The UK failure-to-prevent-fraud offence and non-UK groups

The offence

Since 1 September 2025, a large organisation commits a UK criminal offence where a person associated with it (an employee, agent, subsidiary undertaking or a person who performs services for or on its behalf; a counterparty that merely buys from or sells to the organisation is outside the definition) commits a specified fraud offence intending to benefit the organisation or, where the associate provides services to clients on the organisation's behalf, those clients or their subsidiary undertakings (section 199(1)(b)), unless the organisation proves that it had reasonable fraud prevention procedures in place or that it was not reasonable to expect it to have any (section 199(4)). On the client-benefit route the organisation escapes only if it was itself the victim or intended victim of the fraud (section 199(3)), an exception that does not reach the first route. The prosecution must still prove the base fraud to the criminal standard, whether or not the individual is charged.

The offence was created by section 199 of the Economic Crime and Corporate Transparency Act 2023, with the specified fraud offences listed in Schedule 13 (fraud, participating in a sole trader's fraudulent business and obtaining services dishonestly under the Fraud Act 2006, false accounting and false statements by company directors under the Theft Act 1968, fraudulent trading under section 993 of the Companies Act 2006, cheating the public revenue, and the Scottish common-law equivalents), and the official guidance is explicit: prosecutors do not need to show that managers ordered or even knew about the fraud.

The offence applies to large organisations. At organisation level (section 201) a body qualifies where it met two of three conditions in the financial year before the fraud: more than 250 employees, turnover above GBP 36 million, or a balance sheet total above GBP 18 million. For a parent undertaking (section 202) the same test runs on the group's aggregate figures, with turnover above GBP 36 million net or 43.2 million gross and a balance sheet total above GBP 18 million net or 21.6 million gross, and every subsidiary undertaking counted wherever it sits. Section 199(2) extends liability to a relevant body whose own employee commits the fraud intending to benefit it in a financial year in which its parent undertaking is a large organisation, whether or not the body itself qualifies. On conviction the penalty is a fine, unlimited on indictment (section 199(12)), and the offence is one for which a deferred prosecution agreement is available (Crime and Courts Act 2013, Schedule 17, paragraph 27B). The guidance was updated on 10 October 2025 to adopt the statutory term "subsidiary undertaking" in place of "subsidiary".

Separately, senior-manager attribution runs on its own track. From 26 December 2023, section 196 of the same Act attributed economic crimes committed by senior managers acting within the actual or apparent scope of their authority directly to the organisation; since 29 June 2026, section 250 of the Crime and Policing Act 2026 has replaced it with a rule covering any offence under UK law, subject to an exclusion for conduct wholly outside the UK for which the organisation itself could not be prosecuted, with earlier conduct still governed by section 196; the Home Office and CPS guidance still cite section 196 and await updating. That is a distinct route to corporate liability that no prevention programme can defend against.

Why the offence reaches non-UK groups

An organisation based outside the UK can be prosecuted where the underlying fraud has a UK nexus, for instance where the associated person's conduct is caught by UK fraud law or targets victims in the UK. For a Swiss or EU group, that means UK subsidiaries, UK branches, UK-facing sales teams and even agents dealing into the UK market can each bring the offence to the group entity the fraud was meant to benefit. The limit matters just as much: the Home Office guidance states that the offence does not apply to UK organisations whose overseas employees or subsidiaries commit fraud abroad with no UK nexus, a UK nexus meaning that an act forming part of the underlying fraud took place in the UK, or that the gain or loss occurred in the UK. Groups that treated the UK Bribery Act's failure-to-prevent model as the template will recognise the architecture; fraud, however, can arise in everyday sales, reporting and claims processes where bribery rarely features, and the CPS and SFO updated their joint corporate prosecution guidance ahead of commencement and again in November 2025, in our assessment a clear signal that prosecutors intend to charge it.

Reasonable procedures: the defence

The guidance is organised around six principles familiar from the Bribery Act canon: top-level commitment, risk assessment, proportionate risk-based procedures, due diligence, communication and training, and monitoring and review. Two practical points deserve emphasis. First, the risk assessment is the foundation of the defence: it must be a documented analysis, specific to the business, of how fraud for the organisation's benefit could occur in your business (revenue recognition pressure, sales practices, subsidy and grant claims, greenwashing in disclosures); a recycled anti-bribery matrix will not suffice. Second, proportionality cuts both ways: it permits smaller programmes for smaller risks, but an organisation that does nothing because it deems its risk low is relying on the second limb of section 199(4), that no procedures were reasonably to be expected, and must be able to defend that choice in hindsight, after the fraud.

What this means for you

• Check whether you are in scope, at group level. Size runs on group figures for a parent (section 202), so a group whose UK subsidiary is modest can still be caught at parent level; a subsidiary undertaking is an associated person of its parent, and which entity answers depends on who committed the fraud and who was meant to benefit.
• Run the fraud risk assessment now. It is the foundation of the defence and the record a prosecutor will test first: in our assessment, contemporaneous evidence of prevention procedures is the evidence, and its absence will be read against the organisation.
• Map your associated persons. Employees, agents, subsidiary undertakings and anyone performing services for or on your behalf are inside the offence, for fraud committed in that capacity; a distributor or supplier that merely buys from you or sells to you is not, unless it also performs services on your behalf. Your contracts and diligence should follow that line.
• Adapt what you have. Extend existing anti-bribery and compliance frameworks to fraud scenarios; the six principles map onto what a Bribery Act programme already holds.
• Non-UK boards: minute the analysis. Even a decision that exposure is limited should be documented, with the UK nexus mapping that supports it.

Isak Legal advises Swiss, EU and UK-linked groups on corporate criminal exposure, fraud and financial-crime prevention frameworks and their integration with existing compliance programmes. See our Sanctions and AML and United Kingdom pages, or get in touch.

This client update is provided for general information only, reflects the position as at 27 September 2026 and does not constitute legal advice or create a lawyer-client relationship. Scope thresholds and the treatment of specific structures should be verified against the Act and current guidance at the sources linked above. For advice on a specific matter, please contact us.