Dan Ostergaard · Co-founder, Trusty · Former Novartis Global Head of Compliance · Founder of PolicyStore
Why “reasonable procedures” now means demonstrable training, active implementation, and a working whistleblowing channel, and why the rest of the regulatory world is moving the same way
For years, fraud prevention could be satisfied, or at least defended, with a binder. A policy existed, it was signed off, it sat on the intranet. Whether anyone read it, understood it, or acted on it was a separate question, and rarely the one regulators asked. That era is over.
Since 1 September 2025, the Failure to Prevent Fraud offence under section 199 of the UK’s Economic Crime and Corporate Transparency Act 2023 has been live against large organisations. The mechanics are deliberately broad: an organisation can be held criminally liable, with an unlimited fine, where an associated person (an employee, agent, subsidiary, or contractor) commits a fraud intended to benefit the organisation. The only statutory defence is that the organisation had reasonable procedures in place to prevent that fraud.
And the Serious Fraud Office has been unambiguous about what “reasonable procedures” does not mean.
The SFO's evidence test
The headline message from enforcement bodies is simple: a written policy without evidence that it is actually operating will not satisfy the defence. A policy that no one is trained on, that isn’t monitored, and that produces no record of its own functioning is, for defence purposes, close to worthless. What protects an organisation is not the existence of a procedure but the evidence that the procedure lives: that people were trained, that the training was understood, that controls are monitored on an ongoing basis, and that concerns can be raised and are acted upon.
This reframes compliance around three demonstrable elements:
- Evidence of employee training. Not “we have a code of conduct,” but a verifiable record of who was trained, on what, when, and whether they demonstrated understanding. Training that cannot be evidenced is, in a courtroom, training that did not happen.
- Implementation and ongoing monitoring. Reasonable procedures are not a launch event; they are a continuous control. The defence rests on showing that controls were implemented, owned by named individuals, and monitored over time, with a documented trail of risk assessments, reviews, and remediation.
- A functioning whistleblowing channel. The first full year of the offence has hardened the expectation that whistleblowing, fraud prevention training, and effective oversight are essential rather than optional. A channel that exists on paper but generates no reports, no triage, and no action taken is itself a red flag.
The common thread is the same one that separates real internal control from ticking boxes: a control only matters if it can be shown to work.
This is not a UK quirk: It's the global direction of travel
The temptation is to file Failure to Prevent Fraud under “UK problem.” That would be a mistake. Across jurisdictions and sectors, regulators are converging on the same principle: demonstrated effectiveness over documented intent.
- United Kingdom, Fraud Strategy 2026 to 2029. On 9 March 2026 the UK government launched a new national Fraud Strategy, committing over £250 million across three years and a “Disrupt, Safeguard, Respond” model. It sits directly on top of the Failure to Prevent Fraud offence and reinforces the expectation that organisations take a proactive, evidenced approach.
- Switzerland, FINMA’s AML overhaul. In May 2026 FINMA opened a consultation on a partial revision of its AML Ordinance, with the revised framework expected to take effect on 1 January 2027. Among the changes: senior management facing increased accountability for the effectiveness of internal controls, not merely their existence. The regulatory direction mirrors a broader shift away from supervising processes towards supervising outcomes, where the question is whether a programme actually detects and prevents misconduct.
- United States, record DOJ recoveries and liability for associated persons. In January 2026 the Department of Justice reported that False Claims Act settlements and judgments exceeded $6.8 billion for fiscal year 2025, the highest single year total in the statute’s history, and roughly a 120% increase over the prior year. Health care and life sciences drove the overwhelming majority. Notably, enforcement increasingly reaches third party distributors and sales agents: independent contractor status does not insulate a representative from liability, and the manufacturer they represent can be pulled in too, the same upstream accountability logic as the UK offence.
- EU, tightening medtech oversight. Even as the European Commission proposes to streamline the Medical Devices Regulation, hard obligations are landing: EUDAMED became mandatory in May 2026 and incident reporting requirements have been upgraded. Industry voices have warned that any reduction in audit frequency or documentation sampling risks reopening the very gaps where misconduct goes undetected.
The preparedness gap. A February 2026 survey of internal audit leaders found that while fraud enabled by AI is widely recognised as a growing risk, only about four in ten believed their functions were adequately prepared to detect or respond to it.
Put together, the picture is consistent. Whether the regulator is the SFO, FINMA, the DOJ, or the European Commission, the assurance bar is rising, and “we had a policy” is no longer the answer to the question being asked.
The implementation gap, and how to close it
Here is the practical problem. Most organisations already have policies. What they often lack is the connective tissue that turns a policy into defensible evidence: a single, auditable record that links each procedure to the people trained on it, the controls implementing it, and the concerns raised against it.
That gap is exactly where a dedicated compliance platform earns its place.
Trusty Compliance App is designed around the three elements the Failure to Prevent Fraud defence now demands:
- Evidence of training, on demand. Trusty Compliance App maintains a verifiable record of policy distribution, attestation, and training completion: who was trained, on what version of the policy, when, and with what result. When a regulator or auditor asks for proof, the answer is a report, not a scramble.
- Implementation you can monitor. Rather than treating compliance as an annual event, Trusty Compliance App supports ongoing implementation: assigning named control owners, tracking attestations and reviews, and surfacing where procedures are lapsing before they become a finding. It turns “reasonable procedures” from a claim into a continuously evidenced state.
- Whistleblowing built in. A confidential reporting channel sits inside the same platform, with structured triage and a documented trail of how each report is handled, so the existence of the channel is matched by evidence that reports are received, assessed, and acted upon.
The strategic point is not that software substitutes for culture. It doesn’t. But in a world where the defence turns on evidence, the organisations that can produce that evidence (training records, monitoring trails, whistleblowing logs, all in one place) are the ones that will withstand scrutiny. Everyone else will be explaining, after the fact, why their carefully written policy didn’t prevent the thing it was written to prevent.
The offence is live. The strategy is funded. The global direction is set. The only open question is whether your procedures can prove themselves.
The SFO's evidence test
The SFO evidence test demands three things: documented training, governed policies, and a functioning whistleblowing channel. Trusty brings all three into one platform, audit-ready, live in under 5 minutes.
- Evidenced training, on demand. Trusty Compliance App tracks who completed which policy version, when, and with what result. When the SFO asks, you produce a timestamped report.
- Policies your team actually follows. Trusty Compliance App turns anti-fraud policies into acknowledged, timestamped records. Every employee sign-off becomes part of your audit trail.
- Whistleblowing built in. Trusty Whistleblowing is confidential, anonymous-capable, GDPR-compliant, and mapped to the EU Whistleblower Directive. Live in minutes.
Trusted by 1,000+ companies across Europe. From €49/month, no setup fees, no IT required. Trusty Whistleblowing → Compliance App → Trusty Compliance App → All pricing →
Sources
- UK Government, New failure to prevent fraud guidance published: www.gov.uk/government/news/new-failure-to-prevent-fraud-guidance-published
- Trowers & Hamlins, Fraud: what lies ahead for 2026
- Bird & Bird, UK Fraud Strategy 2026-2029
- Fiscaltec, UK Fraud & Sanctions Compliance 2026: ECCTA, OFSI
- FINMA, Consultation on partial revision of the AMLO: www.finma.ch/en/news/2026/05/20260512-mm-anh-gwv-finma/
- GRC Report, FINMA Proposes AML Overhaul
- Epstein Becker Green, False Claims Act Recoveries Reach Historic Highs in FY 2025
- MedDeviceGuide, DOJ Medical Device Fraud Enforcement 2026
- MedTech Europe, Revision proposal for the medical devices rules
- The IIA / AuditBoard, Internal Audit and AI Enabled Fraud
Frequently asked questions
The offence applies to "large organisations" as defined by the Companies Act 2006 (two of three: £36m+ turnover, £18m+ balance sheet, 250+ employees). SMEs below this threshold are currently outside direct scope, but the same evidence-based expectations are increasingly reflected across sector regulators.
The SFO expects six elements: proportionate procedures, top-level commitment, risk assessment, due diligence on associated persons, communication and training, and monitoring and review. Every element must be evidenced, a written policy without a functioning trail is not enough.
Yes. Enforcement signals from the first year of the offence make clear that a functioning internal reporting channel is expected as part of reasonable procedures. A channel that exists on paper but generates no documented reports or triage actions is itself a risk indicator.
A dedicated platform like Trusty can be configured and live in under 5 minutes, with no IT involvement. This includes an anonymous reporting channel, case management dashboard, GDPR-compliant data handling, and a full audit trail of all reports and actions taken.
Yes. As this article explains, the global direction is consistent: evidenced effectiveness over documented intent. The EU Whistleblower Directive (2019/1937) applies to all private-sector organisations with 50+ employees across the EU. FINMA, the DOJ, and sector regulators are all converging on outcome-based oversight.
POLICIES, TRAININGS AND HOTLINE
Trusty Compliance App: company policies, compliance training and a whistleblowing channel in one app for your employees. 10 ready-made policies, 6 trainings, free trial, no IT setup.