A corporate offence of failing to prevent fraud has been in force across the UK since 1 September 2025, and it can catch a large business even when no senior manager knew about the wrongdoing. This article explains who is covered, how the defence works and why the rules matter to smaller London firms that supply bigger ones.
What does the offence actually say?
The offence was created by the Economic Crime and Corporate Transparency Act 2023 and sits in section 199 of the Act. According to the legislation, a large organisation commits an offence if an “associated person” commits a fraud offence intending to benefit the organisation, or intending to benefit someone to whom that person provides services on the organisation’s behalf.
GOV.UK guidance for organisations stresses a point that distinguishes the offence from older corporate liability rules: prosecutors do not need to show that directors or senior managers ordered or knew about the fraud. The question is whether the organisation had adequate procedures in place to prevent it.
There is an important exception. An organisation is not liable where it was, or was intended to be, the victim of the fraud. The offence is aimed at fraud committed for the organisation’s gain, such as misleading customers or investors, rather than fraud committed against it.
Which frauds count?
The offence is tied to a list of specified offences in Schedule 13 to the Act. They include:
- fraud, participation in a fraudulent business and dishonestly obtaining services under the Fraud Act 2006;
- false accounting and false statements by company directors under the Theft Act 1968;
- fraudulent trading under the Companies Act 2006;
- cheating the public revenue, a common law offence.
Aiding, abetting, counselling or procuring one of these offences is also covered. The GOV.UK guidance offers examples of the kind of conduct that could fall within scope: diverting pension contributions to other projects, manipulating accounts to attract investors, misleading investment marketing, falsified right-to-work checks by a recruitment partner, and falsified environmental discharge data sent to a regulator.
Is your organisation “large”?
Only large organisations are within the offence. Section 201 of the Act says a body is large if it meets two or more of three conditions in the financial year before the year of the fraud:
| Test | Threshold |
|---|---|
| Turnover | More than £36 million |
| Balance sheet total | More than £18 million |
| Employees | More than 250 (average headcount) |
The guidance says these criteria are applied across the whole group, including subsidiary undertakings. Unincorporated organisations, other than partnerships, are out of scope. Incorporated charities and other not-for-profits, and incorporated public bodies, can be covered, while police forces and government departments are excluded.
A worked example of the two-of-three test
Illustrative arithmetic shows how the test works. Take a London professional services group with 180 employees, £40 million of turnover and a £20 million balance sheet. It exceeds the turnover and balance sheet thresholds, so it meets two of the three conditions and is large, despite having fewer than 250 staff. A second group with 300 employees, £30 million of turnover and a £15 million balance sheet meets only the headcount condition. It is not large under the test.
The Secretary of State can change the thresholds by regulations, so the figures are worth re-checking.
Who counts as an associated person?
The definition is broad. Under the Act, employees, agents and subsidiary undertakings are associated persons, as is anyone else who performs services for or on behalf of the organisation. Whether someone performs such services is judged on all the relevant circumstances rather than just the label on their relationship.
According to the GOV.UK guidance, that can include contractors and suppliers, whether or not there is a direct contract. Providers of services to the organisation, such as external lawyers or accountants, are generally not caught. A parent company can also be liable where an employee of a subsidiary commits fraud intending to benefit the parent.
For a London business with outsourced sales teams, agency recruiters or franchised operations, this definition deserves careful reading. The organisation does not need to employ someone for their conduct to matter.
Does the offence reach overseas groups with London operations?
Yes, where there is a UK connection. Under the Act, a relevant body is any body corporate or partnership, wherever incorporated or formed, and it can be prosecuted anywhere in the UK regardless of where the offence took place.
The guidance explains the UK nexus. An overseas organisation is covered if part of the underlying fraud took place in the UK, or if a gain or loss occurred in the UK. Where no part of the fraud happened here, the gain or loss must actually occur in the UK; an intended gain or loss is not enough. That matters in a capital with a large concentration of international groups, because a fraud by an overseas employee could still engage the offence if London customers or investors were affected.
What is the defence, and what do “reasonable procedures” look like?
The Act provides a defence if the organisation can prove that, at the time of the fraud, it had in place such prevention procedures as it was reasonable in all the circumstances to expect, or that it was not reasonable to expect it to have any. The burden of proof sits with the organisation, on the balance of probabilities, according to the guidance, and only a court can decide.
The guidance sets out six principles to shape a prevention framework:
- Top-level commitment. Leadership rejects fraud and fosters a culture that supports this.
- Risk assessment. Exposure to fraud by associated persons is identified, documented and reviewed regularly.
- Proportionate, risk-based prevention procedures. Controls match the identified risks.
- Due diligence. Associated persons and transactions, including mergers and acquisitions, are vetted on a risk basis.
- Communication, including training. Policies are understood throughout the organisation.
- Monitoring and review. Suspected fraud is detected and investigated, and prevention measures improve over time.
The guidance names risk factors that boards may want to consider: commission-based pay, pressure to meet targets, weak oversight and a culture that discourages whistleblowing.
It is not a safe harbour. The guidance says following it does not guarantee a defence, and departing from it does not automatically mean a failure. It is advisory and does not replace reading the legislation.
What is the penalty?
Section 199 says a guilty organisation is liable to a fine, on conviction on indictment and on summary conviction in England and Wales. The text sets no figure for either, so the legislation itself does not cap the amount in those cases. Beyond the fine, a prosecution can bring reputational damage, which for firms that depend on banks, investors and large customers may be significant.
Why does this matter to smaller London firms?
The offence does not apply directly to small and medium-sized organisations. The guidance says so plainly, and describes the principles as good practice that may help them.
But the offence can still reach them indirectly. A small firm that provides services to a large organisation may itself be an associated person, and the guidance notes it may face contractual requirements from that client. In practice, a small agency, outsourced finance provider or recruitment business could be asked to complete due diligence questionnaires, sign anti-fraud warranties or accept audit rights.
This sits alongside other compliance changes affecting London boards. The same disciplined approach to ownership of tasks and dates applies to director identity verification at Companies House, and to the cash discipline described in what business owners should understand about cash flow. Firms already adjusting to how London’s business landscape is changing may find that fraud controls become one more part of winning and keeping larger customers. Payment terms are shifting too, as the commercial payments bill and its 60-day cap show.
A practical sequence for a board to review
Without making any recommendation about a specific business, the structure of the guidance suggests a sensible order of work for a board:
- Confirm whether the group meets the two-of-three test, including subsidiaries.
- Map the associated persons: employees, agents, contractors and suppliers acting on the group’s behalf.
- Record the fraud risks in the specified offences, and document any decision not to address a risk, with the name and position of who approved it.
- Check incentives, such as commission and targets, for pressure points.
- Make sure staff know how to raise concerns and that training is kept up.
- Schedule a review, since the risk assessment is meant to be kept current.
What the offence changes for corporate governance
The offence moves fraud from a matter of individual culpability to one of organisational design. For large London groups, the central question is no longer only who knew, but what the organisation did to stop it. For smaller firms in their supply chains, the effect is likely to arrive through contracts and customer questions rather than the statute. Either way, evidence that risks were assessed, controls were proportionate and staff were trained is what the legislation asks an organisation to be able to show.
This article is general information, not legal, tax or financial advice. Rules and thresholds can change, so seek professional advice for your own circumstances.
Sources: GOV.UK; Legislation.gov.uk
