What the Offence Is

The offence is set out in section 199 of the Economic Crime and Corporate Transparency Act 2023. A relevant organisation commits it if a person associated with it commits a specified fraud offence, intending to benefit the organisation, or in some cases to benefit a person to whom the associate provides services on the organisation’s behalf. The organisation doesn’t need to have known about the fraud, and no senior individual needs to have been involved. Liability turns on whether the organisation had reasonable procedures to prevent fraud.

That is a deliberate break from the traditional approach to corporate criminal liability, which usually required prosecutors to show that a “directing mind” of the company was involved. It follows the model of the failure to prevent bribery offence in the Bribery Act 2010 and the failure to prevent the facilitation of tax evasion offences in the Criminal Finances Act 2017. Many regulated firms will recognise the structure from those regimes.

The penalty on conviction is an unlimited fine. Beyond the fine, a conviction can carry serious consequences for a regulated firm: questions from supervisors about its systems and controls, damage to relationships with banks and other counterparties, and scrutiny of the Senior Managers responsible for the areas where the fraud happened.

Who It Applies To

The offence applies to large organisations. An organisation is in scope if it meets at least two of the following three conditions in the financial year before the fraud:

The thresholds are applied across the whole group where the organisation is a parent, so a small regulated subsidiary can be caught if its group meets the test. The offence also applies to large organisations incorporated outside the UK where the fraud has a UK connection, for example where it targets UK victims or takes place partly in the UK.

Many smaller FCA-regulated firms will fall below the thresholds. But they shouldn’t assume the issue doesn’t affect them: they may be part of a larger group, they may become large as they grow, and their larger counterparties and distributors may expect them to meet similar standards as associated persons. The Home Office has also said it will keep the thresholds under review.

Associated Persons and Base Offences

Who counts as an associated person

An associated person includes an employee, an agent or a subsidiary of the organisation, and anyone else who performs services for or on behalf of it. For regulated firms, that can extend well beyond the payroll: appointed representatives, introducers, distributors, outsourced service providers and contractors may all be associated persons, depending on the services they perform. Mapping who acts on the firm’s behalf is one of the first practical steps in assessing exposure.

Which frauds are covered

The offence is triggered by specified “base” fraud offences, including fraud by false representation, fraud by failing to disclose information and fraud by abuse of position under the Fraud Act 2006, false accounting, false statements by company directors, fraudulent trading and cheating the public revenue. Money laundering itself is not a base offence, but in practice fraud and money laundering are closely linked, and the same people and controls often address both.

The intended benefit test

The fraud must be intended to benefit the organisation, directly or indirectly. The benefit doesn’t have to materialise, and the organisation doesn’t have to have known about it. An organisation that is itself the victim of the fraud is not liable under the offence, which is aimed at fraud committed for the organisation, not against it.

Where the Risk Sits in Financial Services

For regulated firms, the risk of fraud committed for the firm’s benefit tends to concentrate in a few areas:

• Sales and advice. Mis-selling driven by targets or incentives, misleading statements about products, or hidden charges.
• Financial promotions and marketing. Claims that are false or misleading in ways that go beyond a regulatory breach.
• Reporting and accounts. Manipulating figures to meet targets, covenants or regulatory thresholds, including capital and liquidity reporting.
• Claims and customer remediation. Unfairly rejecting claims or understating amounts owed to customers.
• Third parties. Introducers, appointed representatives and distributors making false representations to customers to win business for the firm.
• Tax. Arrangements that stray into cheating the public revenue.

Many of these overlap with conduct risks already covered by the Consumer Duty and the FCA’s rules on financial promotions. The difference is the consequence: what was a regulatory breach can now, in serious cases, expose the firm to prosecution.

The Reasonable Procedures Defence

The organisation has a defence if it can show it had reasonable procedures in place to prevent fraud, or that it was reasonable in the circumstances not to have any. The burden is on the organisation, so evidence matters. The Home Office has published statutory guidance built around six principles:

• Top-level commitment. The board and senior management lead a culture where fraud is unacceptable, and are seen to do so.
• Risk assessment. The organisation assesses the nature and extent of its exposure to fraud by associated persons, and keeps that assessment up to date.
• Proportionate risk-based prevention procedures. Procedures are proportionate to the risks identified and to the organisation’s size and complexity.
• Due diligence. The organisation applies risk-based due diligence to those who act for it.
• Communication, including training. Policies are communicated and understood, with training proportionate to risk.
• Monitoring and review. Procedures are monitored, tested and improved over time, including after incidents.

The guidance is not a checklist, and following it doesn’t guarantee the defence. But a regulated firm that can show a documented fraud risk assessment, clear ownership, proportionate controls and evidence of testing will be far better placed than one that relies on general compliance arrangements without considering this offence specifically.

What It Means for Senior Managers

The offence creates liability for the organisation, not for individuals directly. Individuals who commit fraud remain liable for the underlying offence in the usual way. But for regulated firms, it has a clear Senior Manager dimension.

Under the SMCR, Senior Managers are accountable for the areas set out in their Statements of Responsibilities and must take reasonable steps to prevent regulatory breaches in those areas. A fraud committed for the firm’s benefit in a business area will raise questions about whether the responsible Senior Manager had adequate controls in place. Our guide to the Duty of Responsibility and reasonable steps explains how that accountability works.

In practice, ownership of the firm’s fraud prevention framework usually sits with one of a small number of people:

There’s no single right answer, but there should be a clear one, recorded in the relevant Statement of Responsibilities and the firm’s responsibilities map. Many firms give overall ownership to the CRO or compliance officer, with the financial crime function providing typologies, monitoring and investigation.

Practical Steps for Boards

The firm’s whistleblowing arrangements matter here too. Staff who see fraud being committed for the firm’s benefit need a route to raise it that they trust. Our guide to the whistleblowers’ champion covers the SMCR role responsible for overseeing those arrangements.

The People Behind the Procedures

Reasonable procedures depend on people with the experience to design and run them. Firms reviewing their response to the offence often find gaps in three areas: a risk function without the capacity to run a fraud risk assessment, a financial crime team focused only on external fraud, and no single senior owner. Filling those gaps may mean strengthening the second line, appointing a fraud lead, or making a senior hire.

We recruit the senior people who own these risks. Our pages on chief risk officer recruitment (SMF4), compliance officer recruitment (SMF16) and financial crime leadership recruitment explain how we run those searches. For firms that need help quickly, fractional and interim cover can put experienced people in place while permanent arrangements are decided.

Frequently Asked Questions

When did the offence come into force?

On 1 September 2025. It applies to fraud committed on or after that date.

Does it apply to small regulated firms?

Only to organisations that meet two of the three size conditions, assessed across the group. Many small firms are outside scope, but those in larger groups may be caught.

Can individual Senior Managers be prosecuted under this offence?

No. The offence is committed by the organisation. Individuals remain liable for any fraud they commit personally, and Senior Managers remain accountable under the SMCR for their areas of responsibility.

Is fraud against the firm covered?

No. The offence covers fraud intended to benefit the organisation. Fraud against the firm is dealt with by other law and by the firm’s existing controls.

Does following the Home Office guidance guarantee the defence?

No, but it is the clearest indication of what reasonable procedures look like, and courts will take it into account.