- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
Failure to prevent fraud: the UK offence for large organisations
Since 1 September 2025, a large organisation can be prosecuted if an employee, agent or other associated person commits fraud intending to benefit it or its clients. The only defence is having reasonable fraud prevention procedures.
- The failure to prevent fraud offence in section 199 of the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025.
- It applies to large bodies corporate and partnerships that meet two of three tests: more than 250 employees, more than £36 million turnover, more than £18 million in total assets.
- The organisation is liable when an associated person commits a listed fraud offence intending to benefit the organisation, or a client they serve on its behalf. Managers do not need to have known about it.
- The defence is to prove the organisation had reasonable prevention procedures in place, and the Home Office guidance sets out six principles for them.
What it is
The offence is in section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). It was commenced on 1 September 2025 by SI 2025/349. The government says it is meant to build an anti-fraud culture in the way the failure to prevent bribery offence has done since 2010.
The offence does not require anyone senior to have ordered or known about the fraud. If an associated person commits a fraud offence intending to benefit the organisation, or a person they provide services to on its behalf, the organisation is guilty unless it proves its defence. The penalty is a fine, with no fixed upper limit on conviction on indictment.
The fraud offences that count are listed in Schedule 13. In England and Wales they include fraud by false representation, failure to disclose information and abuse of position, false accounting, false statements by company directors, fraudulent trading and cheating the public revenue. The fraud must have a UK connection.
Who it applies to
The offence applies to large organisations wherever they are incorporated, as long as the fraud has a UK nexus. Size is tested on the financial year before the fraud, and includes subsidiaries.
- Bodies corporate and partnerships that meet two or more of: over 250 employees, over £36 million turnover, over £18 million total assets
- Large incorporated not-for-profits, such as charities, and incorporated public bodies
- Large professional firms, including accounting and law firms structured as companies or partnerships
- Associated persons: employees, agents, subsidiaries and anyone who performs services for or on behalf of the organisation
Smaller organisations are outside this offence. The guidance says its principles are good practice and may be helpful for smaller organisations, and that organisations should take professional legal advice on whether they qualify as large.
What you have to do
The law creates an offence and a defence. It does not list mandatory steps. The Home Office guidance sets out six principles for reasonable procedures, and each organisation decides what is proportionate to its own risks.
- Top level commitment
The board, partners and senior management should be committed to preventing associated persons from committing fraud, and should set the culture for the rest of the organisation.
Governance - Fraud risk assessment
Assess the ways associated persons could commit fraud to benefit the organisation or its clients. The guidance says the assessment should be dynamic, documented and kept under regular review, and that a court may find an out-of-date one not fit for purpose.
- Proportionate prevention procedures
Put in place fraud prevention procedures that are proportionate to the risks the risk assessment identifies.
Ongoing - Due diligence on associated persons
Apply proportionate, risk-based due diligence to people who perform services for or on the organisation's behalf. The guidance gives screening tools, internet searches, trading history checks, vetting and contract reviews as examples.
- Communication and training
Make sure prevention policies are communicated, embedded and understood throughout the organisation, including through training.
Ongoing - Monitoring and review
Monitor and review fraud detection and prevention procedures, investigate suspected fraud and make improvements where necessary.
What firms get wrong
Most misreadings come from treating this as an AML rule or assuming fraud against clients is someone else's problem.
AML customer due diligence under the Money Laundering Regulations looks at the risk clients pose. This offence looks at fraud by your own people and agents. The guidance's due diligence principle covers associated persons, so client onboarding checks alone are unlikely to be enough.
Section 199(1)(b) also covers fraud intended to benefit a person the associate provides services to on the organisation's behalf, such as a client. The organisation is not liable under that limb if it was itself the victim or intended victim.
The guidance says only a court can decide whether procedures were reasonable. Following it does not guarantee the defence, and departing from it does not automatically mean the procedures were unreasonable. The organisation carries the burden of proof.
Related guides
Questions people ask
Who does the failure to prevent fraud offence apply to?
Large bodies corporate and partnerships that meet two of three tests in the previous financial year: more than 250 employees, more than £36 million turnover, or more than £18 million in total assets, counting subsidiaries. It applies wherever the organisation is incorporated if the fraud has a UK connection.
What does the failure to prevent fraud offence not cover?
It does not cover smaller organisations, frauds with no UK connection, or fraud where the organisation itself was the victim or intended victim. It covers only the fraud offences listed in Schedule 13, not every kind of dishonesty.
What are reasonable procedures?
The Home Office guidance groups them under six principles: top level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review. What is reasonable depends on the organisation's size and risks.
Does due diligence include screening people?
The guidance lists screening tools, internet searches, trading history checks and vetting as examples of due diligence on associated persons, applied in proportion to risk. See adverse media screening and sanctions screening.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
Where StackGo fits
Reasonable procedures are mostly about governance, culture, controls and training, which no software provides. IdentityCheck can support parts of the due diligence and risk assessment principles where a firm decides screening fits its risks. Other approaches work too, including manual checks.
- PEP, sanctions and adverse media screening of people and entities, with ongoing monitoring of those screened
- Risk assessment forms with scoring and enhanced due diligence steps
- Biometric identity verification: a photo of a government ID document plus a live selfie with liveness
- It does not build or document a fraud prevention framework or fraud risk assessment for the whole organisation
- It does not do transaction monitoring, staff training or investigations
- It does not give legal advice on whether procedures are reasonable
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.