With the entry into force of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), UK corporate criminal law has undergone a profound transformation. As from 1 September 2025, companies may be held criminally liable for fraud committed by their employees, agents or group companies – even where management was unaware of the conduct.
This is not a routine regulatory update: it represents a structural shift in the legal risk borne by organisations.
If your company operates in the United Kingdom – or forms part of a group with a UK presence – this article is relevant to you.
- The offence: what it consists of
The ECCTA introduces a new corporate offence, and criminal liability arises where:
- a fraud offence is committed by an employee, agent, subsidiary or other associated person of the entity;
- the fraud is intended to benefit the organisation, directly or indirectly; and
- the entity had not adopted reasonable measures to prevent such conduct.
This is a strict liability offence: the prosecution is not required to prove fault or awareness on the part of the entity. The only available defence is to demonstrate that “reasonable procedures” were in place.
- Who is subject to the provision?
The offence applies to “large organisations”, namely entities that meet at least two of the following criteria:
- turnover exceeding £36 million;
- total assets exceeding £18 million;
- more than 250 employees.
The size criteria are assessed at group level, on a consolidated basis. This means that even a small UK subsidiary of an international group—which would not meet the thresholds on a standalone basis—may fall within scope if the group as a whole meets the relevant parameters.
For multinational groups with a presence in the United Kingdom, this significantly extends the scope of exposure. It is not sufficient to assess the size of the single local entity: the group must be analysed as a whole.
- A turning point in corporate criminal liability
Traditionally, UK criminal law required – when attributing liability to a company – proof that the individual who committed the offence constituted the “directing mind and will” of the entity, i.e. a senior individual. This mechanism, known as the “identification principle”, made it in practice difficult to prosecute large organisations, where decision-making is distributed and offences may be committed at intermediate levels.
The ECCTA overcomes this limitation on two fronts: it introduces the “failure to prevent” offence and expands corporate liability for acts of “senior managers”, lowering the threshold for attribution to the company.
The combined effect is a significantly broader exposure to criminal risk, including for conduct carried out at non-senior levels of the organisation.
- A framework consistent with existing legislation
The new offence forms part of an already established legislative framework in UK law, which includes:
- the Bribery Act 2010 (“failure to prevent bribery”);
- the Criminal Finances Act 2017 (“failure to prevent facilitation of tax evasion”).
These provisions share the same structure: liability for acts of associated persons, without the need to prove corporate intent, with a defence based solely on the adoption of adequate procedures.
From a compliance perspective, the legislator’s message is clear and consistent: organisations must actively manage the risk of wrongdoing, rather than merely suffer its consequences.
- Practical impact on businesses
Increased exposure to risk
Companies may now be held liable for fraud committed by employees in finance or commercial functions, by intermediaries, distributors and third-party agents, or within subsidiaries and group structures.
Risk is amplified in organisations with decentralised operating structures or a strong reliance on third parties.
Internal controls and governance
The absence of formalised and documented procedures is the primary risk factor. Informal practices – even if effective in day-to-day operations – do not meet the legal requirement of “reasonable procedures”.
Key areas of concern include:
- payment approval processes;
- lack of segregation of duties, i.e. absence of separation between those who authorise, execute and review transactions;
- insufficient oversight of third-party relationships; and
- absence of documented policies and training programmes.
Implications for international groups
For groups with a presence in the United Kingdom, the legislation requires a coordinated review of global policies, an assessment of cross-border fraud risks and the implementation of consistent safeguards across the various group entities.
- What are “reasonable procedures”?
An adequate compliance framework for the purposes of the defence should include:
- a risk assessment calibrated to the business model and geographic footprint;
- proportionate policies and procedures (e.g. anti-fraud policies and internal controls);
- explicit commitment from top management;
- due diligence on third parties;
- training and communication at all levels of the organisation;
- periodic monitoring and review mechanisms.
In other words, organisations must move from informal practices to structured, documented and verifiable compliance systems.
- Actions to be taken
Organisations falling within the scope of the provision should promptly undertake the following activities:
- conduct a fraud risk assessment across the entire operational and supply chain;
- implement or update anti-fraud policies in line with ECCTA requirements;
- strengthen internal controls, including payment and approval processes;
- establish whistleblowing procedures and reporting management systems;
- provide targeted training to employees and management;
- implement continuous monitoring mechanisms and periodic audits.
These measures are not solely defensive: they also contribute to strengthening overall governance and operational resilience.
- A preliminary check: are you already exposed?
In many cases, organisations already have elements of compliance in place – but these are often:
- undocumented;
- applied inconsistently;
- not integrated into a coherent and verifiable framework; or
- not supported by appropriate training programmes.
Addressing these gaps is essential to building a credible defence in the event of enforcement action. It is not sufficient to do the right thing: it must also be possible to demonstrate it.
How we can support you
The offence of “failure to prevent fraud” cannot be addressed through a simple policy update: it requires a structured response tailored to the specific features of your business and group.
Our firm has the legal and technical expertise required to support organisations at every stage of this process:
- risk assessments to map exposure across the organisation and supply chain;
- design and implementation of anti-fraud frameworks compliant with ECCTA requirements;
- support in structuring third-party due diligence and drafting protective contractual clauses;
- targeted training programmes for boards of directors, management and operational teams.
Our approach is pragmatic and results-oriented: we do not offer standardised solutions, but operational frameworks tailored to your organisation, designed to withstand potential scrutiny.
In a context where enforcement is expected to intensify, having the right framework in place is not an option – it is your first line of defence.