The Serious Fraud Office can validly issue a section 2 notice with extraterritorial application. It can compel production of documents held extraterritorially by a UK company, or issue a notice to foreign companies in respect of documents held outside the UK if there is a “sufficient connection” between that company and the UK. The ruling comes at a time when the SFO is testing the limits of its powers to seek disclosure of documents. Although unsuccessful in SFO v ENRC when contesting the ambit of legal professional privilege, the SFO will be pleased with the outcome of this ruling on its extraterritorial reach: The Queen on the application of KBR Inc v The Director of the Serious Fraud Office [2018] EWHC 2368 (Admin), 6 September 2018.
The SFO can issue a notice requiring a person or entity under investigation or any other person to produce documents which appear to the SFO to relate to any matter relevant to the investigation.1 These are commonly called “section 2 notices”. Failure to comply with a section 2 notice without reasonable excuse is a criminal offence.
The territorial scope of this power has been unclear: does it extend to documents held by UK companies overseas (including on an overseas server)? Does the SFO have power to issue a section 2 notice to a foreign corporation that has no business presence in the UK?
These questions were answered in this case dealing with the validity of section 2 notices issued to:
− an English company: Kellogg Brown & Root Ltd (KBR Ltd): KBR Ltd carried out business in the UK. In February 2017, the SFO commenced a criminal investigation into KBR Ltd for suspected offences of bribery and corruption relating to the Unaoil scandal; and
− the US parent company: KBR Inc: the ultimate parent of a multinational group, including KBR Ltd, providing professional services and technologies. KBR Inc had no fixed place of business in the UK and did not independently carry on business in the UK; it only did so through its UK subsidiaries. KBR Inc was under investigation by the US Department of Justice and Securities and Exchange Commission for its dealings with Unaoil.
SFO seeks documents held both in and outside the UK
The SFO issued a section 2 notice to KBR Ltd in April 2017. Initially, the KBR Group expressed an intention to cooperate expansively in its response. It provided: (i) UK-based responsive documents already under KBR Ltd’s custody and control; (ii) documents located outside the UK and sent to KBR Ltd at KBR Inc's direction; and (iii) purely on a voluntary basis, documents which KBR Inc had previously disclosed to the DOJ and SEC.
However, the SFO became concerned that the KBR Group was drawing an inappropriate distinction between documents held by or under the control of KBR Ltd, and documents held outside the UK and beyond the control of KBR Ltd. It therefore issued a further, largely duplicative, section 2 notice in July 2017 (the July Notice) addressed directly to the US entity, KBR Inc.
The US entity, KBR Inc, challenged the lawfulness of the notice and refused to produce documents in response to it on the grounds that:
− the July Notice was ultra vires as it requested material held outside the UK from a foreign-incorporated company;
− it was an error of law for the SFO to exercise section 2 powers despite the power to seek Mutual Legal Assistance (MLA) from the US authorities; and
− the July Notice had not been effectively served on KBR Inc when it was handed to an officer of KBR Inc who had temporarily been present in the UK in order to, at the request of the SFO, attend a meeting with the SFO.
The court rejected all of these arguments and upheld the validity of the notice.
Section 2 notice capable of extending to documents held overseas by UK companies
There is a general principle that, absent contrary intention, statutes have only territorial (not extraterritorial) application: ie they are restricted in operation to the UK.
However, the court concluded that section 2 notices issued to UK companies had to have at least some extraterritorial reach. This was because it was “scarcely credible” that a UK-based company could refuse to provide documents solely because the documents were contained on a server abroad, as this would mean that a company could thwart an investigation by moving documents overseas. While section 2 had been drafted pre-internet, and had to be construed accordingly, the underlying policy behind section 2 was to prevent the “determination and ingenuity” of persons trying to obstruct investigations. Even in a pre-internet age, this would have required section 2 notices served on UK companies to have extraterritorial application.
Section 2 notice capable of extending to non-UK companies in respect of documents held outside the UK
There was no express statutory limitation on who could be a potential recipient of a section 2 notice. The court concluded that section 2 was directed at facilitating the investigation and prosecution of top end fraud, which by its nature would have an international dimension. While the international spread of documents has been amplified by technological developments since 1987, the court did not consider that an international dimension to such investigations was “unknown or not appreciated” when the Criminal Justice Act 1987 was drafted. Excluding any consideration of MLA, the court saw a “very real risk” that the section 2 power would be frustrated if the SFO was unable to seek documents located abroad from a foreign company. The court recognised the strong public interest in section 2 having an extraterritorial ambit, and concluded that section 2 notices could be validly issued to non-UK companies for documents held both in and outside of the UK.
Section 2 notice issued to non-UK company – must be a “sufficient connection” with the UK
The court applied a new limitation - a section 2 notice can only validly be given to a non-UK company in respect of documents held outside the UK where there is a “sufficient connection” between the company and the UK.
The court found a sufficient connection between KBR Inc and the UK for the July Notice to be valid. This was because the SFO's investigation focused on a large number of suspected corrupt payments made by KBR Inc's UK subsidiaries to Unaoil. The SFO had formed the view that those payments had required express approval by KBR Inc's US-based compliance function and were processed by KBR Inc's US-based treasury function. Further support arose from the fact that a corporate officer of KBR Inc was based in the group’s UK office and appeared to carry out his functions from the UK.
The following factors, said the court, would not, without more, amount to a “sufficient connection” between a non-UK company and the UK:
− the non-UK company is the parent company of a company under UK investigation;
− the non-UK parent company cooperates to a degree with the SFO's request for documents and remains willing to do so voluntarily; or
− a senior officer of the non-UK parent company attends an in-person meeting with the SFO.
Mutual Legal Assistance (MLA) regime curtailed?
The court found that the MLA regime provides an additional, alternative route to obtain documents for the SFO: but its availability does not affect the lawfulness of the SFO's decision to issue a section 2 notice to a non-UK company with sufficient connection to the UK. Even when there is an available MLA regime, there may be good practical reasons for the SFO to proceed with a section 2 notice (as it had in this case). The SFO has recently used the MLA regime to try to obtain documents in Monaco.
How is a section 2 notice served on a non-UK company?
A section 2 notice should be given to a person within the jurisdiction: there is no additional formality or traditional “service” required beyond the giving of the notice.
In this case, the July Notice was handed to an officer of KBR Inc voluntarily attending a meeting in the UK with the SFO, at the SFO's request. The officer was present in the UK for the purpose of representing KBR Inc, which was sufficient to establish KBR Inc was present in the jurisdiction at the time it (through its officer) was given the July Notice. Whilst the court found it unappealing that the SFO insisted on a KBR Inc representative attending the meeting with the intention to serve the July Notice, this did not affect its validity.
Safeguards/defences
The court pointed to statutory “safeguards” in place in the CJA: the SFO must decide whether to exercise the power to issue a section 2 notice, the issue of such a notice is subject to judicial review and a person may rely on a statutory defence of reasonable excuse if they do not comply. However, it is unclear what the practical value of these safeguards and defences would be to a foreign company facing a potential fishing expedition. The English court has traditionally been reluctant to interfere, by way of judicial review, with the SFO’s decision-making powers, for example the 2016 failed attempt, via judicial review, by Soma Oil to stop an SFO investigation.
Comment
While the court was careful to note that it was not engaging in “impermissible judicial legislation”, it is difficult to conclude that the decision involves anything else. The CJA imposes criminal penalties for failure to comply with a section 2 notice, which would not usually align with an extraterritorial reach without specific extraterritorial statutory provision (as in, for example, the Bribery Act 2010).
There is no suggestion in the CJA of the “sufficient connection” test, and in other similar contexts (for example, the Proceeds of Crime Act 2002), the Supreme Court has limited disclosure orders to having jurisdictional reach only. While similar tests have been generated in the insolvency context, the statutory safeguards surrounding exercise of such powers are quite different to those involved in questioning the SFO's power to issue a section 2 notice, which are limited to very narrow grounds.
The “sufficient connection” test for when a non-UK company may be issued with a section 2 notice involves considering the factual connection of the company to the UK, not in terms of (as might be expected) the strength of the business connections to the UK or storage of documents here, but rather its connection to the subject matter of the SFO's investigation (in this case, it was the US company’s role in the UK company making improper payments). As such, it is unclear what can be done by a non-UK company to insulate itself from the reach of a section 2 notice, barring avoiding receipt of such a notice by refraining from its officers entering the UK.
The court did not consider the practicalities of a non-UK company complying with a request for documents. For example, there was no discussion regarding data protection or other overseas laws or arrangements which may restrict a company’s ability to comply, and the invidious position a non-UK company may then be put in of facing competing criminal or civil liability (a difficulty which may be overcome through appropriate use of the protections built into the MLA regimes). The practical ability of the SFO to enforce such a notice against a non-UK company without any UK presence may also be called into question, in particular where a foreign company may face domestic blocking statutes or other compelling local law prohibitions against compliance with a UK section 2 notice.
A strong pointer that the legislature itself views the SFO's section 2 power as not being intended for extraterritorial use is the proposed introduction of a new UK law that will allow law enforcement agencies (including the SFO) to apply for a UK court order to get stored electronic data directly from a company or person based outside the UK. The Crime (Overseas Production Orders) Bill 2018 contains specific safeguards surrounding the extraterritorial use of production powers. The need for additional UK legislation governing extraterritorial production orders is consistent with the international approach taken in such cases. The Microsoft case in the US (in which the US government sought to compel Microsoft to disclose information stored on servers abroad) was based on unclear drafting in the U.S. Stored Communications Act. To clarify this ambiguity, the U.S. Clarifying Lawful Overseas Use of Data Act (the CLOUD Act) was passed. The CLOUD Act amends the SCA expressly to require a provider to provide data within its “possession, custody, or control, regardless of whether [such data] is located within or outside the United States”.
While the Court did not consider that extending the jurisdiction of the SFO to issue section 2 notices extraterritorially would “raise eyebrows” in this case, it certainly does raise questions about international co-operation and comity, and (if the decision stands) the on-going use of MLA procedures by the SFO in the UK.
Footnote:
1 Section 2 Criminal Justice Act 1987.
