New Offence

On 1 September 2025, the UK’s new corporate ‘failure to prevent fraud’ offence introduced under the Economic Crime and Corporate Transparency Act 2023 (ECCTA) will come into force.

The new offence is part of wider corporate crime reforms in the UK. It targets large organisations with the aim of encouraging a shift in the corporate culture around fraud prevention, encouraging organisations to take proactive measures. The offence makes it easier to prosecute and fine large organisations for failing to implement fraud prevention measures, thereby closing loopholes that have allowed organisations to avoid prosecution in the past.

Large Organisations

The offence applies to all organisations (including its subsidiaries and overseas organisations with a UK presence) that meet two of the following:

– more than 250 employees

– more than £36 million turnover

– more than £18 million in total assets.

Employees of subsidiaries or a parent company that is a large organisation can bring the parent company within the scope of the offence. The offence should also be considered in the context of any future mergers or acquisitions.

Criteria

Whilst revisions are awaited, the government has issued corporate guidance which is available here via the gov.uk website.

There are three elements to the new offence. An organisation can be held criminally liable where a specified fraud offence is:

1. Committed by an employee, agent, subsidiary or person associated with the company on behalf of the organisation. The scope of the offence is broad and senior management do not need to know about the fraud for the organisation to be liable. Previously, corporate liability for fraud would have required evidence of wrongdoing at a senior level. This will no longer be the case.

2. With the intention of benefiting the organisation or its clients. The intention to benefit the organisation or its clients does not need to be the sole or dominant motivation for the fraud. It can be a secondary motive. The benefit in question also does not need to be financial. The organisation or its clients do not need to receive any actual benefit for the offence to have occurred. The intention is sufficient.

3. The specified fraud offences are contained in Schedule 13 ECCTA. They include:

Dishonesty

Dishonesty is a requirement of the offence, the test for which has changed in England for criminal cases. It requires consideration of what the defendant’s actual state of knowledge of the relevant facts was and whether, based on those facts, the conduct was dishonest by the standards of ordinary people.

Penalty

Organisations found liable can be subject to an unlimited fine.

Defence

It will be a defence if an organisation can show that it had in place ‘reasonable fraud prevention procedures’. The government guidance (see link above) sets out six principles of an organisation’s expected fraud prevention framework:

  1. top-level commitment,
  2. risk assessment,
  3. proportionate risk-based prevention procedures,
  4. due diligence,
  5. communication (including training),
  6. ongoing monitoring and review.

This new offence, together with recent changes to the identification principle (the test applied to determine where there is corporate criminal liability for actions of individuals), and the definition of ‘dishonesty’ will make it easier to prosecute organisations and for there to be a heightened chance of conviction.

Contact Our Team

There is a short implementation period for organisations to review and tailor their fraud prevention procedures to meet the specific needs and risks of the business. If you would like to discuss how our team can support your business please contact us for further information.

Disclaimer: This information is for general information purposes only and does not constitute legal advice. It is recommended that specific professional advice is sought before acting on any of the information given. Please contact us for specific advice on your circumstances. 

Cyber Essentials certification is a UK government backed security standard that demonstrates an organisation has implemented the key technical controls needed to protect against the most common cyber threats.

This field is for validation purposes and should be left unchanged.
Name(Required)