On 1 September 2025, a new UK corporate criminal offence will come into force: Failure to Prevent Fraud (FtPF) under the Economic Crime and Corporate Transparency Act 2023 (ECCTA).
This represents a significant shift in how organisations will need to manage fraud risk—especially relevant for Accounts Payable (AP) / Procure-to-Pay (P2P) functions, which are often on the front line of interacting with vendors, agents, invoices, payment flows, third parties. Because fraud schemes often exploit weak controls in P2P/AP, this community has a key part to play.
Some of the key features:
What is it: A corporate criminal offence under ECCTA. It holds large organisations liable when an associated person (e.g. employee, agent, subsidiary, third-party service provider) commits specified fraud for the benefit of the organisation (or in certain cases for the benefit of the organisation’s client), and the organisation did not have “reasonable fraud prevention procedures” in place.
Strict liability structure: The organisation may be liable even if senior management did not order, know of, or had direct involvement in the fraud. What matters is whether the company had appropriate procedures.
Who is in scope: Large organisations which includes incorporated bodies, relevant subsidiaries and partners. Charities, public bodies (if incorporated) also potentially. There are thresholds: to be large, must meet 2 of the 3 criteria:
• over 250 employees
• turnover > £36 million
• total assets > £18 million.
Extra-territorial reach: Even non-UK organisations can be caught if they have a UK nexus (e.g. business operations, associated persons etc.), or fraud affects UK persons.
The defence: To avoid liability, an organisation must show that at the time of the fraud it had “reasonable fraud prevention procedures” in place. What “reasonable” entails is set out in guidance, but it is not a safe harbour: following guidance does not guarantee safety, but diverging significantly will increase risk.
UK Government guidance (Home Office) describes six principle areas that should shape fraud prevention procedures:
AP / P2P are critical control points which are exposed to many fraud vectors. Some examples:
If AP / P2P functions have weak controls, lapses become more than just internal risk, they could be evidence of non-compliance with the new “reasonable procedure” requirement.
Here is what organisations and AP / P2P teams should be doing now to prepare and to ensure they meet the new legal requirement:
Action
Description / Why Important
Understand whether your organisation is in scope
Does your org meet the “large” thresholds? Are you a subsidiary of a larger group? Do you serve UK clients or have operations that link you to the UK? If not, still good to take many actions for best practice.
Map fraud risks specific to AP / P2P
Conduct or update fraud risk assessment for P2P/AP processes: supplier onboarding, invoice receipt & verification, payment authorisation, reconciliation, etc. Identify where weak segments are.
Review existing policies / procedures
What controls are in place (4-eyes approval, supplier verification, PO matching etc.)? Are they documented? Are they being followed? Are there gaps?
Strengthen due diligence for suppliers / agents
Supplier identity verification; background checks; assessing financial stability; reputational checks; periodic re-assessment.
Segregation of duties & approval hierarchies
Ensure no one person has too much control over creation, approval, and payment of invoices. Clear authorisations, audit trails.
Training and awareness
AP / P2P teams need to understand fraud risks and be trained on fraud detection / red flags / ethical standards. Also, people in vendor management, procurement, finance more broadly should know their obligations.
Whistleblowing / speak-up channels
Encourage staff to report concerns; ensure safe, clear channels; ensure there is no retaliation; ensure reports are acted on.
Monitoring, auditing & continuous improvement
Regular reviews/audits of AP / P2P process; look for anomalies (duplicate invoices, round-sum invoices, unusual suppliers, unusual payment patterns); assess the effectiveness of controls. When something goes wrong, do a root cause analysis and adjust procedures.
Ensure clear governance and leadership oversight
Who is ultimately responsible? Does the board or senior execs have visibility into fraud risk and AP control effectiveness? Senior commitment is required under the guidance.
Document everything
Document risk assessments; decisions made; what procedures are in place and when; training records; due diligence and supplier onboarding documents; incidents and responses. If ever asked to show you had “reasonable procedures,” documentation is key.
Examples / Scenarios AP / P2P should think through
These are the kinds of “associated person” misconduct that could trigger liability unless procedures were in place.
To show compliance / defence under FtPF, organisations will need to demonstrate:
As of 1 September 2025, the law is in force.
Organisations have been given guidance already (from November 2024) to begin implementing.
Time is tight to evaluate gaps, update procedures, train staff, and embed monitoring before that date.
For the AP / P2P professional community, the “Failure to Prevent Fraud” offence is not just a legal change, it’s a signal that fraud prevention must be baked into how payables and procurement operate. Systems, process design, staff behaviour, controls, governance all need attention.
If well handled, this presents an opportunity: organisations that build strong AP / P2P fraud-resistant practices will benefit from lower risk, stronger internal control, better reputation, possibly improved supplier relationships. But the cost of neglecting this change could be high.
Fraud is an ever-present risk in transactional finance
roles, especially within Accounts Payable (AP), where the sheer volume of
transactions and the involvement of external vendors can create
vulnerabilities. While technological advancements have provided tools to
mitigate fraud, building a strong anti-fraud culture is equally critical. This
culture starts with awareness and extends through behaviour, processes, and
values embraced by the entire organisation.
Here’s some suggestions on how to create an anti-fraud
culture that safeguards your AP function:
1. Leadership Commitment and Tone at the Top
The foundation of an anti-fraud culture begins with
leadership. When senior leaders demonstrate a zero-tolerance approach to fraud,
employees are more likely to follow suit. It’s essential that management
consistently communicates the importance of fraud prevention through training,
policies, and setting ethical standards. This also means actively participating
in initiatives that promote transparency and integrity.
Key actions include:
2. Comprehensive Employee Training
Employees in AP and transactional finance roles are the
first line of defence against fraud. A well-informed team is better equipped to
spot irregularities and suspicious activities. Comprehensive training programs
that are regularly updated can help foster vigilance.
Training should cover:
Equally important is embedding an understanding of the
repercussions of fraud, not just for the business but for the individual,
including legal consequences and career impacts.
3. Segregation of Duties
One of the most effective internal controls in preventing
fraud is the segregation of duties. No single person should have end-to-end
control over any financial process, such as vendor onboarding, invoice
approval, and payment processing. Splitting these responsibilities between
multiple employees reduces the likelihood of fraud being carried out by an
individual or going unnoticed.
In practice:
4. Automated Fraud Detection Tools
Technology plays a crucial role in identifying potential
fraudulent activity early. AP automation tools equipped with artificial
intelligence (AI) and machine learning can monitor transactions in real-time,
flagging anomalies based on pre-set patterns. For example, they can detect
duplicate invoices, payments to unregistered vendors, or invoices that deviate
from usual spending trends.
These tools should be paired with:
5. Vendor Management and Onboarding Controls
AP fraud often occurs through external vendors, making it
crucial to establish strong vendor onboarding controls. A thorough onboarding
process that includes validating vendor credentials and conducting regular
vendor audits is essential.
Best practices include:
6. Whistleblower and Reporting Mechanisms
An effective anti-fraud culture encourages employees to
report suspicious behaviour. Implementing a whistleblower program that ensures
confidentiality and protection for those reporting potential fraud can greatly
enhance internal fraud detection.
Encourage open communication by:
7. Regular Audits and Continuous Monitoring
Audits play a crucial role in identifying gaps in your
anti-fraud processes. Regular internal audits of AP systems, processes, and
transactions ensure that controls are functioning effectively and provide an
opportunity to spot any unusual patterns or weaknesses.
Continuous monitoring efforts include:
8. Cultivating an Ethical Work Environment
Lastly, fostering an ethical work environment where
integrity is prioritised over shortcuts helps prevent fraud from becoming
ingrained in company culture. When employees understand the value of honesty
and accountability, they are less likely to engage in fraudulent behaviour and
more likely to report it when they see it.
This can be achieved by:
Conclusion
Creating an anti-fraud culture in AP and transactional
finance roles is not a one-time initiative but an ongoing process. It requires
a commitment from leadership, regular training, effective internal controls,
and leveraging technology to build a proactive defence against fraud. When
every team member is aware, vigilant, and supported by strong processes and
tools, the likelihood of fraud can be dramatically reduced, safeguarding both
the department and the wider organisation.
By nurturing this culture, AP teams can move beyond just
preventing fraud and position themselves as trusted, strategic assets to the
business.