TRW & Co · Competition, Regulatory & Investigations
Corporate Investigations Lawyers in London
Corporate investigations lawyers London boards instruct establish the facts behind suspected fraud, bribery, sanctions breaches and misconduct under legal privilege. With the failure to prevent fraud offence in force, corporate liability now extending to all offences committed by senior managers and new SFO guidance on self-reporting, the first decisions on evidence and disclosure matter more than ever.
Key pointUnder the SFO's April 2025 guidance, a company that self-reports promptly and cooperates fully will be invited to negotiate a DPA unless exceptional circumstances apply. That makes the early decision on whether and when to report one of the most valuable in any investigation.
At a glance
Failure to prevent fraud
Large organisations can be prosecuted for fraud by associated persons unless they had reasonable prevention procedures; the offence came into effect on 1 September 2025.
Senior manager attribution
Since 29 June 2026, section 250 of the Crime and Policing Act 2026 attributes any offence by a senior manager to the company.
Self-reporting incentive
The SFO says companies that self-report and cooperate fully will be invited to negotiate a DPA unless exceptional circumstances apply.
Privilege is narrow
English legal advice privilege covers a narrow client group, so investigation structure and timing decide what stays protected.
Compulsory SFO powers
Section 2 of the Criminal Justice Act 1987 lets the SFO compel answers and documents from companies and individuals.
Swipe or scroll →
What corporate investigations cover
A corporate investigation is a structured inquiry into suspected wrongdoing inside a business: fraud, bribery, sanctions breaches, accounting irregularities, market misconduct, harassment or serious regulatory failures. Boards, audit committees and general counsel instruct corporate investigations lawyers London practitioners to establish the facts under legal privilege, decide whether to report to authorities and manage the consequences for the company and the individuals involved.
Investigations start in many ways. A whistleblower raises a concern, an auditor finds an unexplained payment, a regulator sends a request for information, a bank freezes an account or a dawn raid takes place. The trigger often dictates the timetable: an internal concern may allow weeks of planning, while a regulator's notice or a media story can compress decisions into days.
The aim is not only to find out what happened. A well-run investigation protects privilege, preserves evidence, treats employees fairly, satisfies auditors and regulators, and gives the board a defensible record of how it responded. Getting those elements right from the first day is the main reason to involve corporate investigations lawyers London boards trust before collecting documents or interviewing staff.
The legal and enforcement framework
The Serious Fraud Office (SFO) investigates and prosecutes serious or complex fraud, bribery and corruption. Under section 2 of the Criminal Justice Act 1987 it can compel people and companies to answer questions and produce documents. Other authorities with investigatory powers include the FCA, the CMA, HMRC, OFSI, the Insolvency Service, the Information Commissioner's Office and the police.
Corporate criminal liability
Companies face criminal exposure in three main ways. The failure to prevent offences make an organisation liable for offences committed by its associated persons unless it had adequate or reasonable prevention procedures: bribery under section 7 of the Bribery Act 2010, facilitation of tax evasion under Part 3 of the Criminal Finances Act 2017, and fraud under the Economic Crime and Corporate Transparency Act 2023.
The failure to prevent fraud offence came into effect on 1 September 2025 and applies to large organisations that meet size criteria based on employees, turnover and balance sheet. Separately, the identification doctrine was widened: the 2023 Act attributed economic crimes committed by a "senior manager" to the company, and section 250 of the Crime and Policing Act 2026, in force since 29 June 2026, extends that senior manager test to all offences.
Resolutions available
Deferred prosecution agreements (DPAs) under Schedule 17 to the Crime and Courts Act 2013 let a prosecutor suspend a corporate prosecution in return for conditions such as a financial penalty, disgorgement, compensation and compliance improvements, subject to court approval. DPAs are available to companies, not individuals. Regulators have their own settlement processes, and the FCA can impose penalties, public censures and restrictions.
| Authority | Typical matters | Key powers | Possible outcomes |
|---|---|---|---|
| Serious Fraud Office | Serious fraud, bribery and corruption | Section 2 notices, search warrants, interviews | Prosecution, DPA, no further action |
| Financial Conduct Authority | Market abuse, misconduct and systems failures in regulated firms | Information requirements, skilled person reviews under section 166 FSMA, formal investigations | Penalties, censure, restrictions, criminal prosecution in some cases |
| HMRC | Tax fraud, facilitation of tax evasion, export control breaches | Information notices, criminal investigation, Code of Practice 9 | Civil settlement, penalties, prosecution |
| Competition and Markets Authority | Cartels and abuse of dominance | Dawn raids, information notices, interviews | Fines, director disqualification, criminal cartel prosecution |
| OFSI and OTSI | Financial and trade sanctions breaches | Information requests and civil penalty procedures | Civil penalties, disclosure, referral for prosecution |
Key decisions: scope, privilege and self-reporting
The most consequential choices are made early. Corporate investigations lawyers London boards appoint will usually advise on four questions in the first days: who oversees the investigation, what it covers, how privilege will be protected and whether, when and to whom to report.
Governance and independence
The investigation should report to people who are not implicated, often a board committee. If senior executives may be involved, independence matters for credibility with auditors, regulators and prosecutors. Terms of reference should be written but flexible, so the scope can widen if evidence leads elsewhere.
Self-reporting to the SFO
The SFO's corporate guidance published on 24 April 2025 states that a company that self-reports suspected wrongdoing promptly and cooperates fully will be invited to negotiate a DPA, unless exceptional circumstances apply. The SFO aims to respond to a self-report within 48 business hours, to decide whether to open an investigation within six months, and to conclude DPA negotiations within six months of an invitation. Strategic reporting to another jurisdiction, concealing individuals' roles or tactical delay count against a company.
Self-reporting is still a judgement. It depends on the strength of the evidence, the likelihood of discovery, obligations to other regulators such as the FCA, auditors' duties, exposure abroad and the effect on employees. Our article on deferred prosecution agreements explains how the DPA process works in practice.
Regulatory investigations and prevention procedures
Not every investigation is criminal. For firms regulated by the Financial Conduct Authority, the FCA can require information, appoint a skilled person under section 166 of the Financial Services and Markets Act 2000 to report on systems or conduct, and appoint investigators for formal enforcement work. Regulated firms also have a duty under the FCA's Principles for Businesses to deal with the regulator in an open and cooperative way and to disclose matters it would reasonably expect to know about, which can make notification of a serious internal concern effectively mandatory.
Corporate investigations lawyers London financial services firms instruct must therefore manage two tracks at once: the internal fact-finding and the regulatory relationship. Our FCA enforcement team covers skilled person reviews, interviews and settlement discussions.
Testing prevention procedures
Every failure to prevent offence gives the company a defence if it had adequate or reasonable procedures, and official guidance for each offence follows similar themes: top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, and monitoring and review. An investigation is often the moment when those procedures are tested for real. Findings about how misconduct escaped detection should feed straight into remediation, and the company should be able to show prosecutors what has changed. Corporate investigations lawyers London boards rely on will look at prevention procedures as part of the investigation, not as an afterthought.
How an internal investigation runs
No two investigations are identical, but a disciplined sequence keeps them proportionate and defensible. Our guide to conducting an internal investigation goes further on each stage.
- Triage and immediate protection. Assess the allegation, identify urgent risks such as ongoing payments or asset flight, and decide who will oversee the work.
- Preserve evidence. Issue a document hold, suspend automatic deletion, secure devices and collect email, messaging and financial data forensically.
- Set scope and privilege structure. Agree terms of reference, instruct external lawyers and forensic accountants in a way that maximises privilege, and set the reporting line.
- Review documents. Use targeted searches and technology-assisted review to build a chronology and identify key people and transactions.
- Interview witnesses. Interview employees and third parties fairly, explaining who the lawyers act for and that privilege belongs to the company.
- Report and decide. Report findings to the board, usually orally or in a carefully structured written form, and decide on disclosure, remediation and employment action.
- Remediate. Strengthen controls, discipline or exit wrongdoers, pursue recovery against those responsible and document the improvements.
Before interviewing anyone, check whether the SFO or another authority is already involved or likely to be. The SFO expects to be consulted before key steps in a company's internal investigation, particularly interviews, and may ask the company to pause them. Interviewing first and telling the authority later can undermine cooperation credit.
Privilege, evidence and data
Legal professional privilege is the backbone of an internal investigation. Legal advice privilege protects confidential communications between lawyer and client for the purpose of legal advice, but English law defines the "client" narrowly, so communications with ordinary employees may not be covered. Litigation privilege protects documents created for the dominant purpose of adversarial litigation that is reasonably in contemplation, which can include a criminal investigation.
In SFO v Eurasian Natural Resources Corporation [2018] EWCA Civ 2006, the Court of Appeal held that litigation privilege could apply to documents produced during an internal investigation once prosecution was reasonably in contemplation. Privilege is fact-specific, so record when litigation became contemplated, label documents carefully and limit circulation. Our article on legal professional privilege explains the tests.
Data handling must comply with UK GDPR and the Data Protection Act 2018. Personal data in emails and devices must be processed lawfully and proportionately, and transfers to overseas advisers or authorities need a legal basis. Employee monitoring and device collection should follow the company's policies and contracts, and the Information Commissioner's Office publishes guidance on employment practices and monitoring.
People: employees, whistleblowers and directors
Investigations affect people, and how they are treated influences both the evidence and the company's legal exposure. Employees asked to attend interviews should be told the purpose, that the lawyers act for the company and that the company controls privilege. Suspension should be a neutral act, used when needed to protect evidence or the investigation, not as a disciplinary sanction.
Whistleblowers who make protected disclosures are protected from detriment and dismissal under the Employment Rights Act 1996, and a careless investigation can create a whistleblowing claim on top of the original problem. Directors and senior managers may need separate legal representation where their interests diverge from the company's, and directors' and officers' insurance should be checked early. Our whistleblowing team advises on the employment dimension.
Where the investigation leads to disciplinary action, the findings must stand up in an employment tribunal as well as with regulators. That means a fair process, a chance for the employee to respond to the evidence and a decision-maker who did not conduct the investigation. Keeping the investigation and disciplinary stages separate, while sharing only what is needed, protects both the company's privilege and the fairness of the outcome.
The first week of an investigation decides whether the company controls the narrative or reacts to someone else's.
Risks and common mistakes
Corporate investigations lawyers London companies instruct after a problem has escalated often find one of these mistakes at the root.
Losing privilege through the wrong structure
Investigations run by internal audit or HR without legal direction, or by external accountants instructed directly by the business, may produce reports that are not privileged and must be disclosed to authorities or opponents. Even lawyer-led work can lose protection if interview notes are verbatim, widely shared or not linked to legal advice. Instruct lawyers at the outset, route forensic and accounting work through them, consider when litigation privilege arises, and limit written findings until the board decides what it needs. Sharing material with a regulator should be done under a limited-waiver agreement, recognising that other jurisdictions may not respect it.
Destroying or failing to preserve evidence
Routine deletion policies, device replacement and departing employees can wipe crucial evidence, and once an investigation is anticipated, losing material can look like obstruction. Destroying documents relevant to an SFO or CMA investigation can be a criminal offence. Issue a written hold notice to custodians and IT the moment an investigation is likely, suspend auto-delete on email and messaging, image devices before reissuing them and cover personal devices and messaging apps used for work, subject to proper legal basis and policies.
Tipping off or alerting suspects too early
Where money laundering is suspected, disclosure to the suspect can amount to tipping off under the Proceeds of Crime Act 2002, and more generally early contact can lead to evidence destruction or asset flight. Plan the order of steps carefully: secure data before interviewing key people, consider whether a suspicious activity report is needed, and think about civil remedies such as freezing orders where assets are at risk. Our civil fraud and asset recovery team can act quickly in parallel.
Treating the investigation as a single-jurisdiction matter
Misconduct in one country often touches others through payments, subsidiaries and group reporting. Overseas data protection, labour and blocking laws may restrict how evidence is collected or transferred, and foreign authorities may expect notification at the same time as UK authorities. The SFO regards selective reporting to a more favourable jurisdiction as uncooperative. Map the jurisdictions involved at the start, engage local counsel where evidence or employees sit abroad and coordinate any disclosures.
Writing a report that cannot be defended
A long written report full of conclusions about individuals can be a liability: it may not be privileged, it may be quoted in litigation and it may prejudice later criminal proceedings. Equally, a board that receives no clear findings cannot show it acted properly. Agree the form of reporting at the start, separate factual findings from legal advice, avoid unsupported conclusions about guilt, and keep a clear record of the board's decisions and the reasons for them.
Cross-border investigations
Many investigations involve the US Department of Justice and SEC, EU authorities or regulators in the Gulf and Asia, alongside UK agencies. Coordinated resolutions are possible, but each authority has its own expectations on cooperation, privilege waiver and individual accountability, and the UK's narrow approach to legal advice privilege differs from other systems.
For businesses with operations in Bangladesh, TRW & Co's Dhaka head office can support evidence collection and local law advice, including where the Anti-Corruption Commission or Bangladesh Bank may take an interest. Our Singapore and Dubai offices help coordinate matters in those jurisdictions. Corporate investigations lawyers London clients rely on should plan the global sequence of disclosures, so that a report in one country does not trigger avoidable problems elsewhere. See also our sanctions and export controls page where investigations involve restricted trade.
How TRW & Co's corporate investigations lawyers London team helps
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. We act for companies, boards and committees, and coordinate with forensic accountants and data specialists. Where advocacy in the higher courts or criminal courts is required, we instruct specialist counsel. We do not promise any outcome with prosecutors or regulators.
Rapid response
Triage of allegations, document holds, forensic collection and immediate steps when a dawn raid, section 2 notice or regulator request arrives.
Internal investigations
Privileged investigations into fraud, bribery, sanctions, accounting and conduct concerns, with fair witness interviews and board-level reporting.
Regulator and prosecutor engagement
Self-reporting strategy, cooperation, DPA negotiations and responses to the SFO, FCA, HMRC, CMA and sanctions authorities.
Failure to prevent compliance
Risk assessments and procedures for bribery, tax evasion facilitation and fraud prevention, tested against official guidance.
Employment and individuals
Suspension, disciplinary and whistleblowing issues, and advice on when individuals need separate representation.
Recovery and remediation
Civil claims against wrongdoers, insurance notifications, control improvements and monitorship preparation.
Related guidance includes our pages on white-collar crime, anti-bribery and corruption and FCA enforcement, and our article on failure to prevent fraud. Browse all our practices for wider support.
Checklist for decision-makers
When a concern emerges, the board or audit committee should be able to answer these questions quickly:
- Who is overseeing the investigation, and is anyone potentially implicated in that reporting line?
- Have documents and devices been preserved, including messaging apps and personal devices used for work?
- Are lawyers directing the work in a way that protects privilege?
- Is any authority already involved, and do we have a duty to report to a regulator, auditor or insurer?
- Should we self-report to the SFO or another authority, and when?
- Which jurisdictions are involved, and what local laws affect data and interviews?
- How will we treat employees and whistleblowers fairly during the process?
- What remediation will show that the problem has been fixed?
Corporate investigations lawyers London boards instruct should help answer these questions within days, not weeks. To discuss a concern in confidence, contact our London office or email info@trw.co.
Frequently asked questions
01When should a company start an internal investigation?
As soon as there is a credible indication of wrongdoing that could expose the company to criminal, regulatory or civil liability. Credible does not mean proven: a whistleblowing report with specific details, an unexplained payment or an auditor's concern is usually enough to justify at least a preliminary review. Delay risks lost evidence, continuing misconduct and a weaker position with authorities. Early steps can be limited and proportionate, such as preserving documents and scoping the issue, before a decision is taken on a full investigation.
02Are internal investigation reports privileged?
Not automatically. Legal advice privilege covers confidential lawyer-client communications for legal advice, but the client group is narrow, so interview notes with ordinary employees may not be covered. Litigation privilege can apply once adversarial proceedings, including a criminal investigation, are reasonably in contemplation and the document is created for the dominant purpose of that litigation. The structure of the investigation, the involvement of lawyers and careful document management all affect whether protection applies. Sharing a report with a regulator can also waive privilege.
03Should we self-report to the Serious Fraud Office?
It depends on the facts. The SFO's guidance says a company that self-reports promptly and cooperates fully will be invited to negotiate a DPA unless exceptional circumstances apply, which makes self-reporting more predictable than before. Against that, a company must consider the strength of the evidence, the likely penalty, other regulators' requirements, overseas exposure, civil claims and the impact on employees. The decision should be taken by unconflicted directors with legal advice, and recorded with reasons.
04What is a deferred prosecution agreement?
A DPA is an agreement between a prosecutor and a company under which a prosecution is suspended while the company meets agreed conditions, such as paying a financial penalty, disgorging profits, compensating victims, cooperating with investigations and improving compliance. If the company meets the conditions, the proceedings are discontinued. A DPA must be approved by a Crown Court judge as being in the interests of justice and fair, reasonable and proportionate. DPAs are only available to organisations, not individuals.
05Who counts as a large organisation for failure to prevent fraud?
The offence applies to large organisations, defined by reference to size criteria covering employees, turnover and balance sheet total, with an organisation qualifying if it meets at least two of the three. Group structures matter, because the size criteria and associated-person rules can bring subsidiaries and their staff within scope, so check how the test applies across your group. Government guidance explains the reasonable procedures defence. Organisations below the threshold remain exposed to fraud through other routes, including the expanded senior manager attribution test.
06Do employees have a right to a lawyer at an internal interview?
Not automatically. Employees have no general legal right to their own lawyer at an internal investigation interview, although the company may allow it, and a statutory right to be accompanied may apply at disciplinary or grievance hearings. Where an employee's interests conflict with the company's, or they may face personal liability, it is often sensible for them to receive independent advice. Interviewers should explain that they act for the company, that privilege belongs to the company and that the company may share information with authorities.
07Can the SFO force us to hand over documents?
Yes. Under section 2 of the Criminal Justice Act 1987, the SFO can require a person or company to answer questions, provide information and produce documents relevant to an investigation. Failure to comply without reasonable excuse is a criminal offence, and giving false or misleading information is a separate offence. Legal professional privilege can still be asserted over protected material. Take legal advice on the scope of the notice, the timetable, privilege review and how documents held overseas are treated.
Sources and official materials
- Serious Fraud Office — SFO guidance, policy and news
- Criminal Justice Act 1987, section 2 — SFO compulsory investigation powers
- Crime and Courts Act 2013, Schedule 17 — Deferred prosecution agreements
- Economic Crime and Corporate Transparency Act 2023 — Failure to prevent fraud and corporate attribution
- Offence of failure to prevent fraud: guidance — Home Office guidance on reasonable procedures
- Bribery Act 2010 — Bribery offences and failure to prevent bribery
- SFO v ENRC [2018] EWCA Civ 2006 — Litigation privilege in internal investigations
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.