TRW & Co · Investigations and financial crime
Failure to Prevent Fraud: Who Is in Scope and What Counts as Reasonable Procedures
The failure to prevent fraud offence, in force since 1 September 2025, makes large organisations criminally liable when an employee, agent or other associated person commits fraud intending to benefit them. No senior knowledge is needed. The only defence is proving that reasonable fraud prevention procedures were in place at the time, so the evidence must exist before anything goes wrong.
Key pointThe large organisation test is applied across the whole group, so a modest UK subsidiary of a large international group can be in scope, and its defence depends on a documented, dated fraud risk assessment that looks at sales incentives as well as controls.
At a glance
In force
The offence under section 199 of the Economic Crime and Corporate Transparency Act 2023 has applied to fraud committed on or after 1 September 2025.
Who is in scope
Bodies and partnerships meeting two of three tests: over 250 employees, over £36 million turnover, over £18 million total assets, measured across the group.
Base fraud offences
Schedule 13 lists fraud under the Fraud Act 2006, false accounting, false statements by directors, fraudulent trading, cheating the revenue and related offences.
The only defence
The organisation must prove, on the balance of probabilities, that it had reasonable prevention procedures, or that it was unreasonable to expect any procedures.
Six principles
Home Office guidance: top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, and monitoring and review of the framework.
Swipe or scroll →
The short answer: what the failure to prevent fraud offence means for your organisation
The failure to prevent fraud offence makes a large organisation criminally liable when an employee, agent, subsidiary or other person who performs services for it commits a specified fraud intending to benefit the organisation (or, in some cases, its clients). Nobody at board level needs to have known about or authorised the fraud. The only defence is to prove that the organisation had reasonable fraud prevention procedures in place at the time.
The offence was created by the Economic Crime and Corporate Transparency Act 2023 (ECCTA) and came into force on 1 September 2025. As of October 2026 it is fully live: conduct from that date onwards can found a prosecution, and investigators at the Serious Fraud Office (SFO) and the Crown Prosecution Service (CPS) have said they expect organisations to be able to show what they did to prepare.
For most in-scope businesses the practical question is no longer "does this apply to us?" but "could we prove to a court that our procedures were reasonable?" That is an evidential exercise, and the evidence has to exist before anything goes wrong.
The legal framework: ECCTA, Schedule 13 and the Home Office guidance
The offence sits in section 199 of the Economic Crime and Corporate Transparency Act 2023, with the list of "base fraud" offences in Schedule 13. Sections 201 and 202 define which organisations count as "large". Under section 204 the Home Office was required to publish guidance on reasonable procedures, and it did so in November 2024; the Home Office guidance on the failure to prevent fraud offence was updated in October 2025 to use the statutory term "subsidiary undertaking".
Which organisations are in scope?
The offence applies to incorporated bodies and partnerships, wherever incorporated or formed, that are "large organisations". A body is large if it meets at least two of three criteria in the financial year before the fraud: more than 250 employees, more than £36 million turnover, and more than £18 million in total assets. The criteria are measured across the whole group, including subsidiary undertakings outside the UK.
That group aggregation catches many businesses that think of themselves as mid-sized. A UK subsidiary with modest local numbers can be in scope because its parent group is large. Large charities that are incorporated, and incorporated public bodies, are also covered. Police forces and government departments are not.
What counts as a base fraud?
For England and Wales, Schedule 13 lists fraud under the Fraud Act 2006 (false representation, failing to disclose information and abuse of position), participating in a fraudulent business, obtaining services dishonestly, cheating the public revenue, false accounting, false statements by company directors and fraudulent trading. Aiding, abetting, counselling or procuring a listed offence also counts. Scotland and Northern Ireland have their own lists.
Money laundering and bribery are not base frauds for this purpose, because separate regimes deal with them. Bribery has its own corporate offence under section 7 of the Bribery Act 2010, covered in our guide to Bribery Act adequate procedures.
Who is an "associated person"?
An associated person is an employee, agent or subsidiary undertaking of the organisation, or anyone who otherwise performs services for or on its behalf. Whether someone performs services is decided on all the circumstances, not just the contract label. Employees of a subsidiary are also associated persons where they commit a fraud intended to benefit the parent.
How liability works in practice
Three conditions must be met. First, an associated person commits a base fraud. Second, they intend to benefit the organisation, directly or indirectly, or to benefit a person to whom they provide services on the organisation's behalf. Third, there is a UK nexus: one of the acts making up the fraud took place in the UK, or the gain or loss occurred here.
The benefit need not materialise; intention is enough. A fraud that gives the business an unfair commercial advantage, or that disadvantages a competitor, can qualify. An organisation is not liable where it was itself the intended victim of a fraud aimed at benefiting its clients.
The associated person does not have to be prosecuted or convicted first, but the prosecution must prove the base fraud to the criminal standard. A conviction for the failure to prevent fraud offence is punishable by a fine, and on indictment there is no statutory maximum. Prosecutors may also consider a deferred prosecution agreement (DPA) in appropriate cases, which we explain in our guide to deferred prosecution agreements.
The defence is about procedures "at the time the fraud offence was committed". A risk assessment written after a whistleblowing report, or a policy approved after an investigation starts, does not help. Date-stamp board papers, risk registers and training records now so you can show what existed and when.
Reasonable procedures: the six principles
The Home Office guidance says an organisation's fraud prevention framework should be informed by six principles. They mirror the Bribery Act model, but they are aimed at a much wider range of conduct, including mis-selling, misleading investors and dishonest accounting.
| Principle | What it asks for | Evidence a prosecutor will look for |
|---|---|---|
| Top-level commitment | The board and senior management own fraud prevention and set the culture | Board minutes, a named accountable senior manager, a clear statement against fraud |
| Risk assessment | A documented assessment of where associated persons have the motive, opportunity and rationalisation to commit fraud | A dated, reviewed fraud risk assessment covering each business line and third-party channel |
| Proportionate risk-based prevention procedures | Controls that match the risks identified, including for conflicts and incentives | Control design and testing, decisions not to mitigate a risk recorded with the approver's name |
| Due diligence | Risk-based checks on people who perform services, including agents, distributors and acquired businesses | Onboarding files, contractual fraud clauses, M&A due diligence on fraud risk |
| Communication (including training) | Policies are understood, and staff know how to raise concerns | Targeted training records, whistleblowing channels and how reports were handled |
| Monitoring and review | Detection, investigation and periodic review of the framework | Audit findings, investigation logs, updates made after incidents or business change |
The guidance is not a safe harbour. Following it closely will not guarantee a defence if the organisation faces particular risks it did not address, and departing from it is not fatal if the alternative measures were reasonable. The guidance also makes a pointed remark: it will rarely be reasonable not to have conducted a risk assessment at all.
The SFO has since published guidance on evaluating a corporate compliance programme, which confirms it will assess the reasonable procedures defence under section 199 as part of charging decisions, DPA negotiations and sentencing. That document is a useful checklist of what investigators will ask for.
Building a failure to prevent fraud programme: step by step
Most organisations already have anti-bribery, anti-money laundering or conduct risk controls. The task is to extend them to the base fraud offences, not to build a parallel bureaucracy. A workable sequence looks like this.
- Confirm scope. Apply the large organisation test at group level for each financial year, and map which entities, partnerships and joint ventures could be the "relevant body".
- Map associated persons. List employees, agents, introducers, outsourced service providers, distributors and subsidiaries that act for the business, and identify who performs services on its behalf.
- Run a fraud risk assessment. Work through each business line asking where someone could commit a listed fraud intending to benefit the organisation: sales targets, reporting to investors, tax, public contracts, product claims and ESG statements.
- Close the gaps. Add or adjust controls, incentives and approval limits. Where a risk is accepted, record why and who decided.
- Update contracts and due diligence. Add fraud prevention clauses, audit rights and termination rights to third-party contracts, and include fraud risk in acquisition due diligence.
- Train and communicate. Deliver role-specific training to higher-risk teams and make sure speaking-up channels work, including for contractors.
- Monitor, investigate and review. Test controls, investigate red flags promptly and review the framework at least when the business, its markets or its incentives change.
Our corporate investigations team often begins with a short gap analysis against the guidance, so the board can see quickly where the evidence of reasonable procedures is thin.
Illustrative scenario: a sales incentive problem
This scenario is illustrative only and does not describe any real client or case.
A UK-incorporated manufacturer belongs to a group with more than 250 employees and turnover well above £36 million. Its UK sales team is paid a large bonus on annual volume. Late in the year, two account managers tell customers that a product meets a safety certification it has not yet obtained, securing orders that lift the team over its target.
Those statements could amount to fraud by false representation, intended to benefit the company. Because the account managers are employees, the company could face a failure to prevent fraud prosecution even though no director knew. Its defence would depend on what it can show: had it identified mis-selling under target pressure as a risk? Did product claims need sign-off by compliance? Did the sales team receive training and know how to raise concerns?
If the answers are yes, and the documents prove it, the company has a credible defence and a strong position in any discussion with prosecutors. If the risk assessment never looked at sales incentives, the defence is much weaker, however good the rest of the compliance programme looks.
Risks and common mistakes
Assuming the offence only matters for financial services firms
The offence applies across every sector. Manufacturers, retailers, construction groups, technology businesses, charities and professional firms all have associated persons who could misstate facts to customers, investors, lenders or public bodies for the organisation's benefit. Financial services firms may already have strong conduct controls, but the guidance expects every in-scope organisation to assess its own fraud risks. Treating the offence as "someone else's problem" is the most common reason organisations have no documented risk assessment at all, which the guidance says will rarely be reasonable.
Measuring size at the wrong level
The large organisation test counts the whole group, including subsidiary undertakings worldwide. A UK company with 80 staff can still be in scope if its parent group crosses two of the three thresholds. Conversely, a subsidiary that is not itself large can be prosecuted where its own employee commits a fraud intended to benefit it and the parent group is large. Do the calculation for each financial year and keep the workings, because the test looks at the year before the fraud.
Copying the anti-bribery programme without adapting it
The six principles look familiar, but the risks are different. Bribery controls focus on payments, hospitality and intermediaries. Fraud risks sit in sales practices, financial reporting, investor communications, tax, regulatory submissions and product or sustainability claims. A programme that simply renames the anti-bribery policy will miss most of them. Reuse the governance and due diligence architecture, but run a fresh risk assessment built around the base fraud offences listed in Schedule 13.
Leaving incentives out of the risk assessment
Targets, commissions and bonuses are a recurring theme in the guidance because they create the motive and rationalisation for fraud. Organisations that review controls but not remuneration structures leave the biggest risk unexamined. Consider whether targets are realistic, whether bonuses can be clawed back for misconduct, and whether compliance has a say in incentive design for higher-risk roles.
Ignoring the wider change in corporate liability
Separately from this offence, the Crime and Policing Act 2026 extended the "senior manager" attribution test, first introduced by ECCTA for economic crimes, to criminal offences generally from 29 June 2026. That route has no reasonable procedures defence and no size threshold. It is a further reason to know who your senior managers are and what decisions they take. Our guide to corporate criminal liability for senior managers explains it.
Cross-border angle: overseas groups and Bangladesh-linked businesses
The offence applies to organisations incorporated anywhere if the base fraud has a UK nexus. A Dhaka- or Dubai-headquartered group that sells into the UK, raises money from UK investors or has UK customers can face liability where an associated person's fraud touches the UK, even if the employee works abroad. Conversely, a UK company is not liable for overseas fraud with no UK nexus.
For groups operating in the UK–Bangladesh corridor, the usual weak points are third-party agents, buying houses and supply chain intermediaries whose representations reach UK buyers or lenders. Due diligence and contract terms should be consistent across jurisdictions, and local law on whistleblowing, data transfer and employment must be respected when investigating. Our white-collar crime and anti-bribery and corruption teams work with TRW & Co colleagues in Dhaka and other offices on these issues.
What to do next: a board checklist
- Confirm in writing, for each financial year, whether the group meets the large organisation test.
- Appoint an accountable senior owner for failure to prevent fraud compliance and minute the board's commitment.
- Complete, date and approve a fraud risk assessment that covers incentives, third parties and every business line.
- Record decisions not to mitigate particular risks, with reasons and the approver's name.
- Update third-party contracts and acquisition due diligence to address fraud risk.
- Deliver targeted training and test that speaking-up channels work.
- Plan how you would investigate an allegation, including preserving privilege; see our guide to internal investigations.
- Review the framework after any incident, restructuring or new market entry.
If you want an independent view of whether your procedures would stand up as "reasonable", contact our London office at Holborn Gate, 330 High Holborn, London WC1V 7QH, or email info@trw.co. We advise on scoping, risk assessment, policy design and, where needed, investigations and engagement with prosecutors. Where advocacy in the higher courts is required, we instruct specialist counsel.
Frequently asked questions
01When did the failure to prevent fraud offence come into force?
The offence came into force on 1 September 2025. It applies to base fraud offences committed on or after that date, so conduct before it cannot found a prosecution under section 199. The Home Office published its guidance on reasonable procedures in November 2024 to give organisations time to prepare, and updated it in October 2025. As of October 2026, prosecutors expect in-scope organisations to be able to show the procedures they had in place from commencement onwards, including a documented risk assessment.
02Does the failure to prevent fraud offence apply to small businesses?
No. It applies only to large organisations, meaning those meeting at least two of three criteria in the preceding financial year: more than 250 employees, more than £36 million turnover and more than £18 million in total assets. These are measured across the group, including overseas subsidiaries, so a small UK subsidiary of a large group may be in scope. Smaller businesses can still be liable for fraud in other ways, including through the senior manager attribution rules extended by the Crime and Policing Act 2026.
03What are reasonable fraud prevention procedures?
There is no fixed list. The Home Office guidance says procedures should be informed by six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review. What is reasonable depends on the organisation's size, sector and specific risks. The guidance is not a safe harbour, and the court decides whether procedures were reasonable at the time of the fraud. A documented, current fraud risk assessment is the foundation, since the guidance says it will rarely be reasonable not to have one.
04Can a company be liable if its directors did not know about the fraud?
Yes. That is the point of the offence. Liability arises when an associated person commits a listed fraud intending to benefit the organisation, regardless of whether directors or senior managers ordered, knew of or approved it. The organisation's only answer is the reasonable procedures defence. This is a significant change from the traditional identification doctrine, under which a company was only liable if the fraud could be attributed to someone representing its directing mind and will.
05What is the penalty for failure to prevent fraud?
A convicted organisation is liable to a fine. On conviction on indictment there is no statutory maximum, so the fine can be substantial and is set by reference to sentencing guidelines and the circumstances. Beyond the fine, a conviction can bring debarment risks in public procurement, reputational damage and follow-on civil claims. Prosecutors may consider a deferred prosecution agreement as an alternative where the organisation self-reports and co-operates, and a credible compliance programme is relevant to that decision.
06Does the offence apply to overseas companies?
It can. The offence applies to bodies and partnerships wherever incorporated, provided they are large organisations and the base fraud has a UK nexus, meaning an act forming part of the fraud took place in the UK or the gain or loss occurred in the UK. An overseas group selling to UK customers or raising money from UK investors should therefore assess its exposure. A UK company is not liable for fraud committed abroad by its overseas staff where there is no UK nexus.
Sources and official materials
- Economic Crime and Corporate Transparency Act 2023, section 199 — The failure to prevent fraud offence and defence
- Economic Crime and Corporate Transparency Act 2023, Schedule 13 — List of base fraud offences
- Home Office: Offence of failure to prevent fraud introduced by ECCTA — Statutory guidance on reasonable procedures
- SFO Guidance on Evaluating a Corporate Compliance Programme — How the SFO assesses the reasonable procedures defence
- Fraud Act 2006 — Core fraud offences underlying the corporate offence
- Crime and Policing Act 2026 — Extension of senior manager attribution to all offences
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.