A new corporate criminal offence

Failure to prevent fraud – A new corporate criminal offence

Corporates should put in place fraud prevention procedures aligned with newly published Government guidance

The new offence of failure to prevent fraud will make large organisations criminally liable for failing to prevent fraud committed by their employees, agents, subsidiaries or other associates, unless they can demonstrate that they had reasonable fraud prevention procedures in place.

This new offence sends a strong signal that large organisations are expected to play their part in combatting financial crime. The offence follows on from separate reforms, already in force, making companies liable for economic crimes committed by their senior managers.

Here, we consider some key actions for businesses in relation to the new 'failure to prevent fraud' offence.

At a glance:

1. A new offence of failure to prevent fraud will come into force on 1 September 2025. Large organisations may be held criminally liable for failing to prevent fraud committed by employees, agents, subsidiaries and other associates of the organisation.

2. There will be a complete defence if the organisation can show it had reasonable fraud prevention procedures in place at the time. The Government has recently published guidance detailing its expectations around this.

3. Organisations can be held liable for the actions of third parties who provide services on their behalf, so it is essential that you identify these third parties, assess the fraud risk posed by them and conduct appropriate due diligence on them to mitigate identified fraud risks.

4. You should be able to build upon existing financial crime compliance programmes, including bribery and tax evasion risk programmes, and you have time to prepare. To start, see our practical guide on Fraud Prevention Procedures for corporates here.

5. The jurisdictional reach of the new offence is broad, extending beyond UK corporates, to any organisation that has failed to prevent a relevant UK fraud offence from being committed.

Key actions for businesses

Fully understand how the new offence can be committed

The new offence criminalises organisations for failing to prevent certain 'base fraud offences' from being committed by 'associates' of the organisation.

An understanding of the base fraud offences will be an essential first step for organisations, before they can begin to assess where their greatest fraud risks lie. Our top-level guide to the base fraud offences - What is Fraud? - is here.

Equally, organisations will need to identify who their associates are. Employees, agents and subsidiary undertakings are automatically included. In addition, any person who provides services for or on behalf of the organisation will also be an associate. Understanding who these third-party associates are is a first and critical step to assessing the organisation's fraud risk.

Conduct a fraud risk assessment and carry out due diligence, covering 'associates'

The guidance is clear that organisations are expected to conduct a full fraud risk assessment to assess the nature and extent of their exposure to associates committing fraud. The starting point is to identify 'typologies' of associates, and then consider the scenarios under which the associates could attempt one of the base fraud offences. It will also be important to conduct appropriate due diligence on third party associates to mitigate identified fraud risks, which may include carrying out vetting checks and reviewing contracts.

Corporates should also identify the 'potential victims' of fraud. Whilst organisations typically have well developed policies and procedures designed to prevent themselves becoming a victim of fraud, the new offence requires an outward-looking view of fraud risks, and an assessment of how third parties could be harmed by fraud committed by associates of the organisation.

The risk assessment should be dynamic, documented and kept under regular review. It will help identify, on an ongoing basis, any additional fraud prevention procedures needed.

Reasonable fraud prevention procedures

Demonstrating that an organisation has reasonable fraud prevention procedures is a complete defence and will be key to avoiding liability for the new offence.

The Government's guidance stresses that, when putting a fraud prevention framework in place, organisations should:

Demonstrate a top-level commitment to the prevention and detection of fraud.
Conduct dynamic, regular risk assessments to assess the nature and extent of their exposure to fraud risks.
Implement proportionate risk-based fraud prevention procedures.
Apply due diligence procedures in respect of persons who perform or will perform services on their behalf, to mitigate identified fraud risks.
Ensure that their prevention policies and procedures are communicated, embedded and understood throughout their organisation.
Monitor and review their fraud detection and prevention procedures and make improvements where necessary.

See our practical guide on Fraud Prevention Procedures for corporates here.

Ensure policies and procedures adhere to the guidance, and explain any departures

Adherence to the Government's guidance will be a key consideration for prosecutors when deciding whether to bring criminal proceedings, and for the courts when deciding whether an organisation is guilty of the offence.

Organisations should therefore ensure they can demonstrate a carefully considered approach which fully aligns with the guidance and, where there are departures, there are valid, documented reasons for this.

Equally, organisations need to be alert to the need to look beyond the guidance where they face risks arising from the unique facts of their business.

Leverage existing processes for financial crime risks

Most large organisations will already have in place fraud prevention policies and procedures in some form and will be familiar with 'failure to prevent' offences, given the 'failure to prevent bribery' and 'failure to prevent the facilitation of tax evasion' offences that are already law. Steps detailed in the Government's guidance in relation to the new offence are similar to those that organisations will already be taking in relation to bribery and tax evasion risks. This means that organisations should not need to start from scratch when considering what fraud prevention procedures to adopt.

For example, conducting a fraud risk assessment is likely to require the input of many of the same stakeholders who input into bribery and tax evasion risk assessments, so it may be possible to coordinate elements of these processes. Similarly, it may be possible to expand existing training given on bribery-related matters to cover economic crime risks more broadly, including fraud.

Closely integrating any new fraud related measures into the organisation's existing financial crime compliance programme should not only drive synergies in the initial work required to prepare for the new offence but should help with the ongoing process of periodic review and updates to these measures.

Look across the whole business, beyond the UK entities

The new offence will apply to organisations wherever they or their associates are incorporated or carry on business, provided the organisation has failed to prevent one of the UK base fraud offences. These offences require one of the acts which was part of the fraud to have taken place in the UK or any gain or loss resulting from that offence to have occurred in the UK. A non-UK organisation could therefore be liable for failing to prevent a non-UK associate committing a fraud offence, if the fraud targeted UK victims. Organisations should therefore look beyond their UK group companies when considering the new offence.

The risk of a prosecution in these circumstances should not be overstated however, given that finite investigative and prosecutorial resources are most likely to be focused on organisations with a strong UK nexus, and there would be practical challenges to criminally charge a non-UK organisation in the UK.

Download PDF

Contact us

Christopher David, Regulatory Investigations and Financial Crime Partner
Luke Tolaini, Regulatory Investigations and Financial Crime Partner
Michael Lyons, Regulatory Investigations and Financial Crime Partner
Matthew Lee, Regulatory Investigations and Financial Crime Lawyer
Dominic Ross, Corporate Partner
Alanna Hunter, Corporate Partner
David Pudge, Corporate Partner
Juliet McKean, Head of Corporate Knowledge
Isabelle Hessell Tiltman, Head of Corporate Thought Leadership

New corporate criminal offence: failure to prevent fraud

Pursuant to the new offence, large organisations can be held criminally liable for failing to prevent fraud committed by their 'associates'.
Only 'large organisations' are covered by the new offence (i.e. organisations that meet two or more of: (1) turnover of more than £36m; (2) total assets of more than £18m; and (3) more than 250 employees). If a corporate group meets this test, the parent undertaking and each subsidiary undertaking within the group will be in scope, regardless of whether the individual undertaking meets the test on a standalone basis.
Associates will include employees, agents and subsidiary undertakings, and may also extend to suppliers, sub-contractors and other similar third parties where they provide services for or on behalf of the organisation.
To fall within the new regime, the associate must commit a fraud offence to directly or indirectly benefit the organisation, or to benefit a person to whom the associate provides services on behalf of the organisation. The organisation will not be liable if it was a victim of the fraud.
Parent undertakings can be guilty of the offence where fraud has been committed by an employee of a subsidiary undertaking, where the offence was committed for the benefit of the parent.
The underlying fraud must be one of the specified base fraud offences. These extend beyond the core statutory fraud offences (in the Fraud Act 2006) to include false statements by company directors, false accounting, fraudulent trading and cheating the public revenue. A wide range of potential conduct is therefore covered.
The offence will apply to organisations wherever they or their associates are incorporated or carry on business, provided the organisation has failed to prevent one of the specified UK fraud offences.
An organisation will not be guilty of the offence if it can demonstrate that it had reasonable fraud prevention procedures in place, or that it was reasonable not to have such procedures.

Clifford Chance

Better Business

Across the Board