A London sales office raises it
The question usually arrives sideways. Take an illustrative Colorado software company with 900 employees and about $300 million in revenue. Twelve of those employees sit in a London office and sell subscriptions to UK insurers. At a board meeting, the general counsel mentions a UK statute that took effect on 1 September 2025 and asks whether it applies to a Delaware corporation with one small foreign office.
The CFO's first instinct is no. The company is not British, its UK subsidiary has a handful of people, and nothing has gone wrong. That instinct is wrong on two of three counts. The size test counts the whole group, and jurisdiction follows the fraud rather than the passport of the company. What remains is the question that matters: if a salesperson in that office misstated renewal terms to close a deal, could the company show it had reasonable procedures to stop it?
This article walks through the offence as written in the Economic Crime and Corporate Transparency Act 2023 and explained in the Home Office guidance. It is general information, not legal advice. Finance Ethics is not a law firm, and a group with real UK exposure should confirm its position with UK counsel.
What the offence actually requires
Section 199 of the Act makes a large organization guilty of an offence when a person associated with it commits a listed fraud offence intending to benefit the organization, or a client the associated person serves on its behalf. The guidance is explicit that it does not need to be shown that directors or senior managers ordered or knew about the fraud, that the benefit does not have to be received, and that benefiting the organization need not be the fraudster's only or main motive.
Who counts as associated
An associated person is an employee, an agent, a subsidiary undertaking, or anyone else who performs services for or on behalf of the organization. That last category catches distributors acting as agents, outsourced sales teams and consultants who represent you to customers. Suppliers who only provide goods are not included, and the guidance says that services provided to the organization, such as those of external lawyers, valuers, accountants or engineers, generally do not count either.
Which frauds are covered
The base offences for England and Wales include fraud by false representation, by failing to disclose information and by abuse of position; obtaining services dishonestly; participating in a fraudulent business; false accounting; false statements by company directors; fraudulent trading; and cheating the public revenue. Aiding or abetting any of them also counts. In finance terms, that covers misstated sales terms, manipulated figures given to lenders or investors, and false information supplied to UK tax authorities.
When the company is the victim
Fraud against the organization falls outside the offence, because the associate must intend to benefit the organization or its clients. Section 199(3) adds that the organization is not liable for a fraud intended to benefit its clients if it was itself the victim, or the intended victim. An employee who embezzles from you is your problem, not this offence's. An employee who inflates a UK customer's invoice to hit a quota is squarely within it.
The size test counts everyone
The offence applies only to large organizations. Under sections 201 and 202, a body, or for a parent company its whole group, is large if it met two or more of three conditions in the financial year before the year of the fraud:
- more than 250 employees, measured as the monthly average over that year
- more than £36 million in turnover
- more than £18 million in balance sheet total
The guidance says these criteria apply to the whole organization, including subsidiaries, wherever they are headquartered or located. Turnover includes subsidiaries operating wholly outside the UK. Only parent and subsidiary relationships are aggregated; franchises, supply chains and LLP networks are not.
Two consequences follow for US groups. First, a US parent cannot rely on the size of its UK subsidiary. Second, the guidance says that a subsidiary of a large organization that is not large on its own may still be prosecuted if one of its employees commits a fraud intended to benefit it. If the fraud was intended to benefit the parent, the parent may be prosecuted.
Companies below the thresholds are not off the hook commercially. The guidance notes that smaller firms providing services to large organizations are associated persons of those organizations, and may face contractual demands as a result.
Jurisdiction follows the fraud
The Act applies to any body corporate or partnership, wherever incorporated or formed. What it requires is a UK nexus: at least one act forming part of the fraud took place in the UK, or the gain or loss occurred in the UK. Where no part of the fraud happened in the UK, the gain or loss must actually occur there; an intended UK loss is not enough.
The guidance puts it plainly for overseas organizations: if an employee or associated person of an organization based abroad commits fraud in the UK, or targets victims in the UK, the organization could be prosecuted. The reverse also holds. A fraud committed entirely abroad, with no UK act, gain or loss, is outside the offence even for a UK company.
For a US group, the practical exposure points are:
- staff, agents or subsidiaries working in the UK
- UK customers, investors, lenders or grant bodies who could be deceived
- UK bank accounts, UK tax filings or UK regulatory submissions
- third parties in the UK who certify, test or sell on your behalf
Reasonable procedures are the only defense
Section 199 gives one defense: the organization must prove that, at the time of the fraud, it had in place "such prevention procedures as it was reasonable in all the circumstances to expect the body to have in place", or that it was not reasonable to expect any procedures at all. The burden is on the company, on the balance of probabilities. The penalty is a fine, and the Act sets no maximum for conviction on indictment.
The Home Office guidance organizes reasonable procedures under six principles:
- Top-level commitment. Senior management owns fraud prevention and says so.
- Risk assessment. A documented assessment of how associated persons could commit fraud that benefits the organization, kept current.
- Proportionate, risk-based prevention procedures. Controls sized to the risks found, not a generic policy.
- Due diligence. On the people and firms who act for you.
- Communication, including training. So that staff and agents know the rules and how to raise concerns.
- Monitoring and review. Evidence that the procedures work, and changes when they do not.
Many fraud risk assessments focus on fraud against the company: theft, expense abuse, vendor schemes. This offence is about fraud committed for the company. A risk assessment that never asks "how could our people mislead a customer, a lender or a tax authority to help us?" has a gap the guidance will expose.
Screen your exposure in five questions
Use this as a screening aid with your counsel. It does not replace a legal assessment.
| Question | If yes | If no |
|---|---|---|
| Did the worldwide group meet two of the three size conditions in the prior financial year? | The group is a large organization. Continue. | The offence does not apply to the group, but large customers may still require you to follow their procedures. |
| Do any employees, agents, subsidiaries or service providers act for the group with a link to the UK? | Continue. List them by entity and role. | Exposure is low today. Recheck when you hire, sign an agent or win UK customers. |
| Could any of them commit a listed fraud intended to benefit the group or its clients, with an act, gain or loss in the UK? | Continue. Write down each scenario, such as misstated contract terms or false figures to a UK lender. | Document why not, with the date and the person who decided. |
| Does your fraud risk assessment name those scenarios, with an owner and a control for each? | Continue. | Extend the assessment before anything else. This is the core of the defense. |
| Can you show evidence that the controls operated, such as approvals, training records and test results? | Keep the evidence current and review it at least yearly. | Start testing. A procedure without evidence will be hard to rely on in court. |
No case has been named yet
As of November 2026, no investigation, charge or conviction under the offence has been publicly named. King & Spalding's October 2026 review notes that first investigations have reportedly begun and calls the offence one of the most anticipated enforcement developments for 2027. The first cases will show how prosecutors and courts read "reasonable", which is an argument for documenting your reasoning now, calmly, rather than reconstructing it during an investigation.
Where to start
Begin with the risk assessment, because every other principle depends on it. If you have never run one, our guide to a fraud risk assessment in one afternoon gives you a working first draft. Add the UK-facing scenarios from the decision table, then test whether the controls you name actually run. When you want an outside view that covers both UK reasonable procedures and DOJ expectations, our Fraud Risk Assessment is built for exactly that scope.