Transaction risk intelligence
Automated supplier statement reconciliation
Supplier risk intelligence
Managed AP recovery audit
Supplier file performance review
Forensic risk analysis
Consulting and bespoke reporting
TL;DR - UK compliance in 2026 at a glance
Two major regulatory shifts now shape UK fraud and sanctions compliance:
- ECCTA’s “failure to prevent fraud” offence came into force on 1 September 2025, making large organisations criminally liable – with unlimited fines – if an associated person commits fraud to benefit the company and “reasonable procedures” were not in place.
- OFSI’s overhauled sanctions enforcement framework took effect on 9 February 2026, doubling the maximum civil penalty to the greater of £2 million or 100% of the breach value, introducing a new Settlement Scheme, and offering combined discounts of up to 70% for firms that self-disclose and cooperate.
Only 28% of UK directors say they feel prepared for ECCTA. The first prosecution under the failure to prevent fraud offence is now a matter of when, not if – the Serious Fraud Office has already published guidance that policies on paper will not be enough.
If your finance team processes invoices, onboards suppliers, or makes international payments, these regulations apply to you. This guide covers exactly what’s changed, who’s affected, and what “reasonable procedures” actually requires.
What are the main UK fraud and sanctions compliance laws in 2026?
UK businesses in 2026 must comply with four interlocking regulatory regimes:
- The Economic Crime and Corporate Transparency Act 2023 (ECCTA) – the “failure to prevent fraud” offence (live from 1 September 2025)
- The Sanctions and Anti-Money Laundering Act 2018 (SAMLA) and OFSI’s updated enforcement framework (live from 9 February 2026)
- The Procurement Act 2023 – tightened supplier due diligence in public sector procurement
- The Fraud Act 2006 – the foundational offence framework, still live, now amplified by ECCTA
Taken together, these regulations treat fraud prevention and sanctions compliance as a single, continuous obligation – not a one-off policy document.
ECCTA "failure to prevent fraud": what it means and who it applies to
What is the failure to prevent fraud offence?
Under section 199 of the Economic Crime and Corporate Transparency Act 2023, a “large organisation” is criminally liable if an “associated person” (an employee, agent, subsidiary or similar) commits a fraud offence intending to benefit the organisation – unless the organisation can prove it had reasonable fraud prevention procedures in place at the time.
The offence came into force on 1 September 2025. Penalties are uncapped – an organisation found guilty faces an unlimited fine, alongside serious reputational damage and potential director disqualification.
Crucially, the organisation does not need to receive any benefit for the offence to apply. The fraud offence is complete before any gain is received.
Which organisations are covered by ECCTA?
ECCTA’s failure to prevent fraud offence applies to “large organisations” meeting at least two of the following three criteria:
Threshold | Trigger |
|---|---|
Employees | More than 250 |
Turnover | More than £36 million |
Total assets | More than £18 million |
This captures the majority of UK mid-market and enterprise businesses, including most NHS trusts, local councils, universities, and larger charities.
What are ECCTA’s six principles of “reasonable procedures”?
The Home Office’s ECCTA guidance sets out six principles an organisation must evidence to defend itself if fraud occurs:
- Top-level commitment – visible board and executive ownership of fraud prevention.
- Risk assessment – a dynamic, documented assessment of fraud risks across the organisation and its associated persons.
- Proportionate risk-based prevention procedures – controls that reflect the actual likelihood and impact of each risk.
- Due diligence – fraud-specific checks on employees, suppliers, agents and third parties, not generic vetting.
- Communication and training – role-specific training, not an annual e-learning tickbox.
- Monitoring and review – continuous improvement based on incidents, whistleblowing, audits and sector developments.
The Serious Fraud Office has made clear that a written policy without evidence of ongoing monitoring will not satisfy the defence.
OFSI's 2026 sanctions enforcement reforms: what's changed
The Office of Financial Sanctions Implementation (OFSI) published its updated Financial Sanctions Enforcement and Monetary Penalties Guidance on 9 February 2026. These are the most significant reforms to UK sanctions enforcement since OFSI was established in 2016.
The headline changes
Maximum penalties are doubling. Subject to final legislation, the statutory cap will rise from the greater of £1 million or 50% of the breach value to the greater of £2 million or 100% of the breach value.
Fixed penalties for minor breaches. OFSI can now issue fixed penalties of £5,000 or £10,000 for information, reporting and licensing offences – including late reports, failure to respond to a Request for Information, and low-value licence breaches up to £10,000.
New Settlement Scheme. Firms that settle within 30 business days and waive their right to ministerial review or judicial appeal qualify for a 20% penalty discount.
New Early Account Scheme (EAS). Firms can self-investigate and submit a full account of a breach within six months in exchange for a further penalty discount.
Combined discounts of up to 70%. Firms that voluntarily disclose, participate in the EAS, and settle early can access stacked discounts totalling 70% off the base penalty.
Reduced voluntary disclosure discount. The baseline voluntary disclosure discount has been cut from up to 50% to a maximum of 30%, and now requires full cooperation – not just self-reporting – to qualify.
Why OFSI is getting tougher
OFSI has 240 active cases under investigation as of April 2025, up from 172 in April 2023. In 2024–25, it took 57 enforcement actions, with approximately £500,000 in penalties issued to small and large firms, and £37 billion of assets reported as frozen – up from £24.4 billion the year prior.
Recent high-profile penalties include:
- A £160,000 fine against a UK financial institution in January 2026 for processing 24 payments to a designated individual’s account – the breach stemmed from transliteration name-matching failures and inadequate PEP escalation.
- The UK’s first criminal convictions for breaching Russia-related financial sanctions, secured by the NCA in 2025.
- A disclosure notice against Vanquis Bank in September 2025 for failing to restrict a designated person’s account for eight days.
The message from OFSI is explicit: name-matching against a static list is no longer sufficient. Regulators now expect continuous, risk-based screening with documented escalation processes.
What's the penalty for a sanctions breach in the UK in 2026?
Breach type | Penalty |
|---|---|
Reporting / information / minor licence breaches | £5,000 or £10,000 fixed penalty |
Standard civil sanctions breach | Up to £2 million or 100% of breach value (whichever is greater) |
Criminal sanctions breach | Up to 7 years imprisonment and unlimited fine |
ECCTA failure to prevent fraud | Unlimited fine |
Disclosure without penalty | Available where voluntary disclosure + EAS + settlement combine to 70% discount |
Sanctions enforcement is moving from one-off fines to a structured, tiered regime designed to make penalties more predictable – and more frequent.
How fraud and sanctions compliance connect in 2026
Fraud controls and sanctions screening are no longer separate workstreams. Both regimes now demand:
- Continuous monitoring of suppliers, employees and transactions – not point-in-time checks
- Documented due diligence at onboarding and throughout the relationship
- An auditable trail showing how controls actually operate, not just how they’re written down
- Evidence of action when a red flag is raised
- Proportionate, risk-based procedures – off-the-shelf compliance will not suffice
An organisation with strong ECCTA-aligned fraud prevention procedures is typically 80% of the way to meeting OFSI’s sanctions expectations, because both depend on the same underlying data – a clean, continuously monitored supplier master file.
Three things your finance team should do this quarter
1. Map your “associated persons” and score their fraud risk
List every employee, agent, subsidiary and third party who could commit fraud “intending to benefit” your organisation. Score each on likelihood and impact. This single document is the foundation of the ECCTA reasonable procedures defence – and it is the first thing the SFO will ask for.
2. Move from periodic to continuous screening
If you screen suppliers against sanctions lists at onboarding and quarterly thereafter, you are out of step with OFSI’s 2026 expectations. Designated persons lists change daily. A supplier clean at onboarding can become designated the following week. Continuous, automated screening is now the regulatory baseline.
3. Audit your data, not your policies
Most organisations have the right policies. The gap is in the data underneath them – duplicate suppliers, dormant vendors, bank detail changes no one verified, employee and supplier bank accounts that match. These are the gaps regulators and fraudsters both exploit. Fix the data, and the policy does its job.
How FISCAL Technologies supports UK payments compliance in 2026
FISCAL’s AI-powered platform delivers the continuous monitoring and documented controls that both ECCTA and OFSI now require:
- Continuous sanctions screening – every supplier, every day, against a full global sanctions database, including OFSI’s UK consolidated list, OFAC, EU, UN and UNODC lists.
- Continuous fraud detection – forensic-level checks on every transaction and every supplier, flagging duplicates, ghost vendors, employee–supplier account matches, and unusual payment behaviours before funds leave the business.
- Immutable audit trail – every approval, exception and correction logged and time-stamped, ready for SFO or OFSI review.
- Supplier risk intelligence – credit monitoring, adverse media, ESG flags and PEP checks integrated into a single supplier profile.
AI-driven pattern recognition – the tools needed to meet OFSI’s explicit expectation that firms move beyond static name-matching.
Protecting UK and US organisations since 2003, FISCAL works with 40+ healthcare organisations, local government bodies across the UK, and over 100 private-sector businesses.
Frequently asked questions about UK fraud and sanctions compliance
When did ECCTA's failure to prevent fraud offence come into force?
The ECCTA failure to prevent fraud offence came into force on 1 September 2025, 12 months after the Home Office published its statutory guidance in November 2024. Large organisations have been criminally liable since that date.
Who qualifies as a "large organisation" under ECCTA?
A “large organisation” meets at least two of the following in the financial year preceding the offence: more than 250 employees, more than £36 million in turnover, or more than £18 million in total assets. Parent companies are assessed on a group-wide basis.
What are "reasonable fraud prevention procedures"?
Under Home Office guidance, reasonable procedures must reflect six principles: top-level commitment, dynamic risk assessment, proportionate prevention procedures, fraud-specific due diligence, communication and training, and continuous monitoring. A written policy alone is not sufficient – organisations must evidence the controls operating in practice.
What is the maximum OFSI sanctions penalty in 2026?
Following OFSI’s February 2026 reforms, the maximum civil monetary penalty is expected to double to the greater of £2 million or 100% of the value of the breach once the required legislation passes. Fixed penalties of £5,000 or £10,000 now apply to lower-level reporting and licensing breaches.
Can I still get a discount for voluntarily disclosing a sanctions breach?
Yes, but the structure has changed. The previous voluntary disclosure discount of up to 50% has been replaced by a new Voluntary Disclosure and Co-operation discount capped at 30%. However, firms that combine voluntary disclosure, the new Early Account Scheme, and the Settlement Scheme can access combined discounts of up to 70%.
What is the difference between OFSI and HMRC sanctions enforcement?
OFSI (Office of Financial Sanctions Implementation) enforces financial sanctions – asset freezes, payment restrictions, and prohibitions on making funds available to designated persons. HMRC and the Office of Trade Sanctions Implementation (OTSI) enforce trade sanctions – import, export and goods-related restrictions. Most UK businesses must comply with both regimes, but the enforcement bodies, penalties and processes are separate.
Does ECCTA apply to public sector bodies and charities?
Yes, if they meet the “large organisation” thresholds. NHS trusts, larger local authorities, and major charities are all potentially in scope. The Home Office has made clear the offence applies to any body corporate or partnership, not only private companies.
What happens if my company breaches sanctions unintentionally?
Unintentional breaches are still enforceable. OFSI considers intent, knowledge, recklessness and the quality of your compliance systems when calculating the penalty – but lack of intent is not a defence. This is why continuous screening, documented escalation, and evidence of “reasonable and proportionate” controls matter so much under the 2026 framework.
Do I need whistleblower protections for sanctions breaches?
Yes. The Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2025 came into force in June 2025, extending whistleblower protections to cover reports of financial, transport and certain trade sanctions breaches. Organisations should ensure their whistleblowing policies explicitly cover sanctions matters.
How often should suppliers be screened against sanctions lists?
OFSI’s 2026 guidance makes the expectation clear: continuously. Designated persons lists are updated frequently and a supplier clean at onboarding can become designated within days. Point-in-time screening at onboarding with quarterly refreshes is no longer considered adequate for organisations with UK nexus exposure.
Is there a whistleblower reward scheme in the UK?
Not for sanctions or fraud specifically. The UK expanded whistleblower protections in June 2025 but has not introduced a reward scheme. The US FinCEN programme (proposed March 2026) will pay whistleblowers 10–30% of collected penalties for tips on AML and sanctions violations – a model UK policy observers expect may influence future UK proposals.
Sources
- Economic Crime and Corporate Transparency Act 2023 (ECCTA)
- Home Office, Guidance to organisations on the offence of failure to prevent fraud (November 2024)
- Serious Fraud Office, Guidance on failure to prevent fraud (2025)
- HM Treasury / OFSI, Financial Sanctions Enforcement and Monetary Penalties Guidance (9 February 2026)
- OFSI, Annual Review 2024–25: Effective Sanctions (April 2026)
- UK Government, Cross-Government Review of Sanctions Implementation and Enforcement (May 2025)
- Sanctions and Anti-Money Laundering Act 2018
- Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2025
Last updated: September 2026
