The much-anticipated guidance regarding the new UK corporate offence of Failure to Prevent Fraud (FTPF Offence) was published on 6 November 2024. This FTPF Offence is part of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), which was granted Royal Assent on 26 October 2023.
The aim of the FTPF Offence is to change the way in which organisations look at fraud and to encourage measures aimed at detecting and preventing fraud in much the same way as the failure to prevent provisions in s.7 of the Bribery Act 2010 changed the way in which businesses looked at Bribery when that Act was introduced
This offence applies across the UK and can have extra-terrestrial reach when there is a “UK nexus” – see below for an explanation of what this means in practice.
Since the FTPF Offence was introduced, one of the main questions was what “reasonable procedures” should look like for fraud prevention. This Guidance outlines some recommended procedures that organisations can put in place to help prevent fraud.
This offence is set out in sections 199 – 206 and schedule 13 of the ECCTA, and applies to large, incorporated bodies and partnerships across all sectors of the economy,
Organisations will be guilty of an offence if an associated person commits a fraud offence intending to directly or indirectly benefit the organisation or their clients. The definition of associated persons is again similar to that under the Bribery Act 2010. Associated persons include employees, agents, subsidiaries and others. It does not need to be demonstrated that senior managers or directors ordered or knew about the fraud.
A defence is available where the organisation can prove that they had reasonable prevention procedures in place, or that it would have been unreasonable to have expected prevention procedures to be in place. As mentioned above, businesses had many questions about what “reasonable procedures” might look like.
“Incorporated bodies” include organisations incorporated or formed by any means, including but not limited to the Companies Act 2006, Royal Charter, and the Limited Liability Partnerships Act 2000. The offence also applies to partnerships which are not bodies corporate, including Scottish Partnerships and Limited Partnerships formed under the Limited Partnerships Act 1907. As detailed below, this offence can also apply to incorporated bodies and partnerships outside of the UK in certain circumstances.
“Large organisations” meet at least two out of the below three criteria, which apply to the whole organisation including subsidiaries:
The Guidance provides more details regarding the meaning of “intending to benefit”, territoriality, and enforcement. However, a significant portion of this Guidance address reasonable fraud prevention procedures. In essence, the Guidance recommends that an organisation’s fraud prevention frameworks be informed by 6 flexible and outcome focused principles:
Again there are significant similarities here with the guidance issued to accompany the Bribery Act 2010 and it should be relatively simple for most businesses to be able to extend those principles to also deal with the new FTPF Offence.
The guidance has been written by the UK Home Office. It says it has been developed with input from the Crown Prosecution Service (CPS), Serious Fraud Office (SFO), HM Treasury, HMRC, Ministry of Justice, Cabinet Office, Attorney General’s Office and Financial Conduct Authority (FCA).
Possibly. Again the extra-territorial provisions are similar to the Bribery Act 2010. Firstly if an employee or associated person of an overseas-based organisation commits fraud in the UK, or targeting victims in the UK, the organisation could be prosecuted.
If a UK-based employee commits fraud, the employing organisation could be prosecuted, wherever it is based.
But the guidance says “The offence will only apply where the associated person commits a base fraud offence under the law of part of the UK. This requires a UK nexus. By UK nexus, we mean that one of the acts which was part of the underlying fraud took place in the UK, or that that the gain or loss occurred in the UK…The offence will not apply to UK organisations whose overseas employees or subsidiaries commit fraud abroad with no UK nexus. This would be a matter for law enforcement in the country concerned.”
It is also important to remember that a subsidiary undertaking of a large organisation is an associated person for the purposes of the new offence. This means that it is possible for a parent company to be prosecuted for failure to prevent fraud where the initial fraud offence is committed corporately by a subsidiary and where the beneficiary is the parent organisation, or there is a connection with the parent company’s clients. Again we have seen cases under the Bribery Act 2010 where parent companies outside the UK have been involved because of the acts of subsidiaries in the UK.
In addition, there are two ways in which frauds committed by the employee of a subsidiary may be in scope:
According to the Guidance itself, this offence will come into effect 9 months after publication of the Guidance, which would be 6 August 2025. The Home Office website currently states that it will come into force on 1 September 2025. This date will likely be clarified shortly.
The clock has started, and as a result businesses will want to take a look at their own fraud prevention policies and procedures.
For more information please contact Jonathan Armstrong, Partner.
The full guidance can be found at Economic Crime and Corporate Transparency Act 2023: Guidance to organisations on the offence of failure to prevent fraud.
Partner
Jonathan is an experienced lawyer based in London with a concentration on compliance & technology. He is also a Professor at Fordham Law School teaching a new post-graduate course on international compliance.
Jonathan’s professional practice includes advising multinational companies on risk and compliance across Europe. Jonathan gives legal and compliance advice to household name corporations on:
Jonathan has handled legal matters in more than 60 countries covering a wide range of compliance issues. He made one of the first GDPR data breach reports on behalf of a lawyer who had compromised sensitive personal data and he has been particularly active in advising clients on their response to GDPR. He has conducted a wide range of investigations of various shapes and sizes (some as a result of whistleblowers), worked on data breaches (including major ransomware attacks), a request to appear before a UK Parliamentary enquiry, UK Bribery Act 2010, slavery, ESG & supply chain issues, helped businesses move sales online or enter new markets and managed ethics & compliance code implementation. Clients include Fortune 250 organisations & household names in manufacturing, technology, healthcare, luxury goods, automotive, construction & financial services. Jonathan is also regarded as an acknowledged expert in AI and he currently serves on the New York State Bar Association’s AI Task Force looking at the impact of AI on law and regulation. Jonathan also sits on the Law Society AI Group.
Jonathan is a co-author of LexisNexis’ definitive work on technology law, “Managing Risk: Technology & Communications”. He is a frequent broadcaster for the BBC and appeared on BBC News 24 as the studio guest on the Walport Review. He is also a regular contributor to the Everything Compliance & Life with GDPR podcasts. In addition to being a lawyer, Jonathan is a Fellow of The Chartered Institute of Marketing. He has spoken at conferences in the US, Japan, Canada, China, Brazil, Singapore, Vietnam, Mexico, the Middle East & across Europe.
Jonathan qualified as a lawyer in the UK in 1991 and has focused on technology and risk and governance matters for more than 25 years. He is regarded as a leading expert in compliance matters. Jonathan has been selected as one of the Thomson Reuters stand-out lawyers for 2024 – an honour bestowed on him every year since the survey began. In April 2017 Thomson Reuters listed Jonathan as the 6th most influential figure in risk, compliance and fintech in the UK. In 2016 Jonathan was ranked as the 14th most influential figure in data security worldwide by Onalytica. In 2019 Jonathan was the recipient of a Security Serious Unsung Heroes Award for his work in Information Security. Jonathan is listed as a Super Lawyer and has been listed in Legal Experts from 2002 to date.
Jonathan is the former trustee of a children’s music charity and the longstanding Co-Chair of the New York State Bar Association’s Rapid Response Taskforce which has led the response to world events in a number of countries including Afghanistan, France, Pakistan, Poland & Ukraine.
Some of Jonathan’s recent projects (including projects he worked on prior to joining Punter Southall) are:
Everything Compliance: Jonathan Armstrong on the impact President Trump might have on compliance in Europe
In this episode of the Everything Compliance podcast, Jonathan Armstrong takes a look at what the election of President Trump might mean for compliance across Europe. He focuses on a...
2 Min Read
Read More Everything Compliance: Jonathan Armstrong on the impact President Trump might have on compliance in EuropeILTA Voices: Jonathan Armstrong discusses DORA
Jonathan Armstrong of Punter Southall Law joined Leigh Zidwick, Sr Director Info Governance, DLA Piper LLP (US) to discuss DORA. The conversation was facilitated by ILTA Voices, a podcast series by...
2 Min Read
Read More ILTA Voices: Jonathan Armstrong discusses DORAEU Cyber Resilience Act
Cybersecurity is once again headline news and continues to get attention from law makers as new laws pass with the hope of closing out cybersecurity vulnerabilities. On 10 October 2024,...
3 Min Read
Read More EU Cyber Resilience Act
