Mark Beardsworth, Duncan Grieve and Sharon Takhar discuss the joint SFO-CPS Corporate Prosecution Guidance in Business & Accountancy Daily

Under the Economic Crime and Corporate Transparency Act 2023 (ECCTA), a new Failure to Prevent Fraud (FTPF) offence became effective on 1 September 2025. In a timely step, new guidance was also published recently by the UK Serious Fraud Office (SFO) and the Crown Prosecution Service (CPS): the joint SFO-CPS Corporate Prosecution Guidance details their common approach to the prosecution of corporate offending, including the FTPF offence.

The FTPF offence extends strict corporate liability to several fraud offences. In response, company boards and their in-house legal teams will need to update their risk management frameworks and be prepared for regulatory investigations.

So, what does the new guidance contain?

A lower attribution threshold has been introduced which will make it easier for prosecutors to hold companies criminally liable for economic crimes that are listed under Schedule 12 ECCTA. Section 196 of ECCTA allows corporate bodies to be held liable when a senior manager commits a Schedule 12 offence.

The establishment of corporate liability can be made either under statutory provisions or common law. But prosecutors are now advised to choose the ECCTA rather than the common law identification doctrine, thereby significantly lowering the charging threshold for corporates.

Boards must therefore understand who qualifies as a senior manager and how potential corporate can arise from their decisions. They should anticipate that their current compliance programmes and contemporaneous records will be subject to scrutiny.

The new guidance outlines a spectrum of offences under the FTPF and companies are expected to implement procedures to prevent them in addition to the procedures that should already exist to prevent against bribery (under the Bribery Act) and the facilitation of tax evasion (under the Criminal Finances Act). There are few defences: for bribery, proving that procedures are “adequate” and for tax/fraud offences, showing that they are “reasonable”.

In addition to the Full Code Test, the joint guidance states that other factors must be considered by prosecutors. These include: systemic compliance failings; board-level knowledge or wilful blindness; prior warnings or sanctions; and causing harm to market integrity or unidentified victims. Mitigation factors outlined in the guidance include early self-reporting, a compliance culture that is “mature” and remediation that is “genuine”.

Although Deferred Prosecution Agreements (DPAs) remain a useful tool, they are not an easy option for errant companies. Full cooperation, such as timely disclosure of internal investigation materials and privilege waivers, is mandatory; if co-operation is deemed inadequate, the risk of immediate prosecution arises. The guidance expressly encourages the parallel prosecution of individuals.

Investigators are also encouraged to use asset restraint orders early on, and at sentencing, serious crime prevention orders and director disqualification orders. For companies, requests for financial disclosure and possible trading restrictions should be anticipated and their reporting and monitoring frameworks must be well maintained.

Effective co-ordination is a cornerstone of the new guidance: to strengthen cooperation between agencies, the SFO and CPS aim to avoid potential conflict with domestic regulators, Eurojust, and foreign prosecutors. Multinational groups should also align their strategic response across jurisdictions in which they operate: making a strategic early filing or pursuing forum shopping options in other jurisdictions could be viewed as uncooperative behaviour.

The SFO-CPS guidance largely aligns with the SFO’s pre-existing Corporate Guidance: notably, in early self-reporting, full cooperation, and strong compliance programmes.

But there are differences: entities incorporated by statute are not specifically featured in the SFO’s earlier guidance, for example, whereas the joint guidance brings them into scope. This  extends potential liability beyond typical corporate structures, so that statutory bodies – such as the National Health Service – are required to maintain adequate compliance and to cooperate fully with investigations.

The joint guidance focuses on a higher level: statutory changes and public interest factors influencing prosecution decisions, whereas the SFO’s Corporate Guidance is more granular, outlining expectations as well as engagement and investigation timelines.

Although transparent early engagement is common to both sets of guidelines, the joint guidance emphasises cross-border coordination and multi-agency alignment in assessing cooperation. Taken together, the guidelines present an increasingly robust enforcement landscape for every type of corporate entity with a clear message: active self-reporting and proactive cooperation should operate side by side.

So, how should businesses prepare for the FTPF offence?

Corporate procedures and processes may need some revision. Timely action is required domestically and internationally – for organisations with a developed cross-border footprint. Typically, this will include multiple stakeholders across diverse jurisdictions, reinforced by a compliance strategy that meets global regulatory standards. Although US enforcement may have slowed down, for example, robust compliance and risk frameworks continue to be paramount corporate objectives.

Action points should include:

• Making sure that senior management assume responsibility for fraud and bribery risks; setting zero-tolerance policies; and applying oversight mechanisms, including KPIs and quarterly risk reports.
• Updating fraud and bribery risk mapping in relation to: business models, sectors, intermediaries, geography, group structures and client risks. UK touchpoints and potential victims should be identified.
• Matching controls with principles and applying them to the risks of fraud: top-level commitment; risk assessment; proportionate procedures; due diligence; communication and training; monitoring and reviewing.
• Determining whether you are a “large organisation” under the ECCTA definition (>GBP 36m turnover; >GBP 18m balance sheet; >250 employees), and assessing whether your organisation could imminently meet the relevant criteria, and plan accordingly. Identifying and mapping “associated persons” whose actions could trigger liability: employees, agents, subsidiaries, and contractors.
• Maintaining up to date accountability frameworks for senior managers, as defined by the ECCTA. Identifying those who qualify and how their decisions might expose your organisation to risk.
• Creating robust onboarding, renewal, and due diligence procedures for third parties: customers, intermediaries, JV partners, and vendors. Include proper assurances and protections, such as warranties, audit rights and triggers for termination.
• Strengthening whistleblower channels. Assess the logging, review, investigation and remediation of whistleblowing reports. Conduct internal investigations that match SFO expectations, preserve evidence, and ensure that internal processes are not compromised to external reviews.
• Devising protocols to identify key decision-makers and timelines.
• Delivering role-specific and risk-based training that encompasses potential fraud and bribery scenarios. Maintain uptake records and refresh them regularly.
• Deploying internal audit to evidence monitoring and remediation; reporting outcomes to the board and tracking subsequent progress from implementation to completion.