What the “Failure to prevent fraud” law means for UK businesses

A new era of accountability 

On 1 September 2025, the UK introduced a major shift in corporate liability with the enforcement of the “failure to prevent fraud” offence under the Economic Crime and Corporate Transparency Act. This new law, overseen by the Serious Fraud Office (SFO) and the Crown Prosecution Service (CPS), is designed to hold large organisations accountable when fraud is committed by someone acting on their behalf, where the business benefits from it. 

Unlike previous frameworks, this offence doesn’t require proof that senior management knew about or directed the fraud. If an employee, agent, or subsidiary commits fraud that benefits the company, and the company didn’t have reasonable procedures in place to prevent it, the organisation can be prosecuted and face unlimited fines. 

 Why this law matters 

This legislation marks a turning point in how businesses are expected to manage risk. It shifts the burden of proof onto the organisation, requiring them to demonstrate that they had adequate fraud prevention measures in place. In essence, it’s no longer enough to react to fraud after it has occurred—companies must show they were actively working to prevent it. 

The law also aims to level the playing field. Honest businesses that invest in ethical practices and robust compliance systems should not be disadvantaged by competitors who cut corners or turn a blind eye to misconduct. By enforcing accountability, the government hopes to restore trust in corporate governance and reduce the economic damage caused by fraud, which continues to rise year-on-year. 

What businesses should be doing now 

To comply with the new law, firms need to take a proactive and structured approach to fraud prevention. This starts with a thorough risk assessment to identify where fraud could occur—whether in procurement, sales, financial reporting, or client onboarding. Once risks are mapped, businesses should implement proportionate internal controls, such as approval workflows, transaction monitoring, and whistleblowing mechanisms. 

Training is another critical component. Staff must be equipped to recognise fraud, understand their responsibilities, and know how to report concerns. This training should be tailored to different roles and refreshed regularly to reflect evolving risks and regulations. 

Third-party relationships also require close scrutiny. Companies are liable for fraud committed by agents, suppliers, and other associated persons, so due diligence and ongoing monitoring are essential. Contracts should clearly outline expectations, and any red flags should be investigated promptly. 

Finally, documentation is key. In the event of an investigation, the ability to produce evidence of your fraud prevention efforts—risk assessments, training logs, control reviews—could be the difference between prosecution and protection. 

Who is affected? 

The offence applies to large organisations, defined as those meeting at least two of the following criteria: more than 250 employees, over £36 million in turnover, or more than £18 million in total assets. While smaller businesses are currently exempt, they may still be impacted indirectly—especially if they work with larger firms that now require stricter compliance from their partners. 

The “failure to prevent fraud” offence is more than a legal update—it’s a cultural shift. It challenges businesses to move from reactive compliance to proactive integrity. Those that embrace this change will not only reduce their risk exposure but also build stronger, more trustworthy organisations. 

Now is the time to act
Review your fraud prevention strategy, engage your teams, and ensure your procedures are robust, documented, and defensible. In this new era of accountability, prevention isn’t just good practice—it’s the law. 

Need support with your fraud prevention processes? Our experts are here to help. Get in touch today to learn how we can help you, or to set up a free demo to see our anti-fraud tools in action.