Partner Rachael Gregory details those that will be affected by the new offence of failure to prevent fraud, and explains how businesses can ensure that they are prepared for its implementation in September.

Rachael’s article was published in Fraud Intelligence, 24 January 2025.

Fraud is rampant across our society; it accounts for over 40% of crime in England and Wales and is the most commonly experienced crime. Almost two-thirds of British businesses are believed to have been victims of fraud, corruption or financial crime in the last 24 months.

The government is introducing new measures which attempt both to avoid businesses being defrauded and holding to account both those who are responsible for the frauds and, potentially, the companies they work for. From September 2025 businesses and the individuals who, maybe unwittingly, tolerate the conditions in which fraud can take place and fail to put in place sufficient measures to prevent it may be criminally liable.

Under the Economic Crime and Corporate Transparency Act 2023 (ECCT), which takes effect from next September, major corporations will be held more strictly to account for fraud committed by their employees, agents and associates who provide services on behalf of the organisation. And it gets personal. Under the new offence, directors or senior managers can be considered criminally liable for fraudulent conduct of others which may benefit the organisation – regardless of whether or not they were aware of the fraud or whether the organisation ultimately benefits.

As an example of the new rules, if an employee is engaged in dishonest sales practices or deceitful behaviour in financial markets then the company itself could face prosecution if the business could not demonstrate that it had adequate policies and procedures in place to prevent the fraud. This would also apply if employees were engaged in the practice of hiding significant information from its investors or consumers. Financial services companies could be particularly at risk due to the potential for mis-selling when dealing directly with the public. The offence would also apply when a fraud has been committed for the benefit of the organisation, even if there has been no actual advantage. So, even if dishonest sales practices did not result in any increase in sales, the organisation may still be liable under the new provisions.

The consequence of this is that in just nine months’ time the C-suite will be in the front line when it comes to accountability for what their staff might have done. And it is not just the staff – it is also any agents or associates acting on behalf of the business. All of which adds up to a major challenge to ensure that reasonable fraud prevention procedures have been put in place.

If there are any mis-steps in these procedures the consequences will be serious. If the organisation has benefited then directors and senior managers alike can, potentially, be held criminally liable for the fraudulent conduct. And, just to re-emphasise, that applies whether or not they were aware of what was happening. Claiming that you were ‘Not Aware’ of what was happening is no longer a passport to Innocence.

Is this unfair? Not really. The prevalence of fraud is due in no small part to the slackness in the conditions within which the fraudsters operate. In short, the Government would argue, the first big step towards ending fraud is by closing down the organisational loopholes and identifying the blind-spots which the fraudsters exploit. And that can only be done by the management – starting with the people at the top.

All this change represents a significant departure from the traditional common law concept of a ‘directing mind and will’ test which has been used to attribute criminal conduct to corporations. Until now the prosecution needed to identify a specific individual or individuals who could be regarded as having the sufficient involvement, knowledge and seniority to act as the directing mind and will of the company. This ‘identification doctrine’, as it was called, has meant that seniority alone has not been sufficient for a conviction.

However, we are now entering a new era in terms of corporate responsibility. As some experts have commented, the new guidance marks a major shift in tone, with affirmative corporate governance at its core, designed to ensure large corporations are properly held to account for committing serious crimes. So, while individuals who carry out fraud can still be prosecuted under existing laws, the crucial change is that the organisation which employs them will now face a prosecution too if investigators can reasonably conclude that it failed to prevent the crime.

In practice the terms of the new offence will shift the emphasis in prosecutions away from actual individual knowledge of fraudulent activity and towards businesses having the right safeguards in place to prevent wrongdoing in the first place. If an employee or agent has committed a fraud then, as a defence to prosecution, the organisation will need to be able to demonstrate that it had adequate policies and procedures in place to prevent fraud.

So, to whom exactly does this new legislation apply?

The primary (but by no means exclusive) focus will be on large organisations. According to the guidance issued by the Home Office, all companies will be liable who have more than 250 employees, a turnover of more than £36m, or total assets of more than £18m in the financial year preceding the year in which fraud offence occurred.

Moreover, this applies to the whole organisation, including subsidiaries, regardless of where the organisation is headquartered or where its subsidiaries are located. In other words overseas operations will also be subject to the new requirements. The new regime will include organisations incorporated outside of the UK, with the result that businesses registered in other jurisdictions may find themselves liable for actions of employees or associates carried out within the UK. This would include situations where part of the fraud takes place in the UK but could also apply where there are victims in the UK or, for certain offences, where there is a gain in the UK. Even if an organisation is based outside of the UK and doesn’t have any nexus here, it could still be liable for actions of a third-party service provider operating within the UK.

Accordingly, both UK and non-UK companies will need to assess whether the acts of their employees, subsidiaries, or agents are likely to give rise to liability for the company under the new offence.

In a nutshell then, no firm covered by these criteria will be able to claim ignorance of the SFO measures, because the precise definition leaves no room for misinterpretation. What this means is that smaller organisations can also be on the hook. If they are operating on behalf of a large organisation which itself is covered by the legislation, then they must comply as well. The Guidance states clearly that if an employee of a subsidiary of a large organisation commits fraud which is intended to benefit the subsidiary, then the subsidiary may be prosecuted for failure to prevent fraud even though it does not itself fall within the definition of being a large organisation. However small an outfit might be, if it is linked to or acting for a large organisation – thereby being what the legislation calls an ‘associated person’ – then it can be caught within the net of the new legislation.

Arising from all this the question for employers next September is what must they do to ensure they don’t fall foul of the legislation?

As the SFO’s director, Nick Ephgrave, has recently underlined, “Time is now running short for corporations to get their house in order.” He has also expressed the regulator’s determination to “act swiftly and send a strong signal to companies profiting from malpractice” and insisted that any behaviour proven to be fraud will not be tolerated by the watchdog.

This means that businesses should now take stock of their processes to identify where risks of fraud might lie and then review the appropriate policies and procedures to consider whether there is adequate fraud protection. For any areas of the business which have been identified as being particularly high risk then it is imperative that they are proactive in putting in measures to counter it. It might not be possible to forestall fraud 100% but it is vital to appear to have viable policies in place. I recommend reviewing a company’s systems and processes including undertaking risk assessments to identify areas of the business which may be particularly susceptible to fraud or/ and where the current procedures may be inadequate. The more steps a business can demonstrate taking to prevent fraud, the better placed it will be when the new legislation comes into effect and the more protected it will be from potential prosecution.