Failure to Prevent Fraud: A UK Director’s Checklist for 2026
Failure to prevent fraud is a corporate offence under the Economic Crime and Corporate Transparency Act 2023 (ECCTA): large UK organisations face unlimited fines unless they can prove reasonable fraud prevention procedures.
The offence took effect on 1 September 2025, and the Home Office guidance sets out six principles that regulators and prosecutors will use to judge whether your procedures were reasonable. This checklist turns those principles into decisions a director can take this quarter.
Does the failure to prevent fraud offence apply to your organisation?
The offence applies to “large” organisations, defined as those meeting at least two of three tests: 250 or more employees, turnover of £36 million or more, or assets of £18 million or more. It reaches the parent of a group, and it applies to non-UK companies if the fraud has a UK nexus.
Liability arises when an “associated person” commits a specified fraud intending to benefit the organisation. Associated persons include employees, agents and subsidiaries, and also third parties who perform services on your behalf. Senior management need not have known about the fraud. The organisation’s only defence is to show that it had reasonable prevention procedures in place at the time, or that it was unreasonable to expect any.
The scale of the underlying problem explains the policy. According to the Office for National Statistics, the Crime Survey for England and Wales estimated 4.5 million fraud incidents in the year ending March 2026, and fraud now touches 7.8% of adults aged 16 and over.
Executive Action
- Confirm in writing whether the organisation, or any group entity, meets two of the three size tests, including on a consolidated basis.
- Map the associated persons whose conduct could benefit the group: sales agents, distributors, outsourced finance and procurement providers.
- Minute the conclusion at the Audit or Risk Committee so the decision is evidenced.
What does “reasonable procedures” actually require of directors?
The Home Office guidance is built on six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review. Only the first is explicitly about the boardroom, but the Financial Reporting Council’s UK Corporate Governance Code expects the board to oversee risk management and internal controls, so the other five land on your agenda too.
Top-level commitment is evidenced, not asserted. Prosecutors will ask what the board saw, what it challenged and what it funded. A policy signed by the chief executive but never discussed at board level is weak evidence. Our executive assessment tools can help structure that challenge.
Executive Action
- Place failure to prevent fraud on the board and Audit Committee calendars with a named executive owner.
- Require a written statement of the six principles against current controls, with gaps rated and dated.
- Record board challenge and resourcing decisions in the minutes.
How should you run the fraud risk assessment?
The guidance asks for a documented, dynamic assessment of the opportunity, motive and rationalisation for fraud by associated persons. The in-scope offences include false accounting, fraud by false representation, fraud by abuse of position, false statements by company directors, and cheating the public revenue. Each business line should be tested against the types most relevant to it, such as inflated sales reporting, misleading customer or investor statements, and tax-related misconduct.
Treat the assessment as a living register, refreshed when you enter a new market, acquire a business or change incentive schemes. Pay particular attention to pay structures that reward revenue or margin targets, since they create the motive the guidance highlights. The templates library includes structured review formats you can adapt.
Executive Action
- Commission one enterprise-wide fraud risk assessment, owned by the CFO or CRO, within 90 days.
- Link bonus and target-setting reviews to the assessment findings via the Remuneration Committee.
- Refresh the register after every material acquisition, restructuring or new-market entry.
What do due diligence, training and monitoring look like in practice?
Due diligence now extends to agents, intermediaries and outsourced service providers who perform services for you. Update onboarding questionnaires and contract terms to include fraud prevention warranties, audit rights and termination triggers. The same logic applies to acquisitions: ask what fraud controls the target had before you inherit its liability. Our briefing on director personal liability covers the wider duties directors carry alongside the new corporate offence.
Training should be role-based. Finance, sales, procurement and investor relations teams need worked scenarios, while the board needs a briefing on its own oversight role. Monitoring needs a feedback loop: whistleblowing reports, internal audit findings and near misses should flow to the Audit Committee at least twice a year, with documented changes to controls as a result. More briefings sit in the executive briefing library.
Executive Action
- Add fraud prevention warranties and audit rights to contracts with agents and outsourced providers at next renewal.
- Deliver role-based training and keep attendance records for the evidence file.
- Have internal audit test two high-risk controls per quarter and report results to the Audit Committee.
Frequently asked questions
The organisation is liable, not the individual, if an associated person commits a specified fraud intending to benefit it. Individuals can still be prosecuted for the underlying fraud, and senior managers who consent to or connive in offences face separate exposure.
A conviction carries an unlimited fine. Beyond the fine, firms face reputational damage, potential debarment from public contracts, and investor and lender scrutiny. The practical incentive is to build and document reasonable procedures before any incident occurs.
The offence applies only to large organisations meeting two of three tests: 250 employees, £36 million turnover or £18 million assets. Smaller firms are not directly caught, but they may be asked for fraud controls by large customers who treat them as associated persons.
Contemporaneous records: board and committee minutes, a dated fraud risk assessment, policies, training logs, due diligence files, internal audit reports and evidence of remediation. Documents created after an incident carry far less weight than those that show an established, reviewed programme.
About INFORMD. INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/). Questions? Contact us.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk (/resources/).
