Media, disclosure and the listed company: what to do in the first ten days comes down to three moves taken in order: verify internally before saying anything externally, run the disclosure test before a leak forces it, and put one named person in charge of every external contact. None of this waits for counsel to arrive on schedule.
Who this concerns
This situation starts the same way almost every time. A journalist calls the press office with a detail that could only have come from inside the company or from a law-enforcement file. Or an authority executes a search of business premises, known in Swedish as husrannsakan, and a photographer is outside before the general counsel has finished reading the warrant. Or a whistleblower, frustrated with the internal channel, goes straight to a business desk instead. In every version, the company learns that the story is already moving before it has finished establishing what actually happened.
It concerns the board, the general counsel, the CFO and whoever runs investor relations, because all four have a duty running at the same time and those duties are not aligned. The board owes a duty of oversight. The GC owes a duty to protect privilege and the integrity of any internal investigation. The CFO and IR owe a duty to the market. None of them can discharge their duty by waiting for the others to finish, and the standard crisis-communications plan, written for a product recall or a data breach, assumes a single narrative that the company controls. Here the company does not control the narrative from day one, and the economic crime defence practice exists largely to manage that gap.
Whether the underlying allegation later proves founded or not is irrelevant to the first ten days. The exposure clock starts on the leak, the raid or the call, not on the outcome of any investigation that follows.
What the law says
Under Swedish law as it currently stands, a listed company carries a continuing obligation to keep the market informed of matters the market is entitled to know without delay, and that obligation sits in the same period as, and often in direct tension with, the confidentiality that attaches to an ongoing law-enforcement matter. A preliminary investigation carries its own secrecy regime, referred to as förundersökningssekretess, meaning the authority conducting it is not obliged, and is often not permitted, to confirm or deny details to the press or to the company under investigation. The company is left to decide, on its own facts and largely on its own judgement in the first instance, whether what it knows crosses the line into information the market must receive.
That decision cannot be delegated to the press office and cannot be made by silence. Saying nothing is itself a choice with disclosure consequences, and it is not automatically the safer one. Equally, a public statement issued before the underlying facts are verified can create a second problem independent of the first: a statement that turns out to be inaccurate, made under pressure to look responsive, does more lasting damage to the company's position than a short delay taken to get the facts straight.
Where the parent company sits outside Sweden, or where the shares are dual-listed, or where a major shareholder is a foreign institutional investor, the picture does not simplify. A foreign regulator or a foreign stock exchange may have its own continuous disclosure regime running in parallel, on its own clock, and coordinating a single public position across two disclosure regimes at once is materially harder than meeting either one alone. Translation delay, time-zone lag between the Swedish and the foreign legal team, and a foreign parent's own instinct to comment publicly before the Swedish position is settled are the three most common ways a manageable situation becomes an unmanageable one within the first days.
How it works in practice
The first hour: what not to say
The instinct in the first hour is to say something, anything, to look responsive. Resist it. A holding statement that commits the company to no position beyond "we are aware of the matter and are establishing the facts" buys time without creating exposure. Anything beyond that, offered under pressure before the facts are checked, becomes a fixed point the company has to defend or retract later.
Verifying the facts before anyone drafts a line
Before any external line is drafted, someone with authority to do so has to establish what the company actually knows, as distinct from what the journalist or the leaked material claims. This is not the same exercise as the underlying investigation; it is a narrow, fast check of whether the specific facts reported are accurate, partly accurate, or wrong. Conflating the two slows everything down.
The disclosure test, run in writing
The question of whether the situation now amounts to information the market is entitled to receive is not a communications judgement. It has to be answered by the people responsible for market disclosure, working from the verified facts, and the answer and its reasoning should be recorded in writing at the time, not reconstructed afterward. A written record made in the moment is worth far more, later, than a well-argued explanation produced under scrutiny months on.
Naming one person for every external contact
Every additional person authorised to speak to a journalist is another version of the story in circulation. One named contact, briefed on exactly what can and cannot be confirmed, is not a communications preference; it is a control measure. Everyone else, including well-meaning senior people who take a call because they happen to answer the phone, is told to redirect without comment.
Journalists: what to confirm, what to decline, what to never say
A journalist working a story rarely needs the company to confirm everything; they need one detail confirmed to run with what they already have. Confirming a fact that is genuinely public, or already established, costs little. Declining to comment on an ongoing legal matter is a legitimate and common position, and does not need to be dressed up as anything else. What should never happen is an off-the-record characterisation of the underlying allegation, offered informally to sound cooperative; off the record is not a legal category the company can rely on.
Employees, counterparties and the market in parallel
Employees who see the story before they hear from the company internally will assume the worst and may speak to journalists themselves, with less discipline than the person now managing the press. Key counterparties who might otherwise call a contract or a facility on reputational grounds need to hear from the company before they hear from the newspaper. All three audiences, employees, counterparties and the market, are moving on their own clocks, and a message accurate for one can be premature or incomplete for another.
Days six to ten: closing the loop
By the second week the initial pressure has usually eased, and the risk shifts from what to say to what has already been said. This is the point to check that the holding position, the disclosure filing if one was made, and whatever was told to employees and to the largest counterparties are all consistent with each other and with the facts as they stand now, not as they were assumed to be on day one.
What to check
- Who inside the company has actually spoken to a journalist, on or off the record, and what was said
- Whether a disclosure decision was made and recorded in writing, and by whom
- Whether the holding statement issued to the press matches what employees were told internally
- Whether any counterparty has been given an informal assurance that could contradict a later public position
- Whether privilege over the internal fact-finding has been preserved, or waived without anyone deciding to waive it
- Whether a foreign parent, co-listed exchange or foreign shareholder has made, or is about to make, its own public statement
Does the company have to comment if a journalist already has the story?
No. A journalist having the story does not create a legal obligation to comment on it. The company's obligation is to the market, not to the press, and a considered "we are establishing the facts" position, held consistently, meets that obligation better than a rushed comment made only because the story is already out.
Who inside the company should be the only point of contact with the press?
One person, agreed in advance and briefed on the exact line, usually from investor relations or the general counsel's office rather than a business unit head. The choice matters less than the discipline of having only one, because every additional speaker multiplies the number of things the company later has to reconcile.
What happens if the company says nothing at all?
Silence is a legal position with its own consequences, not an absence of one. If the underlying facts turn out to require market disclosure, prolonged silence can itself become the problem the company has to answer for, separate from whatever the original allegation was.
The numbers
The ten-day frame in the title is a working period, not a statutory deadline; no fixed number of hours or days for a disclosure decision is set out generically here, because none applies uniformly across situations, and stating one would overstate what is actually required. What is consistent is the principle that information the market is entitled to receive must reach it without unjustified delay once the company has established that the threshold is met, and "without delay" is assessed against what the company actually knew and when, not against a fixed clock.
What drives the cost and duration of managing the first ten days is not the underlying allegation itself but a handful of practical factors: how many people inside the company already know the detail that leaked, whether trading in the company's shares has visibly moved before any statement was issued, whether more than one disclosure regime applies because of a foreign parent or a dual listing, and whether the authority involved has itself made any public statement that the company now has to sit alongside. Each of those factors adds coordination, not complexity to the law itself, and coordination is what consumes the time.
Where it usually goes wrong
Silence held too long is read by the market and by employees as an admission, even where the underlying facts do not support one; a holding position needs periodic, deliberate maintenance, not a single statement left to stand indefinitely. A statement drafted by investor relations without legal review is the second common failure, usually because speed was prioritised over coordination, and it tends to say more than the verified facts support. Reassuring a major shareholder informally, in a phone call meant to be helpful, creates a private position that can directly contradict the public one once a formal disclosure is made, and shareholders remember which version they were given first. Waiving privilege over the internal fact-finding, by sharing draft findings with the press office or with a shareholder before counsel has decided that sharing them is safe, is rarely reversible. And treating the raid or the leak and the market disclosure question as a single clock, when they in fact run on separate tracks with separate obligations, is the single most common source of an avoidable second problem stacked on top of the first.
What to do next
Everything above can be run by the company itself in the first days, with the general counsel's office coordinating IR, the board and whoever is speaking to the press. Where it stops being something the company can safely run alone is the point where the facts still need to be established with any rigour: reading the leaked material against internal records, establishing who inside the organisation actually had access to what leaked, and scoping whether a formal internal investigation is now required before the authority, if one is involved, moves further. That scoping question is addressed directly in the internal investigation timeline, which sets out what changes once an authority is actively involved rather than merely rumoured to be.
Beyond that point, the right next step is not more reading but an assessment of the company's specific exposure against its own documents, its own disclosure history and its own shareholder base. Book an assessment call once the holding position is in place; the call is for deciding what the documents actually show, not for deciding whether to hold the line for another day.