What does the failure to prevent fraud offence ask of a board?
The short answer
Since 1 September 2025, a large organisation can be guilty of a criminal offence under the Economic Crime and Corporate Transparency Act 2023 if an associated person, such as an employee or agent, commits one of a set of listed frauds intending to benefit it or, in some cases, its clients. It has a defence if it proves it had reasonable fraud prevention procedures in place. The Home Office guidance places responsibility for preventing and detecting fraud on those charged with governance, so a board should expect a documented fraud risk assessment and evidence that prevention works.
Which organisations are in scope?
The offence covers large incorporated bodies and partnerships in every sector, including bodies created by statute, such as NHS trusts. A body formed overseas can still be in scope, because the Act applies to bodies corporate and partnerships wherever incorporated or formed. The guidance says the fraud needs a UK link: one of the acts that made up the fraud took place in the UK, or the gain or loss occurred there.
An organisation counts as large if it met two or more of three conditions in the financial year before the year of the fraud: turnover of more than £36 million, a balance sheet total of more than £18 million, and more than 250 employees. For a parent undertaking, the same test applies to the whole group: more than £36 million net turnover (£43.2 million gross), a balance sheet total of more than £18 million net (£21.6 million gross), and more than 250 employees.
When does the offence apply, and what has to be proved?
The offence applies when a person associated with a large organisation commits a listed fraud intending to benefit it or its clients, and the organisation lacked reasonable fraud prevention procedures. Associated persons include employees, agents, subsidiaries and anyone else performing services for or on behalf of the organisation, which can include suppliers; where one carries a significant fraud risk, the organisation should consider what procedures are reasonable. The listed frauds include fraud by false representation, false accounting and fraudulent trading.
Prosecutors do not need to show that directors or senior managers ordered or knew about the fraud. To rely on the defence, the organisation must prove, on the balance of probabilities, that it had reasonable prevention procedures, or that it was not reasonable to expect any. The guidance says the offence creates no personal liability for those who failed to prevent the fraud, though whoever committed it can still be prosecuted.
What counts as reasonable procedures?
The Home Office guidance, issued under the Act, sets six principles for fraud prevention, and a court will take adherence to them into account. They are top level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication (including training), and monitoring and review. The guidance is advisory and “is not intended to provide a safe harbour”: even strict compliance may fall short against unaddressed risks particular to the organisation.
The guidance also says that being regulated does not make existing compliance processes reasonable procedures automatically, though work need not be duplicated, and that an audit alone cannot be a sufficient defence, because audits are not designed to find every fraud. It adds that, for companies reporting under the UK Corporate Governance Code, compliance with the Code may contribute to the defence but is not sufficient on its own.
What does the guidance ask of the board itself?
The guidance says responsibility for the prevention and detection of fraud “rests with those charged with the governance of the organisation”. The board, partners and senior management should be committed to preventing associated persons from committing fraud, foster a culture in which fraud is never acceptable, and “reject profit based on, or assisted by, fraud”.
The guidance’s likely best practice includes designated responsibility for tasks from approving the risk assessment to investigations, and for management information on the risks and how well the procedures work, along with reporting to the board and minuted decisions. The person responsible for financial crime compliance, such as a Head of Ethics and Compliance, should have direct access to the board or chief executive as they think necessary. Best practice also has senior managers committing a proportionate budget and resourcing the plan over the long term.
What should a buyer check before an acquisition?
A buyer should assess how a target detects and prevents fraud, and plan how to integrate fraud prevention after completion. The guidance lists both as best practice in due diligence on mergers and acquisitions, alongside assessing any relevant criminal or regulatory charges, tax documentation and the exposure of the target to risk.
A target below the size test may have no procedures that directly address the offence. Where the target becomes a subsidiary, the Act makes a subsidiary undertaking an associated person of its parent and adds its figures to the parent’s group test. Read together, an acquisition may therefore bring a smaller group within the offence, and when depends on the group’s financial years. For a target authorised by the Financial Conduct Authority (FCA), see the briefing on what a buyer should check in an FCA-authorised firm’s governance.
What should a company growing past the size test do?
On the Act’s wording, a company that meets the size test in one financial year is in scope for frauds committed in the next, so a growing company should check the test each year. The employee figure is a monthly average of the people employed under contracts of service. The defence turns on the procedures in place when the fraud was committed, so the safe reading is that they should be working from the first day of the year in scope.
The guidance recommends professional legal advice on whether an organisation meets the definition, and says its principles are good practice that may help smaller organisations. The Act also lets the Secretary of State change, by regulations, what counts as large, or remove the size condition.
What should a board ask to see?
A board should see the evidence a defence would rest on, starting with a fraud risk assessment that is “dynamic, documented and kept under regular review”. Reviews are typically annual or every two years, and a court may treat an unreviewed assessment as not fit for purpose. Drawing on the guidance, a board can look for evidence of the following in its papers:
- a risk assessment covering all the listed frauds and all associated persons
- any decision not to act on a risk, with the name and position of the person who authorised it
- testing of the prevention plan by people who did not write it
- management information on suspected fraud, and the results of investigations
- any bonus framework that encourages risk-taking, and whether it could encourage fraud
Where any of these is missing, start with the risk assessment: the guidance builds the prevention plan on it.
Sources
Each source opens in a new tab.
- Home Office, Economic Crime and Corporate Transparency Act 2023: Guidance to Organisations on the Offence of Failure to Prevent Fraud, updated 10 October 2025, chapters 1 to 4
- Economic Crime and Corporate Transparency Act 2023, sections 199, 201, 202 and 204 and Schedule 13, Royal Assent 26 October 2023, thresholds checked on legislation.gov.uk on 3 October 2026
Insights
Worth reading next
The reading below stays close to this subject, often seen from the side of someone else round the table, such as the chair, an investor or the head of internal audit. It shows the wider subject from their perspective, and the questions each of them is likely to ask.
Which governance and controls come first in a 100-day plan?
Once a business changes hands, the first thing to put in writing is who may decide what, before old habits set the pattern.
What should a buyer check in an FCA-authorised firm’s governance?
Board papers show a buyer how a regulated target runs in practice, and approval from the regulator depends partly on the same governance.
Should internal audit report to the chief financial officer?
A line from internal audit to the finance chief needs safeguards that an audit committee chair can see and check.
Explore your own question further
Boards and audit committees can ask James to review the evidence behind their fraud prevention procedures, and buyers can ask him to check a target’s as part of due diligence. In a particular organisation, the detail can change the answer to a question like this one. James is happy to hear from anyone weighing it up for their own board, audit function or deal. This briefing is general information on the rules as they stood when it was last reviewed, and is not advice on any particular situation.