Regulatory Investigations

Regulatory investigations can arise when a business, organisation, director, employee or professional is suspected of failing to comply with legal or regulatory requirements.

Investigations may be conducted by national regulators, local authorities, professional bodies or specialist enforcement agencies. The investigator's powers and the possible consequences will depend on the industry, the legislation involved and whether the matter is being treated as a civil, disciplinary or criminal investigation.

A regulatory investigations solicitor can advise from the first request for information or inspection through to interviews, enforcement notices, disciplinary hearings, appeals and criminal proceedings.

Early legal advice can be particularly important because documents, statements and explanations provided during the initial stages may later be used when deciding whether to impose a penalty, suspend a licence or commence a prosecution.

Who May Carry Out a Regulatory Investigation?

Regulatory investigations may be conducted by organisations including:

• the Financial Conduct Authority;
• the Health and Safety Executive;
• the Environment Agency or Natural Resources Wales;
• the Information Commissioner’s Office;
• the Competition and Markets Authority;
• the Office for Product Safety and Standards;
• the Food Standards Agency and local food authorities;
• HM Revenue and Customs;
• the Care Quality Commission or Care Inspectorate Wales;
• Ofsted or Estyn;
• the Gambling Commission;
• the Security Industry Authority;
• local authority trading standards departments;
• environmental health departments;
• fire and rescue authorities;
• licensing authorities;
• professional regulators; and
• other bodies responsible for enforcing industry-specific legislation.

Some regulators can impose civil or administrative penalties directly. Others may issue enforcement notices, suspend permissions, refer matters to another agency or prosecute criminal offences.

Why Do Regulatory Investigations Begin?

An investigation may begin following:

• a workplace accident or fatality;
• a customer or employee complaint;
• a data breach or cyber incident;
• a report from a whistleblower;
• a routine inspection or audit;
• an allegation of misleading sales or advertising;
• a defective or unsafe product;
• suspected financial misconduct;
• environmental pollution;
• a food safety incident;
• breach of a licence or permit;
• information supplied by another regulator;
• an internal report made by the organisation;
• a referral from the police; or
• information obtained through market monitoring or data analysis.

The fact that an investigation has begun does not necessarily mean that an offence or regulatory breach has occurred. The purpose of the investigation is usually to establish the facts and decide whether further action is justified.

Responding to Initial Contact from a Regulator

A regulator may first make contact by letter, email, telephone call or an unannounced visit. The communication may request documents, answers to questions, access to premises or attendance at an interview.

Before responding, it is important to establish:

• which regulator is involved;
• the legal basis of the investigation;
• whether compliance with the request is compulsory;
• the deadline for responding;
• whether criminal offences are being considered;
• which individuals or legal entities are under investigation;
• whether documents are legally privileged;
• whether insurers must be notified; and
• whether a response could expose another person or company to liability.

A business should not ignore a lawful request. However, it should not provide an unverified or unnecessarily wide response without understanding the regulator's powers and the consequences.

Inspections and Visits to Business Premises

Regulators may have statutory powers to enter and inspect business premises. Depending on the legislation, an inspector may be able to:

• enter at a reasonable time;
• inspect the premises, equipment or working practices;
• take photographs, measurements or samples;
• copy or seize documents;
• examine computer records;
• require equipment to be tested or left undisturbed;
• question employees or managers;
• require assistance or information; and
• remove items for examination.

The extent of the powers varies between regulators. Entry into residential premises may require consent or a warrant, while some business premises can be entered without advance notice.

Staff should be trained to:

• check the investigator's identification;
• ask which statutory power is being exercised;
• contact the appropriate manager and solicitor;
• avoid obstructing the inspection;
• keep a record of documents and items taken;
• retain copies where permitted;
• record questions and answers accurately; and
• avoid speculation or informal admissions.

Dawn Raids and Search Warrants

Some regulatory and criminal investigations involve an unannounced search, often described as a dawn raid. Investigators may attend with a warrant authorising them to enter premises and search for specified material.

A solicitor can check:

• the identity of the investigating body;
• the premises and persons covered by the warrant;
• the offences under investigation;
• the scope and duration of the search;
• what documents or electronic material may be seized;
• whether legally privileged material is protected; and
• whether the investigators are acting within their authority.

The subject of a search should not obstruct investigators or destroy, conceal or alter evidence. Concerns about the legality or scope of the search should be recorded and challenged through the proper legal procedure.

Preserving evidence

Once an investigation is anticipated, relevant material should be preserved. This may include:

• emails and messages;
• contracts and policies;
• risk assessments;
• training records;
• maintenance and inspection records;
• CCTV footage;
• telephone recordings;
• financial records;
• customer files;
• computer logs and metadata;
• personnel records; and
• internal investigation documents.

Ordinary deletion or document-destruction processes may need to be suspended. Destroying or altering relevant evidence can create separate criminal, regulatory and procedural consequences.

The organisation should identify who holds relevant information and issue clear instructions to ensure its preservation.

Requests for Information and Documents

Regulators may issue statutory notices requiring the supply of information or documents.

Failure to comply with a valid notice may be an offence or lead to enforcement action.

A solicitor can advise on:

• whether the notice is valid;
• the information that must be provided;
• whether the request is unreasonably wide;
• the treatment of confidential information;
• data protection obligations;
• legal professional privilege;
• the deadline for compliance;
• applications for additional time; and
• the risks of providing false or misleading information.

Responses should be accurate and complete within the scope of the requirement. The organisation should retain a copy of everything supplied and a record explaining how documents were collected.

Legal Professional Privilege

Some confidential communications between a client and legal adviser may be protected by legal professional privilege.

Privilege may apply to:

• confidential communications seeking or giving legal advice;
• documents created for the dominant purpose of existing or reasonably contemplated litigation; and
• certain communications involving experts and witnesses in connection with litigation.

Privilege does not protect an underlying fact merely because it has been discussed with a solicitor. It also does not protect communications made for a criminal or fraudulent purpose.

Privilege can be lost through accidental or deliberate disclosure. Documents should therefore be reviewed before they are supplied to a regulator.

Internal Investigations

A business may conduct an internal investigation after discovering a possible regulatory breach or receiving a complaint.

An internal investigation can help the organisation:

• establish what happened;
• identify the people and systems involved;
• preserve evidence;
• assess whether a regulator must be notified;
• correct ongoing risks;
• consider disciplinary action;
• respond accurately to the regulator; and
• demonstrate cooperation and remediation.

The investigation should have a clear scope and reporting structure. Careful consideration should be given to privilege, employment rights, data protection, whistleblower protection and the possibility of parallel criminal proceedings.

A poorly managed internal investigation can contaminate evidence, create inconsistent accounts or generate documents that are later disclosable.

Interviews under Caution

A regulator may invite or require an individual to attend an interview under caution where there are grounds to suspect that they have committed an offence.

The caution is used because answers, or a failure to mention matters later relied upon, may have evidential consequences in criminal proceedings.

An interview may concern:

• an individual employee or director;
• a sole trader;
• a company or other organisation as a suspected legal person; or
• more than one potentially responsible party.

A person invited to an interview under caution should obtain legal advice before agreeing to attend or submitting a written response.

Preparing for an Interview

A solicitor can:

• obtain information about the alleged offence;
• request disclosure of the evidence or interview topics;
• advise whether attendance is compulsory;
• review relevant documents;
• identify conflicts between individuals and the organisation;
• advise on the right to silence;
• prepare a written statement where appropriate;
• attend the interview; and
• challenge improper or misleading questions.

The company's solicitor may not be able to represent both the company and an employee or director where their interests conflict. Separate legal representation may be necessary.

Witness Interviews

A regulator may also interview a person as a witness rather than a suspect. A witness may be asked to provide a signed statement or answer questions under a statutory power.

Witnesses should provide truthful and accurate information. However, they should understand:

• whether attendance is voluntary or compulsory;
• whether the statement may be disclosed;
• whether they may become a suspect;
• whether they are entitled to legal representation; and
• whether confidentiality or employment issues arise.

If questioning begins to suggest personal responsibility for an offence, the interview should not simply continue as an informal witness discussion without considering the person's rights.

Parallel Investigations

A single incident may lead to several investigations simultaneously.

For example, a workplace fatality might involve:

• the police;
• the Health and Safety Executive or local authority;
• a coroner;
• an employer’s internal investigation;
• an insurer;
• a professional regulator;
• a civil compensation claim; and
• employment or disciplinary proceedings.

Similarly, a financial or data incident may involve the FCA, ICO, police, auditors and overseas regulators.

Statements made in one process may affect another. A coordinated legal strategy is therefore required to manage disclosure, privilege, interviews, public statements and reporting obligations.

Regulatory Notices

Regulators may issue notices requiring action to address an actual or suspected breach.

Depending on the legislation, these may include:

• improvement notices;
• prohibition notices;
• compliance notices;
• stop notices;
• information notices;
• product recall or withdrawal notices;
• suspension notices;
• remediation notices;
• enforcement notices; and
• licence or permit conditions.

Improvement and Compliance Notices

An improvement or compliance notice may require specified steps to be completed within a stated period.

The recipient should consider:

• whether the alleged breach is correctly identified;
• whether the regulator has jurisdiction;
• whether the required work is clear and achievable;
• whether the compliance period is reasonable;
• whether compliance would amount to an admission;
• whether an appeal suspends the notice; and
• the consequences of failing to comply.

Prohibition and Stop Notices

A prohibition or stop notice may prevent a business from carrying out a particular activity where the regulator considers that there is a serious or immediate risk.

These notices can have an immediate effect on trading. Urgent advice may be required about compliance, appeal rights, alternative operating arrangements and communications with customers or employees.

Possible Outcomes of a Regulatory Investigation

An investigation may result in:

• no further action;
• informal advice or a warning;
• a requirement to improve policies or systems;
• an enforcement notice;
• a voluntary undertaking;
• an enforcement undertaking;
• a fixed or variable monetary penalty;
• repayment or redress to customers;
• licence restrictions;
• suspension or revocation of a licence;
• professional disciplinary action;
• director disqualification proceedings;
• public censure;
• criminal prosecution; or
• referral to another regulator or enforcement agency.

The available sanctions vary considerably. The Regulatory Enforcement and Sanctions Act 2008 permits specified regulators to use certain civil sanctions where the necessary statutory powers have been conferred.

Enforcement Undertakings

Some regulators may accept an enforcement undertaking instead of another form of enforcement action.

An undertaking may require the organisation to:

• stop the non-compliant activity;
• remedy the consequences;
• compensate affected people;
• improve systems or staff training;
• fund environmental or community projects;
• appoint independent auditors; or
• report on future compliance.

An enforcement undertaking is not an informal promise. Its terms should be achievable, properly costed and carefully drafted.

A regulator is not obliged to accept an undertaking, particularly where the breach is deliberate, serious or repeated.

Regulatory Prosecutions

Some regulators can prosecute offences directly, while others refer cases to the Crown Prosecution Service or another prosecuting authority.

Proceedings may be brought against:

• a company;
• a partnership;
• a sole trader;
• a director or senior manager;
• an employee;
• a professional; or
• more than one defendant.

Directors, managers and officers may face personal liability where legislation provides for prosecution based on consent, connivance, neglect or personal participation.

Defending a Regulatory Prosecution

A regulatory solicitor can examine:

• whether the prosecution was brought within the relevant time limit;
• whether the regulator has proved each element of the offence;
• whether the defendant had the required knowledge or intention;
• whether reasonable precautions or due diligence were exercised;
• whether another statutory defence applies;
• the validity of notices and evidence;
• the lawfulness of searches and interviews;
• expert evidence;
• disclosure failures; and
• the responsibility of other parties.

Some regulatory offences impose strict or near-strict liability, meaning that the prosecution may not need to prove dishonesty or deliberate wrongdoing. The precise wording of the offence must be considered.

Sentencing and Financial Penalties

Regulatory offences can result in substantial fines. In serious cases, individuals may face imprisonment, disqualification or restrictions on future professional or business activity.

When determining a penalty, a court or regulator may consider:

• the seriousness and duration of the breach;
• actual or potential harm;
• whether the conduct was deliberate or reckless;
• financial benefit obtained;
• the size and resources of the organisation;
• previous regulatory history;
• cooperation with the investigation;
• steps taken to remedy the breach;
• early admissions; and
• the need for deterrence.

A business should not assume that cooperation requires it to accept an inaccurate allegation or waive its legal rights.

Challenging Regulatory Decisions

The route for challenging a regulatory decision depends on the legislation and the decision-maker.

Possible routes include:

• making written representations;
• requesting an internal review;
• appealing to a tribunal;
• appealing to the magistrates’ court or Crown Court;
• appealing to a specialist disciplinary panel;
• applying for judicial review; and
• appealing a criminal conviction or sentence.

Deadlines may be very short. The decision or notice should be reviewed immediately to determine:

• the deadline for challenge;
• whether the decision remains effective during the appeal;
• the evidence that may be submitted;
• the tribunal or court's powers;
• the costs risk; and
• whether an urgent suspension or interim order is available.

Judicial Review

Judicial review may be available where a regulator has acted unlawfully, unfairly, irrationally or outside its statutory powers.

Possible grounds may include:

• failure to follow a required procedure;
• reliance on irrelevant considerations;
• failure to consider relevant evidence;
• apparent bias;
• inadequate reasons;
• disproportionate action;
• breach of legitimate expectation; and
• incompatibility with human rights.

Judicial review is usually a remedy of last resort where no adequate statutory appeal is available. Claims must be brought promptly and within the applicable maximum period.

Professional Disciplinary Investigations

Professionals may face investigations by bodies that regulate their qualifications, conduct, or right to practise.

These may include investigations involving:

• solicitors and barristers;
• doctors, nurses and other healthcare professionals;
• accountants and auditors;
• architects and surveyors;
• teachers and social workers;
• financial services professionals;
• pharmacists and dental professionals; and
• other regulated occupations.

Possible outcomes include a warning, conditions on practice, suspension, financial penalty or removal from the professional register.

A professional may face an employer investigation, criminal proceedings and a regulatory case arising from the same incident. Each process should be managed in relation to the others.

Health and Safety Investigations

Health and safety investigations may follow an accident, a dangerous occurrence, an occupational illness, or a complaint about working conditions.

A solicitor can assist with:

• HSE or local authority inspections;
• improvement and prohibition notices;
• interviews under caution;
• fatal accident investigations;
• inquests;
• corporate manslaughter investigations;
• prosecutions of companies and individuals;
• appeals against notices; and
• sentencing and mitigation.

Businesses should preserve risk assessments, training records, maintenance documents, inspection records, and evidence of the systems in place before the incident.

Financial Services Investigations

The Financial Conduct Authority can investigate regulated and unregulated firms and individuals where it suspects serious misconduct or breaches within its jurisdiction.

Investigations may concern:

• misleading sales practices;
• market abuse or insider dealing;
• financial crime controls;
• anti-money laundering failures;
• consumer redress;
• client money;
• systems and controls;
• individual conduct and responsibility;
• unauthorised regulated activity; and
• false or misleading information supplied to the FCA.

Possible outcomes include no action, supervisory measures, financial penalties, public censure, restrictions, prohibition of individuals, withdrawal of authorisation, civil proceedings or criminal prosecution.

Environmental Investigations

Environmental investigations may concern pollution, waste, water, emissions, permits, protected habitats or damage to the natural environment.

The Environment Agency and Natural Resources Wales may use criminal prosecution, civil penalties and enforcement undertakings, depending on the offence and circumstances.

A solicitor may advise on:

• site inspections;
• pollution incidents;
• waste offences;
• permit breaches;
• remediation notices;
• interviews under caution;
• enforcement undertakings;
• civil sanctions;
• prosecutions; and
• claims for the cost of clean-up or restoration.

Product Safety and Trading Standards Investigations

Trading standards departments and the Office for Product Safety and Standards may investigate unsafe products, misleading commercial practices, inaccurate descriptions and other consumer-protection breaches.

Action may include:

• requests for technical files and test reports;
• product testing;
• withdrawal or recall requirements;
• compliance notices;
• seizure of goods;
• online marketplace restrictions;
• financial penalties;
• enforcement undertakings; and
• criminal prosecution.

Manufacturers, importers, distributors and retailers may each have separate legal responsibilities.

Data Protection Investigations

The Information Commissioner's Office may investigate organisations following a data breach, complaint or concern about the use of personal information.

An investigation may examine:

• lawful use of personal data;
• data security;
• transparency and privacy information;
• direct marketing;
• subject access requests;
• retention and deletion;
• international transfers;
• automated decision-making;
• processor contracts; and
• breach reporting.

Possible outcomes include advice, reprimands, enforcement notices, restrictions on processing and financial penalties.

Publicity and Reputation Management

A regulatory investigation can damage confidence among customers, employees, investors, insurers and commercial partners even before any formal finding is made.

Organisations should coordinate legal and communications advice when responding publicly.

Statements should be:

• accurate;
• consistent with the known evidence;
• careful not to prejudice proceedings;
• respectful of confidentiality and data protection;
• consistent with stock market or contractual reporting duties; and
• reviewed as the investigation develops.

Not every investigation will be publicised. The approach differs among regulators and may depend on the seriousness of the matter, the public interest, and the stage reached.

Self-Reporting and Cooperation

Some regulated businesses and professionals have duties to notify their regulator of specified events, breaches, or concerns.

Before making a report, the organisation should establish:

• whether notification is mandatory;
• which regulator or authority must be informed;
• the reporting deadline;
• what facts have been verified;
• whether further reports will be required;
• whether insurers, customers or other parties must also be notified; and
• how to avoid making inaccurate or misleading statements.

Prompt self-reporting, cooperation and effective remedial action may affect the regulator's assessment. However, cooperation should be managed carefully and does not require a person to abandon privilege or admit allegations that have not been established.

How a Regulatory Investigations Solicitor Can Help

A regulatory solicitor may assist with:

• responding to initial enquiries and information notices;
• advising during inspections and dawn raids;
• preserving and reviewing evidence;
• conducting privileged internal investigations;
• responding to compulsory document requests;
• preparing for interviews under caution;
• representing companies, directors and employees at interviews;
• advising on conflicts of interest;
• challenging improvement, prohibition or enforcement notices;
• negotiating with regulators;
• preparing enforcement undertakings;
• responding to proposed financial penalties;
• professional disciplinary proceedings;
• regulatory appeals;
• judicial review;
• criminal prosecutions;
• sentencing and mitigation; and
• managing related civil, employment and reputational issues.

Finding a Regulatory Investigations Solicitor

Regulatory investigations can progress quickly and may expose both organisations and individuals to serious financial, professional and criminal consequences. Obtaining advice at an early stage can help preserve evidence, protect legal privilege and ensure that responses to the regulator are accurate and properly considered.

You may wish to refine your search to find Regulatory Investigations Solicitors in your area. Select Regulatory Investigations from the area-of-law drop-down menu, then enter your town, city, or postcode.

This guide provides general information about regulatory investigations in England and Wales. It does not constitute legal advice and should not be relied upon as a substitute for advice about a particular investigation, notice or enforcement action.