Failure to Prevent Fraud: the first few weeks

Matthew Garbutt and David Pack at Devonshires discuss the significance of the new offence and the steps businesses will need to take to navigate the new regulatory environment.

 

The much-heralded “failure to prevent fraud” offence under the Economic Crime and Corporate Transparency Act 2023 came into effect on 1 September 2025. It marks the most significant shift in corporate liability for fraud in a generation, lowering the bar for prosecution and placing prevention at the heart of compliance.

 

We are still in the early days, with no announcements of live investigations. That is unsurprising – fraud cases are complex and prosecutors will be cautious in selecting a test case. The message is clear: the framework is in force and liability can attach.

 

Many organisations were slow to prepare, only revising outward fraud risk assessments over the summer. Any in-scope business still scrambling faces serious financial and reputational risk. Box-ticking exercises undertaken in haste will not stand up to scrutiny. Prosecutors and regulators will expect to see documented, risk-based work, not simply template policies.

 

 

Legal uncertainty remains

One of the most debated questions is how the courts will interpret the scope of an “associated person.” The offence is committed if an employee, agent or other associated person commits a fraud for the benefit of the organisation.

 

The statutory wording is broad and will be tested over time. Is a subcontractor’s subcontractor caught? What about a joint venture partner, or an introducer with a tenuous commercial connection? Case law under the Bribery Act 2010 suggests that courts may take a purposive approach, casting the net widely. Organisations that treat “associated persons” as limited only to payroll staff are exposed to serious risk of prosecution.

 

 

Government guidance

The government’s statutory guidance was published in November 2024. It set out six guiding principles for reasonable fraud prevention procedures. They are sensible in outline (risk assessment, proportionality, due diligence, training, tone from the top, and monitoring), but leave significant gaps.

 

The guidance gave no sector-specific examples, little on proportionality, and did not grapple with complex supply chains. For many in outsourced industries, it raised as many questions as it answered.

 

Professional bodies and trade associations are beginning to issue their own supplementary material to fill the gap. Financial services, for instance, now have UK Finance guidance to help tailor controls. But the landscape remains uneven, and boards still face uncertainty when deciding whether their procedures will be viewed as “reasonable” by a prosecutor or judge.

 

 

Who will be first?

Much attention is focused on which sector will face the first prosecution. Some expect financial services, where fraud risk is well understood and regulators are active. Others point to government contracting, construction and facilities management, where complex supply chains and high-value deals create obvious exposure.

 

Whoever is first, those early cases will set the tone for how “associated persons,” “reasonable procedures,” and prosecutorial discretion are interpreted. Businesses should watch closely.

 

Ultimately, the new offence, like the Bribery offence, is one whose bark may be worse than its bite. Fraud is the most common crime in the UK, costing billions each year, and the government has consistently linked the new offence to the wider economic agenda. Reducing the attraction of fraud is ultimately a way to boost international investment, consumer confidence and economic growth.

 

If the UK can demonstrate a credible system of corporate liability, it strengthens the argument that London is a safe, well-regulated market in which to do business. That ambition will be under the spotlight in the upcoming Autumn Budget, when the Chancellor is expected to link economic crime enforcement with the government’s pro-growth narrative.

 

 

We have the technological tools

One difference from 2011 is the availability of AI-driven tools to identify anomalies in financial transactions, procurement communications and other day to day activities. Used properly, these tools can help organisations spot outward-facing fraud that might trigger liability.

 

Some boards are cautious about cost and data risks, but early adopters will be better placed to demonstrate “reasonable procedures”. Proactive monitoring, supported by technology, is a stronger defence than annual staff training alone.

 

 

A mindset shift

Setting up reasonable procedures is straightforward, but it requires a mindset shift. This is not about employees defrauding the company – it concerns outward fraud, where someone connected commits it for the organisation’s or a client’s benefit.

 

That means practices once viewed as “creative sales tactics” or “over-enthusiastic marketing” could cross the line if they mislead customers, investors or regulators. The reputational risk is obvious: being prosecuted for benefitting from fraud is far more damaging than being seen as the victim of it.

 

The “failure to prevent fraud” offence is not simply another compliance burden. It is a cultural and operational challenge and opportunity. Businesses that treat it as a tick-box exercise will struggle – they must undertake a ground up risk assessment from which to then build their outbound fraud prevention measures and, ultimately, an effective defence to prosecution. Those that invest in credible, risk-based procedures, use technology wisely, and view fraud prevention as part of good governance will not only reduce liability but also strengthen their market position.

 

---

 

Matthew Garbutt and David Pack are Partners at Devonshires

 

Main image courtesy of iStockPhoto.com and ronniechua