The failure to prevent fraud offence came into force on 1 September 2025.1 Under section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), a large organisation can now be prosecuted when an employee, agent, subsidiary or other person providing services on its behalf commits a fraud intending to benefit it, unless the organisation can prove it had reasonable procedures to prevent that fraud.2 Directors do not need to have known about the fraud, let alone ordered it.3 This guide explains what the offence is, who is in scope, how far it reaches, how the defence works, how it fits with ECCTA’s wider changes to corporate criminal liability, and what boards should do over the next 90 days.
What the failure to prevent fraud offence is
A relevant body, meaning a body corporate or partnership wherever it is incorporated or formed, commits the offence if it is a large organisation and, in one of its financial years, a person associated with it commits a fraud offence intending to benefit, directly or indirectly, either the body itself or any person to whom (or to whose subsidiary undertaking) the associate provides services on the body’s behalf.2 The second limb captures fraud committed for the benefit of clients, for example by a firm’s staff acting for a customer. Where the organisation itself was, or was intended to be, the victim of a fraud committed for its clients’ benefit, it does not commit the offence under that limb.2
This is a corporate offence of omission. The organisation is not being prosecuted for the fraud itself but for failing to prevent it. The individual fraudster does not need to be prosecuted for the organisation to be held liable, although the prosecution must still prove the underlying fraud to the criminal standard.3
The base fraud offences
The offence is triggered only by the fraud offences listed in Schedule 13 to the Act, or by aiding, abetting, counselling or procuring one of them.42
| Jurisdiction | Base fraud offences in Schedule 13 |
|---|---|
| United Kingdom-wide statute | Fraudulent trading (Companies Act 2006, section 993) |
| England and Wales, and Northern Ireland | Fraud (Fraud Act 2006, section 1); participating in a fraudulent business carried on by a sole trader (section 9); obtaining services dishonestly (section 11); cheating the public revenue (common law) |
| England and Wales | False accounting and false statements by company directors (Theft Act 1968, sections 17 and 19) |
| Northern Ireland | False accounting and false statements by company directors (Theft Act (Northern Ireland) 1969, sections 17 and 18) |
| Scotland | Common law fraud, uttering and embezzlement |
Fraud under section 1 of the Fraud Act 2006 includes fraud by false representation, by failing to disclose information and by abuse of position.3 In practice, that brings into scope misleading statements to customers, investors, lenders, funders and regulators, manipulated accounts and performance data, and falsified compliance or testing records. The Home Office guidance gives examples including accounts manipulated to attract investors, an investment fund falsely promoting a company as sustainable, falsified right-to-work checks by a recruiter, and falsified environmental monitoring data submitted to a regulator.3
Intention to benefit
The associate must intend to benefit the organisation or its clients, but no benefit needs to be received. According to the guidance, the benefit can be financial or non-financial, direct or indirect, and it need not be the fraudster’s main motive: a salesperson who misleads customers to earn commission also intends to benefit the employer that receives the sales.3 Frauds aimed purely at the organisation, such as an employee stealing from it, fall outside this offence, although they remain a serious risk in their own right.
Penalties and enforcement
On conviction on indictment the penalty is a fine, with no statutory maximum; on summary conviction in Scotland or Northern Ireland the fine cannot exceed the statutory maximum.2 The guidance notes that cases may be prosecuted by the Serious Fraud Office or the Crown Prosecution Service, by the Crown Office and Procurator Fiscal Service in Scotland, and by the Public Prosecution Service in Northern Ireland, and that self-reporting and cooperation are taken into account, including when considering a deferred prosecution agreement.3 Beyond the fine, the reputational, contractual and regulatory consequences of a conviction are likely to matter more to most boards.
Which organisations are in scope
The offence applies only to large organisations. A relevant body is large if it met at least two of the following three conditions in the financial year before the year in which the fraud took place: turnover of more than £36 million, a balance sheet total of more than £18 million, and more than 250 employees.5 Employee numbers are the average of the monthly headcount over that year, and turnover is adjusted proportionately where the financial year is not a full year.5
For a parent undertaking, the test is applied to the whole group, meaning the parent and all its subsidiary undertakings, by aggregating their figures.6
| Condition (two of three needed) | Single entity | Group headed by a parent undertaking |
|---|---|---|
| Turnover | More than £36 million | More than £36 million net or £43.2 million gross |
| Balance sheet total | More than £18 million | More than £18 million net or £21.6 million gross |
| Employees | More than 250 | More than 250 in aggregate |
Two group features catch people out. First, a subsidiary in a large group can commit the offence where one of its own employees commits fraud intending to benefit it, even if the subsidiary would not be large on its own figures. Second, a subsidiary’s employees are associated persons of the parent, so the parent can be liable where such an employee commits fraud intending to benefit the parent.23
The offence is not limited to companies. The guidance states that it applies across all sectors of the economy: some charities are incorporated and would be in scope if they meet the size test, and some public sector organisations, such as NHS trusts and incorporated local authorities, are in scope. Unincorporated organisations other than partnerships are not.3
Who counts as an associated person
A person is associated with an organisation if they are its employee, agent or subsidiary, or if they otherwise perform services for or on its behalf. Whether someone performs services is decided by reference to all the relevant circumstances, not merely the nature of the relationship.2 The guidance adds several practical clarifications:3
- Supplying goods does not, by itself, make someone an associated person.
- Providing services to the organisation, as external lawyers or auditors typically do, is different from providing services for or on its behalf, and does not on its own create association.
- Agents are associated only when acting in their capacity as agents, and partners in a partnership are associated persons.
- Small suppliers and franchisees can be associated persons where they provide services for or on behalf of a large organisation.
- Fraud committed in someone’s private life, outside their capacity as an associated person, does not create liability.
For most organisations, the hardest part is simply knowing who all these people are. Sales agents, introducers, outsourced customer service providers, recruitment agencies and contractors embedded in operations are often managed by different departments with no single list.
Territorial reach: the UK nexus
A relevant body can be incorporated or formed anywhere, and proceedings can be brought in any part of the UK.2 The limiting factor is the base fraud, which must have a UK connection. The guidance explains that this means an act forming part of the fraud took place in the UK, or that the gain or loss occurred in the UK. On that basis, an overseas organisation can be prosecuted if its associate commits fraud in the UK or targets victims in the UK, and a UK-based employee’s fraud can expose the employer wherever it is based. Conversely, a UK organisation whose overseas staff commit fraud abroad with no UK connection would not be caught.3 International groups should therefore map where their UK exposure sits rather than assume that only UK entities are affected.
What counts as reasonable fraud prevention procedures
The organisation has a defence if it proves that, when the fraud was committed, it had such prevention procedures as it was reasonable in all the circumstances to expect it to have, or that it was not reasonable to expect it to have any.2 The burden of proof is on the organisation, on the balance of probabilities. The Home Office guidance is not a safe harbour, departures from it do not automatically make procedures unreasonable, and it will rarely be considered reasonable not to have even conducted a risk assessment.3
The guidance sets out six principles:3
- Top-level commitment: the board and senior management own fraud prevention and build a culture in which fraud is never acceptable.
- Risk assessment: a documented, dynamic assessment of the organisation’s exposure to fraud by associated persons.
- Proportionate risk-based prevention procedures: procedures that are clear, practical, accessible, effectively implemented and enforced.
- Due diligence: risk-based checks on those who perform services for or on behalf of the organisation, and in mergers and acquisitions.
- Communication (including training): policies understood throughout the organisation, targeted training and effective whistleblowing arrangements.
- Monitoring and review: detection, investigation and periodic review, with lessons fed back into the framework.
We take each principle in turn, with the evidence to retain and the common gaps, in our article on failure to prevent fraud reasonable procedures. Two points from the guidance’s discussion of overlapping regimes are worth stressing here. A statutory audit cannot by itself provide a defence, and management should not rely solely on it. And while compliance with the UK Corporate Governance Code may contribute to the defence, it is not sufficient on its own; the Code’s revised provision on declaring the effectiveness of material controls applies to reporting years beginning on or after 1 January 2026.3
How the offence fits with senior manager attribution under ECCTA
Section 199 is not ECCTA’s only change to corporate criminal liability. Section 196, in force since 26 December 2023, provides that where a senior manager, acting within the actual or apparent scope of their authority, commits a relevant economic crime, the organisation is also guilty of that offence.7 A senior manager is an individual who plays a significant role in making decisions about how the whole or a substantial part of the organisation’s activities are to be managed or organised, or in actually managing or organising them. The relevant offences are listed in Schedule 12 and include fraud, false accounting, bribery, money laundering, tax and sanctions offences.78 Where no part of the offence took place in the UK, the organisation is liable only if it would have been guilty had it done the acts where they took place.7
The two provisions work together. Fraud by a senior manager can be attributed to the organisation directly under section 196, with no reasonable procedures defence, and section 196 applies regardless of the organisation’s size. Fraud by anyone else who is associated with a large organisation is addressed by section 199, where the defence is available. Senior manager is a functional test, not a job title, so heads of key functions, regional leaders and those running significant business lines may qualify. Boards should therefore treat the conduct of senior managers, and the controls over management override, as a direct corporate liability issue rather than a matter for individual discipline alone.
There is also overlap with the failure to prevent the facilitation of tax evasion offences. Cheating the public revenue is a base offence for both, but the fraud offence has a wider range of potential perpetrators, so procedures built for tax evasion may not be enough on their own.3
Carrying out a fraud risk assessment
The risk assessment is the foundation of the defence, because every other procedure should be proportionate to the risks it identifies. The guidance expects it to be dynamic, documented and kept under regular review, typically annually or every two years, with earlier or partial reviews when external developments warrant them.3 It suggests starting with the types of associated person, such as agents, contractors and staff in sensitive roles, and then using the fraud triangle:3
- Opportunity: which roles work with little oversight, where controls are weak or have been weakened, whether staff turnover creates gaps, and whether new technology such as AI opens new routes to fraud.
- Motive: whether bonuses, commissions, targets, funding deadlines or time pressure could encourage fraud.
- Rationalisation: whether the culture tolerates fraud that wins business, whether it is seen as common in the sector, and whether it is hard to speak up.
The guidance also asks organisations to consider emergency scenarios, to classify inherent risks by likelihood and impact with reasons, and to record any decision not to address a risk with the name and position of the person who authorised it.3
The most common weakness we see is an organisation presenting its existing fraud risk register. Those registers are usually built around fraud against the organisation: payment diversion, theft, procurement fraud, cyber-enabled fraud. The new offence requires the opposite perspective, asking where people acting for the organisation might deceive others to benefit it. A good assessment covers each business line and each type of associated person, links each risk to the base offences, and draws on evidence such as complaints, regulatory correspondence, audit findings, incentive data and whistleblowing reports, not just workshop opinion. Our fraud risk management work starts here.
Policies, training and speak-up arrangements
Procedures need to be proportionate to the risks identified and designed around the fraud triangle. The guidance points to measures that reduce opportunity, such as vetting, procurement controls, segregation of duties, conflict of interest management and access controls; measures that reduce motive, such as reviewing bonus structures and managing unrealistic time pressure; and clear consequences for breaches. It warns of “ethical fading”, where one-off frauds become normalised over time.3
Training should be proportionate, with extra focus on the highest-risk posts, and should explain the offence and the organisation’s procedures. Messages should come from middle management as well as the top, and third parties should either be trained or have their own arrangements.3 Whistleblowing arrangements deserve particular attention: the guidance points to board-level accountability, independent channels, protection against victimisation, prompt investigation and feedback.3 The Association of Certified Fraud Examiners’ 2024 Report to the Nations found that 43% of the frauds in its study were detected through tips.9 Make sure your speak-up materials say plainly that pressure to mislead customers, investors or regulators is reportable, not just theft and misconduct.
Monitoring and review
The guidance expects detection measures, such as analysis of procurement, payments and invoicing, data analytics and consideration of AI tools, with a named person collating fraud management information for the board. Investigations should have defined triggers and clear authorisation, be independent and appropriately resourced, report to the board and feed lessons back. The framework itself should be reviewed formally and periodically, internally or by an external party, taking account of incidents, whistleblowing cases, staff feedback, and relevant prosecutions and deferred prosecution agreements.3
Because the defence is judged at the time of the fraud, the framework has to stay current. Where suspicions arise, an independent fraud investigation protects the integrity of the evidence and the organisation’s position, particularly if self-reporting is under consideration. Embedding fraud risk in the wider governance and risk management framework, rather than running it as a stand-alone compliance project, is what keeps it alive after the initial push.
What boards should do now: a 90-day action plan
With the offence in force, any fraud committed from 1 September 2025 will be judged against the procedures in place at the time. If your programme is incomplete, the priority is to close the most significant gaps quickly and to be able to show a reasoned, documented plan for the rest. The plan below is a practical sequence, not a statutory requirement.
| Period | Actions | Output for the board |
|---|---|---|
| Days 1 to 30: confirm and govern | Confirm whether each entity and the group meet the size test; appoint an accountable executive; agree terms of reference and budget; build a first inventory of associated persons (agents, introducers, outsourced providers, subsidiaries) | Scope paper and minuted board decision on ownership and resourcing |
| Days 31 to 60: assess | Complete or refresh the fraud risk assessment from the benefit-to-the-organisation perspective; review incentive schemes and targets; map existing controls to each priority risk; identify gaps against the six principles | Approved risk assessment, gap analysis and prioritised action plan, including any documented decisions not to address a risk |
| Days 61 to 90: act and assure | Issue the board statement and updated policies; deliver targeted training to high-risk roles; update contract clauses for higher-risk third parties; refresh speak-up materials; agree investigation protocol; schedule independent testing and the first formal review | Implementation report, training and communication records, and an assurance plan for the next 12 months |
Throughout, keep the evidence. A prosecutor, and later a court, will look for contemporaneous records showing what the organisation knew about its risks, what it decided and why. Audit committees should ask for the risk assessment, the gap analysis and the action log, and should challenge whether the assessment genuinely addresses fraud committed for the organisation’s benefit.
How we can help
Our fraud risk management service delivers failure to prevent fraud risk assessments, gap analyses against the six principles and practical improvement plans. We carry out independent fraud investigations when concerns arise, and our governance and risk management work helps boards embed fraud risk in their wider risk framework. We support corporates and listed companies wherever they operate. To talk through where your organisation stands, book a free 20-minute call.
This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.
Frequently asked questions
What is the failure to prevent fraud offence?
It is a corporate criminal offence in section 199 of the Economic Crime and Corporate Transparency Act 2023. A large organisation commits it when an employee, agent, subsidiary or other person performing services on its behalf commits a specified fraud intending to benefit the organisation or its clients. The organisation has a defence if it proves it had reasonable fraud prevention procedures in place.
Which organisations does the failure to prevent fraud offence apply to?
It applies to large bodies corporate and partnerships, wherever incorporated, that meet two of three tests in the previous financial year: turnover over £36 million, balance sheet total over £18 million, and more than 250 employees. For groups, the figures are aggregated across the parent and its subsidiaries. Incorporated charities and some public bodies can be in scope.
What is the penalty for failure to prevent fraud?
An organisation convicted on indictment faces a fine with no statutory maximum. Prosecutors can also consider a deferred prosecution agreement, and self-reporting and cooperation are taken into account. The reputational, contractual and regulatory consequences of a conviction can be at least as significant as the fine.
References
- legislation.gov.uk (The National Archives), 13 March 2025. The Economic Crime and Corporate Transparency Act 2023 (Commencement No. 4) Regulations 2025 (SI 2025/349)
- legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 199: Failure to prevent fraud
- Home Office, 6 November 2024. Economic Crime and Corporate Transparency Act 2023: guidance to organisations on the offence of failure to prevent fraud
- legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, Schedule 13: Failure to prevent fraud: fraud offences
- legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 201: Meaning of large organisation
- legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 202: Meaning of large organisation: parent undertakings
- legislation.gov.uk (The National Archives), 26 December 2023. Economic Crime and Corporate Transparency Act 2023, section 196: Attributing criminal liability for economic crimes to certain bodies (version in force from 26 December 2023)
- legislation.gov.uk (The National Archives), 26 December 2023. Economic Crime and Corporate Transparency Act 2023, Schedule 12: Economic crimes
- Association of Certified Fraud Examiners, 20 March 2024. ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case
