Failure to Prevent Fraud Training: What the Law Expects

Failure to prevent fraud training teaches employees and others who work on your behalf what the offence is, how fraud could happen in their role, and how to use your controls and whistleblowing routes. Since 1 September 2025, a large organisation can be prosecuted if an employee, agent or other associated person commits fraud intending to benefit it, unless it had reasonable fraud prevention procedures. The Home Office guidance makes communication, including training, one of six principles for those procedures, and says training should match the risk, with particular attention to the highest-risk roles.

This guide explains who the offence covers, what the guidance expects from training, who needs what, how to run it alongside anti-bribery training and the records to keep.

What is the failure to prevent fraud offence?

The offence is in section 199 of the Economic Crime and Corporate Transparency Act 2023. An organisation commits it when a person associated with it commits a fraud offence intending to benefit the organisation, or the clients it provides services to.

• Who it applies to. Large organisations only. Under section 201, that means meeting two or more of these in the previous financial year: more than 250 employees, turnover over £36 million, balance sheet total over £18 million. A parent company is judged on the figures for its whole group.
• Who counts as associated. Employees, agents, subsidiaries and anyone else who performs services for or on behalf of the organisation, such as contractors.
• Which frauds. The offences listed in Schedule 13, including fraud by false representation or abuse of position, false accounting, false statements by company directors, fraudulent trading and cheating the public revenue.
• The defence. The organisation is not guilty if it had the prevention procedures it was reasonable to expect it to have in place.
• The penalty. A fine, with no upper limit on conviction on indictment. Deferred prosecution agreements are available in England and Wales.

Two points in the guidance are easy to miss. The benefit to the organisation does not have to be the fraudster’s main motive: its example is a salesperson on commission who mis-sells to earn more, which also increases the company’s sales. And the individual who committed the fraud does not have to be prosecuted for the organisation to be liable.

Smaller organisations are outside the offence, but the guidance says its principles are good practice for them too. For the training UK law requires of every employer, see our guide to mandatory training for employees in the UK.

Does the law require failure to prevent fraud training?

The Act does not mention training. It requires the government to publish guidance on reasonable procedures, and the Home Office guidance sets out six principles:

1. Top-level commitment
2. Risk assessment
3. Proportionate risk-based prevention procedures
4. Due diligence
5. Communication (including training)
6. Monitoring and review

On communication, the guidance says “training and maintaining training are key”. Its training section says that training should:

• be proportionate to the risk the organisation faces
• consider the specific needs of people in the highest-risk posts
• cover the nature of the offence as well as the procedures to address it
• make sure staff and other associated persons know the whistleblowing policy
• be monitored for effectiveness and kept up to date, particularly as staff move.

Among its questions for judging risk, the guidance asks whether people in high-risk roles receive regular anti-fraud training and how closely completion is monitored. Its suggestions for monitoring include collecting data on how many staff have attended fraud prevention training and their test results. If a fraud happens, records like these help show your procedures were in place.

Who needs failure to prevent fraud training?

Who	What they need
All employees	What fraud in scope looks like, your organisation’s stance, the controls they must follow and how to raise a concern safely.
High-risk roles	Scenario-based training on the fraud risks in their own work. The guidance names finance, procurement, investor sales and marketing as departments that may have the greatest opportunity, and highlights pressure from sales targets.
Managers	How to set the right example, avoid creating pressure that leads to fraud, and respond when someone raises a concern. The guidance warns that leadership statements mean little if middle managers ignore the procedures.
Senior leaders and the board	Their responsibility for the fraud prevention framework, approving the risk assessment, and funding training and controls.
Agents, contractors and other associated persons	Your expectations and how to report concerns. The guidance says you can train them yourself or encourage them to have their own arrangements.

A training needs analysis helps you match the depth of training to the risk in each role, using your fraud risk assessment as the starting point.

What should failure to prevent fraud training cover?

• The offence in plain words. Who is an associated person, what “intending to benefit” means and why a fraud that only partly benefits the organisation still counts.
• Fraud that looks like your business. The guidance’s own examples include overstating profits to attract investors and promoting an investment with false environmental claims. Use scenarios from your sector and your risk assessment, such as misleading customers to hit a target, false claims in a bid or invoices that misstate what was delivered.
• Why people commit fraud. The guidance uses the fraud triangle of opportunity, motive and rationalisation. Training can challenge rationalisations such as “nobody gets hurt” or “everyone does it”.
• Your controls. Sign-off rules, segregation of duties, due diligence on third parties and what to do when a control seems to get in the way.
• Speaking up. Your whistleblowing routes, the protection people have and what happens after a report. The guidance suggests regular reminders because people use these routes rarely. Our guide to whistleblowing training covers the law.
• Consequences. For the organisation and for individuals.
• A short assessment. It shows understanding and gives you the test results the guidance suggests monitoring.

The guidance notes that some organisations add this to existing financial crime training while others introduce bespoke training for their specific fraud risks. Generic content explains the law. Training built on your own risk assessment is what shows your procedures were reasonable for your organisation.

Fraud and bribery: one programme

Section 7 of the Bribery Act 2010 has a similar structure: a commercial organisation is guilty if a person associated with it pays a bribe, unless it had adequate procedures to prevent bribery. Unlike the fraud offence, it applies to commercial organisations of any size.

The Ministry of Justice Bribery Act guidance also has six principles, and principle 5 is communication (including training). It suggests general training for new employees and, on a risk basis, for agents, with tailored training for higher-risk functions such as purchasing, contracting, distribution and marketing. It says effective training is continuous, monitored and evaluated, and names e-learning as one of the formats available.

Because the frameworks match, it makes sense to cover both in one economic crime module, with branches for the roles that carry the most risk. Our guide to anti-bribery training for employees covers what the Bribery Act guidance expects. Firms in the money laundering regulated sector also have a direct legal duty to train staff, explained in our guide to anti-money laundering training.

Online or face to face?

E-learning suits the core content. Everyone gets the same message, it can reach agents and contractors as well as employees, and it records completion and test results automatically. Scenario-based modules let people in high-risk roles practise decisions they might face.

Face-to-face or live sessions suit senior leaders and high-risk teams, where discussing real dilemmas is the point. The MoJ guidance says that whatever the format, people should come away with a firm understanding of what the policies and procedures mean in practice for them.

How often should the training be repeated?

Neither the Act nor the guidance sets an interval. The guidance expects regular training for high-risk roles, training kept up to date as people move roles, and a risk assessment reviewed regularly, typically every year or two. We suggest training at induction, an annual refresher for high-risk roles, and an update whenever your risk assessment or procedures change.

How Capytech helps

FastTrack turns your fraud risk assessment, policies and controls into a custom e-learning module with scenarios from your own sector and a knowledge check, built from your documents in days. Updates are turned round in 48 hours, so the training changes when your risk assessment does. We can build one economic crime module covering fraud and bribery, with role-based branches.

The Capytech LMS assigns the right training to each role and keeps the evidence the guidance points to: who completed what and when, and their test results. Its compliance matrix shows who is valid, due or overdue, and certificates carry renewal dates so refreshers happen on time.

The Capytech course library adds anti-bribery and business ethics titles for general awareness. Our free mandatory training checker shows whether the fraud offence applies to you, alongside the rest of your training duties.

Frequently asked questions