Mark Beardsworth, Duncan Grieve and Sharon Takhar assess the new joint SFO-CPS guidance on corporate prosecutions, in Law360

On 18 August 2025, the Serious Fraud Office (SFO) and Crown Prosecution Service (CPS) issued updated guidance on corporate prosecutions, aligning their approach and reflecting the new Economic Crime and Corporate Transparency Act 2023 (ECCTA).[1]

The guidance comes just weeks before the new failure to prevent fraud offence takes effect, which extends strict corporate liability to several fraud offences including fraud by false representation, fraud by failing to disclose information and fraud by abuse of position.

A strong indicator of how authorities plan to prosecute the FTPF offence came in an April 2025 speech by Nick Ephgrave, Director of the SFO, in which he said, “Come September, if they (companies) haven’t sorted themselves out, we’re coming after them … I’m very, very keen to prosecute someone for that (FTPF) offence. We can’t sit with the statute books gathering dust, someone needs to feel the bite.”

It is therefore a timely prompt for boards and legal teams to update risk management frameworks tailored to the new offence and investigative readiness.

This article highlights the new joint SFO-CPS guidance on corporate prosecutions, linking it to the incoming failure to prevent fraud offence.

We highlight key takeaways, compare it to the SFO’s existing corporate guidance, and offer some practical steps for in-house counsel.

Statutory Attribution Replaces “Directing Mind”

It is now easier for prosecutors to hold companies criminally liable for a range of economic crimes (primarily listed under Schedule 12 ECCTA) due to a lowered threshold for attribution. Section 196 of ECCTA now allows companies to be held liable where any “senior manager” commits a Schedule 12 offence within their actual or apparent authority. Prosecutors are instructed to prefer this statutory route over the common-law identification doctrine, significantly lowering the threshold for charging corporates. Boards should understand who qualifies as a senior manager and how their decisions could create corporate exposure.

Expanded “Failure to Prevent” Framework

The guidance embeds existing Bribery Act and Criminal Finances Act offences and prepares prosecutors for the new failure to prevent fraud offence. Strict liability applies, and the only defences are proving that procedures are “adequate” for bribery or “reasonable” for tax/fraud. Companies can expect detailed scrutiny of their compliance programmes and contemporaneous records. 

Refresh of Public-Interest Factors

While the Full Code Test remains, prosecutors are now directed to weigh:

1. systemic compliance failings;
2. board-level knowledge or wilful blindness;
3. prior warnings or sanctions; and
4. harm to market integrity or unidentified victims.

Mitigation factors are listed to include early self-reporting, genuine remediation and a mature compliance culture.

Clearer Roadmap to Deferred Prosecution Agreements (DPAs)

The guidance confirms that DPAs remain a tool for cooperative companies, but they are not a soft option. Organisations must provide full cooperation, including timely disclosure of internal investigation materials and, where appropriate, privilege waivers. Parallel prosecutions of individuals are explicitly encouraged, and incomplete cooperation risks immediate prosecution.

Aggressive Use of Asset Restraint and Ancillary Orders

Investigators are encouraged to deploy asset restraint orders early and pursue serious crime prevention orders and director disqualification orders at sentencing. Boards should anticipate requests for early financial disclosure and potential trading restrictions and prepare their reporting and monitoring frameworks accordingly.

Coordinated Multi-Agency and Cross-Border Approach

The SFO and CPS will proactively de-conflict with domestic regulators, Eurojust, and foreign prosecutors. This is consistent with the UK’s joint memorandum of understanding signed recently with France and Switzerland, creating a new alliance to tackle bribery and corruption[2]. Multinational groups should align their response strategies across jurisdictions from day one, as forum shopping or strategic early filings abroad may be treated as uncooperative behaviour.

Comparison with SFO Corporate Guidance

The joint SFO-CPS guidance largely aligns with the SFO’s standalone Corporate Guidance published in April on early self-reporting, genuine cooperation, and robust compliance programmes, all of which remain critical to securing a DPA.[3] However, there are notable differences:

Broader Scope

The joint guidance explicitly brings entities incorporated by statute into scope, which were not clearly covered by the SFO’s earlier guidance. This expands potential liability beyond typical corporate structures and signals that statutory bodies must also maintain adequate compliance and be prepared to cooperate fully with investigations.

Policy vs. Operational Detail

The joint guidance focuses on high-level statutory changes and public interest factors influencing prosecution decisions, whereas the SFO’s guidance provides granular operational expectations, including illustrative examples of cooperative vs. uncooperative behaviour and defined timelines for engagement and investigations.

Forum Shopping & Multi-Agency Coordination

Both guides highlight the importance of early, transparent engagement, but the joint guidance underscores cross-border coordination and multi-agency alignment as part of assessing cooperation.

Together, both the SFO’s standalone guidance and the joint guidance with the CPS signal an increasingly rigorous enforcement landscape for all types of corporate entities, statutory or otherwise (for example, public service providers like the National Health Service), and reinforces that self-reporting must be paired with proactive cooperation.

Practical Next Steps

In this section, we set out ten areas for in-house teams to refresh and revise ahead of the incoming failure to prevent fraud offence and in light of the joint guidance on corporate prosecutions. These steps are not only timely and relevant in a UK context but also apply to organisations that have an international footprint. Large multinational organisations will invariably have stakeholders overseas and their strategy will be benchmarked alongside global standards. In jurisdictions such as the US, where enforcement may have slowed, self-reporting and robust compliance and risk frameworks are still key priorities and will remain so.

• Ensure senior management owns fraud/bribery risk, set zero-tolerance policies, and implement oversight mechanisms (KPIs, quarterly risk reports).
• Refresh annual fraud and bribery risk mapping: business model, sector, geography, intermediaries, client risks, and group structures. Identify UK touchpoints and potential victims.
• Align controls with six principles: top-level commitment; risk assessment; proportionate procedures; due diligence; communication/training; monitoring & review. Apply specifically to fraud risks.
• Determine if your organisation is a “large organisation” (>GBP 36m turnover; >GBP 18m balance sheet; >250 employees). Assess whether there is a possibility that the organisation will meet the relevant criteria in the short-medium term future and plan accordingly. Map all “associated persons” (employees, agents, subsidiaries, certain contractors) whose conduct could trigger liability.
• Update accountability frameworks for ECCTA’s senior manager attribution. Identify who qualifies and how their decisions expose the organisation to risk.
• Strengthen onboarding, renewal, and due diligence for third parties (intermediaries, customers, JV partners, vendors). Include adequate assurances and protections such as warranties, audit rights and triggers for termination.
• Strengthen whistleblowing channels. Assess how whistleblowing reports are logged, reviewed, investigated and remediated. Align internal investigations with SFO expectations, preserve evidence, and ensure processes avoid compromising external review.
• Plan protocols to identify key decision-makers and timelines.
• Deliver role-specific, risk-based training covering concrete fraud/bribery scenarios. Maintain records of uptake and refresh regularly.
• Use internal audit to evidence monitoring and remediation; report outcomes to the board and track implementation to completion.

The joint SFO-CPS guidance provides a clear indication of how prosecutors intend to approach corporate liability in the post-ECCTA landscape. With the new failure to prevent fraud offence about to take effect, organisations should ensure their compliance frameworks, reporting protocols and investigative procedures are robust and up to date. Early preparation will be critical in demonstrating readiness and mitigating enforcement risk.

[1] https://www.gov.uk/government/publications/joint-sfo-cps-corporate-prosecution-guidance.

[2] https://www.gov.uk/government/news/uk-france-and-switzerland-announce-new-anti-corruption-alliance

[3] https://www.gov.uk/government/publications/sfo-corporate-guidance.

[4] For example, on 7 August 2025 U.S. Department of Justice declined to prosecute Liberty Mutual, an insurance company, on the basis that the company would disgorge USUSD 4.7 million to settle a bribery probe into an Indian subsidiary, demonstrating that U.S. authorities will continue to enforce anti-bribery and corruption legislation, albeit focused on misconduct that harms the U.S. more directly. See https://www.justice.gov/criminal/media/1410761/dl?inline.