Failure to Prevent Fraud: What UK Boards Should Have in Place a Year After the ECCTA Offence Came Into Force

Original educational diagram. It does not depict a PJN Group office, person, client, transaction or real case. Sources shown in the diagram: Economic Crime and Corporate Transparency Act 2023, sections 199–202, and Home Office guidance; checked 6 October 2026.

The UK corporate offence of failure to prevent fraud came into force on 1 September 2025 under the Economic Crime and Corporate Transparency Act 2023 (ECCTA).

About a year on, the central board question is not whether a fraud policy exists. It is whether the organisation can show that its fraud prevention arrangements were reasonable, proportionate to its risks, implemented in practice and supported by evidence at the time any relevant fraud took place.

This article is about the UK framework only. The legislation applies across the UK, but the underlying fraud offences, prosecution arrangements and some procedural issues differ between England and Wales, Scotland and Northern Ireland. Organisations with operations elsewhere should obtain advice for those jurisdictions separately.

What the offence does

Section 199 creates a corporate offence for a “relevant body” that is a large organisation. Liability may arise where:

  1. An associated person commits a specified fraud offence.
  2. The associated person intended to benefit the organisation, directly or indirectly, or in certain circumstances a person to whom the associated person provides services for or on behalf of the organisation.
  3. The organisation did not have reasonable fraud prevention procedures in place when the fraud was committed.

The legislation does not require proof that directors or senior managers ordered, knew about or approved the fraud. The underlying fraud must still be established, but the organisation can face prosecution because of a failure to prevent it.

The specified offences are listed in Schedule 13. For England and Wales, the list includes fraud by false representation, fraud by failing to disclose information, fraud by abuse of position, obtaining services dishonestly, participation in a fraudulent business, cheating the public revenue, false accounting, false statements by company directors and fraudulent trading. Aiding, abetting, counselling or procuring one of the listed offences is also within section 199.

The precise list differs for Scotland and Northern Ireland. Boards should therefore avoid treating the England and Wales list as a complete description of every UK scenario.

The organisation itself does not have to receive the benefit. The Home Office guidance gives the example of a salesperson who commits mis-selling to increase personal commission while also increasing the company’s sales. A benefit to the organisation may be indirect, and the benefit does not have to be the fraudster’s only or main motivation.

The Act provides a limited exception where the organisation is itself the victim, or intended victim, of a fraud committed to benefit one of its clients.

Who is an associated person?

The definition is deliberately broad. An associated person may be:

The question is determined by the circumstances, not simply by the label used in a contract. This means that boards should consider more than employees and traditional agents. Depending on the relationship and the services being performed, relevant persons may include contractors, intermediaries and other service providers.

The Home Office guidance makes an important distinction: providing services to an organisation is not necessarily the same as providing services for or on behalf of it. An external professional adviser, for example, is not automatically an associated person merely because it supplies services to the organisation. The facts and the capacity in which the person acts matter.

Supply-chain companies are not automatically associated persons either. They may fall within scope where they provide services for or on behalf of the relevant body. The degree of control, supervision and proximity the organisation has over the relationship is relevant when designing reasonable procedures.

Which organisations are in scope?

The offence applies to large incorporated bodies and partnerships, including relevant organisations formed outside the UK where there is a UK nexus.

Under section 201, an organisation is large if it satisfies at least two of these three tests in the financial year preceding the year of the fraud offence:

Threshold Statutory test
Employees More than 250
Turnover More than £36 million
Balance sheet total More than £18 million

These are not simply a test of the UK subsidiary’s size in every group structure.

For a parent undertaking, section 202 applies group-level tests based on aggregate figures:

At least two of the three group tests must be met.

The Home Office guidance also explains that a subsidiary which is not itself large may still be prosecuted in particular circumstances. For example, where an employee of a subsidiary commits a fraud intended to benefit that subsidiary, section 199(2) may apply if the parent undertaking is a large organisation. A parent may also face liability where an employee of a subsidiary commits a fraud intended to benefit the parent.

International groups should not assume that incorporation outside the UK removes the risk. The guidance describes a UK nexus where, for example, an act forming part of the fraud takes place in the UK, or the gain or loss occurs in the UK. A UK-based employee may create exposure for an overseas organisation. Conversely, a UK organisation’s overseas employee or subsidiary committing fraud abroad with no UK nexus is not automatically within this offence.

What does “reasonable fraud prevention procedures” mean?

The statutory defence is that, at the time of the fraud, the organisation had prevention procedures that it was reasonable in all the circumstances to expect it to have in place. A further defence may apply where it was not reasonable to expect the organisation to have any procedures at all.

The Home Office guidance, published on 6 November 2024 and checked in its latest accessible version on 6 October 2026, is advisory rather than a fixed checklist. It expressly warns that following the guidance does not create a safe harbour. Equally, departing from a suggested measure does not automatically mean that procedures were unreasonable.

The guidance is structured around six principles.

1. Top-level commitment

Responsibility for fraud prevention rests with those charged with governance. The board and senior management should:

Board minutes should record meaningful challenge, decisions and actions. A general statement of ethical intent is unlikely to be persuasive if there is no evidence of ownership, funding or follow-through.

2. Risk assessment

The risk assessment should be documented, dynamic and specific to the organisation. It should identify:

The guidance suggests considering the fraud triangle: opportunity, motivation and rationalisation. It also recommends using information from audits, data analysis, investigations, whistleblowing reports, sector information and regulatory activity.

A risk assessment should be reviewed at appropriate intervals and sooner when there is a material change, incident, acquisition, new service, new intermediary or significant change in incentives.

3. Proportionate, risk-based procedures

The organisation should translate its risk assessment into a fraud prevention plan. Procedures should be clear, practical, accessible, implemented and enforced.

Potential measures include segregation of duties, reconciliations, approval controls, conflict-of-interest processes, access restrictions and controls around financial reporting. Procurement and sales controls should cover the full lifecycle, including tendering, contract management, delivery and extensions.

The guidance does not require every organisation to adopt identical controls. An employee with authority to approve payments may require different controls from a contractor with limited access and supervision. The organisation should document why its procedures are proportionate and why any identified risk has not been addressed with a particular measure.

4. Due diligence

Due diligence should be risk-based and cover people who perform, or will perform, services for or on behalf of the organisation.

Boards should expect management to consider:

The Home Office guidance notes that due diligence designed for a different purpose may not address fraud risk adequately. Existing anti-money laundering, sanctions or anti-bribery checks may contribute, but they should be mapped against the specific fraud risks identified.

5. Communication, including training

Policies should be communicated, understood and embedded. Training should be proportionate to risk, with tailored content for higher-risk roles and relevant associated persons.

Training should explain:

Completion records, assessments, refresh cycles and evidence of targeted training are important. Training that exists only as an untracked policy document is unlikely to demonstrate effective implementation.

6. Monitoring and review

Monitoring should cover three connected activities:

  1. Detection of actual or attempted fraud.
  2. Independent and properly scoped investigation of concerns.
  3. Assessment of whether prevention measures are working.

Relevant evidence may include analysis of payments, procurement, invoicing and access data; records of alerts and investigations; whistleblowing trends; due-diligence updates; contractual reviews; control testing; and management information reported to the board.

An audit may help identify fraud risks, but the Home Office guidance states that an audit alone is not a defence. Nor does compliance with another regulatory framework automatically establish reasonable procedures for ECCTA purposes.

How existing compliance frameworks fit

The offence overlaps with, but does not replace, existing controls.

Anti-money laundering controls address money-laundering risks and regulated firms’ obligations. Sanctions controls address prohibited dealings and restrictions. Anti-bribery and corruption controls address bribery risks, including the separate failure-to-prevent bribery offence under the Bribery Act 2010. Financial reporting controls, whistleblowing systems and internal audit may also reduce fraud opportunities.

These systems can be integrated to avoid unnecessary duplication. However, the organisation should test whether each relevant control addresses the specific fraud risk, associated person and beneficiary scenario identified in its ECCTA risk assessment.

The model is similar in principle to section 7 of the Bribery Act: corporate liability is linked to conduct by an associated person and a defence is based on appropriate preventive procedures. The ECCTA offence is not identical. It applies only to large organisations, covers a defined list of fraud offences and uses its own statutory wording and guidance.

What remains uncertain?

The offence is relatively new. As at 6 October 2026, a review of the official legislation, Home Office material and publicly available CPS and SFO information did not identify a publicly reported conviction under section 199. That should not be read as evidence that enforcement risk is low, or that investigations do not exist. It means that reported judicial guidance on the offence remains limited.

Several questions therefore remain to be tested in practice:

The practical distinction between having procedures and proving that they were reasonable at the relevant time may become particularly important. Evidence, not policy volume, is likely to matter.

Board checklist

A board may wish to ask management:

PJN Group is a family of connected companies with shared ownership, with businesses across the UK, UAE, Croatia/Europe and India and expertise including advisory, due diligence and cross-border work. This article does not attribute fraud-prevention, audit or legal services to PJN Group and makes no claim about its regulatory permissions or compliance arrangements.

This article is general educational information, not legal advice. The thresholds, wording and guidance discussed are UK-specific, and the application of the offence depends on the organisation’s structure, activities, relationships and facts. Boards and senior management should obtain advice from appropriately qualified advisers before relying on any conclusion for a particular organisation.

Sources checked on 6 October 2026