Large businesses, corporations and partnerships will now be held liable if it’s found the offence was committed with the ‘intention of benefiting the organisation or their clients’ and they did not take reasonable steps to prevent fraud, according to official government guidance.

Crucially, the organisation will still be liable even if senior management were unaware of the fraud.

Under the new law, an organisation is classed as a ‘large business’ if it meets two of three criteria: more than 250 employees, at least £36m turnover and/or more than £18m in total assets.

New offence objectives

The failure to prevent fraud offence places the onus on businesses to proactively prevent fraud through risk assessments, robust policies and frameworks. 

The new offence is designed to ‘drive good behaviour and culture’ and encourage an anti-fraud culture rather than just prosecuting hundreds of companies.

Examples of fraud

Fraud under the scope of ECCTA can take many guises. It might involve:

• failing to declare revenue;
• artificially altering invoices to suppress revenue recognition;
• artificially altering payroll;
• accepting bribes from third parties to award contracts;
• falsifying accounts; and
• awarding contracts to those secretly owned by the company or management.

It can also involve activities which would affect customers or clients, such as misrepresenting products or services or even overstating green credentials of products to generate sales.

Businesses, including accountancy practices, therefore need to be aware of their obligations and liabilities. ‘Not being aware’ or ‘having no idea’, is no longer an excuse – if it ever was.

Liability in criminal prosecutions

Individuals who commit fraud for their own gain are liable under The Fraud Act 2006 Act. But where individuals or ‘associated persons’ carry out fraudulent activity to intentionally benefit the business, this then falls under the scope of the ECCTA. The business is therefore liable, especially if they did not take reasonable steps to prevent fraud.

It becomes much more complicated for businesses operating across different geographic jurisdictions or parent and subsidiary companies. The law won’t just look at one subsidiary in isolation when deciding liability – liability extends to the entire corporate group. This means that a parent company, even outside the UK, could be liable.

Liability under ECCTA therefore includes:

• Large businesses, corporations and partnerships that meet two of the following criteria:
  - more than 250 employees,
  - more than £36m turnover, and
  - more than £18m in total assets.
• Parent companies of subsidiaries.
• Non-UK multinationals, if fraud has impacted UK customers/clients.

This reflects the broad impacts of fraud offences, across economies and borders. The impact can be felt among thousands – sometimes millions – of people at any one time.

If fraud occurs in a UK subsidiary of a multinational organisation that affects UK customers and clients, that would be enough to claim jurisdictional nexus. All acts of fraud that occur abroad and have effects felt in the UK mean that UK law applies.

Penalties and sanctions

If a business or organisation is convicted of a failure to prevent fraud offence, it will receive an unlimited fine in England or Wales, or a fine that doesn’t exceed the statutory maximum in Scotland or Northern Ireland.

When it comes to charities or public sector bodies that provide some sort of public service, the impact on the public must be considered when setting the fine.