Executive Summary
On 13 October 2026, the UK Serious Fraud Office (SFO) announced amendments to its Corporate Cooperation Guidance, first published in April 2025.1,2 The principal change allows a company’s legal representatives, while it considers whether to self-report, to engage with the SFO, potentially without identifying the company. The updated guidance also states that companies should take a proportionate, risk-based approach to identifying the full extent of offending and that the six-month deferred prosecution agreement (DPA) negotiation period runs from acceptance of an invitation to negotiate.
The amendments form part of a stated push for more self-reports. In June 2026, SFO Director Graham McNulty said, “I want the SFO to receive more self-reports, which will lead to more DPAs.”
The opportunity to engage in early dialogue with the SFO prior to reaching any investigative conclusions or decision to self-report is welcome but in truth represents a formalisation of the previous approach. It is intended to encourage transparency and may reduce some of the uncertainty inherent in the prior guidance. However, companies will remain cautious of engaging with the SFO when DPA invitations remain discretionary, when the prospect of the SFO identifying and pursuing wrongdoing absent a self-report remains uncertain, and when the guidance still acknowledges that companies that do not self-report can be invited into DPA negotiations when they demonstrate exemplary cooperation.
What Has Changed?
The most significant change is a new route for pre-report engagement with the SFO’s Director of Legal Services. When a company “is considering whether to submit a self-report,” its legal representatives may contact the Director at [email protected]. The SFO “recognise[s] that the corporate may wish to remain anonymous at this stage,” and the representative “will be invited to a meeting” to discuss the potential self-report, including whether the SFO is the correct agency to which to report. A note of the contact will be made and shared with the Intelligence Division. Although companies could raise process questions with that division before reporting, the new route provides access at a more senior level.
The revised guidance also addresses agency triage. If the SFO considers another agency better placed to receive the referral, it will tell the company promptly. When several agencies have an interest, the SFO will work with them to identify which should take the matter forward.
The SFO has expanded its description of cooperative conduct. A company should now “[p]roactively consider[] key areas of risk across the scope of its business” and, when appropriate, take proportionate steps to satisfy itself and the SFO that the full extent of any potential criminality has been reported.
The timetable for DPA negotiations has also been adjusted. The April 2025 guidance contemplated concluding negotiations within six months “of sending an invite.” The revised target is, “wherever possible,” to conclude them within six months after the company accepts an invitation to negotiate.
Finally, the expectation that a company will make employees available for interview now extends, “where possible,” to former officers and employees, agents, and consultants, whether in the United Kingdom or overseas.
Unchanged are the commitment that a company that self-reports promptly and cooperates fully will be invited to negotiate a DPA “unless exceptional circumstances apply” and the statement that the SFO does “not expect a corporate to fully investigate the matter before self-reporting.”
Will the Changes Work?
A self-report is irreversible and usually made before the company knows how the SFO will view its timing or the adequacy of its fact-finding or whether the SFO is the right recipient. The new route allows a company to test some of those uncertainties by allowing a structured discussion of agency, jurisdiction and sequencing at a senior level.
However, familiar limitations remain. Most importantly, the SFO cannot give meaningful assurance about the outcome before it knows the facts. Promptness, “full” cooperation and “exceptional circumstances” will be judged retrospectively and subjectively. The DPA Code confirms that a company has “no right to be invited to negotiate a DPA,”3 while Schedule 17 to the Crime and Courts Act 2013 requires any DPA to receive court approval. The SFO has acknowledged the “limits to the commitments that we can make.”4
Anonymity presents a related difficulty because anonymity and usefulness pull in opposite directions. A hypothetical no-names account is likely to produce only hypothetical comfort, but sufficient detail to make the discussion useful may identify the company. The guidance does not explain how the SFO will treat information provided through an anonymous approach.
Timing creates a further risk. The guidance is silent on whether an approach will affect the SFO’s assessment of promptness. A record showing that a company was considering a report could later be used to identify the point from which any delay is measured.
More fundamentally, the amendments do not alter the risk matrix that drives the self-reporting decision in circumstances where the company is not legally obliged to notify the SFO and others. Companies must still weigh the likelihood of detection, the potential penalty, the duration of the process, collateral consequences, exposure across jurisdictions and the position of individuals whom the DPA Code expects ordinarily to be investigated and, when appropriate, prosecuted.
Practical Implications
Before the company has sufficient information to conclude that potential wrongdoing may have occurred, the priorities remain evidence preservation and investigation. A direct approach to the SFO at this stage is unlikely to be helpful.
Once there is sufficient evidence of potential wrongdoing, the guidance expects a report “soon after.” Further investigation may be appropriate when the position remains less clear-cut, but the updated guidance does not permit a company to postpone reporting until it has completed an enterprise-wide review. A company making a report should therefore do so promptly once the relevant threshold is met, while conducting a documented, risk-based review of comparable exposures whose scope and methodology it can explain to the SFO.
A pre-report discussion is most likely to help when the uncertainty is procedural, for example when the uncertainty relates to which agency to report to, coordination with overseas authorities, interview sequencing and what initial scope the SFO would regard as proportionate. This discussion should be properly authorised, recorded and treated as irreversible and should not become a means of deferring the decision.
Whether to self-report remains fact-specific, turning on the strength of the evidence, the likelihood of independent detection (including through whistleblowers or overseas authorities) and parallel reporting obligations. A pre-report discussion may inform this decision. It will not make it.
