With the entry into force of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), UK corporate criminal law has undergone a profound transformation. As from 1 September 2025, companies may be held criminally liable for fraud committed by their employees, agents or group companies – even where management was unaware of the conduct.

This is not a routine regulatory update: it represents a structural shift in the legal risk borne by organisations.

If your company operates in the United Kingdom – or forms part of a group with a UK presence – this article is relevant to you.

1. The offence: what it consists of

The ECCTA introduces a new corporate offence, and criminal liability arises where:

• a fraud offence is committed by an employee, agent, subsidiary or other associated person of the entity;
• the fraud is intended to benefit the organisation, directly or indirectly; and
• the entity had not adopted reasonable measures to prevent such conduct.

This is a strict liability offence: the prosecution is not required to prove fault or awareness on the part of the entity. The only available defence is to demonstrate that “reasonable procedures” were in place.

2. Who is subject to the provision?

The offence applies to “large organisations”, namely entities that meet at least two of the following criteria:

• turnover exceeding £36 million;
• total assets exceeding £18 million;
• more than 250 employees.

The size criteria are assessed at group level, on a consolidated basis. This means that even a small UK subsidiary of an international group—which would not meet the thresholds on a standalone basis—may fall within scope if the group as a whole meets the relevant parameters.

For multinational groups with a presence in the United Kingdom, this significantly extends the scope of exposure. It is not sufficient to assess the size of the single local entity: the group must be analysed as a whole.

3. A turning point in corporate criminal liability

Traditionally, UK criminal law required – when attributing liability to a company – proof that the individual who committed the offence constituted the “directing mind and will” of the entity, i.e. a senior individual. This mechanism, known as the “identification principle”, made it in practice difficult to prosecute large organisations, where decision-making is distributed and offences may be committed at intermediate levels.

The ECCTA overcomes this limitation on two fronts: it introduces the “failure to prevent” offence and expands corporate liability for acts of “senior managers”, lowering the threshold for attribution to the company.

The combined effect is a significantly broader exposure to criminal risk, including for conduct carried out at non-senior levels of the organisation.

4. A framework consistent with existing legislation

The new offence forms part of an already established legislative framework in UK law, which includes:

• the Bribery Act 2010 (“failure to prevent bribery”);
• the Criminal Finances Act 2017 (“failure to prevent facilitation of tax evasion”).

These provisions share the same structure: liability for acts of associated persons, without the need to prove corporate intent, with a defence based solely on the adoption of adequate procedures.

From a compliance perspective, the legislator’s message is clear and consistent: organisations must actively manage the risk of wrongdoing, rather than merely suffer its consequences.

5. Practical impact on businesses

Increased exposure to risk

Companies may now be held liable for fraud committed by employees in finance or commercial functions, by intermediaries, distributors and third-party agents, or within subsidiaries and group structures.

Risk is amplified in organisations with decentralised operating structures or a strong reliance on third parties.

Internal controls and governance

The absence of formalised and documented procedures is the primary risk factor. Informal practices – even if effective in day-to-day operations – do not meet the legal requirement of “reasonable procedures”.

Key areas of concern include:

• payment approval processes;
• lack of segregation of duties, i.e. absence of separation between those who authorise, execute and review transactions;
• insufficient oversight of third-party relationships; and
• absence of documented policies and training programmes.

Implications for international groups

For groups with a presence in the United Kingdom, the legislation requires a coordinated review of global policies, an assessment of cross-border fraud risks and the implementation of consistent safeguards across the various group entities.

6. What are “reasonable procedures”?

An adequate compliance framework for the purposes of the defence should include:

• a risk assessment calibrated to the business model and geographic footprint;
• proportionate policies and procedures (e.g. anti-fraud policies and internal controls);
• explicit commitment from top management;
• due diligence on third parties;
• training and communication at all levels of the organisation;
• periodic monitoring and review mechanisms.

In other words, organisations must move from informal practices to structured, documented and verifiable compliance systems.

7. Actions to be taken

Organisations falling within the scope of the provision should promptly undertake the following activities:

• conduct a fraud risk assessment across the entire operational and supply chain;
• implement or update anti-fraud policies in line with ECCTA requirements;
• strengthen internal controls, including payment and approval processes;
• establish whistleblowing procedures and reporting management systems;
• provide targeted training to employees and management;
• implement continuous monitoring mechanisms and periodic audits.

These measures are not solely defensive: they also contribute to strengthening overall governance and operational resilience.

8. A preliminary check: are you already exposed?

In many cases, organisations already have elements of compliance in place – but these are often:

• undocumented;
• applied inconsistently;
• not integrated into a coherent and verifiable framework; or
• not supported by appropriate training programmes.

Addressing these gaps is essential to building a credible defence in the event of enforcement action. It is not sufficient to do the right thing: it must also be possible to demonstrate it.

How we can support you

The offence of “failure to prevent fraud” cannot be addressed through a simple policy update: it requires a structured response tailored to the specific features of your business and group.

Our firm has the legal and technical expertise required to support organisations at every stage of this process:

• risk assessments to map exposure across the organisation and supply chain;
• design and implementation of anti-fraud frameworks compliant with ECCTA requirements;
• support in structuring third-party due diligence and drafting protective contractual clauses;
• targeted training programmes for boards of directors, management and operational teams.

Our approach is pragmatic and results-oriented: we do not offer standardised solutions, but operational frameworks tailored to your organisation, designed to withstand potential scrutiny.

In a context where enforcement is expected to intensify, having the right framework in place is not an option – it is your first line of defence.