Failure to Prevent Fraud Offence – Home Office Guidance Update

The Guidance helpfully highlights the following key aspects of the FTP Offence:

• The FTP Offence applies to large, incorporated bodies and partnerships across all sectors of the economy. The Guidance provides further explanatory detail of what is meant by “large organisations” and “incorporated bodies and partnerships”. It also confirms that the relevant criteria apply to the whole organisation, including subsidiaries, regardless of where the organisation is headquartered or where its subsidiaries are located.
• The FTP Offence applies to a number of specific fraud offences, which the Guidance refers to as ‘base fraud’ offences. These are listed in Schedule 13 of ECCTA. Aiding, abetting, counselling, or procuring the commission of any of the listed offences would also qualify as a base fraud offence (section 199(6)(b)).
• An associated person may or may not be under contract to the relevant body, and small organisations may be “associated persons” while they provide services for or on behalf of large organisations.
  
• An organisation does not need to receive any benefit for the offence to apply – since the fraud offence can be complete before any gain is received. It is enough that the organisation was intended to be the beneficiary. Examples may include dishonest sales practices, the hiding of important information from consumers or investors, or dishonest practices in financial markets.

The above is a non-exhaustive list of the overview in the Guidance, which we would encourage all organisations (large and small) to consider it in light of their own fraud risk assessment.

The Guidance sets out that the fraud prevention framework put in place by relevant organisations should be informed by the following six principles, which are intended to be flexible and outcome-focussed:

• Top level commitment: The Guidance sets out that the responsibility for the prevention and detection of fraud rests with those charged with the governance of the organisation.
• Risk assessment: Organisations should assess the nature and extent of its exposure to the risk of employees, agents and other associated persons committing fraud in scope of the offence.
• Proportionate risk-based prevention procedures: An organisation’s procedures to prevent fraud by persons associated with it should be proportionate to the fraud risks it faces and to the nature, scale and complexity of the organisation’s activities. They should also be clear, practical, accessible, effectively implemented and enforced.
  
• Due diligence: Organisations should apply due diligence procedures, taking a proportionate and risk-based approach, in respect of persons who perform or will perform services for or on behalf of the organisation, in order to mitigate identified fraud risks.
• Communication (including training): Organisations should seek to ensure that its prevention policies and procedures are communicated, embedded and understood throughout the organisation, through internal and external communication (and appropriate whistleblowing arrangements should also be in place).
• Monitoring and review: An organisation should monitor and review its fraud detection and prevention procedures and make improvements where necessary. This includes learning from investigations and whistleblowing incidents and reviewing information from its own sector.

Whether or not an organisation has appropriate fraud prevention measures in place will be fact-sensitive and the onus will be on the organisation to prove that it did indeed have such procedures in place (the standard of proof being the balance of probabilities).

The Guidance also outlines examples of where and how the new regime overlaps with the UK’s existing legislative and regulatory landscape:

• Firstly, the Guidance recognises that the common law offence of “cheating the public revenue”, which is one of the base fraud offences, is also one of the base offences caught by the offence of failure to prevent facilitation of tax evasion in the Criminal Finances Act 2017. However, whilst the base offence remains the same for both failure to prevent offences, the Guidance explains that an organisation’s existing procedures to prevent the criminal facilitation of tax evasion may not be sufficient on their own as the offences serve different purposes and the new offence covers a wider scope in terms of who can commit the offence of “cheating the public revenue”.
• Secondly, given that organisations falling within the scope of the FTP Offence are generally subject to auditing requirements, the Guidance makes clear that whilst audits may be useful in identifying certain potential fraud risks, they cannot sufficiently guard against an accusation of failure to prevent fraud. As a result, the Guidance recommends that organisations do not solely rely on the auditing process to provide them with assurance in respect of their fraud prevention and detection controls.
• Lastly, the Guidance clarifies that for listed companies whose board’s report on an organisation’s principal risks and controls under the UK Corporate Governance Code (the “Code”), there is no need to duplicate work where these concern fraud risks identified in the assessment for the failure to prevent fraud. That said, although compliance with the Code may contribute to an organisation’s defence of “reasonable procedures” in the context of the FTP Offence, on its own it is not sufficient to constitute that defence in practice.