Corporate criminal liability

The failure to prevent fraud offence: what UK boards need to know

Since 1 September 2025, a large organisation is criminally liable if an employee, agent or other associated person commits fraud intending to benefit it or its clients, unless it can prove it had reasonable procedures in place to prevent that fraud. The offence is in section 199 of the Economic Crime and Corporate Transparency Act 2023. This reference sets out who is in scope, which frauds count, how the defence works and what it means for directors, with links to the legislation and Home Office guidance.

Part of: D&O defence costs and investigations cover

How the offence works

Section 199 of the Economic Crime and Corporate Transparency Act 2023 makes a “relevant body” — a body corporate or partnership, wherever incorporated or formed — guilty of an offence if it is a large organisation and a person associated with it commits a fraud offence intending to benefit, directly or indirectly, the organisation or a person to whom the associate provides services on its behalf, such as a client.

• No need to prove the board knew. The Home Office guidance says it does not need to be demonstrated that directors or senior managers ordered or knew about the fraud. The SFO and CPS describe it as a strict liability offence.
• Intended benefit is enough. The organisation need not actually benefit, and benefiting it need not be the fraudster’s main motive.
• Victims are excluded. Where the fraud was intended to benefit a client, the organisation is not guilty if it was itself the victim or intended victim (section 199(3)).

An associated person is an employee, agent or subsidiary undertaking, or anyone who otherwise performs services for or on behalf of the organisation, judged on all the relevant circumstances (section 199(7) and (9)). The guidance says people who provide services to an organisation, such as external lawyers, accountants or engineers, are not associated persons unless they also provide services for or on its behalf and the fraud is committed in that context. The fraud must be committed in the person’s capacity as an associate, and there must be a UK connection: part of the fraud takes place in the UK, or the gain or loss occurs here.

Who is in scope: the “large organisation” test

The offence applies only to large organisations. Under section 201, an organisation is large if it met at least two of these conditions in its financial year before the year in which the fraud was committed:

Condition	Threshold
Turnover	More than £36 million
Balance sheet total (total assets)	More than £18 million
Employees	More than 250 (monthly average)

For a parent undertaking, section 202 applies the test to the whole group, aggregating the parent and its subsidiary undertakings, including those operating wholly outside the UK. LLP networks, franchises and supply chain companies are not aggregated. A subsidiary that is not itself large can still be prosecuted where its own employee commits fraud intending to benefit it and its parent is a large organisation (section 199(2)).

Relevant bodies include companies, limited liability partnerships, partnerships and bodies created by Royal Charter or statute. Incorporated charities that meet the size test are in scope; unincorporated organisations other than partnerships are not. The Secretary of State can change the size test by regulations, or remove the large-organisation limit altogether (section 201(6) and (7)).

Which fraud offences are covered

The underlying “base” fraud offences are listed in Schedule 13. Aiding, abetting, counselling or procuring any of them also counts (section 199(6)).

Jurisdiction	Base fraud offences (Schedule 13)
England and Wales	Fraud by false representation, failing to disclose information or abuse of position (Fraud Act 2006, section 1); participating in fraudulent business carried on by a sole trader (section 9); obtaining services dishonestly (section 11); false accounting and false statements by company directors (Theft Act 1968, sections 17 and 19); fraudulent trading (Companies Act 2006, section 993); cheating the public revenue (common law)
Northern Ireland	The same offences, with false accounting and false statements by company directors under the Theft Act (Northern Ireland) 1969, sections 17 and 18
Scotland	Fraudulent trading (Companies Act 2006, section 993) and the common law offences of fraud, uttering and embezzlement

Money laundering offences are not on the list. Regulations can amend it, but any offence added must be an offence of dishonesty, similar in character to those originally listed, or one of three money laundering offences under the Proceeds of Crime Act 2002 (section 200).

The defence, the Home Office guidance and what boards should do

It is a defence for the organisation to prove that, when the fraud was committed, it had the prevention procedures it was reasonable in all the circumstances to expect, or that it was not reasonable to expect it to have any (section 199(4)). The burden is on the organisation, on the balance of probabilities, and only a court can decide whether procedures were reasonable.

Section 204 requires the Secretary of State to publish guidance. The Home Office published it on 6 November 2024 and last updated it on 10 October 2025. It is advisory, but a court will take adherence to its six principles into account: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication (including training) and monitoring and review. It is not a safe harbour: following it may not be enough if the organisation has particular risks it has not addressed. It also says it will rarely be reasonable not to have carried out a risk assessment, that an audit alone cannot amount to a defence, and that being regulated does not automatically mean existing compliance processes qualify.

The guidance places responsibility for preventing and detecting fraud with those charged with governance. Practical steps for an in-scope board:

• Confirm whether the organisation or its group met the size test in the previous financial year.
• Give named people responsibility for the fraud prevention framework, with direct access to the board.
• Approve a documented fraud risk assessment, reviewed at consistent intervals — typically annually or every two years — and record any decision not to act on a risk, with the name and position of whoever authorised it.
• Ask whether bonuses, commission, targets or time pressures could encourage fraud.
• Review due diligence and contract terms for agents and service providers, and keep whistleblowing channels independent.
• Have the prevention plan tested by people who did not write it.

Penalties, personal liability and insurance

An organisation convicted of the offence is liable to a fine (section 199(12)). The Home Office and the CPS describe it as an unlimited fine; on summary conviction in Scotland or Northern Ireland the fine cannot exceed the statutory maximum. Prosecutors include the CPS and the Serious Fraud Office, with the Crown Office and Procurator Fiscal Service in Scotland and the Public Prosecution Service in Northern Ireland. Section 206 makes it eligible for a deferred prosecution agreement, which the guidance notes is available in England and Wales only, and lists it as a “serious offence” for the purposes of serious crime prevention orders. The guidance says an organisation’s co-operation and full disclosure are taken into account in deciding whether to prosecute.

The offence creates no personal liability for directors or managers who failed to prevent a fraud. Anyone who commits the underlying fraud, or encourages or assists it, can still be prosecuted for it, including directors and senior managers.

Where insurance fits. The offence is committed by the organisation, and criminal fines are generally not insurable. Directors can still be investigated personally where a fraud raises questions about their own conduct. A directors’ and officers’ (D&O) policy can typically help individual directors with legal defence and investigation costs, subject to the policy wording, limits and exclusions. Policies typically exclude deliberate fraud and dishonesty, and D&O insurance should not be relied on to pay fines or penalties. Apex arranges D&O insurance: see D&O defence costs and investigations cover.

Smaller organisations and the senior manager rule

Organisations below the size test are outside section 199, but not outside corporate criminal liability:

• Senior managers can make any organisation liable. From 26 December 2023, section 196 of the Act made a company or partnership guilty of a listed economic crime, including fraud, false accounting and bribery, committed by a senior manager acting within the actual or apparent scope of their authority — regardless of the organisation’s size, as the SFO and CPS confirm. Since 29 June 2026, section 250 of the Crime and Policing Act 2026 has replaced sections 196 to 198 with a senior manager rule that applies to all offences. A senior manager is someone who plays a significant role in managing or organising, or deciding how to manage or organise, the whole or a substantial part of the organisation’s activities.
• Large clients may pass requirements down. The guidance warns that small organisations may be associated persons while providing services for or on behalf of large organisations, and may face contractual requirements from them.
• The guidance is good practice. The Home Office says its principles may be helpful for smaller organisations too.

For founders and directors of growing companies, see what a founder is personally liable for and D&O insurance for startups.

Frequently asked

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not legal or tax advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.