Failure to Prevent Fraud guidance: next steps for businesses

Under Section 199 of ECCTA, a “relevant body” (i.e. a large organisation) commits an offence if:

• an associated person commits a specified fraud offence;
• with intent to benefit the organisation or its clients; and
• the organisation lacks adequate procedures for preventing fraud.

This is a strict liability offence — no need to prove senior management involvement.

The offence applies to UK and overseas companies and partnerships doing business in the UK that meet at least two of the following:

• over 250 employees;
• turnover over £36 million; and
• balance sheet total over £18 million.

It also applies to parent companies and subsidiaries if the group meets the threshold.

Even if your organisation is not currently in scope, you may still be affected contractually — larger partners may require anti-fraud controls.

Specified frauds include:

• fraud by false representation and fraud by failing to disclose information (Section 2 & 3 Fraud Act 2006 offences);
• fraud by abuse of position, participating in a fraudulent business and obtaining services dishonestly (Section 4, 9 & 11 Fraud Act 2006 offences);
• fraudulent trading (Section 993 Companies Act 2006);
• false accounting (Section 17 Theft Act 1968);
• false statements by company directors (Section 19 Theft Act 1968);
• cheating public revenue (common law); and
• aiding and abetting any of the above.

The fraud must be intended to benefit the organisation or its clients — even if the benefit is indirect or the fraud fails. For example:

• manipulating results to boost bonuses and company performance; or
• gaining contracts through misrepresentation.

The only defence is having “reasonable fraud prevention procedures” in place at the time of the offence.

The six principles of reasonable procedures:

1. Top-level commitment
   Leadership must be committed to anti-fraud efforts.

2. Risk assessment
   Identify and document fraud risks across all business areas.

3. Proportionate procedures
   Tailor controls to your risk profile — e.g. dual authorisation, whistleblowing channels.

4. Due diligence
   Vet those people who will be carrying out services for you with background checks and ongoing monitoring.

5. Communication and training
   Provide regular, practical training, make it mandatory and test understanding.

6. Monitoring and review
   Update procedures regularly and log incidents and responses – and feed them back into the risk assessment.