Fraud – failure to prepare, and prepare to fail (and be fined!)
In one of the most significant reforms to company law, we will discuss the new corporate offence of ‘Failure to Prevent Fraud’ under the Economic Crime and Corporate Transparency Act 2023 (ECCTA) which came into force on 1 September 2025.
The new offence
There is a new strict liability offence (no need to show complicity or even knowledge) imposing criminal liability on specific large organisations if they fail to prevent fraud. The only defence available will be if reasonable procedures were in place to prevent fraud, at the time of the fraud.
A “relevant body” for the purposes of ECCTA is a UK or overseas company / partnership that carries on business in the UK (including parent companies, subsidiaries, and third parties, wherever located, if there is a UK connection) and must satisfy two or more of the following conditions:
> 250 employees
turnover > £36 million
a balance sheet total > £18 million
An offence is committed under section 199 of ECCTA, where:
- A person associated (which is an open-ended list which includes employees, agents, subsidiaries and contractors) with a relevant body, commits a specified fraud offence;
- That fraud offence is intended to benefit (directly or indirectly, it need not be financial or and the primary purpose) the relevant body (or a person to whom the associated person provides services on behalf of the relevant body – personal gain will not be covered); and
- The relevant body did not have reasonable fraud prevention procedures in place.ESG clauses are included in contracts to manage legal risks, align with reporting standards (whether voluntary or mandatory) and/or address stakeholder expectations. There are various factors which can affect the type of ESG clauses which may be incorporated into a contract, including the size of the parties and the nature and value of the transaction.
Small businesses are not necessarily off the hook. Government guidance issued in November 2024 suggested that the scope of the offence could be widened in future and that, in any event, such principles should be adopted as good practice by SMEs. It may also be the case that larger businesses start imposing their anti-fraud controls within their contracts with businesses of any size.
The fraud
To be guilty, a specified fraud must have taken place, which in accordance with Schedule 13 of ECCTA, which includes (but is not limited to):
- fraudulent trading (Section 993 Companies Act 2006);
- false statements by company directors (Section 19 Theft Act 1968);
- false accounting (Section 17 Theft Act 1968);
- fraud by false representation and fraud by failing to disclose information (Section 2 & 3 Fraud Act 2006 offences); and
- fraud by abuse of position, participating in a fraudulent business and obtaining services dishonestly (Section 4, 9 & 11 Fraud Act 2006 offences).
Sanctions and defence
The main criminal sanction for a failure to prevent fraud is an unlimited fine, which will come hand in hand reputational damage, regulatory scrutiny, and the possibility of director disqualification. We expect that initial fines will act as examples, with high fines levied. The only way to avoid liability is to prove that reasonable fraud prevention procedures were in place at the time of the offence.
Six core principles of ECCTA
ECCTA is not prescriptive about what must be done but Government guidance outlines six core principles that should be part of a fraud prevention framework.
- Top-level commitment: senior leadership must demonstrate a strong and proactive commitment to preventing fraud.
- Risk assessment: organisations must conduct tailored fraud risk assessments and document decisions, event where the risk is low.
- Proportionate risk-based prevention procedures: the prevention procedures should be appropriate and tailored to the identified risks.
- Due diligence: companies should know who they are working with and document it, from onboarding and background check to regular monitoring.
- Communication and training: there must be clear communication and training for employees on how to spot, prevent and report fraud under the prevention policies and procedures.
- Monitoring and review: the effectiveness of the procedures must be regularly monitored with a log of incidents, reports, responses and the decision-making process.
Proactively taking steps is key. Doing nothing will not be enough to prove reasonable protections against fraud, unless you have robust procedures already in place and are reviewed regularly.
If you would like to discuss anything in this article further, please contact:
Paul Jonson
Emma Haymes
Our Pannone x IHL is designed to bring you the latest news and legal developments relevant to in-house lawyers. If there are any areas you would like more information on or if you have any questions or feedback, please do not hesitate to let us know via our feedback form or get in touch with any member of our team.
Copyright in this publication is owned by Pannone Corporate LLP and all rights in such copyright are reserved. Pannone Corporate LLP is a limited liability partnership registered in England and Wales with number OC388393. Authorised and Regulated by the Solicitors Regulation Authority. A list of members is available for inspection at the registered office, 378-380 Deansgate, Manchester M3 4LY. We use the terms “partner” to refer to a member of the LLP.