Failure to prevent fraud – managing risk and reputation

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) creates a new criminal offence of failing to prevent fraud.

In this update, we explain the impact of this development for organisations, and the pro-active compliance steps that can be taken to manage risk and protect reputation.

What is the new offence?

Section 199 of ECCTA creates a new criminal offence of failing to prevent fraud. The offence is modelled on existing UK ‘failure to prevent’ offences such as failure to prevent bribery contrary to the Bribery Act 2010 and failure to prevent the facilitation of tax evasion contrary to the Criminal Finances Act 2017.

How does the offence work?

The offence applies to organisations in all sectors.

It is however subject to a size threshold – currently, the offence only applies to “large organisations”. Those are organisations meeting at least two of the following: (1) more than 250 employees (2) more than £36 million turnover and (3) more than £18 million in total assets.

An organisation can be held criminally liable if it fails to prevent certain fraud offences (listed in Schedule 13 to ECCTA which includes the Scots law offences of fraud, uttering and embezzlement) being committed by an “associated person”.

“Associated person” is broadly defined and includes employees, agents, subsidiaries or any person who otherwise performs services for or on behalf of the organisation.

The test is whether the “associated person” commits a fraud intending to benefit: (1) the organisation in question (identified in ECCTA as the “relevant body”) or (2) any person to whom, or to whose subsidiary, the associated person provides services on behalf of the relevant body.

What about victims of fraud?

ECCTA makes clear that an organisation is not guilty of the ‘failure to prevent fraud’ offence “if the body itself was, or was intended to be, a victim of the fraud offence.”

Are there defences to the offence?

Yes. ECCTA provides that it is a defence for the relevant body to prove that, at the time the fraud offence was committed (1) there were prevention procedures in place that were reasonable in all the circumstances for the body to have in place to prevent fraud; or (2) it was not reasonable in the circumstances to expect such prevention procedures to be in place.

It appears that (2) above will only apply very rarely and that organisations are expected to implement reasonable fraud prevention procedures, again a similar model to the existing UK ‘failure to prevent fraud’ bribery and tax evasion facilitation offences.

How does an organisation implement reasonable prevention procedures?

The UK Government has committed to publishing guidance on prevention procedures before the new offence comes into force. The guidance is expected imminently. As matters stand, there is to be a six-month period between the publication of the guidance and the offence coming into force.

Organisations should play close attention to the guidance once published.

In the meantime, a review of existing economic crime compliance measures should be carried out. Responsible organisations will want to consider:

1. Reviewing existing financial controls.
2. Reviewing due diligence processes for engagement with counterparties.
3. Updating existing anti-fraud policies and procedures / preparing new materials.
4. Providing training, particularly to ‘at risk’ teams.
5. Implementing anti-fraud clauses in contracts.
6. Reviewing existing audit and compliance monitoring processes.

Taking action now will assist in (1) front-loading the steps that require to be taken once the new ‘failure to prevent fraud’ offence comes into force (2) limiting the risk of a fraud event occurring now and (3) demonstrating to business partners, investors, staff and other stakeholders that the organisation has a responsible approach to managing the risk of economic crime.

We’re not a “large organisation” – do we need to do anything?

Yes. While the new offence currently applies only to “large organisations”, we can expect a trickle-down effect on other organisations.  “Large organisations” tend to be those at the top of supply chains. They will likely require those in their supply chain to implement sufficiently robust compliance measures, including in relation to fraud prevention.

Additional comment – corporate criminal liability

ECCTA creates a clear route through which organisations can be criminally liable in circumstances where a “senior manager” commits certain economic crimes (including those listed in Schedule 12 to ECCTA. The Scots law offences of fraud, uttering, embezzlement and theft are included).

Section 196 of ECCTA provides “If a senior manager of a body corporate or partnership (“the organisation”) acting within the actual or apparent scope of their authority commits a relevant offence after this section comes into force, the organisation is also guilty of the offence.”

Importantly “senior manager” is defined as an individual who “plays a significant role in (a) the making of decisions about how the whole or a substantial part of the activities of the body corporate or (as the case may be) partnership are to be managed or organised, or (b) the actual managing or organising of the whole or a substantial part of those activities.”

This change is significant. It widens the existing legal position (known as the ‘identification doctrine’) whereby an organisation can be criminally liable at common law where it can be shown that the “directing mind and will” of the organisation committed the offence. The UK authorities have found it difficult to successfully prosecute organisations under the “directing mind and will” test. Section 196 broadens the scope of corporate criminal liability.

It is worth noting that, unlike the new failure to prevent fraud offence, section 196 is not limited to organisations meeting certain size or turnover criteria. Essentially, it applies to organisations of all sizes whether incorporated or formed within or outside the UK.

The change in approach to corporate criminal liability is another reason why organisations should take steps now to review and update existing economic crime compliance measures.