Economic Crime and Corporate Transparency Act 2023 (ECCTA)

 was introduced, one of the measures prompting major interest was the introduction of a new offence entitled “Failure to Prevent Fraud”. The Act, which will be enforceable from 1 September 2025, is tailored to ensure that corporations are more accountable in the event that serious crimes are committed in the course of business.

The "failure to prevent fraud" offence aims to broaden a corporation's accountability for fraudulent acts carried out by associated individuals and entities intended to benefit the business. Companies with inadequate fraud prevention measures can be criminally prosecuted under this Act. Importantly, there's no need to show that directors or senior managers directed or were aware of the fraudulent activities. Even if the leadership is unaware of the fraud, the corporation can still be held responsible.

Confidently address the complexities of ECCTA and discover practical steps for your organisation.

Your essential ECCTA checklist

advisory guidance to help companies develop and implement reasonable fraud prevention procedures

. This guidance takes a risk-based approach, directing companies to build a tailored response.

The failure to prevent fraud offence is relevant to incorporated companies and organisations classified as “large” according to the Companies Act 2006. This classification applies if they meet two of the following criteria:

This includes organisations such as NHS Trusts and some charities. The offence applies to base fraud committed in the UK, or fraudulent gain or loss occurring in the UK. It also covers UK-based employees that commit fraud, wherever the employing organisation is based, and overseas employees who commit fraud in the UK or targeted at UK victims.

Although smaller organisations are not directly governed by this regulation, it is recommended they adopt the guidance as a best practice for managing fraud risks.

Companies are advised to use the guidance to inform their fraud prevention strategies, considering their unique circumstances and particular areas of risk. The Government is at pains to point out that “even strict compliance with the guidance will not necessarily amount to having reasonable procedures” if a court could conclude that this fails to take account of the operational and ethical realities facing the business.

The offence applies to fraud committed by “employees, agents, subsidiaries or other ‘associated persons’ who provide services for or on behalf of the organisation, where the fraud was committed with the intention of benefiting the organisation or its clients.”

Including 'associated persons' who provide services in this context has significant implications for supplier due diligence and oversight. Organisations must extend their monitoring and fraud prevention measures to their supply chains where suppliers act on their behalf.

These individuals may also face separate prosecution for the primary fraud. However, the offence does not cover company members who failed to prevent the fraudulent behaviour from occurring.

The guidance highlights that the issue of who is “intended to benefit” from fraudulent activity is key to determining whether the organisation is liable for failing to prevent the fraud.

For instance: an organisation can still be held accountable, if the person committing fraud seeks to do so for their own benefit, but the net result is also a benefit for the organisation. The example cited is that of a salesperson mis-selling to increase their own commission, but also increasing the company’s sales. It's also vital to understand that benefits aren't limited to monetary gains; they can include indirect advantages that lead to an unfair competitive edge.

Gain actionable insights into the critical requirements of NIS2, Cyber Resilience Act and DORA and their impact on operational resilience. 

Cyber Risk Virtual Summit

“Reasonable” fraud prevention measures

“Reasonable” fraud prevention measures are vital in defending against accusations of failing to prevent fraud. Organisations must demonstrate that their strategies, procedures, and implementations for preventing fraud were adequate, sufficient, and suited to the specific context of their business at the time the fraud occurred.

The guidance offers six key pillars around which organisations should structure a risk-based fraud prevention strategy:

 The board of directors, partners and senior management are explicitly responsible for setting an anti-fraud culture. This should be achieved through communication, governance processes, policy-setting, committing to and implementing training, leading by example and building an open culture where whistleblowing is supported.

 Fraud risk should form an integral part of the organisation’s risk identification, assessment, and management strategy. Many organizations will already look at risk under other rules against fraud and economic crime. So, it may be a case of adding new activities to those that are already in place to cover the new offence. This could include fraud risk assessments for suppliers and other associated persons and should also recognise risks arising in emergency scenarios.

Proportionate risk-based fraud prevention measures:

 The fraud prevention plan must be proportionate to the risk and the potential impact. The associated procedures should be clear, practical, accessible, effectively implemented, and enforced.

 Persons who perform services on behalf of the organisation must be subjected to effective due diligence procedures that follow best practices including the use of screening tools, third party risk management technology, contract reviews and staff monitoring for higher risk of fraud e.g. due to “stress, targets or workload”

 Policies and procedures must be effectively “communicated, embedded and understood” throughout the organisation and by relevant third parties. Training is required and should be regularly repeated. Whistleblowing policies should be especially well-publicised.

 This must cover detection of fraud and attempted fraud, investigations, and monitoring the effectiveness of fraud prevention measures. The fraud risk management programme should be regularly reviewed to account for changes in circumstances, operating environments, and emerging risks.

By adhering to these six pillars, organisations can establish a robust fraud prevention strategy that is both effective and adaptable to their specific needs.

Much of what is covered in the guidance on the failure to prevent fraud offence is risk management best practice that risk professionals will recognise – it just needs to be tailored for this new offence. This guidance presents an opportunity to strengthen fraud risk management and compliance, which can positively impact other aspects of the company’s risk strategy.

This is particularly relevant in third-party risks. This is not the only regulation that now requires companies to extend due diligence and risk management more deeply into their supply chain, and there will likely be cross-over in the actions and measures required.

In-scope organisations should move fast to assess their current fraud prevention procedures and perform a gap analysis against the official guidance.

They must ensure that their risk and compliance teams 

have the right tools to manage and report fraud risks

 to achieve visibility over fraud risk evolution.

The failure to prevent fraud offence adds a new degree of corporate accountability for fraud by associated persons. To ensure they are in a strong defensive position, companies should take proactive measures to be ready for the 1 September 2025 deadline.

Ready to transform your ECCTA compliance from a challenge into a competitive advantage? 

Find out more and request a demo with Diligent Entities here.

ECCTA: UK Government issues guidance on failure to prevent fraud offence

In 2024, artificial intelligence (AI) dramatically reshaped industries, with major tech companies investing heavily to enhance IT systems. However, a 

 caused global disruptions and financial losses. The tech sector also saw major mergers, such as Hewlett Packard Enterprise's acquisition of Juniper Networks.

Concurrently, the global economy faced slow growth, leading to debates on a new prosperity model that integrates productivity, fairness and sustainability, as highlighted in the 

World Economic Forum's Future of Growth Report 2024.

 The stock market experienced significant volatility, with the Dow hitting over 43,000 points and companies like Nvidia achieving record valuations due to AI chip demand.

All of this resulted in significant transformations in governance, risk and compliance (GRC) and we’ve been there every step of the way. Our list of 2024’s most-read resources represent all of the highs and lows of the past year, with expert advice for boards, executives and practitioners to excel through these complexities.

Keep reading to discover the blogs, guides and reports our readers viewed the most.

1. Using AI to elevate governance, risk and compliance

This blog explores the possibilities of AI in enhancing GRC functions. It highlights how AI can automate time-consuming tasks, provide rapid analysis and deliver real-time intelligence, thereby enabling GRC professionals to manage risks more effectively and make informed decisions swiftly.

“GRC leaders who are unable to turn complex data into smart decisions, at the speed of change, risk falling behind. Here's where artificial intelligence (AI) comes in.” — Phil Lim, Director, Product Management, Diligent

 The emphasis on responsible AI use and staying ahead of evolving regulations provides a clear roadmap for integrating cutting-edge technology while maintaining ethical standards. It offers key questions to ask in order to ensure data protection, operations and your reputation.

2. Making AI part of your GRC strategy: A checklist for boards and leaders

Tailored for decision-makers, this checklist serves as a crucial tool for leaders aiming to embed AI into their GRC strategies effectively. It offers a structured approach that includes assessing current operations and ensuring scalability and ethical compliance.

“The first step toward building stronger AI-powered GRC processes is looking at the processes you currently have — and, more importantly, where they’re letting you down.” — Meghan Day, Principal Solution Designer, Diligent

 The eight-step guide, from assessing current operations to ensuring scalability and ethical compliance, offers a structured approach that readers can appreciate for its clarity and practicality.

3. 16 board management best practices for 2025

This popular blog (recently updated for 2025) provides actionable insights for fostering inclusive board cultures, staying abreast of emerging risks and leveraging technology for better governance outcomes.

“Technology is the single best tool boards have to stay afloat amid the rapid tides of change. Growing numbers of boards recognize the benefits of both AI and technology in streamlining and future-proofing their board management.” — Meghan Day, Principal Solution Designer, Diligent

 The detailed guidance on onboarding new directors and the strategic integration of AI tools, which are seen as key to enhancing board effectiveness and compliance in the coming years.

Download our guide for practical insights and proven strategies to enhance your organization's GRC efforts.

Get the ultimate GRC guide

4. AI regulations around the world: Trends, takeaways & what to watch heading into 2025

With AI becoming increasingly central to corporate strategies, our guide offers a thorough overview of AI regulations across various regions, including North America, South America, Latin America, Europe and Asia. It discusses transparency requirements, data governance standards and the principles of responsible AI development.

“How we set up artificial intelligence now will create commercial incentives for the AI we get in the future. We need to raise our game and make sure that human impact is at the heart of how we develop AI.” — Annabel Gillard, AI Advisory Committee, Institute of Business Ethics

 Readers get a detailed analysis of transparency requirements, data governance standards and the principles of responsible AI development, which are essential for navigating the complex global compliance landscape.

5. Board reporting for ERM: Navigate risks to maximize opportunities

This guide emphasizes the importance of clear, integrated and standardized reporting to the board for effective risk management. It showcases how consolidating risk data into a single source of truth allows for a comprehensive view of risks, enhancing strategic decision-making.

"Sifting through mountains of data to extrapolate the right insights to surface to the board is time-consuming and inefficient…Having the ability to streamline data collection, break down siloes and communication gaps and surface clear insights built on reliable, up-to-date risk data is invaluable.” — Simon Owen, Group Director of Business Risk and Internal Audit, Grafton Group PLC

 The guide offers a practical and actionable approach to streamlining data integration and analysis, which not only saves time but also focuses board discussions on meaningful insights, thereby enhancing the overall risk management process.

6. Sustainability in the spotlight: The balancing act of ESG

As ESG factors continue to influence corporate agendas, this survey provides critical insights into how companies are integrating sustainability into their core strategies. It discusses the role of directors in shaping ESG visions, the impact of regulatory changes and stakeholder expectations.

“Directors report that the ESG ambitions of the organizations they oversee are high — even though some may be slightly less likely to publicize them — and that they are bullish on the prospects of achieving their ESG strategies.” — Sustainability in the Spotlight report, Diligent Institute and SpencerStuart

 The survey's findings on anticipated ESG strategy shifts over the next five years provided necessary strategic foresight for leaders.

Bring all of these insights together in 2025

Each of these resources has not only informed but also inspired GRC professionals to adapt and innovate. As we look forward to 2025, the insights garnered from these materials will undoubtedly continue to influence the GRC landscape.

Our guide will get you equipped with the right resources for 2025. Get practical insights and proven strategies from to enhance your organization's GRC efforts, including:

 today and start transforming your approach to governance, risk management, and compliance.

Diligent

Blog

ECCTA: UK Government issues guidance on failure to prevent fraud offence

It’s a wrap, 2024! The top GRC resources of the year

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

ECCTA: UK Government issues guidance on failure to prevent fraud offence

It’s a wrap, 2024! The top GRC resources of the year

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company