The UK's Failure to Prevent Fraud Offense: A Guide to the New Corporate Criminal Liability, Extraterritorial Reach, and the 'Reasonable Procedures' Defense

For decades, prosecuting large corporations for economic crimes in the United Kingdom required navigating a notoriously difficult legal labyrinth. Law enforcement agencies had to prove that the "directing mind and will" of the company—typically the board of directors or senior executives—was directly involved in the illicit activity. This high bar meant that while individual rogue employees were frequently jailed, the corporate entities that profited from their actions often escaped criminal liability entirely.[5]

That era of corporate immunity effectively ended on September 1, 2025, when the "Failure to Prevent Fraud" offense officially came into force. Introduced as the cornerstone of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), the legislation represents the most significant overhaul of the UK's financial crime compliance landscape since the Bribery Act of 2010.[4]

The new law fundamentally rewrites the rules of corporate accountability by introducing a strict liability standard. Under the ECCTA, an organization is automatically held criminally liable if an "associated person" commits a specified fraud offense with the intention of benefiting the company or its clients. Prosecutors no longer need to prove that senior management knew about, authorized, or orchestrated the fraud.[4]

The scope of the legislation is deliberately expansive, targeting what the government defines as "large organizations." To fall within the law's crosshairs, a company must meet at least two of three financial thresholds in the preceding year: more than 250 employees, an annual turnover exceeding £36 million, or total assets surpassing £18 million.[1]

Crucially, these thresholds are calculated on a consolidated, group-wide basis. A parent company cannot shield itself by isolating its operations into smaller subsidiaries. If a subsidiary commits a fraud that benefits the parent organization, the parent can be prosecuted directly.[4]

The definition of an "associated person" is equally broad, extending far beyond direct employees. The term encompasses agents, subsidiaries, consultants, and third-party service providers who perform services for or on behalf of the organization. This means a company could face criminal charges if an external contractor inflates invoices or falsifies data to secure a contract that benefits the parent firm.

Perhaps the most consequential aspect of the new offense is its aggressive extraterritorial reach. The law is not confined to businesses headquartered in the UK. A multinational corporation based in New York, Tokyo, or Frankfurt can be prosecuted in London if the underlying fraud has a "UK nexus."[1][4]

A UK nexus is established if an essential element of the fraud occurred within the United Kingdom, or if the fraudulent activity targeted UK-based victims. Consequently, global entities with even a tangential operational footprint in the UK have been forced to overhaul their global compliance frameworks to mitigate their exposure.[1]

The legislation covers a comprehensive list of "base fraud" offenses detailed in Schedule 13 of the ECCTA. These include fraud by false representation, failing to disclose information, abuse of position, false accounting, fraudulent trading, and cheating the public revenue. Aiding or abetting any of these crimes also triggers corporate liability.[4]

For organizations caught in the crosshairs, the consequences of a conviction are severe. The law empowers the courts to levy unlimited financial fines. Beyond the immediate financial penalty, a conviction carries devastating reputational damage, potential exclusion from public procurement contracts, and intense ongoing regulatory scrutiny.[4]

There is only one statutory defense available to an organization facing prosecution: it must prove, on the balance of probabilities, that it had "reasonable procedures" in place to prevent the fraud at the time the offense occurred. Alternatively, the company must prove that it was reasonable under the circumstances not to have any procedures in place—a highly unlikely scenario for a large enterprise.

To guide businesses, the UK Home Office published a detailed framework outlining six core principles for reasonable procedures. These principles require top-level commitment from the board, comprehensive risk assessments, proportionate risk-based prevention procedures, rigorous due diligence on third parties, continuous communication and training, and ongoing monitoring and review.

As the law moves through its first full year of enforceability in 2026, the regulatory expectations have crystallized. The Serious Fraud Office (SFO) and the Crown Prosecution Service have made it unequivocally clear that a static, "tick-box" compliance policy sitting in a document library will not hold up in court.[2]

In its updated 2026 guidance for evaluating corporate compliance programs, the SFO emphasized a shift toward a performance-based model. Prosecutors are instructed to evaluate the actual, day-to-day operation of a company's controls. Organizations must provide concrete evidence that their procedures were actively tested, enforced, and capable of identifying risks before the fraud materialized.[2]

This represents a massive operational shift for compliance teams. While the "reasonable procedures" standard mirrors the "adequate procedures" required under the UK Bribery Act, fraud presents unique and complex challenges. Bribery typically involves outbound payments to secure an advantage, making it somewhat easier to track through financial ledgers.

Fraud, by contrast, is often deeply embedded in internal business processes. It can manifest as an employee manipulating sales data to hit a bonus target, a manager hiding vital information from investors, or a subsidiary engaging in dishonest sales practices to boost quarterly revenue.[5]

To build a defensible program, legal advisors are urging companies to conduct exhaustive, fraud-specific risk assessments. Organizations cannot simply recycle their existing anti-money laundering or anti-bribery frameworks; they must map out the specific opportunities, motives, and means by which an associated person could commit fraud to benefit the business.[1]

The enforcement landscape is rapidly intensifying. The Home Office's May 2026 Fraud Strategy Framework signaled a sharp uplift in enforcement resources, and the SFO's 2026-2027 Business Plan prioritized intelligence-led investigations and faster-moving corporate prosecutions.[2][3]

For large organizations globally, the grace period for adapting to the ECCTA has officially expired. The burden of proof has shifted entirely onto the corporate board, transforming fraud prevention from a theoretical best practice into an urgent, strictly enforced legal mandate.[5]