SFO's new self-reporting guidance: A new deal or a departure from justice?

Key elements of the new guidance

The guidance sets out the following key commitments:

• Swift engagement: The SFO will contact a company within 48 business hours of a self-report to the Intelligence Division using a new secure reporting form.
• Timely decision-making: A determination on whether to open an investigation will be made within six months.
• Expedited DPA process: DPA negotiations, where initiated, are expected to conclude within six months.
• Presumption in favour of DPAs: Where a company self-reports and co-operates fully, a DPA will be offered in almost all cases. Ephgrave appeared to put it even higher at the GIR Conference: "No ifs, no buts – it’s a cast-iron guarantee". 

The guidance also outlines what constitutes "genuine co-operation", including expectations that companies preserve evidence, engage early on internal investigations, and present all known facts transparently. Co-operation is defined as going beyond what the law strictly requires, with particular emphasis on proactivity and openness.

Interestingly, the guidance now actively discourages self-reporting to any "domestic or foreign" agencies other than the SFO. Notably, reporting offending solely through another agency or via a Suspicious Activity Report does not qualify as a self-report to the SFO unless the SFO is notified simultaneously or immediately thereafter. The guidance also identifies conduct that may be treated as uncooperative, including "forum shopping" by reporting misconduct to another jurisdiction for strategic advantage, or attempting to exploit differences between legal systems.

The implications: Are DPAs becoming the default?

Under the Crime and Courts Act 2013, DPAs are intended as an alternative to prosecution in cases where it is in the public interest and appropriate to do so. Importantly, any DPA must be approved by a judge, who must be satisfied that the agreement is in the interests of justice and that its terms are fair, reasonable, and proportionate. However, the SFO's new stance suggests that DPAs will be the expected route in most cases involving self-reporting corporates.

This raises three significant concerns. First, whether such an approach can be reconciled with a legislative framework that demands a case-by-case assessment of public interest.

Second, whether courts may increasingly scrutinise the SFO's use of DPAs, particularly in cases where the seriousness of the misconduct raises questions about whether prosecution, rather than a negotiated settlement, better serves the public interest. The role of judges in this context will become more significant; their oversight is a safeguard that may be tested more frequently if the SFO continues to pursue DPAs as a near-default option.

Thirdly, there is the broader question of whether the public interest is best served when serious criminal conduct is resolved outside of court. While DPAs can result in significant financial penalties and commitments to reform, they do not deliver the same level of accountability or deterrence as a conviction. The perception that companies can pay their way out of prosecution may, over time, erode public confidence in the system.

The SFO's focus: Justice or efficiency?

The guidance reflects a clear intention to streamline the resolution of corporate investigations. Complex investigations, resource constraints, and legal setbacks have placed pressure on the agency to deliver measurable outcomes. In this context, the emphasis on DPAs could be seen as a pragmatic response – resolving cases more quickly, avoiding the uncertainties of trial, and delivering financial penalties that contribute to public funds.

This efficiency may come at a cost. Justice, particularly in cases of serious fraud or corruption, is not always compatible with expedience. While DPAs can provide a resolution, they may not offer the same level of public scrutiny or deterrent effect as a conviction following trial. Whether prioritising financial settlements over prosecutorial rigour serves the broader public interest is open to debate.

The pressure to self-report: An unintended consequence?

The SFO has emphasised that "the gamble of keeping this to yourself has never been riskier". At the GIR Conference, Ephgrave doubled down on this gambit, referring to the recent changes to the identification doctrine and the failure to prevent fraud offence: "[t]he bar for corporate liability is lower than ever. The chance of detection is higher than ever. The risk of ignoring misconduct has never been greater".

Yet, paradoxically, by making DPAs so readily available in all but the most exceptional cases, companies may feel less incentive to report at an early stage. The guidance itself recognises that where the position is "less clear-cut", some further investigation before self-reporting "may be necessary". If a DPA remains an option even after such delay, the practical risk of holding back diminishes.

In effect, some companies may choose to wait until they are certain of the severity of the misconduct before engaging with the SFO. This creates a potential tension within the guidance itself – while designed to prompt early engagement, it may inadvertently encourage more cautious, delayed decision-making.

In response to a question regarding the timing of self-reporting at the GIR Conference, Ephgrave stated that "there are no hard and fast rules". He suggested as a "rough and ready guide" that corporates were permitted to ask questions to establish whether and by whom an offence has been committed, but "as soon as there is a reasonable suspicion that a criminal offence has occurred, that's the point at which you stop and speak to the SFO". The Director clarified that "[y]ou don’t need proof beyond reasonable doubt. You don’t even need proof on the balance of probabilities. Just reasonable suspicion is enough".

Some might ask why this helpful clarification was not included in the new guidance; it appears that the SFO is seeking to preserve flexibility to offer DPAs to companies whose reporting may not meet this (rather low) threshold.

Genuine co-operation: Going beyond legal requirements

A further area of concern is the expectation that co-operating companies go "above and beyond" legal requirements, including the suggestion that waiving legal professional privilege is viewed favourably. The SFO's challenges in this area have been well documented, most notably in the high-profile and costly privilege dispute with ENRC.

While the SFO acknowledges that asserting privilege will not be penalised, the implication remains that the most favourable outcomes are reserved for those willing to forgo such protections. This approach may present significant risks for corporates seeking to co-operate, especially where the benefits of doing so remain uncertain.

Conclusion

Ultimately, the SFO's guidance reflects a desire to resolve cases more effectively, but it also signals a shift in how corporate misconduct is addressed in the UK. While DPAs can serve a valuable role, their widespread use raises broader questions about the nature of accountability and the role of the courts.

What is now clear is that the SFO’s top priority is achieving negotiated outcomes that serve its operational needs and the UK Treasury’s financial interests.

The SFO's new guidance provides a more structured and transparent framework for corporate engagement, but it also reflects a pragmatic shift in the agency's approach to enforcement. It remains to be seen whether that approach will be effective.

Authored by Liam Naidoo, Claire Lipworth, Olga Tocewicz, and Reuben Vandercruyssen.