Criminal misconduct in business: the first 48 hours

What to do if there are allegations of criminal misconduct in my business: the first 48 hours of an internal investigation

Practical steps that can make or break your response

The first 48 hours of an internal investigation can be the most consequential period your organisation will face. The decisions made — and not made — in this narrow window will shape the trajectory of the entire matter, from regulatory outcomes to reputational impact. Whether the trigger is a whistleblower report, a suspicious transaction, a regulatory enquiry, or a dawn raid, the speed and quality of your initial response has an impact long after the matter has concluded.

Too often, organisations lose critical ground in these early hours. Documents are inadvertently destroyed, privilege is compromised, and ill-considered statements are made to regulators. The difference between a well-managed investigation and a crisis that spirals out of control can be governed by what happens in the early critical stages of the case.

What are the critical steps in the first 48 hours?

Evaluate the allegation:  is it criminal in nature?  Does it involve senior management or even board members?

Dependent on the conduct alleged, one of the most important steps will be to constitute an independent investigation committee, which is empowered to investigate the issue.  If the matters alleged are serious in nature or involve senior management, a key step is to consider the identification and appointment of specialist external legal counsel.

Can I instruct my usual lawyers?

For high-stakes investigations, independence is key, so it will rarely be appropriate to instruct the business’s usual corporate counsel.  However, neither do you want to instruct advisors with little experience of handling complex investigations, particularly those with a regulatory angle.

Assess regulatory notification obligations.

Under the FCA Handbook, Principle 11 requires authorised firms to deal with the Financial Conduct Authority in an open and cooperative way. The Senior Managers and Certification Regime imposes personal accountability on senior individuals. Determine promptly whether you are under a duty to notify the FCA, the Serious Fraud Office, HMRC, or any other regulator. Failure to notify, where required, can itself become the subject of enforcement action.

Preserve documents and data.

Consider issuing litigation hold notices immediately. Identify key custodians and the systems they use. Secure mobile devices, laptops, and email accounts. Ensure that automatic deletion policies are suspended for all relevant data. A failure to preserve evidence can constitute a criminal offence in some circumstances and can severely damage your credibility with regulators.

Brief the board or audit committee.

Directors owe duties under sections 171 to 177 of the Companies Act 2006, including the duty to exercise reasonable care, skill, and diligence. If the allegations are sufficiently serious and cannot be disregarded as frivolous, the board must be informed at the earliest opportunity so that it can discharge its governance obligations and establish appropriate oversight of the investigation.

What about legal privilege?

In English law, communications made for the dominant purpose of obtaining legal advice are protected from disclosure to regulators and in litigation, but only if the privilege is properly established and maintained from the outset.

The scope of litigation privilege in the investigation context remains contested, and organisations that delay seeking legal advice risk creating a body of unprivileged material that regulators can later compel.

It must also be remembered that legal privilege rules vary around the world.  Having lawyers which understand cross border investigations and how to maximise privilege claims could be essential down the line.

How does AI transform the response?

Modern businesses generate vast quantities of data: from email, to Whatsapp to chatrooms and social media. The use of artificial intelligence tools can enable rapid document review and data preservation at scale.  This allows specialist legal teams to move as quickly and effectively as the largest firms, at a fraction of the cost. AI-powered early case assessment can identify the most relevant custodians, flag privileged material, and map the key issues within hours rather than weeks. This is a genuine competitive advantage: it means that smaller, expert teams can deliver the responsiveness and rigour without the disproportionate costs.

What mistakes should you avoid?

• Conducting internal interviews before privilege is established;
• Allowing IT or HR teams to “investigate” without legal oversight;
• Making voluntary disclosures to regulators before the facts are understood;
• Failing to secure personal devices or accounts which are used for business communications; and
• Delaying board notification in the hope that the issue will resolve itself.

The bottom line

Every corporate investigation has a critical window. What you do in the first 48 hours can determine whether you control the narrative or the narrative controls you. Early expert legal advice is not a luxury — it is the single most effective step you can take to protect your organisation, your people, and your reputation.

If your organisation is facing an investigation or a potential compliance issue, contact us immediately. The earlier we are involved, the more we can do to protect and manage your position.

If you have any questions arising from this blog, please do not hesitate to contact us for advice, send us an e-mail, or, alternatively, follow us on X, Facebook, Instagram, or LinkedIn to stay-up-to-date.

Corporate investigations in the UK – blog series

This article is part of the Corporate Investigations in the UK blog series, exploring key legal, regulatory and practical considerations for businesses navigating corporate investigations. Read the full series below:

1. Criminal misconduct in business: the first 48 hours
2. Understanding regulator-led investigations in the UK
3. Privilege in internal investigations: protecting your communications
4. Self-reporting and cooperating with UK authorities: risks and rewards
5. The role of the board during a corporate investigation

The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Gherson accepts no responsibility for loss which may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please do not hesitate to contact Gherson. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Gherson.

©Gherson 2026