Questioning as a suspect and as a witness: what to do in the first ten days turns on the status assigned, because a suspect (skäligen misstänkt) may stay silent and have counsel present, while a witness must, with narrow exceptions, answer without that protection. The priority is confirming status in writing and instructing counsel before the next interview, not after.
Who this concerns
This concerns anyone who receives a call from Ekobrottsmyndigheten, the Swedish Economic Crime Authority, or the police asking them to attend a förhör (formal interview) in connection with an economic-crime investigation, whether the matter involves accounting irregularities, procurement fraud, market abuse or sanctions circumvention. It also concerns the company employing that person, because the company's own exposure, and its access to privileged material, can be shaped by how the individual interview is handled. Background on how a company's position is structured once an employee is drawn into an investigation sits within the economic crime defence practice.
Two roles are treated very differently by the process. A witness is asked to describe what they observed. A suspect is asked to account for their own conduct, and the interview record can be used to build a charge. The same person can move from one role to the other within a single investigation, sometimes within a single interview, and the shift is not always announced clearly at the moment it happens.
Where a counterparty, a parent company or the relevant assets sit outside Sweden, the position changes further. A witness based abroad may be interviewed on a rogatory basis or asked to travel; a Swedish subsidiary of a foreign group is frequently the entity that receives the first call, while the people who actually decide how to respond sit in another jurisdiction and hear about it second-hand. That gap between who is interviewed and who decides is where early missteps tend to originate.
What the law says
Under Swedish law as it currently stands, the line between a witness and a suspect turns on whether the person is, in the assessment of the investigating authority, reasonably suspected of the offence under investigation. That assessment is made by the police or prosecutor, not by the person being interviewed, and it can change during the course of the investigation without a fresh summons being issued.
A suspect has the right to remain silent and the right to have defence counsel present at the interview. Nothing said, or not said, in that capacity is treated as an automatic admission, although it can still be weighed against other evidence in the case as a whole. A witness, in contrast, is in principle obliged to answer truthfully, subject to narrow exceptions that mainly concern self-incrimination and certain protected relationships, and does not have the same right to have their own counsel present during the interview itself, although consulting counsel beforehand is standard practice for anyone with reason to be cautious.
The practical effect is that status determines the toolkit available in the room. Confirming which status applies, in writing rather than by assumption, is the first thing to establish before agreeing a date for the interview.
How it works in practice
The first phone call
The initial contact usually comes by phone from an investigator proposing a date for the interview. Attending as a witness is generally voluntary at this stage, but non-attendance after a formal summons carries its own consequences, and declining an interview as a suspect carries different weight again. The useful questions to ask on that first call are narrow: in what capacity is the person being asked to attend, what is the matter under investigation described as, and can that be confirmed in writing. Details of the allegation should not be discussed on the call itself.
Confirming the status in writing
Investigators are not always precise about status on a first approach, and the label used informally on the phone does not always match the formal position. Requesting written confirmation before the interview date removes that ambiguity and gives counsel something concrete to work from. If the person is formally notified of suspicion before or during the process, that notification itself is a meaningful event, not a formality, and it should trigger a pause before anything further is said.
Deciding whether to attend without counsel
A witness is not entitled to bring counsel into the interview room in the same way a suspect is, but nothing prevents consulting counsel beforehand, and doing so is sensible wherever the underlying facts touch the person's own conduct rather than someone else's. A suspect should not attend once status is confirmed without counsel present. The risk of proceeding alone is not dramatic in any single answer; it is that early answers set a narrative that is difficult to revise later without appearing inconsistent.
What happens inside the interview room
The interview is recorded, and the questions are designed to build a timeline rather than to test a single fact. Ambiguous or defensive answers become part of the permanent record in the same way as clear ones. The investigating officer's own notes and characterisations of what was said often carry as much weight later as the verbatim transcript, which is one reason precision in the room matters more than volume of explanation.
What the record is used for afterwards
The transcript becomes part of the case file and is drawn on for later decisions, including whether to proceed to a formal charge and what that charge should cover. It can also be put to the person again at trial. A later account that differs from the first interview, even where the difference is minor and explicable, tends to be read as inconsistency rather than as clarification, which is why getting the first account right matters more than getting it fast.
When the company needs to know
An employee's interview does not automatically trigger a company reporting obligation, but it frequently coincides with facts that do. Where the underlying conduct touches a regulated activity or a compliance failure that has its own notification clock, that clock can already be running independently of the criminal process. Where a subcontractor or supplier is also drawn into the same facts, it is worth checking whether contractual security requirements for suppliers and subcontractors limit what that party can disclose about the arrangement without separate consent.
Moving from witness to suspect mid-interview
The clearest signal that status is shifting is an officer stating that they must now inform the person of something before continuing. At that point the sensible response is to stop, ask for the interview to be paused, and have the new status confirmed before anything further is answered. Continuing on the assumption that nothing has changed is the single most common way a witness interview turns into evidence against the same person as a suspect.
What to check
- Written confirmation of the capacity, witness or suspect, for the scheduled interview
- Whether the summons names a specific offence or only a general matter under investigation
- Whether counsel can attend, and on what basis, privately instructed or appointed defence counsel
- Whether the company has an ongoing internal investigation that overlaps with the same facts
- Whether any documents to be discussed are covered by legal privilege
- Whether the individual has exposure separate from the company's own position, such as a director role
- Whether a decision has been made on legal cost coverage before the interview date
- Whether any subcontractor or supplier involved in the same facts is bound by contractual security requirements for suppliers and subcontractors that limit what it may disclose
What is the difference between being questioned as a witness and as a suspect?
A witness describes what they observed and is, with narrow exceptions, obliged to answer; there is no right to have counsel present at the interview table, though consulting counsel beforehand is standard. A suspect, described in Swedish practice as skäligen misstänkt, is asked to account for their own conduct, may remain silent, and has the right to counsel throughout the interview. Confirming which status applies before the interview date changes what preparation is needed.
Does the company need to make a formal report once an employee has been questioned?
Being questioned is not itself a reporting trigger, but it often coincides with facts that are. Where the underlying conduct touches a regulated activity, a sanctions exposure or a data incident, the company's own reporting clock may already be running independently of the criminal process; see our note on incident reporting and its deadlines for how that timeline is calculated.
Can material prepared for the defence be kept out of the investigation file?
Material created to obtain legal advice or to prepare a defence is, in principle, protected, but the protection depends on how it was created and who had access to it before the question arose. Internal notes, chat logs and draft memos written before counsel was instructed rarely qualify; see protecting privileged material for how that boundary is drawn in practice.
The numbers
There is no fixed statutory countdown that runs from the first interview; the ten-day window referred to here is a working discipline, not a procedural deadline. What does move on its own schedule is the investigation itself: further interviews, requests for documents, and any decision on formal suspect status can follow within days rather than weeks once a case is active.
Cost at this stage is driven less by hours billed than by three variables: whether the matter is still at witness stage or has moved to suspect stage, how much digital material has to be reviewed before the next interview, and whether a parallel internal investigation is running that has to be coordinated with the criminal one. A witness interview that stays a witness interview is inexpensive to prepare for. A suspect interview that follows an unprepared witness interview is not, because the earlier transcript is already part of the file.
The trade-off resembles a calculation made in a different context: how much to spend early against the cost of a worse position later. That arithmetic, applied to a different kind of dispute, is set out in our note on settlement and enforcement economics.
Where it usually goes wrong
Assuming witness status is fixed for the duration of the process is the most common error; status can shift mid-interview, and people who have not anticipated that are caught giving detailed answers in a capacity they no longer hold.
Assuming the employer will pay for counsel as a matter of course is a second one. The employee's interests and the company's interests are not automatically aligned, and company-funded counsel for an individual can itself become a point of conflict once the two positions diverge.
Assuming informal conversations with colleagues before the interview are protected is a third. They are not privileged, and messages exchanged before counsel is instructed can end up quoted in the file regardless of how sensitive their content feels at the time.
Assuming that repeated "I don't recall" answers are a safe default causes its own damage: credibility, once dented, affects how the rest of the account is read, including the parts that were accurate.
This reasoning stops applying, though, for genuinely peripheral witnesses with no plausible connection to the conduct under investigation. Instructing counsel for every routine witness interview is disproportionate; the calculus above becomes relevant once suspicion, however preliminary, has attached to the person or to a close colleague whose account might implicate them.
What to do next
This material covers the mechanics of the interview itself, not what a company does once an employee's status shifts to suspect; that is a separate and larger question, addressed in the company's position once an employee becomes a suspect.
Self-directed preparation reaches its limit where the case file itself needs to be read: whether the summons already states a specific offence, whether privilege has already been compromised by earlier internal communications, and whether the individual's interests and the company's interests still align. Once those questions are live, an assessment call is a more efficient next step than continuing to prepare in the abstract. Book an assessment.