The UK’s new Failure to Prevent Fraud (FTP) offence comes into force today (1st September), but many Scottish businesses remain underprepared to comply with their legal obligations, according to new research from Dentons.

Discussions with industry, coupled with research conducted by the law firm from February through to June 2025, show that many Scottish businesses have been slow to take the necessary steps to get ready for FTP compliance.

As of June this year, 30% of firms had still not appointed anyone to oversee FTP compliance, but even of the 70% that had taken measures, most had assigned the new FTP responsibilities to stretched compliance teams already in need of support.

Dentons found that three-quarters of businesses (78%)had not completed, or even begun, a fraud risk assessment, a key component of the ‘reasonable procedures’ described in government guidance.

Even as of August 2025, businesses across multiple sectors, including high-risk industries like financial services, real estate and construction, reported limited progress, citing competing demands on compliance functions as the main barrier.

In response, Dentons has launched an FTP Toolkit to help organisations assess and address gaps in their fraud prevention measures, allowing them to evaluate their current FTP readiness and identify gaps in policies, procedures, and controls to take targeted action.

“The introduction of FTP marks a significant shift in the corporate fraud landscape for Scottish businesses,” said Katy MacAskill, senior associate in Dentons’ Regulatory and Investigations team in Glasgow and co-developer of the firm’s new toolkit.

“It is a strict liability offence, meaning Scottish companies will not be able to rely on good intentions or retrospective justifications in place of robust, proportionate and bespoke fraud prevention measures. 

“Our data shows that there is still a lack of preparation across industry, which is understandable given today’s competing compliance workload. However, with the offence in force as of 1 September, there is now an urgent need for Scotland’s in-scope firms to ensure that they are sufficiently protected.”

FTP was introduced as part of the Economic Crime and Corporate Transparency Act 2023 (ECCTA) and creates a strict liability criminal offence for in-scope companies that fail to prevent fraud by individuals associated with them, where the fraud benefits the organisation or its customers.

According to the UK Government, the new rules are designed to hold large organisations to account if they profit from fraud, and build an ‘anti-fraud culture’ among UK businesses.

Recommended reading

• Compliance Now Biggest Threat to UK Financial Firms
• Only Half Of UK Businesses Report Full Data Privacy Compliance
• European Financial Services Are Behind on DORA Compliance

Under the new law, which was passed with cross-Parliament support, businesses can be held criminally liable where an employee, agent, subsidiary, or other ‘associated person’ commits a fraud intending to benefit the organisation. 

Examples include dishonest sales practices, hiding important information from consumers or investors, or dishonest practices in financial markets.

The only defence is to demonstrate that reasonable and proportionate fraud controls were in place when the offence occurred.

While in Scotland, prosecutions of the new offence will be undertaken by the Crown Office and Procurator Fiscal Service, the UK’s Serious Fraud Office has made clear it will prioritise enforcement of the new offence, with SFO director Nick Ephgrave stating earlier this year that the agency is “very, very keen” for an initial prosecution to prevent the new laws from “gathering dust”.