Dealing with the economic crime authority: step by step, a company or individual under review moves through five broadly fixed stages: initial contact, preliminary investigation, interviews under caution, potential search or asset-freezing measures, and the prosecutor's charging decision. Each stage carries its own deadline and its own documentary demands, and the choices made in the first two weeks generally decide how the rest of the matter unfolds.
Who this concerns
This sequence applies to any company, board member, finance function or individual contacted by Ekobrottsmyndigheten (the Swedish Economic Crime Authority), the specialised prosecution authority that investigates and prosecutes suspected accounting offences, tax-related economic crime, breach of trust against a principal, market abuse, corruption and EU-funds fraud. It also applies to auditors, external accountants and advisers who receive a request for material rather than a formal notification of suspicion.
The trigger is usually one of three events: a letter announcing that a preliminary investigation (förundersökning) has been opened, an unannounced visit to collect documents and devices (husrannsakan), or a call inviting someone to attend an interview (förhör) as a witness or as a suspect. The economic crime defence practice exists precisely because the procedural path from that first contact to a charging decision is fixed in its stages but variable in its length, and the difference between a well-handled first week and a poorly handled one is rarely reversible later.
Companies with a parent, shareholder or main counterparty outside Sweden face an additional layer: requests for mutual legal assistance, extended deadlines while foreign authorities respond, and, in some cases, parallel proceedings abroad running on a different timetable. That layer is addressed separately below, because it changes what "step by step" actually means for a cross-border group.
What the law says
Sweden does not run a separate procedural code for economic crime. Ekobrottsmyndigheten operates under the same rules that govern any preliminary investigation and any subsequent prosecution, under Swedish law as it currently stands, with the distinguishing feature that its prosecutors and investigators specialise in financial and accounting matters and typically work alongside forensic accountants from the outset.
A person contacted in connection with a suspected economic offence has, at different stages, different rights and different exposure. A witness has an obligation to answer truthfully but no right to refuse to attend. A person who becomes formally suspected, skäligen misstänkt, gains the right to be informed of the suspicion, the right to a defence counsel, and the right to remain silent in interview. The shift from witness to suspect is a legal event with consequences, not a formality, and it is the single most important signal in the entire sequence.
The authority's investigative powers, search, seizure, provisional attachment of assets and access to electronic material, are exercised under judicial or prosecutorial authorisation depending on the measure, and each carries a route for challenge. None of the powers described here removes the underlying obligation on the authority to state, in writing, what is being investigated and on what basis.
How it works in practice
Step 1: the first letter or the first visit
Notification arrives in one of two forms. A written underrättelse states that a preliminary investigation has been opened, names the suspected offence in general terms, and either invites a response or announces an interview date. Alternatively, investigators arrive without warning to execute a search, in which case the notification and the search happen at the same moment. Neither form requires the recipient to have done anything wrong; a preliminary investigation can be opened on a report from a liquidator, an auditor's obligatory notification, a bank's suspicious-activity report, or a competitor's complaint.
Step 2: establishing status, witness or suspect
Before anything substantive happens, the recipient's procedural status needs to be established, in writing if it is not already clear from the letter. A witness and a suspect are asked different questions, face different consequences for what they say, and need different preparation. Where the letter is ambiguous, that ambiguity is worth resolving before any interview, not during it.
Step 3: the preliminary investigation runs its course
Once opened, the preliminary investigation proceeds through document requests, interviews of employees and counterparties, and, frequently, a forensic review of the company's bookkeeping. A company can be asked to produce material voluntarily or have it seized. The distinction matters for later argument about proportionality and about what happens to material that turns out to be privileged.
Step 4: the interview itself
An interview, förhör, is recorded and forms part of the case file whether the person attends as witness or suspect. A suspect has the right to have counsel present; a witness generally does not, but can request it in complex matters. Preparation before the interview, not during it, is what determines whether a factual account stays factual or drifts into speculation that later becomes hard to retract.
Step 5: search, seizure and asset-freezing
Where the authority considers evidence at risk of being destroyed or assets at risk of dissipation, it can execute a search and seize material, or apply for provisional attachment (kvarstad) of specific assets pending the outcome of the investigation. Both measures are challengeable, and both have a documented basis that the recipient is entitled to see.
Step 6: negotiation, closure or extension
Not every preliminary investigation ends in a charge. A significant share are discontinued for lack of evidence, redirected once the forensic accounting review narrows the suspicion, or resolved through a corporate fine (företagsböter) against the company rather than a prosecution of an individual. Extensions of the investigation period happen routinely in matters involving complex bookkeeping or a foreign counterparty, and are not, on their own, a sign that the matter is escalating.
Step 7: the prosecutor's decision
The preliminary investigation concludes with one of three outcomes: a decision to prosecute (åtal), a decision to discontinue (nedläggning), or, less commonly, a decision to waive prosecution despite sufficient evidence on public-interest grounds. That decision is the point at which the matter either moves to court or closes, and it is usually preceded by a final opportunity to respond to the material gathered, known as slutdelgivning.
What to check at each stage
- Whether the letter states witness status or suspect status in explicit terms, and if it does not, whether that has been clarified in writing.
- Which offence category is named, since the category determines both the available defences and which documents are likely to be requested next.
- Whether a deadline for a written response or for attendance is stated, and how that deadline was calculated.
- Whether the request for documents specifies systems, accounts or a date range, or is drafted broadly enough to be challenged on proportionality.
- Whether board minutes, internal memos or an internal investigation report already reference the matters under review, since those documents are usually the first the authority requests.
- Whether directors' and officers' liability insurance has been notified, and within what window the policy requires notification.
- Whether any material gathered for internal review purposes was created with legal advice in mind, which affects whether it can later be withheld as privileged.
Frequently asked questions
#### Does documentation that protects the board also help during an Economic Crime Authority investigation?
Some of it does, and some of it becomes the first material the authority requests. Minutes, resolutions and internal reports drafted to demonstrate board oversight are exactly the documents a forensic accountant reviews first, because they show what the board knew and when. Where that protection stops, and what changes the answer, is addressed separately in where board documentation stops protecting directors.
#### Does a foreign-owned company's registration duty under NIS2 have any bearing on an economic crime investigation?
Generally not directly, since NIS2 registration sits with a different authority and addresses a different risk category. It becomes relevant indirectly where the same group structure, the same foreign parent or the same compliance function is under scrutiny from more than one authority at once, which is increasingly common for groups with Swedish subsidiaries. The registration mechanics for foreign-owned entities are set out in NIS2 scoping and registration for foreign parties.
#### If a foreign claimant brings a related civil claim during the same period, can they be asked to post security for costs?
In many cases, yes. A foreign claimant without assets or domicile in Sweden can, depending on the circumstances, be required to post security to cover the defendant's costs if the claim fails, and that requirement can run entirely separately from the criminal investigation's own timetable. The mechanics are covered in security for costs from a foreign claimant.
The numbers
Sweden does not fix a single statutory deadline for concluding a preliminary investigation into suspected economic crime, and no responsible account of the process should invent one. What actually governs duration is the complexity of the bookkeeping under review, the number of interviews required, whether a forensic accountant needs to reconstruct transactions across several financial years, and whether any request for mutual legal assistance has gone out to another jurisdiction. A domestic matter confined to one company's own accounts moves at a materially different pace from one that involves a foreign parent, an intermediary counterparty, or assets held through a structure outside Sweden.
The same applies to cost. There is no meaningful published range for what defending against an Ekobrottsmyndigheten investigation costs, because the answer depends on the volume of material seized, whether a forensic reconstruction of the accounts is contested, how many interviews take place, and whether the matter proceeds to prosecution or is discontinued after the preliminary stage. What increases cost predictably is scope: the number of financial years under review, the number of jurisdictions involved in evidence gathering, and whether privilege over internal investigation material is disputed rather than accepted.
What can be stated with confidence is sequencing: status determination happens before the first interview, any challenge to a search or seizure happens within days rather than weeks, and the opportunity to respond before slutdelgivning is the last point at which new material can meaningfully change the prosecutor's assessment.
Where it usually goes wrong
The most common error is treating the first letter as correspondence rather than as the opening move of a procedure with its own clock. A company that takes two or three weeks to decide who should respond, and on what basis, has usually already lost the ability to shape how the initial document request is scoped.
The second is confusing an internal investigation with legal privilege. Material produced by a compliance team or an external accountant for management's own understanding of what happened is not automatically protected, and once it exists, it is discoverable. Whether specific material qualifies, and what has to be in place before it is created for that qualification to hold, is a narrower question than most in-house teams assume; it is addressed directly in protecting privileged material in the first ten days.
The third is assuming the criminal process and any parallel tax assessment run on the same track. Ekobrottsmyndigheten's preliminary investigation and the Tax Agency's own reassessment of the same transactions are procedurally independent, can reach different conclusions, and often proceed on different timetables, particularly where a foreign counterparty is involved and the tax question turns on transfer pricing or the substance of a cross-border arrangement. That divergence, and what it means for a company defending both fronts at once, is covered in the parallel tax case when a counterparty is involved.
The fourth, specific to groups with a parent or main counterparty outside Sweden, is underestimating how much longer the process takes once mutual legal assistance is required. A request to a foreign authority for banking records or witness statements adds a stage that Ekobrottsmyndigheten does not control and cannot expedite on request, and it is common for a Swedish preliminary investigation to sit dormant for months while a foreign response is awaited. Where the parent company also has its own reporting obligations or its own regulator, the two processes need to be coordinated deliberately; left uncoordinated, they tend to generate inconsistent statements that later damage both.
Where none of this applies, and the matter is a purely domestic one, confined to a single company's own accounts with no foreign element and no parallel civil claim, the sequence described above runs closer to its shortest version, and the main risk shifts from coordination to simple speed of response at the first two steps.
What to do next
Everything up to the point of an interview or a document request can be assessed against the letter itself, the company's own records and the checklist above, without engaging anyone. Once a formal suspicion is named, a seizure has taken place, or slutdelgivning has been served, the questions stop being procedural and start being about the strength of the evidence itself, which is a different kind of assessment.
A preliminary assessment of a specific notification, before any response is drafted, is the point at which this material stops being general and starts being about the letter actually received. Book a preliminary assessment with the timeline and any documents already in hand.