One Year On: The Failure To Prevent Fraud Offence, The Crime And Policing Act 2026, And What MoD Suppliers Must Do Now

September 2026 marks the first anniversary of the corporate criminal offence of failure to prevent fraud coming into force under section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). The Home Office guidance recommends that organisations review their fraud prevention measures at least every 12 months.

For companies supplying goods, works, or services to the Ministry of Defence (MoD), the obligation to conduct that review has never been more pressing in light of a landmark parliamentary report, a record-setting deferred prosecution agreement against a British defence supplier, and a significant expansion of corporate criminal liability under the Crime and Policing Act 2026. The question for every supplier is whether its fraud prevention framework is fit to operate in this new regulatory landscape.

The Legal Landscape: Two Offences, One Compliance Challenge

The ECCTA failure to prevent fraud offence applies to any large organisation meeting at least two of: more than £36 million turnover; more than £18 million total assets; or more than 250 employees — where an associated person commits a fraud offence for the organisation’s benefit.¹ The statutory defence requires the organisation to demonstrate that it had reasonable fraud prevention procedures in place at the time. One year in, enforcement activity has been limited, but a quiet enforcement landscape should not inspire complacency. Investigation and prosecution cycles for complex fraud are long, and cases in the system now will surface in the years ahead.

Section 250 of the Crime and Policing Act 2026 (CPA 2026), in force since 29 June 2026, significantly widens the exposure to organisations meeting the criteria. It extends corporate criminal liability to any criminal offence committed by a senior manager acting within actual or apparent authority, not merely the specific economic crimes previously listed under ECCTA, and it applies to organisations of any size. Smaller companies in the MoD supply chain that considered themselves outside the scope of ECCTA are now caught. Critically, there is no equivalent “reasonable procedures” defence under section 250. The only mitigation available is to have robust governance structures that reduce the prospect of a senior manager committing a relevant offence in the first place.

Taken together, these two regimes mean that virtually every participant in the MoD supply chain — from major prime contractors to SMEs — now operates within a corporate criminal liability framework that did not exist two years ago.

Sector-Specific Risk: Parliament’s Verdict on the MoD

The Public Accounts Committee’s report of 29 May 2026² is the most significant parliamentary assessment of fraud governance within the MoD’s procurement function in a generation. Its findings are stark and directly relevant to any company that holds or bids for MoD contracts.

The committee found that the MoD is exposed to a fraud and economic crime risk of £1.5 billion per year — a figure it has addressed with “no overarching strategy” and insufficient leadership.³ Over the last four years, the MoD recovered only 48 pence for every pound it spent tackling fraud and economic crime against a government-wide expectation of a £3 return per pound spent, to be achieved by 2028. This is shocking given the obligations on companies operating in the MoD supply chain pursuant to ECCTA and the CPA 2026 described above.

The most operationally significant finding for suppliers concerns procurement fraud. Around £400 million of contract payments were stopped in 2024–25 that the MoD judged to be invalid — submitted by suppliers despite the MoD having open-book access to their financial data.⁴ The committee concluded that suppliers may regularly and repeatedly claim more than they are entitled to, and that there is little evidence that the MoD’s oversight deters or penalises dishonest behaviour.⁵

The PAC Chair characterised this as “the apparent normalisation of fraud in the procurement process.”⁶ The remedy is imminent: the PAC has called for a new MoD Counter Fraud Strategy by September 2026 and a recovery plan targeted by 2028 (at the latest) to achieve the £3:1 return. The appointment of a dedicated two-star individual to lead counter-fraud work is also recommended. Each of these developments will translate into heightened scrutiny of, and new compliance expectations for, the supply chain.

Case Study: Ultra Electronics and the DPA Lesson

The Serious Fraud Office’s Deferred Prosecution Agreement with Ultra Electronics Holdings Limited, approved on 1 May 2026, is the most instructive recent enforcement action for MoD suppliers.

Ultra Electronics, a British defence and aerospace manufacturer, accepted responsibility for three “failure to prevent” bribery offences under section 7 of the UK Bribery Act. The case involved three public-sector contracts across Oman and Algeria, including a contract worth up to £200 million awarded by the Omani Ministry of Transport and Communications. The total financial consequence was £14.9 million, comprising a £10.08 million penalty and £4.8 million in SFO costs. A three-year probationary period runs until May 2029, requiring evidence of a fully independent compliance function, continuous third-party monitoring, and annual SFO reporting.⁷

Although the Ultra DPA concerns bribery rather than fraud, the compliance lessons are directly transferable. This is not a coincidence as the “reasonable procedures” defence under the FTPF offence is deliberately modelled on the Bribery Act 2010 “adequate procedures” defence. Suppliers that already maintain a compliant anti-bribery framework are therefore well-placed to extend it to cover fraud risk, provided the extension is properly documented, risk-assessed, and tailored to outward fraud scenarios specific to the MoD supply chain

Enforcement authorities look closely at whether a company had a structured process for identifying and assessing risk in practice. A policy that looks effective on paper but is not properly implemented carries little weight. Engaging agents, consultants, and intermediaries remains a well-recognised source of financial crime risk in cross-border and public-sector contracting, and supplier arrangements (including sub-contracting and teaming) must be treated as an integral part of any fraud risk assessment. Most critically, the DPA framework remains available only to those who self-report and cooperate genuinely: that calculation must be made at an early stage.

Practical Steps for MoD Suppliers

Against this backdrop, the 12-month anniversary review should address the following:

• Refresh the fraud risk assessment. Assessments that are too narrowly focused, or that have not been updated to reflect changes in the organisation’s contracts, markets, or systems, may fail to identify current exposures. The MoD’s own findings about open-book pricing and sub-contractor management should be reflected explicitly in the assessment.
• Review contract claims controls. Senior-level approval mechanisms and audit trails governing the submission of claims under MoD contracts — particularly open-book and cost-reimbursable arrangements — must be capable of withstanding forensic scrutiny. The PAC’s findings make this a priority area.
• Audit third-party and intermediary arrangements. Sub-contracting, teaming, and agent arrangements are consistently identified as elevated-risk areas in enforcement actions. Due diligence, contractual flow-down provisions, and ongoing monitoring should be reviewed for adequacy.
• Assess section 250 CPA 2026 exposure. Organisations should consider whether their governance arrangements adequately address the broader scope of the new provision, including for entities and individuals below the ECCTA size threshold.
• Address supply chain flow-down for SMEs. Smaller organisations in the MoD supply chain that fall below the ECCTA large-organisation thresholds are not directly liable under that offence, but they will increasingly face contractual requirements from prime contractors to demonstrate proportionate fraud prevention controls. Public sector procurement scoring already includes fraud control criteria for larger contracts, and this is expected to intensify. SMEs should treat compliance with the spirit of the framework as a commercial necessity, not merely a legal one.
• Engage the board. Training and awareness programmes should be tailored to relevant risk areas and refreshed annually. Board-level engagement with the fraud prevention framework is increasingly an expectation of enforcement authorities, not merely good practice.
• Consider self-reporting obligations early. The Ultra Electronics DPA demonstrates that voluntary disclosure and genuine cooperation materially shape enforcement outcomes. That assessment should be built into the organisation’s incident response framework before a problem arises.
• Build and maintain a documented fraud prevention file. The reasonable procedures defence stands or falls on evidence. The file should include a board-approved fraud prevention policy and tone-from-the-top statement; a documented fraud risk assessment refreshed at least annually; due diligence records for employees, agents, sub-contractors, and other associated persons; training records with role-based completion rates and refresher dates; whistleblowing arrangements with independent reporting routes and case logs; monitoring and audit reports covering fraud risks; incident logs and documented responses; and board minutes evidencing oversight and challenge. The defence must be evidenced as at the time of the alleged offence as retrospective documentation does not rebuild it.

This alert has been prepared for informational purposes only and does not constitute legal advice.

Footnotes

1 Economic Crime and Corporate Transparency Act 2023 (ECCTAs 199(1). A “relevant body” which is a “large organisation” (as defined by ss 201–202) commits the offence where a person “associated” with it (defined in s 199(7) as an employee, agent, subsidiary undertaking, or any person otherwise performing services for or on behalf of the body) commits a “fraud offence” (defined in s 199(6) as an act constituting an offence listed in Schedule 13, or aiding, abetting, counselling, or procuring the commission of such an offence) intending to benefit the relevant body or any person to whom services are provided on the body’s behalf. The statutory defence is set out in s 199(4): it is a defence to prove that, at the time of the fraud offence, the body had in place such prevention procedures as it was reasonable in all the circumstances to expect, or that it was not reasonable in all the circumstances to expect any such procedures.

2 House of Commons Committee of Public Accounts, The MoD’s Tackling of Economic Crime and Misconduct, Third Report of Session 2026–27, HC 91, 29 May 2026. The underpinning National Audit Office report is: National Audit Office, MoD’s Management of Losses from Fraud and Other Economic Crime, Session 2024–26, HC 1596. https://assets.publishing.service.gov.uk/media/6a62426babcde513b38b6e0d/E03651559_-_Seventy-sixth_to_the_Seventy-ninth_reports_and_the_Second_and_Third_reports_from_Sessions_2024-26_and_2026-27_Access.pdf 

3 https://committees.parliament.uk/committee/127/public-accounts-committee/news/213810/mods-lack-of-focus-and-leadership-leaves-valuable-public-funds-exposed-to-fraud/

4 https://committees.parliament.uk/committee/127/public-accounts-committee/news/213810/mods-lack-of-focus-and-leadership-leaves-valuable-public-funds-exposed-to-fraud/

5 See also PAC Conclusion 4 (Treasury Minute Response, HC 91): “The department faces a particularly high risk of fraud in its procurement, but there is little evidence that its work to select and oversee contractors deters or penalises dishonest behaviour.” https://assets.publishing.service.gov.uk/media/6a62426babcde513b38b6e0d/E03651559_-_Seventy-sixth_to_the_Seventy-ninth_reports_and_the_Second_and_Third_reports_from_Sessions_2024-26_and_2026-27_Access.pdf

6 https://committees.parliament.uk/committee/127/public-accounts-committee/news/213810/mods-lack-of-focus-and-leadership-leaves-valuable-public-funds-exposed-to-fraud/ 

7 https://www.gov.uk/guidance/sfo-dpa-with-ultra-electronics-holdings-limited-formerly-plc.