The failure to prevent fraud offence

For a long time it was difficult to prosecute a company, as opposed to an individual, for fraud. Prosecutors generally had to show that the "directing mind and will" of the company, in practice the most senior people, was personally involved. In large organisations that was rarely provable.

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) changed this. It created a new corporate offence of failure to prevent fraud, which came into force in September 2025.

How the offence works

A large organisation can be criminally liable where a person associated with it, such as an employee, agent or subsidiary, commits a fraud intending to benefit the organisation or its clients. Crucially, the prosecution does not need to show that directors ordered the fraud or even knew about it. The organisation is on the hook for failing to prevent it. The penalty is an unlimited fine.

Who counts as a large organisation

The offence applies to organisations that meet at least two of these three criteria:

• 250 or more employees
• More than £36 million in turnover
• More than £18 million in total assets

The reasonable procedures defence

An organisation has a defence if it can show it had reasonable fraud prevention procedures in place at the time, or that it was reasonable not to have such procedures in the circumstances. This mirrors the approach of the Bribery Act 2010 and its "adequate procedures" defence.

In practice, reasonable procedures means things like a documented fraud risk assessment, proportionate controls over payments and procurement, due diligence on third parties, clear reporting routes, and regular training. Training like this course is itself part of an organisation's reasonable procedures. That is one reason you are doing it: awareness among staff is one of the controls regulators and courts expect to see.