Why this matters.
Section 199 of the Economic Crime and Corporate Transparency Act 2023 created a new corporate criminal offence of “failure to prevent fraud,” which came into force on 1 September 2025. It applies to large organisations (meeting at least two of: 250+ employees, £36 million+ annual turnover, £18 million+ total assets) and their subsidiaries. If an employee, agent, or subsidiary commits a fraud offence that benefits the organisation — or was intended to — the organisation is criminally liable unless it can prove it had adequate fraud prevention procedures in place. The Home Office has published statutory guidance setting out six principles that define what “adequate procedures” means in practice.
Even if your business falls below the size thresholds today, the principles of adequate procedures represent recognised best practice that courts, insurers, and commercial counterparties increasingly expect to see. Penalties for the offence include unlimited fines, mandatory publication of convictions, and significant reputational harm. Subsidiaries of large groups are explicitly in scope regardless of their own size. Now that the offence is live, every business with growth ambitions, a complex supply chain, or third-party relationships should assess its fraud risk exposure and document the controls it has in place.