of a SAR.[46] This can lead to practical problems during the notice period itself and, if applicable, during the following moratorium period (which may now be extended to up to six months on the application of investigating authorities). Transactions will not be able to proceed. The risk of tipping off or committing other offences also leads to difficulties when communicating with customers, counterparties and others. The courts have been reluctant to interfere to accelerate this process.[47]
The Law Commission’s review of the effectiveness of the United Kingdom’s suspicious activity reporting regime for money laundering has acknowledged that more changes to existing frameworks are required. It has proposed changes including further practical guidance on key tenets of the reporting regime, such as the meaning of ‘suspicion’, but has stopped short of recommending other more radical changes originally mooted, such as amending the threshold for reporting matters to the NCA.[48]
3.4.2Other mandatory reporting obligations prescribed by legislation
(for financial institutions) the corporate offences of failure to prevent the facilitation of UK or foreign tax evasion under the CFA to HMRC;[49] and
data security breaches under the General Data Protection Regulation (GDPR), within 72 hours of becoming aware of the breach, to the Information Commissioner’s Office (ICO) and, in some cases, to the data subjects concerned.
3.4.3Self-reporting obligations in DPAs and regulatory and private agreements
3.4.4Self-reporting to the FCA and PRA
The FCA and, in the case of dual-regulated firms, the PRA are responsible for the conduct of firms authorised under the Financial Services and Markets Act 2000. Of particular relevance is the responsibility for ensuring that the firms and individuals regulated by it establish and maintain effective, proportionate and risk-based systems and controls to ensure that they cannot be used for the purposes of financial crime.[50]
The FCA Handbook and the PRA Rulebook contain detailed rules and guidance on its requirements in this area. These provisions supplement the overarching obligations on regulated firms and individuals to maintain an ‘open and co-operative’ relationship with the FCA and PRA and to ‘disclose . . . appropriately anything relating to the firm of which [the relevant regulator] would reasonably expect notice’.[51] In practice, these broad principles-based requirements oblige regulated firms and individuals to notify the FCA or the PRA, or both, not only of circumstances that may amount to breaches of rules set out in the FCA Handbook or the PRA Rulebook, but also of investigations and other matters that may affect the fitness and propriety of individuals, or the ability of firms to satisfy the threshold conditions required to be authorised to carry on particular regulated activities.
In recent years, the FCA has increasingly used its enforcement powers against firms and individuals for deficiencies in financial crime systems and controls. It continues to do so enthusiastically, with the most recent statistics published by the FCA indicating that it has approximately 88 such investigations open at the time of writing. It looks set to continue in this vein, having identified the area as one of its ‘cross-sector priorities’ in its most recent annual report.[52] A number of enforcement cases pursued by the FCA in relation to financial crime systems and controls have been based to a significant degree on failures proactively to bring matters to the FCA’s attention.[53] Looking more widely across the FCA’s regulatory purview, in a number of other cases substantial penalties have been imposed on firms and individuals simply for failing to comply with obligations to notify the regulator.[54]
In a number of other areas, firms and individuals must proactively bring particular matters to the attention of the FCA, which may in due course give rise to intensified supervision, or enforcement investigations, or both. Key examples include obligations to file suspicious transaction and order reports under the Market Abuse Regulation and requirements for firms to notify the FCA (or PRA, as appropriate) of breaches of the Conduct Rules by senior managers, certified persons or other employees. The timescales for such notifications and the level of detail required also vary significantly depending on the circumstances.
The FCA also acts as the UK Listing Authority, meaning that companies listed in the United Kingdom (and their directors) must behave in an open and co-operative manner.[55] Although the wording of the requirement imposed on listed companies differs from that imposed on regulated firms and individuals (it does not include an express requirement to notify the FCA of matters of which it would reasonably expect notice), listed companies and their directors should expect to have to notify the FCA of potentially significant investigations under these obligations.
None of the mandatory reporting obligations described above exists in a vacuum. The FCA in particular collaborates closely with other enforcement authorities within the United Kingdom and internationally.
Indeed, notwithstanding its ability to prosecute criminal offences, there have been several examples in recent years of cases in which it has supplied information to and otherwise coordinated its action with other authorities, including, notably, the SFO.[56]
The remainder of this chapter considers self-reporting in relation to the SFO and, to the extent relevant, the FCA, in relation to financial crime issues.
3.5Voluntary self-reporting to the SFO
The SFO’s decision as to whether to prosecute a corporate organisation will be governed by a combination of the ‘Full Code Test’ in the Code for Crown Prosecutors,[57] the Guidance on Corporate Prosecutions,[58] (in relevant cases) the Joint Prosecution Guidance of the Director of the SFO and the Director of Public Prosecutions on the Bribery Act 2010 (the Joint UKBA Guidance), the DPA Code of Practice and the Corporate Co-operation Guidance.[59]
The SFO will prosecute if there is a realistic prospect of conviction on the evidence, and it is in the public interest to do so. The fact that a corporate has reported itself will be a relevant consideration to the extent set out in the Guidance on Corporate Prosecutions. That guidance explains that, for a self-report to be a public interest factor tending against prosecution, it must form part of a ‘genuinely proactive approach adopted by the corporate management team when the offending is brought to their notice’.[60] The SFO has long stated expressly, and has reiterated most recently in the Corporate Co-operation Guidance, that self-reporting is no guarantee that a prosecution will not follow, and that each case will turn on its own facts.[61]
The Corporate Co-operation Guidance ‘does not seek to set out exhaustively what will be required in order for a corporate organisation to be considered as genuinely co-operative and indeed is clear that there will be dialogue in every case about what will be expected of the corporate organisation concerned’. It does add detail and confirm previous public statements in relation to some practical steps corporate organisations should take, including good general practices surrounding the preservation and production of relevant digital and hard copy information; good practice concerning evidence of financial records and analysis (to ‘show relevant money flows’); the provision of industry and background information (including about other actors in the market and whether any other government agencies are aware); and good practice concerning taking witness evidence (including an expectation that co-operating corporates will waive privilege over witness accounts).
In appropriate cases the SFO may use its powers under proceeds of crime legislation as an alternative (or in addition) to prosecution.[62] If the SFO uses those powers, it will publish its reasons, the details of the illegal conduct and the details of the disposal.
3.5.1Advantages of self-reporting
3.5.1.1Co-operation credit
Most corporates will consider that the primary advantage of making a voluntary self-report is co-operation credit, particularly if the corporate is seeking a DPA. Speaking in June 2018, Camilla de Silva, the SFO’s Joint Head of Bribery and Corruption, said: ‘The SFO will only invite a company to enter into an agreement to defer prosecution where the company has genuinely co-operated with the SFO.’[63] This statement reflects the DPA Code, which lists co-operation as an additional public interest factor tending against prosecution.[64] As noted earlier, the DPA Code is clear that the co-operation has to be ‘genuinely proactive’ and lists as examples of co-operative behaviour ‘identifying relevant witnesses, disclosing their accounts and the documents shown to them . . . [and] where practicable it will involve making the witnesses available for interview when requested’.[65]
The Guidance on Corporate Prosecutions also lists co-operation as a factor tending against prosecution, but instructs prosecutors to ‘establish whether sufficient information about the operation of the company in its entirety has been supplied in order to assess whether the company has been proactively compliant’ before taking co-operation into account as a factor, and stresses that ‘[t]his will include making witnesses available and disclosure of the details of any internal investigation’.[66]
In approving DPAs between the SFO and each of Standard Bank, Sarclad Ltd,[67 (which in the initial preliminary and approved judgments had been identified as XYZ Ltd) and Rolls-Royce, Sir Brian Leveson, then President of the Queen’s Bench Division, spoke approvingly of the co-operative stance adopted by each of those firms, as did Mr Justice William Davis, approving the DPA between the SFO and Serco Geografix Limited in July 2019.[68]
Even if a corporate reports at an early stage and takes every step to co-operate with the SFO, it may still not be considered eligible for a DPA because other factors ward against it, for example where the behaviour in question has caused a significant level of harm to victims, or a substantial adverse impact to the integrity or confidence of markets.[69]
Following conviction or a guilty plea, a corporate is still likely to receive some benefit from its co-operation when it comes to sentencing. The Sentencing Council’s Definitive Guideline sets out a multi-step process to assist courts in determining the appropriate fine. The first step is to establish the harm caused by the offending. For example, for a bribery offence, the starting point for the calculation is the ‘harm figure’ – the gross profit from the contract obtained. Once a harm figure has been determined, the court has to establish the ‘culpability’ factor by reference to a scale in the Definitive Guideline (from ‘A’ for high culpability down to ‘C’ for lesser culpability). Each level of culpability has attached to it a range of multipliers to apply to the harm figure. In determining exactly which multiplier to apply, the court must take into account many factors. Notably, co-operation with the investigation is listed in the Definitive Guideline as a factor that will tend to reduce the culpability multiplier.
Arguably, corporates in the regulated sector have less scope for truly voluntary self-reporting because the requirement in Principle 11 of the FCA’s Principles for Businesses require a regulated firm to ‘disclose to the FCA appropriately anything relating to the firm of which that regulator would reasonably expect notice’.[70] The FCA sets out in its Decision Procedure and Penalties Manual (DEPP) a non-exhaustive list of factors it will consider when deciding to issue a financial penalty or public censure. Included on the list of factors is ‘how quickly, effectively and completely the person brought the breach to the attention of the FCA or another relevant regulatory authority’.[71] If the FCA does choose to take action against a firm, DEPP includes provisions for determining the appropriate level of financial penalty, which operate similarly to the Sentencing Council’s Definitive Guideline. DEPP states that a factor to consider when deciding whether to increase or decrease any fine is ‘the conduct of the firm in bringing (or failing to bring) quickly, effectively and completely the breach to the FCA’s attention’.[72]
3.5.1.2Demonstrating culture and the strength of systems and controls
Effective self-reporting will clearly indicate a good corporate culture. Firms that have taken the necessary steps to institute a good culture supported by robust systems and controls will expect that any matters involving wrongdoing are quickly reported internally via its whistleblowing procedures and escalated and reported to the relevant authorities, as appropriate.
must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm including its managers, employees and appointed representatives (or where applicable, tied agents) with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime.[73]
There are a number of examples of the FCA taking enforcement action in recent years against regulated firms for having inadequate systems and controls.[74]
In a slightly different context, a recently concluded case concerning whether the actions of an investment bank in paying away monies held in the account of a company to its director amounted to negligence highlights the potentially substantial losses that may result from inadequacies in systems and controls, even if no regulatory or criminal enforcement action is taken against the institution concerned.[75]
3.5.1.3Information control
3.5.2Risks of self-reporting
For many companies, the primary driver behind self-reporting is the opportunity to secure a DPA. It should be clear from the analysis above, however, that self-reporting in the United Kingdom does not guarantee a DPA or even necessarily leniency in sentencing (depending on whether other public interest factors are at play). It is also clear that a firm may only be able to gauge its prospects of success relatively late in a process during which the firm will usually have provided a significant amount of information, documents, investigation reports and even witnesses for interview.[76]
Perversely, therefore, a firm’s efforts to secure maximum co-operation credit may actually put it in a worse position than it began in, especially if it has provided information or evidence about an issue or facts that may not otherwise have come to light or been obtainable by the authority. There is an ever-present risk that by the time the corporate has visibility as to the direction in which the SFO or the court is leaning, it may have assisted prosecutors in building a strong case against itself, often at significant financial and other cost, for little or no benefit. The Corporate Co-operation Guidance provides the most recent reminder of this, with clear express warnings to corporate organisations that none of its provisions creates any rights or expectations. In a slightly different context, Soma Oil & Gas Limited v. Director of the Serious Fraud Office[77] provides an illustration of the expense, difficulty and disruption associated with seeking to force the SFO to bring about a conclusion to an investigation. Corporates therefore need to evaluate the risks and costs inherent in making self-reports very carefully. Some key risks and practical considerations are set out below.
3.5.2.1Interest and potential investigation in other jurisdictions
There is always a risk of contagion: it is the nature of complex bribery, fraud and corruption that it crosses borders and can implicate authorities in multiple jurisdictions. Self-reporting to a regulator in one jurisdiction may draw the attention of other regulators, domestically or abroad. Matters are frequently complicated because the benefits and risks of reporting are seldom consistent or certain across jurisdictions, and authorities in different countries seldom have the same procedures, techniques or demands in conducting their investigations and taking enforcement action.
Increasingly, regulators are sharing information and seeking to collaborate in enforcement actions. As long ago as 2010, the US Department of Justice (DOJ) and the SFO worked together in investigating BAE Systems plc,[78] and such co-operation has since become routine. International co-operation often goes beyond formal mutual legal assistance requests, to encompass informal intelligence sharing (sometimes in advance of formal investigation in any jurisdiction), coordination or division of responsibility or issues for enforcement, and even formal programmes by which to enhance understanding and assist with capacity or resourcing. At a symposium in September 2016, Sir David Green QC, then Director of the SFO, explained: ‘All [SFO] cases have a significant international dimension. We have invested real effort in building strong co-operative relations with foreign agencies in key financial centres across the globe. This involves secondments, rolling discussions, exchange of information and coordinated activity.’[79]
While there are legal limits to the extent of information sharing and collaboration between authorities, firms need to be strategic in their conduct across all countries. It is important to take heed of cases such as United States v. Allen,[80] in which the US Court of Appeals for the Second Circuit held that the prohibition against the use (and derivative use) of a defendant’s compelled testimony will apply even where the testimony had been compelled by a foreign authority, such as the FCA. The DOJ therefore needs to ensure that it avoids its own investigation becoming ‘tainted’ by compelled testimony when it is collaborating or exchanging information with other countries’ authorities – a particular concern as regards the United Kingdom, where the provision of evidence or interviews is commonly compelled. This also means that there is a risk that, by providing to the DOJ reports or information derived from compelled testimony (even by inadvertence, as part of routine updates or reports on progress or developments in parallel investigations), a firm may risk negating any co-operation credit that they might have established in other ways.
3.5.2.2Privilege issues and authorities’ involvement in the internal investigation
A key concern for all firms considering and investigating suspicions or allegations of wrongdoing is to establish clearly at the outset that its board, or any committee with oversight of internal investigations, is authorised to seek and receive legal advice in relation to the investigation to ensure that updates to these bodies and related documents will be protected by legal professional privilege. This authorisation is important because English law on the question of who is the ‘client’ for the purposes of legal professional privilege remains rooted in the House of Lords decision in Three Rivers No. 5, such that the ‘client’ was not the corporation itself but only those officers and employees of the corporation who were ‘authorised’ to communicate with the corporation’s lawyers.[81] In its September 2018 judgment in the ENRC case, the Court of Appeal made a number of interesting comments on the latter rule. The court noted in particular that this rule was more appropriate for the 19th century than the 21st century, that its application may result in a disadvantage to modern multinational corporations (where the information required to obtain legal advice would often be in the hands of people not charged with obtaining it),[82] and that it would have been in favour of departing from Three Rivers No. 5 if it had been open to it to do so. Significantly, however, those comments were obiter on the basis that only the Supreme Court can reverse or depart from the decision in Three Rivers No. 5.
The UK authorities are adamant that to self-report in any meaningful sense, firms must provide them with sufficiently detailed information about the wrongdoing. The SFO states: ‘All supporting evidence including, but not limited to emails, banking evidence and witness accounts, must be provided to the SFO’s Intelligence Unit as part of the self-reporting process.’[83] In practice, the SFO’s Intelligence Unit will not always want every email that has been identified during an internal investigation. A key question for a company considering a self-report is thus whether or not it is prepared to disclose its full interview notes; the privileged status of which has been subject to heated debate in the United Kingdom in recent years.
By way of context, a good starting point is the April 2018 decision of the High Court in R (AL) v. Serious Fraud Office.[84] The case arose out of the SFO’s investigation of Sarclad, during which the SFO had accepted ‘oral proffers’ of the first account interviews that had been conducted by an external law firm engaged by the company to conduct an internal investigation.[85] Having entered into a DPA with the corporate entity in 2016, the SFO turned its attention to a number of individuals, including the anonymised AL,[86] whose defence team repeatedly asked the SFO to obtain the complete notes of his first account interview with the law firm. The SFO asked Sarclad to disclose the interview notes but ultimately accepted the firm’s refusal to do so on the grounds of privilege. Despite declining to exercise its judicial review jurisdiction (as it felt that disclosure disputes were best dealt with in the Crown Court), the High Court took the unusual step of stating that if it had chosen to exercise its judicial review jurisdiction, it would have found for AL. In obiter comments, Mr Justice Green, giving the judgment of the court, was critical of the SFO’s acceptance of the law firm’s claims that the current law of privilege was unclear pending the (then undecided) ENRC appeal. In Green J’s view, the ‘law as it stands today is settled. Privilege does not apply to interview notes.’ In support of that statement, Green J cited the decision in Three Rivers No. 6 and concluded that the SFO had ‘erred’ as it had ‘simply accepted the assertion of privilege made by [the law firm] even though it is the SFO’s own case that privilege does not apply and the SFO’s position is supported by current case law’, and that the SFO had therefore not fulfilled its duty to ‘assess claims of privilege properly and not cursorily and superficially.’
The thrust of the Sarclad decision appeared to be in line with Mrs Justice Andrews’ first instance decision in ENRC. However, as noted already, a few months later, in September 2018, the Court of Appeal overturned her decision and handed down a judgment that does not sit comfortably with Sarclad.[87] The Court of Appeal rejected Andrews J’s decision that litigation privilege will only apply in criminal or regulatory proceedings at the point where a company had uncovered evidence of wrongdoing that meant that a criminal prosecution or enforcement again was likely to follow. The Court of Appeal reiterated the established principle that litigation privilege may be claimed over documents that had been created at a time when litigation was in ‘reasonable contemplation’ and for the purposes of that litigation. Such determinations are necessarily fact-specific. Notably, the Court of Appeal held that, on the ENRC facts, the interview notes generated during the course of its internal investigation were subject to litigation privilege on the basis that (1) they had been brought into existence after ENRC’s external counsel (who were conducting an investigation) had advised that there was a real and serious risk of law enforcement and regulatory intervention, including criminal prosecution, and (2) the notes were, in the Court of Appeal’s estimation, drafted to assist any future defence of such proceedings.
If a further illustration of the potential complexities and follow-on implications of DPAs were needed, it is provided by Omers Administration Corporation and others v. Tesco PLC.[88] In a judgment handed down in January 2019 in civil proceedings pursued by investors in respect of losses they claim resulted from the conduct forming the basis of the DPA agreed between the SFO and Tesco Stores Limited, Mr Justice Hildyard ordered disclosure of documents in the possession or control of Tesco PLC. These included some documents provided to it by the SFO that had been obtained from third parties through the use of the SFO’s compulsory powers under section 2 of the Criminal Justice Act 1987 and transcripts of interviews with and witness statements of third parties. The conflict between Tesco PLC’s obligations to keep these documents confidential pursuant to an undertaking provided to the SFO as part of the DPA negotiation process, and its disclosure obligations in the follow-on litigation pursued by investors under the Financial Services and Markets Act 2000, generated substantial ancillary litigation and a costly and involved process of seeking representations from third parties. The proceedings serve as a reminder that although a DPA may avoid the need for protracted criminal proceedings, it provides no guarantee of finality in respect of (and indeed may provide oxygen for) associated civil (or regulatory) proceedings.
The SFO has maintained for some time that firms wishing to co-operate with the SFO need to give serious consideration to waiving privilege, and that it is ready to challenge any overly broad claims to privilege. The Corporate Co-operation Guidance reinforces that approach. It notes that a claim to privilege must be properly established, that any claim should be supported by independent counsel and that the Court of Appeal in ENRC ‘has not ruled out a court’s consideration of the effect of an organisation’s non-waiver over witness accounts as it determines whether a proposed DPA is in the interests of justice’.[89]
Following the Court of Appeal judgment in ENRC, it is open to any company that has conducted an initial investigation and received clear legal advice that the information unearthed may amount to a criminal offence or a regulatory failing[90] to claim that any material generated in the course of that initial internal investigation will be subject to litigation privilege.
In practice, however, and especially following the publication of the Corporate Co-operation Guidance, companies are likely to come under pressure from the SFO to disclose interview transcripts as part of the self-reporting process. The Court of Appeal’s judgment in ENRC made it clear that nothing it said about privilege should adversely impact the DPA regime and, furthermore, that maintaining claims to privilege may adversely affect prospects of obtaining a DPA.[91] The Court also noted: ‘Had the court been asked to approve a DPA between ENRC and the SFO, the company’s failure to make good on its promises to be full and frank would undoubtedly have counted against it.’[92]
In deciding whether to acquiesce in providing witness accounts, a company will need clear advice as to the risks involved in waiving litigation privilege, even on a limited basis, at such an early stage, particularly before it is clear whether a settled resolution is likely and especially where multiple authorities may be involved. The shield of litigation privilege is clearly of paramount importance to any company defending criminal or regulatory enforcement proceedings where, very commonly, civil litigants will be waiting in the wings and in jurisdictions where the concept of limited waiver may not exist.
Having ensured that the internal investigation is suitably established for the purposes of privilege, another critical concern for any corporate will be the likelihood of potential involvement in, or loss of control of the scope, timing and conduct of, its own investigation into the matters concerned. The former Director of the SFO, Sir David Green QC, made it clear that the SFO might specify particular areas or issues to be included in the firm’s investigation, how the investigation ought to be conducted in relation to particular issues or persons, and to provide updates to the SFO, usually within agreed time frames.[93] Sir David Green QC explained the SFO’s influence or imposition into internal investigations as being necessary to avoid ‘churning up the crime scene’ and compromising the SFO’s own investigation. This, again, is reinforced in the Corporate Co-operation Guidance.
Similar sentiment (if not criticism) was expressed by Mark Steward, the FCA’s Head of Enforcement, who referred to ‘the crime scene being trampled over’. While he was Director of the SFO, in June 2016, Sir David Green QC also suggested that the SFO’s influence or control over internal investigations might usefully be formalised so that it would be akin to the FCA’s use of ‘skilled persons investigations’ (also known as section 166 investigations) of regulated firms.[94] The latter involves the FCA requiring the firm to engage (and pay for) an independent ‘skilled person’ (typically a law firm or forensic accountants, depending on the subject matter), approved by the FCA, to investigate and report to the FCA on areas or issues of concern specified by the FCA.[95]
3.5.2.3Impact on witness interviews
In addition to influencing the scope of an internal investigation, UK authorities may also influence a firm’s ability to conduct witness interviews after self-reporting, whether by prohibiting the firm from conducting interviews with certain individuals, or by requiring the firm to delay such interviews until after the authority has interviewed the individuals concerned. In approving the various DPAs to date, Sir Brian Leveson highlighted the assistance provided by firms to the SFO in relation to witness interviews. In relation to the Rolls-Royce DPA, for example, Leveson P noted the high levels of co-operation from Rolls-Royce as regards its witnesses, pointing out that when the SFO commenced its own investigation, not only did it have access to Rolls-Royce’s internal investigations and interview notes (Rolls-Royce having made a limited waiver of its claims for legal professional privilege over them), but Rolls-Royce also deferred certain interviews until after the SFO had completed interviews of them.
3.5.2.4Scrutiny, including potential monitoring obligations
A DPA or settled resolution will always include a number of non-financial terms and conditions. While these will often be fact-dependent and tailored to the wrongdoing involved and the state of the firm’s remediation at the point of agreement, the DPA Code includes a list of terms that may be agreed as part of a DPA, including requirements for putting in place a robust compliance or monitoring programme, or both, which may include the appointment of an independent monitor.[96]
While the imposition of a corporate monitor is not compulsory, the DPA Code provides lengthy guidance as to monitors’ roles and appointment, and notes that the imposition of a monitor ‘must always be fair, reasonable and proportionate’.[97] Where a monitor is required, the costs to the firm can be significant. Not only will the firm have to pay the monitor’s fees, but it will also have to pay the costs associated with the selection, appointment and reasonable ‘monitoring’ costs of the prosecutor during the monitoring period. There are indirect or non-financial costs, too. The monitor must be given complete access to all relevant aspects of the firm’s business and the firm will need to allocate resources to ensure that the monitor is provided with the information and co-operation required and to establish the systems and controls necessary to effect the remediation agreed with the regulator.
These costs have attracted a degree of judicial and corporate scepticism and criticism in the United Kingdom and the United States. In the Innospec case,[98] for example – where a UK subsidiary agreed with the SFO to plead guilty to corruption charges as part of the first ‘global settlement’ relating to similar conduct prosecuted by US authorities against its parent entity, and the first joint US–UK monitor was appointed – District Judge Huvelle gave a colourful criticism of the role of monitors, saying: ‘It’s an outrage that people get US$50m to be a monitor . . . . It’s a boondoggle for some of these people.’[99] Lord Justice Thomas (the judge in the English case) chose instead to characterise the imposition of a monitor as ‘an expensive form of “probation order”’, which he considered ‘unnecessary for a company which will also be audited by auditors well aware of the past conduct and whose directors will be well aware of the penal consequences of any similar criminal conduct’.[100]
Such criticism notwithstanding, the appointment of a monitor (in one form or another) is likely to feature regularly in DPAs in the future, as had previously been the case in civil recovery orders[101] or criminal court orders,[102] which were the SFO’s preferred means of imposing monitorships before the introduction of the DPA regime provided it with a statutory basis for doing so. Indeed, in early 2017, the then SFO General Counsel, Alun Milford, explained that ‘an integral part of any DPA discussion is the question of corporate reform. As such, monitors aren’t something the SFO has set its face against, but as we’ve seen from the judgments, there are different ways of achieving that sort of process’.[103]
The five DPAs reached to date clearly demonstrate this flexibility in the SFO’s approach to monitorships. While the SFO required Standard Bank to commission and submit to an independent review of its existing compliance programme by PwC, and to implement PwC’s recommendations (less onerous than a monitorship),[104] it did not require an independent monitor in its DPA with Sarclad, opting instead for a form of ‘self-monitoring’ for the first time, with the company’s Chief Compliance Officer being required to report to the SFO on its anti-bribery and corruption policies and their implementation within one year, and annually for the duration of the DPA.[105] The approach in the Rolls-Royce DPA was different again – some four years before the DPA was agreed, Rolls-Royce had appointed Lord Gold to conduct an independent review of (and report on and make and oversee the implementation of recommendations regarding) the company’s anti-bribery and corruption compliance infrastructure. In approving the DPA, which required the continuation of Lord Gold’s work and the production by him of a final report to the SFO after implementation, Leveson P described Lord Gold as a ‘quasi monitor’.[106] The Tesco Stores DPA required the appointment of Deloitte as an independent monitor to conduct a review, provide a report and implement recommendations in relation to a number of specific areas of concern.[107] In the DPA agreed in July 2019 between the SFO and Serco Geografix Limited, the company is required to report ‘evidence of fraud by itself or related companies or individuals’ and to take steps to enhance and report annually on the effectiveness of its ethics and compliance programme. Some corresponding reporting and enhancement requirements were also imposed on its parent company.
The current Director of the SFO, Lisa Osofsky, is very familiar with monitorships, and it is likely that she will be in favour of increasing their use, even if implemented in the United Kingdom as quasi-monitorships.
3.6Practical considerations, step by step
3.6.1Reaching the decision
3.6.1.1Clear communication
Clear communication underpins a successful response to a disclosure, particularly where a whistleblower is involved. Carefully delineated channels must be in place to enable staff receiving disclosures (whether through a dedicated hotline or other less formal channels) to escalate them quickly and to the right people. In particular, policies and procedures should name a designated member of the senior management of the corporate (probably in its legal or compliance function) who should have a direct reporting line to the board or audit committee. Provision should also be made for how to deal with disclosures naming members of the board or the designated senior manager responsible for handling whistle­blowing reports.
3.6.1.2Even, dispassionate investigation
3.6.1.3Clear protocol and structure
Appropriate senior individuals within the organisation’s human resources function should also be identified to coordinate its approach towards the whistleblower (if there is one) and to deal with any disciplinary action in relation to other employees that may be necessary. The FCA and PRA’s whistleblowing rules require some regulated firms to have enhanced their existing whistleblowing procedures, including the appointment of a whistleblowers’ champion since 7 March 2016.
3.6.1.4Senior management involvement
3.6.2Once the decision has been made
3.6.3Documenting the decision
3.6.4Nature of approach to the authorities
3.6.5Timing of approach (DPAs) – what is a reasonable time?
Beyond the impact it may have on securing a DPA, the timing of a self-report will also have a bearing on the decision to prosecute and the level of any potential penalties. The Sentencing Council Definitive Guideline states that concealing an offence may result in the imposition of heavier penalties. The Guidance on Corporate Prosecutions expressly states that failing to report within a reasonable time will be a ‘public interest’ factor weighing in favour of prosecution, whereas a ‘genuinely proactive approach involving self-reporting and remedial action’ will be a factor tending against prosecution.[108]
The SFO’s expectations as regards timing has become somewhat more realistic over time. The former SFO Director, Sir David Green QC, had stated in 2013 that ‘[c]ommon sense suggests that an initial report of suspected criminality should be made to the SFO as soon as it is discovered’.[109] Some three years later (in March 2016), the then SFO General Counsel, Alun Milford, said that it is reasonable for a firm to undertake an initial assessment before doing so,[110] a view that was echoed three months later by Matthew Wagstaff, SFO Joint Head of Bribery and Corruption, when he said that it is unrealistic to expect a firm to pick up the telephone to the SFO at the very moment it first becomes aware of potential wrongdoing.[111] In March 2018, Camilla de Silva, the SFO Joint Head of Bribery and Corruption, commented that the SFO ‘will not be offering DPAs in cases of a late conversion to the joys of co-operating; DPAs are a reward for openness – the sooner you come in, self-report and the more you are open with us, the more you have to be rewarded for’.[112] In speeches to date, Lisa Osofsky has indicated that the SFO will be open to firms investigating allegations of misconduct before reporting.[113]
3.6.6Managing other regulators
The above notwithstanding, corporates should not assume that disclosure to one authority necessarily means that other relevant authorities are aware of the matter – full assessments must be made as to whether it is necessary or appropriate to make separate notifications to other specific authorities (whether in the same jurisdiction or elsewhere) who might expect to be told of the alleged misconduct or of the fact of other investigations by or at the behest of enforcement authorities.
1 Judith Seddon and Amanda Raad are partners, and Sarah Lambert-Porter, Chris Stott and Matthew Burn are associates, at Ropes & Gray LLP in London.
2 In Lisa Osofsky’s first speech as Director of the Serious Fraud Office (SFO), she referred to how the ‘increasingly multijurisdictional and complex’ nature of SFO cases makes co-operation to achieve global settlements all the more important. She said that ‘[s]trengthening and deepening the relationships that make this happen is going to be a major focus for me’ and listed the newcomer countries to DPAs as part of that focus. Lisa Osofsky, SFO Director, speech at the Cambridge International Symposium on Economic Crime 2018, Jesus College, Cambridge, 3 September 2018, available at https://www.sfo.gov.uk/2018/09/03/lisa-osofsky-making-the-uk-a-high-risk-country-for-fraud-bribery-and-corruption/. A year on, co-operation continues to be central to the SFO’s strategy: ‘The work we at the SFO have been able to do in the last year with our international law enforcement partners has been energising – at times even inspiring. Prosecutors all around the world are realising how much we need each other if we are truly to do justice. So we are increasingly linking arms in the march against transnational fraud and corruption.’ Lisa Osofsky, 2 September 2019, available at https://www.sfo.gov.uk/2019/09/02/cambridge-symposium-2019/.
4 Alun Milford, then General Counsel at the SFO, said in a speech in September 2017 that in all DPA judgments to date, a key element has been the extent of reform in the corporate, including the removal of senior managers who were either implicated in, or should have been aware of, the criminality concerned, available at https://www.sfo.gov.uk/2017/09/05/alun-milford-on-deferred-prosecution-agreements/.
5 For example, in its recently published Corporate Co-operation Guidance, the SFO has set out certain indicators of good practice that they would expect to see in a co-operating corporate, including that an organisation should ‘[n]otify the SFO of any other government agencies, domestic or foreign, law enforcement or regulatory) by whom the organisation has been contacted or to whom it has reported’, SFO Operational Handbook, Corporate Co-operation Guidance, p. 4, available at https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/sfo-operational-handbook/.
6 The Director of the Serious Fraud Office v. Eurasian Natural Resources Corp. Ltd (ENRC) [2018] EWCA Civ 2006.
7 FCA Handbook, SYSC 18.2.2 G.
8 FCA Policy Statement PS15/24 containing the FCA rules applicable to deposit takers with assets over £250 million. The rules are set out in the FCA Handbook at SYSC 18.1, SYSC 18.31, and SYSC 18.4 and 18.5. The PRA rules are set out in its Policy Statement PS24/15, the PRA General Organisational Requirements Rulebook (applicable to CRR firms, i.e, UK banks, building societies or investment firms subject to the EU Capital Requirements Regulation No. 575/2013) and its Whistleblowing Rulebook (applicable to solvency II firms) and PRA Supervisory Statement SS 39/15 (applicable to deposit takers with assets greater than US$250 million, PRA designated investment firms and insurers).
9 FCA Handbook, SYSC 18.1.1AA G, 18.1.1C G and 18.3.9 G.
10 FCA Handbook, SYSC 18.4.4.R.
11 Ministry of Justice ‘Guidance about procedures which relevant commercial organisations can put into place to prevent persons associated with them from bribing’, available at https://www.justice.gov.uk/downloads/legislation/bribery-act-2010-guidance.pdf, March 2011.
12 Ibid. at para. 1.7. See also SFO v Tesco Stores Limited (2017) (Case No. U20170287) [2019] Lloyd’s Rep FC 283, Approved Judgment, para. 60(ii), in which Leveson P set out the ‘tangible remedial measures, that can properly be described as wide-ranging and comprehensive’ and that included the relaunch of Tesco’s ‘externally-run whistle-blowing service, which is promoted to colleagues and suppliers, so as to raise awareness’.
13 https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/corporate-self-reporting/.
14 Deferred Prosecution Agreement Code of Practice issued by the Director of Public Prosecutions and Director of the SFO pursuant to the Crime and Courts Act 2013, available at https://www.cps.gov.uk/sites/default/files/documents/publications/dpa_cop.pdf.
15 DPA Code, s.2.
16 Lisa Osofsky, SFO Director, speech at the Cambridge International Symposium on Economic Crime 2019, Jesus College, Cambridge, 2 September 2019, available at https://www.sfo.gov.uk/2019/09/02/cambridge-symposium-2019/.
17 Sentencing Council’s Definitive Guideline ‘Corporate Offenders: Fraud, Bribery and Money Laundering’, available at https://www.sentencingcouncil.org.uk/wp-content/uploads/Fraud-bribery-and-money-laundering-offences-Definitive-guideline2.pdf.
18 A culture of wilful disregard for the commission of offences will lead to a corporate being placed at the most culpable end of the spectrum and facing the heaviest fines available.
19 The Public Contracts Regulations 2015, Regulation 57(15).
20 The secure reporting form is available at https://www.sfo.gov.uk/contact-us/reporting-serious-fraud-bribery-corruption/.
21 Number of SFO Investigations, July 2019, available at https://www.sfo.gov.uk/publications/corporate-information/freedom-of-information/.
22 See https://www.fca.org.uk/static/documents/how-we-handle-disclosures-from-whistleblowers.pdf.
23 Alun Milford, then General Counsel at the SFO, speech at the Cambridge Symposium on Economic Crime 2014, Jesus College, Cambridge (‘The Use of Information to Discern and Control Risk’), 2 September 2014, available at https://www.sfo.gov.uk/2014/09/02/alun-milford-use-information-discern-control-risk/.
24 See, for example, prosecutions of individuals associated with Torex Retail PLC:
https://www.sfo.gov.uk/2013/06/21/final-conviction-torex-retail-false-accounting-case/.
25 Serious Fraud Office v. Rolls-Royce plc and Rolls-Royce Energy Systems Inc.
(Case No. U20170036) [2017] Lloyd’s Rep FC 249, paras. 21 and 22.
26 Serious Fraud Office (SFO) v. Eurasian Natural Resources Corp. Ltd [2018] EWCA Civ 2006, at paras. 16-17.
27 Lisa Osofsky, speech at the Cambridge International Symposium on Economic Crime 2018,
Jesus College, Cambridge, 3 September 2018, available at https://www.sfo.gov.uk/2018/09/03/lisa-osofsky-making-the-uk-a-high-risk-country-for-fraud-bribery-and-corruption/.
28 SFO Operational Handbook, Corporate Co-operation Guidance, p. 1, available at https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/sfo-operational-handbook/.
29 DPA Code, para. 2.8.2.
30 DPA Code, para. 2.8.1(v): ‘Failure to notify the wrongdoing within a reasonable time of the offending conduct coming to light.’
31 SFO Operational Handbook, Corporate Co-operation Guidance, at p. 1: ‘Co-operation means . . . reporting [suspected wrongdoing] to the SFO within a reasonable time of the suspicions coming to light.’, available at https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/sfo-operational-handbook/.
32 DPA Code, para. 2.9.2; SFO Operational Handbook, Corporate Co-operation Guidance, at p. 4: ‘To avoid prejudice to the investigation, consult in a timely way with the SFO before interviewing potential witnesses or suspects, taking personnel/HR actions or taking other overt steps.’, available at https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/sfo-operational-handbook/.
33 As noted in the Corporate Co-operation Guidance: ‘Each case will turn on its own facts. In discussing co-operation with an organisation, the SFO will make clear that the nature and extent of the organisation’s co-operation is one of many factors that the SFO will take into consideration when determining an appropriate resolution to its investigation.’ Ibid., p. 1.
34 Serious Fraud Office v. Rolls-Royce plc and Rolls-Royce Energy Systems Inc. (Case No. U20170036) [2017] Lloyd’s Rep FC 249, paras. 21 and 22.
35 Serious Fraud Office v. Standard Bank plc (Case No. U20150854) [2016] Lloyd’s Rep FC 102.
36 The most recent examples are the discontinuation of proceedings against former senior executives of Tesco Stores Limited in late 2018 (https://www.sfo.gov.uk/2018/12/06/no-case-to-answer-ruling-in-case-against-former-tesco-executives/) and the acquittal in July 2019 of employees of Sarclad Limited (which was anonymised as ‘XYZ’ when the DPA was entered into with the company, at which point reporting restrictions were in place due to the continuing proceedings against three employees (https://www.sfo.gov.uk/2019/07/16/three-individuals-acquitted-as-sfo-confirms-dpa-with-sarclad/).
37 R v. Skansen Interiors Limited, unreported.
38 The Proceeds of Crime Act (POCA), ss.330 and 331.
39 A firm will be a ‘relevant person’ if it falls within the MLTF Regulations’ definitions of: (1) credit institutions; (2) financial institutions; (3) auditors, insolvency practitioners, external accountants and tax advisers; (4) independent legal professionals; (5) trust or company service providers; (6) estate agents; (7) high value dealers; (8) casinos. (MLTF Regulations, regulation 8).
40 MLTF Regulations, regulations 19 and 20.
41 POCA, ss.335 and 336.
42 The Terrorism Act 2000 (TACT), s.21A (duty for the regulated sector), s.19 (duty outside the regulated sector) and s.21ZA (consent).
43 Counter-Terrorism Act 2008, Schedule 7, para. 12, and Terrorist Asset Freezing Act 2010, s.19.
44 Law Commission’s Consultation Paper, July 2018.
45 POCA, ss.335 (appropriate consent) and 336 (nominated officer consent). The NCA’s most recent statistics indicate that the average turnaround time for a DAML SAR is five to 12 days. See the NCA’s annual SAR report, November 2019, available at https://nationalcrimeagency.gov.uk/who-we-are/publications/390-sars-annual-report-2019/file.
46 The NCA’s most recent statistics indicate that the power to extend the moratorium period was used 70 times in 2018–2019. See the NCA’s annual SAR report, November 2019, available at https://nationalcrimeagency.gov.uk/who-we-are/publications/390-sars-annual-report-2019/file.
47 See National Crime Agency v. N [2017] EWCA Civ 253; and Lonsdale v. Natwest [2018] EWHC 1843 (QB), for example.
48 Law Commission, ‘Anti-Money Laundering: The SARs Regime Report’, Law Com No. 384 (June 2019), available at https://www.lawcom.gov.uk/project/anti-money-laundering/.
49 The term ‘corporate offences’ refers to the ‘failure to prevent the facilitation of tax evasion’ offences created by s.45 (in relation to UK tax) and s.46 (in relation to foreign tax) of the Criminal Finances Act 2017, pursuant to which a financial institution must report on any failure to prevent the criminal acts of its employees and other associated persons who have intentionally facilitated tax evasion while providing a service for it or on its behalf.
50 See the FCA’s Annual Report for 2018/19, available at https://www.fca.org.uk/annual-report-and-accounts-2018-19.
51 PRIN 2.1.1 R, Principle 11 of the Principles for Businesses (Relations with Regulators).
52 FCA Enforcement annual performance report 2018/19, available at https://www.fca.org.uk/publication/corporate/annual-report-2018-19-enforcement-performance.pdf.
53 For example, in 2015 the FCA fined The Bank of Beirut (UK) Ltd (Bank of Beirut) £2.1 million, prevented it from acquiring new customers from high-risk jurisdictions for 126 days, and fined two approved persons at the bank. The FCA noted that Bank of Beirut had also repeatedly provided the FCA with misleading information after it was required to address concerns regarding its financial crime systems and controls, including by indicating that it had completed remedial actions when it had not.
54 For example, in 2018, Santander was fined for, among other things, failing to disclose information relating to certain issues with the probate and bereavement process to the FCA. The final notice is available at https://www.fca.org.uk/publication/final-notices/santander-uk-plc-2018.pdf. In June 2019, the FCA fined Bank of Scotland £45.5 million for failing to disclose suspicions that fraud may have taken place within part of its corporate lending operations. The final notice is available at https://www.fca.org.uk/publication/final-notices/bank-of-scotland-2019.pdf.
55 FCA Handbook, LR 7.2.1 R, Listing Principle 2.
56 By way of recent example, the FCA did not impose a financial penalty on Tesco plc or Tesco Stores in early 2017 for engaging in market abuse, partly because Tesco Stores had entered into a DPA with the SFO, pursuant to which it would pay £128.9925 million. The FCA explained that it had also taken into account ‘the exemplary co-operative approach’ taken by Tesco plc and Tesco Stores with both the FCA and the SFO. See the FCA final notice, available at https://www.fca.org.uk/publication/final-notices/tesco-2017.pdf.
57 The Code for Crown Prosecutors, available at www.cps.gov.uk/publication/code-crown-prosecutors.
58 The joint guidance issued by the Director of Public Prosecutions, the Director of the Serious Fraud Office and the Director of the Revenue and Customs Prosecutions Office Guidance on Corporate Prosecutions, available at https://www.sfo.gov.uk/?wpdmdl=1457.
59 Bribery Act 2010: Joint Prosecution Guidance of The Director of the Serious Fraud Office and The Director of Public Prosecutions, 30 March 2011, available at https://www.sfo.gov.uk/?wpdmdl=1456.
60 Guidance on Corporate Prosecutions, para. 32 (‘Additional public interest factors against prosecution’).
61 SFO’s statement of policy and revised guidance on corporate self-reporting, October 2012.
62 See the Attorney General’s Guidance for prosecutors and investigators on their asset recovery powers under s.2A POCA, available at https://www.gov.uk/guidance/asset-recovery-powers-for-prosecutors-guidance-and-background-note-2009.
63 Camilla de Silva, SFO Joint Head of Bribery and Corruption, speech at the Herbert Smith Freehills Corporate Crime Conference 2018, available at https://www.sfo.gov.uk/2018/06/21/corporate-criminal-liability-ai-and-dpas/.
64 Para. 2.8.2(i).
66 Guidance on Corporate Prosecutions, p. 8.
67 Serious Fraud Office v. XYZ Limited (Case No. U20150856) [2016] 7 WLUK 220; [2016] Lloyd’s Rep FC 509.
68 Serious Fraud Office v. Serco Geografix Ltd [2019] (Case No. U20190413) 7 WLUK 45.
69 DPA Code, para 2.8.1(vii).
70 FCA Handbook, PRIN 2.1.1 R. An equivalent obligation to notify the PRA is set out in Fundamental Rule 7.
71 FCA Handbook, DEPP 6.2.1 (2)(a).
72 FCA Handbook, DEPP 6.5A.3 (2)(a).
73 FCA Handbook, SYSC 6.1.1R.
74 For example, the FCA’s fine of Bank of Beirut, discussed above.
75 Singularis Holdings Ltd (In Official Liquidation) (A Company Incorporated in the Cayman Islands) v. Daiwa Capital Markets Europe Limited [2019] UKSC 50.
76 In the United Kingdom, court approval is required for a DPA, which means that even if the SFO recommends a DPA after extensive co-operation, the court may reject it.
77 Soma Oil & Gas Limited v. Director of the Serious Fraud Office [2016] EWHC 2471 (Admin).
78 See the DOJ’s expression of gratitude to the SFO for its assistance in its press release, March 2010, available at https://www.justice.gov/opa/pr/bae-systems-plc-pleads-guilty-and-ordered-pay-400-million-criminal-fine.
79 Sir David Green QC, former Director of the SFO, speech at the Cambridge Symposium on Economic Crime 2016 at Jesus College, Cambridge, 5 September 2016, available at https://www.sfo.gov.uk/2016/09/05/cambridge-symposium-2016/.
80 United States v. Allen, No. 16-898 (2d Cir. 2017).
81 Three Rivers District Council and Others v. The Governor and Company of the Bank of England [2003] EWCA Civ 474 (Three Rivers No. 5).
82 Especially as compared with smaller corporations, which the Court noted was the typical size and structure of the corporations involved in the 19th century cases considered in Three Rivers No. 5.
83 https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/corporate-self-reporting/.
84 R (AL) v. Serious Fraud Office [2018] EWHC 856 (Admin).
85 This was confirmed to be McGuireWoods.
86 Subsequently identified as Adrian Leek.
87 Director of the Serious Fraud Office v. Eurasian Natural Resources Limited (Law Society intervening) [2018] EWCA Civ 2006.
88 Omers Administration Corporation and others v. Tesco PLC [2019] EWHC 109 (Ch).
89 SFO Operational Handbook, Corporate Co-operation Guidance, p. 1 at note 5, citing The Director of the Serious Fraud Office v. ENRC [2018] EWCA Civ 2006 at para. 117, available at https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/sfo-operational-handbook/.
90 Indeed it is not clear on what other basis such a company would self-report.
91 Director of the Serious Fraud Office v. Eurasian Natural Resources Limited (Law Society intervening) [2018] EWCA Civ 2006, at paras. 115 to 117.
93 Sir David Green QC, former SFO Director, speech at GIR Roundtable Discussion on Corporate Internal Investigations, 27 July 2015.
94 Sir David Green QC, former SFO Director, speech at a Q&A session organised by The Fraud Lawyers Association and the European Fraud and Compliance Lawyers Association in London, 17 June 2016 (see http://globalinvestigationsreview.com/article/1036163/david-green-sfo-can-learn-from-fca-approach-to-internal-investigations).
95 Financial Services and Markets Act 2000, s.166.
96 DPA Code, para. 7.10(iii).
97 DPA Code, paras. 7.11 to 7.22.
98 See https://www.sfo.gov.uk/cases/innospec-ltd/.
99 Christopher M Matthews, ‘Judge Blasts Compliance Monitors at Innospec Plea Hearing,’ (18 March 2010), https://globalinvestigationsreview.com/article/jac/1019218/judge-blasts-compliance-monitors-at-innospec-plea-hearing.
100 R v. Innospec Ltd [2010] Lloyd’s Rep FC 462, at para. 49.
101 For example, the civil recovery orders between the SFO and Balfour Beatty plc in October 2008; Macmillan Publishers Ltd in July 2011; and Oxford Publishing Ltd in July 2012.
102 For example, in relation to Mabey & Johnson in September 2009, as well as Innospec Ltd in March 2010. See https://star.worldbank.org/corruption-cases/sites/corruption-cases/files/documents/arw/Mabey_Johnson_UK_SFO_Press_Release_Sentencing_Sep_25_2009.pdf and https://www.sfo.gov.uk/cases/innospec-ltd/, respectively.
103 Alun Milford, then SFO General Counsel, speech at GIR Live London in April 2017, https://www.globalinvestigationsreview.com/article/1144199/gir-live-london-dpas-the-new-normal.
104 PwC was given the role of producing a report on Standard Bank’s anti-bribery and corruption systems, controls, policies and procedures, the recommendations in respect of which the bank was then obliged to implement (to PwC’s satisfaction) and within a year of that report. Serious Fraud Office v. Standard Bank plc, available at https://www.judiciary.uk/wp-content/uploads/2015/11/sfo-v-standard-bank_Final_1.pdf.
105 Serious Fraud Office v. XYZ Limited (Case No. U20150856) [2016] 7 WLUK 220; [2016] Lloyd’s Rep FC 509.
106 Serious Fraud Office v. Rolls-Royce plc and Rolls-Royce Energy Systems Inc. (Case No. U20170036) [2017] Lloyd’s Rep FC 249, at para. 43.
107 FCA Final Notice, Tesco plc and Tesco Stores Ltd (28 March 2017), at para. 4.10, available at https://www.fca.org.uk/publication/final-notices/tesco-2017.pdf.
108 Bribery Act 2010: Joint Prosecution Guidance of The Director of the Serious Fraud Office and The Director of Public Prosecutions (30 March 2011).
109 Sir David Green QC, former SFO Director, speech at the Pinsent Masons and Legal Week Regulatory Reform and Enforcement Conference, 24 October 2013, available at https://www.sfo.gov.uk/2013/10/24/pinsent-masons-legal-week-regulatory-reform-enforcement-conference-2/.
110 Alun Milford, then SFO General Counsel, speech at the European Compliance and Ethics Institute, Prague, on 29 March 2016, available at https://www.sfo.gov.uk/2016/03/29/speech-compliance-professionals/.
111 Matthew Wagstaff, SFO Joint Head of Bribery and Corruption, speech at the 11th Annual Information Management, Investigations Compliance eDiscovery Conference, London, on 18 May 2016, available at https://www.sfo.gov.uk/2016/05/18/role-remit-sfo/.
112 Camilla de Silva, SFO Joint Head of Bribery and Corruption, speech at ABC Minds Financial Services conference, 15 March 2018, available at https://www.sfo.gov.uk/2018/03/16/camilla-de-silva-at-abc-minds-financial-services/.
113 Lisa Osofsky, SFO Director, speech at the American Bar Association’s London White Collar Crime conference alongside Sandra Moser (acting chief of the DOJ’s Fraud Section), 8 October 2018.