Failure to prevent fraud: why your larger clients may start asking questions

If you supply services to a larger business, you may soon be asked a question you have not met before: what do you do to stop fraud? The reason is a criminal offence that came into effect on 1 September 2025. It does not apply to most small firms directly, but it can reach them through the contracts they sign with bigger customers. This post explains who is covered, why a small supplier might still be asked questions, and what sensible, proportionate steps look like.

What the offence is

The offence is called failure to prevent fraud. It sits in the Economic Crime and Corporate Transparency Act 2023, and the Government's guidance explains how it works. In short, a large organisation can be held to account if an "associated person" commits a fraud intending to benefit that organisation (or, in certain cases, its clients), and the organisation did not have reasonable fraud prevention procedures in place.

The guidance lists the kinds of underlying fraud involved, and they include fraud by false representation under the Fraud Act 2006 and false accounting under the Theft Act 1968. The point of the law is that a large organisation cannot simply say the board did not know. It needs to show it took reasonable steps.

Who is in scope

The guidance is clear that the offence applies to large organisations only. A large organisation is one that meets two or three of these criteria:

• More than 250 employees
• More than £36 million turnover
• More than £18 million in total assets

These conditions are measured on the financial year before the year of the fraud, and they apply to the whole organisation, including subsidiaries. If you run a typical small business, you are almost certainly outside this definition. The guidance itself says the six principles it sets out "represent good practice and may be helpful for smaller organisations", but it does not make them a legal requirement for you.

Why a small supplier might still be asked about it

Here is the part that matters for smaller firms. An "associated person" includes an employee, an agent or a subsidiary, and also anyone who provides services for or on behalf of the large organisation. The Government's guidance says directly that small organisations may be associated persons while they provide services for or on behalf of large organisations, and that in these circumstances they "may be subject to contractual or other requirements imposed by the large organisations".

It also says that companies in a supply chain are not associated persons unless they are providing services for or on behalf of the large organisation. So a business that simply sells a product into a wider supply chain is in a different position from one doing work on a large customer's behalf, such as an agency, a freelancer, a software developer or a sales agent. Where a project involves a prime contractor and subcontractors, the guidance notes the large organisation may ask its direct contractor to take a similar approach with the next party in the chain. That is how questions can travel down to small firms.

Commentary from a law firm suggests this could show up in tenders, insurance applications or investment discussions, and that large clients are likely to pass expectations down their supply chains. That is commentary rather than hard data, and I did not find an independent survey showing how many small suppliers have actually been asked. Treat it as something that may happen, not something that certainly will.

The six principles, in plain English

The Government's guidance says a large organisation's framework should be informed by six principles, and that they are meant to be flexible and proportionate to the risk. They are:

• Top level commitment: the people at the top make it clear that fraud is not tolerated.
• Risk assessment: work out where fraud could realistically happen.
• Proportionate, risk-based procedures: controls that match the size and nature of the risk.
• Due diligence: sensible checks on the people who work for or on behalf of you.
• Communication, including training: the guidance says training and keeping it up to date are key.
• Monitoring and review: check that it works and improve it, including by learning from incidents.

Nothing here demands a compliance department. For a ten-person firm, proportionate might mean a one-page policy, a few clear rules about money and a short annual conversation with staff.

What to do this week if you supply larger businesses

You do not need to wait for a questionnaire. A short, honest piece of preparation will help you answer one calmly. Commentators suggest the practical steps below, and they are also just good business hygiene.

• List where money and records move. Invoices, expenses, supplier bank details, client reports and timesheets are the usual places where false figures or false claims could appear.
• Add a second pair of eyes to payments. For example, require two people to approve high value payments and any change to a supplier's bank details. Confirm changes using a phone number you already hold, not one in the email asking for the change.
• Write a short fraud policy. Say what is not acceptable, who to tell, and that nobody will be penalised for raising a concern in good faith.
• Brief your team. Ten minutes on phishing, fake invoices and false claims is better than a policy nobody has read. The NCSC says reporting a scam is free and takes only a minute, which is a useful message for staff.
• Check who works on your behalf. If you use freelancers, agents or subcontractors, keep a record of who they are and what they do, and make sure your contracts say what you expect of them.
• Read the contract before you sign. If a large client adds fraud prevention clauses, check what you are promising, and ask for plain wording if something is vague.
• Diarise a review. Once a year, ask what has changed and what went wrong elsewhere.

The technology side

Many small business fraud risks are digital: hijacked email accounts, fake supplier invoices, shared logins and no record of who changed what. Basic measures such as two-step verification, separate accounts for each person and a log of changes to payment details make the paperwork above far easier to stand behind. If you want help tightening up accounts, email and systems, our cloud and security work covers exactly that.

What not to do

Do not copy a long policy from a large corporate and sign it without reading it. Do not claim controls you do not actually run, because a false statement in a supplier questionnaire is a problem of its own making. And do not assume you are automatically exempt if you do work on behalf of a large organisation, because the guidance says the associated person test depends on the circumstances, not the size of your firm.

The bottom line

The offence applies to large organisations only, and the Government's guidance describes its principles as good practice for smaller ones. But if you work for or on behalf of a large customer, expect questions and contract wording that flow from it. A short policy, sensible payment controls, basic training and honest answers will put you in a good place. This is general information, not legal advice, so take advice on a specific contract if the wording worries you.