Global Investigations Bulletin - December 2024
Download PDF versionWelcome to Slaughter and May’s December edition of the Global Investigations Bulletin, a digest of key developments and recent news in global investigations and enforcement. In this edition we look at the Government Guidance on the new failure to prevent fraud offence and discuss our top takeaways. We also cover recent news and provide key horizon scanning updates.
FAILURE TO PREVENT FRAUD - GUIDANCE RELEASED
On 6th November 2024, the UK government published long-awaited Guidance on the new corporate offence of failure to prevent fraud. This is a significant milestone in strengthening accountability for fraud committed to benefit organisations and marks a major shift in compliance expectations.
Set to take effect on 1 September 2025, the new offence means that large organisations may be criminally liable if an associated person, such as an employee, subsidiary, or agent, commits fraud intended to benefit the organisation or its clients. However, it will be a complete defence if an organisation can prove it had reasonable fraud prevention procedures in place – highlighting the critical role of the compliance framework.
Reasonable procedures
The Guidance offers practical advice for organisations on designing and implementing fraud prevention procedures, building upon established principles from prior failure-to-prevent offences. Notably, it adopts a more refined and comprehensive approach compared to previous guidance, reflecting the evolution of compliance practices over the past decade.
It is important to note that the Guidance is advisory and not legally binding. While it serves as a valuable starting point, it remains flexible and does not provide a straightforward blueprint for implementation. Organisations are expected to assess their unique risk profiles and develop tailored, proportionate mitigation strategies based on the following six principles:
(1) Top-level commitment: senior management most foster a culture where fraud is unacceptable by actively supporting anti-fraud measures, promoting open reporting, and providing necessary resources and training.
(2) Risk assessment: a comprehensive, regularly reviewed fraud risk assessment is the foundation of any ‘reasonable procedures’ framework. It should address the motives, opportunities, and rationalisations for fraud.
(3) Proportionate procedures: following closely to earlier guidance documents, this principle requires that fraud prevention procedures should be tailored and proportionate to the identified risks and the complexity of the business.
(4) Due diligence: third-party risks must be managed proportionately. While the Guidance refers to established best practices, such as third-party tools and compliance obligations in contracts, it provides very little new advice on this aspect.
(5) Communication: this principle highlights the importance of embedding fraud prevention policies and training across the organisation, with particular focus on establishing and promoting effective whistleblowing processes.
(6) Monitoring and review: ongoing monitoring and review of fraud prevention measures is needed, incorporating lessons from past incidents. This principle also highlights the growing role of advanced technology and AI in fraud prevention solutions, marking an evolution from previous guidance.
What should organisations do now?
The new Guidance sets out clear, actionable expectations for fraud prevention procedures. The first step should be to carry out a comprehensive risk assessment to identify the unique fraud risks specific to the business and its sector. This includes understanding who the business’s ‘associated persons’ are and what might drive them to commit fraud. This risk assessment is the bedrock of any effective fraud prevention compliance framework. Once these risks are identified, tailored policies and procedures should be implemented to address them, followed by communication and training to embed these practices across the business. All these measures need to be in place by the 1 September 2025 deadline to maximise their protective effect – so organisations should start their risk assessments soon.
For more detail on the new offence and the government Guidance see our client briefing ‘Countdown to Compliance’.
Recent news
The SFO has closed its four-year investigation into Bombardier in relation to suspected bribery involving Garuda Indonesia. This decision follows several other high-profile case closures by the SFO, including investigations into ENRC, Rio Tinto, and the Alpha and Green Park Group of companies, all of which were closed in August 2023. Slaughter and May acted as legal advisers to Bombardier during the investigation.
As one investigation closes, another opens. On 21 November, the SFO announced a joint investigation with France’s National Financial Prosecutor’s Office (PNF) into Thales, a leading aviation and defence electronics group, over suspected bribery and corruption. The Thales Group is head-quartered in Paris and its subsidiary Thales UK employees over 7,000 staff in the UK across 16 sites. The investigation involves allegations of bribes to public officials and money laundering. Notably, this is the first international bribery investigation opened under Nick Ephgrave’s leadership as SFO director, with other new investigations primarily addressing allegations of domestic fraud.
In another significant development, on 21 November 2024, the Serious Fraud Office (SFO) filed an application with the court, alleging that Güralp Systems, UK-based seismic instrument manufacturer, may have breached the terms of a 2019 Deferred Prosecution Agreement (DPA). The DPA was originally put in place following charges that Güralp conspired to make corrupt payments and failed to prevent bribery in a scheme involving payments to a South Korean public official. As part of the agreement, Güralp paid £2 million and committed to submitting annual compliance reports. Should the court find that the DPA has been breached, the DPA may be terminated or amended, and criminal prosecution could be resumed. This is the first time a UK prosecutor has taken an organisation to court for allegedly breaching a DPA. This case draws a parallel to a recent example in the US, where Boeing breached its DPA with the Department of Justice, leading to additional fines and compliance obligations.
The First-Tier Tribunal ruled on 26 November that the SFO must disclose the total cost of its controversial Unaoil investigation. The SFO had argued that revealing the costs would hinder future economic crime prosecutions, but the tribunal rejected this argument. It found that the SFO had misunderstood a Freedom of Information request, which sought the total cost of the investigation, not a detailed breakdown.
The UK Attorney General’s Office announced in November, that the SFO will receive an additional £9.3 million in funding to establish a new asset recovery team and enhance its use of technology for disclosure processes. It will also support improvements to the SFO’s case management system. The additional funding comes after the agency faced considerable criticism over its disclosure practices.
Lastly, on 6th December, the SFO announced that Mr Gerald Smith, who has been convicted twice – first for a £72 million historic fraud case and more recently for Covid-related loan fraud - has been given an additional 13 months in prison for obstructing the seizure of his assets. Smith attempted to conceal a Bloomsbury flat by transferring ownership to a company he secretly controlled and obstructed its sale by changing locks and renting it out. The SFO also discovered that Mr Smith violated a spending order by receiving funds from a relative and spending over £53,000 on luxury expenses.
The FCA recently issued a series of final notices, including notable penalties against Macquarie Bank and Metro Bank. On 26 November, Macquarie was fined £13 million for control failures that allowed over 400 fictitious trades. The bank failed to detect these trades earlier due to weaknesses in its systems and controls, some of which had been flagged to the firm previously. On 12 November, Metro Bank plc received a £16 million fine for failing to monitor over 60 million transactions for money laundering risks. Both firms received a 30% discount on their fines for early settlement. Metro Bank’s penalty marks the third fine this year against a challenger bank for financial crime failings.
On 20 November, the Upper Tribunal reduced the FCA’s fine on Arian Financial by nearly two-thirds, to £289,000. Arian Financial had been penalised for "inadequate fraud and money laundering controls", which enabled cum-ex trades to be executed on behalf of Solo Capital without flagging that the transactions were fraudulent. Arian Financial challenged the amount of the FCA’s initial 2022 financial penalty but did not contest the findings on liability.
The FCA has released Part 2 of its consultation (CP24/2, Part 2) on proposals to disclose the names of firms under investigation at an earlier stage. While the proposals have evolved since the initial consultation in February, the revised framework would still mark a significant departure from the current approach, where investigations are only announced in "exceptional circumstances." Under the revised proposals, firms would receive 10 days' notice of an announcement (an increase from one day), with an additional 48 hours' notice if the FCA decides to proceed with public disclosure. Additionally, the FCA now proposes to explicitly consider the potential reputational impact on firms as part of the public interest test, a factor absent from the original proposals. The consultation is open for comments until 17 February 2025, with a final decision expected in Q1 2025.
Following a review and employee complaints about inadequate responses to whistleblower intelligence, the FCA updated its whistleblowing policy on 27 November 2024. Incorporating recommendations from a September 2024 review by Richard Lloyd, the changes clarify reporting procedures, enhance confidentiality measures, and aim to foster a culture encouraging concerns to be raised effectively.
Just before unveiling its updated whistleblowing policy, the FCA faced criticism in a parliamentary report published on 26 November, accusing it of inadequate responses to financial scandals, mistreatment of whistleblowers, and poor internal culture. The parliamentary report also claimed the FCA failed to properly investigate financial institutions, being overly close to them. In response, FCA chief Nikhil Rathi defended the regulator's recent reforms, citing recent record financial crime prosecutions and robust consumer protection efforts.
On 11 November, the FCA issued a statement on its review of disclosure practices in enforcement cases, following a recommendation from the Upper Tribunal in Seiler and Others v FCA. The FCA said it will adopt a broader approach to document review, moving beyond identifying only potentially undermining material. It plans to monitor the changes closely and conduct a follow-up review in 12 months to evaluate progress and determine further actions.
Finally, on 29 November 2024, the FCA published PS24/17, outlining updates to its Financial Crime Guide. These updates, based on feedback from a consultation and supervisory insights, aim to clarify expectations and help firms assess and improve their financial crime systems. The FCA encourages firms to review and adjust their controls accordingly. Further engagement and potential revisions may follow.
The NCA has concluded Operation Destabilise, a major international investigation that dismantled extensive Russian money laundering networks with global connections. Coordinated alongside US sanctions, the operation resulted in 84 arrests and the seizure of over £20 million in cash and cryptocurrency. The targeted networks, identified as Smart and TGR, allegedly laundered money for UK-based criminals, transnational crime syndicates and Russian clients attempting to evade financial restrictions.
The Danish tax authority, Skat, reached a confidential settlement with former bank director Mr Lui and four companies that it sued alongside dozens of others over an alleged scheme to defraud it of £1.4 billion in tax revenue. The claim arises from an alleged cum-ex trading scheme that exploited dividend tax loopholes across Europe. Whilst Mr Lui and the companies deny any involvement in fraud, they agreed to settle midway through the trial. Skat has accused several individuals, including hedge fund founder Sanjay Shah, of orchestrating the operation. The High Court proceedings against the remaining defendants is still ongoing.
Levales Solicitors LLP, a Hampshire law firm, has been sanctioned by the ICO for breaching GDPR after hackers accessed and leaked client data, including names, addresses, national insurance numbers, and health information. The ICO criticised Levales for failing to implement adequate security measures, instead relying on outdated IT management practices outsourced to a third party. The ICO found that the firm did not review the appropriateness of its security measures, breaching GDPR standards for data protection.
After a relatively quiet period, there has been a notable uptick in UK sanctions updates in recent months. Firstly, the UK’s trade sanctions enforcement framework saw significant reform in October 2024, notably with the establishment of the Office of Trade Sanctions Implementation (OTSI). OTSI now oversees civil enforcement of trade sanctions breaches, with the authority to impose penalties of up to £1 million or 50% of the breach value, mirroring OFSI’s powers for financial sanctions. In cases where monetary penalties are deemed inappropriate, OTSI can issue warning letters. For severe breaches OTSI can refer matters to HMRC for potential criminal prosecution. The reforms also introduced mandatory reporting requirements for specific industries.
On 28 November, Spotlight on Corruption reported on concerns about the UK’s low enforcement rates under its sanctions regime. The report highlights that OFSI has issued only one fine (a modest £15,000) since 2022, and no criminal convictions for sanctions evasion have been secured since 2012. Additionally, asset seizures have amounted to less than £1 million. In response, Giles Thomson, OFSI’s Director, suggested that more high-value cases are expected to be disclosed in the near future. Meanwhile, the UK government has said it is reviewing enforcement practices, with proposed measures including a cross-departmental strategy, the establishment of a sanctions task force, and enhanced parliamentary oversight to improve deterrence and accountability.
In October 2024, OFAC and OFSI marked the second anniversary of their ‘enhanced partnership’ with a technical exchange in Washington, D.C. Amid growing geopolitical challenges, the collaboration emphasised joint sanctions enforcement, private sector outreach, and information sharing, including signing a Memorandum of Understanding to further boost sharing and collaboration, particularly in response to Russia’s invasion of Ukraine and Middle Eastern conflicts. Both agencies also confirmed the continuation of their reciprocal secondment programme.
Additionally, on 14 November 2024, the UK introduced the Sanctions (EU Exit) (Miscellaneous Amendments) (No.2) Regulations 2024, expanding financial sanctions reporting obligations to sectors such as high-value dealers, art market participants, insolvency practitioners, and letting agents. The changes include annual reporting of designated persons' assets, clarified licensing and exceptions provisions, and enhanced civil penalties for breaches in relation to Russia land prohibitions. OFSI updated its guidance to reflect these amendments, which aim to strengthen enforcement, improve compliance intelligence, and streamline licensing processes. New guidance for letting agents and insolvency practitioners outlines their upcoming reporting obligations under the updated sanctions framework. Most of these changes took effect on 6 December 2024, with some reporting obligations starting on 14 May 2025.
The Financial Reporting Council (FRC) has reached a settlement with Ms. Amanda Nightingale, imposing sanctions for misconduct during audits at BDO LLP between 2015 and 2019. The FRC found that Ms. Nightingale falsified documents, including auditor’s reports and company accounts. Sanctions include a 20-year exclusion from the Institute of Chartered Accountants (ICAEW), a 20-year ban on accountancy work, and a reprimand. She has also paid £10,000 towards investigation costs. The FRC is also investigating BDO and two former partners in connection with the misconduct.
The UK Competition and Markets Authority (CMA) has closed its investigation into environmental claims made by Unilever after the company revised its product packaging. The investigation, launched in December 2023, focused on concerns that Unilever overstated its products' eco-friendliness through claims and imagery. The CMA noted broader industry improvements due to its Green Claims Code and enforcement actions but did not assess Unilever's compliance with consumer law. The CMA has conducted a range of investigations into greenwashing over the past few years including actions against retailers like Asos and Boohoo.
Meta Platforms has been fined nearly €800 million by the European Commission for alleged antitrust violations benefiting Facebook Marketplace, its online classified ads platform. The EU’s investigation into Meta was launched in 2019 following accusations from competitors that it was abusing its dominant position. The Commission concluded that Meta breached competition laws by tying its Marketplace service to the Facebook social network, creating an unfair advantage over competitors. Margrethe Vestager, the Commission’s Executive Vice-President for Competition Policy, stated that Meta's practices gave it “advantages other online classified ads providers could not match,” calling the behaviour “illegal under EU antitrust rules.” This is one of the last investigations under Vestager’s leadership before she steps down from her role later this year.
The Legal Services Board (LSB) has launched a consultation on draft guidance designed to help legal services regulators meet their new statutory duty under the Economic Crime and Corporate Transparency Act 2023. This duty, introduced as a new regulatory objective in the Legal Services Act 2007, aims to promote the prevention and detection of economic crime. The draft guidance outlines key requirements for regulators, including assessing and addressing risks, ensuring legal professionals can identify and avoid economic crime, monitoring compliance, and conducting regular evaluations. The consultation, which closes on 7 February 2025, aims to strengthen the legal sector’s role in fighting economic crime and safeguarding public trust in legal services.
Key Contacts
Jonathan Cotton Partner |
Ewan Brown Partner |
Orla Fox Senior Professional Support Lawyer |
If you would like to discuss any of the above in more detail, please contact your relationship partner or email one of our Global Investigations team.
You can find previous editions of the Global Investigations Bulletin here.
This material is provided for general information only. It does not constitute legal or other professional advice.