Whether a company is criminally liable for its people's conduct depends on national law. The UK has moved fastest: a failure to prevent fraud offence for large organisations since 1 September 2025, a broader senior manager attribution rule since 29 June 2026, and older failure-to-prevent offences for bribery and tax evasion facilitation. Germany uses administrative fines instead of corporate criminal liability, France uses negotiated settlements, and the US Department of Justice rewards self-disclosure. Reasonable prevention procedures are the common thread.
The UK failure to prevent fraud offence
Since 1 September 2025 a large organisation is liable where an employee, agent, subsidiary or other person performing services for it commits a listed fraud offence intending to benefit it. An organisation is large if, in the previous financial year, it met two of three tests: turnover above £36 million, balance sheet total above £18 million, more than 250 employees, with group rules for parents. The offence applies wherever the organisation is incorporated, and the defence is to prove reasonable fraud prevention procedures were in place, or that none could reasonably be expected.
Two other changes widen exposure. From 29 June 2026 a company commits an offence where a senior manager acting within the actual or apparent scope of their authority commits it, replacing a narrower 2023 rule limited to economic crimes. And since 2017 any relevant body, whatever its size, can be liable for failing to prevent associated persons from facilitating UK tax evasion, or foreign tax evasion where there is a UK connection.123456
Germany, France and the US
Germany has no corporate criminal liability as such, but a company can be fined up to EUR 10 million for an intentional criminal offence, and EUR 5 million for a negligent one, committed by its management in connection with the business. In France, a company accused of probity offences, tax fraud or environmental offences can settle with the prosecutor through a CJIP, with a fine of up to 30% of average annual turnover and, where required, a compliance programme supervised by the AFA for up to three years.
The US Department of Justice's Corporate Enforcement and Voluntary Self-Disclosure Policy offers a declination to a company that voluntarily self-discloses, fully cooperates, remediates and has no aggravating circumstances, with disgorgement. Where a company self-reports but does not qualify, it can obtain a non-prosecution agreement of under three years with no monitor and a 50% to 75% fine reduction.78910
| Market | Mechanism | Threshold or figure | Defence or mitigation | Source |
|---|---|---|---|---|
| United Kingdom | Failure to prevent fraud (ECCTA 2023 s199) | Two of: turnover over £36m, balance sheet over £18m, over 250 employees | Reasonable fraud prevention procedures | legislation.gov.uk |
| United Kingdom | Senior manager attribution (from 29 June 2026) | Any offence by a senior manager within scope of authority | None specific | legislation.gov.uk |
| United Kingdom | Failure to prevent facilitation of tax evasion (CFA 2017 ss45-46) | All relevant bodies; foreign tax needs UK nexus | Reasonable prevention procedures | legislation.gov.uk |
| Germany | Administrative fine (OWiG s30) | Up to EUR 10m (intentional), EUR 5m (negligent) | Not confirmed | gesetze-im-internet.de |
| France | CJIP settlement | Fine up to 30% of average annual turnover | AFA-monitored programme up to three years | AFA |
| United States (federal) | DOJ corporate enforcement policy | Declination or NPA under three years; 50% to 75% reduction | Self-disclosure, cooperation, remediation | justice.gov |
Decisions to make
- Is the group, or any member, a large organisation under the UK test?2The failure to prevent fraud offence applies only to large organisations, but the threshold is low enough to catch many mid-size groups.
- Who are the group's senior managers for UK attribution purposes?4Since 29 June 2026 an offence by a senior manager acting within their authority can be attributed to the company.
- Do the fraud, bribery and tax evasion prevention procedures rest on a documented risk assessment?3511Each UK failure-to-prevent offence offers a defence only for reasonable or adequate procedures.
- What is the process for deciding whether to self-report?910US declinations and fine reductions depend on voluntary self-disclosure and cooperation.
Documents usually needed
- Fraud and tax evasion facilitation risk assessments
- Prevention procedures: policies, controls, training and monitoring, with board approval
- Map of senior managers and their areas of authority
- Investigation and self-reporting protocol
- Records of procedure reviews and testing
Common mistakes
- Assuming the failure to prevent fraud offence applies only to listed or very large companies
- Testing size by the UK entity alone without applying the parent and group rules
- Treating the tax evasion facilitation offence as limited to tax departments
- Relying on Germany's lack of corporate criminal liability when administrative fines reach EUR 10 million
- Delaying a self-report decision until the authorities make contact
Questions businesses ask
Does the UK failure to prevent fraud offence apply to a non-UK company?
It applies to bodies corporate and partnerships wherever incorporated, if they meet the large organisation test, subject to the territorial rules for the underlying fraud.12
What is a large organisation for this offence?
One that met two of three tests in the previous financial year: turnover above £36 million, balance sheet total above £18 million, more than 250 employees, with group rules for parents.2
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- The Home Office guidance on reasonable fraud prevention procedures could not yet be checked.
- Whether the UK senior manager attribution rule applies to conduct before 29 June 2026 was not confirmed.
- Corporate criminal liability in the UAE, Saudi Arabia, India and Singapore was not researched.
- German mitigation for compliance programmes in fine-setting was not confirmed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The offence of failure to prevent fraud came into force on 1 September 2025: a large organisation is liable where an employee, agent, subsidiary or other person performing services for it commits a listed fraud offence intending to benefit it. Applies to bodies corporate and partnerships wherever incorporated. Not liable where the organisation was the intended victim. Fine, unlimited on indictment.
An organisation is a large organisation for the failure to prevent fraud offence if, in the financial year before the fraud, it met two or more of: turnover above £36 million, balance sheet total above £18 million, and more than 250 employees. Separate rules in sections 201 and 202 apply to parent undertakings and groups.
It is a defence to the failure to prevent fraud offence for the organisation to prove that it had reasonable fraud prevention procedures in place, or that it was not reasonable to expect it to have any.
From 29 June 2026, a company or partnership also commits an offence where a senior manager commits it while acting within the actual or apparent scope of their authority, replacing the narrower 2023 rule that covered economic crimes only. Covers bodies incorporated outside the UK. Excludes cases where all the conduct occurs outside the UK and the organisation would not have committed the offence had the conduct been its own.
Section 196 of the Economic Crime and Corporate Transparency Act 2023 is recorded on legislation.gov.uk as omitted from 29 June 2026. Whether section 250 applies to conduct before that date was not confirmed.
A relevant body commits an offence under the Criminal Finances Act 2017 if a person associated with it criminally facilitates UK tax evasion, unless it proves it had reasonable prevention procedures or that it was not reasonable to expect any; the penalty is a fine. Section 45; applies whatever the size of the body. Unlimited fine on indictment.
A relevant body also commits an offence if an associated person facilitates evasion of a foreign tax, where the body is UK-incorporated, carries on business in the UK or part of the conduct takes place in the UK, and the conduct is criminal in both the foreign country and the UK. Criminal Finances Act 2017, section 46. Same reasonable prevention procedures defence; penalty is a fine.
Germany has no corporate criminal liability as such, but a company can be fined up to EUR 10 million for an intentional criminal offence, and up to EUR 5 million for a negligent one, committed by its management in connection with the business. Administrative offence fines under § 30 OWiG; where a statute refers to § 30, the maximum for the relevant regulatory offence can be multiplied by ten.
The § 30 page confirms the fine caps; the statement that Germany has no corporate criminal liability is general background and is not stated on that page.
A company accused of breaches of probity, tax fraud or environmental offences can settle with the public prosecutor through a convention judiciaire d'intérêt public (CJIP), with a public-interest fine of up to 30% of its average annual turnover and, where required, a compliance programme under AFA supervision for up to three years. Code of Criminal Procedure, article 41-1-2. Performance of the obligations extinguishes the prosecution. The AFA reports 30 CJIPs for probity offences, 20 of them with AFA-monitored programmes.
The reference period for average turnover was not stated on this page.
Under the Department of Justice's department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy, the Department will decline to prosecute a company that voluntarily self-discloses, fully cooperates, remediates in a timely and appropriate way and has no aggravating circumstances, but the company must pay all disgorgement or forfeiture and restitution. Federal; all corporate criminal matters handled by the Department except antitrust violations under 15 USC 1-38. Declinations are made public.
The 10 March 2026 date comes from the link label on the Criminal Division corporate enforcement page; the policy document itself shows no date.
Where a company self-reports but does not qualify for a declination, or aggravating factors exist, the department-wide policy provides for a non-prosecution agreement of under three years, no independent compliance monitor and a fine reduction of 50% to 75% off the low end of the US Sentencing Guidelines range, absent particularly egregious or multiple aggravating factors. Federal; Department of Justice. In other cases the reduction is capped at 50%.
A commercial organisation commits an offence if a person associated with it bribes another person to obtain or retain business or a business advantage for it, unless it proves it had adequate procedures designed to prevent such conduct. Applies to UK-incorporated bodies and partnerships wherever they do business, and to any other body or partnership that carries on a business, or part of a business, in the UK.
Questions on this topic
10 statements on corporate criminal liability and failure to prevent fraud
