Know your Compliance Weaknesses - It's the Law, and it Helps you Serve your Customers Better

Most business leaders will admit, in confidence and away from an audience and their investors, that their business isn't perfect. Faults and compromises always get in the way of true best practice, and it's easy enough to overlook the detail as long as the big picture is suitably alluring. UK law no longer allows that comfort: knowing where the weaknesses lie is now a legal imperative. You can't be purely results-focused - you have to sweat the process too, and be able to prove you did.

Knowing your weaknesses is now a legal duty under the ECCTA

The legislation is the Economic Crime and Corporate Transparency Act (ECCTA), and its most significant cultural change is that business leaders must actively monitor their organisation and take demonstrable steps to prevent fraud. Previously, leadership could plausibly claim ignorance when law-breaking came to light, which made it almost advantageous to stay hazy on operational detail. That era ended on 1 September 2025, when the failure to prevent fraud offence came into force: a large organisation can now be held criminally liable for fraud committed by employees, agents or subsidiaries that benefits it - with unlimited fines - even where directors knew nothing. The obligation stretches worldwide, into subsidiaries and out through the supply chain.

The spirit of this is much closer to US enforcement culture, where regulators have long pursued both businesses and individual executives. Uber's former security chief was criminally convicted over the cover-up of the company's 2016 data breach, and the company separately paid $148m to settle related claims - the point being that "we didn't disclose, and hoped" is treated as the offence, not the mitigation. That regulatory posture has now crossed the water, and companies operating in the UK are living with it.

The offence is wide, and the defence is evidence

The scope is deliberately wide. On a strict reading, an over-enthusiastic salesperson materially over-promising to close a deal could qualify: it's fraudulent misrepresentation, it benefits the business, and that meets the test. The Home Office guidance on reasonable prevention procedures sets out the expected shape - risk assessment, proportionate procedures, top-level commitment, due diligence, communication and training, monitoring and review - and the common thread through all six is evidence. A procedure you can't demonstrate is, for legal purposes, a procedure you don't have.

So the practical answer is a deep, current understanding of your own operations: where the weak points are, what controls sit on them, and a record of both. This is where a single, structured system earns its keep. When your documents, approvals, client communications and decisions flow through one place - with an audit trail recording who did what, when - the "active fraud prevention" defence stops being a binder assembled in a panic and becomes a by-product of how the business already works. You might find a few things you'd previously have preferred not to know about. Better you find them than the Serious Fraud Office does.

Provable control of your records is a competitive advantage

There's a commercial upside hiding in the burden, too. "Businesses are starting to be a bit more open about disclosing and declaring what they do - not just cyber security, but general practices," says Luke Kiely, CISO at Workiro. "I think that's a really positive change. There's a lot of value in showing how competent and robust your information security programmes are - for businesses, for society, and for investors."

Robbie Hadfield, Solutions Director at business spend platform Payhawk, agrees: "It's a competitive advantage thing, transparency. The impact of a cyber attack can have a huge effect on a brand - but it could also have the opposite effect if you show that you invest in these things around sustainability and integrity. Organisations that perform better on these measures are going to be the ones that deliver long-term shareholder value."

For accountants, this cuts both ways: it's the conversation your larger clients need to have, and it's the standard your own practice is now held to - the ECCTA's ACSP regime makes firms that file for clients keepers of seven years of verification evidence, where the sanction for failure is public. Conspicuous, provable control of your records has quietly become part of the product a professional firm sells.

You can hear more from Luke and Robbie about the rules, requirements and potential upsides in our free webinar, Trading in the UK? You can't ignore the ECCTA. And to see what a monitored, evidence-by-default operation looks like on a real client file, book a demo.