Understanding regulator-led investigations in the UK

Which regulators investigate businesses, what powers do they have, and what should you expect?

The United Kingdom has one of the most active and well-resourced regulatory enforcement landscapes in the world. For businesses operating in regulated sectors — financial services, energy, mining, aviation, telecoms, and manufacturing — the prospect of a regulator-led investigation is not a remote possibility but a present risk. Understanding which regulators may investigate your organisation, the powers they hold, and the process they follow is essential to managing that risk effectively.

Who are the key regulators for business?

The Financial Conduct Authority (FCA) regulates conduct in financial services markets and has extensive powers under the Financial Services and Markets Act 2000. The FCA investigates market abuse, insider dealing, misselling, failures of governance, and breaches of its principles and rules. It can impose unlimited fines, withdraw authorisations, and make prohibition orders against individuals. Under the Senior Managers and Certification Regime, the FCA holds senior individuals personally accountable for failures within their areas of responsibility.

The Serious Fraud Office (SFO) investigates and prosecutes the most serious and complex cases of fraud, bribery, and corruption. Its powers under section 2 of the Criminal Justice Act 1987 are formidable: the SFO can compel any person to attend for interview and to produce documents, and failure to comply is a criminal offence. The SFO’s remit includes offences under the Fraud Act 2006, the Bribery Act 2010 and the Proceeds of Crime Act 2002.

The Competition and Markets Authority (CMA) enforces competition law under the Competition Act 1998 and the Enterprise Act 2002. The CMA investigates cartels, abuse of dominant position, and anti-competitive agreements. It has the power to conduct dawn raids, compel the production of documents, and impose fines of up to ten per cent of worldwide turnover.

HM Revenue and Customs (HMRC) investigates tax fraud and evasion, including the corporate criminal offence of failing to prevent the facilitation of tax evasion under the Criminal Finances Act 2017. HMRC’s investigations into offshore structures in the energy sector have been particularly prominent in recent years.

The Information Commissioner’s Office (ICO) enforces data protection law under the UK General Data Protection Regulation and the Data Protection Act 2018. The ICO can investigate data breaches, impose fines of up to £17.5 million or four per cent of global turnover, and issue enforcement notices requiring organisations to take specific remedial action.

What investigatory powers do regulators hold?

UK regulators possess a range of coercive powers that distinguish their investigations from purely internal reviews:

• Compulsory document production orders, requiring the disclosure of specified documents within set timeframes;
• Compelled interviews, where individuals are required to answer questions;
• Powers of arrest and interview under caution for suspects;
• Dawn raids and on-site inspections, conducted with or without prior notice;
• Search warrants obtained from the courts, permitting the seizure of physical and electronic evidence; and
• Skilled persons reports under section 166 of the Financial Services and Markets Act 2000, whereby the FCA appoints an independent reviewer at the firm’s expense.

SFO section 2 notices deserve particular attention – it compels the recipient to produce documents and answer questions. There is no right to refuse on the grounds of self-incrimination, although answers given under compulsion cannot generally be used in subsequent criminal proceedings against the person who gave them.

What are the stages of a regulatory investigation?

Initial enquiry: The regulator makes preliminary enquiries, often through informal requests for information. At this stage, the investigation may not be formally opened, but the organisation should treat every regulatory contact with the utmost seriousness.

Formal investigation: The regulator formally opens an investigation and may exercise its compulsory powers. The scope may broaden as new issues emerge.

Enforcement action: If the regulator finds evidence of wrongdoing, it may pursue enforcement action ranging from fines and public censure to criminal prosecution.

Settlement or prosecution: Many investigations conclude with a negotiated settlement. The FCA offers a discount of up to thirty per cent on financial penalties for early settlement. The SFO may offer a deferred prosecution agreement in appropriate cases.

Will being proactive help my business in an investigation?

Businesses do not need to sit and wait for the outcome of an investigation. Taking a proactive approach by way of a well-structured, independent and lawyer-led review in consultation with a regulator can often shorten the length of time an investigation runs for – and achieve a better outcome for to company.

However, a poor internal investigation can lead to the breakdown in trust and confidence of the regulator and increase the chance of prosecution.

How can AI strengthen your response?

AI-driven regulatory intelligence tools allow legal teams to monitor regulatory developments in real time, ensuring that responses to investigations are informed by the very latest guidance and enforcement trends.

AI-powered document review enables the rapid processing of large data sets in response to compulsory production orders, dramatically reducing the cost and time required. Importantly, this must be done in consultation with the regulator.

Key takeaway

A regulator-led investigation is a serious matter with potentially existential consequences for your business. The organisations that navigate these processes most successfully are those that understand the regulatory landscape, respect the powers of the investigating body, and engage specialist legal advisers at the earliest opportunity.

If your organisation has received a regulatory enquiry or is preparing for a potential investigation, contact us for a confidential discussion about your options and obligations.

If you have any questions arising from this blog, please do not hesitate to contact us for advice, send us an e-mail, or, alternatively, follow us on X, Facebook, Instagram, or LinkedIn to stay-up-to-date.

Corporate investigations in the UK – blog series

This article is part of the Corporate Investigations in the UK blog series, exploring key legal, regulatory and practical considerations for businesses navigating corporate investigations. Read the full series below:

1. Criminal misconduct in business: the first 48 hours
2. Understanding regulator-led investigations in the UK
3. Privilege in internal investigations: protecting your communications
4. Self-reporting and cooperating with UK authorities: risks and rewards
5. The role of the board during a corporate investigation

The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Gherson accepts no responsibility for loss which may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please do not hesitate to contact Gherson. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Gherson.

©Gherson 2026