How to Respond to a Voluntary Disclosure Request

Responding to a voluntary disclosure request from a foreign anti-corruption authority is a cross-border compliance task, not an administrative form. The request may seek information about bribery allegations, suspicious transactions, agents or dealings in a particular country. Even if the authority calls the process voluntary, the facts may involve enforceable investigation powers, privacy restrictions, legal professional privilege or reporting duties. First, understand exactly what is being asked and what happens if the company does not respond.

The label “voluntary” usually describes the opportunity to provide a disclosure; it does not mean a company can ignore the approach or disclose indiscriminately. A request marked voluntary may still require legal assessment before information is sent. A defensible process separates authenticity, legal compulsion, internal fact-finding, privilege, confidentiality and approval. Treating every request as routine correspondence can damage credibility.

Australian organisations face a layered environment: the Commonwealth framework, National Anti-Corruption Commission, Australian Principles for Ethical Conduct, and state or territory rules may all matter. Australian-listed companies must consider Australian Securities and Investments Commission requirements, while the Privacy Act 1988 may affect personal information handling. Many firms based in Sydney, Melbourne or Brisbane coordinate overseas activity through regional hubs, agents and distributors, so one request can quickly reach several entities and records owners.

Local business culture also matters. Australian teams usually prefer a direct answer: what is known, what is not, who owns the next step and by when. That plain-spoken approach is useful if it remains precise and avoids admissions. A good first briefing should give senior decision-makers the request’s status, immediate risks, proposed workplan and decisions required. This supports a measured response without suggesting the investigation is complete.

Read the Request in Context

First, preserve the communication in native format. Record who sent it, the official address used, the delivery time and every attachment. Do not reply through an informal messaging channel or forward the request to employees without a legal hold in place. If the sender asks for a particular format, note the request but do not assume that format waives confidentiality, data minimisation or privilege protections.

Next, place the allegation and request in their factual context: which entity is named, which conduct is described, which period is covered and which country or transaction triggered contact. Separate allegations from verified facts and preserve original labels. Country exposure should also be checked against the Business Anti-Corruption Portal’s country risk profiles, which can help teams compare the legal and commercial context of the jurisdiction named in the request.

A request for voluntary disclosure is also distinct from a company-initiated self-report or application for leniency; do not treat participation in one process as consent to the other. The scope may be narrow, such as one payment trail, or broad, covering years of dealings across multiple entities. Assess each element separately. A reference to a “local partner” might reflect a genuine investigation or a misunderstanding of the group structure. A written issue map prevents assumptions from becoming admissions.

Verify the Authority and Purpose

Authenticate the request before sharing substantive information. Use publicly listed contact details for the authority, not only the telephone number or web address in the message. Confirm the sender’s identity, role and authority, and ask for a reference number, legal basis and intended scope. Verification should be possible through an official channel, even if the message arrived from a familiar-looking address.

Determine whether the approach is a voluntary request, a formal information demand, an investigation notice or a settlement communication. The distinction affects deadlines, privilege, data-transfer restrictions and the risk of obstruction allegations. Some agencies do not use voluntary requests as a standard instrument, so the label should not be accepted without verification. If the status is unclear, obtain advice from Australian counsel and counsel in the requesting jurisdiction before responding.

Also test for escalation, fraud and coercion. Employees have received imitation approaches from criminals seeking company data. Do not make payment, provide system access or sign a certification merely because a request appears official. Keep copies of suspicious material and report it to the relevant internal or law-enforcement channel.

Preserve Records and Protect Privilege

Issue a legal hold as soon as the allegations are sufficiently defined. Suspend routine deletion for email, chat platforms, accounting systems, shared drives and mobile devices likely to contain relevant material. Preserve metadata, versions and original files. The hold should identify custodians, date ranges, systems and search terms, while avoiding an indiscriminate collection that would expose unrelated personal information.

Legal professional privilege needs separate analysis. It generally protects confidential communications made to obtain or give legal advice, but not ordinary compliance records or interview notes. In Australia, courts apply a narrow interpretation, so business teams should not assume an internal investigation automatically attracts privilege. Commentary available through the Laredo Lawyer can provide a broader reference, alongside advice from qualified Australian counsel.

Privilege review should occur before external disclosure, not after documents have been shared. Record each decision to withhold or redact a document, but do not describe the protected content in the response itself. Seek a protective order or confidentiality undertaking where appropriate. Limit distribution, encrypt transfers and use secure channels; sending a large file to a personal inbox can create a separate breach.

Assess Scope, Data and Legal Duties

Translate legal and technical terms carefully, especially where the request uses terms such as “bribery”, “benefit”, “failure to comply” or “deceptive conduct”. Their meaning can vary by jurisdiction and may describe conduct that is not prohibited in Australia. Record the authority’s terminology, map it to the facts and avoid adopting it as the company’s own legal conclusion.

If the request concerns India, compare the allegations with the portal’s India country snapshot and identify the relevant statutes, enforcement practices, sector rules and recent enforcement patterns. A corporate structure involving subsidiaries, joint ventures, agents or intermediaries should be mapped against the specific conduct alleged. The key is relevance: a useful country summary can direct enquiries, but it cannot establish what happened in the company’s records.

For Australian operations, assess the Privacy Act’s Australian Privacy Principles, confidentiality obligations, employment contracts, foreign blocking rules, secrecy laws and sector-specific obligations. Check whether the National Anti-Corruption Commission should be informed, whether an Australian reporting duty applies and whether the authority can lawfully obtain the requested material. International legal advice should identify conflicts between mandatory foreign rules and Australian confidentiality or privilege requirements.

Build a Controlled Response

The response should be coordinated, concise and based on verified evidence. A common structure is: request summary, company position, factual chronology, supporting records, gaps, remedial steps and requested next action. Use neutral language. Distinguish “we have no records”, “records are still being collected” and “the available records do not show the alleged conduct” because each carries a different evidentiary implication.

• Acknowledge receipt and identify the appropriate company contact.
• Confirm the authority, legal basis, scope and response deadline.
• State that information will be provided only to the extent permitted by applicable law.
• Request clarification where the request is vague, disproportionate or burdensome.

Prepare two documents: a substantive response for the authority and an internal decision note explaining what was disclosed and why. The internal note can expose gaps that a single perspective misses, much as the photography discussion of reflections and symmetry shows how another angle changes what is visible. Do not include unsupported accusations about competitors, agents or officials. Protect personal information and consider employment or contractual constraints before naming an employee or agent.

• Include a dated chronology tied to source records.
• Explain evidence gaps, ongoing reviews and material limitations.
• Identify relevant controls, remediation or cooperation measures.
• Reserve rights concerning confidentiality, privilege, data protection and completeness.

A production cover letter can record the sender, date, response deadline, production method, document range and named approvers. It should also identify withheld material at a safe level without disclosing privileged content. Keep the final response, source bundle, decision log and transmittal evidence together for later review.

Coordinate Across the Organisation

Assign one accountable owner, usually the compliance lead or general counsel, and establish a response team with defined roles for legal, company secretary, finance, internal audit, privacy, HR, communications and IT or forensics. Do not give every employee broad access to the allegations or records. The owner should maintain a decision log, a timeline and a single channel for questions from the authority.

For an ASX-listed company, the board, audit or risk committee and company secretary may need to assess notification consequences. A foreign inquiry does not automatically require market disclosure, but it may become material to continuous disclosure under the ASX Listing Rules, financial reporting or director oversight. Coordinate advice before contacting the market and notify insurers where the policy requires it.

Australian teams often work across offices and time zones, with records spread between Sydney, Melbourne and overseas hubs. A written issue tracker is more reliable than scattered chat messages: record each information request, owner, due date, dependencies and escalation status. Use external specialists where internal capacity or technical expertise is limited, while keeping commercial discussions and legal advice appropriately segregated.

Close the Loop

Monitor the request through closure and record every interaction, including calls, emails and oral clarifications. Track deadlines and dependencies, respond consistently with the organisation’s earlier statements and correct misunderstandings promptly. If new allegations emerge, reassess scope, preserve the response record and obtain further instructions before making admissions.

Use the review to test whether controls worked, where records were missing and which third parties need closer scrutiny. Remediation can include revised agent due diligence, stronger approval thresholds, targeted training and clearer escalation routes. Keep evidence of improvements because it may explain conduct and support future regulatory discussions.

The practical takeaway is to treat the first 24 hours as a controlled legal and factual triage: authenticate the request, preserve records, define privilege, map obligations, obtain counsel and release only verified information through a documented approval chain. That sequence creates a response that is helpful to the authority, safe for the company and capable of withstanding later scrutiny.