What the Failure to Prevent Fraud Offence means for UK businesses
From September 2025, the new Failure to Prevent Fraud Offence will require large companies to show a top-level commitment to fraud prevention. Toby Thomas and Mario Levin of S-RM explore the implications of the legislation, and the practical steps firms can take to ensure effective compliance ahead of the deadline.
The Failure to Prevent Fraud offence (FPF) marks a significant regulatory shift for the companies that fall within its scope. Forming part of the Economic Crime and Corporate Transparency Act (ECCTA), it has been compared to the UK Bribery Act in terms of reach and compliance burden. In fact, its reach extends further than this. The legislation takes an expansive view of what constitutes a UK footprint and is one of the most significant pieces of anti-fraud legislation in decades.
The FPF applies to organisations – including corporates and partnerships - that meet two of the following criteria: more than 250 employees, more than £36 million turnover or more than £18 million in total assets.
Businesses that fall under its remit must demonstrate a clear and robust commitment to preventing fraud, necessitating a thorough review of existing safeguards and corrective action where needed. This includes, but is not limited to, conducting comprehensive risk assessments, implementing risk-based prevention measures and carrying out due diligence on associated persons. At its core, the FPF aims to improve corporate transparency and increase liability for fraudulent activities.
The core impact
Companies should already have robust safeguards against fraudulent activity as part of standard best practices. However, the new legislation mandates that incorporated companies demonstrate a proactive and tangible approach to fraud prevention. But what does this mean?
In simple terms, organisations must implement a comprehensive strategy to identify, safeguard against and report fraudulent activities, introducing new or revised prevention measures where necessary. It shouldn’t be taken lightly by decision makers, with non-compliance penalties under the FPF reaching up to 10% of global turnover.
The burden of proof is now very much on companies to demonstrate they have done everything they can to prevent fraud, where previously it was on prosecutors. The changes reflect a broader trend towards holding corporations more accountable for economic crimes.
A critical aspect of the legislation is the requirement for companies to conduct due diligence on associated persons. The ECCTA’s definition of associated persons extends liability to fraud committed by employees, agents, subsidiaries, and any third party performing services for the organisation, provided there is intent to benefit the company or its clients.
This notably extends beyond the principle of limiting corporate liability to the small group of individuals closely associated with an organisation’s decision making, such as board members and managing directors.
When onboarding agents, suppliers or other third-parties acting “on their behalf”, will be expected to include historical fraud exposure in their due diligence. Scrutinising records for past incidents of fraud, regulatory infractions, and criminal charges is key to demonstrating compliance with the FPF.
While smaller firms and acquisition targets may fall outside the official scope of the FPF, this doesn’t remove the risk they pose for firms under the regulatory microscope. Many of these smaller firms use weaker fraud prevention measures, which will be expected in bigger organisations, and would therefore need to be thoroughly vetted by those bound by the FPF.
Of course, the concept of due diligence is not new – and businesses are already reviewing their counterparts as part of compliance with anti-bribery, corruption and ESG requirements; but the added focus on fraud will slightly adjust the emphasis and focus of such due diligence.
Preparing for compliance: Key steps
With September approaching, many businesses have already begun acting to ensure compliance with the new legislation. Several critical steps will help establish a robust compliance framework.
As a first step, businesses should conduct a tailored fraud risk assessment to identify areas of vulnerability, considering risks posed by employees, subsidiaries, agents and third parties acting on their behalf.
Using the risk assessment results, organisations must prioritise improving existing compliance frameworks. This could be updating anti-bribery, anti-money laundering and governing policies to explicitly address fraud. Internal audits and enhanced internal controls will ensure that proportionate risk-based procedures exist across the organisation.
The work doesn’t stop here. Affected companies must ensure that their teams understand and adhere to fraud prevention measures. Consistent and targeted training promotes awareness of fraud risks and compliance responsibilities at the individual level.
Businesses will also be expected to continuously assess the effectiveness of their fraud prevention measures to maintain ongoing compliance with the legislation. By adopting a comprehensive approach to fraud prevention, organisations can mitigate risk and foster a culture of ethical business practices, demonstrating implementation of the “reasonable prevention procedures” clause referenced in the ECCTA.
The FPF represents a major shift in corporate responsibility, placing the onus on businesses to prevent fraud or face serious consequences. Prosecutors are expected to take firm action against those without robust prevention measures, making inaction a costly risk. A key challenge is the expanded liability for associated persons, adding complexity and potential exposure that may require additional resources or external support. However, by acting early, organisations can not only ensure compliance but also enhance their integrity and governance—turning this regulatory change into an opportunity for more transparent operations and better public image.
