A new corporate fraud prevention law takes effect in the UK on 1 September 2025. This law, introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA), creates a “failure to prevent fraud” offence for businesses.
Below, we answer key questions to help your organisation understand the requirements and prepare for the enforcement date.
What is the new “failure to prevent fraud” offence?
This new corporate offence under the ECCTA holds large businesses liable if someone associated with them, such as an employee or agent, commits fraud intended to benefit the company. Businesses without adequate fraud prevention measures can face prosecution. The legislation takes effect on 1 September 2025, with no grace period. Companies need to act fast.
Who does this law apply to?
The “failure to prevent fraud” offence applies primarily to large organisations. Under the ECCTA, an organisation is considered “large” if it meets two out of these three criteria in a financial year: (1) global group turnover above £36 million – even if the UK operation is small, (2) balance sheet total over £18 million, or (3) more than 250 employees. This includes companies, partnerships, and certain not-for-profit organisations. Smaller companies are also liable when their employee commits fraud to benefit them if they are subsidiaries of large organisations. Small and medium-sized enterprises below these thresholds and not subsidiaries of large organisations are exempt from this particular offence, but any large UK-connected business, even those based abroad with a UK presence, will be in scope.
What must businesses do to comply?
Businesses should implement “reasonable fraud prevention procedures” to comply with the new law. This means taking proactive steps to deter and detect fraud within your organisation and by those acting on its behalf. The UK government has published broad guidance outlining principles that constitute reasonable procedures. In practice, organisations should consider:
- Risk assessment: Conduct a fraud risk assessment to identify areas where fraud might occur.
- Proportionate controls: Establish policies, controls and due diligence measures that are proportionate to your fraud risks. For example, vet third-party agents and monitor high-risk transactions.
- High-level commitment and training: Ensure senior management actively promotes an anti-fraud culture and provide training and communication so that staff and associated persons understand the fraud prevention policies.
- Ongoing monitoring: Regularly review and update your fraud prevention procedures and monitor their effectiveness.
Taking these steps can demonstrate that your company has a “reasonable procedures” defence, meaning if a fraud were to occur despite your precautions, you can show you took appropriate measures to try to prevent it.
What are the consequences of failing to prevent fraud?
If found liable, companies face criminal prosecution, unlimited fines, and serious reputational damage. UK authorities have emphasised a zero-tolerance approach, with Nicholas Ephgrave, Director of the Serious Fraud Office (SFO), warning: “Come September, if they haven’t sorted themselves out, we’re coming after them. I’m very, very keen to prosecute someone for that offence. Someone needs to feel the bite.”
How 3CS can help
Preparing for the ECCTA requirements can be a challenging task. At 3CS, we offer practical support to review your fraud prevention measures, identify risks, and ensure compliance. Contact our team for further guidance or assistance.
