Failure to prevent fraud: due diligence on Italian suppliers and agents

Updated to 26/10/2026

In short: since 1 September 2025 a large UK organisation can be prosecuted if an employee, agent or other associated person commits fraud to benefit it, unless it had reasonable fraud prevention procedures. An Italian agent or intermediary acting for you can be an associated person. The Home Office guidance asks for proportionate, risk-based due diligence on such persons. A company check is one documented step in that file; it is not a defence by itself.

Part of the guide Checking an Italian company: a guide for UK businesses after Brexit. All guides: Guides.

What is the offence?

Section 199 of the Economic Crime and Corporate Transparency Act 2023 makes a relevant body that is a large organisation guilty of an offence if a person associated with it commits a fraud offence intending to benefit, directly or indirectly, the body, or a person to whom the associate provides services on behalf of the body. It is a defence to prove that the body had in place such prevention procedures as it was reasonable to expect, or that it was not reasonable to expect any. A body that was itself the intended victim of the fraud does not commit the offence under that limb (legislation.gov.uk: ECCTA 2023, section 199).

The Home Office guidance adds that it need not be shown that managers ordered or knew about the fraud, and records that the offence came into effect on 1 September 2025 (GOV.UK: Offence of failure to prevent fraud introduced by ECCTA).

Which organisations, and which counterparties?

The offence applies to large organisations only. Section 201 defines a large organisation as one meeting at least two of three conditions in the previous financial year: turnover above £36 million, a balance sheet total above £18 million, or more than 250 employees (legislation.gov.uk: ECCTA 2023, section 201). A smaller business is outside the offence itself, but if it supplies or acts for a large organisation it may find the large customer asks it for assurances.

A person is associated with the body if they are an employee, agent or subsidiary undertaking of the body, or otherwise perform services for or on behalf of it. Whether someone performs services for or on behalf of the body is decided by all the relevant circumstances, not only by the label on the relationship (section 199(7) and (9)). In an Italian context, the people to think about are agents, distributors acting for you, local intermediaries, subcontractors on a project and consultants, rather than a company that simply sells you goods in its own name.

Does the offence reach fraud committed in Italy?

The Home Office guidance deals with territory. It says the offence also applies to bodies formed outside the UK that have a UK nexus, and that a UK nexus exists where an act that was part of the underlying fraud took place in the UK, or the gain or loss occurred in the UK. It adds that the offence will not apply to UK organisations whose overseas employees or subsidiaries commit fraud abroad with no UK nexus. A fraud by an Italian agent that targets victims in the UK is the kind of case that carries the risk.

What does the guidance say about due diligence?

The guidance sets out principles for reasonable procedures. On due diligence, it says an organisation should apply proportionate, risk-based due diligence procedures to people who perform or will perform services for or on behalf of it, including new partners. Examples of best practice it gives include third-party risk management and screening tools, internet searches, checking trading history or professional or regulated status where relevant, vetting checks, and reviewing contracts with service providers and agents so that they contain compliance obligations and a right to terminate on breach.

It also says that existing due diligence designed for another risk will not necessarily be an adequate response to the risk of fraud, and that where a supply chain involves several entities, an organisation will probably control only its relationship with its direct counterparty. In that case it may use risk-based due diligence and fraud prevention terms with that counterparty and ask it to take the same approach with the next party in the chain. The guidance also stresses that it will rarely be reasonable not to have even carried out a risk assessment, and that decisions not to adopt a procedure should be documented.

What a check on the Italian side can contribute

Facts you can establish before appointing or paying an Italian agent or intermediary
Question	Where the answer comes from	Veryfy product
Is the counterparty a real, identifiable company, and who owns and runs it?	Italian business register data, with source and date	Verification, €19
Is it linked to other companies, and who controls it?	Corporate links and ownership chain	Decision, €49
Is the agent an individual or a sole trader?	The individual behind the business: protests, proceedings, positions and shareholdings	Person Verification, €29, or Extended Person Verification, €49
Are the email, website and bank account consistent with the company?	Anti-scam check on VAT number, email domain, website and IBAN	Free with every company product

The Person Verification is offered only for declared purposes, including a professional or contractual relationship in progress or about to be established with a natural person, and never for personal curiosity. The reports are in Italian, from Italian official sources, and company names and offices keep their original wording.

What a check cannot do

A company check does not show intent or predict fraud, does not screen anyone against sanctions lists, and does not satisfy the offence's defence by itself. The defence turns on whether your overall procedures were reasonable, which a court decides on the facts. What the check gives you is a dated, sourced record that you identified the counterparty and looked at its ownership and credit signals before you committed. Read it together with the contract terms the guidance recommends, and with the owner question in our guide to UK sanctions and an Italian company.

Next steps

Map the Italian counterparties that act for you, not only those that sell to you.
Rank them by risk: the money they handle, their contact with your customers or third parties, and how little supervision you have over them.
Run the matching check and file the report with the date and the person who reviewed it.
Put compliance and termination terms in the contract, and repeat the check at renewal. See Appointing an Italian commercial agent for the Italian-law consequences of ending an agency.

Frequently asked questions

When did the failure to prevent fraud offence start?

The Home Office guidance records that the offence came into effect on 1 September 2025. Section 199 of the Economic Crime and Corporate Transparency Act 2023 was in force from that date.

Is an Italian agent an associated person?

It can be. Section 199 says a person is associated with the body if they are an employee, agent or subsidiary undertaking, or otherwise perform services for or on behalf of it, judged on all the relevant circumstances.

Does my small business fall under the offence?

Only large organisations do: two of three conditions of more than £36 million turnover, more than £18 million balance sheet total or more than 250 employees. A small supplier may still be asked for assurances by a large customer.

Does a Veryfy report protect me from liability?

No. It gives you a dated, sourced record of who the Italian counterparty is and of its ownership and credit signals. The statutory defence depends on whether your procedures overall were reasonable.

Sources

Official sources opened and read on 2026-10-26.

General information, not legal advice. Sources verified on 2026-10-26.