Investigation Bites: From whistleblowing to self-reporting — navigating corporate misconduct

The landscape for corporate criminal liability has changed. See our Investigations Bite Articles on Crime and Policing Act which makes it easier for regulatory agencies to investigate and prosecute corporates for wrongdoing committed by senior management or where they have failed to prevent financial crime.

Now regulatory agencies tasked with investigating fraud, economic crime and misconduct are looking at other ways in which to incentivise people blowing the whistle on corporate misconduct and for organisations embroiled in wrongdoing, the introduction of informal channels to discuss suspected criminality with the regulator.

Whistleblowing Incentivisation

The Government is currently seeking views on a revised framework for whistleblowing, through a consultation open until 11:59 pm on 8 January 2027. The consultation considers reforms to the whistleblowing framework which includes a proposed incentivisation scheme for those that report economic crime.

Part Two of Jonathan Fisher KC’s Independent Review of Disclosure and Fraud Offences, published in July 2026, recommended financial incentives for whistleblowers in some cases to help shed light on economic crimes. The proposals draw on US schemes offering potentially substantial awards to eligible individuals whose original information leads to qualifying enforcement outcomes for misconduct. For example, US Department of Justice operates a Corporate Whistleblower Awards Pilot Program covering specified corporate crimes, with discretionary awards linked to qualifying forfeiture outcomes. The Securities and Exchange Commission’s scheme concerns possible federal securities-law violations.

Whistleblowing protection

In the UK, to qualify for whistleblowing protection, a worker must reasonably believe that their disclosure is one of a number of types of wrongdoing.

This includes the commission of a criminal offence and therefore whilst the consultation may focus on incentivisation for reporting financial crimes, we expect that the Government may in due course consult on whistleblower incentivisation rolling out to all suspected criminality and misconduct. This would align with recent legislative changes expanding corporate criminal attribution from economic crimes to all crimes via the Crime and Policing Act 2026.

SFO Corporate Cooperation Guidance  

The Serious Fraud Office issued its updated Corporate Cooperation Guidance on 13 October 2026. The changes are intended to make the self-reporting process clearer for organisations considering reporting suspected fraud, bribery or corruption. In particular, an organisation’s legal representatives can now approach the SFO to discuss a potential self-report before making a formal submission. The guidance also clarifies what is expected of organisations when assessing the wider extent of suspected offending.

The updated guidance builds on the framework introduced by the SFO in April 2025. Under that framework, an organisation which promptly self-reports suspected criminal conduct and fully cooperates with the SFO will, unless exceptional circumstances apply, be invited to negotiate a Deferred Prosecution Agreement rather than face prosecution.

The main change is that a company's legal representatives can now contact the SFO's Director of Legal Services directly to discuss a potential self-report before making a formal submission. This may be particularly helpful where an organisation has identified a concern but is still considering the appropriate way forward. The organisation may also remain anonymous at this stage.

What does this mean in practice?

With proposals for whistleblower incentives under consultation, organisations should take time to review their whistleblowing policies and procedures and ensure that they are robust enough for protected disclosures to be triaged and investigated appropriately.

For organisations that suspect corporate criminality, they should review their current incident / crisis response procedures. Organisations should have a clear process for escalating concerns as soon as wrongdoing comes to light, which increasingly is from a whistleblower report. This includes identifying who will assess the allegations, who will be responsible for preserving relevant evidence and who has authority to make decisions about reporting.

Investigations can quickly evolve as further lines of enquiry are identified. The scope of the internal investigation should be guided by the available evidence and the risks identified. For example, if concerns arise about payments made through a particular intermediary located in multiple jurisdictions, the company should consider whether similar payments have been made in other jurisdictions and whether other individuals were involved.

Companies should be able to justify why they have chosen to pursue certain lines of enquiry and whether the findings justify looking further in the event new evidence arises which suggests the offending may be more widespread.

Organisations need to take a proportionate approach, allowing them to report what is known promptly, while continuing to establish whether there is anything further which needs to be disclosed. An overly narrow investigation may leave relevant offending undiscovered, while an unnecessarily broad one may delay reporting and make it harder to identify the most important evidence.

Organisations should obtain specialist legal advice promptly on whether, when and to whom to report suspected criminality. Proportionate preliminary enquiries may be appropriate, but the SFO does not expect a completed internal investigation before a self-report. Where there is direct evidence of corporate offending, it expects reporting soon after that evidence is identified. Any separate mandatory reporting obligations must also be considered.

How should companies coordinate internal investigations with the SFO?

If an organisation does decide to self-report to the SFO after taking specialist legal advice, early engagement in connection with the scope of any internal investigation will be necessary. For example, an organisation would be expected to notify the SFO in advance of proposed witness interviews and other investigative steps, so that any potential conflict with the SFO's investigation can be addressed. This is important where interviews could affect the evidence available to investigators.

Companies should also preserve relevant documents and digital material, identify where important records are held and agree the appropriate format for providing digital evidence. Information should be presented in a way that helps the SFO understand the suspected offending, rather than simply providing large volumes of material without explanation.

Legal professional privilege also needs to be considered carefully. The SFO states that a company will not be penalised for maintaining a valid claim of privilege. Companies should therefore consider the position on a case-by-case basis and obtain appropriate advice before making disclosure decisions.

The central takeaway

The corporate criminal liability landscape is constantly evolving — see What do you do when you discover fraud in your organisation?. The latest developments discussed in this Investigation Bites article should act as a timely opportunity for organisations to review their crisis response, governance and legal arrangements to ensure that they are best prepared in the likely event that they suspect or have criminality reported to them by a whistleblower. Specialist advice should be sought on navigating the regulatory framework in which an organisation operates once criminality is suspected.