In brief. The Economic Crime and Corporate Transparency Act 2023 (ECCTA) is the most significant overhaul of UK corporate criminal liability in a generation. It rewrites Companies House powers, expands the identification doctrine for corporate criminal liability and introduces a new failure-to-prevent fraud offence. Any business operating in or through the UK — including foreign groups with UK subsidiaries — falls within its reach.

ILA is an Italian criminal-defence firm. This guide outlines UK/US rules for reference; we assist English-speaking clients whose case has an Italian dimension — extradition to or from Italy, Interpol Red Notices and cross-border proceedings — alongside local counsel abroad.

In brief

  • ECCTA 2023 received Royal Assent on 26 October 2023; provisions are entering into force in phases, and the new failure-to-prevent-fraud offence came into force on 1 September 2025.
  • Companies House becomes an active gatekeeper: identity verification for directors and PSCs (mandatory since 18 November 2025, with a 12-month transition for existing officers), power to query and reject filings, ability to strike off non-compliant entities.
  • A new failure to prevent fraud offence makes large organisations criminally liable when an “associated person” commits a specified fraud for the benefit of the organisation.
  • The identification principle for corporate criminal liability is widened to include senior managers, not only the directing mind and will (s. 196, in force since 26 December 2023 for the economic crimes listed in Schedule 12).
  • Enhanced powers for the Serious Fraud Office (SFO), the National Crime Agency (NCA) and law enforcement on cryptoassets and information sharing.

What is the Economic Crime and Corporate Transparency Act 2023?

The Economic Crime and Corporate Transparency Act 2023 is a UK statute that reforms the way companies are registered, monitored and held criminally responsible for economic crime. It combines a corporate transparency package — centred on Companies House — with a substantive expansion of corporate criminal liability, including a new failure to prevent fraud offence and a widened identification principle for attributing the conduct of senior individuals to the company.

The Act is the second leg of the UK government’s response to large-scale concerns over the misuse of UK corporate structures for money laundering, sanctions evasion and fraud, following the Economic Crime (Transparency and Enforcement) Act 2022 that introduced the Register of Overseas Entities.

Why ECCTA matters: the strategic context

For decades, UK corporate criminal law leaned on the identification doctrine in Tesco Supermarkets v Nattrass [1972]: a company was liable only when the offence was committed by someone identifiable as its “directing mind and will”. Large, decentralised groups were structurally hard to prosecute. ECCTA changes the architecture, on three fronts at once:

  1. Front door — who can incorporate and remain on the register (Companies House reform).
  2. Substantive crime — a new failure-to-prevent fraud offence.
  3. Attribution — a broader rule for ascribing senior conduct to the company.

This is no longer simply a compliance update. For boards, it is a governance reset.

Companies House: from passive registry to active gatekeeper

The Act gives Companies House powers that transform its role:

  • Identity verification: directors and persons with significant control (PSCs) must verify their identity through an Authorised Corporate Service Provider (ACSP) or directly with Companies House — mandatory since 18 November 2025 for new appointments, with existing directors confirming verification at their next confirmation statement during a 12-month transition; verification of those filing on behalf of companies is being introduced at a later stage.
  • Query and reject: power to refuse filings that appear inconsistent, fraudulent or otherwise improper.
  • Annotation and removal: power to annotate the register, share data and strike off entities.
  • Limits on corporate directors: corporate directors will be permitted only in narrow circumstances, with their own director being a verified natural person.
  • Suppression of personal information: enhanced rights for individuals to suppress historical residential addresses and signatures.

Practical consequence: foreign groups using UK private limited companies as holding or trading vehicles must map their PSC chain end-to-end and make sure every director and PSC completes verification by their individual due date: failure to verify is an offence and blocks filings.

The failure to prevent fraud offence

The centrepiece for in-house counsel is the new offence:

  • Triggering principle: a large organisation is criminally liable when a person associated with it (employee, agent, subsidiary) commits a specified fraud offence intending to benefit the organisation or a person to whom services are provided.
  • Large organisation threshold: the offence applies to organisations meeting at least two of three thresholds — turnover above GBP 36 million, balance sheet total above GBP 18 million, or more than 250 employees (in the financial year preceding the offence). Statutory guidance was published by the Home Office on 6 November 2024; the sanction is an unlimited fine.
  • Defence: it is a defence to show that the organisation had reasonable fraud-prevention procedures in place or that it was not reasonable in the circumstances to expect such procedures.

The structure mirrors the failure-to-prevent regimes for bribery (Bribery Act 2010, s. 7) and tax evasion (Criminal Finances Act 2017, ss. 45-46). The fraud-prevention procedures expected from a board now cover risk assessment, due diligence on third parties, communication and training, monitoring and review and a clear top-level commitment.

The widened identification principle

ECCTA codifies and broadens corporate attribution. Section 196, in force since 26 December 2023, expressly provides that, for the economic crimes listed in Schedule 12 (including fraud, false accounting, bribery, money laundering and sanctions offences), the conduct of a senior manager acting within the actual or apparent scope of their authority can be attributed to the organisation. “Senior manager” is defined functionally — those who play a significant role in decision-making about the whole or a substantial part of the organisation’s activities or in actually managing them.

This breaks with the old single “directing mind” test and exposes companies to liability for the acts of:

  • divisional heads;
  • regional managers with autonomous authority;
  • compliance and finance leads with operational discretion.

What the Act means for boards and senior managers

The legal reform is one thing; the operational consequences are another. For cross-border groups with UK exposure, the priorities are clear.

1. Map all UK touchpoints

PSC chains, branch offices, contracts performed in the UK, payment flows. Anything that exposes the group to UK jurisdiction is, after ECCTA, a regulatory question — not only a tax or commercial one.

2. Refresh the fraud-prevention framework

The Bribery Act 2010 procedures are the natural starting point but they are not enough: fraud risk has its own typology (false accounting, false statements, fraud by abuse of position) and requires its own controls.

3. Train senior managers as a population

Identification reform raises the criminal-law relevance of a much larger group of executives. Their training, decision logs and escalation paths become evidential material in any future investigation.

4. Recalibrate joint venture and agent contracts

Indemnities, audit rights and termination triggers for fraud-prevention failures by counterparties are no longer “nice to have”: they form part of the reasonable procedures defence.

Cross-border implications

For companies based in continental Europe, ECCTA changes the cost-benefit of using a UK corporate vehicle. Two patterns are emerging:

  • EU-headquartered groups with UK subsidiaries must extend group fraud-risk assessments to the UK perimeter, with documented escalation to the parent’s compliance function;
  • Latin American businesses using UK SPVs must reconsider beneficial-ownership and identity-verification flows in light of stricter Companies House controls.

For Italian groups, the UK regime must be read alongside corporate liability under D.Lgs. 231/2001: ILA assists on the Italian side and on cross-border coordination, working with UK counsel on English-law questions. See also white collar crime, the conceptual entry on white collar crime definition and, for AML aspects, the money laundering guide.

Real-world scenarios

(Illustrative examples of typical situations: they do not refer to specific proceedings or to clients of the firm.)

Case 1 — Failure to prevent fraud in a procurement chain

A UK subsidiary of a continental engineering group wins a public contract. A regional sales manager arranges, with a third-party agent, for inflated invoices to be issued and partially rebated to a key customer’s officer. After a whistleblower report, the SFO opens an investigation and considers a corporate charge under the failure-to-prevent fraud offence. The defence work centres on whether the group’s fraud-prevention procedures were reasonable in the circumstances, on the documentary trail of training and monitoring, and on prompt self-reporting and remediation.

Case 2 — Companies House strike-off of a UK SPV

A Latin American family group uses a UK private limited company as a holding vehicle for cross-border investments. With the new identity-verification regime, the nominee director is unable to verify and the company is queried, then struck off. Restoration to the register may be sought through the courts, but reputational and tax consequences can be significant. Such a matter requires coordination between UK solicitors, restoration counsel and the family’s onshore advisors.

Frequently asked questions

When did the failure to prevent fraud offence come into force? On 1 September 2025. The Home Office published the statutory guidance on reasonable fraud prevention procedures on 6 November 2024. Conduct from that date onwards is covered, so procedures should already be in place and documented.

Does the Act apply to non-UK companies? It can. Companies House verification applies to UK-registered entities; the failure-to-prevent fraud offence applies to large organisations wherever incorporated when the relevant conduct has a UK nexus.

What is the maximum penalty? For the failure-to-prevent fraud offence, the maximum financial penalty is uncapped on conviction on indictment, and a conviction triggers significant collateral consequences (debarment, regulatory action, reputational harm).

Does ECCTA replace the Bribery Act 2010? No. The Bribery Act remains in force. ECCTA complements it with a fraud-specific failure-to-prevent offence and updates corporate attribution rules.

What should a board do first? Commission a fraud risk assessment focused on the UK perimeter, map senior managers under the new identification principle, and align contractual rights with associated persons.

When to contact the firm

If your group has an Italian parent or Italian operations and UK exposure, ILA can assist on the Italian and cross-border profile — alignment of fraud-prevention procedures with the 231 model, internal investigations in Italy, coordination of parallel proceedings — working alongside UK counsel on English-law matters. Contact the firm.

Last updated: October 2026. References: Economic Crime and Corporate Transparency Act 2023 (ss. 196 and 199); Bribery Act 2010, s. 7; Criminal Finances Act 2017, ss. 45-46; Economic Crime (Transparency and Enforcement) Act 2022.