The Economic Crime and Corporate Transparency Act 2023 (ECCTA) received Royal Assent in October 2023, bringing with it two key changes for potential corporate criminal liability which firms must be aware of. Below, we set out what firms ought to be aware of, in particular:

• changes to the Identification Doctrine (how corporate liability can be attributed); and 

• the new failure to prevent fraud offence. 

Changes to the Identification Doctrine

All firms ought to be aware of a very important change brought in by the ECCTA which will make it easier for firms to be held criminally accountable for the commission of specified substantive criminal offences. 

Until the introduction of the ECCTA, corporate criminal liability for most offences could only be made out where evidence could establish that the "directing mind and will" of the company possessed the relevant "mens rea" (mental state – including dishonesty, intention, recklessness or negligence) for the commission of the offence. This was often difficult to establish, particularly for large firms, where the "directing mind" of the organisation will often be far removed from the day-to-day operational or compliance decision-making.  

The key change adopted by the ECCTA was to lower this threshold so that, from the end of December 2023, prosecutors are able to hold a firm directly criminally accountable where the offence is committed by a Senior Manager acting "within the actual or apparent scope of their authority" – making prosecution more straightforward. 

Who could be a "Senior Manager"?

A Senior Manager is defined in the act as an "individual who plays a 'significant role' in the making of decisions about the whole or a substantial part of the activities of the body corporate…or the actual managing or organising of the whole or a substantial part of those activities". 

This is clearly widely drawn and is likely to include Heads of Department and persons with significant management and oversight responsibilities, including legal and compliance managers. 

To what offences does it apply?

At present, the ECCTA has limited the extension of liability to economic crime offences. These are set out in Schedule 12 of the Act, but include specified theft, tax evasion, terrorism, money laundering, fraud, sanctions and regulatory offences.

However, firms should also be aware that this is likely to be extended further. The draft Criminal Justice Bill proposes the extension of the Identification Doctrine for all criminal offences. In our view, this could lead to an increase in firms being held responsible for non-financial misconduct, including harassment, assault and sexual assault in circumstances where Senior Managers are complicit in such misconduct. 

What is the impact of this change?

We anticipate that this amendment, which is in line with a cross-party commitment to reducing economic crime, will result in a significant increase in corporate prosecutions. Importantly, while prosecuting agencies have previously relied on "failure to prevent" offences, such as those available for bribery and corporate tax evasion, it will now be more likely that corporates will themselves be charged with substantive criminal offences, leading to increased financial penalties as well as reputational damage. 

What should firms do?

All firms should be considering undertaking a review of the adequacy of their financial crime control frameworks to ensure that they are robustly identifying potential risk exposure and taking steps to both prevent the opportunity for the commission of offences and to have in place early detection systems so that any exposure can be identified, assessed and cauterised as early as possible. Although having an adequate framework in place will not provide a defence to substantive offences (unlike for a failure to prevent charge, see below), a robust framework will assist corporates in managing their legal risk exposure.

Failure to prevent fraud

The ECCTA has also introduced a failure to prevent fraud offence, following the model of corporate liability already established for bribery and corporate tax evasion.

What this means is that for large firms (described in more detail below) additional corporate liability will arise in circumstances where a person associated with the firm (an Associated Person) commits a fraud offence for the benefit of the firm, or for the benefit of someone for whom the firm provides services.

Firms may however be able to rely on a defence to this offence where they can show that they had reasonable "prevention procedures" in place at the time the offence was committed. 

To which firms will it apply?

The offence currently applies only to "large organisations". A firm will be deemed to be a "large organisation" where it meets any two of the criteria below in the financial year preceding the date of the fraud offence:

• Turnover +£36 million
• Balance sheet total +£18 million
• +250 employees

Smaller companies are not yet within scope of the ECCTA, but they may want to consider the robustness of their controls for two reasons:

• the Identification Doctrine will still be applicable, and so robust controls will help smaller firms to mitigate and manage their increased financial crime prosecution risk; and
• it is possible that large firms will seek assurances from smaller firms, as part of their engagement, when the smaller firm is acting as an agent or subsidiary of the large firm, and so smaller firms should consider robustness in order to mitigate group liability or to ensure continuity of relationships with larger risk-adverse firms.

In any event, the Criminal Justice Bill 2023 may widen the scope of "failure to prevent fraud" to smaller companies in due course and so companies not falling within the criteria at present should include this as part of horizon scanning ahead of any potential changes.

What are the jurisdictional limitations?

Whilst the legislation does not make a statutory reference to the jurisdictional reach of this new offence in the same way that the Bribery Act 2010 does, the offence can still apply even if the organisation and the employee are outside the UK, such as where the victims of the fraud are in the UK.   

Who is an Associated Person?

An "Associated Person" is defined as someone who is an employee, agent or subsidiary of the relevant body or someone who performs services for or on behalf of the body. Whether someone performs services for or on behalf of the company will be determined factually on a case-by-case basis but it is a notably wide definition. The offence could be triggered by the misconduct of a subsidiary, placing parent companies at a heightened risk of liability for failing to prevent fraudulent behaviour of their subsidiaries, who are affiliated to them. 

What type of offences apply?

The full list of applicable offences can be found within Schedule 13 ECCTA but includes both fraud and specific offences under the Theft Act, fraudulent trading and tax fraud.

When could companies be liable?

Corporate entities will only be liable for a failure to prevent offence in circumstances where a substantive offence is committed by an Associated Person. There is no standalone corporate criminal liability under the new regime for inadequate systems and controls outside the commission of a provable offence (although regulated financial services firms should be mindful of regulatory obligations to have in place effective systems and controls, which can result in standalone enforcement action). 

Adequate procedures defence

The defence to this offence has been modelled on the failure to prevent tax evasion defence, as contained in the Criminal Finances Act 2017.

Where a relevant offence has been committed by an Associated Person, a defence is available where the company can show that, at the time of the fraud, it had either:

The burden to prove the defence will be on the corporate to demonstrate that either of the above is made out to benefit from the defence. 

What are adequate procedures?

The Secretary of State is required to issue guidance for firms on "adequate procedures" before the failure to prevent fraud offence comes into force, outlining what firms should consider when assessing the adequacy of their systems and controls. We expect that such guidance will be issued in the second quarter of 2024, with an expectation that the offence will come into force in the second half of the year.

However, based on our compliance experience, we expect that an adequate framework assessment will consider the following elements:

• Completion of a firm-wide risk assessment
• Assessment of risk in external, third party relationships
• Review how you are assessing and managing your internal fraud risk
• Consider how your current controls prevent fraud and identify breaches
• Are your staff trained on implementing and escalating fraud controls?
• Consider the culture in place at your firm in respect of financial crime compliance

Next steps

The Dentons team is hosting a series of sector-specific roundtable events at which our clients will meet with others in their sector to discuss how they are approaching these issues in the context of financial crime compliance more broadly. If a member of your firm would like to be placed on a list to attend a roundtable, please contact chandrika.hirani@dentons.com confirming your name, role and firm sector.