Tightening of corporate criminal law: Great Britain makes failure to prevent fraud a criminal offense
Update Compliance 10/2025
Since September 1, 2025, British law has provided for criminal sanctions for companies that have not taken appropriate measures to prevent fraud. German companies with UK connections are also at risk of sanctions. However, companies can counter this risk by implementing appropriate compliance measures. By demonstrating that it has taken appropriate measures, a company can avoid liability. The UK government has published guidelines on this subject with specific requirements for compliance organizations.
The new criminal offense
The new corporate offense was introduced in Section 199 of the UK Economic Crime and Corporate Transparency Act 2023 (ECCTA): A company is criminally liable for "failure to prevent fraud" if associated persons commit certain economic crimes for the benefit of the company and no adequate preventive measures are in place. In addition to classic fraud, this includes crimes such as embezzlement, misappropriation, false accounting, money laundering, and similar offenses.
Affected companies
The offense is aimed at large organizations. This includes companies that meet two of the following criteria:
- more than 250 employees
- annual turnover exceeding £36 million (approx. €41.5 million)
- total assets sheet total of more than £18 million (approx. €20.7 million).
The criteria apply to the entire company, including subsidiaries, regardless of their location. The thresholds are often already met by medium-sized companies. Therefore, both large and smaller companies should familiarize themselves with the new UK regulations.
Significance for German companies
The new criminal offense does not only apply to companies based in the UK. It is sufficient for the offense to have a UK connection. The requirements for this are not particularly high. According to the UK government's guidelines, a UK connection exists if
- the offense is committed in the UK, or
- profit or loss is incurred in the UK.
Criminal offenses committed by employees of the company or its subsidiaries, but also by associated persons such as service providers or sales representatives, constitute a risk of sanctions. German companies with business relationships in the UK—even if only through customers or suppliers in the UK—should take note of the new compliance requirements.
Consequences of violations
Violations are punishable by unlimited fines and the confiscation of profits. In addition, there are regularly non-criminal consequences such as a loss of reputation.
Practical note
Companies with UK connections should review their compliance structures, particularly with regard to fraud prevention, and adapt them to current requirements. Only by demonstrating that appropriate compliance measures are in place can allegations of failure to prevent fraud be refuted.
In its guidance, the UK government sets out six principles for guidance:
- Top-level commitment
- Risk assessment
- Proportionate risk-based prevention procedures
- Due diligence
- Communication and training
- Monitoring and review
...and in Germany?
These criteria apply generally to compliance management systems, and companies with no connection to the UK are also advised to observe them. This is because, under German corporate sanctions law, companies can also be fined if they enable or facilitate operational crimes through a lack of supervision. Unlike under UK law, corporate fines are limited to €10 million per offense, but proceeds from the offenses can be skimmed off without limit.
This article was written in collaboration with our research assistant Jakob Döllner.
