ECCTA due diligence: firms should stop treating it as a box-tick and start treating it as a fraud prevention control

For businesses in scope of the UK’s Economic Crime and Corporate Transparency Act (ECCTA), the failure to prevent fraud has fundamentally changed the conversation. Due diligence is no longer just about onboarding a supplier, checking a senior hire, or reviewing an acquisition target. It now needs to form part of a wider, documented fraud prevention framework. Under the government’s guidance, due diligence is one of six core principles that help demonstrate “reasonable procedures” were in place to prevent fraud by an associated person.

The critical point is this: firms should not approach ECCTA due diligence as a generic screening exercise. The guidance points to a proportionate, risk-based approach focused on people and entities performing services for or on behalf of the organisation, and on the specific fraud risks they could create for the business. It also makes clear that simply reusing procedures will not necessarily be enough.

Therefore, where should firms start? Firstly, they need to map the areas of the business where fraud could be committed to benefit the company. The guidance explicitly highlights functions such as finance, procurement, investor sales and marketing, and tells firms to assess risk through the familiar lenses of opportunity, motive and rationalisation. It also points to trigger events such as capital raising, mergers, contracts, permits, grants and financial reporting pressure.

Five practical areas firms should cover

1. Employees and internal roles

Not every employee carries the same exposure. Higher-risk roles are typically those with authority, access, influence over records, or pressure to deliver commercial outcomes, finance, payroll, procurement, sales, investor-facing teams, senior management, and certain operational gatekeepers. The guidance also points to pre-employment vetting, ongoing vetting for high-risk roles, and reviewing whether incentives, targets or workload may increase fraud risk.

2. Agents, intermediaries and service providers acting for or on behalf of the business

This is where many firms will need to think more carefully. ECCTA is concerned with associated persons, which can include employees, agents, subsidiaries and others who perform services for or on behalf of the organisation. But the guidance is equally clear that this does not automatically mean every supplier or adviser is in scope. A party supplying goods, or simply providing services to the organisation, is not necessarily an associated person. The closer a party is to acting in the company’s name, selling for it, representing it, or delivering regulated or outsourced functions on its behalf, the stronger the case for robust fraud-focused due diligence.

3. Procurement and supply chain touchpoints

The guidance makes clear that supply chain entities are not automatically associated persons, but they can be where they provide services for or on behalf of the company. It also specifically asks whether fraud risks are managed throughout the full procurement lifecycle; pre-tender, tender, contract management, delivery and extension, and whether contracts contain appropriate terms. Procurement due diligence should therefore test for fraud opportunity as well as basic onboarding risk.

4. Venture capital, private equity and transaction-related third parties

This is an area that deserves much more attention. The guidance expressly highlights risks around investment activity, capital raising, and mergers or acquisitions. For VC and PE, that means due diligence should extend beyond target-company financials and legal diligence. It should cover founders, directors, key controllers, management teams preparing forecasts or investment materials, placement agents, introducers, operating partners, third parties compiling data room content or deal collateral, and any outsourced finance, compliance or recruitment providers acting for the business.

5. Monitoring, refreshes and event-driven review

ECCTA due diligence is not a one-time onboarding exercise. The wider guidance stresses monitoring and review and specifically mentions monitoring updates to due diligence procedures. Firms should conduct refresh checks periodically and whenever there is a trigger event: a new market, new product, new outsourced function, whistleblowing allegation, acquisition, major capital raise, change in incentives, or unexplained commercial pressure.

What due diligence should test in practice

• Who can commit fraud in order to benefit the organisation.
• Whether the party is acting for or on behalf of the business, rather than simply supplying goods or services to it.
• The level of authority, access, influence or financial pressure attached to the role or relationship.
• Ownership, control, reputation, adverse media, litigation, sanctions exposure, conflicts of interest and integrity indicators.
• The strength of internal approvals, delegated authority, payment controls, record integrity and contract oversight.
• Whether fraud risks increase during trigger events such as fundraising, M&A, rapid expansion, restructuring or performance pressure.
• Whether checks are documented, refreshed and linked back to the firm’s fraud risk assessment.

The practical takeaway

The most robust ECCTA due diligence will not be conducted by the company with the largest screening budget. Instead, companies need to show a regulator, prosecutor or court that the business identified who its associated persons really are, assessed where fraud could occur to benefit the organisation, applied proportionate controls to those risks, and kept those controls under review.

In other words: good ECCTA due diligence is not “check everyone”. It is known where fraud could happen, know who could cause it, and evidence what you did about it.

How Garancie can help

Garancie can add value to organisations subject to ECCTA by delivering targeted due diligence and investigation services on higher-risk individuals, suppliers, agents and transaction-related third parties, helping firms identify red flags, validate concerns and strengthen the quality of the risk assessments and controls they put in place. For more information contact mwhittington@garancie.com.

Under the UK government’s ECCTA failure to prevent fraud guidance, there are six principles that inform “reasonable procedures”: top level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication/training, and monitoring/review. The offence has applied since 1 September 2025 and is aimed at large organisations meeting two of three thresholds: more than 250 employees, more than £36m turnover, or more than £18m in total assets.

Source note: Prepared with reference to the UK government’s Economic Crime and Corporate Transparency Act 2023 guidance to organisations on the offence of failure to prevent fraud.

https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta

About Garancie

Garancie Limited specialises in online due diligence and investigative research, supporting property owners, legal firms, and financial institutions to verify the integrity and legitimacy of individuals and businesses. Our analysts combine open-source intelligence, public-record research, and structured risk assessment to identify red flags before they become liabilities.

Contact us to learn how Garancie can help you implement robust tenant-screening and property-risk monitoring across your portfolio.

🌐 https://garancie.com

#DueDiligence #AML #PropertyRisk #EnhancedDueDiligence #Garancie #OSINT #Compliance #ReputationManagement