How to Comply With Failure to Prevent Fraud: 8 Steps to Reasonable Procedures

What the failure to prevent fraud offence is

The failure to prevent fraud offence makes a large organisation criminally liable when someone associated with it commits a specified fraud intending to benefit the organisation or its clients, unless the organisation can prove it had reasonable prevention procedures. It is a strict corporate offence: prosecutors do not need to show that directors or senior managers ordered, knew about or approved the fraud.

The offence is set out in sections 199 to 206 and Schedule 13 of the 2023 Act. Section 204 required the government to publish guidance on prevention procedures, and the Home Office guidance to organisations was first published in November 2024, giving organisations an implementation period before the offence took effect. The guidance is advisory rather than binding, and it says plainly that it is not a safe harbour: following it to the letter will not amount to reasonable procedures if a business faces particular risks it has not addressed, while departing from it will not automatically mean procedures were unreasonable.

Three features shape any compliance programme:

• The burden is on the company. Under section 199(4), the organisation must prove its procedures were reasonable, on the balance of probabilities, at the time the fraud was committed.
• It is not retrospective. As BCL Solicitors noted in March 2026, the offence only bites on frauds committed after it came into force.
• It sits alongside individual liability. The employee or agent who commits the fraud can still be prosecuted personally, while the organisation is prosecuted for failing to prevent it.

The government announced commencement on 1 September 2025 with examples of the conduct it has in mind: dishonest sales practices, hiding important information from consumers or investors, and dishonest practices in financial markets. It also drew an explicit parallel with the failure to prevent bribery offence, which it said had helped reshape corporate culture since 2010.

Which organisations are subject to the failure to prevent fraud offence

The offence applies only to "large organisations": incorporated bodies and partnerships, wherever formed, that meet at least two of three size tests in the financial year before the fraud. Unincorporated associations other than partnerships are outside scope.

Test	Threshold	How it is measured
Employees	More than 250	Whole organisation, including subsidiary undertakings
Turnover	More than £36 million	Aggregate turnover of the organisation and its subsidiaries, including those wholly outside the UK, net of trade discounts, VAT and other sales taxes
Total assets	More than £18 million	Whole organisation, including subsidiary undertakings

Four scope points catch organisations out:

• Group size counts. The tests apply across the group, regardless of where it is headquartered. A modest UK subsidiary of a large foreign group can be prosecuted where its own employee commits a fraud intended to benefit it, even if the subsidiary is not itself large.
• Overseas companies are caught if there is a UK nexus. The offence applies where an act forming part of the fraud took place in the UK or the gain or loss occurred there. A UK-based employee's fraud can expose the employer wherever it is based.
• Purely foreign fraud is not. A UK organisation whose overseas staff or subsidiaries commit fraud abroad with no UK nexus is outside the offence, although local laws may apply; our explainer on China's main anti-corruption laws shows how other jurisdictions are tightening their own corporate rules.
• Smaller suppliers feel it too. The guidance warns that small firms providing services on behalf of a large organisation may become associated persons and face contractual anti-fraud requirements from their clients.

The Home Office says organisations should take legal advice on whether they meet the definition, given the range of legal structures involved. It also notes that, although only large organisations can commit the offence, its six principles are good practice for smaller ones.

When the failure to prevent fraud offence is triggered

The offence is triggered when an "associated person" commits a listed "base fraud" in that capacity, intending to benefit the organisation or a client it serves. All three elements must be present, and the organisation need not actually receive any benefit.

Associated persons

Under section 199(7), employees, agents and subsidiary undertakings are associated persons, as is anyone who "otherwise performs services for or on behalf of the body", judged on all the circumstances rather than the label on the contract. People providing services to the organisation, such as its external lawyers, valuers or accountants, are not associated persons unless they also act on its behalf. Fraud committed in someone's private life, outside their role, does not count.

Base fraud offences

The base offences are listed in Schedule 13 to the Act, and aiding, abetting, counselling or procuring any of them also qualifies.

Jurisdiction	Base fraud offences
England and Wales	Fraud by false representation, by failing to disclose information and by abuse of position (Fraud Act 2006); participation in a fraudulent business; obtaining services dishonestly; cheating the public revenue; false accounting and false statements by company directors (Theft Act 1968); fraudulent trading (Companies Act 2006)
Northern Ireland	The same Fraud Act offences and cheating the public revenue; false accounting and false statements by company directors under the Theft Act (Northern Ireland) 1969; fraudulent trading
Scotland	Fraudulent trading; common law fraud, uttering and embezzlement

Intention to benefit

The fraudster's intention to benefit the organisation need not be their main motive. The guidance gives the example of a salesperson on commission who mis-sells to boost their own earnings: because their reward depends on the company's sales, an intention to benefit the company can be inferred. Benefits can be non-financial, such as an unfair business advantage. Where the fraud was meant to benefit a client, the organisation is not liable if it was itself the victim or intended victim.

Failure to prevent fraud penalties and enforcement one year on

An organisation convicted on indictment faces a fine with no statutory upper limit under section 199(12); summary fines in Scotland and Northern Ireland are capped at the statutory maximum. The offence can be prosecuted by the Crown Prosecution Service, the Crown Office and Procurator Fiscal Service, the Public Prosecution Service for Northern Ireland and the Serious Fraud Office, and in England and Wales a deferred prosecution agreement is available as an alternative to prosecution.

Beyond the fine, a conviction or DPA brings the reputational and commercial fallout that recent enforcement elsewhere illustrates, as our analysis of the Bank of America AML and sanctions penalties shows. Organisations should also not assume that penalties can be offset against tax: the Supreme Court's recent ruling on whether fines and penalties are tax deductible is relevant to how any settlement is costed.

Enforcement so far has been quiet. Six months after commencement, BCL Solicitors reported no prosecutions or confirmed investigations under the offence, and pointed out that, unlike Bribery Act offences, a prosecution does not need the consent of the Director of Public Prosecutions, which leaves room for private prosecutions. The SFO has signalled intent: in a June 2026 speech in New York, its interim director Graham McNulty said the agency had made clear its commitment to make full use of the offence, which captures conduct anywhere in the world provided there is a UK nexus. Corporate investigations take years, as the Ultra Electronics case discussed below shows, so a quiet first year is not evidence of low risk.

The wider corporate liability picture has also shifted. Section 250 of the Crime and Policing Act 2026, in force since 29 June 2026, provides that where a senior manager acting within the actual or apparent scope of their authority commits any offence, the organisation commits it too. It applies to bodies corporate and partnerships of any size, repeals the earlier senior manager provisions in sections 196 to 198 of the 2023 Act, and contains no reasonable procedures defence.

How to comply with failure to prevent fraud: the 8 steps at a glance

The Home Office guidance says a fraud prevention framework should be informed by six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication (including training), and monitoring and review. Turned into a practical sequence, with scoping at the start and an evidence file at the end, that becomes eight steps.

Step	What to do	Guidance principle	Evidence to keep
1	Confirm scope and map associated persons	Risk assessment (preparation)	Size test calculation, group chart, associate typologies
2	Secure top-level commitment and governance	Top-level commitment	Board minutes, named owner, budget, policy statement
3	Run a failure to prevent fraud risk assessment	Risk assessment	Documented, dated risk register with inherent risk ratings
4	Build proportionate prevention procedures	Proportionate procedures	Fraud prevention plan, control mapping, recorded risk acceptances
5	Apply due diligence to associates and deals	Due diligence	Onboarding files, contract clauses, M&A reports
6	Communicate, train and protect whistleblowers	Communication	Training records, test results, whistleblowing logs
7	Detect, investigate and decide whether to self-report	Monitoring and review	Investigation protocol, decision records, legal advice
8	Test, review and document the defence	Monitoring and review	Independent test reports, review minutes, updated plan

Step 1: confirm scope and map your associated persons

The first step is to establish, with legal advice, whether the organisation or any group entity meets two of the three size tests, and then to build a map of everyone who could be an associated person. Without that map, the risk assessment has nothing to attach to.

Run the size tests at group level using the previous financial year's figures, and repeat them each year, because a group that grows through acquisition can move into scope. Then list the categories of associate the guidance suggests as a starting point: employees in sensitive roles, agents, contractors providing services on the organisation's behalf, subsidiaries and, where relevant, franchisees who provide services for the franchisor. Note where each sits: a UK-based team creates an obvious nexus, while an overseas distributor selling into the UK may too.

Group structure matters to the analysis. Whether a foreign business operates in the UK through a subsidiary or a branch changes which entity is the "relevant body" and who its employees are; our comparison of branch and subsidiary structures sets out the wider liability differences. The output of step 1 should be a short scoping memo, approved by the general counsel, recording the size calculation, the in-scope entities and the associate typologies.

Step 2: secure top-level commitment and clear governance

Reasonable procedures start in the boardroom: the guidance places responsibility for preventing and detecting fraud on those charged with governance and expects them to foster a culture in which fraud is never acceptable, even at the cost of lost business.

In practice that means a formal board-approved statement rejecting fraud and profit gained through fraud, naming the people responsible for the programme and setting out the consequences of breaching policy. The guidance's best practice list includes designated responsibility for horizon scanning, approving the risk assessment, building detection and prevention measures, whistleblowing, investigations and periodic review. It also says the head of ethics and compliance, or equivalent, should have direct access to the board or chief executive when needed, that decisions should be minuted, and that governance must survive staff absence and turnover.

Resourcing is part of commitment. Senior managers should allocate a proportionate budget, covering people, training and due diligence technology, and commit to it over the long term. Leaders should also challenge the rationalisations fraudsters use, such as "everyone does it" or "it is not material". Personal consequences for individuals can be severe, as the sentencing of a former Nodus Bank chief executive for fraud shows, and a visible tone from the top is the strongest answer to those arguments.

Step 3: run a failure to prevent fraud risk assessment

A failure to prevent fraud risk assessment identifies how associated persons could commit an in-scope fraud intended to benefit the organisation or its clients, and rates each risk before controls. The guidance says it will rarely be reasonable not to have carried one out at all.

Most large organisations already assess the risk of fraud against them. The new exercise looks the other way, at fraud committed for them, so existing assessments usually need extending rather than reusing. The guidance recommends nominated risk owners use the fraud triangle:

• Opportunity. Which roles, such as finance, procurement, investor sales and marketing, have the most scope to commit fraud? Do some associates work with minimal oversight? Do staff churn or new technology, including AI, open gaps?
• Motive. Do bonuses or commissions reward risk-taking? Are there pressure points such as financial targets, a merger, a flotation, a capital raise, a licence or grant application, or reporting dates?
• Rationalisation. Is the culture quietly tolerant of fraud that wins contracts? Is fraud prevalent in the sector? Is it hard for staff to speak up?

Feed in data analytics, previous audit findings, sector guidance and regulator enforcement actions, and consider emergency scenarios, which the guidance warns can increase fraud risk. Classify each inherent risk by likelihood and impact with a short explanation of the rating. Keep the assessment documented and dated, and review it at consistent intervals; the guidance says annual or two-yearly reviews are typical, with earlier reviews triggered by events. If it has not been reviewed, a court may find it was not fit for purpose. Specialist economic crime advisers can help design typologies for high-risk sectors.

Step 4: build proportionate, risk-based prevention procedures

Prevention procedures must be proportionate to the risks found in step 3 and to the organisation's size and complexity, and they must be clear, practical, accessible, implemented and enforced. The output is a written fraud prevention plan that maps each identified risk to the controls that address it.

The guidance's risk factors suggest where to focus:

• Reduce opportunity. Pre-employment and ongoing vetting for high-risk roles, segregation of duties, account reconciliations, sign-off arrangements, conflict of interest controls, restricted access to sensitive data and fraud controls across the whole procurement cycle.
• Reduce motive. Adjust bonus and commission schemes that encourage risk-taking, and address time pressures that push staff to cut corners.
• Set consequences. Clear disciplinary procedures, and communication of investigation outcomes to staff and associates.
• Counter rationalisation. Training and a code of ethics that confront "ethical fading", the normalisation of one-off frauds.

Regulated businesses should not duplicate work, but nor can they assume that compliance with other regimes is enough. The guidance is explicit that being regulated does not automatically mean reasonable procedures are in place; organisations should test whether existing regulatory, financial reporting and fraud controls would prevent each identified risk and fill the gaps. Where the organisation decides not to act on a particular risk, it should record that decision with the name and position of the person who authorised it. UK regulatory lawyers can help map overlapping obligations.

Step 5: apply due diligence to associates and deals

Due diligence means proportionate, risk-based checks on the people and businesses that perform services for or on behalf of the organisation, and on companies it acquires. The guidance cautions that due diligence designed for other risks, such as money laundering, will not necessarily address fraud.

For associates, the guidance's examples of best practice include screening tools, internet searches, trading history checks, confirmation of professional or regulated status, and vetting where appropriate. Contracts with service providers and agents should be reviewed to add compliance obligations and, where appropriate, a right to terminate for breach. In long supply chains, the guidance accepts that an organisation usually controls only its relationship with its direct counterparty, so it can impose fraud prevention terms on that party and ask it to flow them down.

For mergers and acquisitions, the guidance lists assessment of any criminal or regulatory charges, tax documentation, the target's exposure to fraud risk and its existing prevention measures, bearing in mind that a target below the size thresholds may have no procedures aimed at this offence at all. Integration of fraud prevention measures after completion is part of the expected process. Deal teams can find UK corporate and M&A lawyers to build these checks into transaction timetables.

Step 6: communicate, train and protect whistleblowers

Policies only count if people know and follow them, so the guidance expects prevention policies to be communicated and embedded at every level, supported by proportionate training and effective whistleblowing arrangements.

Communication has to come from middle management as well as the board; the guidance notes that a senior statement means little if managers then encourage juniors to get around controls. Training should explain the offence and the procedures that address it, with extra focus on the highest-risk roles, and organisations can either train third-party associates or require them to have their own arrangements. Training effectiveness should be monitored and kept up to date as people change roles.

Whistleblowing is singled out as one of the most effective ways to uncover fraud. The guidance suggests board-level accountability for whistleblowing, independent reporting channels, training for managers on how to respond, timely investigation, protection against victimisation and feedback to the person who raised the concern. Employers updating whistleblowing policies this year should also reflect the changes in our Employment Rights Act 2025 employer checklist, and UK employment lawyers can align the fraud and employment sides of the policy.

Step 7: detect, investigate and decide whether to self-report

Monitoring under the guidance has three parts: detecting fraud and attempted fraud, investigating suspicions, and checking that prevention measures work. Detection systems built to spot fraud against the business, such as payment and invoicing analytics, should be extended to spot fraud intended to benefit it or its clients.

Agree an investigation protocol before it is needed: what triggers an investigation, who authorises it, when an external investigator is appointed, how independence is protected and how results reach the board. The guidance says investigations should be independent, properly resourced, scoped with legal advice, legally compliant and fair. Specialists in internal and government investigations and forensic investigators are often instructed at this point.

If fraud is found, the organisation faces the self-reporting decision. The SFO's Corporate Cooperation Guidance, first issued in April 2025 and strengthened on 13 October 2026, commits that corporates which report promptly and cooperate fully will, barring exceptional circumstances, be invited to negotiate a DPA. The SFO says it will make contact within 48 business hours of a self-report and decide whether to open an investigation within six months. The October update lets a company's lawyers discuss a potential self-report directly with the SFO's Director of Legal Services before committing, clarifies that corporates should take a proportionate, risk-based approach to establishing the full extent of offending, and confirms that the six-month window for DPA negotiations runs from acceptance of the invitation.

The SFO's most recent DPA shows the route and its timescale. Ultra Electronics Holdings agreed a DPA approved on 1 May 2026 for failure to prevent bribery, paying a £10 million penalty and £4.8 million in SFO costs, after an investigation opened in 2018 following its own report. The SFO noted it had earlier withdrawn from negotiations and resumed only after significant changes to the company's ownership, structure and leadership.

Step 8: test, review and document your defence

The final step is to prove the programme works: test the controls independently, review the framework regularly and keep the evidence a court would need to see. The defence turns on what was in place when the fraud occurred, so contemporaneous records matter more than a polished policy written afterwards.

The guidance's best practice is for the prevention plan to be tested by people who did not write it, after which residual risk is assessed. Monitoring should cover financial controls, training attendance and results, and updates to due diligence and contract terms. Reviews can be internal or external and should draw on staff feedback, detection data, investigations, whistleblowing cases and any prosecutions or DPAs in the sector. For premium listed companies, the guidance notes overlap with the UK Corporate Governance Code, under which boards are expected from 1 January 2026 to declare the effectiveness of material controls; where a fraud control is covered by that declaration, the work need not be duplicated.

Expect prosecutors to look beyond paperwork. The SFO's refreshed guidance on evaluating compliance programmes, published in November 2025, added criteria for the failure to prevent fraud defence and stresses that having policies, procedures and controls does not automatically make a programme effective; the SFO will examine how policies translate into conduct on the ground. As its Director of Legal Services Matthew Wagstaff put it, "Effective compliance is not a tick-box exercise".

Failure to prevent fraud compared with failure to prevent bribery and the senior manager rule

Failure to prevent fraud is one of three overlapping routes to corporate criminal liability that a UK compliance programme now has to address, and each works differently.

Feature	Failure to prevent fraud (ECCTA 2023, s199)	Failure to prevent bribery (Bribery Act 2010)	Senior manager rule (Crime and Policing Act 2026, s250)
Who commits the underlying offence	An associated person	A person acting on the company's behalf	A senior manager acting within their authority
Offences covered	Listed fraud offences in Schedule 13	Bribery to win or retain business	Any offence
Defence	Reasonable prevention procedures	Adequate procedures	No procedures defence
In force	1 September 2025	Introduced in 2010	29 June 2026

The size threshold is the other key difference: only large organisations can commit the fraud offence, while the senior manager rule applies to bodies corporate and partnerships of any size. Organisations that built anti-bribery programmes can reuse much of the architecture, such as governance, due diligence and training, but the fraud risks, roles and controls are different and need their own assessment.

Common mistakes when implementing reasonable procedures

The most common mistake is treating the offence as a policy-writing exercise rather than a change in how risk is managed. Others drawn from the guidance include:

• Recycling an anti-fraud assessment that only looks at fraud against the business, not fraud committed for it.
• Relying on regulatory compliance alone, which the guidance says will not automatically amount to reasonable procedures.
• Ignoring incentive schemes that reward the sales or targets most likely to tempt staff into misrepresentation.
• Leaving risk acceptances undocumented, without the name and position of the person who decided not to act.
• Letting the risk assessment go stale, which a court may treat as meaning reasonable procedures were not in place.
• Forgetting third parties such as agents, introducers and outsourced sales teams who act on the organisation's behalf.

When to bring in a specialist adviser

Most large organisations can run much of this programme in-house, but specialist advice is worth taking at four points: confirming scope for complex or foreign-owned groups, designing the risk assessment for high-risk functions, responding when a potential fraud surfaces, and deciding whether and how to self-report. The guidance itself repeatedly recommends legal advice on scope and on investigations.

Before the first meeting, gather the group structure chart, the last financial year's headcount, turnover and balance sheet figures for each entity, existing anti-bribery and anti-fraud policies, recent internal audit reports, incentive scheme rules, a list of agents and intermediaries, and any whistleblowing reports or investigations in the past two years.

The Corporate INTL Find an Expert directory lists UK criminal and white-collar lawyers who advise on corporate offences, investigations and SFO engagement, alongside criminal and white-collar specialists in other jurisdictions for groups with a UK nexus from abroad, and advisers across the United Kingdom in related practice areas. Each expert page carries a "Looking for legal or business advice?" form, which readers can use to send an enquiry and be matched with a suitable adviser. For more analysis of enforcement trends, see our criminal and white-collar coverage.

Frequently asked questions

How do you comply with failure to prevent fraud?

Organisations comply by putting reasonable fraud prevention procedures in place, guided by the Home Office's six principles: top-level commitment, a documented risk assessment, proportionate prevention procedures, due diligence, communication and training, and monitoring and review. Keeping dated evidence of each step matters, because the organisation must prove its procedures were reasonable when the fraud occurred.

What legislation introduced the failure to prevent fraud offence?

The offence was created by section 199 of the Economic Crime and Corporate Transparency Act 2023, with the list of base fraud offences in Schedule 13. It came into force on 1 September 2025, after the Home Office published its guidance to organisations in November 2024 to give businesses time to prepare.

Which organisations are subject to the failure to prevent fraud offence?

Large incorporated bodies and partnerships meeting two of three tests in the previous financial year: more than 250 employees, more than £36 million turnover, or more than £18 million total assets. The tests apply across the whole group, including overseas subsidiaries, and foreign organisations are caught where the fraud has a UK nexus.

When is the failure to prevent fraud offence triggered?

It is triggered when an associated person, such as an employee, agent, subsidiary or someone performing services on the organisation's behalf, commits a listed fraud offence intending to benefit the organisation or a client it serves. The organisation does not need to receive the benefit, and senior management need not know about the fraud.

What are the penalties for failure to prevent fraud?

On conviction on indictment the organisation faces a fine with no statutory maximum. In England and Wales, prosecutors can instead agree a deferred prosecution agreement, which typically involves a financial penalty, costs and compliance conditions. Individuals who committed the underlying fraud can be prosecuted separately.

Is there a defence to failure to prevent fraud?

Yes. Under section 199(4) the organisation has a defence if it proves, on the balance of probabilities, that it had reasonable prevention procedures in place when the fraud was committed, or that it was not reasonable in the circumstances to expect it to have any. Only a court can decide whether procedures were reasonable.

How often should a failure to prevent fraud risk assessment be reviewed?

The Home Office guidance leaves frequency to the organisation but says reviews are typically annual or every two years, with earlier or partial reviews when external events change the risk. It warns that a court may find an unreviewed risk assessment was not fit for purpose.

What is a deferred prosecution agreement?

A DPA is a voluntary agreement between a prosecutor and an organisation, approved by a judge, under which prosecution is deferred in exchange for conditions such as a financial penalty and cooperation with investigators. The SFO says companies that self-report promptly and cooperate fully will, barring exceptional circumstances, be invited to negotiate one.

Does failure to prevent fraud apply to small businesses?

Small businesses cannot commit the offence themselves, but they can be associated persons when they provide services on behalf of a large organisation and may face contractual anti-fraud requirements. Separately, the senior manager rule in the Crime and Policing Act 2026 applies to organisations of any size.

Sources

1. Economic Crime and Corporate Transparency Act 2023, section 199 (legislation.gov.uk)
2. Economic Crime and Corporate Transparency Act 2023, Schedule 13 (legislation.gov.uk)
3. Home Office: Guidance to organisations on the offence of failure to prevent fraud
4. GOV.UK: New measures to tackle fraud come into effect (1 September 2025)
5. Crime and Policing Act 2026, section 250 (legislation.gov.uk)
6. Serious Fraud Office: Refreshed guidance to evaluate corporate compliance (26 November 2025)
7. Serious Fraud Office: SFO strengthens corporate cooperation guidance (13 October 2026)
8. Serious Fraud Office: Director addresses global anti-corruption conference (3 June 2026)
9. Serious Fraud Office: SFO secures £10m from British defence supplier (1 May 2026)
10. BCL Solicitors: The Failure to Prevent Fraud Offence: No Cases Yet, But Key Questions Remain (24 March 2026)

About this article

This guide was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the Economic Crime and Corporate Transparency Act 2023, the Crime and Policing Act 2026, the Home Office's statutory guidance and Serious Fraud Office publications. This article is general information, not legal advice; whether an organisation is in scope and whether its procedures are reasonable depend on its own facts, so consult a qualified adviser on any specific matter. Last reviewed 22 October 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.