SFO and FCA Dawn Raids

This guide provides an overview of the key stages of an SFO or FCA dawn raid in the UK and the powers of the relevant investigators acting for them.

Introduction

If the Serious Fraud Office (SFO) suspects that criminal offences may have been committed or the Financial Conduct Authority (FCA) suspects that serious regulatory offences or breaches have occurred, they may carry out unannounced investigations (dawn raids) at the premises of the companies/firms (the firm) suspected of involvement, or whose employees are suspected of involvement.

A dawn raid can place considerable pressure on multiple aspects of a business without warning, and can be very stressful for those involved in managing it. Dawn raids may also take place in multiple business locations at the same time, and can also be carried out at residential locations of relevant staff. Individuals may also face arrest and interrogation in criminal matters.

It is there fore crucial that an effective internal response strategy is put in place before being confronted with a dawn raid.

Those employees who might become involved in handling a dawn raid, in particular, in-house legal and compliance, must know how to deal with the relevant investigators, and what their respective legal obligations and rights are. If a firm fails to comply with its legal obligations during a dawn raid, significant fines can be imposed and individuals may face civil or criminal sanctions. At the same time, it is important to ensure that the firm's rights are respected, the limits on the investigators' powers are not exceeded, and the impact of the dawn raid on the day-to-day business of the firm is minimised.

This guide provides an overview of the key stages of an SFO or FCA dawn raid in the UK and the powers of the relevant investigators acting for them. It also outlines the steps that should be taken to ensure that a firm which is the subject of a dawn raid in the UK responds in an efficient manner while minimising legal risk.

This guide does not deal with arrest and questioning of individuals (including officers and employees), and in cases where arrests are made, it may well be necessary for individuals to receive independent, specialist legal advice.

Be Prepared

There are a number of key steps that ought to be taken now so that the firm is equipped to deal with a dawn raid if it should occur in the future:

• an internal response team of relevant individuals should be identified within the firm, including the senior key contacts to be alerted in the event of a dawn raid. These individuals are likely to be drawn from senior in-house lawyers, compliance or other senior firm officials. An experienced team leader, together with sufficient deputies, should be identified who will take the lead in managing any raid. The team should also include internal IT specialists with a good understanding of the firm's IT and telephony systems, including the ability to access them;
• the internal response team should receive specialist training and have available to them relevant materials to assist them in handling any dawn raid;
• relevant specialist outside legal counsel who are qualified to deal with the particular type of dawn raid should be pre-selected/identified.  Full contact details including emergency out-of-hours contact numbers should be compiled and be easily accessible;
• reception staff at all relevant firm locations should be provided with relevant training and "aide-memoire" documentation for the purposes of handling the initial response to a dawn raid as described in more detail in the "Initial Response" section below; and
• various materials, including shadowing checklists and logs, FAQs and details of the powers of particular law enforcement agencies and regulators should be included in a dawn raid tool kit which is circulated and made available to those employees who may find themselves in the midst of dealing with a dawn raid.  

Initial Response to a Dawn Raid

Although unannounced investigations by investigators are often referred to as "dawn raids", the investigators will not usually arrive at dawn.  They will ordinarily arrive at business premises during normal business hours.  However, raids on residential premises of individual officers/employees are often undertaken before or after the working day.

Reception staff should be trained to follow the firm's internal response strategy.  The key initial steps to be taken will include:

• alerting one or more of the senior members of the internal response team, working their way through a pre-prepared checklist.  The team leader or their deputy should be alerted as soon as possible.  They, in turn, should alert other members of the internal response team;
• requesting and taking a copy of the investigating team's authorisation documents (which are likely to comprise or include a court-issued warrant in the case of an SFO or FCA dawn raid) and individual ID cards.  Ask to take/scan copies of the authorisation documents and circulate these to the senior internal team members; and
• preparing a list of the investigators, including their contact details (mobile numbers will be useful), and arranging name badges clearly identifying the investigators as visitors to the premises.

The investigators should be told that a senior member of staff is on their way and asked to await their arrival.  The investigators should preferably be asked to wait in a meeting room or other suitable space away from the reception and work areas, which does not have access to the firm's IT systems, while these preliminary administrative tasks are carried out.  All conversations with the investigation team should be kept to a minimum at this stage and reception staff should not discuss the raid with anyone other than the internal response team identified above.

The Response Team

A senior member of the internal response team should go to reception immediately to meet the investigators (the "Primary Contact").  It is preferable that he/she is accompanied by another team member who should take notes of the discussion.  In the meantime, other members of the internal response team, in conjunction with the Primary Contact, should prioritise the following tasks:

• immediately contact any other relevant members of the internal response team, including in-house legal (if the firm has an in-house legal team) and the firm's external legal advisers (if they are to be involved), as well as other key individuals (e.g. senior management) to inform them that a dawn raid is taking place and arrange a brief meeting/call to discuss the subject matter and purpose of the dawn raid.  It should be emphasised to all those concerned that the fact of the dawn raid and its subject matter should be treated as strictly confidential and only shared within the firm on a need-to-know basis;
• ascertain whether dawn raids are taking place at any other firm locations and, if so, coordinate so far as possible; 
• ascertain how long it is likely to be before: (i) in-house lawyers; and (ii) external lawyers (if any) can be present;
• carefully check the investigators' authorisation documents (copied by the reception staff): these should identify the issuing authority (the SFO and FCA will ordinarily produce a search warrant), the subject matter of the investigation (albeit usually in broad terms) and the legal basis for the dawn raid.  This will enable you to identify which procedural rules will apply to the investigation and the scope and limits of the investigators' powers.  Check that they have identified the correct firm/entity, the correct address (or addresses if the warrant extends to all or multiple firm addresses), that the investigators, if named, are present and that others are not in attendance, and check the issue and expiry date; 
• a copy of the authorisation documents should be e-mailed to any external legal team as soon as possible.  The internal response team should discuss the contents of the authorisation documents with the external legal team so that they are informed of the reason for the raid and can confirm the extent of the investigators' powers.  The external lawyers may thereafter fulfil an advisory role, attending the firm's premises to provide immediate "on the ground" advice to members of the internal response team, or additionally the external lawyers can act as shadowers (see below);
• a list should be drawn up of the names of all members of the investigation team (clearly identifying the lead investigator), together with details of their role/job title (where known) and which organisation they work for (e.g. the SFO);
• appoint a team of "shadowers" from the internal response team/external counsel team (at least as many as the number of investigators) to accompany each of the investigators at all times once they proceed with the investigation.  Shadowers should be allocated to each individual.  The shadowers should be briefed as to the limits on the investigators' powers, and should keep a written record of: (i) what documents (whether hard copy or electronic) and other data have been reviewed; (ii) which documents/data have been copied; and (iii) any questions asked and the answers given.  A pre-prepared checklist, FAQs, and shadower's record log can be helpful;
• ensure that members of the firm's internal IT team are available to assist with complying with any requests by the investigators to shut down or lock telephone, e-mail and other IT systems during the dawn raid, and to deal with issues and tasks which will arise when searching electronic documents/data; and
• it may well be appropriate to send an e-mail to relevant staff at the premises to explain what is happening and stress the need to be cooperative, but to pass all questions/requests from the investigators to the response team members/external counsel, and not to discuss the fact of the dawn raid with anyone outside of the business.  We suggest discussing this step with the investigators first in case there is any suggestion that doing so will disrupt or interfere with the investigation, including whether there is any risk of tipping off.

Negotiating whether the investigators will wait for your legal team/response team

If in-house lawyer members of the internal response team will be present within, say, 15 minutes, or external lawyers will be present within, say, 45 minutes, we suggest that it would be reasonable for the Primary Contact to ask the investigators to wait until their arrival before proceeding with the investigation.  

However, there is usually no legal requirement for the investigators to wait for the arrival of lawyers/the full response team, and if they refuse to do so then it is important that a delay is not insisted upon as there is a risk that this could be deemed to amount to non-cooperation or obstruction of the investigation.  

If the investigators are not willing to wait for the arrival of the lawyers/full response team, the investigation should be allowed to proceed, but the members of the response team who are available should liaise with the in-house and/or external lawyers by telephone (consider opening a conference call line for this purpose, with a lawyer constantly available for questions).

If the investigators insist on starting to review documents before either the internal or external lawyers arrive (i.e. in sufficient number to effectively shadow each investigator):

• seek to agree with the lead investigator that at this stage the investigators will not take any further steps prior to the lawyers/response team's arrival beyond those necessary to ensure no documents can be concealed/destroyed and no undertakings subject to parallel dawn raids can be tipped off (i.e. no review/copying of documents and no questioning of individual employees takes place before the lawyers/response team arrive); and
• if this is not possible, identify (with assistance from the lawyers via telephone) any categories of files which are likely to be relevant to the investigation but which are at a low risk of containing privileged or irrelevant material.  If possible, let the investigators work through these groups of files until the lawyers/response team arrive.

Some key points to remember:

Do:

• inform the investigators that you have contacted your lawyers (whether internal or external or a combination of the two) and have asked them to attend and advise the firm during the investigation;
• try to delay answering any questions (other than straightforward administrative queries) until a lawyer is present;
• seek immediate legal advice if at any stage you are uncertain as to your rights and responsibilities; and
• ask the investigators whether you are obliged to answer their questions, as opposed to providing material e.g. do you have to identify other locations where documents may be found if asked?  Usually, these questions are limited to the practicalities of the search and are not an opportunity to question employees.

Don't:

• be hostile to investigators;
• insist that the investigators wait for external lawyers to arrive before starting the investigation if they refuse to do so when asked;
• obstruct the investigation by refusing to cooperate;
• allow any investigator to be unaccompanied on the premises at any stage;
• try to destroy, delete or hide any documents or files (whether paper or electronic);
• agree to sign any consent to search or similar without first seeking legal advice; and
• tell anyone outside the firm (other than the firm's professional advisers) that the investigation is taking place or discuss any aspect of it.

Practical Preparations for Inspection/Review

In preparation for when the investigators start reviewing documents and other data, the response team should carry out the following tasks:

• identify secretarial/administrative staff to back up the response team of external lawyers, in-house lawyers and senior management. Ask all members of the response team to clear their diaries for at least the rest of the day;
• identify a number of empty meeting rooms (or other suitable space) for (i) the investigators and (ii) the response team to use during the investigation (separate rooms for each team).  If possible, block-book these rooms/areas for the rest of the day, and provisionally for the following day as well in case the dawn raid lasts for more than one day; and
• identify a photocopier and printer which is available for use by the investigators under the supervision of the response team, as they are likely to want to make copies/print out documents, e-mails and other data during the dawn raid.  

Do not attempt to shred, delete, close down, remove or hide any hard copy documents or electronic files or documents at any time during the raid, or otherwise make it more difficult for the investigators to find anything or to speak to anyone.  Do not allow anyone else to take such steps, making sure that everyone is made aware that they must not take such steps.  There are criminal sanctions and/or financial penalties for any such action.

If the investigators seek to ask questions of members of staff (whether in relation to a particular document or more generally), tell the investigators that you would like a lawyer to be present for any interviews and/or questioning and ask them to wait until your lawyers arrive.  However, if the questions relate only to where certain types of documents can be found on the premises or the meaning of acronyms used in documents, then these questions should be answered immediately.

Managing the on-going Dawn Raid

The detailed rules governing the powers of the investigators will vary depending on which law enforcement agency/regulatory body is carrying out the raid and the type of underlying investigation.  This information will be included in the authorisation documents presented by the lead investigator on arrival at the premises.

Review and copying documents

Generally, the investigators will have the right to require any documents to be produced which they consider to be relevant to the subject matter of the investigation (as specified in the authorisation documents).  They will also have the right to copy those documents or remove originals.  This can include hard copy and electronic documents, including emails and documents stored on desktops, laptops, mobile phones or any other electronic data storage devices.  The investigators should, where possible, be asked to take copies rather than originals.  If they insist on removing originals, copies should be retained by the firm.

Throughout the dawn raid, shadowers should keep a detailed record of all documents reviewed and copied by the investigators.  It may be sensible to agree that the firm has an exact duplicate set of the copies taken by the investigators.  However, consideration should be given as to whether such a duplicate set will not attract privilege and whether that is problematic.  The shadowers should also immediately pass copies of any potentially critical or damaging "hot documents" to the senior internal review team or external counsel.  Those documents may be important in the context of any risk assessment to be made following the investigation.  Shadowers should also, if possible, keep a record of any key word search terms used by investigators when searching electronic data.

In some circumstances, the investigators may have wide "seize and sift" powers under Part 2 of the Criminal Justice and Police Act 2001, permitting them to uplift relevant material from the premises to be reviewed at a later date.  Seize and sift powers allow, for example, investigators to copy the entire hard drive of a computer and remove that copy to be reviewed.  The exercise of these legal powers may result in irrelevant documents or legally privileged material being seized because the investigators are not required to check each individual document before making a copy of the host source if it would not be reasonably practicable to do so.  It is sensible to put the investigators on notice that certain hard drives are very likely to contain privileged material if that is the case, i.e. the hard drives of in-house counsel, senior management, etc.

The investigators may well also bring forensic IT experts or hardware with them so that they can run review or imaging software.  It is therefore important that there are senior members of the IT team available to assist the investigators with any IT-related issues such as providing access to password-protected systems and documents or providing administrator access rights.

Privileged and Irrelevant Documents

All shadowers should be made aware of the rules relating to the powers of investigators to review documents so that they can monitor the investigation of documents.  If the investigators try to review or copy documents which are irrelevant, privileged or otherwise protected, shadowers should intervene, and/or highlight their concerns, and seek support from others in the internal response team/external counsel as necessary.

Investigators will not normally be permitted to require the production of, or inspect, documents which are not relevant to the subject of the investigation, nor are they entitled to documents which are legally privileged under English law.  As a general proposition, no law enforcement agency, regulator or court can require a person to provide either information or documents which are the subject of legal professional privilege.  If, for example, the SFO or a police officer has reasonable grounds for believing that any items may be subject to privilege, they are not entitled to seize them (section 19(6) of the Police and Criminal Evidence Act 1984).  The Criminal Justice and Police Act 2001 does, however, allow privileged material to be gathered if the officers are exercising their seize and sift powers under that section, but that does not override the right to privilege.  

Likewise, the FCA is prohibited from seizing "protected items".  Protected items are defined in section 413 of the Financial Services and Markets Act 2000 (FSMA) as being: (i) communications between a professional legal adviser and his client or any person representing his client; (ii) communications between a professional legal adviser, his client or any person representing his client and any other persons; or (iii) enclosures or documents referencing such communications which in any case fall within section 413(3).  A communication or item falls within section 413(3) if it is made in connection with giving legal advice to the client or in connection with or in contemplation of legal proceedings and for the purposes of those proceedings.  There is an exception if the item is held with the intention of furthering a criminal purpose.

If specific documents are legally privileged, the investigators are ordinarily not entitled to read or take copies of them.  If there is any dispute or doubt as to the claim to privilege, special arrangements can often be made to deal with privilege claims such as the documents being separated and sealed in an envelope for subsequent inspection either by independent counsel to assess claims for legal professional privilege, or for independent counsel to attend the raid itself to assess such claims.

Power to Ask Questions

The investigators may have powers to ask individuals for explanations about potentially relevant documents.  Refusal to answer may result in significant sanctions being imposed on the firm and/or the individual.  However, questions from the investigators are ordinarily subject to the privilege against self-incrimination and the legal professional privilege exception so that it is not necessary to give answers if either privilege is applicable.  The questions should be limited to assisting the investigator in understanding the documents before him/her.  They should not be about new issues or seeking new information beyond that contained in the document.  Once again, it is best to tell the investigators that you would like a lawyer to be present for any interviews and/or questioning and ask them to wait until your lawyers arrive.  

Both the SFO and FCA do have specific powers to compel an individual associated with the firm to answer questions.  Usually, they will need to produce a specific written notice before doing so, but the FCA can seek explanations of documents under the warrant itself.  Questions of privilege against self-incrimination and the need for a caution may arise, in which case external legal advice should be sought.

Raid Powers and Consequences of Non-Cooperation with the SFO/FCA

The SFO's powers to carry out dawn raids are usually exercised by means of their obtaining a search warrant under section 2(4) of the Criminal Justice Act 1987 (CJA).  The warrant will authorise the officer (a) to enter (using such force as is reasonably necessary for the purpose) and search the premises, and (b) to take possession of any documents appearing to be documents of the description specified or to take, in relation to any documents so appearing, any other steps which may appear to be necessary for preserving them and preventing interference with them.  The SFO invariably will conduct raids in conjunction with the police.  

If a firm or individual fails to cooperate with an investigation by the SFO, it/he/she becomes liable to criminal prosecution and penalties under section 2 of the CJA.  This section states that:

• any person who fails (without a reasonable excuse) to comply with the requirements imposed on him by the SFO shall be guilty of an offence punishable by up to six months in prison and/or a fine;
• any person who makes a statement to the SFO, which he knows to be false or misleading, or recklessly makes such a statement, may be guilty of an offence punishable by up to two years in prison and/or a fine; and
• any person who knows or suspects that an investigation is likely to be carried out and falsifies, conceals, or destroys documents that are known or suspected to be relevant to the investigation shall be guilty of an offence punishable by up to seven years in prison and/or a fine.

The powers of the FCA in respect of raids derives from section 176 of FSMA which entitles the FCA in certain circumstances to seek a search warrant.  Such a warrant will authorise the officer: (a) to enter the premises specified in the warrant; (b) to search the premises and take possession of any documents or information appearing to be documents or information of a kind in respect of which a warrant was issued ("the relevant kind") or to take, in relation to any such documents or information, any other steps which may appear to be necessary for preserving them or preventing interference with them; (c) to take copies of, or extracts from, any documents or information appearing to be of the relevant kind; (d) to require any person on the premises to provide an explanation of any document or information appearing to be of the relevant kind or to state where it may be found; and (e) to use such force as may be reasonably necessary.  In the case of an FCA dawn raid, the police will execute the warrant, accompanied by the FCA staff.

Various offences in relation to non-cooperation are created under section 177 of FSMA:

• if a person fails without reasonable excuse to comply with an FCA investigation requirement, the court may deal with the defaulter (and in the case of a body corporate, any director or officer) as if he were in contempt of court;
• a person who knows or suspects that an investigation is being or is likely to be conducted will be guilty of an offence if: (a) he falsifies, conceals, destroys or otherwise disposes of a document which he knows or suspects is or would be relevant to such an investigation; or (b) he causes or permits the falsification, concealment, destruction or disposal of such a document, unless in either case he shows that he had no intention of concealing facts disclosed by the documents from the investigator;
• a person who, in purported compliance with a requirement imposed on him: (a) provides information which he knows to be false or misleading in a material particular; or (b) recklessly provides information which is false or misleading in a material particular will be guilty of an offence; and
• any person who intentionally obstructs the exercise of any rights conferred by a warrant under section 176 will be guilty of an offence punishable by imprisonment for up to three months or a fine.

The second and third offences above are punishable with up to two years imprisonment or a fine.  

The End of the Dawn Raid

Before the investigators leave

A closing meeting should be held with the investigators before the investigators leave the firm's premises. During this meeting, the firm should consider seeking confirmation that:

• the dawn raid has come to an end (i.e. can the firm go "back to business" and/or are there any files/rooms which must remain sealed?);
• the firm has cooperated with the investigators throughout (although the investigators may not agree to this); and
• any seals applied by the investigators during the dawn raid to prevent unauthorised access have not been tampered with.

The firm should also seek to agree with the investigators:

• a list of any factual points brought up during any interviews on which written clarification is to be given and reserving the right to supplement any answers already given; 
• a list of any outstanding documents which the firm has undertaken to produce; and 
• any areas of disagreement, reserving the right to challenge the authority of the investigators to take disputed documents (e.g. on the basis of irrelevance or privilege).

The investigators are likely to request that a representative of the firm signs an index/log of documents which they have drawn up during the dawn raid, to confirm that the firm agrees that the index/log is correct.  This index/log should be checked to verify that it matches up with the copies which the investigators have made (both paper and electronic) and/or the original documents which they plan to remove.  It should also be compared to the firm's own record.

After the investigators leave

Once the investigators have left the premises, a "debriefing" with the in-house/external lawyers should be held as soon as possible to try to establish whether there is any substance to any allegations being made against the firm/individuals.

A review of all documents copied/seized by the investigators should then be carried out as quickly as possible, to assess the level of any risks/issues faced by the firm (if the dawn raid lasts several days, a review should be conducted at the end of each day).  If there appears to be evidence of involvement in a criminal offence or regulatory breaches, consideration may need to be given as to whether any notifications to law enforcement agencies/regulators need to be made quite apart from the raid itself, e.g. suspicious transactions or under the FCA's Principle 11.

Questions of cooperation and waiver of privilege in relation both the SFO and FCA go beyond the scope of this guide and you should seek specialist advice.

If any inaccurate information or impression has been given in either the documents provided or in the answers to questions, the lead investigator should be notified in order to correct the impression given by misleading or ambiguous answers or documents as quickly as possible.
Publicity

Publicity

It will also be important to consider how to deal with any inquiries about the dawn raid and the firm's involvement or suspicion of involvement in any offences/regulatory action, both internally and externally. 

A press release confirming that dawn raids have been carried out may be issued by the law enforcement agency or regulator.  If the fact of the dawn raid becomes public (whether as a result of a press release issued by the regulator or otherwise, for example, by a leak), the firm will need to consider whether to put out a statement in response. 

It will also be important to manage effectively the dissemination of appropriate (non-confidential) information to staff, whether by email or briefings by directors/managers.

Summary of key actions to be taken by the Internal Response Team