Self‑reporting vs Internal Investigation in Finland (2026): Should Boards Report Suspected Corporate Crime to Police or Keep It In‑house?

When a Finnish board discovers credible evidence of corporate wrongdoing, fraud, bribery, a sanctions breach, environmental crime, it faces a binary fork: self‑report to police or prosecutors now (Option A), or run an internal investigation first and defer external disclosure (Option B). The choice between self‑report vs internal investigation in Finland in 2026 carries materially higher stakes than it did even two years ago, because recent Criminal Code amendments and sanctions‑enforcement reforms have expanded corporate liability, raised maximum fines, and sharpened prosecutorial expectations around cooperation.

This guide provides the board‑level decision matrix that no other Finland‑specific resource currently offers, dimension by dimension, with concrete counsel‑call triggers, so that directors, GCs, CFOs and compliance officers can act decisively within the first 72 hours of discovery.

Option A, Self‑Reporting: What It Is, When It Applies, Who It Suits

What self‑reporting looks like in Finland

Self‑reporting corporate crime in Finland means the company, acting through its board or authorised representative, voluntarily notifies the police or prosecutor that it has discovered (or reasonably suspects) criminal conduct within the organisation. The practical steps are straightforward but sequencing matters:

• Board resolution. The board formally resolves to report. Recommended minute language: “The board resolves to report the suspected [offence type] to the police/prosecutor, having received criminal counsel advice and preserved relevant evidence.”
• Preserve evidence. Impose a litigation hold on documents, devices and electronic communications before any external contact.
• File a report. Contact the police via Poliisi (online, by phone at +358 295 419 800, or at any police station). For serious economic crime or corruption, the National Bureau of Investigation (KRP) typically assumes jurisdiction. The Suomi.fi service also provides non‑emergency reporting channels.
• Designate a spokesperson. Appoint one person, typically criminal counsel, to manage all authority communications.

Immediate benefits

• Mitigation through self‑report. Finnish prosecutors weigh early, truthful cooperation when determining charges and penalty recommendations. While Finland does not operate a formal leniency programme for all corporate offences, prosecutorial practice recognises voluntary disclosure and active remediation as mitigating factors.
• Insurance signalling. Prompt notification to D&O and corporate liability insurers, required by most policy terms, is easier to justify when coupled with a police report.
• Narrative control. Reporting first lets the company shape the initial factual record rather than responding defensively to a regulator‑initiated probe.

Risks of self‑reporting

• Loss of confidentiality. Materials submitted with a police report enter the criminal file and are generally accessible to suspects, co‑defendants and, eventually, the public.
• Triggering investigations into individuals. A corporate report can open direct criminal investigations into directors and officers, including the very board members who authorised the report.
• Reputational leak. Police and prosecutor actions are difficult to contain; media monitoring of court registries is standard practice in Finland.

Option B, Internal Investigation: What It Is, When It Applies, Who It Suits

Running a defensible internal investigation

An internal investigation means the company examines the suspected wrongdoing itself, typically through external counsel and forensic specialists, before deciding whether, when and how to report externally. For the investigation to be defensible if later scrutinised by authorities, it must meet several conditions:

• Independence. The investigator must be demonstrably separate from the individuals under suspicion. External criminal counsel is strongly preferred.
• Scope and mandate. A written terms of reference, approved by the board or audit committee, defines what is being investigated and what remediation authority the investigator holds.
• Evidence integrity. Forensic chain‑of‑custody protocols, imaging devices, preserving metadata, logging access, must be established from day one.

Benefits of the internal‑investigation route

• Control of facts. The company identifies the full scope of misconduct before exposing itself to prosecutorial scrutiny.
• Remediation before disclosure. Terminating wrongdoers, strengthening controls and clawing back gains can all occur before external reporting, potentially limiting ongoing harm.
• Internal investigation privilege in Finland. While Finland does not recognise US‑style attorney–client privilege for internal investigation reports, structuring the investigation through external counsel, restricting distribution to the board, and marking all outputs as legal advice increases the prospect that confidentiality will be respected in practice.

Risks of keeping it in‑house

• Later discovery. If authorities or a whistleblower surfaces the matter independently, the company loses all cooperation credit and faces the appearance of concealment.
• Spoliation allegations. Any destruction or alteration of evidence, even inadvertent, is far harder to defend if the company knew of wrongdoing and chose not to report.
• Parallel proceedings. An ongoing internal investigation does not prevent police from commencing their own investigation if they learn of the matter through another channel.

Self‑Report vs Internal Investigation: Side‑by‑Side Comparison

The following table is the centrepiece of this analysis. Each dimension answers one question: what changes materially depending on whether the board reports or investigates internally?

Key takeaways from the comparison:

• Self‑reporting is the stronger path when the misconduct is clearly criminal, systemic and likely to surface independently.
• Internal investigation gives the board time and control, but only if evidence is scrupulously preserved and the window for voluntary disclosure is not missed.
• Under the 2026 enforcement climate, the cost of being discovered without having self‑reported is materially higher than before. The decision framework in Section 7 below translates these dimensions into concrete triggers.

Dimension‑by‑Dimension Analysis

Each dimension below unpacks what changes, for the company, the board and individual officers, depending on whether you report to police or handle the matter internally.

Liability and penalties

Under Chapter 9 of the Finnish Criminal Code (Rikoslaki), a legal person (corporation, foundation, association) can be sentenced to a corporate fine when an offence has been committed in its operations. The 2026 legislative landscape significantly increases the stakes. In the sanctions‑violation context specifically, commentary from leading Finnish firms notes that the maximum corporate fine has been set at five percent of the entity’s turnover, with a minimum of EUR 850,000 and a substantially higher maximum ceiling. These figures reflect the trend toward turnover‑based penalties aligned with EU enforcement standards.

Mitigation through self‑report matters here. Prosecutors retain discretion to weigh the company’s cooperation, the speed and completeness of disclosure, and the effectiveness of remediation when recommending penalties. Early, truthful cooperation does not guarantee a lower fine, but it is the single most controllable variable the board has.

Cost

Evidence handling and privilege

Finland does not recognise a broad attorney–client privilege over internal investigation reports in the way common‑law jurisdictions do. The practical protections available are narrow:

• Communications between external counsel and the client for the purpose of giving legal advice enjoy a degree of protection, but this does not extend to fact‑finding documents created by or for the investigation team.
• Distribution control is the most effective tool: restrict the investigation report to the board or audit committee, mark it as legal advice, and avoid circulating it to operational staff.
• Self‑report materials submitted to police become part of the criminal file. Once in the file, they are generally available to all parties to the proceedings.

The practical implication: if privilege preservation is a priority, structure the investigation through external counsel from the outset and consider a phased disclosure strategy rather than a wholesale document dump to police.

Timing and procedural outcomes

Filing a police report triggers the official criminal process. The police will assess whether to commence a pre‑trial investigation, which can take months or years to complete. The company has limited control over the timeline once the report is filed.

An internal investigation can typically produce preliminary findings within weeks. The board then chooses whether and when to notify prosecutors, but the window for earning cooperation credit narrows with every passing week. Industry observers expect that, under the 2026 enforcement posture, authorities will scrutinise the gap between discovery and disclosure more closely than in prior years.

Regulatory enforcement, reputation and insurance

In regulated sectors, financial services, energy, pharmaceuticals, self‑reporting corporate crime to police does not discharge the separate obligation to notify the sectoral regulator (FIN‑FSA, Tukes, Fimea or equivalent). Boards must run parallel notification tracks. Failure to notify a sectoral regulator can trigger independent administrative sanctions.

D&O insurers require notification of circumstances that may give rise to a claim. Most policies contain consent clauses that prohibit the insured from admitting liability or settling without insurer approval. Self‑reporting to police without first engaging the insurer can jeopardise coverage. The sequence should always be: engage counsel → notify insurer → report to police.

Reputationally, early voluntary disclosure is generally viewed more favourably by markets and regulators than a forced revelation. The reputational calculus has shifted in 2026: with higher fines and broader corporate liability, a company that is discovered to have concealed wrongdoing faces not just legal penalties but sustained public trust damage.

What Changes in 2026

The 2026 Criminal Code amendments and related sanctions‑violation regulations have materially altered the decision calculus for boards weighing self‑report vs internal investigation in Finland. Three changes matter most:

• Higher corporate fines. New statutory provisions, particularly in the sanctions‑enforcement context, establish turnover‑based corporate fine ceilings that dwarf the previous flat‑rate regime. The amended framework aligns Finland more closely with EU enforcement norms.
• Expanded legal‑person liability. The 2026 amendments clarify the circumstances under which a corporation bears criminal liability for acts committed within its operations, reducing the room for arguments that misconduct was purely individual.
• Stricter enforcement posture. Finnish law firms and enforcement observers note that prosecutors are applying the new provisions actively, with particular emphasis on sanctions compliance, and that cooperation and remediation are weighed more explicitly in penalty determinations.

The net effect: the cost of inaction, or of delayed reporting, has increased. Boards should engage criminal counsel earlier, preserve evidence more rigorously, and default toward structured disclosure rather than indefinite internal containment.

Board Decision Framework: When to Self‑Report, When to Investigate Internally

Use the triggers below as a practical board decision matrix for reporting suspected corporate crime in Finland.

Choose self‑report (Option A) when:

• Evidence indicates serious criminal conduct (fraud, bribery, sanctions violation).
• The misconduct is systemic, not an isolated individual act.
• Discovery by authorities or third parties is likely (whistleblower, audit trail, counterparty cooperation).
• Cross‑border elements exist (EU sanctions, multi‑jurisdiction bribery).
• The company wants cooperation credit to reduce penalties under the 2026 regime.
• A sectoral regulator already has parallel jurisdiction and is likely to refer the matter to police.
• The insurer’s policy terms require immediate notification of circumstances.

Choose internal investigation first (Option B) when:

• The allegation is preliminary and the underlying facts are unclear.
• The conduct may be a regulatory breach rather than a criminal offence.
• Rapid internal remediation (termination, control fix, claw‑back) can eliminate ongoing harm.
• Privilege preservation is essential to protect legal strategy.
• The whistleblower channel has been used and protected under the Whistleblower Protection Act.
• No immediate risk of evidence spoliation or flight by suspects.

When to Engage a Lawyer for This Decision

Certain triggers require immediate engagement of criminal counsel, before the board takes any external action. Contact a criminal lawyer in Finland when any of the following apply:

• Potential sanctions breach, any indication the company has violated EU or national sanctions obligations.
• Cross‑border elements, the misconduct involves foreign jurisdictions, multi‑national counterparties or international regulatory exposure.
• Whistleblower complaint naming senior management, allegations implicating board members or C‑suite executives require independent counsel immediately.
• Insurer demands notification, policy consent clauses require counsel involvement before any admissions or external communications.
• Evidence of systematic or ongoing criminal conduct, where the company’s liability will increase with every day of inaction.

Recommended counsel roles: criminal counsel for exposure assessment and authority engagement; employment counsel for disciplinary action and dismissals; external forensic specialists for evidence preservation; PR / crisis communications counsel for stakeholder management.

Sources

1. Finlex, Criminal Code (Rikoslaki)
2. Finlex, English legislation portal
3. Poliisi, How to report a crime
4. Suomi.fi, Report of criminal wrongdoing
5. Dittmar & Indrenius, Liability for sanctions violations is increasing in Finland
6. Castrén & Snellman, Stricter penalties under new sanctions violation regulation
7. Chambers Practice Guides, Internal Investigations Finland 2026
8. ICLG, Corporate Investigations Finland
9. Korruptiontorjunta, Report corruption
10. Global Law Experts, Criminal Liability Finland