Guarding the Perimeter: Contractual Controls for the Failure to Prevent Fraud Offence

The Economic Crime and Corporate Transparency Act 2023 introduced a failure to prevent fraud offence that has changed the compliance calculus for large UK organisations. The offence is now in force, and it applies to fraud committed by associated persons. For businesses that rely on agents, distributors, subsidiaries and other intermediaries, the contract is often the first and sometimes the only point of control.

The scope of the offence

A large organisation is one meeting at least two of the following thresholds: turnover of £36 million or more, a balance sheet total of £18 million or more, and 250 or more employees. The offence does not require the organisation's directors to have known about the fraud. The prosecution must show that an associated person committed a fraud offence with the intention of benefiting the organisation. The organisation then has a defence if it can show that it had reasonable fraud prevention procedures in place.

The penalty is an unlimited fine, but the commercial consequences can be more significant than the fine itself. Reputational damage, loss of public contracts, regulatory scrutiny and management distraction are all foreseeable. The offence also creates a strong incentive for boards to demonstrate that fraud risk is managed throughout the organisation's network of associated persons.

Who counts as an associated person?

An associated person is a person who performs services for or on behalf of the organisation. That can include employees, agents, subsidiaries, distributors, joint venture partners and intermediaries. The label used in the contract is not decisive; the court will look at substance. A distributor that is formally independent may still be associated if, in practice, it acts on the organisation's behalf. The same applies to consultants, sales agents and local representatives in overseas markets.

This breadth means that procurement and legal teams should map the organisation's relationships and assess where fraud risk is highest. High-risk categories often include third parties with discretion over pricing, procurement, customs, licensing or customer onboarding. Contracts in those areas should be reviewed first.

The reasonable procedures defence

Home Office guidance identifies six principles for reasonable fraud prevention procedures: top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, and monitoring and review. Contracts can evidence each of these principles, but they cannot substitute for actual compliance. A contract that contains strong warranties but is never monitored may be of limited value in a prosecution.

Top-level commitment can be shown through board minutes, policy statements and delegated authority frameworks. Risk assessment can be documented through third-party risk assessments and country risk analyses. Proportionate procedures can be reflected in contract terms, approval thresholds and payment controls. Due diligence can be demonstrated through pre-appointment checks and periodic reviews. Communication and training can be evidenced through mandatory training records and contractual obligations on counterparties. Monitoring and review can be supported by audit rights and reporting obligations.

Contractual safeguards

Contracts with associated persons should include a combination of preventive and detective controls. Preventive controls include anti-fraud representations and warranties, commitments to maintain compliance policies, restrictions on subcontracting and approval rights over key personnel. Detective controls include audit and inspection rights, mandatory notification of investigations or allegations, and reporting obligations.

The following provisions are worth considering:

• Due diligence rights: the organisation should be able to request information about the counterparty's ownership, controls, litigation history and regulatory status, both before appointment and periodically thereafter.
• Anti-fraud warranties: the counterparty should warrant that it has not committed, and will not commit, any fraud offence in connection with the contract, and that it maintains adequate procedures.
• Audit and inspection rights: the organisation should be able to audit the counterparty's records and premises on reasonable notice, subject to confidentiality and data protection safeguards.
• Notification obligations: the counterparty should notify the organisation promptly of any investigation, allegation or suspicion of fraud involving the contract or the organisation's business.
• Training and certification: the counterparty should ensure that relevant personnel complete fraud prevention training and provide evidence on request.
• Suspension and termination: the organisation should be able to suspend the counterparty or terminate the contract for material breach, including a failure to maintain adequate procedures.
• Indemnities: a civil indemnity can allocate losses arising from the counterparty's fraud, but it does not extinguish criminal liability. It should be used alongside prevention measures, not as a substitute.
• Cooperation: the counterparty should cooperate with investigations and regulatory enquiries, including by preserving documents and making personnel available for interview.

Documenting compliance

Documentation is central to the reasonable procedures defence. Organisations should retain risk assessments, due diligence reports, contract negotiation records, training logs, audit reports and records of responses to red flags. Board and committee minutes should show that fraud risk was considered and that decisions were taken on a reasoned basis. If a prosecution is brought, the organisation will need to show what it did, not merely what it intended to do.

Practical next steps

Legal, compliance and procurement teams should work together to review high-risk contracts and update templates. They should also consider how existing contracts can be amended through variation letters or side letters where appropriate. Training for commercial teams is essential: a well-drafted clause can be undermined by informal assurances or by a failure to escalate red flags. Finally, organisations should test their procedures periodically and record the results. The offence is not merely a legal issue; it is an operational one that requires sustained attention from the board down.