New UK fraud prevention law

What large organisations need to know

On 1 September 2025, a significant new corporate criminal offence came into force in the UK. The Duty to Prevent Fraud offence, introduced as part of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), represents one of the most substantial changes to corporate criminal liability in decades.

If your organisation meets the criteria for a “large organisation,” understanding this new law and taking action to comply is now essential.

What is the duty to prevent fraud offence?

The offence creates corporate criminal liability where an employee or other “associated person” commits fraud intending to benefit the organisation or anyone that receives services from the company, and the organisation does not have reasonable fraud prevention procedures in place.

Crucially, it does not need to be shown that company managers ordered or knew about the fraud. This is a strict liability offence.

Does this apply to your organisation?

The offence only applies to large organisations. A large organisation is defined as any company that satisfies two or more of the following conditions:

• More than 250 employees
• Turnover of more than £36 million
• Balance sheet total of more than £18 million

The offence applies to bodies incorporated or formed in the UK by any means, as well as partnerships (including Scottish partnerships and Limited Partnerships). It also applies to bodies incorporated and partnerships formed outside the UK but with a UK nexus.

Who can trigger the offence?

An “associated person” includes:

• Employees
• Agents
• Subsidiaries
• Anyone providing services for or on behalf of the organisation

These individuals are automatically regarded as associated persons, regardless of whether they are under contract.

What fraud offences are covered?

The offence applies to specific “base fraud” offences listed in Schedule 13 of the ECCTA, including:

• Fraud by false representation (Section 2 Fraud Act 2006)
• Fraud by failing to disclose information (Section 3 Fraud Act 2006)
• Fraud by abuse of position (Section 4 Fraud Act 2006)
• Participation in a fraudulent business (Section 9 Fraud Act 2006)
• Obtaining services dishonestly (Section 11 Fraud Act 2006)

Aiding, abetting, counselling, or procuring the commission of any of these offences would also qualify as a base fraud offence.

An organisation can be prosecuted if the associated person’s conduct constitutes a base fraud offence, even if the associated person is prosecuted for an alternative offence or is not prosecuted at all.

The defence: Reasonable procedures

Organisations have a complete defence if they can demonstrate they had reasonable fraud prevention procedures in place.

On 6 November 2024, the UK government published official guidance setting out six fraud prevention principles that should inform organisations’ fraud prevention frameworks. These principles provide the benchmark against which “reasonable procedures” will be assessed.

The enforcement landscape

The UK Serious Fraud Office (SFO) has made clear its intention to actively pursue prosecutions under this new offence. In February 2024, the Director of the SFO stated the organisation is “very, very keen” to bring charges against companies, noting: “We’re telling [companies] how to avoid getting into trouble” and “come September, if they haven’t sorted themselves out, we’re coming after them.”

Organisations found guilty face unlimited fines, alongside the significant reputational damage and regulatory scrutiny that would accompany such a prosecution.

Taking action: The fraud prevention framework

Government guidance recommends organisations develop their fraud prevention procedures using the fraud triangle model, which examines three elements:

• Opportunity – circumstances that allow fraud to occur
• Motive – incentives or pressures that might lead someone to commit fraud
• Rationalisation – how individuals might justify fraudulent behaviour to themselves

By addressing these three elements, organisations can build comprehensive fraud prevention procedures tailored to their specific risk profile.