Serious organised crime is not only a policing problem — it is a business risk. Legitimate companies are drawn into money laundering, targeted by fraud, and, since September 2025, exposed to a new corporate offence of failing to prevent fraud. This guide explains how organised crime reaches ordinary businesses, the money laundering and fraud liabilities that follow, the reasonable-procedures defence that protects a company, and the asset-recovery powers that sit behind the whole regime.
Understanding Serious Organised Crime and Business
Quick Answer — Why It Matters to Business
Serious organised crime affects legitimate businesses in three main ways: they can be used, knowingly or not, to launder criminal money; they are frequent targets of fraud; and large organisations now face criminal liability if they fail to prevent fraud committed for their benefit. The defence, in each case, is a documented, risk-based compliance framework.
The Organised Crime Threat to Business
Serious and organised crime in the UK is coordinated against by the National Crime Agency, established in 2013 to lead the national response. Its annual National Strategic Assessment consistently identifies money laundering, fraud, drugs and cybercrime among the most significant threats, and repeatedly makes the point that organised criminal networks depend on the legitimate economy — on real banks, businesses and professional services — to move and hide their money.
The scale of that dependence was laid bare by Operation Destabilise, which the NCA announced in December 2024. It disrupted multi-billion-dollar Russian money laundering networks that swapped criminal cash for cryptocurrency across borders, with links to drugs, ransomware and espionage, and led to dozens of arrests. The operation illustrated how organised crime routes its money through everyday commercial channels — and why businesses are on the front line whether they realise it or not.
Money Laundering Exposure for Businesses
The money laundering offences in the Proceeds of Crime Act 2002 — sections 327 to 329 — reach any business that deals with criminal property while knowing or suspecting what it is. A company does not have to be part of a criminal enterprise to be caught; it is enough to handle tainted money through a transaction, an arrangement or a payment. That is why money laundering is a mainstream commercial risk, not a niche one.
Businesses in the regulated sector — financial services, accountancy, legal services, estate agency and others — carry heavier duties under the Money Laundering Regulations, including customer due diligence and the obligation to submit suspicious activity reports. Failing to report a suspicion, or ignoring obvious red flags, can itself be an offence. For businesses, the practical safeguard is a genuine anti-money-laundering framework that is used, not merely written.
Fraud as a Business Risk
Fraud is now the most commonly experienced crime in England and Wales, and businesses are both victims and, increasingly, potential defendants. As victims, companies face invoice fraud, mandate fraud, procurement fraud and insider fraud, often enabled by the same organised networks that launder the proceeds. Strong internal controls, payment verification and staff awareness are the first line of defence.
The Serious Crime Act 2007 introduced serious crime prevention orders, which can impose restrictions on individuals or companies to prevent involvement in serious crime, and the Serious Crime Act 2015 created an offence of participating in the activities of an organised crime group. These powers sit alongside fraud prosecution and asset recovery, giving enforcement authorities a broad toolkit against those who enable organised crime.
Failure to Prevent Fraud: The Corporate Offence
The most important recent development for businesses is the new offence of failing to prevent fraud, created by the Economic Crime and Corporate Transparency Act 2023 and in force from 1 September 2025. A large organisation can be criminally liable where an employee or other associated person commits a specified fraud intending to benefit the organisation, unless it can show it had reasonable fraud prevention procedures in place.
The offence applies to large organisations — broadly those meeting two of three thresholds for turnover, balance sheet total and employee numbers. The Act also reformed corporate criminal liability more widely, making it easier to attribute the criminal conduct of senior managers to the company itself. Together these changes mean a company's own compliance failures, not just individual wrongdoing, can now found a prosecution.
The Reasonable Procedures Defence
The defence to the failure-to-prevent-fraud offence is having reasonable fraud prevention procedures. Government guidance sets out six principles that should shape them: top-level commitment, risk assessment, proportionate risk-based procedures, due diligence, communication and training, and monitoring and review. The critical practical point is documentation — a fraud risk assessment and a record of the procedures in place are what evidence the defence if fraud ever occurs.
Key Points — The Six Principles
Top-level commitment: leadership sets and owns the anti-fraud culture.
Risk assessment: a documented assessment of the organisation's fraud risks.
Proportionate procedures: controls matched to the level of risk.
Due diligence, training and monitoring: ongoing checks, staff awareness and regular review.
Asset Recovery Powers
Behind the criminal offences sits a wide asset-recovery regime. Confiscation orders strip the proceeds of crime after conviction; civil recovery allows property to be recovered in the High Court without a conviction; account freezing orders lock suspected criminal funds held in bank accounts; and unexplained wealth orders compel an explanation of how assets were obtained. The reach of these powers now extends expressly to cryptoassets.
For a business caught up in an investigation — even innocently — these powers can freeze accounts and tie up assets quickly. That makes early legal advice essential, both to protect legitimate property and to respond to any allegation on a proper footing. Our guides to POCA confiscation orders and unexplained wealth orders examine these mechanisms in detail, and our asset tracing and criminal defence team acts where they are deployed.
Frequently Asked Questions
How does serious organised crime affect legitimate businesses?
Businesses can be used to launder criminal money, are frequent targets of fraud, and — if they are large organisations — can now be criminally liable for failing to prevent fraud committed for their benefit. The common protection is a documented, risk-based compliance framework.
What is the failure to prevent fraud offence under ECCTA?
In force from 1 September 2025, it makes a large organisation criminally liable where an associated person commits a specified fraud intending to benefit it, unless the organisation had reasonable fraud prevention procedures in place. It was created by the Economic Crime and Corporate Transparency Act 2023.
Which organisations does the failure to prevent fraud offence apply to?
It applies to large organisations — broadly those meeting two of three thresholds for turnover, balance sheet total and number of employees. Smaller organisations are outside the offence, though they remain exposed to the underlying fraud and money laundering laws.
How common is fraud against UK businesses?
Fraud is the most commonly experienced crime in England and Wales, and businesses face invoice, mandate, procurement and insider fraud, often linked to organised networks. Payment controls, verification and staff awareness are the practical defences.
What was Operation Destabilise?
Announced by the National Crime Agency in December 2024, Operation Destabilise disrupted multi-billion-dollar Russian money laundering networks that exchanged criminal cash for cryptocurrency, with links to drugs, ransomware and espionage, leading to dozens of arrests. It showed how organised crime moves money through the legitimate economy.
Can businesses recover assets lost through fraud?
Yes. Businesses can pursue civil recovery, freezing injunctions and asset tracing to recover misappropriated funds, alongside any criminal investigation. Early action is important because dissipated assets — increasingly moved through cryptocurrency — become harder to trace over time.
What are the six principles of fraud prevention?
The government guidance sets out top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication and training, and monitoring and review. A documented framework built on these principles evidences the reasonable procedures defence.
When should a business seek legal advice?
Before a problem arises, to build a defensible compliance framework, and immediately if an investigation, account freezing order or fraud allegation emerges. Early advice protects legitimate assets and ensures any response is made on a proper legal footing.
Expert Business Crime Support
Compliance Frameworks
We help build and document the fraud and anti-money-laundering procedures that evidence the reasonable-procedures defence.
Investigation Response
We act quickly where an account freezing order or investigation threatens legitimate business assets.
Asset Recovery
We pursue civil recovery, tracing and freezing remedies to recover funds lost to fraud and organised crime.
Organised crime now reaches ordinary businesses through liability as well as loss — the business crime team at Connaught Law can protect your company before a problem arises and defend it if one does.
The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Connaught Law and authors accept no responsibility for loss that may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please don't hesitate to contact Connaught Law. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Connaught Law.
UK Serious Organised Crime 2026: Business Protection and Asset Recovery
Serious organised crime is not only a policing problem — it is a business risk. Legitimate companies are drawn into money laundering, targeted by fraud, and, since September 2025, exposed to a new corporate offence of failing to prevent fraud. This guide explains how organised crime reaches ordinary businesses, the money laundering and fraud liabilities that follow, the reasonable-procedures defence that protects a company, and the asset-recovery powers that sit behind the whole regime.
Understanding Serious Organised Crime and Business
Serious organised crime affects legitimate businesses in three main ways: they can be used, knowingly or not, to launder criminal money; they are frequent targets of fraud; and large organisations now face criminal liability if they fail to prevent fraud committed for their benefit. The defence, in each case, is a documented, risk-based compliance framework.
The Organised Crime Threat to Business
Serious and organised crime in the UK is coordinated against by the National Crime Agency, established in 2013 to lead the national response. Its annual National Strategic Assessment consistently identifies money laundering, fraud, drugs and cybercrime among the most significant threats, and repeatedly makes the point that organised criminal networks depend on the legitimate economy — on real banks, businesses and professional services — to move and hide their money.
The scale of that dependence was laid bare by Operation Destabilise, which the NCA announced in December 2024. It disrupted multi-billion-dollar Russian money laundering networks that swapped criminal cash for cryptocurrency across borders, with links to drugs, ransomware and espionage, and led to dozens of arrests. The operation illustrated how organised crime routes its money through everyday commercial channels — and why businesses are on the front line whether they realise it or not.
Money Laundering Exposure for Businesses
The money laundering offences in the Proceeds of Crime Act 2002 — sections 327 to 329 — reach any business that deals with criminal property while knowing or suspecting what it is. A company does not have to be part of a criminal enterprise to be caught; it is enough to handle tainted money through a transaction, an arrangement or a payment. That is why money laundering is a mainstream commercial risk, not a niche one.
Businesses in the regulated sector — financial services, accountancy, legal services, estate agency and others — carry heavier duties under the Money Laundering Regulations, including customer due diligence and the obligation to submit suspicious activity reports. Failing to report a suspicion, or ignoring obvious red flags, can itself be an offence. For businesses, the practical safeguard is a genuine anti-money-laundering framework that is used, not merely written.
Fraud as a Business Risk
Fraud is now the most commonly experienced crime in England and Wales, and businesses are both victims and, increasingly, potential defendants. As victims, companies face invoice fraud, mandate fraud, procurement fraud and insider fraud, often enabled by the same organised networks that launder the proceeds. Strong internal controls, payment verification and staff awareness are the first line of defence.
The Serious Crime Act 2007 introduced serious crime prevention orders, which can impose restrictions on individuals or companies to prevent involvement in serious crime, and the Serious Crime Act 2015 created an offence of participating in the activities of an organised crime group. These powers sit alongside fraud prosecution and asset recovery, giving enforcement authorities a broad toolkit against those who enable organised crime.
Failure to Prevent Fraud: The Corporate Offence
The most important recent development for businesses is the new offence of failing to prevent fraud, created by the Economic Crime and Corporate Transparency Act 2023 and in force from 1 September 2025. A large organisation can be criminally liable where an employee or other associated person commits a specified fraud intending to benefit the organisation, unless it can show it had reasonable fraud prevention procedures in place.
The offence applies to large organisations — broadly those meeting two of three thresholds for turnover, balance sheet total and employee numbers. The Act also reformed corporate criminal liability more widely, making it easier to attribute the criminal conduct of senior managers to the company itself. Together these changes mean a company's own compliance failures, not just individual wrongdoing, can now found a prosecution.
The Reasonable Procedures Defence
The defence to the failure-to-prevent-fraud offence is having reasonable fraud prevention procedures. Government guidance sets out six principles that should shape them: top-level commitment, risk assessment, proportionate risk-based procedures, due diligence, communication and training, and monitoring and review. The critical practical point is documentation — a fraud risk assessment and a record of the procedures in place are what evidence the defence if fraud ever occurs.
Asset Recovery Powers
Behind the criminal offences sits a wide asset-recovery regime. Confiscation orders strip the proceeds of crime after conviction; civil recovery allows property to be recovered in the High Court without a conviction; account freezing orders lock suspected criminal funds held in bank accounts; and unexplained wealth orders compel an explanation of how assets were obtained. The reach of these powers now extends expressly to cryptoassets.
For a business caught up in an investigation — even innocently — these powers can freeze accounts and tie up assets quickly. That makes early legal advice essential, both to protect legitimate property and to respond to any allegation on a proper footing. Our guides to POCA confiscation orders and unexplained wealth orders examine these mechanisms in detail, and our asset tracing and criminal defence team acts where they are deployed.
Frequently Asked Questions
How does serious organised crime affect legitimate businesses?
Businesses can be used to launder criminal money, are frequent targets of fraud, and — if they are large organisations — can now be criminally liable for failing to prevent fraud committed for their benefit. The common protection is a documented, risk-based compliance framework.
What is the failure to prevent fraud offence under ECCTA?
In force from 1 September 2025, it makes a large organisation criminally liable where an associated person commits a specified fraud intending to benefit it, unless the organisation had reasonable fraud prevention procedures in place. It was created by the Economic Crime and Corporate Transparency Act 2023.
Which organisations does the failure to prevent fraud offence apply to?
It applies to large organisations — broadly those meeting two of three thresholds for turnover, balance sheet total and number of employees. Smaller organisations are outside the offence, though they remain exposed to the underlying fraud and money laundering laws.
How common is fraud against UK businesses?
Fraud is the most commonly experienced crime in England and Wales, and businesses face invoice, mandate, procurement and insider fraud, often linked to organised networks. Payment controls, verification and staff awareness are the practical defences.
What was Operation Destabilise?
Announced by the National Crime Agency in December 2024, Operation Destabilise disrupted multi-billion-dollar Russian money laundering networks that exchanged criminal cash for cryptocurrency, with links to drugs, ransomware and espionage, leading to dozens of arrests. It showed how organised crime moves money through the legitimate economy.
Can businesses recover assets lost through fraud?
Yes. Businesses can pursue civil recovery, freezing injunctions and asset tracing to recover misappropriated funds, alongside any criminal investigation. Early action is important because dissipated assets — increasingly moved through cryptocurrency — become harder to trace over time.
What are the six principles of fraud prevention?
The government guidance sets out top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication and training, and monitoring and review. A documented framework built on these principles evidences the reasonable procedures defence.
When should a business seek legal advice?
Before a problem arises, to build a defensible compliance framework, and immediately if an investigation, account freezing order or fraud allegation emerges. Early advice protects legitimate assets and ensures any response is made on a proper legal footing.
We help build and document the fraud and anti-money-laundering procedures that evidence the reasonable-procedures defence.
We act quickly where an account freezing order or investigation threatens legitimate business assets.
We pursue civil recovery, tracing and freezing remedies to recover funds lost to fraud and organised crime.
Organised crime now reaches ordinary businesses through liability as well as loss — the business crime team at Connaught Law can protect your company before a problem arises and defend it if one does.
Speak to UsDisclaimer:
The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Connaught Law and authors accept no responsibility for loss that may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please don't hesitate to contact Connaught Law. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Connaught Law.