A search at the company's premises: step by step, moves through five fixed stages under Swedish law as it currently stands: the decision to search, its presentation on arrival, execution within the stated scope, seizure and protocol, and the return or retention of material afterwards. Each stage carries its own deadline, and each is a point where the company's conduct either protects its position or makes the position considerably harder to recover later.
Who this concerns
This concerns any company that has become the subject of a preliminary investigation into suspected economic crime, most commonly bookkeeping offences, tax offences, fraud against creditors, or corruption. It also concerns companies that are not themselves suspects but hold documents or systems relevant to an investigation into a supplier, customer, or group entity. Directors, the person responsible for accounting, and whoever administers the company's IT systems are the people who end up making the decisions on the day, usually with no advance warning and no time to consult external counsel before officers are already at the door.
The trigger is almost never the search itself. It is a preceding step, most often a request for documents that went unanswered, a whistleblower report, information shared by a bank or an auditor under a reporting duty, or material that surfaced during an investigation into a separate company. By the time a search decision ('husrannsakan') has been issued, the investigating authority already believes it has enough to justify entering the premises without prior notice.
What the law says
A search of business premises requires a decision by a person with the authority to issue it, typically a prosecutor, or in urgent cases a senior police officer with subsequent court confirmation. The decision must be linked to a specific suspected offence and specify, at least in general terms, what is being sought. It does not have to disclose the full evidentiary basis of the suspicion, and the company is not entitled to a preview before officers arrive.
Officers executing the search must identify themselves and present the decision, or at minimum communicate its substance, before entry. The search itself is confined to what the decision covers, both in terms of the premises named and the type of material sought. Items outside that scope are not lawfully within reach, even if they happen to be found in the same room. A written record, the protocol, must be produced listing everything taken. Material that is subject to legal privilege, correspondence with legal counsel in particular, is treated separately: it can be sealed and set aside for a court to rule on, but it is not meant to be read by the investigating officers as part of the ordinary sift.
How it works in practice
Before the search: what usually precedes it
By the time officers arrive, a prosecutor has typically already reviewed material that points to the company's premises specifically. Common precursors are an unanswered request for documents in a preliminary investigation into a third party, a report from an auditor who identified irregularities during a statutory review, or information passed on by a bank following suspicious transaction monitoring. None of this is visible to the company beforehand. There is no notice period built into the process, because advance notice would defeat the purpose of the measure.
Who carries out the search and who authorises it
Execution normally falls to police officers, often working alongside the Swedish Economic Crime Authority ('Ekobrottsmyndigheten') when the underlying suspicion concerns bookkeeping or accounting offences. The decision authorising the search comes from a prosecutor attached to the investigation, or, where the situation is urgent enough that waiting for a prosecutor would risk the loss of evidence, from a police officer acting under emergency powers, with the matter then referred to a court for confirmation within a short period afterwards.
Arrival: what must be shown before entry
Officers are required to identify themselves and to communicate the substance of the search decision before they proceed. This does not mean handing over a full copy for the company to study at leisure before allowing entry; it means the company is told, in substance, what the search concerns and what premises it covers. Refusing entry once this has happened does not stop the search, it simply removes the company's ability to observe and object to how it is conducted from the very start.
What officers may search and what falls outside the decision
The lawful scope of a search is set by the decision itself, not by whatever officers happen to find convenient once inside. If the decision names an accounting department and a server room, material found in an unrelated office is, in principle, outside that scope, unless it is in plain view and obviously connected to the same suspected offence. This distinction matters later: material seized outside the stated scope is a common ground for a subsequent challenge to admissibility.
Seizure: what can be taken and what should be flagged as privileged
Physical documents, storage media, and, increasingly, entire devices are the typical targets of seizure. Anything the company or its legal counsel believes is privileged correspondence should be identified and flagged at the point of seizure, not afterwards. Once flagged, the material is meant to be sealed rather than reviewed on the spot, with a court deciding on the privilege question separately. Failing to flag privileged material during the search, rather than after, is one of the most common and most avoidable losses in this process.
The protocol: what must appear in it before signing
The protocol is the written record of everything taken, and it is the company's principal tool for later verifying what happened. It should list each item with enough specificity to identify it again, note where it was found, and record who was present on both sides. A representative of the company should read the protocol before it is finalised and raise any discrepancy immediately, since a protocol signed without comment is difficult to contest later purely on the basis that it was inaccurate.
Digital devices and cloud data: a separate set of rules
Seizure of a physical laptop is one thing; access to data stored on a cloud server, particularly one hosted outside Sweden, is another. Officers may seek access to remotely stored data connected to a seized device, but where that data sits on infrastructure controlled by a foreign entity, or where the company forms part of a group with a parent company abroad, additional questions arise about which authority has jurisdiction over the data and what cooperation mechanism applies. This is not a technicality: it frequently determines how much of the company's systems are actually within reach on the day.
Role of legal counsel during the search
Counsel has no automatic right to delay a search pending their arrival, but a company is entitled to have counsel present as soon as practicable, and officers will generally accommodate a reasonable wait if one is already engaged. Counsel's role during the search itself is narrow but concrete: observing the scope being respected, flagging privileged material before it is bagged, and taking a parallel note of what is happening, since the company's own record of events is often the only counterweight to the protocol if a dispute arises later.
Immediately after: what to do in the first two working days
Once officers leave, the priority is internal, not external. Preserve a copy of the protocol and any counsel's notes. Identify who else in the company knew about the underlying issue before the search, since that group will need to be interviewed carefully and consistently. Suspend any routine deletion or overwrite schedules on systems that were touched, even partially, since inadvertent deletion after a search looks materially different to an investigator than deletion before one. None of this requires a public statement, and making one prematurely is rarely advisable.
The numbers
There is no single fixed number of days that governs how quickly seized material must be reviewed, returned, or challenged; that timing is set by the court handling the matter and by how much material was taken. A request to have a seizure lifted, in whole or in part, goes to the district court with jurisdiction over the location of the search, and that court's own docket, not a statutory countdown, determines how quickly it will be heard. What is fixed is the sequence, not the calendar: the decision comes first, execution and protocol follow, and any challenge to what was taken comes after that, addressed to the court rather than to the officers who carried out the search.
Where it usually goes wrong
The most frequent dispute is scope. Material seized from premises, or from a device, not named in the decision is vulnerable to challenge, but that challenge has to be raised, and raised with a specific factual basis tied to the protocol, not asserted generally after the fact. A close second is privileged material seized without being flagged at the time, which then requires a separate application to a court to have it excluded, a step that is avoidable entirely if counsel identifies it during the search itself.
The foreign element changes the picture materially. Where the company's data is hosted abroad, where its parent company sits in another jurisdiction, or where a counterparty under investigation is based outside Sweden, the practical reach of a Swedish search decision runs into the limits of Swedish jurisdiction. Cross-border access to data typically requires either the cooperation of the foreign entity holding it or a formal mutual legal assistance request, and both take considerably longer than the search itself. A group compliance function based abroad should not assume that a Swedish search automatically extends to systems it controls outside Sweden, nor should it assume the opposite; the answer depends on where the specific data sits and which entity legally controls it.
A third recurring problem is internal: employees who, in a genuine attempt to be helpful, start moving or consolidating files once they realise what is happening. Even entirely innocent tidying during a search reads, from the outside, indistinguishable from concealment. The practical instruction that holds up best is the simplest one: stop working on anything connected to the matter the moment the decision is presented, and let counsel do the talking.
The search process occasionally intersects with questions that sit in adjacent areas of law rather than in the search itself. If material seized points to a director having favoured particular creditors before an insolvency, that raises a distinct question of liability for creditor-related offences that runs on its own boundary, separate from the company's exposure. If the company is a regulated financial entity and the seizure touches its core IT systems, a parallel question about ICT risk management obligations can arise independently of the criminal matter. And where the search uncovers disputed amounts owed by or to the company, those claims, once genuinely disputed, cannot be pushed through the summary route for uncontested debt and have to be pursued as ordinary litigation instead.
Frequently asked questions
Liability for creditor-related offences: where does it stop?
A search that surfaces evidence of preferential treatment of particular creditors ahead of an insolvency can expose individual directors to a separate line of liability, distinct from the company's own exposure to a bookkeeping or fraud charge. That boundary, where personal director liability starts and where it stops, is not determined by the search itself but by what the seized material actually shows about who made the relevant decisions and when.
ICT risk management for financial entities: where does it stop?
Where a search targets a regulated financial entity's core systems, the seizure can trigger a parallel compliance question about whether the entity's own ICT risk controls held up, independent of the criminal investigation itself. The two tracks run separately: a weakness exposed by a search does not automatically become a criminal matter, and a criminal suspicion does not automatically establish a regulatory failing.
Disputed claims that cannot go the summary route: the numbers
If a search reveals sums the company owes, or is owed, that the other side genuinely disputes, those amounts cannot be recovered through the simplified summary process reserved for uncontested debt. Once a claim is contested on a substantive basis, it moves into ordinary litigation, which runs on a different timetable and requires a different kind of evidence than the search itself produced.
What to do next
The steps above cover the mechanics of the search: who authorises it, what officers may take, and where the process runs into its own limits. They do not answer the separate question of how strong the case built on the seized material actually is, which requires looking at the specific documents taken and the specific allegation they are said to support. That assessment sits within our economic crime defence practice, and where the underlying suspicion concerns bookkeeping irregularities specifically, the practical first moves are set out in what the first ten days after a bookkeeping allegation involve.
Book a preliminary assessment to go through the protocol and what was actually seized, before deciding what, if anything, needs to be challenged.