This shift to a focus on fraud accelerated under Nick Ephgrave, whose tenure as Director from September 2023 to March 2026 was marked by a drive for faster casework, increased focus on domestic enforcement, prioritising investment in technology, and closer agency collaboration.

The trade-off is disclosure. The collapse of the decade-long London Mining prosecution in February 2026, following failures in the SFO’s legacy e-discovery software, exposed a central tension: although the SFO is seeking to move faster, its disclosure infrastructure cannot always keep pace. For businesses and individuals under investigation, 2027 may therefore expose tensions between the SFO’s desire to make faster charging decisions and its difficulties when handling disclosure leading to a more challenging cooperation landscape.

This alert analyses the shifting trends in SFO investigations by looking back on the past decade, and then turns to assessing likely areas of focus, change, and priority in 2027.

A decade of shifting priorities: SFO enforcement since 2015

The shift from international corruption to domestic fraud

The public case data shows a clear reorientation in priorities from international corruption to domestic fraud. Between 2015 and 2019, only 30% of new SFO investigations concerned purely domestic conduct; the balance was dominated by international bribery and corruption. Between 2021 and 2024, that position reversed: 82% of new cases were domestic fraud matters. In 2025–2026, the domestic proportion remains significant at approximately 57%, reflecting a more balanced but still UK-centred pipeline.

New SFO Investigations by Year — Domestic vs. Overseas

* 2026 data as of September 2026.

Ephgrave’s 5-year strategy

Ephgrave’s 2024–2029 strategy focused on workforce specialisation, efficiencies by embracing new technologies, intelligence-led enforcement and prevention, and a more proactive role in the domestic and global justice system. By the time he stepped down in 2026, it was a fair assessment to conclude there was some progress but unfinished business.

Delivered: Faster paced, domestically focussed investigations

The clearest operational change was speed. Recent domestic cases moved materially faster than historic cross-border investigations, including Axiom Ince (approximately 13–15 months to charge), AOG Technics (approximately 18 months to charge and two years to guilty plea), and Safe Hands (approximately 27 months to charge). The SFO also charged 16 defendants on 43 counts, announced 10 overt investigations, and arrested or questioned 22 individuals during Ephgrave’s short tenure.

What Remains Unresolved

Now, nearly halfway through the 5-year plan, the following three key areas require further attention:

• Pressure test the new failure to prevent fraud offence: No named investigation, charge, or conviction has yet been publicly announced, although first public use of the offence is highly anticipated and will be closely watched and scrutinised.
• Whistleblower incentivisation: Ephgrave publicly advocated paying whistleblowers, but no legislative change or formal scheme was implemented before his departure.
• Restore integrity and trust in SFO disclosures: The London Mining collapse exposed the operational challenges created by legacy e-discovery systems and has led to the SFO reviewing other cases potentially affected by the same issues. Separately, the legacy of the ENRC litigation continues to cast a shadow over the SFO's institutional credibility and underscores the need for demonstrable improvements in internal governance alongside disclosure infrastructure. A need to embrace advancing technologies is particularly acute here; which will go some way to restoring trust and integrity in the SFO’s disclosure process.

As noted above, the London Mining collapse revealed that the SFO’s legacy e-discovery software failed to identify and produce relevant material — a fundamental obligation on the prosecution. For defendants and corporates considering cooperation, these disclosure vulnerabilities may affect case strategy, trial readiness, and self-reporting decisions. Practically, it may support earlier requests for assurance on how the SFO is handling data, which disclosure systems are being used, whether material is being migrated between legacy and new platforms, and what quality-control measures are in place to ensure the scope of material reviewed is complete and reliable.

The outlook for 2027

The Failure to Prevent Fraud Offence

As introduced above, the failure to prevent fraud offence under ECCTA holds large organisations criminally liable where an associated person commits fraud to benefit the organisation without reasonable prevention procedures in place. The offence will continue to be one of the most highly anticipated enforcement developments for corporates in 2027. Although no public prosecution materialised during Ephgrave’s tenure, first investigations under the offence have reportedly begun. The first named investigation, charge, deferred prosecution agreement negotiation, or formal prosecutorial guidance is likely to give practical content to the statutory requirement for “reasonable procedures” and will likely become an important benchmark for corporate fraud controls.

Continued Domestic Fraud Focus

The pivot towards domestic enforcement is unlikely to reverse. The current pipeline remains weighted toward UK-centred matters, including public-sector and procurement fraud, green-energy subsidy fraud, property-investment fraud and consumer-facing schemes. For companies in regulated or publicly funded sectors, SFO risk is no longer confined to overseas bribery red flags.

International Corruption - Fewer but More Targeted

International corruption will not disappear, but the likely direction is fewer, more targeted matters with earlier cross-border coordination. At least four of the current 29 cases involve parallel foreign investigations, and the broader enforcement environment is also tightening, with the FCA, HMRC, CMA and Government’s Fraud Strategy all pointing toward greater data-led enforcement and private-sector responsibility. Meanwhile, signals from the US suggest that FCPA investigations and prosecutions are once again becoming a priority for the DOJ and SEC, which may increase pressure on UK-linked conduct even where the SFO’s own international caseload contracts.

Leadership and Technology

The appointment of a permanent SFO Director will be an important signal of enforcement priorities. Continuity would suggest sustained emphasis on domestic fraud, faster casework and technology-led investigations; recalibration could shift resources toward larger cross-border corruption work or institutional remediation. Either way, the incoming Director will inherit the task of restoring confidence in disclosure while maintaining investigative momentum.

Wildcard - Crypto-Asset Enforcement

The SFO has quietly built crypto-asset tracing and freezing capabilities over the past two years — demonstrated by the Arena Television Crypto Wallet Freezing Order in July 2025, the first use of ECCTA powers to restrain digital assets. Whilst none of the current 29 cases is primarily a cryptocurrency fraud, and no headline crypto prosecution is visibly imminent, if a major crypto fraud with a UK nexus emerges, the SFO now has tools it did not possess three years ago. For compliance teams, the practical implication is limited: crypto-specific controls are not yet an SFO enforcement priority. For businesses already operating in the digital-asset space, however, the capability exists — and 2027 could be the year it is tested.

Key Takeaways

• Speed is now part of the SFO’s enforcement model—but disclosure is the constraint. Faster casework will be sustainable only if the SFO’s disclosure processes and procedures are actually and perceptibly reliable and defensible.
• Corporate fraud risk is increasingly domestic. The SFO’s centre of gravity has shifted toward UK-centred fraud, including procurement, subsidy, property-investment and consumer-facing matters.
• The first failure-to-prevent fraud case will set the market standard. Boards should test whether their fraud controls would withstand scrutiny as “reasonable procedures”.
• 2027 may be a decision year. Companies in active SFO sectors should assume shorter windows for fact-finding, privilege analysis, remediation and engagement.

Practical Implications for Compliance Programs

• Refresh fraud prevention procedures against the failure to prevent fraud guidance, including associated-person risk, escalation routes and board oversight.
• Stress-test investigation readiness for compressed timelines, including document preservation, privilege protocols and board reporting.
• Address disclosure risk early through clear data-handling, disclosure, migration and cooperation protocols.
• Reassess domestic fraud exposure in public procurement, green energy, property investment, consumer finance and investor-facing communications.

Sources

SFO, “Our casework” (public case register), available at https://www.sfo.gov.uk/our-casework/ (accessed September 2026).

SFO, “Strategy 2024–2029” (18 April 2024), available at https://www.sfo.gov.uk/publications/corporate-information/sfo-strategy-2024-2029/

Nick Ephgrave, “Opening speech at RUSI” (13 February 2024), available at https://www.sfo.gov.uk/2024/02/13/sfo-director-nick-ephgrave-opening-speech-at-rusi/

SFO, “SFO Director Nick Ephgrave retires” (press release, 27 January 2026), available at https://www.sfo.gov.uk/.

SFO, “Business Plan 2025–26” (2025) and “Business Plan 2026–27” (2026), available at https://www.sfo.gov.uk/publications/corporate-information/.

SFO, “Axiom Ince: Three charged” (press release, 19 December 2024); SFO, “AOG Technics: Guilty plea” (press release, 2025); SFO, “Safe Hands Plans: Charges” (press release, 2026), available at https://www.sfo.gov.uk/.

Hansard, House of Commons Debate on Serious Fraud Office (June 2025), available at https://hansard.parliament.uk/.

Economic Crime and Corporate Transparency Act 2023, s.199 (failure to prevent fraud offence, in force 1 September 2025).

R v London Mining Plc (Southwark Crown Court, February 2026) — prosecution discontinued following disclosure failures.

SFO, “Arena Television: Crypto Wallet Freezing Order” (July 2025), available at https://www.sfo.gov.uk/

SFO, “Graham McNulty appointed Interim Director” (press release, April 2026), available at https://www.sfo.gov.uk/

SFO, individual case pages for Rockfire (June 2025), Home REIT (January 2026), Warmfront/JJ Crump (April 2026), IMC (June 2026), Basis Markets (November 2025) and Carlauren (March 2024), available at https://www.sfo.gov.uk/our-casework/

SFO case pages for IMC (parallel New York DA investigation), Thales (French Parquet national financier), Blu-3/Mace (Monaco assistance) and Home REIT (Italian law enforcement assistance), available at https://www.sfo.gov.uk/our-casework/

HM Government, “Fraud Strategy 2026–2029” (2026); FCA, “Business Plan 2026/27” (2026); CMA, “Annual Plan 2026–27” (2026); HMRC, “Strengthened Reward Scheme for serious tax evasion” (December 2025).