The opinions expressed here are those of the authors. They do not necessarily reflect the views or positions of UK Finance or its members.

On 1 September 2025, the new failure to prevent fraud (FTPF) offence finally came in to force.  Introduced in the Economic Crime and Corporate Transparency Act 2023, with guidance from the Home Office following in 2024, and a long process of preparation across the financial industry, conducting risk assessments and putting into place reasonable fraud prevention measures followed. 

The FTPF offence puts the UK in an exclusive club – many countries have failure to prevent bribery offences, or general obligations to prevent fraud, but Italy is the only other country to have a strict liability criminal offence holdings firms responsible for the frauds committed by their employees. 

Given the increasing divergence between the UK's financial crime regime and the rest of the world, it is understandable that many international organisations have taken time to come to grips with the potential scope of the new legislation. 

All large organisations are caught by the offence – regardless of where in the world they are incorporated – and any parent organisations are liable for the actions of its employees, agents, or subsidiaries or other 'associated persons' – again, regardless of where in the world they are located.

This gives the offence significant extra-territoriality.  The Home Office's guidance has made clear that "The offence will not apply to UK organisations whose overseas employees or subsidiaries commit fraud abroad with no UK nexus" but where there is a UK nexus the scope of potential liability for non-UK firms is significant.   For example:

• a UK-based branch, subsidiary, or even affiliate of the non-UK parent;

• UK-based staff acting for and on behalf of a non-UK parent, or even a non-UK subsidiary of a parent; or

• conducting activities in the UK, or targeting activities at UK customers.

In principle, a UK-based employee of a non-UK entity could render a third-country parent liable for the offence!  Indeed, ECCTA also introduced the "identification doctrine" holding companies liable (on a strict liability basis) for the actions of their senior managers.  That introduces the risk of a subsidiary being held strictly liable for the actions of a UK-based 'senior manager' and that liability being passed up to a non-UK parent – provided there was an intention to benefit that parent. 

This does not mean that non-UK financial institutions need to implement anti-fraud procedures for their non-UK activities but the difficulty lies in working out exactly where the line between non-UK and UK activities especially where group companies and individuals are conducting both UK and non-UK-associated activities. Blurred lines could lead to difficulties in proving compliance should fraud occur. 

Whether the UK authorities would seek to pursue such an offence is a question of enforcement.  However, the recent head of the SFO has fired the starting gun declaring that “Now is the time to take action. Corporations must get their house in order or be ready to face investigation.”

Strictly speaking, the offence would be a criminal act (in the UK) whether or not the Serious Fraud Office decided to prosecute or not, which could have international money laundering consequences.  If it would be an offence in the UK, the proceeds could be criminal.  It does not require criminal proceedings to be taken. The regulatory consequences – both in the UK and overseas – of potential investigation by financial regulators also need to be taken into account. 

We are only a few days into the offence: the full impact has yet to be seen.  However, there is still a significant risk of unrealised consequences across the sector.