The failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. Just over a year on, no prosecution has been announced. The Serious Fraud Office has said it wants to bring the first case, and the CPS is well placed to do so. Neither has needed to explain how long that will take.
It would be a mistake to read the absence of a case as a sign that the risk is theoretical. Investigations into corporate fraud take years, and the conduct that leads to the first prosecutions may already have happened. When it comes to court, the organisation's defence will turn on the procedures it had in place at the time, not the ones it put in place once it knew it was under investigation.
What has changed in a year
In the first year, most in-scope organisations did the obvious things. They briefed the board, mapped the Home Office guidance, refreshed their fraud policy and ran awareness training. Many commissioned a gap analysis. That was the right starting point.
The question has now moved on. Prosecutors and the SFO have been clear that compliance programmes will be judged on whether they work in practice, not on whether they exist. A policy library and a training completion rate will not, on their own, demonstrate reasonable procedures.
There is also a less obvious development. Unlike offences under the Bribery Act 2010, prosecution for failure to prevent fraud does not require the consent of the Director of Public Prosecutions. That opens the door, at least in principle, to private prosecutions by competitors, shareholders or campaign groups. Whether the courts will let such cases proceed is untested, but it is one more reason to have the evidence ready.
Where frameworks are falling short
Across the organisations we speak to, the same gaps come up repeatedly.
The risk assessment has not been refreshed. A risk assessment written in the summer of 2025 will not reflect a year of new products, channels, incentive schemes, acquisitions and third-party arrangements. The Home Office guidance expects the assessment to be dynamic.
The focus is on fraud against the organisation. Traditional fraud frameworks are built to protect the firm from being defrauded. The offence is about fraud committed by associated persons that is intended to benefit the organisation or its clients. Mis-selling, misleading financial statements and false representations to customers or counterparties are the scenarios that matter.
Associated persons are incompletely identified. Employees are covered, but agents, introducers, distributors, subsidiaries and contractors who perform services on the organisation's behalf are frequently missing from the analysis.
Controls are documented but not evidenced. Control owners cannot show that key controls operated as designed, and there is no record of exceptions, overrides or near misses being used to improve the framework.
A one-year health check
The practical response is a structured review against the six principles, focused on evidence rather than documentation. That should cover whether the fraud risk assessment has been updated for changes since September 2025, whether associated persons have been mapped by service, whether management information allows senior management to see where procedures are failing, and whether incidents, whistleblowing reports and audit findings have led to documented changes.
The output that matters most is an evidence pack: a coherent, dated record that shows what the organisation's procedures were, why they were judged reasonable for its risk profile, and how it knew they were working. If a prosecutor asked for it tomorrow, most organisations would be assembling it from scratch.
The role of internal audit
Internal audit is well placed to provide that independent view. A thematic review in the 2027 audit plan, scoped to test the operation of fraud prevention procedures rather than their design, gives the board something it cannot get from management's own reporting. Where the in-house team lacks financial crime expertise, subject matter input at the scoping stage is usually enough to make the review credible.
Getting specialist support
We provide ECCTA health checks, procedures adequacy reviews and independent assurance over fraud prevention frameworks, drawing on direct financial crime audit experience in UK financial services. If your framework was built in 2025 and has not been tested since, a short conversation is usually enough to establish where to start.
