By Jessica Holman, Associate Director

Three months until the ECCTA ‘failure to prevent fraud’ offence comes into force 

It is now only three months until the new ‘failure to prevent fraud’ offense, as outlined in section 199 of the Economic Crime and Corporate Transparency Act (ECCTA) 2023, comes into effect on 1 September 2025. From this date, large organizations can face criminal liability if an associated person (for example, an employee, agent or subsidiary) commits a fraud offense which benefits the company or its clients, and the organization fails to have reasonable procedures in place to prevent such fraud. Even if a junior employee or ‘associated person’, including related third parties, commits a fraud within the scope of their role, businesses will be held strictly liable. 

The offence applies to partnerships, subsidiaries, large not-for-profit organisations and incorporated public bodies. A ‘large organisation’ meets at least two of the following criteria: turnover over £36 million, balance sheet total over £18 million, or more than 250 employees.  

To comply with the ECCTA, organisations must understand that the benefit of fraud is not necessarily financial, and the intention to benefit the organisation or its clients is sufficient for liability. Senior management’s knowledge of the fraud is not required for the organisation to be liable. Organisations found to be responsible will face fines unless they demonstrate reasonable fraud prevention procedures. 

To prepare, organisations should: 

1. Conduct Risk Assessments: Assess exposure to fraud risks, considering the organisation’s profile and activities. Document and regularly review the risk assessment, considering opportunity, motive and rationalisation. 

1. Implement Proportionate Prevention Procedures: Evaluate existing compliance mechanisms and create a fraud prevention plan. Policies should reduce opportunities and motives for fraud, enforce consequences and consider emergency scenarios.  

1. Perform Due Diligence: Conduct risk-based checks on individuals performing services for the organisation. In addition, organisations should carry out regular due diligence on affiliated entities. Conduct detailed screening checks on new hires, increase awareness on high-risk jurisdictions and review contracts for compliance obligations. 

1. Ensure Top-Level Commitment: Senior management should lead fraud prevention efforts, oversee processes and demonstrate commitment. 

1. Communicate and Train: Ensure all staff understand the offence and their responsibilities. Integrate fraud messaging into policies, provide bespoke training and publicise investigation outcomes to deter fraud. 

1. Monitor and Review: Regularly review and update procedures to address new risks and learn from whistleblowing and investigations. 

By following these steps, organisations can prepare for the upcoming enforcement of the ‘failure to prevent fraud’ offence.