Duncan Grieve examines the SFO’s new corporate compliance guidance in Thomson Reuters Regulatory Intelligence

On 26 November 2025, the SFO published updated guidance (the “Guidance”) on its approach to the assessment of corporate compliance programmes.

Importantly, the Guidance now encompasses the new failure to prevent fraud offence (“FTPF”) under section 199 of the Economic Crime and Corporate Transparency Act 2023 (“ECCTA”), and its defence of “reasonable” fraud-prevention procedures. The FTPF offence came into force on 1 September 2025.

The Guidance is predominantly a high-level restatement of principles established in earlier SFO guidance (as previously set out in the 2020 SFO operational handbook). It is light on specific, actionable detail though it cites more comprehensive guidance issued by the US Department of Justice (“DOJ”) and the Agence française anticorruption (“AFA”).

This article summarises the core principles of the Guidance and compares them with some of those emphasised by the DOJ and AFA.

Corporate Compliance Scrutiny

Although the Guidance does not go into “how” it will assess an organisation’s corporate compliance programmes, it does provide details on “when”.

1. When considering prosecution.
2. When considering a deferred prosecution agreement (“DPA”).
3. Whether to include compliance terms or a monitorship as part of a DPA.
4. If the “adequate procedures” defence to failure to prevent bribery under s7 of the UK Bribery Act (“S.7 UKBA”) is available.
5. If the “reasonable procedures” defence to FTPF is available.
6. Sentencing.

Defences to S.7 UKBA and FTPF

The Guidance discusses two statutory defences available to corporates: s.7(2) UKBA “adequate procedures”; and s.199(4) ECCTA “reasonable procedures”.

The Guidance states that the two defences will be assessed based on the following six broadly similar principles:

1. Proportionate procedures.
2. Top level commitment.
3. Risk assessment.
4. Due diligence.
5. Communication (especially training).
6. Monitoring and review.

Of particular note are the contrasting standards of “reasonable” and “adequate” procedures, with reasonable considered to be a lower standard.

The SFO acknowledges that, other than the actual Bribery Act Guidance and the FTPF Guidance, there is no formal guidance on what constitutes adequate or reasonable procedures. A programme should be effective in practice, proportionate to the company’s size and nature, and subject to ongoing assessments to ensure alignment with its operations and risk profile.

What does an effective compliance programme look like?

The SFO states that it will take a logical, holistic approach to analysing a company’s compliance programme. Whilst the SFO does not provide defined standards, it has repeatedly emphasised the importance of on-the-ground effectiveness and demonstrable outcomes.

Factors leading to decision to prosecute

Currently, the decision to prosecute a corporate offender is made against the Full Code Test and the factors in the Corporate Prosecution Guidance.

The Guidance is explicit that the burden of proof rests with the organisation to prove the “reasonable” procedures defence. However, it also acknowledges that it will consider the likelihood of the defence being raised successfully as an “important factor” when considering whether to proceed with a corporate prosecution.

It follows that a comprehensive, effective, and well-documented compliance programme can play a significant role in reducing the risk of a corporate prosecution.

SFO’s use of foreign guidance

The SFO highlights the more detailed guidance issued by the French Anti-Corruption Agency (AFA) and the Department of Justice (DOJ).

The reliance on guidance published by international counterparts is novel, but helpful given the similar requirements across converging international compliance regimes. Increasing jurisdictional alignment on good practice would assist multi-national corporates in designing integrated, global compliance programmes with less regional variation.

There are common themes shared across the various Guidance regimes.

1. Design

The DOJ emphasises that a compliance programme should be “periodically updated” and tailored to a specific risk assessment which accounts for factors like location, sector, the regulatory landscape, and potential clients. Companies should allocate resources towards areas of greater risk, and improvement should be continuous. Companies should design robust policies to act on lessons learned and comprehensively mitigate the spectrum of risk it faces.

The DOJ and AFA both emphasise the importance of training and communication, with the AFA placing greater emphasis on an appropriate code of conduct. Policies and procedures must be integrated into the organisation through periodic training of personnel throughout the organisation – although the DOJ states this can be “tailored to audience size, sophistication and subject matter expertise.” The DOJ suggests preparing practical advice, case studies, and shorter, targeted sessions. Companies must also monitor the engagement and effectiveness of the training.

An effective whistleblower mechanism is also flagged by both as another “hallmark” of a well-designed compliance programme.

2. Adequate resourcing and empowerment

Like the SFO, the DOJ will not accept a “paper programme”. Employees must be “adequately informed about the compliance programme and convinced of the corporation’s commitment to it.” Overall, both agencies agree that a programme must be independent, well resourced, and staffed by people with sufficient seniority and qualifications to discharge their responsibilities.

Interestingly, the AFA Guidance suggests that a compliance function can be entrusted with less responsibility if it is more actively supported by senior and middle management. In contrast, the DOJ assigns greater responsibility to the function itself.

Notably, the DOJ guidance warns that companies must be able to justify instances where compliance functions have had requests for resources denied.

3. Does it work in practice

The AFA, SFO, and DOJ all emphasise the importance of outcomes, evaluating them both at the time of the offence and at the charging decision. However, there is a shared understanding that even a good compliance programme will not stop all criminal activity. What matters is that misconduct is identified and remediated, and a proactive approach is taken to improvement.

Proper investigations by qualified, independent, and empowered personnel feed into an overall company’s compliance culture. The DOJ and AFA require that investigations be supported and followed through by senior staff. Demonstrable continuous improvement is also essential, and can be demonstrated through control testing, employee surveys, and periodic audits.

Lessons for organisations

The core principles referred to in the SFO Guidance, along with the linked DOJ and AFA publications, will already be broadly familiar to General Counsel and Compliance Officers. References to more comprehensive guidance issued by foreign authorities are helpful to organisations even where they do not have significant presence in the U.S. or France. In a situation where a company is facing investigation and potential prosecution, it will be seeking to avail itself of one of the statutory defences and demonstrate that it had “adequate” or “reasonable” procedures. Alignment with global good practice, including the common features shared across Guidance documents issued by the SFO, DOJ and AFA, should put organisations in a strong position.

The publication of this Guidance, along with the coming into force of the broad FTPF offence on 1 September 2025, should prompt organisations to refresh and review their internal controls to ensure they are robust, proportionate, and effective in practice. The SFO has announced its intention to be the first agency to prosecute a corporate using the new offence and is keen not to let it languish on the statute books.