Updated UK SFO Compliance Guidance

The UK Serious Fraud Office has released updated guidance on how it evaluates corporate compliance programmes during investigations and enforcement decisions. This includes alignment with the new “failure to prevent fraud” offense under the Economic Crime and Corporate Transparency Act 2023 — significantly raising expectations for governance, controls, and real-world effectiveness.

This shift reflects global trends in enforcement across the UK, EU, and US, where regulators are increasingly requiring companies to prove that controls actually work, not just that they exist.

Photo: https://pl.freepik.com/

Key Principles

✅ Compliance Effectiveness Must Be Demonstrable in Practice

➡️ The SFO explicitly states it will examine whether controls operate in reality, not whether they are written in a policy binder.

➡️ This means evidence of behaviour, culture, accountability, training, monitoring, and escalation must be measurable.

✅ Two Moments of Assessment

The SFO will evaluate compliance:

➡️ at the time of the misconduct, and

➡️ at the time of charging or a Deferred Prosecution Agreement (DPA).

✅ Reasonable Procedures

Companies must now show:

➡️ “reasonable procedures” to prevent fraud, or demonstrate that, given the circumstances, such procedures were not reasonable.

➡️ This differs from the Bribery Act “adequate procedures” threshold.

✅ Compliance Can Influence Prosecutorial Outcomes

The SFO will consider compliance effectiveness when deciding:

➡️ whether to prosecute,

➡️ whether a DPA is appropriate,

➡️ whether a monitorship is required,

➡️ whether improvements should be mandated as part of a settlement.

✅ Culture, Conduct, and Leadership

Internal tone, ethical behaviour, governance structures, and management accountability play a larger role in assessment.

The SFO’s revisions reflect a broader shift in global enforcement:

➡️ Compliance is treated as a living system, not a documentation exercise.

➡️ Regulators are harmonising approaches across fraud, bribery, corruption, and economic crime.

➡️ Organisations must prepare for assessments based on empirical effectiveness, not intentions.

➡️ For companies operating in the UK — or multinational firms subject to UK enforcement — this means strengthening:

✅ fraud prevention controls,

✅ data-driven monitoring,

✅ risk assessments,

✅ compliance governance,

✅ incident response,

✅ auditability and evidence trails.

From a governance and audit perspective, this aligns perfectly with the principles of SOC1 /SOC2 operational control evaluation.

Link

Author: Sebastian Burgemejster