Read with the right scope
UK failure-to-prevent-fraud regime under ECCTA 2023. Large-organisation, group, associated-person and territorial rules require careful assessment. Smaller organisations may adopt proportionate good practice.
Status: Current law and implementation guide · source-checked 1 November 2026
Check which organisation and conduct are in scope
The failure-to-prevent-fraud offence under section 199 of the Economic Crime and Corporate Transparency Act 2023 has operated since 1 September 2025. It concerns specified fraud by an associated person intended to benefit the organisation or, in defined circumstances, its client. It is different from merely being a victim of fraud.
The size test generally requires at least two of: turnover above £36 million, balance-sheet total above £18 million and more than 250 employees in the preceding financial year. Parent and subsidiary provisions must also be considered: a standalone entity-size check is insufficient for groups. Territorial reach and the precise conduct matter. Obtain advice where application is uncertain.
Start with prevention, not a declaration
Section 199 provides a defence based on reasonable prevention procedures, or circumstances in which expecting any procedures would not be reasonable. A website checklist cannot decide that defence. The Home Office guidance sets out six prevention principles: senior commitment, assessment of risk, proportionate procedures, due diligence, communication including training, and monitoring and review. The guidance is advisory; the legislation and facts remain decisive.
Practical workflow: follow the incentive
The following is an editorial implementation approach. Consider where someone performing services for the organisation might misrepresent facts to secure revenue, meet a target or benefit a client. Include intermediaries and delivery arrangements rather than reviewing employees alone. Distinguish this assessment from controls aimed only at preventing theft from the organisation.
- Identify decisions and representations that can influence sales, finance, grants, claims or reporting.
- Ask where incentives, time pressure, weak challenge or unreliable information could enable misconduct.
- Link each material scenario to a control, accountable owner and evidence of operation.
- Check escalation and speak-up arrangements, including how concerns about senior people are handled.
- Test a selection of real transactions or representations, record limitations and follow exceptions.
Give the board a decision-ready account
Report the assessment scope, key scenarios, control gaps and overdue work. Show whether training covered the relevant roles and whether due diligence addressed the actual services performed. Record what changed following incidents, near misses or challenge.
An illustrative control might require an independently evidenced check of a material claim before it reaches a customer. The correct design depends on the product and risk; approval signatures alone may leave the underlying representation untested. Track implementation and retesting separately.
Smaller organisations should assess their own legal position and may use these principles proportionately. Do not label every SME directly subject to this offence, or advertise a completed template as protection from prosecution.
Put the guide to work
Start with the evidence.
- A documented scope assessment, including unresolved organisation or group questions.
- Scenarios identifying who might make a misleading representation, the incentive and the intended benefit.
- Checks of actual claims, transactions or representations, including exceptions and sample limits.
- Senior review of gaps, escalation arrangements and evidence required before actions can close.
Your first three steps
- Confirm the scope assessment and assign unresolved questions to someone able to obtain suitable advice.
- Follow one revenue, claim or reporting process to identify incentives and opportunities for misrepresentation.
- Inspect whether a prevention measure challenged the underlying facts in selected real cases.
Common gaps to look for
- The review considers only fraud against the organisation.
- Approval signatures replace checks of the underlying representation.
- A policy is treated as proof that prevention procedures operate effectively.
Review when: Revisit when incentives, intermediaries, services or group arrangements change, or when a concern exposes a prevention weakness.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the governance guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- ECCTA 2023 — section 199, failure to prevent fraud ↗Source checked 1 November 2026 · Primary source
- ECCTA 2023 — section 201, large organisations ↗Source checked 1 November 2026 · Primary source
- Home Office — guidance on the offence of failure to prevent fraud ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.