How best to respond to the discovery of a fraud in a financial institution that has an exposure to the offshore world? Here we look at the most effective crisis management strategies, in particular the practical steps that trust and fiduciary service providers should take to limit the damage that a fraud can do to their clients' assets.

An organisation's usual response to the discovery of a fraud is to report it immediately to the authorities – perhaps the police, and thereafter a regulator, if necessary. Although this reaction to adversity is understandable, it is of vital importance that the organisation should consider its position properly before opting for this choice. According to my own experience, it is best for the stricken organisation to approach the authorities and regulators with the facts, but only after deciding on a considered, detailed strategy that can help it deal with the situation both at that time and in the foreseeable future. This gives the organisation a measure of control and maximises the chances of recovery whilst protecting its clients' assets.

If there is an offshore dimension to the fraud, it is likely that the cause of the fraud is in the offshore jurisdiction. However, insurers, regulators and the authorities are often prepared to allow an organisation greater discretion to undertake its investigation in circumstances where they are actively advised by London-based lawyers who can mobilise large teams without delay, allowing the organisation to retain control of the investigation and its strategy. Furthermore, it is usually wise to employ solicitors outside the offshore jurisdiction because an independent investigation can then take place without any plausible accusations of conflicts of interest. It also minimises the likelihood that someone will leak information.

This article is a rough-and-ready guide for any organisations in the offshore world that is faced with the discovery of a fraud.

When first fraud is discovered

A fraud at an organisation may well damage the morale of the staff and the organisation's financial standing very severely. It is also likely to attract media attention, which can quickly snowball into a threat to the reputation of the organisation as a whole and the trust it has built up among all the people who deal with it. In offshore jurisdictions concerning organisations that mainly manage and safeguard clients' funds, this is of particular concern. For regulated entities, the risk is of even greater significance. It is often fatal to the finances and reputation of any organisation to attract regulatory scrutiny and, potentially, fines.

Unfortunately, fraud occurs in all industries and sectors. Individuals of all backgrounds succumb to temptation and their greed leads them to chase after easy riches. Despite the fact that almost all organisations pursue policies and controls to prevent fraud occurring, this phenomenon still takes place on an unprecedented scale. Businesses ought to be realistic and pragmatic in their approach to responding to fraud.

Prevention is always the best cure, but fraud goes on. Once a fraud is uncovered, it is imperative for the stricken firm to deal with it in a manner that reduces its impact and maximises the chances of recovering any misappropriated assets. The true extent of any fraud is unlikely to be apparent at first glance. Almost all frauds are bigger than initially expected and have been going on for a longer period of time than initially suspected. In order to deal with all the issues which arise from a fraud, the stricken firm has to allocate its resources in an efficient and targeted manner.

Legal advice and privilege

Regardless of the circumstances under which a fraud is discovered, it is imperative that legal counsel is briefed and involved as soon as possible. Any investigation into the circumstances that have given rise to the suspected fraud must be delayed until legal counsel is updated and legal advice taken on the appropriate next steps. Legal counsel will determine whether forensic accountants are needed and will arrange for their employment directly, if necessary for the reasons set out below.

Legal counsel should be involved to ensure that the investigation is protected by legal privilege. This, in turn, prevents documents from being created which do not attract the benefit of privilege and which may subsequently be disclosable to regulators and third parties in legal proceedings. It should always be borne in mind that organisations that fall victim to frauds may also find themselves at risk of claims from their own clients and investors for regulatory and “system control” failures. The compulsory disclosure of documents, particularly those that cast the organisation in an unfavourable light, is likely to have wider legal and financial implications at a later date. If an organisation knows that it will not be obliged to disclose the results of its investigation to a third party (including a regulator) or to a court, it will be able to undertake a thorough review of its concerns without fear of exposure.

“Legal advice privilege” does not apply to advice given by accountants. Therefore, any report or analysis prepared by an accountant will be disclosable to regulators and third parties during the course of proceedings. However, it is possible, in various circumstances, for legal counsel to retain privilege over any report or analysis in circumstances where forensic accountants are instructed by legal counsel and where the report or analysis was created for the dominant purpose of litigation which at the time was reasonably in prospect. Therefore, organisations ought to think carefully before deploying accountants.

In addition to this, documents created during the course of an investigation are likely to contain confidential information that relates to clients. It goes without saying that clients of offshore trust and fiduciary services companies are unlikely to appreciate any disclosure of information that relates to them and their affairs unless it is absolutely necessary and even then only under compulsion of law.

Strategy and fact-finding

Once legal counsel is involved, the stricken firm ought to evolve and follow a strategy involving a select number of its people. It should identify as much information as possible about the fraud within a set time-frame. It is important to determine the organisation's objectives, which may include any one or more of the following: (i) the identification of systemic weaknesses, (ii) the prevention of further losses, and (iii) the recovery of losses.

It is imperative that the investigation and action plan should proceed without delay. This maximises the firm's chances of recovering any misappropriated funds. It may be appropriate to apply to a court for interim remedies such as freezing orders and search-and-seize orders or even disclosure orders without notifying the suspected fraudster. It is therefore important to consider the benefits of a covert investigation, especially in matters relating to fraud by employees. It will also be important to consider whether legal counsel from other jurisdictions ought to be brought on board to advise on obtaining interim relief in other jurisdictions at the same time. A co-ordinated and targeted approach can often reap huge dividends which is why experience in this area of work is of vital importance.

Reputation management

Organisations should hope for the best but always prepare for the worst. With this in mind, it is important for them to consider how the investigation and news of the fraud would affect their reputation if it were leaked. It would often be prudent to hire a public relations agency/reputation management company to give its advice. This will be particularly important when the investigation relates to potential client losses or losses to trust monies.

A PR agency is ideally placed to conduct a surveillance of media reports, including social media, and to manage the flow of information and announcements from the business. This, in turn, guarantees a certain consistency of communications with the outside world and limits potentially adverse PR to the extent possible. It also allows the management team of the business to get on with the investigation and its day-to-day activities.

In certain offshore jurisdictions, there is the risk of news of the fraud being leaked within the jurisdiction if local advisors are used. This can have severe and dramatic consequences for the organisation as well as its clients and can ultimately undermine the whole strategy. This in turn can irreparably damage the organisation's reputation.

Moreover, positive PR management and strategy will also give the regulators more confidence in the organisation and its ability to deal with the crisis as a whole. regulators' key concern is often to protect the reputation of the jurisdiction and it is likely that any protection afforded to the organisation through a positive PR management will protect the jurisdiction as well.

Regulators...can't live with them...

Each stricken organisation must consider the best time to start talking to the relevant regulator. Offshore trust and fiduciary services companies will be under close scrutiny in relation to their operations and their management of clients' funds. However, before liaising with a regulator, it is important for the firm in question to understand the basic facts surrounding the fraud. It will have to strike a balance between informing the regulators in accordance with local regulations and avoiding the regulator's intervention, which is likely to take its toll on the progress of the investigation and reduce the influence of the organisation's own management team (who are likely to be best placed to investigate the problem).

In my experience, the firm will obtain a positive response from the regulator if it approaches it with a summary of the facts it has ascertained from the investigation to date, along with a plan of action to both minimise any losses to clients' funds and maximise the chances of recovering funds through the use of freezing orders and disclosure orders. The regulator is likely to require regular updates about the progress of the investigation and the plan of action. Regulators normally appreciate that their ability to quickly and effectively conduct an investigation, even with the use of the authorities, is severely limited owing to pressures on their resources. Therefore, if the organisation has convinced the regulator to trust it because it has matters in hand, it is likely to be less eager to intervene before the organisation's own investigations have ended.

Insurers

Organisations should consider the cover afforded by their insurance policies most carefully. Every organisation, along with its operating subsidiaries, should have adequate protection (including crime and fidelity cover) to cover itself and its directors/trustees in the event of a fraud.

Organisations should be aware that different jurisdictions may require different levels and types of cover and should consider asking their brokers to draw comparisons between the policies required in different jurisdictions. This can be illuminating and can identify gaps in existing cover, i.e. clauses in insurance policies that might not cover the organisations and their directors/trustees in certain eventualities. Every organisation should consider taking independent advice on its insurance policy before obtaining cover, particularly in respect of what the policy will and will not cover (for example, legal expenses). In summary, organisations must ensure that they are comfortable with the cover they have if the worst happens.

Organisations often rely on the authorities too readily to help them in mitigating any losses they suffer. They should be aware that the asset recovery rate is extremely poor, even in the UK. According to the National Audit Office Report of 2013, only 26p in every £100 of criminal proceeds was confiscated in 2012-13. Insurers and regulators are aware of this poor recovery rate and therefore organisations must consider instructing legal counsel to obtain freezing orders (and any other court orders necessary) to mitigate the consequences of the fraud and to maximise potential recoveries. Failing to act in a way which is aimed at mitigating loss could lead to the insurer refusing to cover claims made on the policy.

Keeping employees, clients and investors informed

Employees are the most important asset of a professional services firm. Upon discovery of a fraud within the organisation, they are bound to be concerned about their own positions and the future viability of the organisation. Naturally, this can be very damaging for morale and productivity. Clear, effective and regular communications with employees are vital if the stricken company is to stop them thinking of leaving. This will also prevent false information and rumours (which serve only to harm the organisation) from spreading. The firm should remind employees of their obligations to keep certain information confidential and should instruct them to direct any queries from external parties to the relevant manager/PR agency contact person.

If the firm believes that someone has been tampering with clients' funds, it must keep those clients abreast of the progress that its investigation is making. It should tell them whether their assets have been affected and, if so, what steps it is taking to minimise their losses. It need not inform the clients of its investigation's findings or the specific details of the action plan but it ought to give them enough information to reassure them that it is responding to their concerns and safeguarding their assets as well as possible.

If the firm has set timetables for communications (and this applies whomever these are to be sent to), it should send off the updates in accordance with those timetables. A failure to communicate consistently and in accordance with previous communications is likely to lead everybody to draw negative conclusions.

A display of ethics

Successful crisis management requires an immediate, well-informed reaction to an unfolding situation. An organisation's failure to react quickly is likely to result in a failure to contain and minimise the damage. It will also hinder the organisation in its efforts to maximise the chances of recovering the misappropriated funds. Speed of response is also particularly important in the context of interim applications for freezing orders and search and seize orders which ought to be made without undue delay. Decisive action in a crisis can often be the difference between success and failure for both the organisation and the directors and trustees personally.

If an organisation can manage and deal with a crisis emanating from a fraud successfully, it sends out a positive message to its shareholders and any regulators. It demonstrates the competence of the organisation's management and instils confidence in its future decisions. A time of crisis is often an opportunity to demonstrate and reiterate the good points and values of a business. If it shows the world that it will not tolerate fraud but will instead try to recover all losses arising from a fraud, it might turn a disaster into a triumph. Such a message about the organisation's morals is unlikely to be forgotten quickly.

A case study

My team at Pinsent Masons once advised an offshore professional services firm which provided trust services and managed clients' funds that had fallen victim to a fraud by its finance director. The potential losses arising from the fraud were estimated in the millions and took in company funds as well as clients' funds.

Within two weeks of being instructed, we successfully obtained freezing orders in the offshore jurisdiction against the rogue finance director and the companies he controlled. Upon further investigation, we also obtained freezing orders in England regarding assets believed to be located in England. During this time, we worked closely with a PR firm to manage our client's communications with clients, employees and the financial regulator of the offshore jurisdiction. The communications with the relevant stakeholders showed that our client had established control over the situation and had inspired confidence in the regulator.

Our ability to mobilise an expert team immediately and obtain interim injunctive relief kept the financial harm of the fraud to a minimum. Furthermore, our advice on the communications with everyone involved in the process – and throughout the process – protected our client's corporate reputation from damage. Our client's licence to provide trust services remains in force and it continues to provide services to its clients.

* Alan Sheeley, Pinsent's head of civil fraud and asset recovery, can be contacted on +44 (0)207 054 2626 or at alan.sheeley@pinsentmasons.com. Mehmet Karagoz, a solicitor in the civil fraud and asset recovery team, can be contacted on +44 (0)207 054 2660 or at Mehmet.karagoz@pinsentmasons.com