The UK Failure to Prevent Fraud regime takes effect on 1 September: Here's what you need to know

Prior to ECCTA, a corporate organisation could only be criminally liable under UK laws for fraud committed by it as an organisation, i.e. where the corporate itself could be shown to have the requisite dishonest intent (or 'mens rea') for criminality of this nature to arise. Historically, that meant that the fraud would have to have been committed with the involvement or knowledge of individuals representing the 'directing mind and will' of the particular organisation. This was a very high bar, effectively requiring board-level complicity for corporate criminal liability to arise but, as the high-profile failed prosecution of Barclays arising out of the global financial crisis showed, even alleged complicity by the CEO and CFO was not enough.

ECCTA changes this in two ways:

1. Entirely separately to the FTPF Offence (and so not the primary focus of this article) it expands the test for attribution of criminal liability. As of 26 December 2023, criminal liability may be attributed to corporates for fraud (and certain other economic offences, including bribery) which is committed by a 'senior manager' (broadly defined to include persons playing a significant role in the relevant decision making of the organisation or the management of its relevant activities). This provides an expanded scope for corporates to be treated as having committed fraud themselves - as distinct to being liable for the fraud of others, which is the focus of the FTPF Offence. There is no 'reasonable procedures' defence available at law for this type of liability, making training and controls around senior managers critical.
   
   
2. It introduces the FTPF Offence, as summarised below. This is not a case of a corporate being treated as having itself committed fraud; rather it is liable for not preventing others closely associated with it (including employees) from themselves committing frauds which benefit the business. It is a strict liability offence, in the sense that the corporate can be liable regardless of its 'state of mind' / complicity in that fraud (albeit the associated person will need to have the requisite dishonest intent). This – and the broad nature of 'fraud' offences (which can capture a wide range of dishonest behaviour) – makes the new regime a very significant expansion in the risk of criminal liability of corporate entities.

Under the FTPF Offence, an in-scope corporate entity can be held criminally liable where an ‘associated person’ (such as an employee, agent, subsidiary or another person who performs services for or on behalf of the entity), commits a 'specified fraud offence' (which encompasses various offences, with some degree of intentional deception being the common thread to them) intending directly or indirectly to benefit either: (i) that entity, or (ii) any person to whom, or to whose subsidiary undertaking, the associated person provides services on its behalf (i.e. a client), and the in-scope entity is not a victim of that fraud.

An in-scope entity is a large organisation which meets at least two of the following three criteria (in the financial year of the organisation that precedes the year of the FTPF Offence – note that similar, albeit higher criteria, can apply at an aggregate group level):

(i) more than £36 million turnover;

(ii) more than £18 million in total assets;

(iii) more than 250 employees.

A subsidiary of a large organisation, which is not itself a large organisation, can also be held liable if it fails to prevent fraud committed by an employee of the subsidiary (where the fraud was intended to benefit the subsidiary).

There is a full defence to the FTPF Offence where an organisation can demonstrate that: (i) it had reasonable fraud prevention measures in place at the time the offence took place; or (ii) it would have been unreasonable to expect the organisation to have any prevention procedures in place (which we expect will be a more difficult defence to prove in practice, particularly for more sophisticated corporate organisations).

It is important to note that a 'large' organisation (and its subsidiaries) will be within the scope of the FTPF Offence regardless of where they are incorporated (i.e. it is not only UK incorporated organisations who can be prosecuted under the new regime). For liability to arise there does however need to be an underlying fraud offence which is triable under UK law – which could arise in respect of fraudulent activity which takes place overseas, if there were an impact on / harm to persons in the UK.

For more detail on the mechanics of the FTPF Offence, please see our original FTPF Offence briefing available here.

Yes and no.

The overall approach of the FTPF Offence very much follows the playbook the UK government established for tax evasion and bribery: i.e. that organisations may be liable for these economic crimes where committed for their benefit by persons associated with them, unless they can show they made reasonable efforts to prevent the same. That said, there are a number of technical differences in the regimes. For example: only the FTPF Offence has a qualification threshold of 'large' organisations, it has (in some ways) a broader jurisdictional nexus, and it employs a subtly wider construction of 'associated persons (which, for example, captures subsidiaries).

However most importantly, 'fraud' is a significantly broader concept of criminal liability as compared to the existing regimes. It captures a wide spectrum of dishonest acts – which will in many cases encompass, or arise alongside, bribery and/or tax evasion offences. This overlap is discussed in the recently updated 'Joint SFO-CPS Corporate Prosecution Guidance'. And so, whilst the impact (in enforcement terms) of the tax evasion^[1] and bribery regimes has not been significant, beyond a limited number of high-profile bribery cases, the fraud regime does have the potential for higher levels of enforcement. This also means that it is important that organisations consider their approach to fraud prevention procedures alongside, and in a way which is consistent with, their approach to these similar regimes.

It remains to be seen whether the UK government has the appetite to roll-out the 'failure to prevent' concept of liability to other areas, and particularly beyond economic crimes. The idea of statutory liability for 'failure to prevent' human rights breaches is, for example, frequently raised by various committees and back-benchers, but has not as yet progressed as a serious policy proposal.^[2]

Examples of higher-risk situations for businesses include:

• Employees working in parts of the business where they are more likely to encounter fraud (or the opportunity to commit fraud), such as those involved in sales, marketing, financing, providing services to clients directly or invoicing and payroll. Contractors, part-time and flexible workers may also pose similar risks, particularly if they are not adequately trained before starting their role.
  
  
  • In-scope organisations do not technically need to receive any actual benefit for the FTPF Offence to apply (and, even if they do, the benefit does not need to be financial in nature). Being the intended beneficiary is sufficient and the same applies if the intention was to benefit the clients to whom the associated person provides services for or on behalf of the relevant organisation.

• It should also be emphasised that UK Government guidance suggests that the intention to benefit the organisation does not need to be the primary reason for the fraud being committed (although we may need to await court action for the boundaries of this to be properly tested, given the law is not clear on the point). If correct, this would mean the FTPF Offence could arise where the associated person's primary reason for committing (or attempting to commit) fraud is to benefit themselves, but a secondary consequence of benefiting the organisation at the same time was known.
  
  
  • This means that employees and other associated persons who receive additional pay (or bonuses) based on how well the company is performing (or where their remuneration is otherwise tied to meeting specific company performance metrics, such as product launches) may be considered higher risk from an FTPF Offence perspective.

• Companies that have outsourced parts of their business to be performed for or on behalf of the organisation (e.g. generating sales leads, providing support services) to other countries where either (i) the organisation has less oversight and control and/or (ii) the business environment means fraud may be more commonplace.
  
  
  • Outsourcing services may generally be higher risk from an FTPF Offence perspective – ‘providing services’ (the general test for who is an associated person, beyond employees, agents and subsidiaries) does not include providing goods and it also does not include situations where services are being provided to the organisation (such as an accountant or lawyer providing a service to a company). 

Yes. A corporate parent company may be prosecuted for acts of its subsidiary where:

1. The base fraud offence is committed 'corporately' by a subsidiary (as discussed above, this means a senior manager must have been culpable in it);
   
   
2. The beneficiary of that offence is (in whole or in part) the parent organisation or its clients and the subsidiary intended to benefit either the parent company (and it is suggested that in this instance that benefit needs to be relatively direct, i.e. the parent company benefitting from an accretion in the value of the subsidiary business is unlikely to suffice) or its clients;
   
   
3. The parent company is not a victim or intended victim of the fraud (noting that an organisation is not considered a victim only because it suffered indirect harm); and
   
   
4. The parent company did not have reasonable fraud prevention procedures in place, or it was not reasonable to have any procedures at the time.

Whilst the above presents a relatively limited scenario, it is nonetheless critical that organisations – and larger and more complex groups with multiple trading entities in particular – carefully consider their governance arrangements and ensure that liability is managed and isolated appropriately

It is a defence to liability for the FTPF Offence if an organisation had reasonable prevention procedures in place to prevent fraud (or it was reasonable not to have any fraud prevention procedures in place) at the time the underlying offence took place.

The UK Government guidance sets out expectations for reasonable fraud prevention procedures, focusing on:

(i) Top level commitment;

(ii) Risk assessment;

(iii) Robust but proportionate risk-based prevention procedures;

(iv) Due diligence;

(v) Communication (including training); and

(vi) Monitoring and review.

A robust corporate compliance package should therefore address all of the above (in a proportionate manner) including an internal fraud prevention plan, a policy, the implementation of internal controls, supporting documents (e.g. employee onboarding procedures and enhanced supplier checks), senior management buy-in, training and regular reviews and monitoring.

The good news is that many organisations will already have many of these systems, policies and controls in place to tackle fraud and/or other related financial crime regimes. However, these will need to be updated (to the extent they have not already been) to ensure that they are sufficient from an FTPF Offence perspective. This can be structured in different ways. We have worked with many organisations to integrate new fraud policies and procedures into existing bribery and/or financial crime procedures. However, many prefer to adopt a standalone fraud policy and approach, to sit alongside the others. Ultimately, the decision of what an organisation's FTPF Offence compliance framework should look like will need to be based on a risk assessment tailored to that specific organisation (including input from internal stakeholders in different areas of the business, and a holistic overview of the operations of the business – including areas where fraud is more likely to take place), and in a way which is coherent with, and does not undercut, its wider governance approach.

Earlier this year, the SFO published their annual business plan, which set out their strategy for 2025-2026, which stated specifically that the "deployment of the failure to prevent fraud offence in September will be a landmark moment which will widen the reach and breadth of prosecutions".

This has recently been followed up by the SFO and CPS publishing 'Joint SFO-CPS Corporate Prosecution Guidance', setting out "the common approach" of the CPS and the SFO to the prosecution of corporate offending, including in relation to the FTPF Offence. Whilst the information in this prosecution guidance does not materially differ from earlier guidance that has already been released by the Government, it suggests that the new FTPF Offence clearly remains on the radar of prosecuting authorities. It also emphasises that corporates should be following Government guidance (see 6 above) in terms of what reasonable fraud prevention procedures should look like if they wish to have a potential defence to the FTPF Offence.

While we anticipate that it will take some time before enforcement in this area gets going, given the potential for an unlimited fine (and associated material investigation and reputational costs), this is something businesses should be preparing for in advance.