On 1 September 2025, the new corporate offence of failure to prevent fraud will come into force - under the Economic Crime and Corporate Transparency Act 2023 (ECCTA). The implementation of this offence marks a significant step change in corporate accountability, shifting the focus from reacting to fraud, to proactively preventing it. There are potentially serious consequences for organisations that fall short and do not take preventative action as required.

While many businesses may already have some level of financial crime prevention in place, this new offence requires detailed scrutiny of the processes and procedures relied upon. In this article, part of our Understanding ECCTA series, our fraud and asset recovery experts highlight what organisations need to know – regardless of whether or not the organisation meets the statutory threshold.

For more information about ECCTA, read our first Understanding ECCTA article, which provides a summary of the key provisions.

What is the new offence?

At its core, the new offence imposes criminal liability on a relevant body (a large organisation) if they fail to prevent fraud committed by an associated person for their benefit.

Under Section 199 of ECCTA, an organisation will commit the offence where:

  • A person associated with the relevant body commits a specified fraud offence,
  • Intending to benefit the relevant body (or a person to whom the associated person provides services on behalf of the relevant body),
  • And the relevant body did not have reasonable fraud prevention procedures in place.

The offence is a strict liability one — meaning there is no need to show complicity or even knowledge of senior management. The only available defence will be if the relevant body has reasonable procedures in place to prevent fraud, at the time the fraud took place. Proactive risk management and governance is therefore essential.

Who does the offence apply to?

The offence applies to a relevant body, which is a "large organisation" that satisfies two or more of the following conditions:

  • it has more than 250 employees;
  • it has a turnover of more than £36 million;
  • it has a balance sheet total of more than £18 million.

It applies to UK and overseas companies and partnerships that carry on business in the UK. Notably, this includes parent companies, subsidiaries, and third parties, wherever located, if there is a UK connection.

A parent company can be a "large organisation" if, on an aggregate basis, the criteria apply to its subsidiaries, and a subsidiary will be capable of committing the offence if its parent company satisfies the large organisation test.

If a business does not fit the large organisation criteria it will not currently be in scope — but that does not mean the offence can be ignored. The Government in its Guidance (on the offence of failure to prevent fraud – issued in November 2024) has hinted that the scope of the failure to prevent fraud offence could be widened in future and - in any event - the principles to be adopted by large organisations represent good practice and could prove helpful to small and medium-sized organisations in any event. In addition, small and medium-sized organisations may be affected contractually. Larger businesses may begin imposing anti-fraud controls on their partners, requiring partners to have reasonable fraud prevention procedures in place before they can work together.

Who is an "associated person"?

The fraud must be committed by an associated person in order for the relevant body to be guilty of the failure to prevent fraud offence.

Essentially, anyone providing services for or on behalf of the relevant body can be an associated person, including:

  • employees, agents, subsidiaries – all of whom are automatically regarded as associated persons;
  • contractors, distributors, franchisees;
  • joint venture partners; and
  • payroll providers, HR service firms

Those providing services to the relevant body – rather than for or on behalf of – will not be an associated person. The Guidance lists those likely to provide services to the relevant body (and therefore are not an associated person) as including external auditors, valuers, lawyers and engineers.

WHAT fraud offences are covered?

To be guilty of an offence the associated person must commit a specified fraud. In accordance with Schedule 13 of ECCTA a specified fraud includes the following:

  • fraud by false representation and fraud by failing to disclose information (Section 2 & 3 Fraud Act 2006 offences);
  • fraud by abuse of position, participating in a fraudulent business and obtaining services dishonestly (Section 4, 9 & 11 Fraud Act 2006 offences);
  • false statements by company directors (Section 19 Theft Act 1968);
  • false accounting (Section 17 Theft Act 1968);
  • fraudulent trading (Section 993 Companies Act 2006);
  • cheating public revenue (common law); and
  • aiding and abetting any of the above.

What is meant by an intention to benefit?

The fraud must be intended to benefit the relevant body or the relevant body's customers or clients. Organisations will have accountability for fraudulent activities that benefit them directly, and for those that indirectly benefit them. If there is no intention to benefit the relevant body (or its customers or clients) there will be no offence. For example, if the offence is for personal gain the relevant body will not be liable.

The benefit does not need to be financial in nature and neither is it necessary for the fraud to succeed in conferring a benefit – it will be enough that the associated person intended that it would benefit the relevant body (or its customers or clients).

In addition, the benefit does not have to be the sole or primary purpose – for example, if a rogue employee manipulates results to boost bonus eligibility and to make the company look more profitable, the company can still be liable.

What defence is available? What do you need to do?

Organisations can avoid liability if they can prove they had reasonable fraud prevention procedures in place at the time of the offence.

What is considered reasonable will vary depending on the size, structure and risk profile of the organisation, and the size and complexity of its operations. The greater the risk of fraud, the stronger controls to prevent it will need to be. There is no rigid checklist or definition of what counts as "reasonable" fraud prevention, and the ECCTA does not proscribe what companies must do in order to prevent fraud.

Instead, the Guidance outlines six core principles that organisations should consider when designing their fraud prevention framework.

1. Top-level commitment

Leaders must foster a culture of integrity; they must be engaged and proactive with the organisation's fraud prevention measures. This means visible endorsement of anti-fraud policies, clear communication, a budget for compliance, and senior oversight.

Tip: Appoint 'fraud champions' or a senior risk owner and make fraud a regular board agenda item.

2. Risk assessment

Conduct a fraud risk assessment that is tailored to your business. You must identify where fraud might occur, why it might occur, and how those who are involved might justify their actions. Document decisions, even if the risk is low and ensure risk assessments are up to date.

Tip: Look beyond finance — sales targets, procurement processes, and third-party relationships often pose hidden risks.

3. Proportionate prevention procedures

Tailor prevention procedures to the risks identified in your risk assessment. This might include strengthened contracts, dual authorisation processes, fraud-focused internal audits, and updated whistleblowing channels.

Tip: Make sure fraud prevention is built into supplier and agency contracts.

4. Due diligence

Know who you're dealing with — and document it. That means enhanced onboarding, risk background checks, and regular monitoring for key suppliers and partners.

Tip: Conduct media, legal, and reputational screening for key partners, assess whether existing verification tools are robust enough and whether improved systems are required to provide earlier warning signs and help highlight issues.

5. Communication and training

Employees must know how to spot, prevent, and report fraud. Training should be practical and tailored — and regular – to ensure everyone understands their role in preventing fraud.

Tip: Include fraud scenarios in compliance training and onboarding and use internal surveys to check employees' understanding of fraud and reporting procedures.

6. Monitoring and review

Fraud risks change over time. Keep your prevention procedures under review and update them as needed.

Tip: Schedule annual (or more frequent) fraud risk assessment reviews, and maintain a log of fraud incidents, whistleblowing reports, and responses. Ensure diverse reporting channels are available to all employees.

ACT NOW — doing nothing Is NOT a defence

While there is no legal requirement under the Act to introduce new fraud prevention measures or procedures, doing nothing is unlikely to be enough to prove an organisation had reasonable protections in place if fraud subsequently occurs. Proactively taking steps now is key.

If an organisation already has robust anti-bribery or financial crime controls, reviewing and refining them may well be enough – but it will be essential to review them and document that a review has been undertaken.

At the very least organisations should:

  • conduct a fraud risk assessment;
  • evaluate existing controls against the six principles;
  • record decisions and rationale; and
  • update contracts, policies, and training where necessary.

Unlimited fines, reputational damage and regulatory scrutiny await those who fail to ensure their organisation has reasonable measures in place to prevent fraud.For those who prepare and ensure that procedures and processes in place (or implemented) are proportionate and tailored to their business - the risks can at least be managed and reduced.

If you have any questions about the issues raised in this article, please get in touch with Emma Carr, Catherine Naylor or David Lowe. To receive future articles in our Understanding ECCTA series and related insights, sign up to our mailing list.