Westminster Policy News & Legislative Analysis

SFO Interim Director Graham McNulty sets 2026 enforcement agenda

Serious Fraud Office Interim Director Graham McNulty used a speech at the Global Anti-Corruption, Ethics and Compliance Conference in New York on 3 June 2026 to describe a more interventionist model for UK economic crime enforcement. In text published by the SFO on GOV.UK, he organised the agency's programme around three linked claims: that the SFO wants to be a credible partner for responsible corporates, a more active enforcer, and a stronger participant in cross-border justice. For policy, legal and compliance teams, the speech is notable because it brings several recent developments into one framework. The revised corporate co-operation guidance, the Deferred Prosecution Agreement with Ultra Electronics, planned expansion of intelligence and surveillance work, and the use of powers under the Economic Crime and Corporate Transparency Act were presented as parts of the same enforcement strategy.

The clearest message for companies was that self-reporting remains the SFO's preferred route for resolving corporate misconduct, but only where co-operation is complete and sustained. McNulty used the Ultra Electronics agreement to show both sides of that position. The company accepted responsibility for failure to prevent bribery linked to three public sector contracts obtained through agents, and under the agreement is due to pay a £10 million financial penalty alongside £4.8 million in SFO costs. The history of that case is central to the point the SFO wanted to make. According to McNulty's account, the investigation began with a self-report in 2018 and the company was invited into DPA discussions in 2021. Those talks were later halted after further information emerged about conduct in Oman and the SFO decided that the conditions for a meaningful agreement were no longer met. Negotiations resumed only after changes in ownership, structure and leadership, and McNulty said the final agreement was then reached within eight months. The practical signal is that a self-report may open the door to a DPA, but it does not protect a company that provides incomplete or contested information.

That position now sits alongside a more explicit offer in the SFO's revised corporate co-operation guidance. McNulty said the guidance is intended to give advisers greater certainty when deciding whether to report wrongdoing. Where a company self-reports promptly and co-operates fully, the SFO says it will ordinarily invite the company to negotiate a DPA unless exceptional circumstances apply. Just as important are the time commitments attached to that offer. The guidance promises contact within 48 business hours of a self-report, regular updates, a decision within six months on whether to open an investigation, and a target of concluding DPA negotiations within six months of an invitation. For boards and general counsel, that does not remove legal risk, judicial scrutiny or the possibility of prosecution. It does, however, create a clearer timetable and a stronger incentive to report early rather than wait for external detection.

McNulty paired that co-operative route with a direct warning that the SFO intends to become less reliant on referrals. He said ministers have backed the agency with multi-million pound investment in intelligence capabilities and that the SFO is building an enterprise intelligence system to aggregate information from different sources and connect it with a new case management platform. The policy aim is straightforward: identify misconduct earlier, intervene before assets dissipate, and generate more investigations from intelligence rather than from corporate self-reporting alone. The speech sought to show that this shift is already being operationalised. McNulty pointed to recent dawn raids, four arrests and searches at six premises as part of an investigation into alleged fraud involving companies linked to a government energy efficiency scheme. He also referred to the impending sentencing of three individuals convicted earlier in 2026 for fraudulent trading in a £70 million investment scheme. Taken together, those references were designed to support the claim that the SFO wants to be judged not only by negotiated settlements but by executive action and trial outcomes.

A second strand of the speech concerned the SFO's willingness to use more intrusive investigative tools. McNulty argued that complex economic crime has too often been treated with a degree of deference that would not be extended to other offending, and said the agency is determined to make fuller use of surveillance in partnership with other law enforcement bodies. He also said he is working with government on changes that would make the use of those powers quicker and more operationally effective. That matters because surveillance and human intelligence are being presented as part of the same enforcement model. McNulty openly backed a whistleblower incentivisation scheme for the SFO and said insider reporting can sharply reduce the time and scope of an investigation by identifying what happened, who was involved and where evidence is likely to sit. He cited a striking comparison: more than 700 UK nationals used US whistleblower incentive programmes between 2012 and 2023, making UK reporters the second largest group in those schemes. The argument is not simply that rewards may generate more tips, but that the UK is currently losing intelligence to systems elsewhere.

The legislative backdrop is the Economic Crime and Corporate Transparency Act, which McNulty described as materially widening the SFO's enforcement reach. He focused on two changes with direct corporate consequences. The first is the failure to prevent fraud offence, under which a large organisation can be criminally liable where an associated person commits fraud intended to benefit the organisation, including conduct overseas where there is a UK nexus. The second is the senior manager attribution test, which lowers the threshold for fixing corporate liability where wrongdoing can be linked to senior personnel. For compliance professionals, the significance is practical rather than abstract. The speech framed the new law not only as a prosecution tool but as a prevention tool intended to change internal controls, governance and organisational culture. Large firms with UK exposure therefore face a narrower margin for arguing that misconduct was isolated or too remote from management. In policy terms, the SFO is signalling that the Act should alter behaviour before a case reaches court, not merely increase penalties afterwards.

The third pillar was international enforcement. McNulty described overseas co-operation as routine rather than exceptional in serious fraud and bribery cases, and emphasised the SFO's working relationships with the US Department of Justice, the FBI and other American agencies. He also highlighted the anti-corruption prosecutorial taskforce established with France's Parquet National Financier and the Swiss Office of the Attorney General, presenting it as a move beyond ad hoc case collaboration towards more systematic co-ordination. He used the AOG Technics case as a practical example of why that matters. The company was convicted at the end of 2025 after an investigation into falsified documentation relating to more than 60,000 aircraft parts, conduct that led aviation authorities to issue safety alerts and caused hundreds of aircraft to be grounded. McNulty said the case relied on a Joint Investigation Team with Portugal and rapid assistance from French authorities. The broader point was that the SFO sees cross-border evidence gathering, arrest activity and charging decisions as normal conditions of modern enforcement, not special cases.

The speech does not remove the structural difficulties McNulty also acknowledged, including the scale of disclosure in SFO cases, the cost of contesting multinational defendants and the slower pace of UK procedure compared with some US outcomes. Those constraints remain important when judging how quickly the new programme can be delivered. Even so, the direction of travel was clear. The SFO is asking responsible companies to self-report sooner, while also warning that intelligence development, surveillance and whistleblower reform are intended to make non-disclosure riskier. For advisers, the policy position is now harder to misread. The SFO wants co-operation to be measurable, timetabled and rewarded, but it is also preparing for a model in which the agency uncovers more conduct without waiting to be approached. That combination, together with the corporate liability changes introduced by the Economic Crime and Corporate Transparency Act, points to a more assertive enforcement environment for UK-linked companies operating across multiple jurisdictions.