Failing to Prevent Fraud
The Economic Crime and Corporate Transparency Act (ECCTA) 2023 introduced criminal liability for 'large organisations' whose associated persons (e.g., employees, agents or subsidiaries) commit fraud, intending to benefit (whether directly or indirectly) the large organisation.
A large organisation is an organisation which satisfies two or more of the following conditions in the financial year preceding the year of the offence: (i) more than 250 employees: (ii) more than £36 million turnover; and / or (iii) total assets of more than £18 million.
The subsidiary of a large organisation, which is not itself a large organisation, can be prosecuted rather than the parent organisation if an employee of the subsidiary commits a fraud intending to benefit the subsidiary.
Example persons who could be considered associated with a relevant body/large organisation, include:
Whether or not a particular person performs services for or on behalf of a relevant body will be determined by reference to all the relevant circumstances and not merely by reference to the nature of relationship between a person and the body.
A large organisation could be strictly liable if:
The offence will apply to:
The offence will make it easier to hold organisations to account for fraud committed by associated persons which benefit the organisation, or, in certain circumstances, their clients.
There will be no need to demonstrate that a large organisation's directors or senior managers knew about the fraud.
The ‘failure to prevent’ fraud offence is intended to encourage large organisations to build an anti-fraud culture.
Such an organisation would benefit from completing a risk-assessment (e.g., where or how 'associated persons' might have opportunity to commit fraud, due to weak internal controls, inadequate management oversight).
Without compliance policies and procedures being in place, which reflect an informed assessment of fraud risk (i.e., relevant to the organisation and/or its peer-group risks), in the event of criminal proceedings being implemented against a large organisation, a court may determine that ‘reasonable procedures’ were not in place at the time of a particular fraud.
A large organisation will be responsible for proving that it had reasonable fraud prevention procedures in place (i.e., proportionate to the risk). 'Reasonableness' should take account of the level of control, proximity and supervision the organisation is able to exercise over a particular person acting on its behalf.
A large organisation could be liable where an associated person (e.g., employee, agent, etc.) commits a specified offence for the organisation's benefit, where reasonable procedures are not in place to prevent involvement in a specified offence:
If an employee or associated person of an overseas-based organisation commits fraud in the UK, or targeting victims in the UK, the organisation could be prosecuted.
Whether or not a person performs services for or on behalf of an organisation will be determined by the relevant circumstances and not merely by reference to the nature of relationship between that person and the organisation.
Firms supervised by the Financial Conduct Authority ('FCA') are already subject to compliance with regulatory requirements set out in the FCA Handbook, which include: "A firm must take reasonable care to establish and maintain effective systems and controls for compliance with applicable requirements and standards under the regulatory system and for countering the risk that the firm might be used to further financial crime." [SYSC 3.2.6]
To avoid duplication relevant firms should consider whether their existing regulatory compliance mechanisms and fraud prevention measures are sufficient to prevent the assessed fraud risk.
A large organisation supervised by the FCA could be subject to regulatory intervention or enforcement activity, where fraud-related systems and controls fail to meet regulatory requirements.
The failure to prevent fraud offence under criminal law will apply to all 'large organisations'. The ECCTA is designed to:
Senior management of large organisations need to ensure consideration of fraud risk within their organisation's control environment.
Home Office Guidance indicates a fraud prevention framework should be informed by six principles:
A defence to the ‘failure to prevent fraud’ offence is available, where an organisation can prove that, at the time the fraud offence was committed:
To assess whether existing fraud prevention arrangements are reasonable requires consideration of the organisation's fraud-risk nexus:
Example areas to review/assess include:
Proportionate risk-based fraud prevention procedures should reduce exposure to fraud risk involving 'associated persons'. This might incorporate:
SYSC326 supports organisations to identify and respond to fraud risk, or fraud events, and to prepare for the new failing to prevent fraud offence, by:
