The Economic Crime and Corporate Transparency Act 2023 (ECCTA) is developing into one of the most consequential pieces of UK corporate governance legislation in a generation. Its full reach is only now starting to be felt by UK businesses, in part because of a long lead up through a staggered implementation timetable: some of its provisions will not take effect until 2027.

ECCTA has introduced a broad suite of measures designed to strengthen the UK’s economic crime framework. Three have been particularly important in the context of fraud risk.

1. Greater corporate accountability for economic crime

ECCTA has ensured that the conduct of a company’s senior managers, where carried out within the scope of their authority, can be treated as the conduct of the company itself for a wide range of economic crime offences. This materially lowers the threshold for finding companies criminally accountable, moving away from the long-standing requirement to identify wrongdoing by a “directing mind and will” of the company: a high bar that had historically made it difficult to prosecute large organisations.

2. The introduction of strict liability for fraud offences

ECCTA also created a new offence of “failure to prevent fraud”, under which large organisations can be held criminally liable where a person associated with the business commits a specified fraud offence intended to benefit it. The offence is wide ranging in its reach and applies to large organisations globally, provided there is a connection with the UK. The only substantive defence is to show that reasonable fraud prevention procedures were in place at the time, placing a clear premium on risk assessed, targeted and regularly tested controls.

3. Enhanced enforcement and verification procedures

ECCTA is also equipping Companies House, the UK company registry, with substantially greater funding, as well as new verification powers and wider discretion to challenge false information on the corporate register. There is now available a much broader range of financial penalties, enabling an evolution in the registry from a somewhat passive repository of corporate information into an active gatekeeper and enforcer.

Taken together, these three reforms signal a subtle but significant tightening of the UK economic crime landscape. ECCTA represents a major shift toward proactive corporate accountability, forcing companies to proactively implement “reasonable procedures” to prevent fraud, rather than simply reacting to it. They represent the further acceleration of a decade-long shift towards greater corporate liability and more onerous internal standards, in which boards and in-house compliance teams are expected to design, document and police preventative controls for fraud and economic crime. ECCTA therefore acts simultaneously as both a criminal statute and an instrument of corporate governance.

An epidemic of fraud

The problems that ECCTA sought to address can hardly be overstated in their scale. The UK’s latest ONS crime figures, released in July last year, cite fraud as responsible for nearly all of the rise in total crime. That is up 31% from the previous year, with more than a million new individual and corporate victims added to the 3.3 million already recorded. In 2013, that figure was just 230,335: an increase of 1,400% in 12 years.

A UK government paper, Economic and social cost of fraud, put the cost to UK businesses and individuals in the private sector at a minimum of £14.4 billion a year (for the year ending March 2024).

The National Audit Office estimated the cost to the public sector for the same period at a further £55bn+, and both figures are widely regarded as underestimates. Relatedly, the National Crime Agency estimates the scale of the UK’s money laundering problem at £100bn a year, much of it the product of frauds and other economic crimes involving UK companies.

The UK was therefore, as the government-aligned think tank RUSI termed it, the “centre of a global fraud epidemic”, and ECCTA urgently sought to tackle what had become a serious threat to UK businesses. Notably, it was the wider geopolitical context—including the war in Ukraine and the increased European focus on issues of defence and national security—that provided the necessary momentum for legislative change to be enacted.
Enforcement through compliance?

The full effects of ECCTA will not be visible for some time, but the direction of travel is becoming clearer. Complex criminal investigations can take years. It is not therefore surprising there has been no substantive enforcement to date of the new corporate liability provisions, including the “senior manager” regime and the “failure to prevent fraud” offence.

Moreover, the UK government has explicitly stated that ECCTA should not be measured by prosecutions alone: its central purpose is to compel companies to raise their own compliance standards and expect the same from those they contract with. This should drive a cultural shift to meaningfully reduce the opportunities for fraud, thereby in turn preventing the commission of fraud offences.

There is real evidence that this is beginning to happen. Boards are expanding compliance budgets, commissioning fresh fraud risk assessments and taking a noticeably stricter look at where senior management responsibility for economic crime sits within their organisations.

Such preventative actions can only advance following the introduction this spring of the Crime and Policing Act 2026, which has extended ECCTA’s “senior manager” attribution from economic crime offences to all UK criminal offences—further broadening the circumstances in which companies can be held liable for the actions of their employees.

‘Failure to prevent’

ECCTA looks set to follow the path of its predecessors. The Bribery Act 2010 and the Criminal Finances Act 2017 similarly sought to expand the ways in which corporates could be held criminally accountable and introduced “failure to prevent” offences for bribery and tax evasion respectively. Whilst both reforms helped to facilitate cultural change within UK businesses, they precipitated only a trickle of prosecutions and convictions in the courts.

This ascendant model of compliance-by-legislation—sometimes described as the “privatisation” of UK economic crime enforcement—relies ever more heavily on companies to both drive standards and police their own wrongdoing, at a time when enforcement agencies often lack the resources and capacity needed to bring large cases to trial.

Without a significant enforcement deterrent however, the short-term successes of ECCTA are unlikely to be sustained in the long run. Fears of penalties for wrongdoing will gradually fade, and in-house legal teams may struggle to persuade boards of the necessity of maintaining complex procedures and costly compliance processes.

With that in mind, notice should be taken of the one part of ECCTA that has already delivered tangible enforcement results. Bolstered by 500 additional staff, Companies House has materially stepped up both civil penalties against companies and criminal prosecutions of directors under the Companies Act 2006.

During the last year on record, the registry issued 317,985 penalties—a near 10% year-on-year increase—and prosecuted 2,760 directors, a figure that looks set to climb further still. If a reminder is needed that legislative changes are enhanced by a credible enforcement deterrent, the UK government may find it already has one to hand.

Lorna Emson is a partner and Francis Bond is a senior associate, both in Macfarlanes’ Litigation, Arbitration and Investigations team. With thanks also to Lara Gardiner, associate, Macfarlanes.