The Economic Crime and Corporate Transparency Act 2023 introduces a new corporate criminal offence of failure to prevent fraud.

The failure to prevent fraud offence aims to shift the corporate culture around fraud prevention in large organisations so that it’s not only the individual(s) committing the fraud who get prosecuted but potentially the corporation itself for not maintaining a culture of deterrence and control. Business owners must ensure their organisation fully complies with this new legislation by 1^st September 2025.

In this blog, we’ll look at the new offence and the steps you should take to prepare for the changes.

Introduction to economic crime prevention

The new offence applies to large organisations and is designed to prevent fraud and promote corporate transparency. The offence also applies to organisations with overseas employees or subsidiaries, which may be liable for fraud committed abroad.

Organisations must implement reasonable procedures to prevent fraud. Otherwise, they may be held criminally liable for fraud committed by associated persons.

The Home Office provides guidance and a framework for preventing fraud and ensuring compliance with the new legislation.

Which companies does the failure to prevent fraud offence relate to?

The offence applies to large, incorporated bodies and partnerships across all sectors of the economy.

A “large organisation” is defined as meeting two or three out of the following criteria:

• More than 250 employees.
• More than £36 million turnover.
• More than £18 million in total assets.

These criteria apply to the whole organisation, including subsidiaries, regardless of where the organisation is headquartered or where its subsidiaries are located. The conditions apply to the financial year of the organisation that precedes the year of the base fraud offence. It includes organisations incorporated or formed by any means, including (but not limited to) incorporation by:

• The Companies Act 2006
• Royal Charter • Statute (for example NHS Trusts)
• The Limited Liability Partnerships Act 2000
• The Co-operative and Community Benefit Societies Act 2014.

 When does the failure to prevent fraud offence come into effect?

The failure to prevent fraud offence comes into effect on 1 September 2025. The aim is to allow companies to develop and implement comprehensive fraud prevention procedures and have these in place by the effective date.

Who is responsible for the detection and prevention procedures within the organisation?

The responsibility for preventing and detecting fraud lies with senior management, the board of directors or partners in the organisation. The level of their responsibility will depend on the structure and size of the organisation.

Senior management, company directors or partners are likely to be responsible for:

• Design and implementation of a clear governance structure across the organisation.
• Ongoing top-level commitment to budget allocation for resourcing and training around the company’s fraud prevention plan.
• Implementation of reasonable procedures across the organisation.
• Risk-based prevention procedures.
• Endorsement and communication of the organisation’s fraud prevention measures, policies and procedures.
• Fostering an organisational culture where fraud is challenged proactively.
• Due diligence to prevent a fraud offence.

Understanding fraud offences

A wide range of offences and fraud risks will be included in the new fraud offence, including, for example:

• Any fraud committed to benefit the organisation or its clients.
• False statements by company directors.
• Failing to disclose important information to customers or investors.
• Participation in fraudulent businesses.
• False representation.
• Abuse of position.
• False accounting.
• Fraudulent trading.
• Obtaining services dishonestly.
• Cheating the public revenue.
• Mis-selling or false sales practices.

Associated persons to the organisation, including employees, agents, and subsidiaries, can commit fraud offences that may lead to the organisation being held liable and prosecuted.

Associated persons do not include those in the supply chain or franchises.

We recommend you seek legal advice on more detailed definitions of the above.

The offence will be considered alongside existing law. For example, an individual in the company who commits fraud may also be prosecuted individually for the offence, while the organisation may be prosecuted for failing to prevent that fraud.

What are reasonable prevention procedures?

Guidance suggests that reasonable fraud prevention measures are based on six principles, which are:

1. Top-level commitment.
2. Risk assessment.
3. Proportionate risk-based prevention procedures.
4. Due diligence.
5. Communication (including training, monitoring and review).
6. Monitoring and review

Compliance strategies and risk assessments

Companies must conduct thorough risk assessments to identify areas of risk and implement reasonable prevention procedures to prevent fraud in the organisation.

The risk assessment should consider the level of risk, effectiveness of controls, and the level of control to be exercised.

Risk assessment should be documented, dynamic, and regularly reviewed to ensure the effectiveness of the fraud prevention plan.

Due diligence should be applied when establishing and reviewing third-party relationships.

Sector-specific guidance

There is no plan for the government to issue sector-specific guidance. However, individual sectors that are high-risk (for example, the financial services sector) may choose to develop sector-specific guidance that includes more detail on prevention measures regarding the specific risks in that sector. Refer to the official sector body websites for more information. For example, UK Finance has published sector-specific guidance to assist financial services firms in preparing for the new failure to prevent fraud offence.

Implementation and next steps

Organisations should review and implement reasonable fraud prevention procedures before the new offence comes into force on 1st September 2025.

Reviewing your fraud prevention procedures should not be a one-off exercise; it is essential to assess and update them regularly, taking into account changes in your company’s risk profile.

It’s advised to read the Home Office guidance when preparing for these changes. You can find these guidance notes here.

The government guidance notes provide examples to help companies determine whether they are at risk of being held liable for fraud.

Your company may not be prosecuted for fraud if it has reasonable procedures in place to prevent it.