Two developments in the space of two days point in the same direction. The Serious Fraud Office (SFO) has made self-reporting slightly easier, while the government is considering measures that could make external whistleblowing considerably more attractive. Companies may soon have less time to investigate suspected misconduct before somebody else reports it for them.
Cooperation guidance update: Anonymous pre-self-report discussion with SFO
On 13 October, the SFO published updated the SFO Cooperation Guidance.
The central offer remains unchanged from the original April 2025 guidance: A company that reports promptly and cooperates fully will be invited to negotiate a deferred prosecution agreement (DPA) rather than face prosecution, unless exceptional circumstances apply. Where there is direct evidence of corporate offending, the SFO expects a report “soon after” the company learns of it; where matters are less clear, some further investigation may be appropriate. The company must therefore investigate enough to take a responsible and properly informed decision – but not for so long that the SFO regards the report as late.
The key new provision is the option for a company’s lawyers to discuss a potential self-report directly with the SFO’s director of legal services, which they can do on an anonymous basis.
This pre-report discussion may well help with questions of jurisdiction, sequencing and investigative scope and therefore help companies weigh up the appropriate timing of a potential self-report. It should not, however, be regarded as an entirely off-record sounding board: The guidance states that a note of the contact will be made and shared with the SFO’s Intelligence Division.
Whistleblower: US-style financial incentivisation proposed
On 12 October, the UK government issued a consultation on whistleblowing.
The headline is that it raises the prospect of a mandatory statutory duty for companies with 50+ employees to operate effective reporting channels, protect confidentiality, appoint an impartial person to manage disclosures, follow them up and communicate with whistleblowers. It is of note that such duties are similar to the obligations set out in the EU Whistleblowing Directive.
In the context of self-reporting, however, the most consequential proposal is an SFO reward scheme, similar to the US scheme designed to incentivise individuals to report economic crime. Significant and original information leading to a corporate conviction or alternative enforcement action (including a DPA) could attract a payment funded from the company’s financial penalty. The reward could be calculated as a percentage of the penalty and potentially be uncapped. Eligibility would not depend on the individual being an employee or qualifying for protection under existing whistleblowing law.
The consultation identifies compliance with a company’s internal reporting system as one possible factor when calculating an award. Crucially, however, it is not presently proposed as a condition of eligibility. The commercial risk is obvious: An insider may decide that reporting externally offers a clearer personal upside than waiting for an internal process to run its course.
There is also a notable asymmetry for multinational businesses. A company’s report to another domestic or overseas authority will not count as an SFO self-report unless the matter is also reported to the SFO simultaneously or immediately afterwards. By contrast, the consultation contemplates rewarding an individual who reports to another UK or overseas authority if the information later reaches the SFO. Coordinating regulatory notifications across jurisdictions will therefore matter more than ever.
Takeaways
The consultation does not change the law today. But the direction of travel is sufficiently clear to justify action now.
Boards should ensure that serious whistleblowing reports reach the right legal and compliance decision-makers quickly; that evidence-preservation and investigation protocols can be activated immediately; and that there is a documented process for deciding whether, when and to whom a self-report should be made. Internal reporting channels must also be credible in practice – confidential, responsive and capable of giving the whistleblower confidence that the concern is being taken seriously.
The SFO is offering responsible companies a clearer route to cooperation. At the same time, it is seeking to increase the prospect that misconduct will reach it through another route. The question for companies is no longer simply whether to self-report. It is whether they can identify the facts, make the right decision and coordinate their reporting strategy before the matter is taken out of their hands.
Contributors