SFO and FCA Dawn Raids
19 June 2019
19 June 2019
This guide provides an overview of the key stages of an SFO or FCA dawn raid in the UK and the powers of the relevant investigators acting for them.
If the Serious Fraud Office (SFO) suspects that criminal offences may have been committed or the Financial Conduct Authority (FCA) suspects that serious regulatory offences or breaches have occurred, they may carry out unannounced investigations (dawn raids) at the premises of the companies/firms (the firm) suspected of involvement, or whose employees are suspected of involvement.
A dawn raid can place considerable pressure on multiple aspects of a business without warning, and can be very stressful for those involved in managing it. Dawn raids may also take place in multiple business locations at the same time, and can also be carried out at residential locations of relevant staff. Individuals may also face arrest and interrogation in criminal matters.
It is there fore crucial that an effective internal response strategy is put in place before being confronted with a dawn raid.
Those employees who might become involved in handling a dawn raid, in particular, in-house legal and compliance, must know how to deal with the relevant investigators, and what their respective legal obligations and rights are. If a firm fails to comply with its legal obligations during a dawn raid, significant fines can be imposed and individuals may face civil or criminal sanctions. At the same time, it is important to ensure that the firm's rights are respected, the limits on the investigators' powers are not exceeded, and the impact of the dawn raid on the day-to-day business of the firm is minimised.
This guide provides an overview of the key stages of an SFO or FCA dawn raid in the UK and the powers of the relevant investigators acting for them. It also outlines the steps that should be taken to ensure that a firm which is the subject of a dawn raid in the UK responds in an efficient manner while minimising legal risk.
This guide does not deal with arrest and questioning of individuals (including officers and employees), and in cases where arrests are made, it may well be necessary for individuals to receive independent, specialist legal advice.
There are a number of key steps that ought to be taken now so that the firm is equipped to deal with a dawn raid if it should occur in the future:
Although unannounced investigations by investigators are often referred to as "dawn raids", the investigators will not usually arrive at dawn. They will ordinarily arrive at business premises during normal business hours. However, raids on residential premises of individual officers/employees are often undertaken before or after the working day.
Reception staff should be trained to follow the firm's internal response strategy. The key initial steps to be taken will include:
The investigators should be told that a senior member of staff is on their way and asked to await their arrival. The investigators should preferably be asked to wait in a meeting room or other suitable space away from the reception and work areas, which does not have access to the firm's IT systems, while these preliminary administrative tasks are carried out. All conversations with the investigation team should be kept to a minimum at this stage and reception staff should not discuss the raid with anyone other than the internal response team identified above.
A senior member of the internal response team should go to reception immediately to meet the investigators (the "Primary Contact"). It is preferable that he/she is accompanied by another team member who should take notes of the discussion. In the meantime, other members of the internal response team, in conjunction with the Primary Contact, should prioritise the following tasks:
If in-house lawyer members of the internal response team will be present within, say, 15 minutes, or external lawyers will be present within, say, 45 minutes, we suggest that it would be reasonable for the Primary Contact to ask the investigators to wait until their arrival before proceeding with the investigation.
However, there is usually no legal requirement for the investigators to wait for the arrival of lawyers/the full response team, and if they refuse to do so then it is important that a delay is not insisted upon as there is a risk that this could be deemed to amount to non-cooperation or obstruction of the investigation.
If the investigators are not willing to wait for the arrival of the lawyers/full response team, the investigation should be allowed to proceed, but the members of the response team who are available should liaise with the in-house and/or external lawyers by telephone (consider opening a conference call line for this purpose, with a lawyer constantly available for questions).
If the investigators insist on starting to review documents before either the internal or external lawyers arrive (i.e. in sufficient number to effectively shadow each investigator):
In preparation for when the investigators start reviewing documents and other data, the response team should carry out the following tasks:
Do not attempt to shred, delete, close down, remove or hide any hard copy documents or electronic files or documents at any time during the raid, or otherwise make it more difficult for the investigators to find anything or to speak to anyone. Do not allow anyone else to take such steps, making sure that everyone is made aware that they must not take such steps. There are criminal sanctions and/or financial penalties for any such action.
If the investigators seek to ask questions of members of staff (whether in relation to a particular document or more generally), tell the investigators that you would like a lawyer to be present for any interviews and/or questioning and ask them to wait until your lawyers arrive. However, if the questions relate only to where certain types of documents can be found on the premises or the meaning of acronyms used in documents, then these questions should be answered immediately.
The detailed rules governing the powers of the investigators will vary depending on which law enforcement agency/regulatory body is carrying out the raid and the type of underlying investigation. This information will be included in the authorisation documents presented by the lead investigator on arrival at the premises.
Generally, the investigators will have the right to require any documents to be produced which they consider to be relevant to the subject matter of the investigation (as specified in the authorisation documents). They will also have the right to copy those documents or remove originals. This can include hard copy and electronic documents, including emails and documents stored on desktops, laptops, mobile phones or any other electronic data storage devices. The investigators should, where possible, be asked to take copies rather than originals. If they insist on removing originals, copies should be retained by the firm.
Throughout the dawn raid, shadowers should keep a detailed record of all documents reviewed and copied by the investigators. It may be sensible to agree that the firm has an exact duplicate set of the copies taken by the investigators. However, consideration should be given as to whether such a duplicate set will not attract privilege and whether that is problematic. The shadowers should also immediately pass copies of any potentially critical or damaging "hot documents" to the senior internal review team or external counsel. Those documents may be important in the context of any risk assessment to be made following the investigation. Shadowers should also, if possible, keep a record of any key word search terms used by investigators when searching electronic data.
In some circumstances, the investigators may have wide "seize and sift" powers under Part 2 of the Criminal Justice and Police Act 2001, permitting them to uplift relevant material from the premises to be reviewed at a later date. Seize and sift powers allow, for example, investigators to copy the entire hard drive of a computer and remove that copy to be reviewed. The exercise of these legal powers may result in irrelevant documents or legally privileged material being seized because the investigators are not required to check each individual document before making a copy of the host source if it would not be reasonably practicable to do so. It is sensible to put the investigators on notice that certain hard drives are very likely to contain privileged material if that is the case, i.e. the hard drives of in-house counsel, senior management, etc.
The investigators may well also bring forensic IT experts or hardware with them so that they can run review or imaging software. It is therefore important that there are senior members of the IT team available to assist the investigators with any IT-related issues such as providing access to password-protected systems and documents or providing administrator access rights.
All shadowers should be made aware of the rules relating to the powers of investigators to review documents so that they can monitor the investigation of documents. If the investigators try to review or copy documents which are irrelevant, privileged or otherwise protected, shadowers should intervene, and/or highlight their concerns, and seek support from others in the internal response team/external counsel as necessary.
Investigators will not normally be permitted to require the production of, or inspect, documents which are not relevant to the subject of the investigation, nor are they entitled to documents which are legally privileged under English law. As a general proposition, no law enforcement agency, regulator or court can require a person to provide either information or documents which are the subject of legal professional privilege. If, for example, the SFO or a police officer has reasonable grounds for believing that any items may be subject to privilege, they are not entitled to seize them (section 19(6) of the Police and Criminal Evidence Act 1984). The Criminal Justice and Police Act 2001 does, however, allow privileged material to be gathered if the officers are exercising their seize and sift powers under that section, but that does not override the right to privilege.
Likewise, the FCA is prohibited from seizing "protected items". Protected items are defined in section 413 of the Financial Services and Markets Act 2000 (FSMA) as being: (i) communications between a professional legal adviser and his client or any person representing his client; (ii) communications between a professional legal adviser, his client or any person representing his client and any other persons; or (iii) enclosures or documents referencing such communications which in any case fall within section 413(3). A communication or item falls within section 413(3) if it is made in connection with giving legal advice to the client or in connection with or in contemplation of legal proceedings and for the purposes of those proceedings. There is an exception if the item is held with the intention of furthering a criminal purpose.
If specific documents are legally privileged, the investigators are ordinarily not entitled to read or take copies of them. If there is any dispute or doubt as to the claim to privilege, special arrangements can often be made to deal with privilege claims such as the documents being separated and sealed in an envelope for subsequent inspection either by independent counsel to assess claims for legal professional privilege, or for independent counsel to attend the raid itself to assess such claims.
The investigators may have powers to ask individuals for explanations about potentially relevant documents. Refusal to answer may result in significant sanctions being imposed on the firm and/or the individual. However, questions from the investigators are ordinarily subject to the privilege against self-incrimination and the legal professional privilege exception so that it is not necessary to give answers if either privilege is applicable. The questions should be limited to assisting the investigator in understanding the documents before him/her. They should not be about new issues or seeking new information beyond that contained in the document. Once again, it is best to tell the investigators that you would like a lawyer to be present for any interviews and/or questioning and ask them to wait until your lawyers arrive.
Both the SFO and FCA do have specific powers to compel an individual associated with the firm to answer questions. Usually, they will need to produce a specific written notice before doing so, but the FCA can seek explanations of documents under the warrant itself. Questions of privilege against self-incrimination and the need for a caution may arise, in which case external legal advice should be sought.
The SFO's powers to carry out dawn raids are usually exercised by means of their obtaining a search warrant under section 2(4) of the Criminal Justice Act 1987 (CJA). The warrant will authorise the officer (a) to enter (using such force as is reasonably necessary for the purpose) and search the premises, and (b) to take possession of any documents appearing to be documents of the description specified or to take, in relation to any documents so appearing, any other steps which may appear to be necessary for preserving them and preventing interference with them. The SFO invariably will conduct raids in conjunction with the police.
If a firm or individual fails to cooperate with an investigation by the SFO, it/he/she becomes liable to criminal prosecution and penalties under section 2 of the CJA. This section states that:
The powers of the FCA in respect of raids derives from section 176 of FSMA which entitles the FCA in certain circumstances to seek a search warrant. Such a warrant will authorise the officer: (a) to enter the premises specified in the warrant; (b) to search the premises and take possession of any documents or information appearing to be documents or information of a kind in respect of which a warrant was issued ("the relevant kind") or to take, in relation to any such documents or information, any other steps which may appear to be necessary for preserving them or preventing interference with them; (c) to take copies of, or extracts from, any documents or information appearing to be of the relevant kind; (d) to require any person on the premises to provide an explanation of any document or information appearing to be of the relevant kind or to state where it may be found; and (e) to use such force as may be reasonably necessary. In the case of an FCA dawn raid, the police will execute the warrant, accompanied by the FCA staff.
Various offences in relation to non-cooperation are created under section 177 of FSMA:
The second and third offences above are punishable with up to two years imprisonment or a fine.
A closing meeting should be held with the investigators before the investigators leave the firm's premises. During this meeting, the firm should consider seeking confirmation that:
The firm should also seek to agree with the investigators:
The investigators are likely to request that a representative of the firm signs an index/log of documents which they have drawn up during the dawn raid, to confirm that the firm agrees that the index/log is correct. This index/log should be checked to verify that it matches up with the copies which the investigators have made (both paper and electronic) and/or the original documents which they plan to remove. It should also be compared to the firm's own record.
Once the investigators have left the premises, a "debriefing" with the in-house/external lawyers should be held as soon as possible to try to establish whether there is any substance to any allegations being made against the firm/individuals.
A review of all documents copied/seized by the investigators should then be carried out as quickly as possible, to assess the level of any risks/issues faced by the firm (if the dawn raid lasts several days, a review should be conducted at the end of each day). If there appears to be evidence of involvement in a criminal offence or regulatory breaches, consideration may need to be given as to whether any notifications to law enforcement agencies/regulators need to be made quite apart from the raid itself, e.g. suspicious transactions or under the FCA's Principle 11.
Questions of cooperation and waiver of privilege in relation both the SFO and FCA go beyond the scope of this guide and you should seek specialist advice.
If any inaccurate information or impression has been given in either the documents provided or in the answers to questions, the lead investigator should be notified in order to correct the impression given by misleading or ambiguous answers or documents as quickly as possible.
It will also be important to consider how to deal with any inquiries about the dawn raid and the firm's involvement or suspicion of involvement in any offences/regulatory action, both internally and externally.
A press release confirming that dawn raids have been carried out may be issued by the law enforcement agency or regulator. If the fact of the dawn raid becomes public (whether as a result of a press release issued by the regulator or otherwise, for example, by a leak), the firm will need to consider whether to put out a statement in response.
It will also be important to manage effectively the dissemination of appropriate (non-confidential) information to staff, whether by email or briefings by directors/managers.