The failure to prevent fraud offence: what supplier due diligence looks like for a small business

If you supply services to a large company, you may already have noticed something new in your inbox: longer supplier questionnaires, new contract clauses about fraud, and requests for your anti-fraud policy. There’s a reason for that.

Since 1 September 2025, large organisations in the UK can be prosecuted if someone working for them, or on their behalf, commits fraud intended to benefit them and they didn’t have reasonable procedures in place to prevent it. Small businesses aren’t directly caught by the offence. But many of them are caught in the due diligence that their large clients now carry out.

This article explains how the offence works, why it reaches SMEs through the supply chain, and what a sensible, proportionate response looks like for a small business. It’s general guidance, not legal advice.

What the offence actually says

The offence is in section 199 of the Economic Crime and Corporate Transparency Act 2023. In simple terms, a large organisation commits an offence if an “associated person” commits a specified fraud offence intending to benefit the organisation, or a person the associate provides services to on the organisation’s behalf (in effect, its clients).

A few details are worth knowing:

• The organisation doesn’t need to have actually benefited. The Home Office guidance says “An organisation does not need to actually receive any benefit for the offence to apply.”
• It doesn’t need to be shown that senior managers or directors ordered or knew about the fraud.
• The underlying fraud offences include fraud by false representation (section 2 Fraud Act 2006), false accounting (section 17 Theft Act 1968), and cheating the public revenue.
• The organisation has a defence if it can prove it had in place such prevention procedures as it was reasonable in all the circumstances to expect (or that it wasn’t reasonable to expect any procedures at all).
• On conviction the penalty is a fine, and the Act sets no maximum for conviction on indictment.

The offence came into force on 1 September 2025, confirmed both by the commencement note on legislation.gov.uk and by the government’s guidance.

Who counts as a large organisation

The offence only applies to large organisations. Section 201 defines these as bodies that met two or more of the conditions in the financial year before the year of the fraud offence. The conditions are an average of more than 250 employees, turnover of more than £36 million, and a balance sheet total of more than £18 million.

The guidance says the offence applies to large incorporated bodies and partnerships across all sectors of the economy. That includes incorporated charities and some public bodies.

Most of my clients are well under those thresholds. So why should they care?

Why small businesses are affected

The answer is the phrase “associated person”. Under section 199, an associated person includes an employee, agent, or subsidiary of the organisation, or anyone who “otherwise performs services for or on behalf of the body”.

That last part is the one that matters for SMEs. If you provide services for or on behalf of a large client, for example as a security subcontractor, a labour provider, a facilities contractor, or a recruitment firm, you may be one of their associated persons while you’re doing that work. The guidance is explicit: “Small organisations should be aware that they may be ‘associated persons’” when they provide services for or on behalf of large organisations, and those large organisations may impose contractual terms or other requirements on them.

The guidance also points out that people further down the chain can be associated persons even if they don’t contract directly with the large organisation.

One of the guidance’s examples should sound familiar if you work in security or labour supply. A large healthcare company uses a recruitment firm that is supposed to carry out right to work checks. An employee of the healthcare company colludes with the recruitment firm to falsify documents saying the checks were done, so the company can fill its vacancies and meet its contracts. The guidance says the healthcare company could be liable unless a court decides it had reasonable procedures in place. The supplier’s paperwork sits right at the centre of that fraud.

There’s an important limit. The guidance says that providing services doesn’t include providing goods. A business that only sells products to a large company isn’t an associated person on that basis.

What large clients are likely to ask you for

The Home Office guidance sets out six principles that should shape an organisation’s reasonable procedures:

• Top level commitment
• Risk assessment
• Proportionate risk-based prevention procedures
• Due diligence
• Communication (including training)
• Monitoring and review

Under due diligence, the guidance gives examples such as reviewing contracts with those providing services to include appropriate obligations requiring compliance, and the ability to terminate in the event of a breach where appropriate.

In practice, that’s what lands on your desk. Expect some combination of:

• New contract clauses requiring you to have anti-fraud procedures and to report suspected fraud
• Termination rights if you breach those clauses
• Supplier questionnaires asking about your policies, training, and controls
• Requests for evidence, such as a policy, a training record, or a risk assessment
• Audit rights allowing the client to check what you’ve told them

Don’t be alarmed by this. It’s the same pattern many suppliers saw with the Bribery Act and with modern slavery statements. Clients need to show that they’ve taken a proportionate, risk-based approach, and you’re part of that picture. If you’ve read my guide to Modern Slavery Act compliance for supply chains, you’ll recognise the approach.

What sensible due diligence looks like for a small business

You don’t need a compliance department. You need to be able to show, honestly and simply, that you understand where fraud could happen in your work and that you’ve taken reasonable steps. Here’s how I’d approach it.

Start with a short fraud risk assessment

Think about where someone in your business could commit fraud that benefits you or your client. In service businesses the usual suspects are timesheets and hours billed, falsified training or vetting records, false claims about qualifications or accreditations, expense claims, and invoicing. Write down the risks, who could commit them, and what currently stops them. The guidance stresses keeping risk assessments under review, and warns that an outdated one may be found “not fit for purpose”.

Write a proportionate anti-fraud policy

One or two pages is fine for a small business. It should say that fraud isn’t tolerated, who is responsible, how staff can raise concerns (including anonymously if possible), and what happens when fraud is suspected. Signed by a director, it’s also your evidence of top level commitment.

Check your own supply chain

If you subcontract, the same logic applies to you. Make sure your subcontractors know your expectations and put simple clauses in your agreements. For screening-heavy sectors, accurate pre-employment checks are one of the best fraud controls you have. My BS 7858 screening guide and right to work checks guide cover the detail.

Train people and keep records

A short briefing at induction and an annual refresher, recorded, goes a long way. When a client asks for evidence, a signed training register is far more convincing than a statement that “staff are aware”.

Review it

Put the risk assessment and policy on your management review agenda once a year, and after any incident or significant change.

Using ISO standards as a framework

ISO does publish a fraud-specific standard. ISO 37003:2025, Fraud control management systems, was published in May 2025. It’s a guidance standard: ISO describes it as providing guidance for organisations to develop, implement, and maintain a fraud control management system. ISO also says it complements ISO 37001 and ISO 37301, which are the two requirements standards most relevant here.

ISO 37001:2025, Anti-bribery management systems, is the second edition and replaced ISO 37001:2016 in February 2025. It’s about bribery rather than fraud, but the components ISO lists for it, including anti-bribery policies, due diligence procedures, financial and non-financial controls, training, and monitoring, map closely onto the six principles above. ISO says it’s designed for any organisation, regardless of size or sector.

ISO 37301:2021, Compliance management systems, covers compliance obligations more broadly, and ISO’s website shows it was reviewed and confirmed in 2026. It’s a sensible home for fraud, bribery, modern slavery, and data protection obligations in one system.

Many small businesses won’t need certification to any of these standards. If you already run ISO 9001 or an integrated management system, you can usually add fraud risk to your existing risk register, policies, and internal audits without starting from scratch.

FAQs

When did the failure to prevent fraud offence come into force?

The offence came into force on 1 September 2025, under the Economic Crime and Corporate Transparency Act 2023.

Does the failure to prevent fraud offence apply to small businesses?

Not directly. It applies to large organisations that meet at least two of three conditions: more than 250 employees, more than £36 million turnover, or more than £18 million balance sheet total. Small businesses can still be affected as associated persons of large clients.

What is an associated person?

An employee, agent, or subsidiary of the organisation, or a person who otherwise performs services for or on behalf of it. Suppliers of goods only are not associated persons on that basis.

What are the six principles of reasonable fraud prevention procedures?

Top level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication (including training), and monitoring and review.

Is there an ISO standard for fraud prevention?

Yes. ISO 37003:2025 gives guidance on fraud control management systems. ISO 37001:2025 (anti-bribery) and ISO 37301:2021 (compliance management) are requirements standards that also provide frameworks small businesses can adapt to manage fraud risk.

Get your supplier due diligence in order

If a large client has sent you a fraud questionnaire or new contract clauses, CAW Consultancy can help you put together a proportionate fraud risk assessment, policy, and training record, and fit them into your existing management system. Our gap analysis is free.

If staff vetting is part of your risk, Screen My Staff provides BS 7858 screening and compliance outsourcing.

Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk.

This article is general information and isn’t legal advice. If you’re unsure how the offence applies to your business, take advice from a qualified solicitor.

Sources

• Economic Crime and Corporate Transparency Act 2023, section 199 (legislation.gov.uk)
• Economic Crime and Corporate Transparency Act 2023, section 201 (legislation.gov.uk)
• Offence of failure to prevent fraud introduced by ECCTA, Home Office guidance (GOV.UK)
• ISO 37003:2025 Fraud control management systems (ISO)
• ISO 37001:2025 Anti-bribery management systems (ISO)
• ISO 37301:2021 Compliance management systems (ISO)

Craig Willetts is the founder of CAW Consultancy Business Solutions Ltd and a UK lead auditor with over 20 years’ experience across ISO management systems and UK security industry schemes.