UK's Landmark Corporate Fraud Law Takes Effect
Historic Shift in Corporate Criminal Liability
The UK's 'failure to prevent fraud' offense came into force on September 1, 2025, marking what legal experts describe as the most significant expansion of corporate criminal liability in decades. This offense, introduced as part of the Economic Crime and Corporate Transparency Act (ECCTA), fundamentally changes how the UK polices corporate fraud.
[cite author="Nick Ephgrave, Director" source="Serious Fraud Office, September 2025"]I want to be the first to prosecute someone under the new provisions. The deployment of the failure to prevent fraud offense in September will be a landmark moment which will widen the reach and breadth of prosecutions.[/cite]
The law's scope is remarkably broad, covering organizations that meet at least two of three criteria: turnover exceeding £36 million, total assets over £18 million, or more than 250 employees. Crucially, it applies to subsidiaries regardless of their location, and has extraterritorial reach - organizations don't need to be UK-incorporated for the law to apply.
Strict Liability Changes the Game
[cite author="Legal Analysis" source="Sidley Austin LLP, January 2025"]It is a strict liability offense, meaning there is no requirement to prove that the organization or its senior managers had any prior knowledge of the fraud for the offense to apply.[/cite]
This represents a seismic shift from previous requirements. Historically, prosecutors needed to prove fraud was committed with involvement or knowledge of individuals representing the 'directing mind and will' of the organization. Now, if any employee, agent, or subsidiary commits fraud intending to benefit the organization, criminal liability attaches automatically.
[cite author="DLA Piper Analysis" source="January 2025"]The offense marks a major shift in how the UK polices corporate fraud because it removes the previous need to prove that senior management were complicit.[/cite]
The Only Defense: Reasonable Prevention Procedures
Organizations face unlimited fines if convicted, with only one defense available: demonstrating they had reasonable fraud prevention procedures in place at the time of the offense, or that it wasn't reasonable to expect such procedures given the circumstances.
[cite author="UK Government Guidance" source="Home Office, 2025"]The government guidance outlines six principles that organizations must implement: Top-level commitment, Risk assessment, Proportionate risk-based prevention procedures, Due diligence, Communication (including training), and Monitoring and review.[/cite]
Wide-Ranging Fraud Types Covered
[cite author="Crown Prosecution Service" source="September 2025"]Examples may include dishonest sales practices, the hiding of important information from consumers or investors, or dishonest practices in financial markets. The definition of a 'specified fraud offense' includes fraud and false accounting offenses most relevant to large organizations.[/cite]
The specified offenses include fraud by false representation, false accounting, false statements by company directors, and cheating the public revenue. The breadth ensures most corporate fraud scenarios fall within scope.
Extraterritorial Reach Creates Global Impact
[cite author="Travers Smith Legal Analysis" source="September 2025"]The offense has extraterritorial application, meaning the organization does not need to be incorporated or conduct business in the UK for the offense to apply. It will be sufficient to establish jurisdiction if any act or omission that needs to be proved as part of the fraud occurs in the UK or the intended loss or gain was due to take place in the UK.[/cite]
This means international corporations with any UK nexus must implement fraud prevention procedures or risk prosecution. A US company with UK customers, an Asian manufacturer with UK suppliers, or a European bank with London operations all fall within potential scope.
Financial Services Under Intense Scrutiny
[cite author="RSM UK Advisory" source="September 2025"]Financial services organizations face particular scrutiny given the sector's history of fraud cases and the FCA's parallel focus on operational resilience and consumer duty.[/cite]
The timing coincides with massive fraud losses in UK financial services. UK Finance reports over £1 billion stolen through fraud in 2024, with 3.3 million reported incidents. The Financial Conduct Authority received almost 5,000 fake FCA scam reports in just the first half of 2025.
Enforcement Signals Strong Intent
[cite author="SFO Business Plan" source="2025"]The deployment of the failure to prevent fraud offense in September will be a landmark moment which will widen the reach and breadth of prosecutions.[/cite]
The Serious Fraud Office has signaled aggressive enforcement intentions, with Director Nick Ephgrave explicitly stating his desire to be first to prosecute under the new provisions. This suggests organizations should expect swift enforcement action rather than a grace period.
Penalties: Unlimited Fines Create Existential Risk
[cite author="WilmerHale Legal Alert" source="August 25, 2025"]Organizations face unlimited fines if convicted. The maximum penalty for a conviction under the offense is an unlimited fine.[/cite]
Unlike many regulatory penalties with caps, the unlimited fine provision means courts can impose penalties proportionate to the organization's size and the fraud's severity. For large multinationals, this could mean fines in the hundreds of millions or billions.
Implementation Timeline Already Tight
[cite author="Government Announcement" source="GOV.UK, 2025"]Organizations must prepare now for new fraud prevention law. The offense applies to frauds committed on or after September 1, 2025.[/cite]
With the law now in effect, organizations lacking reasonable prevention procedures face immediate risk. Any fraud committed by an associated person from September 1 onwards could trigger prosecution, making implementation of the six government principles urgent.
Global Implications for Multinational Corporations
The extraterritorial reach means multinational corporations must evaluate their global fraud prevention frameworks. A fraud committed by an employee in Singapore benefiting a UK subsidiary, or false accounting in New York affecting UK investors, could trigger UK prosecution.
This represents a new era in corporate criminal liability, with the UK joining a small group of countries imposing strict liability for corporate fraud. Organizations worldwide must now ask: do we have reasonable procedures to prevent any associated person, anywhere, from committing fraud that might benefit us?