Amongst the various changes introduced by the Economic Crime and Corporate Transparency Act 2023 is a new “failure to prevent fraud” offence. Timing for implementation of the offence is unclear but it is expected that it could come into force during early 2025.

What is the “failure to prevent fraud” offence?

Subject to the defence noted below, an organisation will be liable where a specified fraud offence is committed by an employee or agent, for the organisation’s benefit.

The specified fraud offences include fraud by false representation, fraud by failing to disclose information and false accounting, amongst other offences. Notably money laundering offences are not included within the scope of the offence.

The specified fraud has to benefit the organisation. It should be noted that this can include an indirect benefit for an organisation and it does not need to be shown that the executive team and/or board of an organisation ordered or even knew about the fraud.

If convicted of the offence, the penalty is an unlimited fine for the organisation. Board members and/ or the executive team will not be held individually liable and prosecuted for a failure to prevent fraud.

Who will the offence apply to?

Unlike the existing “failure to prevent” offences (in respect of bribery and tax evasion), the new offence will only apply to “large organisations”. It applies to all “large” corporate entities including community benefit societies and registered charities.

To qualify as a "large organisation", an organisation must meet two of three threshold conditions, in the financial year preceding the year of the offence:

• more than 250 employees;
• more than £36 million turnover; and/or
• assets of more than £18 million.

Additionally, the offence will apply to a parent entity if the wider group (parent and subsidiaries) meets, in aggregate, two or more of the criteria noted above.

Is there a defence?

Organisations will be able to avoid prosecution if they have “reasonable procedures” in place to prevent fraud. There may also be circumstances where it is reasonable to have no fraud prevention procedures in place (for example, organisations where the risk is extremely low).

The Government will be publishing guidance on what these "reasonable procedures" should look like within the next couple of months but it is expected that such guidance will focus on proportionate policies and procedures, a top-level commitment, risk assessments, due diligence, communications and monitoring and review.

What do Registered Providers need to do now?

Registered Providers within the scope of the offence will need to conduct risk assessments and examine their current fraud detection and prevention measures against such guidance once it has been published. We will be keeping an eye on developments and will issue a further update once guidance has been published.

If you have any queries on this, please contact Rachel Orgill-Harris.