A search at the company's premises: cost and likely outcome is rarely a fixed figure. What it costs and how it ends depend on what is seized, how long material stays with the authority, and whether the case moves to prosecution. Cost tracks the volume under review; the outcome is usually measured in months, not decided on the day.
Who this concerns
This applies to a company that has just had, or is bracing for, a visit from the Swedish Economic Crime Authority (Ekobrottsmyndigheten) or the police, acting on a prosecutor's order to search business premises and seize documents or devices. The trigger is rarely a surprise to everyone in the building. A tip-off from a former employee, a suspicious activity report filed by a bank, an audit finding that a partner firm flagged upward, or an information request arriving through a cross-border investigation channel: any of these can precede a search by weeks or months, visible only to whoever received the first signal.
The company's position at this stage is procedural, not accusatory in the criminal sense. In the majority of cases the company is a source of evidence, not yet a defendant, even though the individuals inside it, directors, the CFO, a specific manager, may already be under suspicion. That distinction matters for everything that follows: what gets seized, who has to answer questions, and what the eventual bill looks like. For the board and the compliance function, the practical question on the day is narrower than "are we in trouble". It is: what happens in the next four hours, and what does it cost to get through them without making the position worse. For background on the practice area this sits in, see the economic crime defence overview.
What the law says
Under Swedish law as it currently stands, a search of business premises is authorised where there is reasonable suspicion of an offence that carries imprisonment and where there is cause to believe the premises hold material relevant to the investigation. The decision is taken by a prosecutor or, where the matter is contested or urgent procedural safeguards require it, by a court, and it is executed by police officers or investigators attached to the Economic Crime Authority. A closely related but separate measure is the seizure of specific items: paper files, hard drives, mobile devices, cloud credentials, once the search team is on the premises and has identified material it considers relevant.
The company, as the entity whose premises are searched, is not automatically a criminal suspect. It is common for the search to target evidence of an offence attributed to one or more individuals inside the company, with the company's own exposure, if any, running on a separate and later track. That later track exists in Swedish law specifically for companies: a corporate sanction, the företagsbot (corporate fine), can attach to the business itself where an offence was committed in the course of its activities, independently of whether any individual is ultimately convicted. The mechanics of that sanction are covered separately in the glossary entry on företagsbot; it is worth reading early, because it explains why a search can have consequences for the company even if no director is charged.
How it works in practice
Who arrives and under what authority
The team typically includes investigators from the Economic Crime Authority or police, sometimes accompanied by forensic IT specialists if digital evidence is anticipated. They carry a decision authorising the search, which they are required to present. That decision defines the scope: which premises, in connection with which suspected offence, and, where specified, which categories of material. A search that exceeds its stated scope is a point worth noting in real time, not raising as an afterthought weeks later.
The decision behind the door: warrant versus urgent search
Most searches proceed on a prior decision from a prosecutor or court. In genuinely urgent situations, where waiting for that decision would let evidence disappear, the law allows an accelerated route, with judicial review following after the fact rather than before. From the company's side, the practical difference is limited: either way, the team is at the door with authority to proceed, and the sensible response is the same in both cases.
What actually gets taken: paper, servers, phones, cloud access
Seizure is not limited to physical paper. Server access, email accounts, accounting system logins, and personal devices used for work are all within scope if they plausibly hold relevant material. Cloud-hosted data is increasingly the largest category by volume, and it is also the category most likely to generate disputes later over what was actually copied, from where, and under whose login credentials.
The role of company counsel while the search is underway
Counsel's function on the day is narrow and specific: confirm the scope of the decision, note anything that falls outside it, flag material that may be subject to legal privilege before it is copied rather than after, and keep a contemporaneous record of what was taken, from which location, and by whom. This record becomes the basis for any later challenge to the scope or conduct of the search, and it is far more useful built in real time than reconstructed from memory.
Keeping the business running during and after
A search interrupts normal operation for the hours it takes, and the interruption does not end when the team leaves the building. Systems that were imaged may run more slowly; staff who were interviewed on site may need time before they are functioning normally again; certain files or accounts may be unavailable until copies are confirmed and originals released. Planning for that continuity gap, who covers which function, how client-facing work proceeds, is a cost item that rarely appears on an invoice but shows up in lost productivity all the same.
Employees on site: rights and obligations
Staff present during a search are generally not obliged to answer substantive questions about the underlying suspicion on the spot, though they may be asked to assist practically, for example by providing access to a locked room or a specific system. Anyone approached for a substantive statement, rather than practical assistance, is entitled to have that clarified before responding, and to involve counsel before making any statement that goes beyond confirming their own role.
What happens to material once it leaves the building
Seized material is logged, and the company is entitled to a receipt describing what was taken. Copies of digital material are typically made before analysis begins, and originals may be returned once copying is complete, though this varies with the volume and complexity of what was seized. Requesting the return of material that is not itself needed for the investigation, distinct from copies of its contents, is a standard and often underused step.
From search to charge: what usually follows
A search does not automatically lead to a charge, against the company or against any individual. Material seized during the search is analysed, sometimes over an extended period, and the investigation either progresses toward a formal decision to prosecute, is narrowed to specific individuals, or is discontinued. The gap between the search and the next formal step is frequently the period in which the company has the most influence over how the matter develops, because it is the period in which voluntary cooperation, additional disclosure, or a compliance response can still shape the prosecutor's assessment.
The corporate fine that runs alongside individual liability
Because a företagsbot can be imposed on the company independently of any individual conviction, a search that targets a named manager's conduct is not, from the company's point of view, a matter that only that manager needs to worry about. The company's own exposure to a corporate fine is assessed on separate criteria, including whether it took reasonable steps to prevent the offence, and building that record starts well before any formal proceedings, ideally the day the search takes place.
What to verify now
- Whether the search decision was formally presented and matches what is actually being examined
- Whether any material taken falls outside the stated scope of the decision
- Whether privileged communications were flagged before copying, not after
- Whether a receipt listing seized items was issued and matches the internal log kept by counsel
- Whether any staff member gave a substantive statement without counsel present
- Whether business continuity gaps, system access, staff availability, have been documented for later cost recovery or defence purposes
- Whether the company's own compliance record, prior to the search, is preserved and accessible
FAQ
Does a search extend to data held by suppliers or subcontractors?
A search decision covers the company's own premises and systems, not a third party's infrastructure by default. Where the company shares systems with a supplier, or where a subcontractor holds data on the company's behalf, whether that material falls within scope depends on the access rights described in the underlying contract. Suppliers with weak security terms in their agreements are more likely to see their own systems drawn into a request for cooperation. The contractual side of this is covered in security requirements on suppliers and subcontractors.
Can a search lead to personal liability for board members?
A search targets evidence, not a verdict on any individual's liability, and board members are not automatically exposed simply because the company's premises were searched. Personal exposure for directors typically surfaces later and through a different route, most often when a bankruptcy trustee reviews the board's conduct in the period before insolvency. That separate track is explained in claims by a bankruptcy trustee against the board.
Does a search affect enforcement of a foreign judgment against the company?
The two tracks are independent. A search is a criminal investigative measure; enforcement of a foreign civil judgment against the company follows its own procedure and timetable in Sweden, and one does not suspend or accelerate the other. Where both are live at the same time, the practical question is usually which one the company's resources should be directed toward first. The enforcement mechanics are set out in enforcement of a foreign judgment in Sweden.
The numbers
There is no standard invoice for a search, and any figure quoted without reference to the specific case should be treated as guesswork rather than guidance. What can be said with confidence is what drives the cost up or down. The volume of material seized is the single largest factor: a search that yields a handful of files closes out in days of review, while one that captures an entire mail server or years of accounting data can generate weeks of forensic and legal work before anyone can say what was actually found. Whether digital forensics specialists are needed, rather than a straightforward document review, adds a distinct cost layer, and that need is determined by how the material was stored, not by the size of the company.
Duration follows the same pattern rather than a fixed calendar. How long material stays with the authority, and how long it takes for the investigation to reach its next formal step, is set by the workload of the specific prosecutor or investigative unit handling the file and by how complete the material is once seized, not by a statutory clock that runs the same way in every case. A company that resolves scope disputes and privilege questions quickly, rather than litigating them piecemeal, tends to see its own material returned sooner, which is itself a meaningful part of managing cost, since delayed access to seized systems has its own operational price.
Where it usually goes wrong
The most common error is treating the search as the event, when in fact it is the opening move in a process that runs for months afterward. Companies that focus entirely on getting through the day of the search, and stop documenting anything once the team leaves, lose the record they need if the scope of the search or the handling of privileged material becomes an issue later. The contemporaneous log kept by counsel during the search is worth more three months later than any recollection assembled after the fact.
A second recurring problem is confusing the company's position with that of the individual under suspicion. A search targeting a specific manager's conduct does not mean the company has no independent exposure, and it does not mean the company is automatically implicated either. Both assumptions lead to the wrong response: treating the company as a bystander risks missing the steps that limit its own corporate fine exposure, while treating it as automatically guilty risks conceding points that were never established.
The picture changes further where the company sits inside a cross-border structure. Where the parent company is incorporated outside Sweden, where relevant servers are hosted abroad, or where key documents exist only in a foreign subsidiary's systems, the search executed on Swedish premises does not automatically extend that authority across the border. Material held outside Sweden typically requires a separate international request, following its own procedure and timetable, and the Swedish investigation may proceed on incomplete information for a period while that request is pending. A group structure with unclear internal reporting lines between the Swedish entity and its foreign parent is precisely the situation where a search generates the most confusion about who is actually obliged to respond to what, and clarifying those lines before a search happens, not during one, is one of the more reliable ways to reduce the eventual cost.
Finally, this analysis reaches a limit once the investigation moves from search to a formal decision on charges. At that point the questions change from procedural, was the search properly scoped, was privilege respected, to substantive, what does the evidence actually show, and that shift requires a review of the specific material seized, not a general description of how searches work.
What to do next
Everything above describes how a search unfolds and what shapes its cost. It stops short of one thing: what the seized material, once reviewed, actually shows about the underlying suspicion, and how that translates into the company's exposure to a charge, a corporate fine, or neither. That assessment requires looking at the specific documents and the specific decision authorising the search, which is exactly the point where a general account of the process needs to hand over to a review of the case file. A related walk-through of what follows once the authority moves from search to formal engagement is covered in dealing with the Economic Crime Authority. Where the position needs to be assessed against the actual material seized, get in touch and expect a response within two hours on a working day.